* [PATCH 6.17 001/563] arch: copy_thread: pass clone_flags as u64
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
@ 2025-10-13 14:37 ` Greg Kroah-Hartman
2025-10-13 14:37 ` [PATCH 6.17 002/563] filelock: add FL_RECLAIM to show_fl_flags() macro Greg Kroah-Hartman
` (575 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Simon Schuster,
Guo Ren (Alibaba Damo Academy), David Hildenbrand, Arnd Bergmann,
Christian Brauner, Sasha Levin, Andreas Larsson,
Geert Uytterhoeven
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Schuster <schuster.simon@siemens-energy.com>
[ Upstream commit bbc46b23af5bb934cd1cf066ef4342cee457a24e ]
With the introduction of clone3 in commit 7f192e3cd316 ("fork: add
clone3") the effective bit width of clone_flags on all architectures was
increased from 32-bit to 64-bit, with a new type of u64 for the flags.
However, for most consumers of clone_flags the interface was not
changed from the previous type of unsigned long.
While this works fine as long as none of the new 64-bit flag bits
(CLONE_CLEAR_SIGHAND and CLONE_INTO_CGROUP) are evaluated, this is still
undesirable in terms of the principle of least surprise.
Thus, this commit fixes all relevant interfaces of the copy_thread
function that is called from copy_process to consistently pass
clone_flags as u64, so that no truncation to 32-bit integers occurs on
32-bit architectures.
Signed-off-by: Simon Schuster <schuster.simon@siemens-energy.com>
Link: https://lore.kernel.org/20250901-nios2-implement-clone3-v2-3-53fcf5577d57@siemens-energy.com
Fixes: c5febea0956fd387 ("fork: Pass struct kernel_clone_args into copy_thread")
Acked-by: Guo Ren (Alibaba Damo Academy) <guoren@kernel.org>
Acked-by: Andreas Larsson <andreas@gaisler.com> # sparc
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> # m68k
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/kernel/process.c | 2 +-
arch/arc/kernel/process.c | 2 +-
arch/arm/kernel/process.c | 2 +-
arch/arm64/kernel/process.c | 2 +-
arch/csky/kernel/process.c | 2 +-
arch/hexagon/kernel/process.c | 2 +-
arch/loongarch/kernel/process.c | 2 +-
arch/m68k/kernel/process.c | 2 +-
arch/microblaze/kernel/process.c | 2 +-
arch/mips/kernel/process.c | 2 +-
arch/nios2/kernel/process.c | 2 +-
arch/openrisc/kernel/process.c | 2 +-
arch/parisc/kernel/process.c | 2 +-
arch/powerpc/kernel/process.c | 2 +-
arch/riscv/kernel/process.c | 2 +-
arch/s390/kernel/process.c | 2 +-
arch/sh/kernel/process_32.c | 2 +-
arch/sparc/kernel/process_32.c | 2 +-
arch/sparc/kernel/process_64.c | 2 +-
arch/um/kernel/process.c | 2 +-
arch/x86/include/asm/fpu/sched.h | 2 +-
arch/x86/include/asm/shstk.h | 4 ++--
arch/x86/kernel/fpu/core.c | 2 +-
arch/x86/kernel/process.c | 2 +-
arch/x86/kernel/shstk.c | 2 +-
arch/xtensa/kernel/process.c | 2 +-
26 files changed, 27 insertions(+), 27 deletions(-)
diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c
index 582d96548385d..06522451f018f 100644
--- a/arch/alpha/kernel/process.c
+++ b/arch/alpha/kernel/process.c
@@ -231,7 +231,7 @@ flush_thread(void)
*/
int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
{
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long usp = args->stack;
unsigned long tls = args->tls;
extern void ret_from_fork(void);
diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c
index 186ceab661eb0..8166d09087130 100644
--- a/arch/arc/kernel/process.c
+++ b/arch/arc/kernel/process.c
@@ -166,7 +166,7 @@ asmlinkage void ret_from_fork(void);
*/
int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
{
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long usp = args->stack;
unsigned long tls = args->tls;
struct pt_regs *c_regs; /* child's pt_regs */
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index e16ed102960cb..d7aa95225c70b 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -234,7 +234,7 @@ asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");
int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
{
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long stack_start = args->stack;
unsigned long tls = args->tls;
struct thread_info *thread = task_thread_info(p);
diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index 96482a1412c6a..fba7ca102a8c4 100644
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -409,7 +409,7 @@ asmlinkage void ret_from_fork(void) asm("ret_from_fork");
int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
{
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long stack_start = args->stack;
unsigned long tls = args->tls;
struct pt_regs *childregs = task_pt_regs(p);
diff --git a/arch/csky/kernel/process.c b/arch/csky/kernel/process.c
index 0c6e4b17fe00f..a7a90340042a5 100644
--- a/arch/csky/kernel/process.c
+++ b/arch/csky/kernel/process.c
@@ -32,7 +32,7 @@ void flush_thread(void){}
int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
{
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long usp = args->stack;
unsigned long tls = args->tls;
struct switch_stack *childstack;
diff --git a/arch/hexagon/kernel/process.c b/arch/hexagon/kernel/process.c
index 2a77bfd756945..15b4992bfa298 100644
--- a/arch/hexagon/kernel/process.c
+++ b/arch/hexagon/kernel/process.c
@@ -52,7 +52,7 @@ void arch_cpu_idle(void)
*/
int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
{
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long usp = args->stack;
unsigned long tls = args->tls;
struct thread_info *ti = task_thread_info(p);
diff --git a/arch/loongarch/kernel/process.c b/arch/loongarch/kernel/process.c
index 3582f591bab28..efd9edf65603c 100644
--- a/arch/loongarch/kernel/process.c
+++ b/arch/loongarch/kernel/process.c
@@ -167,7 +167,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
unsigned long childksp;
unsigned long tls = args->tls;
unsigned long usp = args->stack;
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
struct pt_regs *childregs, *regs = current_pt_regs();
childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE;
diff --git a/arch/m68k/kernel/process.c b/arch/m68k/kernel/process.c
index fda7eac23f872..f5a07a70e9385 100644
--- a/arch/m68k/kernel/process.c
+++ b/arch/m68k/kernel/process.c
@@ -141,7 +141,7 @@ asmlinkage int m68k_clone3(struct pt_regs *regs)
int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
{
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long usp = args->stack;
unsigned long tls = args->tls;
struct fork_frame {
diff --git a/arch/microblaze/kernel/process.c b/arch/microblaze/kernel/process.c
index 56342e11442d2..6cbf642d7b801 100644
--- a/arch/microblaze/kernel/process.c
+++ b/arch/microblaze/kernel/process.c
@@ -54,7 +54,7 @@ void flush_thread(void)
int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
{
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long usp = args->stack;
unsigned long tls = args->tls;
struct pt_regs *childregs = task_pt_regs(p);
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 02aa6a04a21da..29191fa1801e2 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -107,7 +107,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
*/
int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
{
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long usp = args->stack;
unsigned long tls = args->tls;
struct thread_info *ti = task_thread_info(p);
diff --git a/arch/nios2/kernel/process.c b/arch/nios2/kernel/process.c
index f84021303f6a8..151404139085c 100644
--- a/arch/nios2/kernel/process.c
+++ b/arch/nios2/kernel/process.c
@@ -101,7 +101,7 @@ void flush_thread(void)
int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
{
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long usp = args->stack;
unsigned long tls = args->tls;
struct pt_regs *childregs = task_pt_regs(p);
diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c
index eef99fee2110c..73ffb9fa3118b 100644
--- a/arch/openrisc/kernel/process.c
+++ b/arch/openrisc/kernel/process.c
@@ -165,7 +165,7 @@ extern asmlinkage void ret_from_fork(void);
int
copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
{
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long usp = args->stack;
unsigned long tls = args->tls;
struct pt_regs *userregs;
diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
index ed93bd8c15453..e64ab5d2a40d6 100644
--- a/arch/parisc/kernel/process.c
+++ b/arch/parisc/kernel/process.c
@@ -201,7 +201,7 @@ arch_initcall(parisc_idle_init);
int
copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
{
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long usp = args->stack;
unsigned long tls = args->tls;
struct pt_regs *cregs = &(p->thread.regs);
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 855e098865032..eb23966ac0a9f 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1805,7 +1805,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
f = ret_from_kernel_user_thread;
} else {
struct pt_regs *regs = current_pt_regs();
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long usp = args->stack;
/* Copy registers */
diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c
index a0a40889d79a5..31a392993cb45 100644
--- a/arch/riscv/kernel/process.c
+++ b/arch/riscv/kernel/process.c
@@ -223,7 +223,7 @@ asmlinkage void ret_from_fork_user(struct pt_regs *regs)
int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
{
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long usp = args->stack;
unsigned long tls = args->tls;
struct pt_regs *childregs = task_pt_regs(p);
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index f55f09cda6f88..b107dbca4ed7d 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -106,7 +106,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
{
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long new_stackp = args->stack;
unsigned long tls = args->tls;
struct fake_frame
diff --git a/arch/sh/kernel/process_32.c b/arch/sh/kernel/process_32.c
index 92b6649d49295..62f753a85b89c 100644
--- a/arch/sh/kernel/process_32.c
+++ b/arch/sh/kernel/process_32.c
@@ -89,7 +89,7 @@ asmlinkage void ret_from_kernel_thread(void);
int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
{
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long usp = args->stack;
unsigned long tls = args->tls;
struct thread_info *ti = task_thread_info(p);
diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
index 9c7c662cb5659..5a28c0e91bf15 100644
--- a/arch/sparc/kernel/process_32.c
+++ b/arch/sparc/kernel/process_32.c
@@ -260,7 +260,7 @@ extern void ret_from_kernel_thread(void);
int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
{
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long sp = args->stack;
unsigned long tls = args->tls;
struct thread_info *ti = task_thread_info(p);
diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
index 529adfecd58ca..25781923788a0 100644
--- a/arch/sparc/kernel/process_64.c
+++ b/arch/sparc/kernel/process_64.c
@@ -567,7 +567,7 @@ void fault_in_user_windows(struct pt_regs *regs)
*/
int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
{
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long sp = args->stack;
unsigned long tls = args->tls;
struct thread_info *t = task_thread_info(p);
diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
index 1be644de9e41e..9c9c66dc45f05 100644
--- a/arch/um/kernel/process.c
+++ b/arch/um/kernel/process.c
@@ -143,7 +143,7 @@ static void fork_handler(void)
int copy_thread(struct task_struct * p, const struct kernel_clone_args *args)
{
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long sp = args->stack;
unsigned long tls = args->tls;
void (*handler)(void);
diff --git a/arch/x86/include/asm/fpu/sched.h b/arch/x86/include/asm/fpu/sched.h
index c060549c6c940..89004f4ca208d 100644
--- a/arch/x86/include/asm/fpu/sched.h
+++ b/arch/x86/include/asm/fpu/sched.h
@@ -11,7 +11,7 @@
extern void save_fpregs_to_fpstate(struct fpu *fpu);
extern void fpu__drop(struct task_struct *tsk);
-extern int fpu_clone(struct task_struct *dst, unsigned long clone_flags, bool minimal,
+extern int fpu_clone(struct task_struct *dst, u64 clone_flags, bool minimal,
unsigned long shstk_addr);
extern void fpu_flush_thread(void);
diff --git a/arch/x86/include/asm/shstk.h b/arch/x86/include/asm/shstk.h
index ba6f2fe438488..0f50e01259430 100644
--- a/arch/x86/include/asm/shstk.h
+++ b/arch/x86/include/asm/shstk.h
@@ -16,7 +16,7 @@ struct thread_shstk {
long shstk_prctl(struct task_struct *task, int option, unsigned long arg2);
void reset_thread_features(void);
-unsigned long shstk_alloc_thread_stack(struct task_struct *p, unsigned long clone_flags,
+unsigned long shstk_alloc_thread_stack(struct task_struct *p, u64 clone_flags,
unsigned long stack_size);
void shstk_free(struct task_struct *p);
int setup_signal_shadow_stack(struct ksignal *ksig);
@@ -28,7 +28,7 @@ static inline long shstk_prctl(struct task_struct *task, int option,
unsigned long arg2) { return -EINVAL; }
static inline void reset_thread_features(void) {}
static inline unsigned long shstk_alloc_thread_stack(struct task_struct *p,
- unsigned long clone_flags,
+ u64 clone_flags,
unsigned long stack_size) { return 0; }
static inline void shstk_free(struct task_struct *p) {}
static inline int setup_signal_shadow_stack(struct ksignal *ksig) { return 0; }
diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c
index aefd412a23dc2..1f71cc135e9ad 100644
--- a/arch/x86/kernel/fpu/core.c
+++ b/arch/x86/kernel/fpu/core.c
@@ -631,7 +631,7 @@ static int update_fpu_shstk(struct task_struct *dst, unsigned long ssp)
}
/* Clone current's FPU state on fork */
-int fpu_clone(struct task_struct *dst, unsigned long clone_flags, bool minimal,
+int fpu_clone(struct task_struct *dst, u64 clone_flags, bool minimal,
unsigned long ssp)
{
/*
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 1b7960cf6eb0c..e3a3987b0c4fb 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -159,7 +159,7 @@ __visible void ret_from_fork(struct task_struct *prev, struct pt_regs *regs,
int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
{
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long sp = args->stack;
unsigned long tls = args->tls;
struct inactive_task_frame *frame;
diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c
index 2ddf23387c7ef..5eba6c5a67757 100644
--- a/arch/x86/kernel/shstk.c
+++ b/arch/x86/kernel/shstk.c
@@ -191,7 +191,7 @@ void reset_thread_features(void)
current->thread.features_locked = 0;
}
-unsigned long shstk_alloc_thread_stack(struct task_struct *tsk, unsigned long clone_flags,
+unsigned long shstk_alloc_thread_stack(struct task_struct *tsk, u64 clone_flags,
unsigned long stack_size)
{
struct thread_shstk *shstk = &tsk->thread.shstk;
diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c
index 7bd66677f7b6d..94d43f44be131 100644
--- a/arch/xtensa/kernel/process.c
+++ b/arch/xtensa/kernel/process.c
@@ -267,7 +267,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
{
- unsigned long clone_flags = args->flags;
+ u64 clone_flags = args->flags;
unsigned long usp_thread_fn = args->stack;
unsigned long tls = args->tls;
struct pt_regs *childregs = task_pt_regs(p);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 002/563] filelock: add FL_RECLAIM to show_fl_flags() macro
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
2025-10-13 14:37 ` [PATCH 6.17 001/563] arch: copy_thread: pass clone_flags as u64 Greg Kroah-Hartman
@ 2025-10-13 14:37 ` Greg Kroah-Hartman
2025-10-13 14:37 ` [PATCH 6.17 003/563] init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD Greg Kroah-Hartman
` (574 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeff Layton, Christian Brauner,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ]
Show the FL_RECLAIM flag symbolically in tracepoints.
Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims")
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://lore.kernel.org/20250903-filelock-v1-1-f2926902962d@kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/trace/events/filelock.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h
index b8d1e00a7982c..2dfeb158e848a 100644
--- a/include/trace/events/filelock.h
+++ b/include/trace/events/filelock.h
@@ -27,7 +27,8 @@
{ FL_SLEEP, "FL_SLEEP" }, \
{ FL_DOWNGRADE_PENDING, "FL_DOWNGRADE_PENDING" }, \
{ FL_UNLOCK_PENDING, "FL_UNLOCK_PENDING" }, \
- { FL_OFDLCK, "FL_OFDLCK" })
+ { FL_OFDLCK, "FL_OFDLCK" }, \
+ { FL_RECLAIM, "FL_RECLAIM"})
#define show_fl_type(val) \
__print_symbolic(val, \
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 003/563] init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
2025-10-13 14:37 ` [PATCH 6.17 001/563] arch: copy_thread: pass clone_flags as u64 Greg Kroah-Hartman
2025-10-13 14:37 ` [PATCH 6.17 002/563] filelock: add FL_RECLAIM to show_fl_flags() macro Greg Kroah-Hartman
@ 2025-10-13 14:37 ` Greg Kroah-Hartman
2025-10-13 14:37 ` [PATCH 6.17 004/563] pid: use ns_capable_noaudit() when determining net sysctl permissions Greg Kroah-Hartman
` (573 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Martin Wilck,
David Disseldorp, Christian Brauner, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit 74792608606a525a0e0df7e8d48acd8000561389 ]
INITRAMFS_PRESERVE_MTIME is only used in init/initramfs.c and
init/initramfs_test.c. Hence add a dependency on BLK_DEV_INITRD, to
prevent asking the user about this feature when configuring a kernel
without initramfs support.
Fixes: 1274aea127b2e8c9 ("initramfs: add INITRAMFS_PRESERVE_MTIME Kconfig option")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Martin Wilck <mwilck@suse.com>
Reviewed-by: David Disseldorp <ddiss@suse.de>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
init/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/init/Kconfig b/init/Kconfig
index ecddb94db8dc0..e5d6d798994ae 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1504,6 +1504,7 @@ config BOOT_CONFIG_EMBED_FILE
config INITRAMFS_PRESERVE_MTIME
bool "Preserve cpio archive mtimes in initramfs"
+ depends on BLK_DEV_INITRD
default y
help
Each entry in an initramfs cpio archive carries an mtime value. When
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 004/563] pid: use ns_capable_noaudit() when determining net sysctl permissions
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2025-10-13 14:37 ` [PATCH 6.17 003/563] init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD Greg Kroah-Hartman
@ 2025-10-13 14:37 ` Greg Kroah-Hartman
2025-10-13 14:37 ` [PATCH 6.17 005/563] Fix CC_HAS_ASM_GOTO_OUTPUT on non-x86 architectures Greg Kroah-Hartman
` (572 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Brauner,
linux-security-module, selinux, Christian Göttsche,
Serge Hallyn, Paul Moore, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Göttsche <cgzones@googlemail.com>
[ Upstream commit b9cb7e59ac4ae68940347ebfc41e0436d32d3c6e ]
The capability check should not be audited since it is only being used
to determine the inode permissions. A failed check does not indicate a
violation of security policy but, when an LSM is enabled, a denial audit
message was being generated.
The denial audit message can either lead to the capability being
unnecessarily allowed in a security policy, or being silenced potentially
masking a legitimate capability check at a later point in time.
Similar to commit d6169b0206db ("net: Use ns_capable_noaudit() when
determining net sysctl permissions")
Fixes: 7863dcc72d0f ("pid: allow pid_max to be set per pid namespace")
CC: Christian Brauner <brauner@kernel.org>
CC: linux-security-module@vger.kernel.org
CC: selinux@vger.kernel.org
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Acked-by: Serge Hallyn <serge@hallyn.com>
Reviewed-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/pid.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/pid.c b/kernel/pid.c
index c45a28c16cd25..d94ce02505012 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -680,7 +680,7 @@ static int pid_table_root_permissions(struct ctl_table_header *head,
container_of(head->set, struct pid_namespace, set);
int mode = table->mode;
- if (ns_capable(pidns->user_ns, CAP_SYS_ADMIN) ||
+ if (ns_capable_noaudit(pidns->user_ns, CAP_SYS_ADMIN) ||
uid_eq(current_euid(), make_kuid(pidns->user_ns, 0)))
mode = (mode & S_IRWXU) >> 6;
else if (in_egroup_p(make_kgid(pidns->user_ns, 0)))
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 005/563] Fix CC_HAS_ASM_GOTO_OUTPUT on non-x86 architectures
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2025-10-13 14:37 ` [PATCH 6.17 004/563] pid: use ns_capable_noaudit() when determining net sysctl permissions Greg Kroah-Hartman
@ 2025-10-13 14:37 ` Greg Kroah-Hartman
2025-10-13 14:37 ` [PATCH 6.17 006/563] seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast Greg Kroah-Hartman
` (571 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Zijlstra, Nathan Chancellor,
Thomas Gleixner, Linus Torvalds, Sasha Levin, Geert Uytterhoeven
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
[ Upstream commit fde0ab43b9a30d08817adc5402b69fec83a61cb8 ]
There's a silly problem with the CC_HAS_ASM_GOTO_OUTPUT test: even with
a working compiler it will fail on some architectures simply because it
uses the mnemonic "jmp" for testing the inline asm.
And as reported by Geert, not all architectures use that mnemonic, so
the test fails spuriously on such platforms (including arm and riscv,
but also several other architectures).
This issue avoided any obvious test failures because the build still
works thanks to falling back on the old non-asm-goto code, which just
generates worse code.
Just use an empty asm statement instead.
Reported-and-tested-by: Geert Uytterhoeven <geert@linux-m68k.org>
Suggested-by: Peter Zijlstra <peterz@infradead.org>
Fixes: e2ffa15b9baa ("kbuild: Disable CC_HAS_ASM_GOTO_OUTPUT on clang < 17")
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
init/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/init/Kconfig b/init/Kconfig
index e5d6d798994ae..87c868f86a060 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -102,7 +102,7 @@ config CC_HAS_ASM_GOTO_OUTPUT
# Detect basic support
depends on $(success,echo 'int foo(int x) { asm goto ("": "=r"(x) ::: bar); return x; bar: return 0; }' | $(CC) -x c - -c -o /dev/null)
# Detect clang (< v17) scoped label issues
- depends on $(success,echo 'void b(void **);void* c(void);int f(void){{asm goto("jmp %l0"::::l0);return 0;l0:return 1;}void *x __attribute__((cleanup(b)))=c();{asm goto("jmp %l0"::::l1);return 2;l1:return 3;}}' | $(CC) -x c - -c -o /dev/null)
+ depends on $(success,echo 'void b(void **);void* c(void);int f(void){{asm goto(""::::l0);return 0;l0:return 1;}void *x __attribute__((cleanup(b)))=c();{asm goto(""::::l1);return 2;l1:return 3;}}' | $(CC) -x c - -c -o /dev/null)
config CC_HAS_ASM_GOTO_TIED_OUTPUT
depends on CC_HAS_ASM_GOTO_OUTPUT
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 006/563] seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2025-10-13 14:37 ` [PATCH 6.17 005/563] Fix CC_HAS_ASM_GOTO_OUTPUT on non-x86 architectures Greg Kroah-Hartman
@ 2025-10-13 14:37 ` Greg Kroah-Hartman
2025-10-13 14:37 ` [PATCH 6.17 007/563] kbuild: Add missing $(objtree) prefix to powerpc crtsavres.o artifact Greg Kroah-Hartman
` (570 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ali Polatel, Johannes Nixdorf,
Kees Cook, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Nixdorf <johannes@nixdorf.dev>
[ Upstream commit cce436aafc2abad691fdd37de63ec8a4490b42ce ]
Normally the tracee starts in SECCOMP_NOTIFY_INIT, sends an
event to the tracer, and starts to wait interruptibly. With
SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV, if the tracer receives the
message (SECCOMP_NOTIFY_SENT is reached) while the tracee was waiting
and is subsequently interrupted, the tracee begins to wait again
uninterruptibly (but killable).
This fails if SECCOMP_NOTIFY_REPLIED is reached before the tracee
is interrupted, as the check only considered SECCOMP_NOTIFY_SENT as a
condition to begin waiting again. In this case the tracee is interrupted
even though the tracer already acted on its behalf. This breaks the
assumption SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV wanted to ensure,
namely that the tracer can be sure the syscall is not interrupted or
restarted on the tracee after it is received on the tracer. Fix this
by also considering SECCOMP_NOTIFY_REPLIED when evaluating whether to
switch to uninterruptible waiting.
With the condition changed the loop in seccomp_do_user_notification()
would exit immediately after deciding that noninterruptible waiting
is required if the operation already reached SECCOMP_NOTIFY_REPLIED,
skipping the code that processes pending addfd commands first. Prevent
this by executing the remaining loop body one last time in this case.
Fixes: c2aa2dfef243 ("seccomp: Add wait_killable semantic to seccomp user notifier")
Reported-by: Ali Polatel <alip@chesswob.org>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220291
Signed-off-by: Johannes Nixdorf <johannes@nixdorf.dev>
Link: https://lore.kernel.org/r/20250725-seccomp-races-v2-1-cf8b9d139596@nixdorf.dev
Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/seccomp.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 41aa761c7738c..3bbfba30a777a 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1139,7 +1139,7 @@ static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_kn
static bool should_sleep_killable(struct seccomp_filter *match,
struct seccomp_knotif *n)
{
- return match->wait_killable_recv && n->state == SECCOMP_NOTIFY_SENT;
+ return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT;
}
static int seccomp_do_user_notification(int this_syscall,
@@ -1186,13 +1186,11 @@ static int seccomp_do_user_notification(int this_syscall,
if (err != 0) {
/*
- * Check to see if the notifcation got picked up and
- * whether we should switch to wait killable.
+ * Check to see whether we should switch to wait
+ * killable. Only return the interrupted error if not.
*/
- if (!wait_killable && should_sleep_killable(match, &n))
- continue;
-
- goto interrupted;
+ if (!(!wait_killable && should_sleep_killable(match, &n)))
+ goto interrupted;
}
addfd = list_first_entry_or_null(&n.addfd,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 007/563] kbuild: Add missing $(objtree) prefix to powerpc crtsavres.o artifact
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2025-10-13 14:37 ` [PATCH 6.17 006/563] seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast Greg Kroah-Hartman
@ 2025-10-13 14:37 ` Greg Kroah-Hartman
2025-10-13 14:37 ` [PATCH 6.17 008/563] selftests: arm64: Check fread return value in exec_target Greg Kroah-Hartman
` (569 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masahiro Yamada, Nicolas Schier,
Kienan Stewart, Madhavan Srinivasan, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kienan Stewart <kstewart@efficios.com>
[ Upstream commit 46104a7d3ccd2acfe508e661393add0615c27a22 ]
In the upstream commit 214c0eea43b2ea66bcd6467ea57e47ce8874191b
("kbuild: add $(objtree)/ prefix to some in-kernel build artifacts")
artifacts required for building out-of-tree kernel modules had
$(objtree) prepended to them to prepare for building in other
directories.
When building external modules for powerpc,
arch/powerpc/lib/crtsavres.o is required for certain
configurations. This artifact is missing the prepended $(objtree).
Fixes: 13b25489b6f8 ("kbuild: change working directory to external module directory with M=")
Acked-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Nicolas Schier <n.schier@avm.de>
Tested-by: Nicolas Schier <n.schier@avm.de>
Signed-off-by: Kienan Stewart <kstewart@efficios.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20250218-buildfix-extmod-powerpc-v2-1-1e78fcf12b56@efficios.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index 9753fb87217c3..a58b1029592ce 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -58,7 +58,7 @@ ifeq ($(CONFIG_PPC64)$(CONFIG_LD_IS_BFD),yy)
# There is a corresponding test in arch/powerpc/lib/Makefile
KBUILD_LDFLAGS_MODULE += --save-restore-funcs
else
-KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o
+KBUILD_LDFLAGS_MODULE += $(objtree)/arch/powerpc/lib/crtsavres.o
endif
ifdef CONFIG_CPU_LITTLE_ENDIAN
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 008/563] selftests: arm64: Check fread return value in exec_target
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2025-10-13 14:37 ` [PATCH 6.17 007/563] kbuild: Add missing $(objtree) prefix to powerpc crtsavres.o artifact Greg Kroah-Hartman
@ 2025-10-13 14:37 ` Greg Kroah-Hartman
2025-10-13 14:37 ` [PATCH 6.17 009/563] selftests: arm64: Fix -Waddress warning in tpidr2 test Greg Kroah-Hartman
` (568 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bala-Vignesh-Reddy, Mark Brown,
Will Deacon, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ]
Fix -Wunused-result warning generated when compiled with gcc 13.3.0,
by checking fread's return value and handling errors, preventing
potential failures when reading from stdin.
Fixes compiler warning:
warning: ignoring return value of 'fread' declared with attribute
'warn_unused_result' [-Wunused-result]
Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys")
Signed-off-by: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
Reviewed-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c
index 4435600ca400d..e597861b26d6b 100644
--- a/tools/testing/selftests/arm64/pauth/exec_target.c
+++ b/tools/testing/selftests/arm64/pauth/exec_target.c
@@ -13,7 +13,12 @@ int main(void)
unsigned long hwcaps;
size_t val;
- fread(&val, sizeof(size_t), 1, stdin);
+ size_t size = fread(&val, sizeof(size_t), 1, stdin);
+
+ if (size != 1) {
+ fprintf(stderr, "Could not read input from stdin\n");
+ return EXIT_FAILURE;
+ }
/* don't try to execute illegal (unimplemented) instructions) caller
* should have checked this and keep worker simple
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 009/563] selftests: arm64: Fix -Waddress warning in tpidr2 test
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2025-10-13 14:37 ` [PATCH 6.17 008/563] selftests: arm64: Check fread return value in exec_target Greg Kroah-Hartman
@ 2025-10-13 14:37 ` Greg Kroah-Hartman
2025-10-13 14:37 ` [PATCH 6.17 010/563] kselftest/arm64/gcs: Correctly check return value when disabling GCS Greg Kroah-Hartman
` (567 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bala-Vignesh-Reddy,
Anshuman Khandual, Mark Brown, Will Deacon, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
[ Upstream commit 50af02425afc72b1b47c4a0a0b9c9bdaa1a1b347 ]
Thanks to -Waddress, the compiler warns that the ksft_test_result()
invocations in the arm64 tpidr2 selftest are always true. Oops.
Fix the test by, err, actually running the test functions.
Fixes: 6d80cb73131d ("kselftest/arm64: Convert tpidr2 test to use kselftest.h")
Signed-off-by: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Reviewed-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/arm64/abi/tpidr2.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/tools/testing/selftests/arm64/abi/tpidr2.c b/tools/testing/selftests/arm64/abi/tpidr2.c
index f58a9f89b952c..4c89ab0f10101 100644
--- a/tools/testing/selftests/arm64/abi/tpidr2.c
+++ b/tools/testing/selftests/arm64/abi/tpidr2.c
@@ -227,10 +227,10 @@ int main(int argc, char **argv)
ret = open("/proc/sys/abi/sme_default_vector_length", O_RDONLY, 0);
if (ret >= 0) {
ksft_test_result(default_value(), "default_value\n");
- ksft_test_result(write_read, "write_read\n");
- ksft_test_result(write_sleep_read, "write_sleep_read\n");
- ksft_test_result(write_fork_read, "write_fork_read\n");
- ksft_test_result(write_clone_read, "write_clone_read\n");
+ ksft_test_result(write_read(), "write_read\n");
+ ksft_test_result(write_sleep_read(), "write_sleep_read\n");
+ ksft_test_result(write_fork_read(), "write_fork_read\n");
+ ksft_test_result(write_clone_read(), "write_clone_read\n");
} else {
ksft_print_msg("SME support not present\n");
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 010/563] kselftest/arm64/gcs: Correctly check return value when disabling GCS
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2025-10-13 14:37 ` [PATCH 6.17 009/563] selftests: arm64: Fix -Waddress warning in tpidr2 test Greg Kroah-Hartman
@ 2025-10-13 14:37 ` Greg Kroah-Hartman
2025-10-13 14:37 ` [PATCH 6.17 011/563] hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() Greg Kroah-Hartman
` (566 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh, Mark Brown,
Will Deacon, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <linux@weissschuh.net>
[ Upstream commit 740cdafd0d998903c1faeee921028a8a78698be5 ]
The return value was not assigned to 'ret', so the check afterwards
does not do anything.
Fixes: 3d37d4307e0f ("kselftest/arm64: Add very basic GCS test program")
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Reviewed-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/arm64/gcs/basic-gcs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/arm64/gcs/basic-gcs.c b/tools/testing/selftests/arm64/gcs/basic-gcs.c
index 54f9c888249d7..100d2a983155f 100644
--- a/tools/testing/selftests/arm64/gcs/basic-gcs.c
+++ b/tools/testing/selftests/arm64/gcs/basic-gcs.c
@@ -410,7 +410,7 @@ int main(void)
}
/* One last test: disable GCS, we can do this one time */
- my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS, 0, 0, 0, 0);
+ ret = my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS, 0, 0, 0, 0);
if (ret != 0)
ksft_print_msg("Failed to disable GCS: %d\n", ret);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 011/563] hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2025-10-13 14:37 ` [PATCH 6.17 010/563] kselftest/arm64/gcs: Correctly check return value when disabling GCS Greg Kroah-Hartman
@ 2025-10-13 14:37 ` Greg Kroah-Hartman
2025-10-13 14:37 ` [PATCH 6.17 012/563] gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote Greg Kroah-Hartman
` (565 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kang Chen, Viacheslav Dubeyko,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kang Chen <k.chen@smail.nju.edu.cn>
[ Upstream commit bea3e1d4467bcf292c8e54f080353d556d355e26 ]
BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0xa71/0xb90 fs/hfsplus/unicode.c:186
Read of size 2 at addr ffff8880289ef218 by task syz.6.248/14290
CPU: 0 UID: 0 PID: 14290 Comm: syz.6.248 Not tainted 6.16.4 #1 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x5f0 mm/kasan/report.c:482
kasan_report+0xca/0x100 mm/kasan/report.c:595
hfsplus_uni2asc+0xa71/0xb90 fs/hfsplus/unicode.c:186
hfsplus_listxattr+0x5b6/0xbd0 fs/hfsplus/xattr.c:738
vfs_listxattr+0xbe/0x140 fs/xattr.c:493
listxattr+0xee/0x190 fs/xattr.c:924
filename_listxattr fs/xattr.c:958 [inline]
path_listxattrat+0x143/0x360 fs/xattr.c:988
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcb/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe0e9fae16d
Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe0eae67f98 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3
RAX: ffffffffffffffda RBX: 00007fe0ea205fa0 RCX: 00007fe0e9fae16d
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000
RBP: 00007fe0ea0480f0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe0ea206038 R14: 00007fe0ea205fa0 R15: 00007fe0eae48000
</TASK>
Allocated by task 14290:
kasan_save_stack+0x24/0x50 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4333 [inline]
__kmalloc_noprof+0x219/0x540 mm/slub.c:4345
kmalloc_noprof include/linux/slab.h:909 [inline]
hfsplus_find_init+0x95/0x1f0 fs/hfsplus/bfind.c:21
hfsplus_listxattr+0x331/0xbd0 fs/hfsplus/xattr.c:697
vfs_listxattr+0xbe/0x140 fs/xattr.c:493
listxattr+0xee/0x190 fs/xattr.c:924
filename_listxattr fs/xattr.c:958 [inline]
path_listxattrat+0x143/0x360 fs/xattr.c:988
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcb/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
When hfsplus_uni2asc is called from hfsplus_listxattr,
it actually passes in a struct hfsplus_attr_unistr*.
The size of the corresponding structure is different from that of hfsplus_unistr,
so the previous fix (94458781aee6) is insufficient.
The pointer on the unicode buffer is still going beyond the allocated memory.
This patch introduces two warpper functions hfsplus_uni2asc_xattr_str and
hfsplus_uni2asc_str to process two unicode buffers,
struct hfsplus_attr_unistr* and struct hfsplus_unistr* respectively.
When ustrlen value is bigger than the allocated memory size,
the ustrlen value is limited to an safe size.
Fixes: 94458781aee6 ("hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()")
Signed-off-by: Kang Chen <k.chen@smail.nju.edu.cn>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/20250909031316.1647094-1-k.chen@smail.nju.edu.cn
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/hfsplus/dir.c | 2 +-
fs/hfsplus/hfsplus_fs.h | 8 ++++++--
fs/hfsplus/unicode.c | 24 +++++++++++++++++++-----
fs/hfsplus/xattr.c | 6 +++---
4 files changed, 29 insertions(+), 11 deletions(-)
diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
index 876bbb80fb4dc..1b3e27a0d5e03 100644
--- a/fs/hfsplus/dir.c
+++ b/fs/hfsplus/dir.c
@@ -204,7 +204,7 @@ static int hfsplus_readdir(struct file *file, struct dir_context *ctx)
fd.entrylength);
type = be16_to_cpu(entry.type);
len = NLS_MAX_CHARSET_SIZE * HFSPLUS_MAX_STRLEN;
- err = hfsplus_uni2asc(sb, &fd.key->cat.name, strbuf, &len);
+ err = hfsplus_uni2asc_str(sb, &fd.key->cat.name, strbuf, &len);
if (err)
goto out;
if (type == HFSPLUS_FOLDER) {
diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
index 96a5c24813dd6..2311e4be4e865 100644
--- a/fs/hfsplus/hfsplus_fs.h
+++ b/fs/hfsplus/hfsplus_fs.h
@@ -521,8 +521,12 @@ int hfsplus_strcasecmp(const struct hfsplus_unistr *s1,
const struct hfsplus_unistr *s2);
int hfsplus_strcmp(const struct hfsplus_unistr *s1,
const struct hfsplus_unistr *s2);
-int hfsplus_uni2asc(struct super_block *sb, const struct hfsplus_unistr *ustr,
- char *astr, int *len_p);
+int hfsplus_uni2asc_str(struct super_block *sb,
+ const struct hfsplus_unistr *ustr, char *astr,
+ int *len_p);
+int hfsplus_uni2asc_xattr_str(struct super_block *sb,
+ const struct hfsplus_attr_unistr *ustr,
+ char *astr, int *len_p);
int hfsplus_asc2uni(struct super_block *sb, struct hfsplus_unistr *ustr,
int max_unistr_len, const char *astr, int len);
int hfsplus_hash_dentry(const struct dentry *dentry, struct qstr *str);
diff --git a/fs/hfsplus/unicode.c b/fs/hfsplus/unicode.c
index 36b6cf2a3abba..862ba27f1628a 100644
--- a/fs/hfsplus/unicode.c
+++ b/fs/hfsplus/unicode.c
@@ -119,9 +119,8 @@ static u16 *hfsplus_compose_lookup(u16 *p, u16 cc)
return NULL;
}
-int hfsplus_uni2asc(struct super_block *sb,
- const struct hfsplus_unistr *ustr,
- char *astr, int *len_p)
+static int hfsplus_uni2asc(struct super_block *sb, const struct hfsplus_unistr *ustr,
+ int max_len, char *astr, int *len_p)
{
const hfsplus_unichr *ip;
struct nls_table *nls = HFSPLUS_SB(sb)->nls;
@@ -134,8 +133,8 @@ int hfsplus_uni2asc(struct super_block *sb,
ip = ustr->unicode;
ustrlen = be16_to_cpu(ustr->length);
- if (ustrlen > HFSPLUS_MAX_STRLEN) {
- ustrlen = HFSPLUS_MAX_STRLEN;
+ if (ustrlen > max_len) {
+ ustrlen = max_len;
pr_err("invalid length %u has been corrected to %d\n",
be16_to_cpu(ustr->length), ustrlen);
}
@@ -256,6 +255,21 @@ int hfsplus_uni2asc(struct super_block *sb,
return res;
}
+inline int hfsplus_uni2asc_str(struct super_block *sb,
+ const struct hfsplus_unistr *ustr, char *astr,
+ int *len_p)
+{
+ return hfsplus_uni2asc(sb, ustr, HFSPLUS_MAX_STRLEN, astr, len_p);
+}
+
+inline int hfsplus_uni2asc_xattr_str(struct super_block *sb,
+ const struct hfsplus_attr_unistr *ustr,
+ char *astr, int *len_p)
+{
+ return hfsplus_uni2asc(sb, (const struct hfsplus_unistr *)ustr,
+ HFSPLUS_ATTR_MAX_STRLEN, astr, len_p);
+}
+
/*
* Convert one or more ASCII characters into a single unicode character.
* Returns the number of ASCII characters corresponding to the unicode char.
diff --git a/fs/hfsplus/xattr.c b/fs/hfsplus/xattr.c
index 18dc3d254d218..c951fa9835aa1 100644
--- a/fs/hfsplus/xattr.c
+++ b/fs/hfsplus/xattr.c
@@ -735,9 +735,9 @@ ssize_t hfsplus_listxattr(struct dentry *dentry, char *buffer, size_t size)
goto end_listxattr;
xattr_name_len = NLS_MAX_CHARSET_SIZE * HFSPLUS_ATTR_MAX_STRLEN;
- if (hfsplus_uni2asc(inode->i_sb,
- (const struct hfsplus_unistr *)&fd.key->attr.key_name,
- strbuf, &xattr_name_len)) {
+ if (hfsplus_uni2asc_xattr_str(inode->i_sb,
+ &fd.key->attr.key_name, strbuf,
+ &xattr_name_len)) {
pr_err("unicode conversion failed\n");
res = -EIO;
goto end_listxattr;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 012/563] gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2025-10-13 14:37 ` [PATCH 6.17 011/563] hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() Greg Kroah-Hartman
@ 2025-10-13 14:37 ` Greg Kroah-Hartman
2025-10-13 14:37 ` [PATCH 6.17 013/563] gfs2: Remove space before newline Greg Kroah-Hartman
` (564 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Gruenbacher, Andrew Price,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <agruenba@redhat.com>
[ Upstream commit 061df28b82af6b22fb5fa529a8f2ef00474ee004 ]
Commit 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount")
added a statement to do_xmote() to clear the GLF_INVALIDATE_IN_PROGRESS
flag a second time after it has already been cleared. Fix that.
Fixes: 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount")
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Reviewed-by: Andrew Price <anprice@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/glock.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index b6fd1cb17de7b..edb105f9da059 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -805,8 +805,6 @@ __acquires(&gl->gl_lockref.lock)
clear_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags);
gfs2_glock_queue_work(gl, GL_GLOCK_DFT_HOLD);
return;
- } else {
- clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 013/563] gfs2: Remove space before newline
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2025-10-13 14:37 ` [PATCH 6.17 012/563] gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote Greg Kroah-Hartman
@ 2025-10-13 14:37 ` Greg Kroah-Hartman
2025-10-13 14:37 ` [PATCH 6.17 014/563] gfs2: Further sanitize lock_dlm.c Greg Kroah-Hartman
` (563 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Colin Ian King, Andreas Gruenbacher,
Andrew Price, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <colin.i.king@gmail.com>
[ Upstream commit aa94ad9ab230d08741e6630a20fd1296b52c1009 ]
There is an extraneous space before a newline in a fs_err message.
Remove it
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Reviewed-by: Andrew Price <anprice@redhat.com>
Stable-dep-of: bddb53b776fb ("gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/glock.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index edb105f9da059..3d5cf9c24d78b 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -733,7 +733,7 @@ __acquires(&gl->gl_lockref.lock)
*/
if (ret) {
if (cmpxchg(&sdp->sd_log_error, 0, ret)) {
- fs_err(sdp, "Error %d syncing glock \n", ret);
+ fs_err(sdp, "Error %d syncing glock\n", ret);
gfs2_dump_glock(NULL, gl, true);
}
spin_lock(&gl->gl_lockref.lock);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 014/563] gfs2: Further sanitize lock_dlm.c
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2025-10-13 14:37 ` [PATCH 6.17 013/563] gfs2: Remove space before newline Greg Kroah-Hartman
@ 2025-10-13 14:37 ` Greg Kroah-Hartman
2025-10-13 14:37 ` [PATCH 6.17 015/563] gfs2: Fix LM_FLAG_TRY* logic in add_to_queue Greg Kroah-Hartman
` (562 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Gruenbacher, Andrew Price,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <agruenba@redhat.com>
[ Upstream commit fd70ab7155c4b92a9747d42c02791a0793ab9c66 ]
The gl_req field and GLF_BLOCKING flag are only relevant to gdlm_lock(),
its callback gdlm_ast(), and their helpers, so set and clear them inside
lock_dlm.c.
Also, the LM_FLAG_ANY flag is relevant to gdlm_lock(), but do_xmote()
doesn't pass that flag down to gdlm_lock() as it should. Fix that by
passing down all the flags.
In addition, document the effect of the LM_FLAG_ANY flag on locks held
in EX mode locally.
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Reviewed-by: Andrew Price <anprice@redhat.com>
Stable-dep-of: bddb53b776fb ("gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/glock.c | 6 ------
fs/gfs2/glock.h | 4 ++++
fs/gfs2/lock_dlm.c | 26 ++++++++++++++++++--------
3 files changed, 22 insertions(+), 14 deletions(-)
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 3d5cf9c24d78b..45dd73bb884fd 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -715,12 +715,6 @@ __acquires(&gl->gl_lockref.lock)
return;
do_error(gl, 0); /* Fail queued try locks */
}
- gl->gl_req = target;
- set_bit(GLF_BLOCKING, &gl->gl_flags);
- if ((gl->gl_req == LM_ST_UNLOCKED) ||
- (gl->gl_state == LM_ST_EXCLUSIVE) ||
- (lck_flags & (LM_FLAG_TRY|LM_FLAG_TRY_1CB)))
- clear_bit(GLF_BLOCKING, &gl->gl_flags);
if (!glops->go_inval && !glops->go_sync)
goto skip_inval;
diff --git a/fs/gfs2/glock.h b/fs/gfs2/glock.h
index 9339a3bff6eeb..d041b922b45e3 100644
--- a/fs/gfs2/glock.h
+++ b/fs/gfs2/glock.h
@@ -68,6 +68,10 @@ enum {
* also be granted in SHARED. The preferred state is whichever is compatible
* with other granted locks, or the specified state if no other locks exist.
*
+ * In addition, when a lock is already held in EX mode locally, a SHARED or
+ * DEFERRED mode request with the LM_FLAG_ANY flag set will be granted.
+ * (The LM_FLAG_ANY flag is only use for SHARED mode requests currently.)
+ *
* LM_FLAG_NODE_SCOPE
* This holder agrees to share the lock within this node. In other words,
* the glock is held in EX mode according to DLM, but local holders on the
diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
index cee5d199d2d87..5daaeaaaf18dd 100644
--- a/fs/gfs2/lock_dlm.c
+++ b/fs/gfs2/lock_dlm.c
@@ -58,6 +58,7 @@ static inline void gfs2_update_stats(struct gfs2_lkstats *s, unsigned index,
/**
* gfs2_update_reply_times - Update locking statistics
* @gl: The glock to update
+ * @blocking: The operation may have been blocking
*
* This assumes that gl->gl_dstamp has been set earlier.
*
@@ -72,12 +73,12 @@ static inline void gfs2_update_stats(struct gfs2_lkstats *s, unsigned index,
* TRY_1CB flags are set are classified as non-blocking. All
* other DLM requests are counted as (potentially) blocking.
*/
-static inline void gfs2_update_reply_times(struct gfs2_glock *gl)
+static inline void gfs2_update_reply_times(struct gfs2_glock *gl,
+ bool blocking)
{
struct gfs2_pcpu_lkstats *lks;
const unsigned gltype = gl->gl_name.ln_type;
- unsigned index = test_bit(GLF_BLOCKING, &gl->gl_flags) ?
- GFS2_LKS_SRTTB : GFS2_LKS_SRTT;
+ unsigned index = blocking ? GFS2_LKS_SRTTB : GFS2_LKS_SRTT;
s64 rtt;
preempt_disable();
@@ -119,14 +120,18 @@ static inline void gfs2_update_request_times(struct gfs2_glock *gl)
static void gdlm_ast(void *arg)
{
struct gfs2_glock *gl = arg;
+ bool blocking;
unsigned ret;
+ blocking = test_bit(GLF_BLOCKING, &gl->gl_flags);
+ gfs2_update_reply_times(gl, blocking);
+ clear_bit(GLF_BLOCKING, &gl->gl_flags);
+
/* If the glock is dead, we only react to a dlm_unlock() reply. */
if (__lockref_is_dead(&gl->gl_lockref) &&
gl->gl_lksb.sb_status != -DLM_EUNLOCK)
return;
- gfs2_update_reply_times(gl);
BUG_ON(gl->gl_lksb.sb_flags & DLM_SBF_DEMOTED);
if ((gl->gl_lksb.sb_flags & DLM_SBF_VALNOTVALID) && gl->gl_lksb.sb_lvbptr)
@@ -241,7 +246,7 @@ static bool down_conversion(int cur, int req)
}
static u32 make_flags(struct gfs2_glock *gl, const unsigned int gfs_flags,
- const int cur, const int req)
+ const int req, bool blocking)
{
u32 lkf = 0;
@@ -274,7 +279,7 @@ static u32 make_flags(struct gfs2_glock *gl, const unsigned int gfs_flags,
* "upward" lock conversions or else DLM will reject the
* request as invalid.
*/
- if (!down_conversion(cur, req))
+ if (blocking)
lkf |= DLM_LKF_QUECVT;
}
@@ -294,14 +299,20 @@ static int gdlm_lock(struct gfs2_glock *gl, unsigned int req_state,
unsigned int flags)
{
struct lm_lockstruct *ls = &gl->gl_name.ln_sbd->sd_lockstruct;
+ bool blocking;
int cur, req;
u32 lkf;
char strname[GDLM_STRNAME_BYTES] = "";
int error;
+ gl->gl_req = req_state;
cur = make_mode(gl->gl_name.ln_sbd, gl->gl_state);
req = make_mode(gl->gl_name.ln_sbd, req_state);
- lkf = make_flags(gl, flags, cur, req);
+ blocking = !down_conversion(cur, req) &&
+ !(flags & (LM_FLAG_TRY|LM_FLAG_TRY_1CB));
+ lkf = make_flags(gl, flags, req, blocking);
+ if (blocking)
+ set_bit(GLF_BLOCKING, &gl->gl_flags);
gfs2_glstats_inc(gl, GFS2_LKS_DCOUNT);
gfs2_sbstats_inc(gl, GFS2_LKS_DCOUNT);
if (test_bit(GLF_INITIAL, &gl->gl_flags)) {
@@ -341,7 +352,6 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
return;
}
- clear_bit(GLF_BLOCKING, &gl->gl_flags);
gfs2_glstats_inc(gl, GFS2_LKS_DCOUNT);
gfs2_sbstats_inc(gl, GFS2_LKS_DCOUNT);
gfs2_update_request_times(gl);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 015/563] gfs2: Fix LM_FLAG_TRY* logic in add_to_queue
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2025-10-13 14:37 ` [PATCH 6.17 014/563] gfs2: Further sanitize lock_dlm.c Greg Kroah-Hartman
@ 2025-10-13 14:37 ` Greg Kroah-Hartman
2025-10-13 14:37 ` [PATCH 6.17 016/563] gfs2: Remove duplicate check in do_xmote Greg Kroah-Hartman
` (561 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Gruenbacher, Andrew Price,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <agruenba@redhat.com>
[ Upstream commit 0c23e24164d83086e75581b0cf930f4e161636d6 ]
The logic in add_to_queue() for determining whether a LM_FLAG_TRY or
LM_FLAG_TRY_1CB holder should be queued does not make any sense: we are
interested in wether or not the new operation will block behind an
existing or future holder in the queue, but the current code checks for
ongoing locking or ->go_inval() operations, which has little to do with
that.
Replace that code with something more sensible, remove the incorrect
add_to_queue() function annotations, remove the similarly misguided
do_error(gl, 0) call in do_xmote(), and add a missing comment to the
same call in do_promote().
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Reviewed-by: Andrew Price <anprice@redhat.com>
Stable-dep-of: bddb53b776fb ("gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/glock.c | 47 ++++++++++++++++++++++++-----------------------
1 file changed, 24 insertions(+), 23 deletions(-)
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 45dd73bb884fd..5edf125b39fe3 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -502,7 +502,7 @@ static bool do_promote(struct gfs2_glock *gl)
*/
if (list_is_first(&gh->gh_list, &gl->gl_holders))
return false;
- do_error(gl, 0);
+ do_error(gl, 0); /* Fail queued try locks */
break;
}
set_bit(HIF_HOLDER, &gh->gh_iflags);
@@ -713,7 +713,6 @@ __acquires(&gl->gl_lockref.lock)
if (test_and_set_bit(GLF_INVALIDATE_IN_PROGRESS,
&gl->gl_flags))
return;
- do_error(gl, 0); /* Fail queued try locks */
}
if (!glops->go_inval && !glops->go_sync)
goto skip_inval;
@@ -1454,6 +1453,24 @@ void gfs2_print_dbg(struct seq_file *seq, const char *fmt, ...)
va_end(args);
}
+static bool gfs2_should_queue_trylock(struct gfs2_glock *gl,
+ struct gfs2_holder *gh)
+{
+ struct gfs2_holder *current_gh, *gh2;
+
+ current_gh = find_first_holder(gl);
+ if (current_gh && !may_grant(gl, current_gh, gh))
+ return false;
+
+ list_for_each_entry(gh2, &gl->gl_holders, gh_list) {
+ if (test_bit(HIF_HOLDER, &gh2->gh_iflags))
+ continue;
+ if (!(gh2->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB)))
+ return false;
+ }
+ return true;
+}
+
static inline bool pid_is_meaningful(const struct gfs2_holder *gh)
{
if (!(gh->gh_flags & GL_NOPID))
@@ -1472,27 +1489,20 @@ static inline bool pid_is_meaningful(const struct gfs2_holder *gh)
*/
static inline void add_to_queue(struct gfs2_holder *gh)
-__releases(&gl->gl_lockref.lock)
-__acquires(&gl->gl_lockref.lock)
{
struct gfs2_glock *gl = gh->gh_gl;
struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
struct gfs2_holder *gh2;
- int try_futile = 0;
GLOCK_BUG_ON(gl, gh->gh_owner_pid == NULL);
if (test_and_set_bit(HIF_WAIT, &gh->gh_iflags))
GLOCK_BUG_ON(gl, true);
- if (gh->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB)) {
- if (test_bit(GLF_LOCK, &gl->gl_flags)) {
- struct gfs2_holder *current_gh;
-
- current_gh = find_first_holder(gl);
- try_futile = !may_grant(gl, current_gh, gh);
- }
- if (test_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags))
- goto fail;
+ if ((gh->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB)) &&
+ !gfs2_should_queue_trylock(gl, gh)) {
+ gh->gh_error = GLR_TRYFAILED;
+ gfs2_holder_wake(gh);
+ return;
}
list_for_each_entry(gh2, &gl->gl_holders, gh_list) {
@@ -1504,15 +1514,6 @@ __acquires(&gl->gl_lockref.lock)
continue;
goto trap_recursive;
}
- list_for_each_entry(gh2, &gl->gl_holders, gh_list) {
- if (try_futile &&
- !(gh2->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB))) {
-fail:
- gh->gh_error = GLR_TRYFAILED;
- gfs2_holder_wake(gh);
- return;
- }
- }
trace_gfs2_glock_queue(gh, 1);
gfs2_glstats_inc(gl, GFS2_LKS_QCOUNT);
gfs2_sbstats_inc(gl, GFS2_LKS_QCOUNT);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 016/563] gfs2: Remove duplicate check in do_xmote
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2025-10-13 14:37 ` [PATCH 6.17 015/563] gfs2: Fix LM_FLAG_TRY* logic in add_to_queue Greg Kroah-Hartman
@ 2025-10-13 14:37 ` Greg Kroah-Hartman
2025-10-13 14:37 ` [PATCH 6.17 017/563] gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS Greg Kroah-Hartman
` (560 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Gruenbacher, Andrew Price,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <agruenba@redhat.com>
[ Upstream commit 9b54770b68ae793a3a8d378be4cda2bb7be6c8cc ]
In do_xmote(), remove the duplicate check for the ->go_sync and
->go_inval glock operations. They are either both defined, or none of
them are.
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Reviewed-by: Andrew Price <anprice@redhat.com>
Stable-dep-of: bddb53b776fb ("gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/glock.c | 27 +++++++++++++--------------
1 file changed, 13 insertions(+), 14 deletions(-)
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 5edf125b39fe3..93aae10d78f30 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -714,25 +714,24 @@ __acquires(&gl->gl_lockref.lock)
&gl->gl_flags))
return;
}
- if (!glops->go_inval && !glops->go_sync)
+ if (!glops->go_inval || !glops->go_sync)
goto skip_inval;
spin_unlock(&gl->gl_lockref.lock);
- if (glops->go_sync) {
- ret = glops->go_sync(gl);
- /* If we had a problem syncing (due to io errors or whatever,
- * we should not invalidate the metadata or tell dlm to
- * release the glock to other nodes.
- */
- if (ret) {
- if (cmpxchg(&sdp->sd_log_error, 0, ret)) {
- fs_err(sdp, "Error %d syncing glock\n", ret);
- gfs2_dump_glock(NULL, gl, true);
- }
- spin_lock(&gl->gl_lockref.lock);
- goto skip_inval;
+ ret = glops->go_sync(gl);
+ /* If we had a problem syncing (due to io errors or whatever,
+ * we should not invalidate the metadata or tell dlm to
+ * release the glock to other nodes.
+ */
+ if (ret) {
+ if (cmpxchg(&sdp->sd_log_error, 0, ret)) {
+ fs_err(sdp, "Error %d syncing glock\n", ret);
+ gfs2_dump_glock(NULL, gl, true);
}
+ spin_lock(&gl->gl_lockref.lock);
+ goto skip_inval;
}
+
if (test_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags)) {
/*
* The call to go_sync should have cleared out the ail list.
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 017/563] gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2025-10-13 14:37 ` [PATCH 6.17 016/563] gfs2: Remove duplicate check in do_xmote Greg Kroah-Hartman
@ 2025-10-13 14:37 ` Greg Kroah-Hartman
2025-10-13 14:37 ` [PATCH 6.17 018/563] gfs2: do_xmote cleanup Greg Kroah-Hartman
` (559 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Gruenbacher, Andrew Price,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <agruenba@redhat.com>
[ Upstream commit bddb53b776fb7ce81dfba7c24884d9f2c0c68e50 ]
Get rid of the GLF_INVALIDATE_IN_PROGRESS flag: it was originally used
to indicate to add_to_queue() that the ->go_sync() and ->go_invalid()
operations were in progress, but as we have established in commit "gfs2:
Fix LM_FLAG_TRY* logic in add_to_queue", add_to_queue() has no need to
know.
Commit d99724c3c36a describes a race in which GLF_INVALIDATE_IN_PROGRESS
is used to serialize two processes which are both in do_xmote() at the
same time. That analysis is wrong: the serialization happens via the
GLF_LOCK flag, which ensures that at most one glock operation can be
active at any time.
Fixes: d99724c3c36a ("gfs2: Close timing window with GLF_INVALIDATE_IN_PROGRESS")
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Reviewed-by: Andrew Price <anprice@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/glock.c | 16 +---------------
fs/gfs2/incore.h | 1 -
fs/gfs2/trace_gfs2.h | 1 -
3 files changed, 1 insertion(+), 17 deletions(-)
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 93aae10d78f30..68e943e13dd53 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -703,17 +703,6 @@ __acquires(&gl->gl_lockref.lock)
lck_flags &= (LM_FLAG_TRY | LM_FLAG_TRY_1CB | LM_FLAG_NOEXP);
GLOCK_BUG_ON(gl, gl->gl_state == target);
GLOCK_BUG_ON(gl, gl->gl_state == gl->gl_target);
- if ((target == LM_ST_UNLOCKED || target == LM_ST_DEFERRED) &&
- glops->go_inval) {
- /*
- * If another process is already doing the invalidate, let that
- * finish first. The glock state machine will get back to this
- * holder again later.
- */
- if (test_and_set_bit(GLF_INVALIDATE_IN_PROGRESS,
- &gl->gl_flags))
- return;
- }
if (!glops->go_inval || !glops->go_sync)
goto skip_inval;
@@ -732,7 +721,7 @@ __acquires(&gl->gl_lockref.lock)
goto skip_inval;
}
- if (test_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags)) {
+ if (target == LM_ST_UNLOCKED || target == LM_ST_DEFERRED) {
/*
* The call to go_sync should have cleared out the ail list.
* If there are still items, we have a problem. We ought to
@@ -747,7 +736,6 @@ __acquires(&gl->gl_lockref.lock)
gfs2_dump_glock(NULL, gl, true);
}
glops->go_inval(gl, target == LM_ST_DEFERRED ? 0 : DIO_METADATA);
- clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags);
}
spin_lock(&gl->gl_lockref.lock);
@@ -2313,8 +2301,6 @@ static const char *gflags2str(char *buf, const struct gfs2_glock *gl)
*p++ = 'y';
if (test_bit(GLF_LFLUSH, gflags))
*p++ = 'f';
- if (test_bit(GLF_INVALIDATE_IN_PROGRESS, gflags))
- *p++ = 'i';
if (test_bit(GLF_PENDING_REPLY, gflags))
*p++ = 'R';
if (test_bit(GLF_HAVE_REPLY, gflags))
diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
index d4ad82f47eeea..c390f208654c1 100644
--- a/fs/gfs2/incore.h
+++ b/fs/gfs2/incore.h
@@ -319,7 +319,6 @@ enum {
GLF_DEMOTE_IN_PROGRESS = 5,
GLF_DIRTY = 6,
GLF_LFLUSH = 7,
- GLF_INVALIDATE_IN_PROGRESS = 8,
GLF_HAVE_REPLY = 9,
GLF_INITIAL = 10,
GLF_HAVE_FROZEN_REPLY = 11,
diff --git a/fs/gfs2/trace_gfs2.h b/fs/gfs2/trace_gfs2.h
index 26036ffc3f338..1c2507a273180 100644
--- a/fs/gfs2/trace_gfs2.h
+++ b/fs/gfs2/trace_gfs2.h
@@ -52,7 +52,6 @@
{(1UL << GLF_DEMOTE_IN_PROGRESS), "p" }, \
{(1UL << GLF_DIRTY), "y" }, \
{(1UL << GLF_LFLUSH), "f" }, \
- {(1UL << GLF_INVALIDATE_IN_PROGRESS), "i" }, \
{(1UL << GLF_PENDING_REPLY), "R" }, \
{(1UL << GLF_HAVE_REPLY), "r" }, \
{(1UL << GLF_INITIAL), "a" }, \
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 018/563] gfs2: do_xmote cleanup
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2025-10-13 14:37 ` [PATCH 6.17 017/563] gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS Greg Kroah-Hartman
@ 2025-10-13 14:37 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 019/563] gfs2: Add proper lockspace locking Greg Kroah-Hartman
` (558 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Gruenbacher, Andrew Price,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <agruenba@redhat.com>
[ Upstream commit 2309a01351e56446f43c89e200d643647d47e739 ]
Check for asynchronous completion and clear the GLF_PENDING_REPLY flag
earlier in do_xmote(). This will make future changes more readable.
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Reviewed-by: Andrew Price <anprice@redhat.com>
Stable-dep-of: 6ab26555c9ff ("gfs2: Add proper lockspace locking")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/glock.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 68e943e13dd53..54c011ff00ddc 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -794,6 +794,12 @@ __acquires(&gl->gl_lockref.lock)
ret = ls->ls_ops->lm_lock(gl, target, lck_flags);
spin_lock(&gl->gl_lockref.lock);
+ if (!ret) {
+ /* The operation will be completed asynchronously. */
+ return;
+ }
+ clear_bit(GLF_PENDING_REPLY, &gl->gl_flags);
+
if (ret == -EINVAL && gl->gl_target == LM_ST_UNLOCKED &&
target == LM_ST_UNLOCKED &&
test_bit(DFL_UNMOUNT, &ls->ls_recover_flags)) {
@@ -801,14 +807,10 @@ __acquires(&gl->gl_lockref.lock)
* The lockspace has been released and the lock has
* been unlocked implicitly.
*/
- } else if (ret) {
+ } else {
fs_err(sdp, "lm_lock ret %d\n", ret);
target = gl->gl_state | LM_OUT_ERROR;
- } else {
- /* The operation will be completed asynchronously. */
- return;
}
- clear_bit(GLF_PENDING_REPLY, &gl->gl_flags);
}
/* Complete the operation now. */
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 019/563] gfs2: Add proper lockspace locking
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2025-10-13 14:37 ` [PATCH 6.17 018/563] gfs2: do_xmote cleanup Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 020/563] powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler Greg Kroah-Hartman
` (557 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Gruenbacher, Andrew Price,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <agruenba@redhat.com>
[ Upstream commit 6ab26555c9ffef96c56ca16356e55ac5ab61ec93 ]
GFS2 has been calling functions like dlm_lock() even after the lockspace
that these functions operate on has been released with
dlm_release_lockspace(). It has always assumed that those functions
would return -EINVAL in that case, but that was never guaranteed, and it
certainly is no longer the case since commit 4db41bf4f04f ("dlm: remove
ls_local_handle from struct dlm_ls").
To fix that, add proper lockspace locking.
Fixes: 3e11e5304150 ("GFS2: ignore unlock failures after withdraw")
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Reviewed-by: Andrew Price <anprice@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/file.c | 23 +++++++++++++++--------
fs/gfs2/glock.c | 5 ++---
fs/gfs2/incore.h | 2 ++
fs/gfs2/lock_dlm.c | 46 +++++++++++++++++++++++++++++++++++++---------
4 files changed, 56 insertions(+), 20 deletions(-)
diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
index 72d95185a39f6..bc67fa058c845 100644
--- a/fs/gfs2/file.c
+++ b/fs/gfs2/file.c
@@ -1442,6 +1442,7 @@ static int gfs2_lock(struct file *file, int cmd, struct file_lock *fl)
struct gfs2_inode *ip = GFS2_I(file->f_mapping->host);
struct gfs2_sbd *sdp = GFS2_SB(file->f_mapping->host);
struct lm_lockstruct *ls = &sdp->sd_lockstruct;
+ int ret;
if (!(fl->c.flc_flags & FL_POSIX))
return -ENOLCK;
@@ -1450,14 +1451,20 @@ static int gfs2_lock(struct file *file, int cmd, struct file_lock *fl)
locks_lock_file_wait(file, fl);
return -EIO;
}
- if (cmd == F_CANCELLK)
- return dlm_posix_cancel(ls->ls_dlm, ip->i_no_addr, file, fl);
- else if (IS_GETLK(cmd))
- return dlm_posix_get(ls->ls_dlm, ip->i_no_addr, file, fl);
- else if (lock_is_unlock(fl))
- return dlm_posix_unlock(ls->ls_dlm, ip->i_no_addr, file, fl);
- else
- return dlm_posix_lock(ls->ls_dlm, ip->i_no_addr, file, cmd, fl);
+ down_read(&ls->ls_sem);
+ ret = -ENODEV;
+ if (likely(ls->ls_dlm != NULL)) {
+ if (cmd == F_CANCELLK)
+ ret = dlm_posix_cancel(ls->ls_dlm, ip->i_no_addr, file, fl);
+ else if (IS_GETLK(cmd))
+ ret = dlm_posix_get(ls->ls_dlm, ip->i_no_addr, file, fl);
+ else if (lock_is_unlock(fl))
+ ret = dlm_posix_unlock(ls->ls_dlm, ip->i_no_addr, file, fl);
+ else
+ ret = dlm_posix_lock(ls->ls_dlm, ip->i_no_addr, file, cmd, fl);
+ }
+ up_read(&ls->ls_sem);
+ return ret;
}
static void __flock_holder_uninit(struct file *file, struct gfs2_holder *fl_gh)
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 54c011ff00ddc..a6535413a0b46 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -800,9 +800,8 @@ __acquires(&gl->gl_lockref.lock)
}
clear_bit(GLF_PENDING_REPLY, &gl->gl_flags);
- if (ret == -EINVAL && gl->gl_target == LM_ST_UNLOCKED &&
- target == LM_ST_UNLOCKED &&
- test_bit(DFL_UNMOUNT, &ls->ls_recover_flags)) {
+ if (ret == -ENODEV && gl->gl_target == LM_ST_UNLOCKED &&
+ target == LM_ST_UNLOCKED) {
/*
* The lockspace has been released and the lock has
* been unlocked implicitly.
diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
index c390f208654c1..3fcb7ab198d47 100644
--- a/fs/gfs2/incore.h
+++ b/fs/gfs2/incore.h
@@ -657,6 +657,8 @@ struct lm_lockstruct {
struct completion ls_sync_wait; /* {control,mounted}_{lock,unlock} */
char *ls_lvb_bits;
+ struct rw_semaphore ls_sem;
+
spinlock_t ls_recover_spin; /* protects following fields */
unsigned long ls_recover_flags; /* DFL_ */
uint32_t ls_recover_mount; /* gen in first recover_done cb */
diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
index 5daaeaaaf18dd..6db37c20587d1 100644
--- a/fs/gfs2/lock_dlm.c
+++ b/fs/gfs2/lock_dlm.c
@@ -329,8 +329,13 @@ static int gdlm_lock(struct gfs2_glock *gl, unsigned int req_state,
*/
again:
- error = dlm_lock(ls->ls_dlm, req, &gl->gl_lksb, lkf, strname,
- GDLM_STRNAME_BYTES - 1, 0, gdlm_ast, gl, gdlm_bast);
+ down_read(&ls->ls_sem);
+ error = -ENODEV;
+ if (likely(ls->ls_dlm != NULL)) {
+ error = dlm_lock(ls->ls_dlm, req, &gl->gl_lksb, lkf, strname,
+ GDLM_STRNAME_BYTES - 1, 0, gdlm_ast, gl, gdlm_bast);
+ }
+ up_read(&ls->ls_sem);
if (error == -EBUSY) {
msleep(20);
goto again;
@@ -379,8 +384,13 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
flags |= DLM_LKF_VALBLK;
again:
- error = dlm_unlock(ls->ls_dlm, gl->gl_lksb.sb_lkid, flags,
- NULL, gl);
+ down_read(&ls->ls_sem);
+ error = -ENODEV;
+ if (likely(ls->ls_dlm != NULL)) {
+ error = dlm_unlock(ls->ls_dlm, gl->gl_lksb.sb_lkid, flags,
+ NULL, gl);
+ }
+ up_read(&ls->ls_sem);
if (error == -EBUSY) {
msleep(20);
goto again;
@@ -396,7 +406,12 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
static void gdlm_cancel(struct gfs2_glock *gl)
{
struct lm_lockstruct *ls = &gl->gl_name.ln_sbd->sd_lockstruct;
- dlm_unlock(ls->ls_dlm, gl->gl_lksb.sb_lkid, DLM_LKF_CANCEL, NULL, gl);
+
+ down_read(&ls->ls_sem);
+ if (likely(ls->ls_dlm != NULL)) {
+ dlm_unlock(ls->ls_dlm, gl->gl_lksb.sb_lkid, DLM_LKF_CANCEL, NULL, gl);
+ }
+ up_read(&ls->ls_sem);
}
/*
@@ -577,7 +592,11 @@ static int sync_unlock(struct gfs2_sbd *sdp, struct dlm_lksb *lksb, char *name)
struct lm_lockstruct *ls = &sdp->sd_lockstruct;
int error;
- error = dlm_unlock(ls->ls_dlm, lksb->sb_lkid, 0, lksb, ls);
+ down_read(&ls->ls_sem);
+ error = -ENODEV;
+ if (likely(ls->ls_dlm != NULL))
+ error = dlm_unlock(ls->ls_dlm, lksb->sb_lkid, 0, lksb, ls);
+ up_read(&ls->ls_sem);
if (error) {
fs_err(sdp, "%s lkid %x error %d\n",
name, lksb->sb_lkid, error);
@@ -604,9 +623,14 @@ static int sync_lock(struct gfs2_sbd *sdp, int mode, uint32_t flags,
memset(strname, 0, GDLM_STRNAME_BYTES);
snprintf(strname, GDLM_STRNAME_BYTES, "%8x%16x", LM_TYPE_NONDISK, num);
- error = dlm_lock(ls->ls_dlm, mode, lksb, flags,
- strname, GDLM_STRNAME_BYTES - 1,
- 0, sync_wait_cb, ls, NULL);
+ down_read(&ls->ls_sem);
+ error = -ENODEV;
+ if (likely(ls->ls_dlm != NULL)) {
+ error = dlm_lock(ls->ls_dlm, mode, lksb, flags,
+ strname, GDLM_STRNAME_BYTES - 1,
+ 0, sync_wait_cb, ls, NULL);
+ }
+ up_read(&ls->ls_sem);
if (error) {
fs_err(sdp, "%s lkid %x flags %x mode %d error %d\n",
name, lksb->sb_lkid, flags, mode, error);
@@ -1333,6 +1357,7 @@ static int gdlm_mount(struct gfs2_sbd *sdp, const char *table)
*/
INIT_DELAYED_WORK(&sdp->sd_control_work, gfs2_control_func);
+ ls->ls_dlm = NULL;
spin_lock_init(&ls->ls_recover_spin);
ls->ls_recover_flags = 0;
ls->ls_recover_mount = 0;
@@ -1367,6 +1392,7 @@ static int gdlm_mount(struct gfs2_sbd *sdp, const char *table)
* create/join lockspace
*/
+ init_rwsem(&ls->ls_sem);
error = dlm_new_lockspace(fsname, cluster, flags, GDLM_LVB_SIZE,
&gdlm_lockspace_ops, sdp, &ops_result,
&ls->ls_dlm);
@@ -1446,10 +1472,12 @@ static void gdlm_unmount(struct gfs2_sbd *sdp)
/* mounted_lock and control_lock will be purged in dlm recovery */
release:
+ down_write(&ls->ls_sem);
if (ls->ls_dlm) {
dlm_release_lockspace(ls->ls_dlm, 2);
ls->ls_dlm = NULL;
}
+ up_write(&ls->ls_sem);
free_recover_size(ls);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 020/563] powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 019/563] gfs2: Add proper lockspace locking Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 021/563] powerpc/603: Really copy kernel PGD entries into all PGDIRs Greg Kroah-Hartman
` (556 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe Leroy,
Madhavan Srinivasan, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <christophe.leroy@csgroup.eu>
[ Upstream commit d9e46de4bf5c5f987075afd5f240bb2a8a5d71ed ]
Commit ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in
DTLB misses") removed the test that needed the valeur in SPRN_EPN but
failed to remove the read.
Remove it.
And remove related comments, including the very same comment
in InstructionTLBMiss that should have been removed by
commit 33c527522f39 ("powerpc/8xx: Inconditionally use task PGDIR in
ITLB misses").
Also update the comment about absence of a second level table which
has been handled implicitely since commit 5ddb75cee5af ("powerpc/8xx:
remove tests on PGDIR entry validity").
Fixes: ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in DTLB misses")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/5811c8d1d6187f280ad140d6c0ad6010e41eeaeb.1755361995.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/head_8xx.S | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
index 56c5ebe21b99a..613606400ee99 100644
--- a/arch/powerpc/kernel/head_8xx.S
+++ b/arch/powerpc/kernel/head_8xx.S
@@ -162,7 +162,7 @@ instruction_counter:
* For the MPC8xx, this is a software tablewalk to load the instruction
* TLB. The task switch loads the M_TWB register with the pointer to the first
* level table.
- * If we discover there is no second level table (value is zero) or if there
+ * If there is no second level table (value is zero) or if there
* is an invalid pte, we load that into the TLB, which causes another fault
* into the TLB Error interrupt where we can handle such problems.
* We have to use the MD_xxx registers for the tablewalk because the
@@ -183,9 +183,6 @@ instruction_counter:
mtspr SPRN_SPRG_SCRATCH2, r10
mtspr SPRN_M_TW, r11
- /* If we are faulting a kernel address, we have to use the
- * kernel page tables.
- */
mfspr r10, SPRN_SRR0 /* Get effective address of fault */
INVALIDATE_ADJACENT_PAGES_CPU15(r10, r11)
mtspr SPRN_MD_EPN, r10
@@ -228,10 +225,6 @@ instruction_counter:
mtspr SPRN_SPRG_SCRATCH2, r10
mtspr SPRN_M_TW, r11
- /* If we are faulting a kernel address, we have to use the
- * kernel page tables.
- */
- mfspr r10, SPRN_MD_EPN
mfspr r10, SPRN_M_TWB /* Get level 1 table */
lwz r11, (swapper_pg_dir-PAGE_OFFSET)@l(r10) /* Get level 1 entry */
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 021/563] powerpc/603: Really copy kernel PGD entries into all PGDIRs
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 020/563] powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 022/563] powerpc/ftrace: ensure ftrace record ops are always set for NOPs Greg Kroah-Hartman
` (555 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe Leroy,
Madhavan Srinivasan, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <christophe.leroy@csgroup.eu>
[ Upstream commit f2863371f017eb03c230addc253783fa4c7e90f5 ]
Commit 82ef440f9a38 ("powerpc/603: Copy kernel PGD entries into all
PGDIRs and preallocate execmem page tables") was supposed to extend
to powerpc 603 the copy of kernel PGD entries into all PGDIRs
implemented in a previous patch on the 8xx. But 603 is book3s/32 and
uses a duplicate of pgd_alloc() defined in another header.
So really do the copy at the correct place for the 603.
Fixes: 82ef440f9a38 ("powerpc/603: Copy kernel PGD entries into all PGDIRs and preallocate execmem page tables")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/752ab7514cae089a2dd7cc0f3d5e35849f76adb9.1755757797.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/include/asm/book3s/32/pgalloc.h | 10 ++++++++--
arch/powerpc/include/asm/nohash/pgalloc.h | 2 +-
2 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/arch/powerpc/include/asm/book3s/32/pgalloc.h b/arch/powerpc/include/asm/book3s/32/pgalloc.h
index dd4eb30631758..f4390704d5ba2 100644
--- a/arch/powerpc/include/asm/book3s/32/pgalloc.h
+++ b/arch/powerpc/include/asm/book3s/32/pgalloc.h
@@ -7,8 +7,14 @@
static inline pgd_t *pgd_alloc(struct mm_struct *mm)
{
- return kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
- pgtable_gfp_flags(mm, GFP_KERNEL));
+ pgd_t *pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
+ pgtable_gfp_flags(mm, GFP_KERNEL));
+
+#ifdef CONFIG_PPC_BOOK3S_603
+ memcpy(pgd + USER_PTRS_PER_PGD, swapper_pg_dir + USER_PTRS_PER_PGD,
+ (MAX_PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t));
+#endif
+ return pgd;
}
static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
diff --git a/arch/powerpc/include/asm/nohash/pgalloc.h b/arch/powerpc/include/asm/nohash/pgalloc.h
index bb5f3e8ea912d..4ef780b291bc3 100644
--- a/arch/powerpc/include/asm/nohash/pgalloc.h
+++ b/arch/powerpc/include/asm/nohash/pgalloc.h
@@ -22,7 +22,7 @@ static inline pgd_t *pgd_alloc(struct mm_struct *mm)
pgd_t *pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
pgtable_gfp_flags(mm, GFP_KERNEL));
-#if defined(CONFIG_PPC_8xx) || defined(CONFIG_PPC_BOOK3S_603)
+#ifdef CONFIG_PPC_8xx
memcpy(pgd + USER_PTRS_PER_PGD, swapper_pg_dir + USER_PTRS_PER_PGD,
(MAX_PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t));
#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 022/563] powerpc/ftrace: ensure ftrace record ops are always set for NOPs
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 021/563] powerpc/603: Really copy kernel PGD entries into all PGDIRs Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 023/563] powerpc64/modules: correctly iterate over stubs in setup_ftrace_ool_stubs Greg Kroah-Hartman
` (554 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Naveen N Rao, Joe Lawrence,
Madhavan Srinivasan, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Lawrence <joe.lawrence@redhat.com>
[ Upstream commit 5337609a314828aa2474ac359db615f475c4a4d2 ]
When an ftrace call site is converted to a NOP, its corresponding
dyn_ftrace record should have its ftrace_ops pointer set to
ftrace_nop_ops.
Correct the powerpc implementation to ensure the
ftrace_rec_set_nop_ops() helper is called on all successful NOP
initialization paths. This ensures all ftrace records are consistent
before being handled by the ftrace core.
Fixes: eec37961a56a ("powerpc64/ftrace: Move ftrace sequence out of line")
Suggested-by: Naveen N Rao <naveen@kernel.org>
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
Acked-by: Naveen N Rao (AMD) <naveen@kernel.org>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20250912142740.3581368-2-joe.lawrence@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/trace/ftrace.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/arch/powerpc/kernel/trace/ftrace.c b/arch/powerpc/kernel/trace/ftrace.c
index 6dca92d5a6e82..841d077e28251 100644
--- a/arch/powerpc/kernel/trace/ftrace.c
+++ b/arch/powerpc/kernel/trace/ftrace.c
@@ -488,8 +488,10 @@ int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec)
return ret;
/* Set up out-of-line stub */
- if (IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE))
- return ftrace_init_ool_stub(mod, rec);
+ if (IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE)) {
+ ret = ftrace_init_ool_stub(mod, rec);
+ goto out;
+ }
/* Nop-out the ftrace location */
new = ppc_inst(PPC_RAW_NOP());
@@ -520,6 +522,10 @@ int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec)
return -EINVAL;
}
+out:
+ if (!ret)
+ ret = ftrace_rec_set_nop_ops(rec);
+
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 023/563] powerpc64/modules: correctly iterate over stubs in setup_ftrace_ool_stubs
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 022/563] powerpc/ftrace: ensure ftrace record ops are always set for NOPs Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 024/563] uprobes: uprobe_warn should use passed task Greg Kroah-Hartman
` (553 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joe Lawrence, Naveen N Rao (AMD),
Madhavan Srinivasan, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Lawrence <joe.lawrence@redhat.com>
[ Upstream commit f6b4df37ebfeb47e50e27780500d2d06b4d211bd ]
CONFIG_PPC_FTRACE_OUT_OF_LINE introduced setup_ftrace_ool_stubs() to
extend the ppc64le module .stubs section with an array of
ftrace_ool_stub structures for each patchable function.
Fix its ppc64_stub_entry stub reservation loop to properly write across
all of the num_stubs used and not just the first entry.
Fixes: eec37961a56a ("powerpc64/ftrace: Move ftrace sequence out of line")
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
Acked-by: Naveen N Rao (AMD) <naveen@kernel.org>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20250912142740.3581368-3-joe.lawrence@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/module_64.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c
index 126bf3b06ab7e..0e45cac4de76b 100644
--- a/arch/powerpc/kernel/module_64.c
+++ b/arch/powerpc/kernel/module_64.c
@@ -1139,7 +1139,7 @@ static int setup_ftrace_ool_stubs(const Elf64_Shdr *sechdrs, unsigned long addr,
/* reserve stubs */
for (i = 0; i < num_stubs; i++)
- if (patch_u32((void *)&stub->funcdata, PPC_RAW_NOP()))
+ if (patch_u32((void *)&stub[i].funcdata, PPC_RAW_NOP()))
return -1;
#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 024/563] uprobes: uprobe_warn should use passed task
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 023/563] powerpc64/modules: correctly iterate over stubs in setup_ftrace_ool_stubs Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 025/563] raid6: riscv: Clean up unused header file inclusion Greg Kroah-Hartman
` (552 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeremy Linton, Catalin Marinas,
Oleg Nesterov, Masami Hiramatsu (Google), Will Deacon,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremy Linton <jeremy.linton@arm.com>
[ Upstream commit ba1afc94deb849eab843a372b969444581add2c9 ]
uprobe_warn() is passed a task structure, yet its using current. For
the most part this shouldn't matter, but since a task structure is
provided, lets use it.
Fixes: 248d3a7b2f10 ("uprobes: Change uprobe_copy_process() to dup return_instances")
Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/events/uprobes.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 7ca1940607bd8..4b97d16f731c1 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -121,7 +121,7 @@ struct xol_area {
static void uprobe_warn(struct task_struct *t, const char *msg)
{
- pr_warn("uprobe: %s:%d failed to %s\n", current->comm, current->pid, msg);
+ pr_warn("uprobe: %s:%d failed to %s\n", t->comm, t->pid, msg);
}
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 025/563] raid6: riscv: Clean up unused header file inclusion
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 024/563] uprobes: uprobe_warn should use passed task Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 026/563] coresight: trbe: Prevent overflow in PERF_IDX2OFF() Greg Kroah-Hartman
` (551 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexandre Ghiti, Chunyan Zhang,
Nutty Liu, Paul Walmsley, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chunyan Zhang <zhangchunyan@iscas.ac.cn>
[ Upstream commit f8a03516a530cc36bc9015c84ba7540ee3e8d7bd ]
These two C files don't reference things defined in simd.h or types.h
so remove these redundant #inclusions.
Fixes: 6093faaf9593 ("raid6: Add RISC-V SIMD syndrome and recovery calculations")
Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Signed-off-by: Chunyan Zhang <zhangchunyan@iscas.ac.cn>
Reviewed-by: Nutty Liu <liujingqi@lanxincomputing.com>
Link: https://lore.kernel.org/r/20250718072711.3865118-2-zhangchunyan@iscas.ac.cn
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/raid6/recov_rvv.c | 2 --
lib/raid6/rvv.c | 3 ---
2 files changed, 5 deletions(-)
diff --git a/lib/raid6/recov_rvv.c b/lib/raid6/recov_rvv.c
index 5d54c4b437df7..5f779719c3d34 100644
--- a/lib/raid6/recov_rvv.c
+++ b/lib/raid6/recov_rvv.c
@@ -4,9 +4,7 @@
* Author: Chunyan Zhang <zhangchunyan@iscas.ac.cn>
*/
-#include <asm/simd.h>
#include <asm/vector.h>
-#include <crypto/internal/simd.h>
#include <linux/raid/pq.h>
static int rvv_has_vector(void)
diff --git a/lib/raid6/rvv.c b/lib/raid6/rvv.c
index 7d82efa5b14f9..b193ea176d5d3 100644
--- a/lib/raid6/rvv.c
+++ b/lib/raid6/rvv.c
@@ -9,11 +9,8 @@
* Copyright 2002-2004 H. Peter Anvin
*/
-#include <asm/simd.h>
#include <asm/vector.h>
-#include <crypto/internal/simd.h>
#include <linux/raid/pq.h>
-#include <linux/types.h>
#include "rvv.h"
#define NSIZE (riscv_v_vsize / 32) /* NSIZE = vlenb */
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 026/563] coresight: trbe: Prevent overflow in PERF_IDX2OFF()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 025/563] raid6: riscv: Clean up unused header file inclusion Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 027/563] perf: arm_spe: " Greg Kroah-Hartman
` (550 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Leo Yan, Will Deacon, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit 105f56877f2d5f82d71e20b45eb7be7c24c3d908 ]
Cast nr_pages to unsigned long to avoid overflow when handling large
AUX buffer sizes (>= 2 GiB).
Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
Signed-off-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-trbe.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
index 8267dd1a2130d..8f426f94e32a1 100644
--- a/drivers/hwtracing/coresight/coresight-trbe.c
+++ b/drivers/hwtracing/coresight/coresight-trbe.c
@@ -23,7 +23,8 @@
#include "coresight-self-hosted-trace.h"
#include "coresight-trbe.h"
-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
+#define PERF_IDX2OFF(idx, buf) \
+ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
/*
* A padding packet that will help the user space tools
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 027/563] perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 026/563] coresight: trbe: Prevent overflow in PERF_IDX2OFF() Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 028/563] erofs: avoid reading more for fragment maps Greg Kroah-Hartman
` (549 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Leo Yan, Will Deacon, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ]
Cast nr_pages to unsigned long to avoid overflow when handling large
AUX buffer sizes (>= 2 GiB).
Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension")
Signed-off-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/perf/arm_spe_pmu.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c
index 369e77ad5f13f..8f14cb324e018 100644
--- a/drivers/perf/arm_spe_pmu.c
+++ b/drivers/perf/arm_spe_pmu.c
@@ -97,7 +97,8 @@ struct arm_spe_pmu {
#define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu))
/* Convert a free-running index from perf into an SPE buffer offset */
-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
+#define PERF_IDX2OFF(idx, buf) \
+ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
/* Keep track of our dynamic hotplug state */
static enum cpuhp_state arm_spe_pmu_online;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 028/563] erofs: avoid reading more for fragment maps
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 027/563] perf: arm_spe: " Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 029/563] smb: client: fix sending the iwrap custom IRD/ORD negotiation messages Greg Kroah-Hartman
` (548 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongbo Li, Chao Yu, Gao Xiang,
Sasha Levin, syzbot+1a9af3ef3c84c5e14dcc
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <hsiangkao@linux.alibaba.com>
[ Upstream commit 334c0e493c2aa3e843a80bb9f3862bb50360cb36 ]
Since all real encoded extents (directly handled by the decompression
subsystem) have a sane, limited maximum decoded length
(Z_EROFS_PCLUSTER_MAX_DSIZE), and the read-more policy is only applied
if needed.
However, it makes no sense to read more for non-encoded maps, such as
fragment extents, since such extents can be huge (up to i_size) and
there is no benefit to reading more at this layer.
For normal images, it does not really matter, but for crafted images
generated by syzbot, excessively large fragment extents can cause
read-more to run for an overly long time.
Reported-and-tested-by: syzbot+1a9af3ef3c84c5e14dcc@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/r/68c8583d.050a0220.2ff435.03a3.GAE@google.com
Fixes: b44686c8391b ("erofs: fix large fragment handling")
Fixes: b15b2e307c3a ("erofs: support on-disk compressed fragments data")
Reviewed-by: Hongbo Li <lihongbo22@huawei.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/erofs/zdata.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
index 2d73297003d25..625b8ae8f67f0 100644
--- a/fs/erofs/zdata.c
+++ b/fs/erofs/zdata.c
@@ -1835,7 +1835,7 @@ static void z_erofs_pcluster_readmore(struct z_erofs_frontend *f,
map->m_la = end;
err = z_erofs_map_blocks_iter(inode, map,
EROFS_GET_BLOCKS_READMORE);
- if (err)
+ if (err || !(map->m_flags & EROFS_MAP_ENCODED))
return;
/* expand ra for the trailing edge if readahead */
@@ -1847,7 +1847,7 @@ static void z_erofs_pcluster_readmore(struct z_erofs_frontend *f,
end = round_up(end, PAGE_SIZE);
} else {
end = round_up(map->m_la, PAGE_SIZE);
- if (!map->m_llen)
+ if (!(map->m_flags & EROFS_MAP_ENCODED) || !map->m_llen)
return;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 029/563] smb: client: fix sending the iwrap custom IRD/ORD negotiation messages
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 028/563] erofs: avoid reading more for fragment maps Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 030/563] smb: server: fix IRD/ORD negotiation with the client Greg Kroah-Hartman
` (547 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Steve French, Tom Talpey, Long Li,
Namjae Jeon, linux-cifs, samba-technical, linux-rdma,
Stefan Metzmacher, Steve French, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <metze@samba.org>
[ Upstream commit ef71f1e046489c77a2f7d012edc762fba0a7aadc ]
Do a real negotiation and check the servers initiator_depth and
responder_resources.
This should use big endian in order to be useful.
I have captures of windows clients showing this.
The fact that we used little endian up to now
means that we sent very large numbers and the
negotiation with the server truncated them to the
server limits.
Note the reason why this uses u8 for
initiator_depth and responder_resources is
that the rdma layer also uses it.
The inconsitency regarding the initiator_depth
and responder_resources values being reversed
for iwarp devices in RDMA_CM_EVENT_ESTABLISHED
should also be fixed later, but for now we should
fix it.
Cc: Steve French <smfrench@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Long Li <longli@microsoft.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Cc: linux-rdma@vger.kernel.org
Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration")
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smbdirect.c | 110 ++++++++++++++++++++++++++++++++++----
fs/smb/client/smbdirect.h | 4 +-
2 files changed, 103 insertions(+), 11 deletions(-)
diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c
index e0fce5033004c..6480945c24592 100644
--- a/fs/smb/client/smbdirect.c
+++ b/fs/smb/client/smbdirect.c
@@ -179,6 +179,8 @@ static int smbd_conn_upcall(
struct smbd_connection *info = id->context;
struct smbdirect_socket *sc = &info->socket;
const char *event_name = rdma_event_msg(event->event);
+ u8 peer_initiator_depth;
+ u8 peer_responder_resources;
log_rdma_event(INFO, "event=%s status=%d\n",
event_name, event->status);
@@ -204,6 +206,85 @@ static int smbd_conn_upcall(
case RDMA_CM_EVENT_ESTABLISHED:
log_rdma_event(INFO, "connected event=%s\n", event_name);
+
+ /*
+ * Here we work around an inconsistency between
+ * iWarp and other devices (at least rxe and irdma using RoCEv2)
+ */
+ if (rdma_protocol_iwarp(id->device, id->port_num)) {
+ /*
+ * iWarp devices report the peer's values
+ * with the perspective of the peer here.
+ * Tested with siw and irdma (in iwarp mode)
+ * We need to change to our perspective here,
+ * so we need to switch the values.
+ */
+ peer_initiator_depth = event->param.conn.responder_resources;
+ peer_responder_resources = event->param.conn.initiator_depth;
+ } else {
+ /*
+ * Non iWarp devices report the peer's values
+ * already changed to our perspective here.
+ * Tested with rxe and irdma (in roce mode).
+ */
+ peer_initiator_depth = event->param.conn.initiator_depth;
+ peer_responder_resources = event->param.conn.responder_resources;
+ }
+ if (rdma_protocol_iwarp(id->device, id->port_num) &&
+ event->param.conn.private_data_len == 8) {
+ /*
+ * Legacy clients with only iWarp MPA v1 support
+ * need a private blob in order to negotiate
+ * the IRD/ORD values.
+ */
+ const __be32 *ird_ord_hdr = event->param.conn.private_data;
+ u32 ird32 = be32_to_cpu(ird_ord_hdr[0]);
+ u32 ord32 = be32_to_cpu(ird_ord_hdr[1]);
+
+ /*
+ * cifs.ko sends the legacy IRD/ORD negotiation
+ * event if iWarp MPA v2 was used.
+ *
+ * Here we check that the values match and only
+ * mark the client as legacy if they don't match.
+ */
+ if ((u32)event->param.conn.initiator_depth != ird32 ||
+ (u32)event->param.conn.responder_resources != ord32) {
+ /*
+ * There are broken clients (old cifs.ko)
+ * using little endian and also
+ * struct rdma_conn_param only uses u8
+ * for initiator_depth and responder_resources,
+ * so we truncate the value to U8_MAX.
+ *
+ * smb_direct_accept_client() will then
+ * do the real negotiation in order to
+ * select the minimum between client and
+ * server.
+ */
+ ird32 = min_t(u32, ird32, U8_MAX);
+ ord32 = min_t(u32, ord32, U8_MAX);
+
+ info->legacy_iwarp = true;
+ peer_initiator_depth = (u8)ird32;
+ peer_responder_resources = (u8)ord32;
+ }
+ }
+
+ /*
+ * negotiate the value by using the minimum
+ * between client and server if the client provided
+ * non 0 values.
+ */
+ if (peer_initiator_depth != 0)
+ info->initiator_depth =
+ min_t(u8, info->initiator_depth,
+ peer_initiator_depth);
+ if (peer_responder_resources != 0)
+ info->responder_resources =
+ min_t(u8, info->responder_resources,
+ peer_responder_resources);
+
sc->status = SMBDIRECT_SOCKET_CONNECTED;
wake_up_interruptible(&info->status_wait);
break;
@@ -1551,7 +1632,7 @@ static struct smbd_connection *_smbd_get_connection(
struct ib_qp_init_attr qp_attr;
struct sockaddr_in *addr_in = (struct sockaddr_in *) dstaddr;
struct ib_port_immutable port_immutable;
- u32 ird_ord_hdr[2];
+ __be32 ird_ord_hdr[2];
info = kzalloc(sizeof(struct smbd_connection), GFP_KERNEL);
if (!info)
@@ -1559,6 +1640,9 @@ static struct smbd_connection *_smbd_get_connection(
sc = &info->socket;
sp = &sc->parameters;
+ info->initiator_depth = 1;
+ info->responder_resources = SMBD_CM_RESPONDER_RESOURCES;
+
sc->status = SMBDIRECT_SOCKET_CONNECTING;
rc = smbd_ia_open(info, dstaddr, port);
if (rc) {
@@ -1639,22 +1723,22 @@ static struct smbd_connection *_smbd_get_connection(
}
sc->ib.qp = sc->rdma.cm_id->qp;
- memset(&conn_param, 0, sizeof(conn_param));
- conn_param.initiator_depth = 0;
-
- conn_param.responder_resources =
- min(sc->ib.dev->attrs.max_qp_rd_atom,
- SMBD_CM_RESPONDER_RESOURCES);
- info->responder_resources = conn_param.responder_resources;
+ info->responder_resources =
+ min_t(u8, info->responder_resources,
+ sc->ib.dev->attrs.max_qp_rd_atom);
log_rdma_mr(INFO, "responder_resources=%d\n",
info->responder_resources);
+ memset(&conn_param, 0, sizeof(conn_param));
+ conn_param.initiator_depth = info->initiator_depth;
+ conn_param.responder_resources = info->responder_resources;
+
/* Need to send IRD/ORD in private data for iWARP */
sc->ib.dev->ops.get_port_immutable(
sc->ib.dev, sc->rdma.cm_id->port_num, &port_immutable);
if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) {
- ird_ord_hdr[0] = info->responder_resources;
- ird_ord_hdr[1] = 1;
+ ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources);
+ ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth);
conn_param.private_data = ird_ord_hdr;
conn_param.private_data_len = sizeof(ird_ord_hdr);
} else {
@@ -2121,6 +2205,12 @@ static int allocate_mr_list(struct smbd_connection *info)
atomic_set(&info->mr_used_count, 0);
init_waitqueue_head(&info->wait_for_mr_cleanup);
INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work);
+
+ if (info->responder_resources == 0) {
+ log_rdma_mr(ERR, "responder_resources negotiated as 0\n");
+ return -EINVAL;
+ }
+
/* Allocate more MRs (2x) than hardware responder_resources */
for (i = 0; i < info->responder_resources * 2; i++) {
smbdirect_mr = kzalloc(sizeof(*smbdirect_mr), GFP_KERNEL);
diff --git a/fs/smb/client/smbdirect.h b/fs/smb/client/smbdirect.h
index e45aa9ddd71da..4ca9b2b2c57f9 100644
--- a/fs/smb/client/smbdirect.h
+++ b/fs/smb/client/smbdirect.h
@@ -67,7 +67,9 @@ struct smbd_connection {
/* Memory registrations */
/* Maximum number of RDMA read/write outstanding on this connection */
- int responder_resources;
+ bool legacy_iwarp;
+ u8 initiator_depth;
+ u8 responder_resources;
/* Maximum number of pages in a single RDMA write/read on this connection */
int max_frmr_depth;
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 030/563] smb: server: fix IRD/ORD negotiation with the client
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 029/563] smb: client: fix sending the iwrap custom IRD/ORD negotiation messages Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 031/563] EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller Greg Kroah-Hartman
` (546 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Namjae Jeon, Steve French,
Tom Talpey, linux-cifs, samba-technical, linux-rdma,
Stefan Metzmacher, Steve French, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <metze@samba.org>
[ Upstream commit fad988a2158d743da7971884b93482a73735b25e ]
Already do real negotiation in smb_direct_handle_connect_request()
where we see the requested initiator_depth and responder_resources
from the client.
We should detect legacy iwarp clients using MPA v1
with the custom IRD/ORD negotiation.
We need to send the custom IRD/ORD in big endian,
but we need to try to let clients with broken requests
using little endian (older cifs.ko) to work.
Note the reason why this uses u8 for
initiator_depth and responder_resources is
that the rdma layer also uses it.
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Cc: Steve French <smfrench@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Cc: linux-rdma@vger.kernel.org
Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/transport_rdma.c | 99 +++++++++++++++++++++++++++++-----
1 file changed, 85 insertions(+), 14 deletions(-)
diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
index 74dfb6496095d..e1f659d3b4cf5 100644
--- a/fs/smb/server/transport_rdma.c
+++ b/fs/smb/server/transport_rdma.c
@@ -153,6 +153,10 @@ struct smb_direct_transport {
struct work_struct disconnect_work;
bool negotiation_requested;
+
+ bool legacy_iwarp;
+ u8 initiator_depth;
+ u8 responder_resources;
};
#define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport))
@@ -347,6 +351,9 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id)
t->cm_id = cm_id;
cm_id->context = t;
+ t->initiator_depth = SMB_DIRECT_CM_INITIATOR_DEPTH;
+ t->responder_resources = 1;
+
t->status = SMB_DIRECT_CS_NEW;
init_waitqueue_head(&t->wait_status);
@@ -1676,21 +1683,21 @@ static int smb_direct_send_negotiate_response(struct smb_direct_transport *t,
static int smb_direct_accept_client(struct smb_direct_transport *t)
{
struct rdma_conn_param conn_param;
- struct ib_port_immutable port_immutable;
- u32 ird_ord_hdr[2];
+ __be32 ird_ord_hdr[2];
int ret;
+ /*
+ * smb_direct_handle_connect_request()
+ * already negotiated t->initiator_depth
+ * and t->responder_resources
+ */
memset(&conn_param, 0, sizeof(conn_param));
- conn_param.initiator_depth = min_t(u8, t->cm_id->device->attrs.max_qp_rd_atom,
- SMB_DIRECT_CM_INITIATOR_DEPTH);
- conn_param.responder_resources = 0;
-
- t->cm_id->device->ops.get_port_immutable(t->cm_id->device,
- t->cm_id->port_num,
- &port_immutable);
- if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) {
- ird_ord_hdr[0] = conn_param.responder_resources;
- ird_ord_hdr[1] = 1;
+ conn_param.initiator_depth = t->initiator_depth;
+ conn_param.responder_resources = t->responder_resources;
+
+ if (t->legacy_iwarp) {
+ ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources);
+ ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth);
conn_param.private_data = ird_ord_hdr;
conn_param.private_data_len = sizeof(ird_ord_hdr);
} else {
@@ -2081,10 +2088,13 @@ static bool rdma_frwr_is_supported(struct ib_device_attr *attrs)
return true;
}
-static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
+static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id,
+ struct rdma_cm_event *event)
{
struct smb_direct_transport *t;
struct task_struct *handler;
+ u8 peer_initiator_depth;
+ u8 peer_responder_resources;
int ret;
if (!rdma_frwr_is_supported(&new_cm_id->device->attrs)) {
@@ -2098,6 +2108,67 @@ static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
if (!t)
return -ENOMEM;
+ peer_initiator_depth = event->param.conn.initiator_depth;
+ peer_responder_resources = event->param.conn.responder_resources;
+ if (rdma_protocol_iwarp(new_cm_id->device, new_cm_id->port_num) &&
+ event->param.conn.private_data_len == 8) {
+ /*
+ * Legacy clients with only iWarp MPA v1 support
+ * need a private blob in order to negotiate
+ * the IRD/ORD values.
+ */
+ const __be32 *ird_ord_hdr = event->param.conn.private_data;
+ u32 ird32 = be32_to_cpu(ird_ord_hdr[0]);
+ u32 ord32 = be32_to_cpu(ird_ord_hdr[1]);
+
+ /*
+ * cifs.ko sends the legacy IRD/ORD negotiation
+ * event if iWarp MPA v2 was used.
+ *
+ * Here we check that the values match and only
+ * mark the client as legacy if they don't match.
+ */
+ if ((u32)event->param.conn.initiator_depth != ird32 ||
+ (u32)event->param.conn.responder_resources != ord32) {
+ /*
+ * There are broken clients (old cifs.ko)
+ * using little endian and also
+ * struct rdma_conn_param only uses u8
+ * for initiator_depth and responder_resources,
+ * so we truncate the value to U8_MAX.
+ *
+ * smb_direct_accept_client() will then
+ * do the real negotiation in order to
+ * select the minimum between client and
+ * server.
+ */
+ ird32 = min_t(u32, ird32, U8_MAX);
+ ord32 = min_t(u32, ord32, U8_MAX);
+
+ t->legacy_iwarp = true;
+ peer_initiator_depth = (u8)ird32;
+ peer_responder_resources = (u8)ord32;
+ }
+ }
+
+ /*
+ * First set what the we as server are able to support
+ */
+ t->initiator_depth = min_t(u8, t->initiator_depth,
+ new_cm_id->device->attrs.max_qp_rd_atom);
+
+ /*
+ * negotiate the value by using the minimum
+ * between client and server if the client provided
+ * non 0 values.
+ */
+ if (peer_initiator_depth != 0)
+ t->initiator_depth = min_t(u8, t->initiator_depth,
+ peer_initiator_depth);
+ if (peer_responder_resources != 0)
+ t->responder_resources = min_t(u8, t->responder_resources,
+ peer_responder_resources);
+
ret = smb_direct_connect(t);
if (ret)
goto out_err;
@@ -2122,7 +2193,7 @@ static int smb_direct_listen_handler(struct rdma_cm_id *cm_id,
{
switch (event->event) {
case RDMA_CM_EVENT_CONNECT_REQUEST: {
- int ret = smb_direct_handle_connect_request(cm_id);
+ int ret = smb_direct_handle_connect_request(cm_id, event);
if (ret) {
pr_err("Can't create transport: %d\n", ret);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 031/563] EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 030/563] smb: server: fix IRD/ORD negotiation with the client Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 032/563] perf/x86/intel: Use early_initcall() to hook bts_init() Greg Kroah-Hartman
` (545 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jose Jesus Ambriz Meza,
Chia-Lin Kao (AceLan), Qiuxu Zhuo, Tony Luck, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
[ Upstream commit 2e6fe1bbefd9c059c3787d1c620fe67343a94dff ]
When loading the i10nm_edac driver on some Intel Granite Rapids servers,
a call trace may appear as follows:
UBSAN: shift-out-of-bounds in drivers/edac/skx_common.c:453:16
shift exponent -66 is negative
...
__ubsan_handle_shift_out_of_bounds+0x1e3/0x390
skx_get_dimm_info.cold+0x47/0xd40 [skx_edac_common]
i10nm_get_dimm_config+0x23e/0x390 [i10nm_edac]
skx_register_mci+0x159/0x220 [skx_edac_common]
i10nm_init+0xcb0/0x1ff0 [i10nm_edac]
...
This occurs because some BIOS may disable a memory controller if there
aren't any memory DIMMs populated on this memory controller. The DIMMMTR
register of this disabled memory controller contains the invalid value
~0, resulting in the call trace above.
Fix this call trace by skipping DIMM enumeration on a disabled memory
controller.
Fixes: ba987eaaabf9 ("EDAC/i10nm: Add Intel Granite Rapids server support")
Reported-by: Jose Jesus Ambriz Meza <jose.jesus.ambriz.meza@intel.com>
Reported-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
Closes: https://lore.kernel.org/all/20250730063155.2612379-1-acelan.kao@canonical.com/
Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Tested-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
Link: https://lore.kernel.org/r/20250806065707.3533345-1-qiuxu.zhuo@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/edac/i10nm_base.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c
index bf4171ac191d3..9d00f247f4e0e 100644
--- a/drivers/edac/i10nm_base.c
+++ b/drivers/edac/i10nm_base.c
@@ -1057,6 +1057,15 @@ static bool i10nm_check_ecc(struct skx_imc *imc, int chan)
return !!GET_BITFIELD(mcmtr, 2, 2);
}
+static bool i10nm_channel_disabled(struct skx_imc *imc, int chan)
+{
+ u32 mcmtr = I10NM_GET_MCMTR(imc, chan);
+
+ edac_dbg(1, "mc%d ch%d mcmtr reg %x\n", imc->mc, chan, mcmtr);
+
+ return (mcmtr == ~0 || GET_BITFIELD(mcmtr, 18, 18));
+}
+
static int i10nm_get_dimm_config(struct mem_ctl_info *mci,
struct res_config *cfg)
{
@@ -1070,6 +1079,11 @@ static int i10nm_get_dimm_config(struct mem_ctl_info *mci,
if (!imc->mbase)
continue;
+ if (i10nm_channel_disabled(imc, i)) {
+ edac_dbg(1, "mc%d ch%d is disabled.\n", imc->mc, i);
+ continue;
+ }
+
ndimms = 0;
if (res_cfg->type != GNR)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 032/563] perf/x86/intel: Use early_initcall() to hook bts_init()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 031/563] EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 033/563] perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error Greg Kroah-Hartman
` (544 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dapeng Mi, Peter Zijlstra (Intel),
Kan Liang, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dapeng Mi <dapeng1.mi@linux.intel.com>
[ Upstream commit d9cf9c6884d21e01483c4e17479d27636ea4bb50 ]
After the commit 'd971342d38bf ("perf/x86/intel: Decouple BTS
initialization from PEBS initialization")' is introduced, x86_pmu.bts
would initialized in bts_init() which is hooked by arch_initcall().
Whereas init_hw_perf_events() is hooked by early_initcall(). Once the
core PMU is initialized, nmi watchdog initialization is called
immediately before bts_init() is called. It leads to the BTS buffer is
not really initialized since bts_init() is not called and x86_pmu.bts is
still false at that time. Worse, BTS buffer would never be initialized
then unless all core PMU events are freed and reserve_ds_buffers()
is called again.
Thus aligning with init_hw_perf_events(), use early_initcall() to hook
bts_init() to ensure x86_pmu.bts is initialized before nmi watchdog
initialization.
Fixes: d971342d38bf ("perf/x86/intel: Decouple BTS initialization from PEBS initialization")
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
Link: https://lore.kernel.org/r/20250820023032.17128-2-dapeng1.mi@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/intel/bts.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c
index 61da6b8a3d519..cbac54cb3a9ec 100644
--- a/arch/x86/events/intel/bts.c
+++ b/arch/x86/events/intel/bts.c
@@ -643,4 +643,4 @@ static __init int bts_init(void)
return perf_pmu_register(&bts_pmu, "intel_bts", -1);
}
-arch_initcall(bts_init);
+early_initcall(bts_init);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 033/563] perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 032/563] perf/x86/intel: Use early_initcall() to hook bts_init() Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 034/563] x86/vdso: Fix output operand size of RDPID Greg Kroah-Hartman
` (543 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dapeng Mi, Peter Zijlstra (Intel),
Kan Liang, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dapeng Mi <dapeng1.mi@linux.intel.com>
[ Upstream commit 43796f30507802d93ead2dc44fc9637f34671a89 ]
When running perf_fuzzer on PTL, sometimes the below "unchecked MSR
access error" is seen when accessing IA32_PMC_x_CFG_B MSRs.
[ 55.611268] unchecked MSR access error: WRMSR to 0x1986 (tried to write 0x0000000200000001) at rIP: 0xffffffffac564b28 (native_write_msr+0x8/0x30)
[ 55.611280] Call Trace:
[ 55.611282] <TASK>
[ 55.611284] ? intel_pmu_config_acr+0x87/0x160
[ 55.611289] intel_pmu_enable_acr+0x6d/0x80
[ 55.611291] intel_pmu_enable_event+0xce/0x460
[ 55.611293] x86_pmu_start+0x78/0xb0
[ 55.611297] x86_pmu_enable+0x218/0x3a0
[ 55.611300] ? x86_pmu_enable+0x121/0x3a0
[ 55.611302] perf_pmu_enable+0x40/0x50
[ 55.611307] ctx_resched+0x19d/0x220
[ 55.611309] __perf_install_in_context+0x284/0x2f0
[ 55.611311] ? __pfx_remote_function+0x10/0x10
[ 55.611314] remote_function+0x52/0x70
[ 55.611317] ? __pfx_remote_function+0x10/0x10
[ 55.611319] generic_exec_single+0x84/0x150
[ 55.611323] smp_call_function_single+0xc5/0x1a0
[ 55.611326] ? __pfx_remote_function+0x10/0x10
[ 55.611329] perf_install_in_context+0xd1/0x1e0
[ 55.611331] ? __pfx___perf_install_in_context+0x10/0x10
[ 55.611333] __do_sys_perf_event_open+0xa76/0x1040
[ 55.611336] __x64_sys_perf_event_open+0x26/0x30
[ 55.611337] x64_sys_call+0x1d8e/0x20c0
[ 55.611339] do_syscall_64+0x4f/0x120
[ 55.611343] entry_SYSCALL_64_after_hwframe+0x76/0x7e
On PTL, GP counter 0 and 1 doesn't support auto counter reload feature,
thus it would trigger a #GP when trying to write 1 on bit 0 of CFG_B MSR
which requires to enable auto counter reload on GP counter 0.
The root cause of causing this issue is the check for auto counter
reload (ACR) counter mask from user space is incorrect in
intel_pmu_acr_late_setup() helper. It leads to an invalid ACR counter
mask from user space could be set into hw.config1 and then written into
CFG_B MSRs and trigger the MSR access warning.
e.g., User may create a perf event with ACR counter mask (config2=0xcb),
and there is only 1 event created, so "cpuc->n_events" is 1.
The correct check condition should be "i + idx >= cpuc->n_events"
instead of "i + idx > cpuc->n_events" (it looks a typo). Otherwise,
the counter mask would traverse twice and an invalid "cpuc->assign[1]"
bit (bit 0) is set into hw.config1 and cause MSR accessing error.
Besides, also check if the ACR counter mask corresponding events are
ACR events. If not, filter out these counter mask. If a event is not a
ACR event, it could be scheduled to an HW counter which doesn't support
ACR. It's invalid to add their counter index in ACR counter mask.
Furthermore, remove the WARN_ON_ONCE() since it's easily triggered as
user could set any invalid ACR counter mask and the warning message
could mislead users.
Fixes: ec980e4facef ("perf/x86/intel: Support auto counter reload")
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
Link: https://lore.kernel.org/r/20250820023032.17128-3-dapeng1.mi@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/intel/core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index c2fb729c270ec..15da60cf69f20 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -2997,7 +2997,8 @@ static void intel_pmu_acr_late_setup(struct cpu_hw_events *cpuc)
if (event->group_leader != leader->group_leader)
break;
for_each_set_bit(idx, (unsigned long *)&event->attr.config2, X86_PMC_IDX_MAX) {
- if (WARN_ON_ONCE(i + idx > cpuc->n_events))
+ if (i + idx >= cpuc->n_events ||
+ !is_acr_event_group(cpuc->event_list[i + idx]))
return;
__set_bit(cpuc->assign[i + idx], (unsigned long *)&event->hw.config1);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 034/563] x86/vdso: Fix output operand size of RDPID
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 033/563] perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 035/563] selftests: cgroup: Make test_pids backwards compatible Greg Kroah-Hartman
` (542 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uros Bizjak, Borislav Petkov (AMD),
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uros Bizjak <ubizjak@gmail.com>
[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ]
RDPID instruction outputs to a word-sized register (64-bit on x86_64 and
32-bit on x86_32). Use an unsigned long variable to store the correct size.
LSL outputs to 32-bit register, use %k operand prefix to always print the
32-bit name of the register.
Use RDPID insn mnemonic while at it as the minimum binutils version of
2.30 supports it.
[ bp: Merge two patches touching the same function into a single one. ]
Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number")
Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/20250616095315.230620-1-ubizjak@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/include/asm/segment.h | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
index 77d8f49b92bdd..f59ae7186940a 100644
--- a/arch/x86/include/asm/segment.h
+++ b/arch/x86/include/asm/segment.h
@@ -244,7 +244,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node)
static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
{
- unsigned int p;
+ unsigned long p;
/*
* Load CPU and node number from the GDT. LSL is faster than RDTSCP
@@ -254,10 +254,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
*
* If RDPID is available, use it.
*/
- alternative_io ("lsl %[seg],%[p]",
- ".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */
+ alternative_io ("lsl %[seg],%k[p]",
+ "rdpid %[p]",
X86_FEATURE_RDPID,
- [p] "=a" (p), [seg] "r" (__CPUNODE_SEG));
+ [p] "=r" (p), [seg] "r" (__CPUNODE_SEG));
if (cpu)
*cpu = (p & VDSO_CPUNODE_MASK);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 035/563] selftests: cgroup: Make test_pids backwards compatible
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 034/563] x86/vdso: Fix output operand size of RDPID Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 036/563] sched/fair: Get rid of sched_domains_curr_level hack for tl->cpumask() Greg Kroah-Hartman
` (541 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michal Koutný, Sebastian Chlad,
Tejun Heo, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Koutný <mkoutny@suse.com>
[ Upstream commit 3b0dec689a6301845761681b852f9538cb75a1d2 ]
The predicates in test expect event counting from 73e75e6fc352b
("cgroup/pids: Separate semantics of pids.events related to pids.max")
and the test would fail on older kernels. We want to have one version of
tests for all, so detect the feature and skip the test on old kernels.
(The test could even switch to check v1 semantics based on the flag but
keep it simple for now.)
Fixes: 9f34c566027b6 ("selftests: cgroup: Add basic tests for pids controller")
Signed-off-by: Michal Koutný <mkoutny@suse.com>
Tested-by: Sebastian Chlad <sebastian.chlad@suse.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/cgroup/lib/cgroup_util.c | 12 ++++++++++++
.../selftests/cgroup/lib/include/cgroup_util.h | 1 +
tools/testing/selftests/cgroup/test_pids.c | 3 +++
3 files changed, 16 insertions(+)
diff --git a/tools/testing/selftests/cgroup/lib/cgroup_util.c b/tools/testing/selftests/cgroup/lib/cgroup_util.c
index 0e89fcff4d05d..44c52f620fda1 100644
--- a/tools/testing/selftests/cgroup/lib/cgroup_util.c
+++ b/tools/testing/selftests/cgroup/lib/cgroup_util.c
@@ -522,6 +522,18 @@ int proc_mount_contains(const char *option)
return strstr(buf, option) != NULL;
}
+int cgroup_feature(const char *feature)
+{
+ char buf[PAGE_SIZE];
+ ssize_t read;
+
+ read = read_text("/sys/kernel/cgroup/features", buf, sizeof(buf));
+ if (read < 0)
+ return read;
+
+ return strstr(buf, feature) != NULL;
+}
+
ssize_t proc_read_text(int pid, bool thread, const char *item, char *buf, size_t size)
{
char path[PATH_MAX];
diff --git a/tools/testing/selftests/cgroup/lib/include/cgroup_util.h b/tools/testing/selftests/cgroup/lib/include/cgroup_util.h
index c69cab66254b4..9dc90a1b386d7 100644
--- a/tools/testing/selftests/cgroup/lib/include/cgroup_util.h
+++ b/tools/testing/selftests/cgroup/lib/include/cgroup_util.h
@@ -60,6 +60,7 @@ extern int cg_run_nowait(const char *cgroup,
extern int cg_wait_for_proc_count(const char *cgroup, int count);
extern int cg_killall(const char *cgroup);
int proc_mount_contains(const char *option);
+int cgroup_feature(const char *feature);
extern ssize_t proc_read_text(int pid, bool thread, const char *item, char *buf, size_t size);
extern int proc_read_strstr(int pid, bool thread, const char *item, const char *needle);
extern pid_t clone_into_cgroup(int cgroup_fd);
diff --git a/tools/testing/selftests/cgroup/test_pids.c b/tools/testing/selftests/cgroup/test_pids.c
index 9ecb83c6cc5cb..d8a1d1cd50072 100644
--- a/tools/testing/selftests/cgroup/test_pids.c
+++ b/tools/testing/selftests/cgroup/test_pids.c
@@ -77,6 +77,9 @@ static int test_pids_events(const char *root)
char *cg_parent = NULL, *cg_child = NULL;
int pid;
+ if (cgroup_feature("pids_localevents") <= 0)
+ return KSFT_SKIP;
+
cg_parent = cg_name(root, "pids_parent");
cg_child = cg_name(cg_parent, "pids_child");
if (!cg_parent || !cg_child)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 036/563] sched/fair: Get rid of sched_domains_curr_level hack for tl->cpumask()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 035/563] selftests: cgroup: Make test_pids backwards compatible Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 037/563] lsm: CONFIG_LSM can depend on CONFIG_SECURITY Greg Kroah-Hartman
` (540 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Zijlstra (Intel),
Leon Romanovsky, K Prateek Nayak, Valentin Schneider,
Shrikanth Hegde, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
[ Upstream commit 661f951e371cc134ea31c84238dbdc9a898b8403 ]
Leon [1] and Vinicius [2] noted a topology_span_sane() warning during
their testing starting from v6.16-rc1. Debug that followed pointed to
the tl->mask() for the NODE domain being incorrectly resolved to that of
the highest NUMA domain.
tl->mask() for NODE is set to the sd_numa_mask() which depends on the
global "sched_domains_curr_level" hack. "sched_domains_curr_level" is
set to the "tl->numa_level" during tl traversal in build_sched_domains()
calling sd_init() but was not reset before topology_span_sane().
Since "tl->numa_level" still reflected the old value from
build_sched_domains(), topology_span_sane() for the NODE domain trips
when the span of the last NUMA domain overlaps.
Instead of replicating the "sched_domains_curr_level" hack, get rid of
it entirely and instead, pass the entire "sched_domain_topology_level"
object to tl->cpumask() function to prevent such mishap in the future.
sd_numa_mask() now directly references "tl->numa_level" instead of
relying on the global "sched_domains_curr_level" hack to index into
sched_domains_numa_masks[].
The original warning was reproducible on the following NUMA topology
reported by Leon:
$ sudo numactl -H
available: 5 nodes (0-4)
node 0 cpus: 0 1
node 0 size: 2927 MB
node 0 free: 1603 MB
node 1 cpus: 2 3
node 1 size: 3023 MB
node 1 free: 3008 MB
node 2 cpus: 4 5
node 2 size: 3023 MB
node 2 free: 3007 MB
node 3 cpus: 6 7
node 3 size: 3023 MB
node 3 free: 3002 MB
node 4 cpus: 8 9
node 4 size: 3022 MB
node 4 free: 2718 MB
node distances:
node 0 1 2 3 4
0: 10 39 38 37 36
1: 39 10 38 37 36
2: 38 38 10 37 36
3: 37 37 37 10 36
4: 36 36 36 36 10
The above topology can be mimicked using the following QEMU cmd that was
used to reproduce the warning and test the fix:
sudo qemu-system-x86_64 -enable-kvm -cpu host \
-m 20G -smp cpus=10,sockets=10 -machine q35 \
-object memory-backend-ram,size=4G,id=m0 \
-object memory-backend-ram,size=4G,id=m1 \
-object memory-backend-ram,size=4G,id=m2 \
-object memory-backend-ram,size=4G,id=m3 \
-object memory-backend-ram,size=4G,id=m4 \
-numa node,cpus=0-1,memdev=m0,nodeid=0 \
-numa node,cpus=2-3,memdev=m1,nodeid=1 \
-numa node,cpus=4-5,memdev=m2,nodeid=2 \
-numa node,cpus=6-7,memdev=m3,nodeid=3 \
-numa node,cpus=8-9,memdev=m4,nodeid=4 \
-numa dist,src=0,dst=1,val=39 \
-numa dist,src=0,dst=2,val=38 \
-numa dist,src=0,dst=3,val=37 \
-numa dist,src=0,dst=4,val=36 \
-numa dist,src=1,dst=0,val=39 \
-numa dist,src=1,dst=2,val=38 \
-numa dist,src=1,dst=3,val=37 \
-numa dist,src=1,dst=4,val=36 \
-numa dist,src=2,dst=0,val=38 \
-numa dist,src=2,dst=1,val=38 \
-numa dist,src=2,dst=3,val=37 \
-numa dist,src=2,dst=4,val=36 \
-numa dist,src=3,dst=0,val=37 \
-numa dist,src=3,dst=1,val=37 \
-numa dist,src=3,dst=2,val=37 \
-numa dist,src=3,dst=4,val=36 \
-numa dist,src=4,dst=0,val=36 \
-numa dist,src=4,dst=1,val=36 \
-numa dist,src=4,dst=2,val=36 \
-numa dist,src=4,dst=3,val=36 \
...
[ prateek: Moved common functions to include/linux/sched/topology.h,
reuse the common bits for s390 and ppc, commit message ]
Closes: https://lore.kernel.org/lkml/20250610110701.GA256154@unreal/ [1]
Fixes: ccf74128d66c ("sched/topology: Assert non-NUMA topology masks don't (partially) overlap") # ce29a7da84cd, f55dac1dafb3
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reported-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: K Prateek Nayak <kprateek.nayak@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Valentin Schneider <vschneid@redhat.com>
Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>
Tested-by: Valentin Schneider <vschneid@redhat.com> # x86
Tested-by: Shrikanth Hegde <sshegde@linux.ibm.com> # powerpc
Link: https://lore.kernel.org/lkml/a3de98387abad28592e6ab591f3ff6107fe01dc1.1755893468.git.tim.c.chen@linux.intel.com/ [2]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/Kconfig | 4 ++++
arch/powerpc/include/asm/topology.h | 2 ++
arch/powerpc/kernel/smp.c | 27 +++++++++++----------------
arch/s390/kernel/topology.c | 20 +++++++-------------
arch/x86/kernel/smpboot.c | 8 ++++----
include/linux/sched/topology.h | 28 +++++++++++++++++++++++++++-
include/linux/topology.h | 2 +-
kernel/sched/topology.c | 28 ++++++++++------------------
8 files changed, 66 insertions(+), 53 deletions(-)
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 93402a1d9c9fc..e51a595a06228 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -971,6 +971,10 @@ config SCHED_SMT
when dealing with POWER5 cpus at a cost of slightly increased
overhead in some places. If unsure say N here.
+config SCHED_MC
+ def_bool y
+ depends on SMP
+
config PPC_DENORMALISATION
bool "PowerPC denormalisation exception handling"
depends on PPC_BOOK3S_64
diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
index da15b5efe8071..f19ca44512d1e 100644
--- a/arch/powerpc/include/asm/topology.h
+++ b/arch/powerpc/include/asm/topology.h
@@ -131,6 +131,8 @@ static inline int cpu_to_coregroup_id(int cpu)
#ifdef CONFIG_SMP
#include <asm/cputable.h>
+struct cpumask *cpu_coregroup_mask(int cpu);
+
#ifdef CONFIG_PPC64
#include <asm/smp.h>
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index f59e4b9cc2074..68edb66c2964b 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -1028,19 +1028,19 @@ static int powerpc_shared_proc_flags(void)
* We can't just pass cpu_l2_cache_mask() directly because
* returns a non-const pointer and the compiler barfs on that.
*/
-static const struct cpumask *shared_cache_mask(int cpu)
+static const struct cpumask *tl_cache_mask(struct sched_domain_topology_level *tl, int cpu)
{
return per_cpu(cpu_l2_cache_map, cpu);
}
#ifdef CONFIG_SCHED_SMT
-static const struct cpumask *smallcore_smt_mask(int cpu)
+static const struct cpumask *tl_smallcore_smt_mask(struct sched_domain_topology_level *tl, int cpu)
{
return cpu_smallcore_mask(cpu);
}
#endif
-static struct cpumask *cpu_coregroup_mask(int cpu)
+struct cpumask *cpu_coregroup_mask(int cpu)
{
return per_cpu(cpu_coregroup_map, cpu);
}
@@ -1054,11 +1054,6 @@ static bool has_coregroup_support(void)
return coregroup_enabled;
}
-static const struct cpumask *cpu_mc_mask(int cpu)
-{
- return cpu_coregroup_mask(cpu);
-}
-
static int __init init_big_cores(void)
{
int cpu;
@@ -1448,7 +1443,7 @@ static bool update_mask_by_l2(int cpu, cpumask_var_t *mask)
return false;
}
- cpumask_and(*mask, cpu_online_mask, cpu_cpu_mask(cpu));
+ cpumask_and(*mask, cpu_online_mask, cpu_node_mask(cpu));
/* Update l2-cache mask with all the CPUs that are part of submask */
or_cpumasks_related(cpu, cpu, submask_fn, cpu_l2_cache_mask);
@@ -1538,7 +1533,7 @@ static void update_coregroup_mask(int cpu, cpumask_var_t *mask)
return;
}
- cpumask_and(*mask, cpu_online_mask, cpu_cpu_mask(cpu));
+ cpumask_and(*mask, cpu_online_mask, cpu_node_mask(cpu));
/* Update coregroup mask with all the CPUs that are part of submask */
or_cpumasks_related(cpu, cpu, submask_fn, cpu_coregroup_mask);
@@ -1601,7 +1596,7 @@ static void add_cpu_to_masks(int cpu)
/* If chip_id is -1; limit the cpu_core_mask to within PKG */
if (chip_id == -1)
- cpumask_and(mask, mask, cpu_cpu_mask(cpu));
+ cpumask_and(mask, mask, cpu_node_mask(cpu));
for_each_cpu(i, mask) {
if (chip_id == cpu_to_chip_id(i)) {
@@ -1701,22 +1696,22 @@ static void __init build_sched_topology(void)
if (has_big_cores) {
pr_info("Big cores detected but using small core scheduling\n");
powerpc_topology[i++] =
- SDTL_INIT(smallcore_smt_mask, powerpc_smt_flags, SMT);
+ SDTL_INIT(tl_smallcore_smt_mask, powerpc_smt_flags, SMT);
} else {
- powerpc_topology[i++] = SDTL_INIT(cpu_smt_mask, powerpc_smt_flags, SMT);
+ powerpc_topology[i++] = SDTL_INIT(tl_smt_mask, powerpc_smt_flags, SMT);
}
#endif
if (shared_caches) {
powerpc_topology[i++] =
- SDTL_INIT(shared_cache_mask, powerpc_shared_cache_flags, CACHE);
+ SDTL_INIT(tl_cache_mask, powerpc_shared_cache_flags, CACHE);
}
if (has_coregroup_support()) {
powerpc_topology[i++] =
- SDTL_INIT(cpu_mc_mask, powerpc_shared_proc_flags, MC);
+ SDTL_INIT(tl_mc_mask, powerpc_shared_proc_flags, MC);
}
- powerpc_topology[i++] = SDTL_INIT(cpu_cpu_mask, powerpc_shared_proc_flags, PKG);
+ powerpc_topology[i++] = SDTL_INIT(tl_pkg_mask, powerpc_shared_proc_flags, PKG);
/* There must be one trailing NULL entry left. */
BUG_ON(i >= ARRAY_SIZE(powerpc_topology) - 1);
diff --git a/arch/s390/kernel/topology.c b/arch/s390/kernel/topology.c
index 46569b8e47dde..1594c80e9bc4d 100644
--- a/arch/s390/kernel/topology.c
+++ b/arch/s390/kernel/topology.c
@@ -509,33 +509,27 @@ int topology_cpu_init(struct cpu *cpu)
return rc;
}
-static const struct cpumask *cpu_thread_mask(int cpu)
-{
- return &cpu_topology[cpu].thread_mask;
-}
-
-
const struct cpumask *cpu_coregroup_mask(int cpu)
{
return &cpu_topology[cpu].core_mask;
}
-static const struct cpumask *cpu_book_mask(int cpu)
+static const struct cpumask *tl_book_mask(struct sched_domain_topology_level *tl, int cpu)
{
return &cpu_topology[cpu].book_mask;
}
-static const struct cpumask *cpu_drawer_mask(int cpu)
+static const struct cpumask *tl_drawer_mask(struct sched_domain_topology_level *tl, int cpu)
{
return &cpu_topology[cpu].drawer_mask;
}
static struct sched_domain_topology_level s390_topology[] = {
- SDTL_INIT(cpu_thread_mask, cpu_smt_flags, SMT),
- SDTL_INIT(cpu_coregroup_mask, cpu_core_flags, MC),
- SDTL_INIT(cpu_book_mask, NULL, BOOK),
- SDTL_INIT(cpu_drawer_mask, NULL, DRAWER),
- SDTL_INIT(cpu_cpu_mask, NULL, PKG),
+ SDTL_INIT(tl_smt_mask, cpu_smt_flags, SMT),
+ SDTL_INIT(tl_mc_mask, cpu_core_flags, MC),
+ SDTL_INIT(tl_book_mask, NULL, BOOK),
+ SDTL_INIT(tl_drawer_mask, NULL, DRAWER),
+ SDTL_INIT(tl_pkg_mask, NULL, PKG),
{ NULL, },
};
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 33e166f6ab122..eb289abece237 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -479,14 +479,14 @@ static int x86_cluster_flags(void)
static bool x86_has_numa_in_package;
static struct sched_domain_topology_level x86_topology[] = {
- SDTL_INIT(cpu_smt_mask, cpu_smt_flags, SMT),
+ SDTL_INIT(tl_smt_mask, cpu_smt_flags, SMT),
#ifdef CONFIG_SCHED_CLUSTER
- SDTL_INIT(cpu_clustergroup_mask, x86_cluster_flags, CLS),
+ SDTL_INIT(tl_cls_mask, x86_cluster_flags, CLS),
#endif
#ifdef CONFIG_SCHED_MC
- SDTL_INIT(cpu_coregroup_mask, x86_core_flags, MC),
+ SDTL_INIT(tl_mc_mask, x86_core_flags, MC),
#endif
- SDTL_INIT(cpu_cpu_mask, x86_sched_itmt_flags, PKG),
+ SDTL_INIT(tl_pkg_mask, x86_sched_itmt_flags, PKG),
{ NULL },
};
diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h
index 5263746b63e8c..a3a24e115d446 100644
--- a/include/linux/sched/topology.h
+++ b/include/linux/sched/topology.h
@@ -30,11 +30,19 @@ struct sd_flag_debug {
};
extern const struct sd_flag_debug sd_flag_debug[];
+struct sched_domain_topology_level;
+
#ifdef CONFIG_SCHED_SMT
static inline int cpu_smt_flags(void)
{
return SD_SHARE_CPUCAPACITY | SD_SHARE_LLC;
}
+
+static inline const
+struct cpumask *tl_smt_mask(struct sched_domain_topology_level *tl, int cpu)
+{
+ return cpu_smt_mask(cpu);
+}
#endif
#ifdef CONFIG_SCHED_CLUSTER
@@ -42,6 +50,12 @@ static inline int cpu_cluster_flags(void)
{
return SD_CLUSTER | SD_SHARE_LLC;
}
+
+static inline const
+struct cpumask *tl_cls_mask(struct sched_domain_topology_level *tl, int cpu)
+{
+ return cpu_clustergroup_mask(cpu);
+}
#endif
#ifdef CONFIG_SCHED_MC
@@ -49,8 +63,20 @@ static inline int cpu_core_flags(void)
{
return SD_SHARE_LLC;
}
+
+static inline const
+struct cpumask *tl_mc_mask(struct sched_domain_topology_level *tl, int cpu)
+{
+ return cpu_coregroup_mask(cpu);
+}
#endif
+static inline const
+struct cpumask *tl_pkg_mask(struct sched_domain_topology_level *tl, int cpu)
+{
+ return cpu_node_mask(cpu);
+}
+
#ifdef CONFIG_NUMA
static inline int cpu_numa_flags(void)
{
@@ -172,7 +198,7 @@ bool cpus_equal_capacity(int this_cpu, int that_cpu);
bool cpus_share_cache(int this_cpu, int that_cpu);
bool cpus_share_resources(int this_cpu, int that_cpu);
-typedef const struct cpumask *(*sched_domain_mask_f)(int cpu);
+typedef const struct cpumask *(*sched_domain_mask_f)(struct sched_domain_topology_level *tl, int cpu);
typedef int (*sched_domain_flags_f)(void);
struct sd_data {
diff --git a/include/linux/topology.h b/include/linux/topology.h
index 33b7fda97d390..6575af39fd10f 100644
--- a/include/linux/topology.h
+++ b/include/linux/topology.h
@@ -260,7 +260,7 @@ static inline bool topology_is_primary_thread(unsigned int cpu)
#endif
-static inline const struct cpumask *cpu_cpu_mask(int cpu)
+static inline const struct cpumask *cpu_node_mask(int cpu)
{
return cpumask_of_node(cpu_to_node(cpu));
}
diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
index 6e2f54169e66c..36d4f9f063516 100644
--- a/kernel/sched/topology.c
+++ b/kernel/sched/topology.c
@@ -1591,7 +1591,6 @@ static void claim_allocations(int cpu, struct sched_domain *sd)
enum numa_topology_type sched_numa_topology_type;
static int sched_domains_numa_levels;
-static int sched_domains_curr_level;
int sched_max_numa_distance;
static int *sched_domains_numa_distance;
@@ -1632,14 +1631,7 @@ sd_init(struct sched_domain_topology_level *tl,
int sd_id, sd_weight, sd_flags = 0;
struct cpumask *sd_span;
-#ifdef CONFIG_NUMA
- /*
- * Ugly hack to pass state to sd_numa_mask()...
- */
- sched_domains_curr_level = tl->numa_level;
-#endif
-
- sd_weight = cpumask_weight(tl->mask(cpu));
+ sd_weight = cpumask_weight(tl->mask(tl, cpu));
if (tl->sd_flags)
sd_flags = (*tl->sd_flags)();
@@ -1677,7 +1669,7 @@ sd_init(struct sched_domain_topology_level *tl,
};
sd_span = sched_domain_span(sd);
- cpumask_and(sd_span, cpu_map, tl->mask(cpu));
+ cpumask_and(sd_span, cpu_map, tl->mask(tl, cpu));
sd_id = cpumask_first(sd_span);
sd->flags |= asym_cpu_capacity_classify(sd_span, cpu_map);
@@ -1737,17 +1729,17 @@ sd_init(struct sched_domain_topology_level *tl,
*/
static struct sched_domain_topology_level default_topology[] = {
#ifdef CONFIG_SCHED_SMT
- SDTL_INIT(cpu_smt_mask, cpu_smt_flags, SMT),
+ SDTL_INIT(tl_smt_mask, cpu_smt_flags, SMT),
#endif
#ifdef CONFIG_SCHED_CLUSTER
- SDTL_INIT(cpu_clustergroup_mask, cpu_cluster_flags, CLS),
+ SDTL_INIT(tl_cls_mask, cpu_cluster_flags, CLS),
#endif
#ifdef CONFIG_SCHED_MC
- SDTL_INIT(cpu_coregroup_mask, cpu_core_flags, MC),
+ SDTL_INIT(tl_mc_mask, cpu_core_flags, MC),
#endif
- SDTL_INIT(cpu_cpu_mask, NULL, PKG),
+ SDTL_INIT(tl_pkg_mask, NULL, PKG),
{ NULL, },
};
@@ -1769,9 +1761,9 @@ void __init set_sched_topology(struct sched_domain_topology_level *tl)
#ifdef CONFIG_NUMA
-static const struct cpumask *sd_numa_mask(int cpu)
+static const struct cpumask *sd_numa_mask(struct sched_domain_topology_level *tl, int cpu)
{
- return sched_domains_numa_masks[sched_domains_curr_level][cpu_to_node(cpu)];
+ return sched_domains_numa_masks[tl->numa_level][cpu_to_node(cpu)];
}
static void sched_numa_warn(const char *str)
@@ -2413,7 +2405,7 @@ static bool topology_span_sane(const struct cpumask *cpu_map)
* breaks the linking done for an earlier span.
*/
for_each_cpu(cpu, cpu_map) {
- const struct cpumask *tl_cpu_mask = tl->mask(cpu);
+ const struct cpumask *tl_cpu_mask = tl->mask(tl, cpu);
int id;
/* lowest bit set in this mask is used as a unique id */
@@ -2421,7 +2413,7 @@ static bool topology_span_sane(const struct cpumask *cpu_map)
if (cpumask_test_cpu(id, id_seen)) {
/* First CPU has already been seen, ensure identical spans */
- if (!cpumask_equal(tl->mask(id), tl_cpu_mask))
+ if (!cpumask_equal(tl->mask(tl, id), tl_cpu_mask))
return false;
} else {
/* First CPU hasn't been seen before, ensure it's a completely new span */
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 037/563] lsm: CONFIG_LSM can depend on CONFIG_SECURITY
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 036/563] sched/fair: Get rid of sched_domains_curr_level hack for tl->cpumask() Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 038/563] cpuset: fix failure to enable isolated partition when containing isolcpus Greg Kroah-Hartman
` (539 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Randy Dunlap, Paul Moore,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 54d94c422fed9575b74167333c1757847a4e6899 ]
When CONFIG_SECURITY is not set, CONFIG_LSM (builtin_lsm_order) does
not need to be visible and settable since builtin_lsm_order is defined in
security.o, which is only built when CONFIG_SECURITY=y.
So make CONFIG_LSM depend on CONFIG_SECURITY.
Fixes: 13e735c0e953 ("LSM: Introduce CONFIG_LSM")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
[PM: subj tweak]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/security/Kconfig b/security/Kconfig
index 4816fc74f81eb..285f284dfcac4 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -269,6 +269,7 @@ endchoice
config LSM
string "Ordered list of enabled LSMs"
+ depends on SECURITY
default "landlock,lockdown,yama,loadpin,safesetid,smack,selinux,tomoyo,apparmor,ipe,bpf" if DEFAULT_SECURITY_SMACK
default "landlock,lockdown,yama,loadpin,safesetid,apparmor,selinux,smack,tomoyo,ipe,bpf" if DEFAULT_SECURITY_APPARMOR
default "landlock,lockdown,yama,loadpin,safesetid,tomoyo,ipe,bpf" if DEFAULT_SECURITY_TOMOYO
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 038/563] cpuset: fix failure to enable isolated partition when containing isolcpus
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 037/563] lsm: CONFIG_LSM can depend on CONFIG_SECURITY Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 039/563] btrfs: return any hit error from extent_writepage_io() Greg Kroah-Hartman
` (538 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen Ridong, Waiman Long, Tejun Heo,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <chenridong@huawei.com>
[ Upstream commit 216217ebee16afc4d79c3e86a736d87175c18e68 ]
The 'isolcpus' parameter specified at boot time can be assigned to an
isolated partition. While it is valid put the 'isolcpus' in an isolated
partition, attempting to change a member cpuset to an isolated partition
will fail if the cpuset contains any 'isolcpus'.
For example, the system boots with 'isolcpus=9', and the following
configuration works correctly:
# cd /sys/fs/cgroup/
# mkdir test
# echo 1 > test/cpuset.cpus
# echo isolated > test/cpuset.cpus.partition
# cat test/cpuset.cpus.partition
isolated
# echo 9 > test/cpuset.cpus
# cat test/cpuset.cpus.partition
isolated
# cat test/cpuset.cpus
9
However, the following steps to convert a member cpuset to an isolated
partition will fail:
# cd /sys/fs/cgroup/
# mkdir test
# echo 9 > test/cpuset.cpus
# echo isolated > test/cpuset.cpus.partition
# cat test/cpuset.cpus.partition
isolated invalid (partition config conflicts with housekeeping setup)
The issue occurs because the new partition state (new_prs) is used for
validation against housekeeping constraints before it has been properly
updated. To resolve this, move the assignment of new_prs before the
housekeeping validation check when enabling a root partition.
Fixes: 4a74e418881f ("cgroup/cpuset: Check partition conflict with housekeeping setup")
Signed-off-by: Chen Ridong <chenridong@huawei.com>
Reviewed-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/cgroup/cpuset.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index 27adb04df675d..fef93032fe7e4 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -1716,6 +1716,7 @@ static int update_parent_effective_cpumask(struct cpuset *cs, int cmd,
xcpus = tmp->delmask;
if (compute_effective_exclusive_cpumask(cs, xcpus, NULL))
WARN_ON_ONCE(!cpumask_empty(cs->exclusive_cpus));
+ new_prs = (cmd == partcmd_enable) ? PRS_ROOT : PRS_ISOLATED;
/*
* Enabling partition root is not allowed if its
@@ -1748,7 +1749,6 @@ static int update_parent_effective_cpumask(struct cpuset *cs, int cmd,
deleting = true;
subparts_delta++;
- new_prs = (cmd == partcmd_enable) ? PRS_ROOT : PRS_ISOLATED;
} else if (cmd == partcmd_disable) {
/*
* May need to add cpus back to parent's effective_cpus
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 039/563] btrfs: return any hit error from extent_writepage_io()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 038/563] cpuset: fix failure to enable isolated partition when containing isolcpus Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 040/563] btrfs: fix symbolic link reading when bs > ps Greg Kroah-Hartman
` (537 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Vacek, Qu Wenruo,
David Sterba, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <wqu@suse.com>
[ Upstream commit 2d83ed6c6c4607b42ee7927e92a9d2fa31d6f30b ]
Since the support of bs < ps support, extent_writepage_io() will submit
multiple blocks inside the folio.
But if we hit error submitting one sector, but the next sector can still
be submitted successfully, the function extent_writepage_io() will still
return 0.
This will make btrfs to silently ignore the error without setting error
flag for the filemap.
Fix it by recording the first error hit, and always return that value.
Fixes: 8bf334beb349 ("btrfs: fix double accounting race when extent_writepage_io() failed")
Reviewed-by: Daniel Vacek <neelx@suse.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/extent_io.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index b21cb72835ccf..4eafe3817e11c 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -1621,7 +1621,7 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode,
struct btrfs_fs_info *fs_info = inode->root->fs_info;
unsigned long range_bitmap = 0;
bool submitted_io = false;
- bool error = false;
+ int found_error = 0;
const u64 folio_start = folio_pos(folio);
const unsigned int blocks_per_folio = btrfs_blocks_per_folio(fs_info, folio);
u64 cur;
@@ -1685,7 +1685,8 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode,
*/
btrfs_mark_ordered_io_finished(inode, folio, cur,
fs_info->sectorsize, false);
- error = true;
+ if (!found_error)
+ found_error = ret;
continue;
}
submitted_io = true;
@@ -1702,11 +1703,11 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode,
* If we hit any error, the corresponding sector will have its dirty
* flag cleared and writeback finished, thus no need to handle the error case.
*/
- if (!submitted_io && !error) {
+ if (!submitted_io && !found_error) {
btrfs_folio_set_writeback(fs_info, folio, start, len);
btrfs_folio_clear_writeback(fs_info, folio, start, len);
}
- return ret;
+ return found_error;
}
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 040/563] btrfs: fix symbolic link reading when bs > ps
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 039/563] btrfs: return any hit error from extent_writepage_io() Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 041/563] pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() Greg Kroah-Hartman
` (536 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Qu Wenruo, David Sterba, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <wqu@suse.com>
[ Upstream commit 67378b754608a3524d125bfa5744508a49fe48be ]
[BUG DURING BS > PS TEST]
When running the following script on a btrfs whose block size is larger
than page size, e.g. 8K block size and 4K page size, it will trigger a
kernel BUG:
# mkfs.btrfs -s 8k $dev
# mount $dev $mnt
# mkdir $mnt/dir
# ln -s dir $mnt/link
# ls $mnt/link
The call trace looks like this:
BTRFS warning (device dm-2): support for block size 8192 with page size 4096 is experimental, some features may be missing
BTRFS info (device dm-2): checking UUID tree
BTRFS info (device dm-2): enabling ssd optimizations
BTRFS info (device dm-2): enabling free space tree
------------[ cut here ]------------
kernel BUG at /home/adam/linux/include/linux/highmem.h:275!
Oops: invalid opcode: 0000 [#1] SMP
CPU: 8 UID: 0 PID: 667 Comm: ls Tainted: G OE 6.17.0-rc4-custom+ #283 PREEMPT(full)
Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022
RIP: 0010:zero_user_segments.constprop.0+0xdc/0xe0 [btrfs]
Call Trace:
<TASK>
btrfs_get_extent.cold+0x85/0x101 [btrfs 7453c70c03e631c8d8bfdd4264fa62d3e238da6f]
btrfs_do_readpage+0x244/0x750 [btrfs 7453c70c03e631c8d8bfdd4264fa62d3e238da6f]
btrfs_read_folio+0x9c/0x100 [btrfs 7453c70c03e631c8d8bfdd4264fa62d3e238da6f]
filemap_read_folio+0x37/0xe0
do_read_cache_folio+0x94/0x3e0
__page_get_link.isra.0+0x20/0x90
page_get_link+0x16/0x40
step_into+0x69b/0x830
path_lookupat+0xa7/0x170
filename_lookup+0xf7/0x200
? set_ptes.isra.0+0x36/0x70
vfs_statx+0x7a/0x160
do_statx+0x63/0xa0
__x64_sys_statx+0x90/0xe0
do_syscall_64+0x82/0xae0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
</TASK>
Please note bs > ps support is still under development and the
enablement patch is not even in btrfs development branch.
[CAUSE]
Btrfs reuses its data folio read path to handle symbolic links, as the
symbolic link target is stored as an inline data extent.
But for newly created inodes, btrfs only set the minimal order if the
target inode is a regular file.
Thus for above newly created symbolic link, it doesn't properly respect
the minimal folio order, and triggered the above crash.
[FIX]
Call btrfs_set_inode_mapping_order() unconditionally inside
btrfs_create_new_inode().
For symbolic links this will fix the crash as now the folio will meet
the minimal order.
For regular files this brings no change.
For directory/bdev/char and all the other types of inodes, they won't
go through the data read path, thus no effect either.
Fixes: cc38d178ff33 ("btrfs: enable large data folio support under CONFIG_BTRFS_EXPERIMENTAL")
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/inode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 18db1053cdf08..cd8a09e3d1dc0 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -6479,6 +6479,7 @@ int btrfs_create_new_inode(struct btrfs_trans_handle *trans,
if (!args->subvol)
btrfs_inherit_iflags(BTRFS_I(inode), BTRFS_I(dir));
+ btrfs_set_inode_mapping_order(BTRFS_I(inode));
if (S_ISREG(inode->i_mode)) {
if (btrfs_test_opt(fs_info, NODATASUM))
BTRFS_I(inode)->flags |= BTRFS_INODE_NODATASUM;
@@ -6486,7 +6487,6 @@ int btrfs_create_new_inode(struct btrfs_trans_handle *trans,
BTRFS_I(inode)->flags |= BTRFS_INODE_NODATACOW |
BTRFS_INODE_NODATASUM;
btrfs_update_inode_mapping_flags(BTRFS_I(inode));
- btrfs_set_inode_mapping_order(BTRFS_I(inode));
}
ret = btrfs_insert_inode_locked(inode);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 041/563] pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 040/563] btrfs: fix symbolic link reading when bs > ps Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 042/563] arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 Greg Kroah-Hartman
` (535 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lad Prabhakar, Geert Uytterhoeven,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
[ Upstream commit 8912b2862b9b74a0dc4e3ea1aacdec2f8abd7e1d ]
rzg3s_oen_read() returns a u32 value, but previously propagated a negative
error code from rzg3s_pin_to_oen_bit(), resulting in an unintended large
positive value due to unsigned conversion. This caused incorrect
output-enable reporting for certain pins.
Without this patch, pins P1_0-P1_4 and P7_0-P7_4 are incorrectly reported
as "output enabled" in the pinconf-pins debugfs file. With this fix, only
P1_0-P1_1 and P7_0-P7_1 are shown as "output enabled", which matches the
hardware manual.
Fix this by returning 0 when the OEN bit lookup fails, treating the pin
as output-disabled by default.
Fixes: a9024a323af2 ("pinctrl: renesas: rzg2l: Clean up and refactor OEN read/write functions")
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/20250709160819.306875-2-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
index c52263c2a7b09..22bc5b8f65fde 100644
--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
@@ -1124,7 +1124,7 @@ static u32 rzg3s_oen_read(struct rzg2l_pinctrl *pctrl, unsigned int _pin)
bit = rzg3s_pin_to_oen_bit(pctrl, _pin);
if (bit < 0)
- return bit;
+ return 0;
return !(readb(pctrl->base + ETH_MODE) & BIT(bit));
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 042/563] arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 041/563] pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 043/563] bpf: Tidy verifier bug message Greg Kroah-Hartman
` (534 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Biju Das, Geert Uytterhoeven,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <biju.das.jz@bp.renesas.com>
[ Upstream commit ae014fbc99c7f986ee785233e7a5336834e39af4 ]
On RZ/G2LC SMARC EVK, CAN-FD channel0 is not populated, and currently we
are deleting a wrong and nonexistent node. Fixing the wrong node would
invoke a dtb warning message, as channel0 is a required property.
Disable CAN-FD channel0 instead of deleting the node.
Fixes: 46da632734a5 ("arm64: dts: renesas: rzg2lc-smarc: Enable CANFD channel 1")
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/20250801121959.267424-1-biju.das.jz@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
index 345b779e4f601..f3d7eff0d2f2a 100644
--- a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
+++ b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
@@ -48,7 +48,10 @@ sound_card {
#if (SW_SCIF_CAN || SW_RSPI_CAN)
&canfd {
pinctrl-0 = <&can1_pins>;
- /delete-node/ channel@0;
+
+ channel0 {
+ status = "disabled";
+ };
};
#else
&canfd {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 043/563] bpf: Tidy verifier bug message
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 042/563] arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 044/563] regmap: Remove superfluous check for !config in __regmap_init() Greg Kroah-Hartman
` (533 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yonghong Song, Paul Chaignon,
Andrii Nakryiko, Eduard Zingerman, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Chaignon <paul.chaignon@gmail.com>
[ Upstream commit c93c59baa5ab57e94b874000cec56e26611b7a23 ]
Yonghong noticed that error messages for potential verifier bugs often
have a '(1)' at the end. This is happening because verifier_bug_if(cond,
env, fmt, args...) prints "(" #cond ")\n" as part of the message and
verifier_bug() is defined as:
#define verifier_bug(env, fmt, args...) verifier_bug_if(1, env, fmt, ##args)
Hence, verifier_bug() always ends up displaying '(1)'. This small patch
fixes it by having verifier_bug_if conditionally call verifier_bug
instead of the other way around.
Fixes: 1cb0f56d9618 ("bpf: WARN_ONCE on verifier bugs")
Reported-by: Yonghong Song <yonghong.song@linux.dev>
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Tested-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/bpf/aJo9THBrzo8jFXsh@mail.gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/bpf_verifier.h | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index 94defa405c85e..fe9a841fdf0cf 100644
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -875,13 +875,15 @@ __printf(3, 4) void verbose_linfo(struct bpf_verifier_env *env,
#define verifier_bug_if(cond, env, fmt, args...) \
({ \
bool __cond = (cond); \
- if (unlikely(__cond)) { \
- BPF_WARN_ONCE(1, "verifier bug: " fmt "(" #cond ")\n", ##args); \
- bpf_log(&env->log, "verifier bug: " fmt "(" #cond ")\n", ##args); \
- } \
+ if (unlikely(__cond)) \
+ verifier_bug(env, fmt " (" #cond ")", ##args); \
(__cond); \
})
-#define verifier_bug(env, fmt, args...) verifier_bug_if(1, env, fmt, ##args)
+#define verifier_bug(env, fmt, args...) \
+ ({ \
+ BPF_WARN_ONCE(1, "verifier bug: " fmt "\n", ##args); \
+ bpf_log(&env->log, "verifier bug: " fmt "\n", ##args); \
+ })
static inline struct bpf_func_state *cur_func(struct bpf_verifier_env *env)
{
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 044/563] regmap: Remove superfluous check for !config in __regmap_init()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 043/563] bpf: Tidy verifier bug message Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 045/563] selftests/bpf: Copy test_kmods when installing selftest Greg Kroah-Hartman
` (532 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Mark Brown,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ]
The first thing __regmap_init() do is check if config is non-NULL,
so there is no need to check for this again later.
Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/a154d9db0f290dda96b48bd817eb743773e846e1.1755090330.git.geert+renesas@glider.be
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/regmap/regmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 1f3f782a04ba2..6883e1a43fe5d 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -827,7 +827,7 @@ struct regmap *__regmap_init(struct device *dev,
map->read_flag_mask = bus->read_flag_mask;
}
- if (config && config->read && config->write) {
+ if (config->read && config->write) {
map->reg_read = _regmap_bus_read;
if (config->reg_update_bits)
map->reg_update_bits = config->reg_update_bits;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 045/563] selftests/bpf: Copy test_kmods when installing selftest
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 044/563] regmap: Remove superfluous check for !config in __regmap_init() Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 046/563] rust: cpumask: Mark CpumaskVar as transparent Greg Kroah-Hartman
` (531 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Amery Hung, Andrii Nakryiko,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amery Hung <ameryhung@gmail.com>
[ Upstream commit 07866544e410e4c895a729971e4164861b41fad5 ]
Commit d6212d82bf26 ("selftests/bpf: Consolidate kernel modules into
common directory") consolidated the Makefile of test_kmods. However,
since it removed test_kmods from TEST_GEN_PROGS_EXTENDED, the kernel
modules required by bpf selftests are now missing from kselftest_install
when "make install". Fix it by adding test_kmod to TEST_GEN_FILES.
Fixes: d6212d82bf26 ("selftests/bpf: Consolidate kernel modules into common directory")
Signed-off-by: Amery Hung <ameryhung@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20250812175039.2323570-1-ameryhung@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 4863106034dfb..77794efc020ea 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -137,7 +137,7 @@ TEST_GEN_PROGS_EXTENDED = \
xdping \
xskxceiver
-TEST_GEN_FILES += liburandom_read.so urandom_read sign-file uprobe_multi
+TEST_GEN_FILES += $(TEST_KMODS) liburandom_read.so urandom_read sign-file uprobe_multi
ifneq ($(V),1)
submake_extras := feature_display=0
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 046/563] rust: cpumask: Mark CpumaskVar as transparent
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 045/563] selftests/bpf: Copy test_kmods when installing selftest Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 047/563] bpf/selftests: Fix test_tcpnotify_user Greg Kroah-Hartman
` (530 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baptiste Lepers, Alice Ryhl,
Viresh Kumar, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baptiste Lepers <baptiste.lepers@gmail.com>
[ Upstream commit 23fca458f6ab18927e50c2134fb7b60297f18b4e ]
Unsafe code in CpumaskVar's methods assumes that the type has the same
layout as `bindings::cpumask_var_t`. This is not guaranteed by
the default struct representation in Rust, but requires specifying the
`transparent` representation.
Fixes: 8961b8cb3099a ("rust: cpumask: Add initial abstractions")
Signed-off-by: Baptiste Lepers <baptiste.lepers@gmail.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
rust/kernel/cpumask.rs | 1 +
1 file changed, 1 insertion(+)
diff --git a/rust/kernel/cpumask.rs b/rust/kernel/cpumask.rs
index 3fcbff4386705..05e1c882404e4 100644
--- a/rust/kernel/cpumask.rs
+++ b/rust/kernel/cpumask.rs
@@ -212,6 +212,7 @@ impl Cpumask {
/// }
/// assert_eq!(mask2.weight(), count);
/// ```
+#[repr(transparent)]
pub struct CpumaskVar {
#[cfg(CONFIG_CPUMASK_OFFSTACK)]
ptr: NonNull<Cpumask>,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 047/563] bpf/selftests: Fix test_tcpnotify_user
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 046/563] rust: cpumask: Mark CpumaskVar as transparent Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 048/563] bpf: Remove migrate_disable in kprobe_multi_link_prog_run Greg Kroah-Hartman
` (529 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Bobrowski, Martin KaFai Lau,
Stanislav Fomichev, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Bobrowski <mattbobrowski@google.com>
[ Upstream commit c80d79720647ed77ebc0198abd5a0807efdaff0b ]
Based on a bisect, it appears that commit 7ee988770326 ("timers:
Implement the hierarchical pull model") has somehow inadvertently
broken BPF selftest test_tcpnotify_user. The error that is being
generated by this test is as follows:
FAILED: Wrong stats Expected 10 calls, got 8
It looks like the change allows timer functions to be run on CPUs
different from the one they are armed on. The test had pinned itself
to CPU 0, and in the past the retransmit attempts also occurred on CPU
0. The test had set the max_entries attribute for
BPF_MAP_TYPE_PERF_EVENT_ARRAY to 2 and was calling
bpf_perf_event_output() with BPF_F_CURRENT_CPU, so the entry was
likely to be in range. With the change to allow timers to run on other
CPUs, the current CPU tasked with performing the retransmit might be
bumped and in turn fall out of range, as the event will be filtered
out via __bpf_perf_event_output() using:
if (unlikely(index >= array->map.max_entries))
return -E2BIG;
A possible change would be to explicitly set the max_entries attribute
for perf_event_map in test_tcpnotify_kern.c to a value that's at least
as large as the number of CPUs. As it turns out however, if the field
is left unset, then the libbpf will determine the number of CPUs available
on the underlying system and update the max_entries attribute accordingly
in map_set_def_max_entries().
A further problem with the test is that it has a thread that continues
running up until the program exits. The main thread cleans up some
LIBBPF data structures, while the other thread continues to use them,
which inevitably will trigger a SIGSEGV. This can be dealt with by
telling the thread to run for as long as necessary and doing a
pthread_join on it before exiting the program.
Finally, I don't think binding the process to CPU 0 is meaningful for
this test any more, so get rid of that.
Fixes: 435f90a338ae ("selftests/bpf: add a test case for sock_ops perf-event notification")
Signed-off-by: Matt Bobrowski <mattbobrowski@google.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Link: https://patch.msgid.link/aJ8kHhwgATmA3rLf@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../selftests/bpf/progs/test_tcpnotify_kern.c | 1 -
.../selftests/bpf/test_tcpnotify_user.c | 20 +++++++++----------
2 files changed, 10 insertions(+), 11 deletions(-)
diff --git a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
index 540181c115a85..ef00d38b0a8d2 100644
--- a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
+++ b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
@@ -23,7 +23,6 @@ struct {
struct {
__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
- __uint(max_entries, 2);
__type(key, int);
__type(value, __u32);
} perf_event_map SEC(".maps");
diff --git a/tools/testing/selftests/bpf/test_tcpnotify_user.c b/tools/testing/selftests/bpf/test_tcpnotify_user.c
index 595194453ff8f..35b4893ccdf8a 100644
--- a/tools/testing/selftests/bpf/test_tcpnotify_user.c
+++ b/tools/testing/selftests/bpf/test_tcpnotify_user.c
@@ -15,20 +15,18 @@
#include <bpf/libbpf.h>
#include <sys/ioctl.h>
#include <linux/rtnetlink.h>
-#include <signal.h>
#include <linux/perf_event.h>
-#include <linux/err.h>
-#include "bpf_util.h"
#include "cgroup_helpers.h"
#include "test_tcpnotify.h"
-#include "trace_helpers.h"
#include "testing_helpers.h"
#define SOCKET_BUFFER_SIZE (getpagesize() < 8192L ? getpagesize() : 8192L)
pthread_t tid;
+static bool exit_thread;
+
int rx_callbacks;
static void dummyfn(void *ctx, int cpu, void *data, __u32 size)
@@ -45,7 +43,7 @@ void tcp_notifier_poller(struct perf_buffer *pb)
{
int err;
- while (1) {
+ while (!exit_thread) {
err = perf_buffer__poll(pb, 100);
if (err < 0 && err != -EINTR) {
printf("failed perf_buffer__poll: %d\n", err);
@@ -78,15 +76,10 @@ int main(int argc, char **argv)
int error = EXIT_FAILURE;
struct bpf_object *obj;
char test_script[80];
- cpu_set_t cpuset;
__u32 key = 0;
libbpf_set_strict_mode(LIBBPF_STRICT_ALL);
- CPU_ZERO(&cpuset);
- CPU_SET(0, &cpuset);
- pthread_setaffinity_np(pthread_self(), sizeof(cpu_set_t), &cpuset);
-
cg_fd = cgroup_setup_and_join(cg_path);
if (cg_fd < 0)
goto err;
@@ -151,6 +144,13 @@ int main(int argc, char **argv)
sleep(10);
+ exit_thread = true;
+ int ret = pthread_join(tid, NULL);
+ if (ret) {
+ printf("FAILED: pthread_join\n");
+ goto err;
+ }
+
if (verify_result(&g)) {
printf("FAILED: Wrong stats Expected %d calls, got %d\n",
g.ncalls, rx_callbacks);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 048/563] bpf: Remove migrate_disable in kprobe_multi_link_prog_run
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 047/563] bpf/selftests: Fix test_tcpnotify_user Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 049/563] libbpf: Fix reuse of DEVMAP Greg Kroah-Hartman
` (528 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tao Chen, Andrii Nakryiko,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Chen <chen.dylane@linux.dev>
[ Upstream commit abdaf49be5424db74e19d167c10d7dad79a0efc2 ]
Graph tracer framework ensures we won't migrate, kprobe_multi_link_prog_run
called all the way from graph tracer, which disables preemption in
function_graph_enter_regs, as Jiri and Yonghong suggested, there is no
need to use migrate_disable. As a result, some overhead may will be reduced.
And add cant_sleep check for __this_cpu_inc_return.
Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
Signed-off-by: Tao Chen <chen.dylane@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20250814121430.2347454-1-chen.dylane@linux.dev
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/bpf_trace.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 3ae52978cae61..606007c387c52 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2728,20 +2728,25 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link,
struct pt_regs *regs;
int err;
+ /*
+ * graph tracer framework ensures we won't migrate, so there is no need
+ * to use migrate_disable for bpf_prog_run again. The check here just for
+ * __this_cpu_inc_return.
+ */
+ cant_sleep();
+
if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) {
bpf_prog_inc_misses_counter(link->link.prog);
err = 1;
goto out;
}
- migrate_disable();
rcu_read_lock();
regs = ftrace_partial_regs(fregs, bpf_kprobe_multi_pt_regs_ptr());
old_run_ctx = bpf_set_run_ctx(&run_ctx.session_ctx.run_ctx);
err = bpf_prog_run(link->link.prog, regs);
bpf_reset_run_ctx(old_run_ctx);
rcu_read_unlock();
- migrate_enable();
out:
__this_cpu_dec(bpf_prog_active);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 049/563] libbpf: Fix reuse of DEVMAP
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 048/563] bpf: Remove migrate_disable in kprobe_multi_link_prog_run Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 050/563] tools/nolibc: fix error return value of clock_nanosleep() Greg Kroah-Hartman
` (527 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yureka Lilian, Andrii Nakryiko,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yureka Lilian <yuka@yuka.dev>
[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ]
Previously, re-using pinned DEVMAP maps would always fail, because
get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set,
but BPF_F_RDONLY_PROG being set on a map during creation is invalid.
Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
get_map_info when checking for compatibility with an existing DEVMAP.
The same problem is handled in a third-party ebpf library:
- https://github.com/cilium/ebpf/issues/925
- https://github.com/cilium/ebpf/pull/930
Fixes: 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF")
Signed-off-by: Yureka Lilian <yuka@yuka.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20250814180113.1245565-3-yuka@yuka.dev
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/libbpf.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 8f5a81b672e1b..fe4fc5438678c 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -5093,6 +5093,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd)
return false;
}
+ /*
+ * bpf_get_map_info_by_fd() for DEVMAP will always return flags with
+ * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time.
+ * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
+ * bpf_get_map_info_by_fd() when checking for compatibility with an
+ * existing DEVMAP.
+ */
+ if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH)
+ map_info.map_flags &= ~BPF_F_RDONLY_PROG;
+
return (map_info.type == map->def.type &&
map_info.key_size == map->def.key_size &&
map_info.value_size == map->def.value_size &&
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 050/563] tools/nolibc: fix error return value of clock_nanosleep()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 049/563] libbpf: Fix reuse of DEVMAP Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 051/563] ARM: dts: renesas: porter: Fix CAN pin group Greg Kroah-Hartman
` (526 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh, Willy Tarreau,
Thomas Weißschuh, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit 1201f6fb5bfdbd10985ac3c8f49ef8f4f88b5c94 ]
clock_nanosleep() returns a positive error value. Unlike other libc
functions it *does not* return -1 nor set errno.
Fix the return value and also adapt nanosleep().
Fixes: 7c02bc4088af ("tools/nolibc: add support for clock_nanosleep() and nanosleep()")
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Acked-by: Willy Tarreau <w@1wt.eu>
Link: https://lore.kernel.org/r/20250731-nolibc-clock_nanosleep-ret-v1-1-9e4af7855e61@linutronix.de
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/include/nolibc/time.h | 5 +++--
tools/testing/selftests/nolibc/nolibc-test.c | 1 +
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/tools/include/nolibc/time.h b/tools/include/nolibc/time.h
index d02bc44d2643a..e9c1b976791a6 100644
--- a/tools/include/nolibc/time.h
+++ b/tools/include/nolibc/time.h
@@ -133,7 +133,8 @@ static __attribute__((unused))
int clock_nanosleep(clockid_t clockid, int flags, const struct timespec *rqtp,
struct timespec *rmtp)
{
- return __sysret(sys_clock_nanosleep(clockid, flags, rqtp, rmtp));
+ /* Directly return a positive error number */
+ return -sys_clock_nanosleep(clockid, flags, rqtp, rmtp);
}
static __inline__
@@ -145,7 +146,7 @@ double difftime(time_t time1, time_t time2)
static __inline__
int nanosleep(const struct timespec *rqtp, struct timespec *rmtp)
{
- return clock_nanosleep(CLOCK_REALTIME, 0, rqtp, rmtp);
+ return __sysret(sys_clock_nanosleep(CLOCK_REALTIME, 0, rqtp, rmtp));
}
diff --git a/tools/testing/selftests/nolibc/nolibc-test.c b/tools/testing/selftests/nolibc/nolibc-test.c
index a297ee0d6d075..cc4d730ac4656 100644
--- a/tools/testing/selftests/nolibc/nolibc-test.c
+++ b/tools/testing/selftests/nolibc/nolibc-test.c
@@ -1334,6 +1334,7 @@ int run_syscall(int min, int max)
CASE_TEST(chroot_root); EXPECT_SYSZR(euid0, chroot("/")); break;
CASE_TEST(chroot_blah); EXPECT_SYSER(1, chroot("/proc/self/blah"), -1, ENOENT); break;
CASE_TEST(chroot_exe); EXPECT_SYSER(1, chroot(argv0), -1, ENOTDIR); break;
+ CASE_TEST(clock_nanosleep); ts.tv_nsec = -1; EXPECT_EQ(1, EINVAL, clock_nanosleep(CLOCK_REALTIME, 0, &ts, NULL)); break;
CASE_TEST(close_m1); EXPECT_SYSER(1, close(-1), -1, EBADF); break;
CASE_TEST(close_dup); EXPECT_SYSZR(1, close(dup(0))); break;
CASE_TEST(dup_0); tmp = dup(0); EXPECT_SYSNE(1, tmp, -1); close(tmp); break;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 051/563] ARM: dts: renesas: porter: Fix CAN pin group
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 050/563] tools/nolibc: fix error return value of clock_nanosleep() Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 052/563] leds: max77705: Function return instead of variable assignment Greg Kroah-Hartman
` (525 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit 287066b295051729fb08c3cff12ae17c6fe66133 ]
According to the schematics, the CAN transceiver is connected to pins
GP7_3 and GP7_4, which correspond to CAN0 data group B.
Fixes: 0768fbad7fba1d27 ("ARM: shmobile: porter: add CAN0 DT support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/70ad9bc44d6cea92197c42eedcad6b3d0641d26a.1751032025.git.geert+renesas@glider.be
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/renesas/r8a7791-porter.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/renesas/r8a7791-porter.dts b/arch/arm/boot/dts/renesas/r8a7791-porter.dts
index f518eadd8b9cd..81b3c5d74e9b3 100644
--- a/arch/arm/boot/dts/renesas/r8a7791-porter.dts
+++ b/arch/arm/boot/dts/renesas/r8a7791-porter.dts
@@ -289,7 +289,7 @@ vin0_pins: vin0 {
};
can0_pins: can0 {
- groups = "can0_data";
+ groups = "can0_data_b";
function = "can0";
};
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 052/563] leds: max77705: Function return instead of variable assignment
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 051/563] ARM: dts: renesas: porter: Fix CAN pin group Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 053/563] leds: flash: leds-qcom-flash: Update torch current clamp setting Greg Kroah-Hartman
` (524 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Len Bao, Lee Jones, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Len Bao <len.bao@gmx.us>
[ Upstream commit 6e3779e3c6f9dcc9267bf98bef70773a0b13dcbb ]
Coverity noticed that assigning value -EINVAL to 'ret' in the if
statement is useless because 'ret' is overwritten a few lines later.
However, after inspect the code, this warning reveals that we need to
return -EINVAL instead of the variable assignment. So, fix it.
Coverity-id: 1646104
Fixes: aebb5fc9a0d8 ("leds: max77705: Add LEDs support")
Signed-off-by: Len Bao <len.bao@gmx.us>
Link: https://lore.kernel.org/r/20250727075649.34496-1-len.bao@gmx.us
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/leds/leds-max77705.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/leds/leds-max77705.c b/drivers/leds/leds-max77705.c
index 933cb4f19be9b..b7403b3fcf5e7 100644
--- a/drivers/leds/leds-max77705.c
+++ b/drivers/leds/leds-max77705.c
@@ -180,7 +180,7 @@ static int max77705_add_led(struct device *dev, struct regmap *regmap, struct fw
ret = fwnode_property_read_u32(np, "reg", ®);
if (ret || reg >= MAX77705_LED_NUM_LEDS)
- ret = -EINVAL;
+ return -EINVAL;
info = devm_kcalloc(dev, num_channels, sizeof(*info), GFP_KERNEL);
if (!info)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 053/563] leds: flash: leds-qcom-flash: Update torch current clamp setting
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 052/563] leds: max77705: Function return instead of variable assignment Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 054/563] s390/bpf: Do not write tail call counter into helper and kfunc frames Greg Kroah-Hartman
` (523 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fenglin Wu, Konrad Dybcio, Lee Jones,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
[ Upstream commit 5974e8f6c3e47ab097c3dd8ece7324d1f88fe739 ]
There is a register to clamp the flash current per LED channel when
safety timer is disabled. It needs to be updated according to the
maximum torch LED current setting to ensure the torch current won't
be clamped unexpectedly.
Fixes: 96a2e242a5dc ("leds: flash: Add driver to support flash LED module in QCOM PMICs")
Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250729-fix-torch-clamp-issue-v2-1-9b83816437a3@oss.qualcomm.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/leds/flash/leds-qcom-flash.c | 62 ++++++++++++++++------------
1 file changed, 36 insertions(+), 26 deletions(-)
diff --git a/drivers/leds/flash/leds-qcom-flash.c b/drivers/leds/flash/leds-qcom-flash.c
index 89cf5120f5d55..db7c2c743adc7 100644
--- a/drivers/leds/flash/leds-qcom-flash.c
+++ b/drivers/leds/flash/leds-qcom-flash.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022, 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
*/
#include <linux/bitfield.h>
@@ -114,36 +114,39 @@ enum {
REG_THERM_THRSH1,
REG_THERM_THRSH2,
REG_THERM_THRSH3,
+ REG_TORCH_CLAMP,
REG_MAX_COUNT,
};
static const struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = {
- REG_FIELD(0x08, 0, 7), /* status1 */
- REG_FIELD(0x09, 0, 7), /* status2 */
- REG_FIELD(0x0a, 0, 7), /* status3 */
- REG_FIELD_ID(0x40, 0, 7, 3, 1), /* chan_timer */
- REG_FIELD_ID(0x43, 0, 6, 3, 1), /* itarget */
- REG_FIELD(0x46, 7, 7), /* module_en */
- REG_FIELD(0x47, 0, 5), /* iresolution */
- REG_FIELD_ID(0x49, 0, 2, 3, 1), /* chan_strobe */
- REG_FIELD(0x4c, 0, 2), /* chan_en */
- REG_FIELD(0x56, 0, 2), /* therm_thrsh1 */
- REG_FIELD(0x57, 0, 2), /* therm_thrsh2 */
- REG_FIELD(0x58, 0, 2), /* therm_thrsh3 */
+ [REG_STATUS1] = REG_FIELD(0x08, 0, 7),
+ [REG_STATUS2] = REG_FIELD(0x09, 0, 7),
+ [REG_STATUS3] = REG_FIELD(0x0a, 0, 7),
+ [REG_CHAN_TIMER] = REG_FIELD_ID(0x40, 0, 7, 3, 1),
+ [REG_ITARGET] = REG_FIELD_ID(0x43, 0, 6, 3, 1),
+ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7),
+ [REG_IRESOLUTION] = REG_FIELD(0x47, 0, 5),
+ [REG_CHAN_STROBE] = REG_FIELD_ID(0x49, 0, 2, 3, 1),
+ [REG_CHAN_EN] = REG_FIELD(0x4c, 0, 2),
+ [REG_THERM_THRSH1] = REG_FIELD(0x56, 0, 2),
+ [REG_THERM_THRSH2] = REG_FIELD(0x57, 0, 2),
+ [REG_THERM_THRSH3] = REG_FIELD(0x58, 0, 2),
+ [REG_TORCH_CLAMP] = REG_FIELD(0xec, 0, 6),
};
static const struct reg_field mvflash_4ch_regs[REG_MAX_COUNT] = {
- REG_FIELD(0x06, 0, 7), /* status1 */
- REG_FIELD(0x07, 0, 6), /* status2 */
- REG_FIELD(0x09, 0, 7), /* status3 */
- REG_FIELD_ID(0x3e, 0, 7, 4, 1), /* chan_timer */
- REG_FIELD_ID(0x42, 0, 6, 4, 1), /* itarget */
- REG_FIELD(0x46, 7, 7), /* module_en */
- REG_FIELD(0x49, 0, 3), /* iresolution */
- REG_FIELD_ID(0x4a, 0, 6, 4, 1), /* chan_strobe */
- REG_FIELD(0x4e, 0, 3), /* chan_en */
- REG_FIELD(0x7a, 0, 2), /* therm_thrsh1 */
- REG_FIELD(0x78, 0, 2), /* therm_thrsh2 */
+ [REG_STATUS1] = REG_FIELD(0x06, 0, 7),
+ [REG_STATUS2] = REG_FIELD(0x07, 0, 6),
+ [REG_STATUS3] = REG_FIELD(0x09, 0, 7),
+ [REG_CHAN_TIMER] = REG_FIELD_ID(0x3e, 0, 7, 4, 1),
+ [REG_ITARGET] = REG_FIELD_ID(0x42, 0, 6, 4, 1),
+ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7),
+ [REG_IRESOLUTION] = REG_FIELD(0x49, 0, 3),
+ [REG_CHAN_STROBE] = REG_FIELD_ID(0x4a, 0, 6, 4, 1),
+ [REG_CHAN_EN] = REG_FIELD(0x4e, 0, 3),
+ [REG_THERM_THRSH1] = REG_FIELD(0x7a, 0, 2),
+ [REG_THERM_THRSH2] = REG_FIELD(0x78, 0, 2),
+ [REG_TORCH_CLAMP] = REG_FIELD(0xed, 0, 6),
};
struct qcom_flash_data {
@@ -156,6 +159,7 @@ struct qcom_flash_data {
u8 max_channels;
u8 chan_en_bits;
u8 revision;
+ u8 torch_clamp;
};
struct qcom_flash_led {
@@ -702,6 +706,7 @@ static int qcom_flash_register_led_device(struct device *dev,
u32 current_ua, timeout_us;
u32 channels[4];
int i, rc, count;
+ u8 torch_clamp;
count = fwnode_property_count_u32(node, "led-sources");
if (count <= 0) {
@@ -751,6 +756,12 @@ static int qcom_flash_register_led_device(struct device *dev,
current_ua = min_t(u32, current_ua, TORCH_CURRENT_MAX_UA * led->chan_count);
led->max_torch_current_ma = current_ua / UA_PER_MA;
+ torch_clamp = (current_ua / led->chan_count) / TORCH_IRES_UA;
+ if (torch_clamp != 0)
+ torch_clamp--;
+
+ flash_data->torch_clamp = max_t(u8, flash_data->torch_clamp, torch_clamp);
+
if (fwnode_property_present(node, "flash-max-microamp")) {
flash->led_cdev.flags |= LED_DEV_CAP_FLASH;
@@ -917,8 +928,7 @@ static int qcom_flash_led_probe(struct platform_device *pdev)
flash_data->leds_count++;
}
- return 0;
-
+ return regmap_field_write(flash_data->r_fields[REG_TORCH_CLAMP], flash_data->torch_clamp);
release:
while (flash_data->v4l2_flash[flash_data->leds_count] && flash_data->leds_count)
v4l2_flash_release(flash_data->v4l2_flash[flash_data->leds_count--]);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 054/563] s390/bpf: Do not write tail call counter into helper and kfunc frames
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 053/563] leds: flash: leds-qcom-flash: Update torch current clamp setting Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 055/563] s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL Greg Kroah-Hartman
` (522 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilya Leoshkevich, Daniel Borkmann,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Leoshkevich <iii@linux.ibm.com>
[ Upstream commit eada40e057fc1842358d9daca3abe5cacb21e8a1 ]
Only BPF functions make use of the tail call counter; helpers and
kfuncs ignore and most likely also clobber it. Writing it into these
functions' frames is pointless and misleading, so do not do it.
Fixes: dd691e847d28 ("s390/bpf: Implement bpf_jit_supports_subprog_tailcalls()")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20250813121016.163375-2-iii@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/net/bpf_jit_comp.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index bb17efe29d657..bfac1ddf3447b 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -1790,6 +1790,7 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
REG_SET_SEEN(BPF_REG_5);
jit->seen |= SEEN_FUNC;
+
/*
* Copy the tail call counter to where the callee expects it.
*
@@ -1800,10 +1801,17 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
* Note 2: We assume that the verifier does not let us call the
* main program, which clears the tail call counter on entry.
*/
- /* mvc tail_call_cnt(4,%r15),frame_off+tail_call_cnt(%r15) */
- _EMIT6(0xd203f000 | offsetof(struct prog_frame, tail_call_cnt),
- 0xf000 | (jit->frame_off +
- offsetof(struct prog_frame, tail_call_cnt)));
+
+ if (insn->src_reg == BPF_PSEUDO_CALL)
+ /*
+ * mvc tail_call_cnt(4,%r15),
+ * frame_off+tail_call_cnt(%r15)
+ */
+ _EMIT6(0xd203f000 | offsetof(struct prog_frame,
+ tail_call_cnt),
+ 0xf000 | (jit->frame_off +
+ offsetof(struct prog_frame,
+ tail_call_cnt)));
/* Sign-extend the kfunc arguments. */
if (insn->src_reg == BPF_PSEUDO_KFUNC_CALL) {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 055/563] s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 054/563] s390/bpf: Do not write tail call counter into helper and kfunc frames Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 056/563] s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG Greg Kroah-Hartman
` (521 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilya Leoshkevich, Daniel Borkmann,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Leoshkevich <iii@linux.ibm.com>
[ Upstream commit c861a6b147137d10b5ff88a2c492ba376cd1b8b0 ]
The tailcall_bpf2bpf_hierarchy_1 test hangs on s390. Its call graph is
as follows:
entry()
subprog_tail()
bpf_tail_call_static(0) -> entry + tail_call_start
subprog_tail()
bpf_tail_call_static(0) -> entry + tail_call_start
entry() copies its tail call counter to the subprog_tail()'s frame,
which then increments it. However, the incremented result is discarded,
leading to an astronomically large number of tail calls.
Fix by writing the incremented counter back to the entry()'s frame.
Fixes: dd691e847d28 ("s390/bpf: Implement bpf_jit_supports_subprog_tailcalls()")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20250813121016.163375-3-iii@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/net/bpf_jit_comp.c | 23 ++++++++++++++++-------
1 file changed, 16 insertions(+), 7 deletions(-)
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index bfac1ddf3447b..ccb83ac3e6f32 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -1793,13 +1793,6 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
/*
* Copy the tail call counter to where the callee expects it.
- *
- * Note 1: The callee can increment the tail call counter, but
- * we do not load it back, since the x86 JIT does not do this
- * either.
- *
- * Note 2: We assume that the verifier does not let us call the
- * main program, which clears the tail call counter on entry.
*/
if (insn->src_reg == BPF_PSEUDO_CALL)
@@ -1833,6 +1826,22 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
call_r1(jit);
/* lgr %b0,%r2: load return value into %b0 */
EMIT4(0xb9040000, BPF_REG_0, REG_2);
+
+ /*
+ * Copy the potentially updated tail call counter back.
+ */
+
+ if (insn->src_reg == BPF_PSEUDO_CALL)
+ /*
+ * mvc frame_off+tail_call_cnt(%r15),
+ * tail_call_cnt(4,%r15)
+ */
+ _EMIT6(0xd203f000 | (jit->frame_off +
+ offsetof(struct prog_frame,
+ tail_call_cnt)),
+ 0xf000 | offsetof(struct prog_frame,
+ tail_call_cnt));
+
break;
}
case BPF_JMP | BPF_TAIL_CALL: {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 056/563] s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 055/563] s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 057/563] cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() Greg Kroah-Hartman
` (520 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilya Leoshkevich, Daniel Borkmann,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Leoshkevich <iii@linux.ibm.com>
[ Upstream commit bc3905a71f02511607d3ccf732360580209cac4c ]
The tailcall_bpf2bpf_hierarchy_fentry test hangs on s390. Its call
graph is as follows:
entry()
subprog_tail()
trampoline()
fentry()
the rest of subprog_tail() # via BPF_TRAMP_F_CALL_ORIG
return to entry()
The problem is that the rest of subprog_tail() increments the tail call
counter, but the trampoline discards the incremented value. This
results in an astronomically large number of tail calls.
Fix by making the trampoline write the incremented tail call counter
back.
Fixes: 528eb2cb87bc ("s390/bpf: Implement arch_prepare_bpf_trampoline()")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20250813121016.163375-4-iii@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/net/bpf_jit_comp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index ccb83ac3e6f32..b2b8eb62b82e0 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -2839,6 +2839,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
/* stg %r2,retval_off(%r15) */
EMIT6_DISP_LH(0xe3000000, 0x0024, REG_2, REG_0, REG_15,
tjit->retval_off);
+ /* mvc tccnt_off(%r15),tail_call_cnt(4,%r15) */
+ _EMIT6(0xd203f000 | tjit->tccnt_off,
+ 0xf000 | offsetof(struct prog_frame, tail_call_cnt));
im->ip_after_call = jit->prg_buf + jit->prg;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 057/563] cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 056/563] s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 058/563] arm64: dts: renesas: sparrow-hawk: Invert microSD voltage selector on EVTB1 Greg Kroah-Hartman
` (519 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Fainelli, Sudeep Holla,
Viresh Kumar, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <florian.fainelli@broadcom.com>
[ Upstream commit cd5d4621ba846dad9b2e6b0c2d1518d083fcfa13 ]
Broadcom STB platforms were early adopters (2017) of the SCMI framework and as
a result, not all deployed systems have a Device Tree entry where SCMI
protocol 0x13 (PERFORMANCE) is declared as a clock provider, nor are the
CPU Device Tree node(s) referencing protocol 0x13 as their clock
provider. This was clarified in commit e11c480b6df1 ("dt-bindings:
firmware: arm,scmi: Extend bindings for protocol@13") in 2023.
For those platforms, we allow the checks done by scmi_dev_used_by_cpus()
to continue, and in the event of not having done an early return, we key
off the documented compatible string and give them a pass to continue to
use scmi-cpufreq.
Fixes: 6c9bb8692272 ("cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs")
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/scmi-cpufreq.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
index ef078426bfd51..38c165d526d14 100644
--- a/drivers/cpufreq/scmi-cpufreq.c
+++ b/drivers/cpufreq/scmi-cpufreq.c
@@ -15,6 +15,7 @@
#include <linux/energy_model.h>
#include <linux/export.h>
#include <linux/module.h>
+#include <linux/of.h>
#include <linux/pm_opp.h>
#include <linux/pm_qos.h>
#include <linux/slab.h>
@@ -424,6 +425,15 @@ static bool scmi_dev_used_by_cpus(struct device *scmi_dev)
return true;
}
+ /*
+ * Older Broadcom STB chips had a "clocks" property for CPU node(s)
+ * that did not match the SCMI performance protocol node, if we got
+ * there, it means we had such an older Device Tree, therefore return
+ * true to preserve backwards compatibility.
+ */
+ if (of_machine_is_compatible("brcm,brcmstb"))
+ return true;
+
return false;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 058/563] arm64: dts: renesas: sparrow-hawk: Invert microSD voltage selector on EVTB1
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 057/563] cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 059/563] arm64: dts: renesas: sparrow-hawk: Set VDDQ18_25_AVB voltage " Greg Kroah-Hartman
` (518 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Geert Uytterhoeven,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marek.vasut+renesas@mailbox.org>
[ Upstream commit ae95807b00e1639b3f6ab94eb2cd887266e4f766 ]
Invert the polarity of microSD voltage selector on Retronix R-Car V4H
Sparrow Hawk board. The voltage selector was not populated on prototype
EVTA1 boards, and is implemented slightly different on EVTB1 boards. As
the EVTA1 boards are from a limited run and generally not available,
update the DT to make it compatible with EVTB1 microSD voltage selector.
Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/20250727235905.290427-1-marek.vasut+renesas@mailbox.org
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
index 9ba23129e65ec..18411dfb524fd 100644
--- a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
+++ b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
@@ -185,7 +185,7 @@ vcc_sdhi: regulator-vcc-sdhi {
regulator-max-microvolt = <3300000>;
gpios = <&gpio8 13 GPIO_ACTIVE_HIGH>;
gpios-states = <1>;
- states = <3300000 0>, <1800000 1>;
+ states = <1800000 0>, <3300000 1>;
};
};
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 059/563] arm64: dts: renesas: sparrow-hawk: Set VDDQ18_25_AVB voltage on EVTB1
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 058/563] arm64: dts: renesas: sparrow-hawk: Invert microSD voltage selector on EVTB1 Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 060/563] libbpf: Export bpf_object__prepare symbol Greg Kroah-Hartman
` (517 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Geert Uytterhoeven,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marek.vasut+renesas@mailbox.org>
[ Upstream commit 7d1e3aa2826a22f68f1850c31ac96348272fa356 ]
The Retronix R-Car V4H Sparrow Hawk EVTB1 uses 1V8 IO voltage supply
for VDDQ18_25_AVB power rail. Update the AVB0 pinmux to reflect the
change in IO voltage. Since the VDDQ18_25_AVB power rail is shared,
all four AVB0, AVB1, AVB2, TSN0 PFC/GPIO POC[7..4] registers have to
be configured the same way. As the EVTA1 boards are from a limited run
and generally not available, update the DT to make it compatible with
EVTB1 IO voltage settings.
Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/20250806192821.133302-1-marek.vasut+renesas@mailbox.org
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
index 18411dfb524fd..2c1ab75e4d910 100644
--- a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
+++ b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
@@ -556,6 +556,10 @@ pins-mii {
drive-strength = <21>;
};
+ pins-vddq18-25-avb {
+ pins = "PIN_VDDQ_AVB0", "PIN_VDDQ_AVB1", "PIN_VDDQ_AVB2", "PIN_VDDQ_TSN0";
+ power-source = <1800>;
+ };
};
/* Page 28 / CANFD_IF */
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 060/563] libbpf: Export bpf_object__prepare symbol
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 059/563] arm64: dts: renesas: sparrow-hawk: Set VDDQ18_25_AVB voltage " Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 061/563] firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver Greg Kroah-Hartman
` (516 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mykyta Yatsenko, Daniel Borkmann,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mykyta Yatsenko <yatsenko@meta.com>
[ Upstream commit 2693227c1150d58bf82ef45a394a554373be5286 ]
Add missing LIBBPF_API macro for bpf_object__prepare function to enable
its export. libbpf.map had bpf_object__prepare already listed.
Fixes: 1315c28ed809 ("libbpf: Split bpf object load into prepare/load")
Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20250819215119.37795-1-mykyta.yatsenko5@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/libbpf.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
index 455a957cb702c..2b86e21190d37 100644
--- a/tools/lib/bpf/libbpf.h
+++ b/tools/lib/bpf/libbpf.h
@@ -252,7 +252,7 @@ bpf_object__open_mem(const void *obj_buf, size_t obj_buf_sz,
* @return 0, on success; negative error code, otherwise, error code is
* stored in errno
*/
-int bpf_object__prepare(struct bpf_object *obj);
+LIBBPF_API int bpf_object__prepare(struct bpf_object *obj);
/**
* @brief **bpf_object__load()** loads BPF object into kernel.
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 061/563] firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 060/563] libbpf: Export bpf_object__prepare symbol Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 062/563] arm64: dts: imx93-kontron: Fix GPIO for panel regulator Greg Kroah-Hartman
` (515 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Junnan Wu, Sudeep Holla, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junnan Wu <junnan01.wu@samsung.com>
[ Upstream commit e8faa8a466f61f4ae07069ed6b0872f602f1cba9 ]
After commit 20bda12a0ea0 (“firmware: arm_scmi: Make VirtIO transport a
standalone driver”), the VirtIO transport probes independently. During
scmi_virtio_probe, scmi_probe() is called, which intune invokes
scmi_protocol_acquire() that sends a message over the virtqueue and
waits for a reply.
Previously, DRIVER_OK was only set after scmi_vio_probe, in the core
virtio via virtio_dev_probe(). According to the Virtio spec (3.1 Device
Initialization):
| The driver MUST NOT send any buffer available notifications to the
| device before setting DRIVER_OK.
Some type-1 hypervisors block available-buffer notifications until the
driver is marked OK. In such cases, scmi_vio_probe stalls in
scmi_wait_for_reply(), and the probe never completes.
Resolve this by setting DRIVER_OK immediately after the device-specific
setup, so scmi_probe() can safely send notifications.
Note after splitting the transports into modules, the probe sequence
changed a bit. We can no longer rely on virtio_device_ready() being
called by the core in virtio_dev_probe(), because scmi_vio_probe()
doesn’t complete until the core SCMI stack runs scmi_probe(), which
immediately issues the initial BASE protocol exchanges.
Fixes: 20bda12a0ea0 ("firmware: arm_scmi: Make VirtIO transport a standalone driver")
Signed-off-by: Junnan Wu <junnan01.wu@samsung.com>
Message-Id: <20250812075343.3201365-1-junnan01.wu@samsung.com>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_scmi/transports/virtio.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/firmware/arm_scmi/transports/virtio.c b/drivers/firmware/arm_scmi/transports/virtio.c
index cb934db9b2b4a..326c4a93e44b9 100644
--- a/drivers/firmware/arm_scmi/transports/virtio.c
+++ b/drivers/firmware/arm_scmi/transports/virtio.c
@@ -871,6 +871,9 @@ static int scmi_vio_probe(struct virtio_device *vdev)
/* Ensure initialized scmi_vdev is visible */
smp_store_mb(scmi_vdev, vdev);
+ /* Set device ready */
+ virtio_device_ready(vdev);
+
ret = platform_driver_register(&scmi_virtio_driver);
if (ret) {
vdev->priv = NULL;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 062/563] arm64: dts: imx93-kontron: Fix GPIO for panel regulator
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 061/563] firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 063/563] arm64: dts: imx93-kontron: Fix USB port assignment Greg Kroah-Hartman
` (514 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Annette Kobou, Frieder Schrempf,
Shawn Guo, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Annette Kobou <annette.kobou@kontron.de>
[ Upstream commit f3e011388dd08d15e0414e3b6b974f946305e7af ]
The regulator uses the wrong GPIO. Fix this.
Signed-off-by: Annette Kobou <annette.kobou@kontron.de>
Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board")
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../boot/dts/freescale/imx93-kontron-bl-osm-s.dts | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
index 89e97c604bd3e..9a9e5d0daf3ba 100644
--- a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
+++ b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
@@ -33,7 +33,9 @@ pwm-beeper {
reg_vcc_panel: regulator-vcc-panel {
compatible = "regulator-fixed";
- gpio = <&gpio4 3 GPIO_ACTIVE_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_reg_vcc_panel>;
+ gpio = <&gpio2 21 GPIO_ACTIVE_HIGH>;
enable-active-high;
regulator-max-microvolt = <3300000>;
regulator-min-microvolt = <3300000>;
@@ -161,3 +163,11 @@ &usdhc2 {
vmmc-supply = <®_vdd_3v3>;
status = "okay";
};
+
+&iomuxc {
+ pinctrl_reg_vcc_panel: regvccpanelgrp {
+ fsl,pins = <
+ MX93_PAD_GPIO_IO21__GPIO2_IO21 0x31e /* PWM_2 */
+ >;
+ };
+};
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 063/563] arm64: dts: imx93-kontron: Fix USB port assignment
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 062/563] arm64: dts: imx93-kontron: Fix GPIO for panel regulator Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 064/563] arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid Greg Kroah-Hartman
` (513 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frieder Schrempf, Shawn Guo,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frieder Schrempf <frieder.schrempf@kontron.de>
[ Upstream commit c94737568b290e0547bff344046f02df49ed6373 ]
The assignment of the USB ports is wrong and needs to be swapped.
The OTG (USB-C) port is on the first port and the host port with
the onboard hub is on the second port.
Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board")
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../dts/freescale/imx93-kontron-bl-osm-s.dts | 20 +++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
index 9a9e5d0daf3ba..c3d2ddd887fdf 100644
--- a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
+++ b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
@@ -137,6 +137,16 @@ &tpm6 {
};
&usbotg1 {
+ adp-disable;
+ hnp-disable;
+ srp-disable;
+ disable-over-current;
+ dr_mode = "otg";
+ usb-role-switch;
+ status = "okay";
+};
+
+&usbotg2 {
#address-cells = <1>;
#size-cells = <0>;
disable-over-current;
@@ -149,16 +159,6 @@ usb1@1 {
};
};
-&usbotg2 {
- adp-disable;
- hnp-disable;
- srp-disable;
- disable-over-current;
- dr_mode = "otg";
- usb-role-switch;
- status = "okay";
-};
-
&usdhc2 {
vmmc-supply = <®_vdd_3v3>;
status = "okay";
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 064/563] arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 063/563] arm64: dts: imx93-kontron: Fix USB port assignment Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 065/563] bpf: Remove preempt_disable in bpf_try_get_buffers Greg Kroah-Hartman
` (512 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joy Zou, Peng Fan, Frank Li,
Shawn Guo, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joy Zou <joy.zou@nxp.com>
[ Upstream commit 6fdaf3b1839c861931db0dd11747c056a76b68f9 ]
According to the imx95 RM, the lpuart7 rx and tx DMA's srcid are 88 and 87,
and the lpuart8 rx and tx DMA's srcid are 90 and 89. So correct them.
Fixes: 915fd2e127e8 ("arm64: dts: imx95: add edma[1..3] nodes")
Signed-off-by: Joy Zou <joy.zou@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx95.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/freescale/imx95.dtsi b/arch/arm64/boot/dts/freescale/imx95.dtsi
index 8296888bce594..4521da02d1695 100644
--- a/arch/arm64/boot/dts/freescale/imx95.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx95.dtsi
@@ -913,7 +913,7 @@ lpuart7: serial@42690000 {
interrupts = <GIC_SPI 68 IRQ_TYPE_LEVEL_HIGH>;
clocks = <&scmi_clk IMX95_CLK_LPUART7>;
clock-names = "ipg";
- dmas = <&edma2 26 0 FSL_EDMA_RX>, <&edma2 25 0 0>;
+ dmas = <&edma2 88 0 FSL_EDMA_RX>, <&edma2 87 0 0>;
dma-names = "rx", "tx";
status = "disabled";
};
@@ -925,7 +925,7 @@ lpuart8: serial@426a0000 {
interrupts = <GIC_SPI 69 IRQ_TYPE_LEVEL_HIGH>;
clocks = <&scmi_clk IMX95_CLK_LPUART8>;
clock-names = "ipg";
- dmas = <&edma2 28 0 FSL_EDMA_RX>, <&edma2 27 0 0>;
+ dmas = <&edma2 90 0 FSL_EDMA_RX>, <&edma2 89 0 0>;
dma-names = "rx", "tx";
status = "disabled";
};
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 065/563] bpf: Remove preempt_disable in bpf_try_get_buffers
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 064/563] arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 066/563] ACPI: processor: idle: Fix memory leak when register cpuidle device failed Greg Kroah-Hartman
` (511 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tao Chen, Andrii Nakryiko,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Chen <chen.dylane@linux.dev>
[ Upstream commit 4223bf833c8495e40ae2886acbc0ecbe88fa6306 ]
Now BPF program will run with migration disabled, so it is safe
to access this_cpu_inc_return(bpf_bprintf_nest_level).
Fixes: d9c9e4db186a ("bpf: Factorize bpf_trace_printk and bpf_seq_printf")
Signed-off-by: Tao Chen <chen.dylane@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20250819125638.2544715-1-chen.dylane@linux.dev
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/helpers.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 8af62cb243d9e..9c750a6a895bf 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -774,11 +774,9 @@ int bpf_try_get_buffers(struct bpf_bprintf_buffers **bufs)
{
int nest_level;
- preempt_disable();
nest_level = this_cpu_inc_return(bpf_bprintf_nest_level);
if (WARN_ON_ONCE(nest_level > MAX_BPRINTF_NEST_LEVEL)) {
this_cpu_dec(bpf_bprintf_nest_level);
- preempt_enable();
return -EBUSY;
}
*bufs = this_cpu_ptr(&bpf_bprintf_bufs[nest_level - 1]);
@@ -791,7 +789,6 @@ void bpf_put_buffers(void)
if (WARN_ON_ONCE(this_cpu_read(bpf_bprintf_nest_level) == 0))
return;
this_cpu_dec(bpf_bprintf_nest_level);
- preempt_enable();
}
void bpf_bprintf_cleanup(struct bpf_bprintf_data *data)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 066/563] ACPI: processor: idle: Fix memory leak when register cpuidle device failed
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 065/563] bpf: Remove preempt_disable in bpf_try_get_buffers Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 067/563] genirq: Add irq_chip_(startup/shutdown)_parent() Greg Kroah-Hartman
` (510 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Huisong Li, Rafael J. Wysocki,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huisong Li <lihuisong@huawei.com>
[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ]
The cpuidle device's memory is leaked when cpuidle device registration
fails in acpi_processor_power_init(). Free it as appropriate.
Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure")
Signed-off-by: Huisong Li <lihuisong@huawei.com>
Link: https://patch.msgid.link/20250728070612.1260859-2-lihuisong@huawei.com
[ rjw: Changed the order of the new statements, added empty line after if () ]
[ rjw: Changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/processor_idle.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 2c2dc559e0f8d..d0fc045a8d310 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -1405,6 +1405,9 @@ int acpi_processor_power_init(struct acpi_processor *pr)
if (retval) {
if (acpi_processor_registered == 0)
cpuidle_unregister_driver(&acpi_idle_driver);
+
+ per_cpu(acpi_cpuidle_device, pr->id) = NULL;
+ kfree(dev);
return retval;
}
acpi_processor_registered++;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 067/563] genirq: Add irq_chip_(startup/shutdown)_parent()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 066/563] ACPI: processor: idle: Fix memory leak when register cpuidle device failed Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 068/563] PCI/MSI: Add startup/shutdown for per device domains Greg Kroah-Hartman
` (509 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Gleixner, Inochi Amaoto,
Chen Wang, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Inochi Amaoto <inochiama@gmail.com>
[ Upstream commit 7a721a2fee2bce01af26699a87739db8ca8ea3c8 ]
As the MSI controller on SG2044 uses PLIC as the underlying interrupt
controller, it needs to call irq_enable() and irq_disable() to
startup/shutdown interrupts. Otherwise, the MSI interrupt can not be
startup correctly and will not respond any incoming interrupt.
Introduce irq_chip_startup_parent() and irq_chip_shutdown_parent() to allow
the interrupt controller to call the irq_startup()/irq_shutdown() callbacks
of the parent interrupt chip.
In case the irq_startup()/irq_shutdown() callbacks are not implemented for
the parent interrupt chip, this will fallback to irq_chip_enable_parent()
or irq_chip_disable_parent().
Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Chen Wang <unicorn_wang@outlook.com> # Pioneerbox
Reviewed-by: Chen Wang <unicorn_wang@outlook.com>
Link: https://lore.kernel.org/all/20250813232835.43458-2-inochiama@gmail.com
Link: https://lore.kernel.org/lkml/20250722224513.22125-1-inochiama@gmail.com/
Stable-dep-of: 9d8c41816bac ("irqchip/sg2042-msi: Fix broken affinity setting")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/irq.h | 2 ++
kernel/irq/chip.c | 37 +++++++++++++++++++++++++++++++++++++
2 files changed, 39 insertions(+)
diff --git a/include/linux/irq.h b/include/linux/irq.h
index 1d6b606a81efe..890e1371f5d4c 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -669,6 +669,8 @@ extern int irq_chip_set_parent_state(struct irq_data *data,
extern int irq_chip_get_parent_state(struct irq_data *data,
enum irqchip_irq_state which,
bool *state);
+extern void irq_chip_shutdown_parent(struct irq_data *data);
+extern unsigned int irq_chip_startup_parent(struct irq_data *data);
extern void irq_chip_enable_parent(struct irq_data *data);
extern void irq_chip_disable_parent(struct irq_data *data);
extern void irq_chip_ack_parent(struct irq_data *data);
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index 0d0276378c707..3ffa0d80ddd19 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -1259,6 +1259,43 @@ int irq_chip_get_parent_state(struct irq_data *data,
}
EXPORT_SYMBOL_GPL(irq_chip_get_parent_state);
+/**
+ * irq_chip_shutdown_parent - Shutdown the parent interrupt
+ * @data: Pointer to interrupt specific data
+ *
+ * Invokes the irq_shutdown() callback of the parent if available or falls
+ * back to irq_chip_disable_parent().
+ */
+void irq_chip_shutdown_parent(struct irq_data *data)
+{
+ struct irq_data *parent = data->parent_data;
+
+ if (parent->chip->irq_shutdown)
+ parent->chip->irq_shutdown(parent);
+ else
+ irq_chip_disable_parent(data);
+}
+EXPORT_SYMBOL_GPL(irq_chip_shutdown_parent);
+
+/**
+ * irq_chip_startup_parent - Startup the parent interrupt
+ * @data: Pointer to interrupt specific data
+ *
+ * Invokes the irq_startup() callback of the parent if available or falls
+ * back to irq_chip_enable_parent().
+ */
+unsigned int irq_chip_startup_parent(struct irq_data *data)
+{
+ struct irq_data *parent = data->parent_data;
+
+ if (parent->chip->irq_startup)
+ return parent->chip->irq_startup(parent);
+
+ irq_chip_enable_parent(data);
+ return 0;
+}
+EXPORT_SYMBOL_GPL(irq_chip_startup_parent);
+
/**
* irq_chip_enable_parent - Enable the parent interrupt (defaults to unmask if
* NULL)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 068/563] PCI/MSI: Add startup/shutdown for per device domains
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 067/563] genirq: Add irq_chip_(startup/shutdown)_parent() Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 21:16 ` Bjorn Helgaas
2025-10-13 14:38 ` [PATCH 6.17 069/563] irqchip/sg2042-msi: Fix broken affinity setting Greg Kroah-Hartman
` (508 subsequent siblings)
576 siblings, 1 reply; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Gleixner, Inochi Amaoto,
Chen Wang, Bjorn Helgaas, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Inochi Amaoto <inochiama@gmail.com>
[ Upstream commit 54f45a30c0d0153d2be091ba2d683ab6db6d1d5b ]
As the RISC-V PLIC cannot apply affinity settings without invoking
irq_enable(), it will make the interrupt unavailble when used as an
underlying interrupt chip for the MSI controller.
Implement the irq_startup() and irq_shutdown() callbacks for the PCI MSI
and MSI-X templates.
For chips that specify MSI_FLAG_PCI_MSI_STARTUP_PARENT, the parent startup
and shutdown functions are invoked. That allows the interrupt on the parent
chip to be enabled if the interrupt has not been enabled during
allocation. This is necessary for MSI controllers which use PLIC as
underlying parent interrupt chip.
Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Chen Wang <unicorn_wang@outlook.com> # Pioneerbox
Reviewed-by: Chen Wang <unicorn_wang@outlook.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://lore.kernel.org/all/20250813232835.43458-3-inochiama@gmail.com
Stable-dep-of: 9d8c41816bac ("irqchip/sg2042-msi: Fix broken affinity setting")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/msi/irqdomain.c | 52 +++++++++++++++++++++++++++++++++++++
include/linux/msi.h | 2 ++
2 files changed, 54 insertions(+)
diff --git a/drivers/pci/msi/irqdomain.c b/drivers/pci/msi/irqdomain.c
index 0938ef7ebabf2..e0a800f918e81 100644
--- a/drivers/pci/msi/irqdomain.c
+++ b/drivers/pci/msi/irqdomain.c
@@ -148,6 +148,23 @@ static void pci_device_domain_set_desc(msi_alloc_info_t *arg, struct msi_desc *d
arg->hwirq = desc->msi_index;
}
+static void cond_shutdown_parent(struct irq_data *data)
+{
+ struct msi_domain_info *info = data->domain->host_data;
+
+ if (unlikely(info->flags & MSI_FLAG_PCI_MSI_STARTUP_PARENT))
+ irq_chip_shutdown_parent(data);
+}
+
+static unsigned int cond_startup_parent(struct irq_data *data)
+{
+ struct msi_domain_info *info = data->domain->host_data;
+
+ if (unlikely(info->flags & MSI_FLAG_PCI_MSI_STARTUP_PARENT))
+ return irq_chip_startup_parent(data);
+ return 0;
+}
+
static __always_inline void cond_mask_parent(struct irq_data *data)
{
struct msi_domain_info *info = data->domain->host_data;
@@ -164,6 +181,23 @@ static __always_inline void cond_unmask_parent(struct irq_data *data)
irq_chip_unmask_parent(data);
}
+static void pci_irq_shutdown_msi(struct irq_data *data)
+{
+ struct msi_desc *desc = irq_data_get_msi_desc(data);
+
+ pci_msi_mask(desc, BIT(data->irq - desc->irq));
+ cond_shutdown_parent(data);
+}
+
+static unsigned int pci_irq_startup_msi(struct irq_data *data)
+{
+ struct msi_desc *desc = irq_data_get_msi_desc(data);
+ unsigned int ret = cond_startup_parent(data);
+
+ pci_msi_unmask(desc, BIT(data->irq - desc->irq));
+ return ret;
+}
+
static void pci_irq_mask_msi(struct irq_data *data)
{
struct msi_desc *desc = irq_data_get_msi_desc(data);
@@ -194,6 +228,8 @@ static void pci_irq_unmask_msi(struct irq_data *data)
static const struct msi_domain_template pci_msi_template = {
.chip = {
.name = "PCI-MSI",
+ .irq_startup = pci_irq_startup_msi,
+ .irq_shutdown = pci_irq_shutdown_msi,
.irq_mask = pci_irq_mask_msi,
.irq_unmask = pci_irq_unmask_msi,
.irq_write_msi_msg = pci_msi_domain_write_msg,
@@ -210,6 +246,20 @@ static const struct msi_domain_template pci_msi_template = {
},
};
+static void pci_irq_shutdown_msix(struct irq_data *data)
+{
+ pci_msix_mask(irq_data_get_msi_desc(data));
+ cond_shutdown_parent(data);
+}
+
+static unsigned int pci_irq_startup_msix(struct irq_data *data)
+{
+ unsigned int ret = cond_startup_parent(data);
+
+ pci_msix_unmask(irq_data_get_msi_desc(data));
+ return ret;
+}
+
static void pci_irq_mask_msix(struct irq_data *data)
{
pci_msix_mask(irq_data_get_msi_desc(data));
@@ -234,6 +284,8 @@ EXPORT_SYMBOL_GPL(pci_msix_prepare_desc);
static const struct msi_domain_template pci_msix_template = {
.chip = {
.name = "PCI-MSIX",
+ .irq_startup = pci_irq_startup_msix,
+ .irq_shutdown = pci_irq_shutdown_msix,
.irq_mask = pci_irq_mask_msix,
.irq_unmask = pci_irq_unmask_msix,
.irq_write_msi_msg = pci_msi_domain_write_msg,
diff --git a/include/linux/msi.h b/include/linux/msi.h
index e5e86a8529fb6..3111ba95fbde4 100644
--- a/include/linux/msi.h
+++ b/include/linux/msi.h
@@ -568,6 +568,8 @@ enum {
MSI_FLAG_PARENT_PM_DEV = (1 << 8),
/* Support for parent mask/unmask */
MSI_FLAG_PCI_MSI_MASK_PARENT = (1 << 9),
+ /* Support for parent startup/shutdown */
+ MSI_FLAG_PCI_MSI_STARTUP_PARENT = (1 << 10),
/* Mask for the generic functionality */
MSI_GENERIC_FLAGS_MASK = GENMASK(15, 0),
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 068/563] PCI/MSI: Add startup/shutdown for per device domains
2025-10-13 14:38 ` [PATCH 6.17 068/563] PCI/MSI: Add startup/shutdown for per device domains Greg Kroah-Hartman
@ 2025-10-13 21:16 ` Bjorn Helgaas
2025-10-16 1:07 ` Stefan Lippers-Hollmann
2025-10-17 6:56 ` Greg Kroah-Hartman
0 siblings, 2 replies; 591+ messages in thread
From: Bjorn Helgaas @ 2025-10-13 21:16 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, Thomas Gleixner, Inochi Amaoto, Chen Wang,
Bjorn Helgaas, Sasha Levin, Kenneth Crudup, Genes Lists,
Jens Axboe, Todd Brandt
[+cc Kenny, Gene, Jens, Todd]
On Mon, Oct 13, 2025 at 04:38:49PM +0200, Greg Kroah-Hartman wrote:
> 6.17-stable review patch. If anyone has any objections, please let me know.
We have open regression reports about this, so I don't think we
should backport it yet:
https://lore.kernel.org/r/af5f1790-c3b3-4f43-97d5-759d43e09c7b@panix.com
> ------------------
>
> From: Inochi Amaoto <inochiama@gmail.com>
>
> [ Upstream commit 54f45a30c0d0153d2be091ba2d683ab6db6d1d5b ]
>
> As the RISC-V PLIC cannot apply affinity settings without invoking
> irq_enable(), it will make the interrupt unavailble when used as an
> underlying interrupt chip for the MSI controller.
>
> Implement the irq_startup() and irq_shutdown() callbacks for the PCI MSI
> and MSI-X templates.
>
> For chips that specify MSI_FLAG_PCI_MSI_STARTUP_PARENT, the parent startup
> and shutdown functions are invoked. That allows the interrupt on the parent
> chip to be enabled if the interrupt has not been enabled during
> allocation. This is necessary for MSI controllers which use PLIC as
> underlying parent interrupt chip.
>
> Suggested-by: Thomas Gleixner <tglx@linutronix.de>
> Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> Tested-by: Chen Wang <unicorn_wang@outlook.com> # Pioneerbox
> Reviewed-by: Chen Wang <unicorn_wang@outlook.com>
> Acked-by: Bjorn Helgaas <bhelgaas@google.com>
> Link: https://lore.kernel.org/all/20250813232835.43458-3-inochiama@gmail.com
> Stable-dep-of: 9d8c41816bac ("irqchip/sg2042-msi: Fix broken affinity setting")
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/pci/msi/irqdomain.c | 52 +++++++++++++++++++++++++++++++++++++
> include/linux/msi.h | 2 ++
> 2 files changed, 54 insertions(+)
>
> diff --git a/drivers/pci/msi/irqdomain.c b/drivers/pci/msi/irqdomain.c
> index 0938ef7ebabf2..e0a800f918e81 100644
> --- a/drivers/pci/msi/irqdomain.c
> +++ b/drivers/pci/msi/irqdomain.c
> @@ -148,6 +148,23 @@ static void pci_device_domain_set_desc(msi_alloc_info_t *arg, struct msi_desc *d
> arg->hwirq = desc->msi_index;
> }
>
> +static void cond_shutdown_parent(struct irq_data *data)
> +{
> + struct msi_domain_info *info = data->domain->host_data;
> +
> + if (unlikely(info->flags & MSI_FLAG_PCI_MSI_STARTUP_PARENT))
> + irq_chip_shutdown_parent(data);
> +}
> +
> +static unsigned int cond_startup_parent(struct irq_data *data)
> +{
> + struct msi_domain_info *info = data->domain->host_data;
> +
> + if (unlikely(info->flags & MSI_FLAG_PCI_MSI_STARTUP_PARENT))
> + return irq_chip_startup_parent(data);
> + return 0;
> +}
> +
> static __always_inline void cond_mask_parent(struct irq_data *data)
> {
> struct msi_domain_info *info = data->domain->host_data;
> @@ -164,6 +181,23 @@ static __always_inline void cond_unmask_parent(struct irq_data *data)
> irq_chip_unmask_parent(data);
> }
>
> +static void pci_irq_shutdown_msi(struct irq_data *data)
> +{
> + struct msi_desc *desc = irq_data_get_msi_desc(data);
> +
> + pci_msi_mask(desc, BIT(data->irq - desc->irq));
> + cond_shutdown_parent(data);
> +}
> +
> +static unsigned int pci_irq_startup_msi(struct irq_data *data)
> +{
> + struct msi_desc *desc = irq_data_get_msi_desc(data);
> + unsigned int ret = cond_startup_parent(data);
> +
> + pci_msi_unmask(desc, BIT(data->irq - desc->irq));
> + return ret;
> +}
> +
> static void pci_irq_mask_msi(struct irq_data *data)
> {
> struct msi_desc *desc = irq_data_get_msi_desc(data);
> @@ -194,6 +228,8 @@ static void pci_irq_unmask_msi(struct irq_data *data)
> static const struct msi_domain_template pci_msi_template = {
> .chip = {
> .name = "PCI-MSI",
> + .irq_startup = pci_irq_startup_msi,
> + .irq_shutdown = pci_irq_shutdown_msi,
> .irq_mask = pci_irq_mask_msi,
> .irq_unmask = pci_irq_unmask_msi,
> .irq_write_msi_msg = pci_msi_domain_write_msg,
> @@ -210,6 +246,20 @@ static const struct msi_domain_template pci_msi_template = {
> },
> };
>
> +static void pci_irq_shutdown_msix(struct irq_data *data)
> +{
> + pci_msix_mask(irq_data_get_msi_desc(data));
> + cond_shutdown_parent(data);
> +}
> +
> +static unsigned int pci_irq_startup_msix(struct irq_data *data)
> +{
> + unsigned int ret = cond_startup_parent(data);
> +
> + pci_msix_unmask(irq_data_get_msi_desc(data));
> + return ret;
> +}
> +
> static void pci_irq_mask_msix(struct irq_data *data)
> {
> pci_msix_mask(irq_data_get_msi_desc(data));
> @@ -234,6 +284,8 @@ EXPORT_SYMBOL_GPL(pci_msix_prepare_desc);
> static const struct msi_domain_template pci_msix_template = {
> .chip = {
> .name = "PCI-MSIX",
> + .irq_startup = pci_irq_startup_msix,
> + .irq_shutdown = pci_irq_shutdown_msix,
> .irq_mask = pci_irq_mask_msix,
> .irq_unmask = pci_irq_unmask_msix,
> .irq_write_msi_msg = pci_msi_domain_write_msg,
> diff --git a/include/linux/msi.h b/include/linux/msi.h
> index e5e86a8529fb6..3111ba95fbde4 100644
> --- a/include/linux/msi.h
> +++ b/include/linux/msi.h
> @@ -568,6 +568,8 @@ enum {
> MSI_FLAG_PARENT_PM_DEV = (1 << 8),
> /* Support for parent mask/unmask */
> MSI_FLAG_PCI_MSI_MASK_PARENT = (1 << 9),
> + /* Support for parent startup/shutdown */
> + MSI_FLAG_PCI_MSI_STARTUP_PARENT = (1 << 10),
>
> /* Mask for the generic functionality */
> MSI_GENERIC_FLAGS_MASK = GENMASK(15, 0),
> --
> 2.51.0
>
>
>
^ permalink raw reply [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 068/563] PCI/MSI: Add startup/shutdown for per device domains
2025-10-13 21:16 ` Bjorn Helgaas
@ 2025-10-16 1:07 ` Stefan Lippers-Hollmann
2025-10-16 2:07 ` Inochi Amaoto
2025-10-17 6:56 ` Greg Kroah-Hartman
1 sibling, 1 reply; 591+ messages in thread
From: Stefan Lippers-Hollmann @ 2025-10-16 1:07 UTC (permalink / raw)
To: Bjorn Helgaas
Cc: Greg Kroah-Hartman, stable, patches, Thomas Gleixner,
Inochi Amaoto, Chen Wang, Bjorn Helgaas, Sasha Levin,
Kenneth Crudup, Genes Lists, Jens Axboe, Todd Brandt,
Stefan Lippers-Hollmann
Hi
On 2025-10-13, Bjorn Helgaas wrote:
> [+cc Kenny, Gene, Jens, Todd]
>
> On Mon, Oct 13, 2025 at 04:38:49PM +0200, Greg Kroah-Hartman wrote:
> > 6.17-stable review patch. If anyone has any objections, please let me know.
>
> We have open regression reports about this, so I don't think we
> should backport it yet:
>
> https://lore.kernel.org/r/af5f1790-c3b3-4f43-97d5-759d43e09c7b@panix.com
I've received a similar report for v6.17.3-rc1/ v6.17.3 (v6.17.2 was
fine) on a Lenovo 82FG/ Ideapad 5-15ITL05 (i5-1135G7 and Xe graphics),
failing to (UEFI-) boot already within the initramfs (Debian/ unstable,
initramfs-tools).
Backing out (only) the changes to drivers/pci/msi/irqdomain.c and
include/linux/msi.h from patch-6.17.3 fixes the regression again.
Regards
Stefan Lippers-Hollmann
^ permalink raw reply [flat|nested] 591+ messages in thread
* Re: [PATCH 6.17 068/563] PCI/MSI: Add startup/shutdown for per device domains
2025-10-16 1:07 ` Stefan Lippers-Hollmann
@ 2025-10-16 2:07 ` Inochi Amaoto
2025-10-17 2:33 ` Stefan Lippers-Hollmann
0 siblings, 1 reply; 591+ messages in thread
From: Inochi Amaoto @ 2025-10-16 2:07 UTC (permalink / raw)
To: Stefan Lippers-Hollmann, Bjorn Helgaas
Cc: Greg Kroah-Hartman, stable, patches, Thomas Gleixner,
Inochi Amaoto, Chen Wang, Bjorn Helgaas, Sasha Levin,
Kenneth Crudup, Genes Lists, Jens Axboe, Todd Brandt
On Thu, Oct 16, 2025 at 03:07:11AM +0200, Stefan Lippers-Hollmann wrote:
> Hi
>
> On 2025-10-13, Bjorn Helgaas wrote:
> > [+cc Kenny, Gene, Jens, Todd]
> >
> > On Mon, Oct 13, 2025 at 04:38:49PM +0200, Greg Kroah-Hartman wrote:
> > > 6.17-stable review patch. If anyone has any objections, please let me know.
> >
> > We have open regression reports about this, so I don't think we
> > should backport it yet:
> >
> > https://lore.kernel.org/r/af5f1790-c3b3-4f43-97d5-759d43e09c7b@panix.com
>
> I've received a similar report for v6.17.3-rc1/ v6.17.3 (v6.17.2 was
> fine) on a Lenovo 82FG/ Ideapad 5-15ITL05 (i5-1135G7 and Xe graphics),
> failing to (UEFI-) boot already within the initramfs (Debian/ unstable,
> initramfs-tools).
>
> Backing out (only) the changes to drivers/pci/msi/irqdomain.c and
> include/linux/msi.h from patch-6.17.3 fixes the regression again.
>
> Regards
> Stefan Lippers-Hollmann
This is caused by the vmd driver, as vmd driver rely on the assumption
that pci domain template does not set irq_startup()/irq_shutdown.
I think this may needs the following patch:
https://lore.kernel.org/all/20251014014607.612586-1-inochiama@gmail.com
^ permalink raw reply [flat|nested] 591+ messages in thread
* Re: [PATCH 6.17 068/563] PCI/MSI: Add startup/shutdown for per device domains
2025-10-16 2:07 ` Inochi Amaoto
@ 2025-10-17 2:33 ` Stefan Lippers-Hollmann
0 siblings, 0 replies; 591+ messages in thread
From: Stefan Lippers-Hollmann @ 2025-10-17 2:33 UTC (permalink / raw)
To: Inochi Amaoto
Cc: Bjorn Helgaas, Greg Kroah-Hartman, stable, patches,
Thomas Gleixner, Chen Wang, Bjorn Helgaas, Sasha Levin,
Kenneth Crudup, Genes Lists, Jens Axboe, Todd Brandt
Hi
On 2025-10-16, Inochi Amaoto wrote:
> On Thu, Oct 16, 2025 at 03:07:11AM +0200, Stefan Lippers-Hollmann wrote:
[...]
> > > We have open regression reports about this, so I don't think we
> > > should backport it yet:
> > >
> > > https://lore.kernel.org/r/af5f1790-c3b3-4f43-97d5-759d43e09c7b@panix.com
> >
> > I've received a similar report for v6.17.3-rc1/ v6.17.3 (v6.17.2 was
> > fine) on a Lenovo 82FG/ Ideapad 5-15ITL05 (i5-1135G7 and Xe graphics),
> > failing to (UEFI-) boot already within the initramfs (Debian/ unstable,
> > initramfs-tools).
> >
> > Backing out (only) the changes to drivers/pci/msi/irqdomain.c and
> > include/linux/msi.h from patch-6.17.3 fixes the regression again.
[...]
> This is caused by the vmd driver, as vmd driver rely on the assumption
> that pci domain template does not set irq_startup()/irq_shutdown.
>
> I think this may needs the following patch:
> https://lore.kernel.org/all/20251014014607.612586-1-inochiama@gmail.com
I got confirmation that this patch indeed fixes the problem, thanks a
lot!
Regards
Stefan Lippers-Hollmann
^ permalink raw reply [flat|nested] 591+ messages in thread
* Re: [PATCH 6.17 068/563] PCI/MSI: Add startup/shutdown for per device domains
2025-10-13 21:16 ` Bjorn Helgaas
2025-10-16 1:07 ` Stefan Lippers-Hollmann
@ 2025-10-17 6:56 ` Greg Kroah-Hartman
2025-10-19 5:29 ` Eric Naim
1 sibling, 1 reply; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-17 6:56 UTC (permalink / raw)
To: Bjorn Helgaas
Cc: stable, patches, Thomas Gleixner, Inochi Amaoto, Chen Wang,
Bjorn Helgaas, Sasha Levin, Kenneth Crudup, Genes Lists,
Jens Axboe, Todd Brandt
On Mon, Oct 13, 2025 at 04:16:48PM -0500, Bjorn Helgaas wrote:
> [+cc Kenny, Gene, Jens, Todd]
>
> On Mon, Oct 13, 2025 at 04:38:49PM +0200, Greg Kroah-Hartman wrote:
> > 6.17-stable review patch. If anyone has any objections, please let me know.
>
> We have open regression reports about this, so I don't think we
> should backport it yet:
>
> https://lore.kernel.org/r/af5f1790-c3b3-4f43-97d5-759d43e09c7b@panix.com
It's already in a release :(
If someone will be so kind as to forward me the git id of the fix when
it lands in Linus's tree, I will be glad to queue that up.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 591+ messages in thread
* Re: [PATCH 6.17 068/563] PCI/MSI: Add startup/shutdown for per device domains
2025-10-17 6:56 ` Greg Kroah-Hartman
@ 2025-10-19 5:29 ` Eric Naim
2025-10-20 8:28 ` Greg Kroah-Hartman
0 siblings, 1 reply; 591+ messages in thread
From: Eric Naim @ 2025-10-19 5:29 UTC (permalink / raw)
To: Greg Kroah-Hartman, Bjorn Helgaas
Cc: stable, patches, Thomas Gleixner, Inochi Amaoto, Chen Wang,
Bjorn Helgaas, Sasha Levin, Kenneth Crudup, Genes Lists,
Jens Axboe, Todd Brandt
On 10/17/25 14:56, Greg Kroah-Hartman wrote:
> On Mon, Oct 13, 2025 at 04:16:48PM -0500, Bjorn Helgaas wrote:
>> [+cc Kenny, Gene, Jens, Todd]
>>
>> On Mon, Oct 13, 2025 at 04:38:49PM +0200, Greg Kroah-Hartman wrote:
>>> 6.17-stable review patch. If anyone has any objections, please let me know.
>>
>> We have open regression reports about this, so I don't think we
>> should backport it yet:
>>
>> https://lore.kernel.org/r/af5f1790-c3b3-4f43-97d5-759d43e09c7b@panix.com
>
> It's already in a release :(
>
> If someone will be so kind as to forward me the git id of the fix when
> it lands in Linus's tree, I will be glad to queue that up.
>
> thanks,
>
Hi Greg, the fix has made it into Linus's tree. The git hash is e433110eb5bf067f74d3d15c5fb252206c66ae0b
--
Regards,
Eric
> greg k-h
>
^ permalink raw reply [flat|nested] 591+ messages in thread
* Re: [PATCH 6.17 068/563] PCI/MSI: Add startup/shutdown for per device domains
2025-10-19 5:29 ` Eric Naim
@ 2025-10-20 8:28 ` Greg Kroah-Hartman
0 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-20 8:28 UTC (permalink / raw)
To: Eric Naim
Cc: Bjorn Helgaas, stable, patches, Thomas Gleixner, Inochi Amaoto,
Chen Wang, Bjorn Helgaas, Sasha Levin, Kenneth Crudup,
Genes Lists, Jens Axboe, Todd Brandt
On Sun, Oct 19, 2025 at 01:29:18PM +0800, Eric Naim wrote:
> On 10/17/25 14:56, Greg Kroah-Hartman wrote:
> > On Mon, Oct 13, 2025 at 04:16:48PM -0500, Bjorn Helgaas wrote:
> >> [+cc Kenny, Gene, Jens, Todd]
> >>
> >> On Mon, Oct 13, 2025 at 04:38:49PM +0200, Greg Kroah-Hartman wrote:
> >>> 6.17-stable review patch. If anyone has any objections, please let me know.
> >>
> >> We have open regression reports about this, so I don't think we
> >> should backport it yet:
> >>
> >> https://lore.kernel.org/r/af5f1790-c3b3-4f43-97d5-759d43e09c7b@panix.com
> >
> > It's already in a release :(
> >
> > If someone will be so kind as to forward me the git id of the fix when
> > it lands in Linus's tree, I will be glad to queue that up.
> >
> > thanks,
> >
>
> Hi Greg, the fix has made it into Linus's tree. The git hash is e433110eb5bf067f74d3d15c5fb252206c66ae0b
Thanks, now queued up.
^ permalink raw reply [flat|nested] 591+ messages in thread
* [PATCH 6.17 069/563] irqchip/sg2042-msi: Fix broken affinity setting
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 068/563] PCI/MSI: Add startup/shutdown for per device domains Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 070/563] scripts/misc-check: update export checks for EXPORT_SYMBOL_FOR_MODULES() Greg Kroah-Hartman
` (507 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Han Gao, Thomas Gleixner,
Inochi Amaoto, Chen Wang, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Inochi Amaoto <inochiama@gmail.com>
[ Upstream commit 9d8c41816bac518b4824f83b346ae30a1be83f68 ]
When using NVME on SG2044, the NVME drvier always complains about "I/O tag
XXX (XXX) QID XX timeout, completion polled", which is caused by the broken
affinity setting mechanism of the sg2042-msi driver.
The PLIC driver can only the set the affinity when enabled, but the
sg2042-msi driver invokes the affinity setter in disabled state, which
causes the change to be lost.
Cure this by implementing the irq_startup()/shutdown() callbacks, which
allow to startup (enabled) the underlying PLIC first.
Fixes: e96b93a97c90 ("irqchip/sg2042-msi: Add the Sophgo SG2044 MSI interrupt controller")
Reported-by: Han Gao <rabenda.cn@gmail.com>
Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Chen Wang <unicorn_wang@outlook.com> # Pioneerbox
Reviewed-by: Chen Wang <unicorn_wang@outlook.com>
Link: https://lore.kernel.org/all/20250813232835.43458-4-inochiama@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-sg2042-msi.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/drivers/irqchip/irq-sg2042-msi.c b/drivers/irqchip/irq-sg2042-msi.c
index bcfddc51bc6a1..2fd4d94f9bd76 100644
--- a/drivers/irqchip/irq-sg2042-msi.c
+++ b/drivers/irqchip/irq-sg2042-msi.c
@@ -85,6 +85,8 @@ static void sg2042_msi_irq_compose_msi_msg(struct irq_data *d, struct msi_msg *m
static const struct irq_chip sg2042_msi_middle_irq_chip = {
.name = "SG2042 MSI",
+ .irq_startup = irq_chip_startup_parent,
+ .irq_shutdown = irq_chip_shutdown_parent,
.irq_ack = sg2042_msi_irq_ack,
.irq_mask = irq_chip_mask_parent,
.irq_unmask = irq_chip_unmask_parent,
@@ -114,6 +116,8 @@ static void sg2044_msi_irq_compose_msi_msg(struct irq_data *d, struct msi_msg *m
static struct irq_chip sg2044_msi_middle_irq_chip = {
.name = "SG2044 MSI",
+ .irq_startup = irq_chip_startup_parent,
+ .irq_shutdown = irq_chip_shutdown_parent,
.irq_ack = sg2044_msi_irq_ack,
.irq_mask = irq_chip_mask_parent,
.irq_unmask = irq_chip_unmask_parent,
@@ -185,8 +189,10 @@ static const struct irq_domain_ops sg204x_msi_middle_domain_ops = {
.select = msi_lib_irq_domain_select,
};
-#define SG2042_MSI_FLAGS_REQUIRED (MSI_FLAG_USE_DEF_DOM_OPS | \
- MSI_FLAG_USE_DEF_CHIP_OPS)
+#define SG2042_MSI_FLAGS_REQUIRED (MSI_FLAG_USE_DEF_DOM_OPS | \
+ MSI_FLAG_USE_DEF_CHIP_OPS | \
+ MSI_FLAG_PCI_MSI_MASK_PARENT | \
+ MSI_FLAG_PCI_MSI_STARTUP_PARENT)
#define SG2042_MSI_FLAGS_SUPPORTED MSI_GENERIC_FLAGS_MASK
@@ -200,10 +206,12 @@ static const struct msi_parent_ops sg2042_msi_parent_ops = {
.init_dev_msi_info = msi_lib_init_dev_msi_info,
};
-#define SG2044_MSI_FLAGS_REQUIRED (MSI_FLAG_USE_DEF_DOM_OPS | \
- MSI_FLAG_USE_DEF_CHIP_OPS)
+#define SG2044_MSI_FLAGS_REQUIRED (MSI_FLAG_USE_DEF_DOM_OPS | \
+ MSI_FLAG_USE_DEF_CHIP_OPS | \
+ MSI_FLAG_PCI_MSI_MASK_PARENT | \
+ MSI_FLAG_PCI_MSI_STARTUP_PARENT)
-#define SG2044_MSI_FLAGS_SUPPORTED (MSI_GENERIC_FLAGS_MASK | \
+#define SG2044_MSI_FLAGS_SUPPORTED (MSI_GENERIC_FLAGS_MASK | \
MSI_FLAG_PCI_MSIX)
static const struct msi_parent_ops sg2044_msi_parent_ops = {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 070/563] scripts/misc-check: update export checks for EXPORT_SYMBOL_FOR_MODULES()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 069/563] irqchip/sg2042-msi: Fix broken affinity setting Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 071/563] soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS Greg Kroah-Hartman
` (506 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vlastimil Babka, Daniel Gomez,
Nicolas Schier, Nathan Chancellor, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlastimil Babka <vbabka@suse.cz>
[ Upstream commit 0354e81b7bd629f9c3379c9524e988ebc504fa25 ]
The module export checks are looking for EXPORT_SYMBOL_GPL_FOR_MODULES()
which was renamed to EXPORT_SYMBOL_FOR_MODULES(). Update the checks.
Fixes: 6d3c3ca4c77e ("module: Rename EXPORT_SYMBOL_GPL_FOR_MODULES to EXPORT_SYMBOL_FOR_MODULES")
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Reviewed-by: Daniel Gomez <da.gomez@samsung.com>
Reviewed-by: Nicolas Schier <nsc@kernel.org>
Link: https://lore.kernel.org/r/20250825-export_modules_fix-v1-1-5c331e949538@suse.cz
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/misc-check | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/scripts/misc-check b/scripts/misc-check
index 84f08da17b2c0..40e5a4b01ff47 100755
--- a/scripts/misc-check
+++ b/scripts/misc-check
@@ -45,7 +45,7 @@ check_tracked_ignored_files () {
# does not automatically fix it.
check_missing_include_linux_export_h () {
- git -C "${srctree:-.}" grep --files-with-matches -E 'EXPORT_SYMBOL((_NS)?(_GPL)?|_GPL_FOR_MODULES)\(.*\)' \
+ git -C "${srctree:-.}" grep --files-with-matches -E 'EXPORT_SYMBOL((_NS)?(_GPL)?|_FOR_MODULES)\(.*\)' \
-- '*.[ch]' :^tools/ :^include/linux/export.h |
xargs -r git -C "${srctree:-.}" grep --files-without-match '#include[[:space:]]*<linux/export\.h>' |
xargs -r printf "%s: warning: EXPORT_SYMBOL() is used, but #include <linux/export.h> is missing\n" >&2
@@ -58,7 +58,7 @@ check_unnecessary_include_linux_export_h () {
git -C "${srctree:-.}" grep --files-with-matches '#include[[:space:]]*<linux/export\.h>' \
-- '*.[c]' :^tools/ |
- xargs -r git -C "${srctree:-.}" grep --files-without-match -E 'EXPORT_SYMBOL((_NS)?(_GPL)?|_GPL_FOR_MODULES)\(.*\)' |
+ xargs -r git -C "${srctree:-.}" grep --files-without-match -E 'EXPORT_SYMBOL((_NS)?(_GPL)?|_FOR_MODULES)\(.*\)' |
xargs -r printf "%s: warning: EXPORT_SYMBOL() is not used, but #include <linux/export.h> is present\n" >&2
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 071/563] soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 070/563] scripts/misc-check: update export checks for EXPORT_SYMBOL_FOR_MODULES() Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 072/563] pinctrl: meson-gxl: add missing i2c_d pinmux Greg Kroah-Hartman
` (505 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sneh Mankad, Bjorn Andersson,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ]
Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a
transaction completes. Previously this bit was only cleared when
a wake TCS was borrowed as an AMC TCS but not for dedicated
AMC TCS. Leaving this bit set for AMC TCS and entering deeper low
power modes can generate a false completion IRQ.
Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER
bit upon receiving a completion IRQ.
Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS")
Signed-off-by: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250825-rpmh_rsc_change-v1-1-138202c31bf6@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/qcom/rpmh-rsc.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
index fdab2b1067dbb..c6f7d5c9c493d 100644
--- a/drivers/soc/qcom/rpmh-rsc.c
+++ b/drivers/soc/qcom/rpmh-rsc.c
@@ -453,13 +453,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p)
trace_rpmh_tx_done(drv, i, req);
- /*
- * If wake tcs was re-purposed for sending active
- * votes, clear AMC trigger & enable modes and
+ /* Clear AMC trigger & enable modes and
* disable interrupt for this TCS
*/
- if (!drv->tcs[ACTIVE_TCS].num_tcs)
- __tcs_set_trigger(drv, i, false);
+ __tcs_set_trigger(drv, i, false);
skip:
/* Reclaim the TCS */
write_tcs_reg(drv, drv->regs[RSC_DRV_CMD_ENABLE], i, 0);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 072/563] pinctrl: meson-gxl: add missing i2c_d pinmux
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 071/563] soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 073/563] blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx Greg Kroah-Hartman
` (504 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Da Xue, Linus Walleij, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Da Xue <da@libre.computer>
[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ]
Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11.
Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D.
Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions")
Signed-off-by: Da Xue <da@libre.computer>
Link: https://lore.kernel.org/20250821233335.1707559-1-da@libre.computer
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
index 9171de657f978..a75762e4d2641 100644
--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 };
static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 };
static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 };
+static const unsigned int i2c_sck_d_pins[] = { GPIOX_11 };
+static const unsigned int i2c_sda_d_pins[] = { GPIOX_10 };
+
static const unsigned int eth_mdio_pins[] = { GPIOZ_0 };
static const unsigned int eth_mdc_pins[] = { GPIOZ_1 };
static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 };
@@ -411,6 +414,8 @@ static const struct meson_pmx_group meson_gxl_periphs_groups[] = {
GPIO_GROUP(GPIO_TEST_N),
/* Bank X */
+ GROUP(i2c_sda_d, 5, 5),
+ GROUP(i2c_sck_d, 5, 4),
GROUP(sdio_d0, 5, 31),
GROUP(sdio_d1, 5, 30),
GROUP(sdio_d2, 5, 29),
@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = {
"i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19",
};
+static const char * const i2c_d_groups[] = {
+ "i2c_sck_d", "i2c_sda_d",
+};
+
static const char * const eth_groups[] = {
"eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv",
"eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3",
@@ -777,6 +786,7 @@ static const struct meson_pmx_func meson_gxl_periphs_functions[] = {
FUNCTION(i2c_a),
FUNCTION(i2c_b),
FUNCTION(i2c_c),
+ FUNCTION(i2c_d),
FUNCTION(eth),
FUNCTION(pwm_a),
FUNCTION(pwm_b),
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 073/563] blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 072/563] pinctrl: meson-gxl: add missing i2c_d pinmux Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 074/563] selftests/futex: Remove the -g parameter from futex_priv_hash Greg Kroah-Hartman
` (503 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li Nan, Yu Kuai, Jens Axboe,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Nan <linan122@huawei.com>
[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ]
In __blk_mq_update_nr_hw_queues() the return value of
blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx
fails, later changing the number of hw_queues or removing disk will
trigger the following warning:
kernfs: can not remove 'nr_tags', no directory
WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160
Call Trace:
remove_files.isra.1+0x38/0xb0
sysfs_remove_group+0x4d/0x100
sysfs_remove_groups+0x31/0x60
__kobject_del+0x23/0xf0
kobject_del+0x17/0x40
blk_mq_unregister_hctx+0x5d/0x80
blk_mq_sysfs_unregister_hctxs+0x94/0xd0
blk_mq_update_nr_hw_queues+0x124/0x760
nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]
nullb_device_submit_queues_store+0x92/0x120 [null_blk]
kobjct_del() was called unconditionally even if sysfs creation failed.
Fix it by checkig the kobject creation statusbefore deleting it.
Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues")
Signed-off-by: Li Nan <linan122@huawei.com>
Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20250826084854.1030545-1-linan666@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-mq-sysfs.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
index 24656980f4431..5c399ac562eae 100644
--- a/block/blk-mq-sysfs.c
+++ b/block/blk-mq-sysfs.c
@@ -150,9 +150,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
return;
hctx_for_each_ctx(hctx, ctx, i)
- kobject_del(&ctx->kobj);
+ if (ctx->kobj.state_in_sysfs)
+ kobject_del(&ctx->kobj);
- kobject_del(&hctx->kobj);
+ if (hctx->kobj.state_in_sysfs)
+ kobject_del(&hctx->kobj);
}
static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 074/563] selftests/futex: Remove the -g parameter from futex_priv_hash
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 073/563] blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 075/563] ARM: at91: pm: fix MCKx restore routine Greg Kroah-Hartman
` (502 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Andrzej Siewior,
Borislav Petkov (AMD), André Almeida, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ Upstream commit 2e62688d583809e832433f461194334408b10817 ]
The -g parameter was meant to the test the immutable global hash instead of the
private hash which has been made immutable. The global hash is tested as part
at the end of the regular test. The immutable private hash been removed.
Remove last traces of the immutable private hash.
Fixes: 16adc7f136dc1 ("selftests/futex: Remove support for IMMUTABLE")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: André Almeida <andrealmeid@igalia.com>
Link: https://lore.kernel.org/20250827130011.677600-2-bigeasy@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/futex/functional/futex_priv_hash.c | 1 -
tools/testing/selftests/futex/functional/run.sh | 1 -
2 files changed, 2 deletions(-)
diff --git a/tools/testing/selftests/futex/functional/futex_priv_hash.c b/tools/testing/selftests/futex/functional/futex_priv_hash.c
index aea001ac49460..ec032faca6a91 100644
--- a/tools/testing/selftests/futex/functional/futex_priv_hash.c
+++ b/tools/testing/selftests/futex/functional/futex_priv_hash.c
@@ -132,7 +132,6 @@ static void usage(char *prog)
{
printf("Usage: %s\n", prog);
printf(" -c Use color\n");
- printf(" -g Test global hash instead intead local immutable \n");
printf(" -h Display this help message\n");
printf(" -v L Verbosity level: %d=QUIET %d=CRITICAL %d=INFO\n",
VQUIET, VCRITICAL, VINFO);
diff --git a/tools/testing/selftests/futex/functional/run.sh b/tools/testing/selftests/futex/functional/run.sh
index 81739849f2994..5470088dc4dfb 100755
--- a/tools/testing/selftests/futex/functional/run.sh
+++ b/tools/testing/selftests/futex/functional/run.sh
@@ -85,7 +85,6 @@ echo
echo
./futex_priv_hash $COLOR
-./futex_priv_hash -g $COLOR
echo
./futex_numa_mpol $COLOR
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 075/563] ARM: at91: pm: fix MCKx restore routine
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 074/563] selftests/futex: Remove the -g parameter from futex_priv_hash Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 076/563] arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map Greg Kroah-Hartman
` (501 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Ferre, Alexandre Belloni,
Claudiu Beznea, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <nicolas.ferre@microchip.com>
[ Upstream commit 296302d3d81360e09fa956e9be9edc8223b69a12 ]
The at91_mckx_ps_restore() assembly function is responsible for setting
back MCKx system bus clocks after exiting low power modes.
Fix a typo and use tmp3 variable instead of tmp2 to correctly set MCKx
to previously saved state.
Tmp2 was used without the needed changes in CSS and DIV. Moreover the
required bit 7, telling that MCR register's content is to be changed
(CMD/write), was not set.
Fix function comment to match tmp variables actually used.
Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Fixes: 28eb1d40fe57 ("ARM: at91: pm: add support for MCK1..4 save/restore for ulp modes")
Link: https://lore.kernel.org/r/20250827145427.46819-3-nicolas.ferre@microchip.com
Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
[claudiu.beznea: s/sate/state in commit description]
Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-at91/pm_suspend.S | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
index e23b868340965..7e6c94f8edeef 100644
--- a/arch/arm/mach-at91/pm_suspend.S
+++ b/arch/arm/mach-at91/pm_suspend.S
@@ -904,7 +904,7 @@ e_done:
/**
* at91_mckx_ps_restore: restore MCKx settings
*
- * Side effects: overwrites tmp1, tmp2
+ * Side effects: overwrites tmp1, tmp2 and tmp3
*/
.macro at91_mckx_ps_restore
#ifdef CONFIG_SOC_SAMA7
@@ -980,7 +980,7 @@ r_ps:
bic tmp3, tmp3, #AT91_PMC_MCR_V2_ID_MSK
orr tmp3, tmp3, tmp1
orr tmp3, tmp3, #AT91_PMC_MCR_V2_CMD
- str tmp2, [pmc, #AT91_PMC_MCR_V2]
+ str tmp3, [pmc, #AT91_PMC_MCR_V2]
wait_mckrdy tmp1
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 076/563] arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 075/563] ARM: at91: pm: fix MCKx restore routine Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 077/563] regulator: scmi: Use int type to store negative error codes Greg Kroah-Hartman
` (500 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neal Gompa, Sven Peter, Janne Grunau,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janne Grunau <j@jannau.net>
[ Upstream commit 6e08cdd604edcec2c277af17c7d36caf827057ff ]
PCIe `port01` of t8103-j457 (iMac, M1, 2 USB-C ports, 2021) is unused
and disabled. Linux' PCI subsystem assigns the ethernet nic from
`port02` to bus 02. This results into assigning `pcie0_dart_1` from the
disabled port as iommu. The `pcie0_dart_1` instance is disabled and
probably fused off (it is on the M2 Pro Mac mini which has a disabled
PCIe port as well).
Without iommu the ethernet nic is not expected work.
Adjusts the "bus-range" and the PCIe devices "reg" property to PCI
subsystem's bus number.
Fixes: 7c77ab91b33d ("arm64: dts: apple: Add missing M1 (t8103) devices")
Reviewed-by: Neal Gompa <neal@gompa.dev>
Reviewed-by: Sven Peter <sven@kernel.org>
Signed-off-by: Janne Grunau <j@jannau.net>
Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-1-6dc0daeb4786@jannau.net
Signed-off-by: Sven Peter <sven@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/apple/t8103-j457.dts | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/apple/t8103-j457.dts b/arch/arm64/boot/dts/apple/t8103-j457.dts
index 152f95fd49a21..7089ccf3ce556 100644
--- a/arch/arm64/boot/dts/apple/t8103-j457.dts
+++ b/arch/arm64/boot/dts/apple/t8103-j457.dts
@@ -21,6 +21,14 @@ aliases {
};
};
+/*
+ * Adjust pcie0's iommu-map to account for the disabled port01.
+ */
+&pcie0 {
+ iommu-map = <0x100 &pcie0_dart_0 1 1>,
+ <0x200 &pcie0_dart_2 1 1>;
+};
+
&bluetooth0 {
brcm,board-type = "apple,santorini";
};
@@ -36,10 +44,10 @@ &wifi0 {
*/
&port02 {
- bus-range = <3 3>;
+ bus-range = <2 2>;
status = "okay";
ethernet0: ethernet@0,0 {
- reg = <0x30000 0x0 0x0 0x0 0x0>;
+ reg = <0x20000 0x0 0x0 0x0 0x0>;
/* To be filled by the loader */
local-mac-address = [00 10 18 00 00 00];
};
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 077/563] regulator: scmi: Use int type to store negative error codes
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 076/563] arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:38 ` [PATCH 6.17 078/563] selftests/futex: Fix some futex_numa_mpol subtests Greg Kroah-Hartman
` (499 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qianfeng Rong, Sudeep Holla,
Mark Brown, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <rongqianfeng@vivo.com>
[ Upstream commit 9d35d068fb138160709e04e3ee97fe29a6f8615b ]
Change the 'ret' variable from u32 to int to store negative error codes or
zero returned by of_property_read_u32().
Storing the negative error codes in unsigned type, doesn't cause an issue
at runtime but it's ugly as pants. Additionally, assigning negative error
codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
flag is enabled.
No effect on runtime.
Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
Fixes: 0fbeae70ee7c ("regulator: add SCMI driver")
Link: https://patch.msgid.link/20250829101411.625214-1-rongqianfeng@vivo.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/scmi-regulator.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c
index 9df726f10ad12..6d609c42e4793 100644
--- a/drivers/regulator/scmi-regulator.c
+++ b/drivers/regulator/scmi-regulator.c
@@ -257,7 +257,8 @@ static int process_scmi_regulator_of_node(struct scmi_device *sdev,
struct device_node *np,
struct scmi_regulator_info *rinfo)
{
- u32 dom, ret;
+ u32 dom;
+ int ret;
ret = of_property_read_u32(np, "reg", &dom);
if (ret)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 078/563] selftests/futex: Fix some futex_numa_mpol subtests
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 077/563] regulator: scmi: Use int type to store negative error codes Greg Kroah-Hartman
@ 2025-10-13 14:38 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 079/563] tools/nolibc: avoid error in dup2() if old fd equals new fd Greg Kroah-Hartman
` (498 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Waiman Long,
Sebastian Andrzej Siewior, Borislav Petkov (AMD), Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Waiman Long <longman@redhat.com>
[ Upstream commit d8e2f919997b14665e4509ef9a5278f291598d6e ]
The "Memory out of range" subtest of futex_numa_mpol assumes that memory
access outside of the mmap'ed area is invalid. That may not be the case
depending on the actual memory layout of the test application. When that
subtest was run on an x86-64 system with latest upstream kernel, the test
passed as an error was returned from futex_wake(). On another PowerPC system,
the same subtest failed because futex_wake() returned 0.
Bail out! futex2_wake(64, 0x86) should fail, but didn't
Looking further into the passed subtest on x86-64, it was found that an
-EINVAL was returned instead of -EFAULT. The -EINVAL error was returned
because the node value test with FLAGS_NUMA set failed with a node value
of 0x7f7f. IOW, the futex memory was accessible and futex_wake() failed
because the supposed node number wasn't valid. If that memory location
happens to have a very small value (e.g. 0), the test will pass and no
error will be returned.
Since this subtest is non-deterministic, drop it unless a guard page beyond
the mmap region is explicitly set.
The other problematic test is the "Memory too small" test. The futex_wake()
function returns the -EINVAL error code because the given futex address isn't
8-byte aligned, not because only 4 of the 8 bytes are valid and the other
4 bytes are not. So change the name of this subtest to "Mis-aligned futex" to
reflect the reality.
[ bp: Massage commit message. ]
Fixes: 3163369407ba ("selftests/futex: Add futex_numa_mpol")
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/20250827130011.677600-3-bigeasy@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/futex/functional/futex_numa_mpol.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/tools/testing/selftests/futex/functional/futex_numa_mpol.c b/tools/testing/selftests/futex/functional/futex_numa_mpol.c
index a9ecfb2d3932a..802c15c821906 100644
--- a/tools/testing/selftests/futex/functional/futex_numa_mpol.c
+++ b/tools/testing/selftests/futex/functional/futex_numa_mpol.c
@@ -182,12 +182,10 @@ int main(int argc, char *argv[])
if (futex_numa->numa == FUTEX_NO_NODE)
ksft_exit_fail_msg("NUMA node is left uninitialized\n");
- ksft_print_msg("Memory too small\n");
+ /* FUTEX2_NUMA futex must be 8-byte aligned */
+ ksft_print_msg("Mis-aligned futex\n");
test_futex(futex_ptr + mem_size - 4, 1);
- ksft_print_msg("Memory out of range\n");
- test_futex(futex_ptr + mem_size, 1);
-
futex_numa->numa = FUTEX_NO_NODE;
mprotect(futex_ptr, mem_size, PROT_READ);
ksft_print_msg("Memory, RO\n");
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 079/563] tools/nolibc: avoid error in dup2() if old fd equals new fd
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2025-10-13 14:38 ` [PATCH 6.17 078/563] selftests/futex: Fix some futex_numa_mpol subtests Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 080/563] selftests/nolibc: fix EXPECT_NZ macro Greg Kroah-Hartman
` (497 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh, Willy Tarreau,
Thomas Weißschuh, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit d1ff0e2d13d6ac3a15be7870e15216726b0a809a ]
dup2() allows both 'old' and 'new' to have the same value, which dup3()
does not. If libc dup2() is implemented through the dup3() system call,
then it would incorrectly fail in this case.
Avoid the error by handling old == new explicitly.
Fixes: 30ca20517ac1 ("tools headers: Move the nolibc header from rcutorture to tools/include/nolibc/")
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Acked-by: Willy Tarreau <w@1wt.eu>
Link: https://lore.kernel.org/r/20250820-nolibc-dup2-einval-v2-1-807185a45c56@linutronix.de
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/include/nolibc/sys.h | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/tools/include/nolibc/sys.h b/tools/include/nolibc/sys.h
index 295e71d34abad..90aadad31f6cb 100644
--- a/tools/include/nolibc/sys.h
+++ b/tools/include/nolibc/sys.h
@@ -238,6 +238,19 @@ static __attribute__((unused))
int sys_dup2(int old, int new)
{
#if defined(__NR_dup3)
+ int ret, nr_fcntl;
+
+#ifdef __NR_fcntl64
+ nr_fcntl = __NR_fcntl64;
+#else
+ nr_fcntl = __NR_fcntl;
+#endif
+
+ if (old == new) {
+ ret = my_syscall2(nr_fcntl, old, F_GETFD);
+ return ret < 0 ? ret : old;
+ }
+
return my_syscall3(__NR_dup3, old, new, 0);
#elif defined(__NR_dup2)
return my_syscall2(__NR_dup2, old, new);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 080/563] selftests/nolibc: fix EXPECT_NZ macro
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 079/563] tools/nolibc: avoid error in dup2() if old fd equals new fd Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 081/563] leds: leds-lp55xx: Use correct address for memory programming Greg Kroah-Hartman
` (496 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Berg, Thomas Weißschuh,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <benjamin.berg@intel.com>
[ Upstream commit 6d33ce3634f99e0c6c9ce9fc111261f2c411cb48 ]
The expect non-zero macro was incorrect and never used. Fix its
definition.
Fixes: 362aecb2d8cfa ("selftests/nolibc: add basic infrastructure to ease creation of nolibc tests")
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Link: https://lore.kernel.org/r/20250731201225.323254-2-benjamin@sipsolutions.net
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/nolibc/nolibc-test.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/nolibc/nolibc-test.c b/tools/testing/selftests/nolibc/nolibc-test.c
index cc4d730ac4656..d074878eb2341 100644
--- a/tools/testing/selftests/nolibc/nolibc-test.c
+++ b/tools/testing/selftests/nolibc/nolibc-test.c
@@ -196,8 +196,8 @@ int expect_zr(int expr, int llen)
}
-#define EXPECT_NZ(cond, expr, val) \
- do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen; } while (0)
+#define EXPECT_NZ(cond, expr) \
+ do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen); } while (0)
static __attribute__((unused))
int expect_nz(int expr, int llen)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 081/563] leds: leds-lp55xx: Use correct address for memory programming
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 080/563] selftests/nolibc: fix EXPECT_NZ macro Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 082/563] PCI/MSI: Check MSI_FLAG_PCI_MSI_MASK_PARENT in cond_[startup|shutdown]_parent() Greg Kroah-Hartman
` (495 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andrei Lalaev, Lee Jones,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Lalaev <andrei.lalaev@anton-paar.com>
[ Upstream commit d6058316d16ee0d1861c0550051b2492efb54b79 ]
Memory programming doesn't work for devices without page support.
For example, LP5562 has 3 engines but doesn't support pages,
the start address is changed depending on engine number.
According to datasheet [1], the PROG MEM register addresses for each
engine are as follows:
Engine 1: 0x10
Engine 2: 0x30
Engine 3: 0x50
However, the current implementation incorrectly calculates the address
of PROG MEM register using the engine index starting from 1:
prog_mem_base = 0x10
LP55xx_BYTES_PER_PAGE = 0x20
Engine 1: 0x10 + 0x20 * 1 = 0x30
Engine 2: 0x10 + 0x20 * 2 = 0x50
Engine 3: 0x10 + 0x20 * 3 = 0x70
This results in writing to the wrong engine memory, causing pattern
programming to fail.
To correct it, the engine index should be decreased:
Engine 1: 0x10 + 0x20 * 0 = 0x10
Engine 2: 0x10 + 0x20 * 1 = 0x30
Engine 3: 0x10 + 0x20 * 2 = 0x50
1 - https://www.ti.com/lit/ds/symlink/lp5562.pdf
Fixes: 31379a57cf2f ("leds: leds-lp55xx: Generalize update_program_memory function")
Signed-off-by: Andrei Lalaev <andrei.lalaev@anton-paar.com>
Link: https://lore.kernel.org/r/20250820-lp5562-prog-mem-address-v1-1-8569647fa71d@anton-paar.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/leds/leds-lp55xx-common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/leds/leds-lp55xx-common.c b/drivers/leds/leds-lp55xx-common.c
index e71456a56ab8d..fd447eb7eb15e 100644
--- a/drivers/leds/leds-lp55xx-common.c
+++ b/drivers/leds/leds-lp55xx-common.c
@@ -212,7 +212,7 @@ int lp55xx_update_program_memory(struct lp55xx_chip *chip,
* For LED chip that support page, PAGE is already set in load_engine.
*/
if (!cfg->pages_per_engine)
- start_addr += LP55xx_BYTES_PER_PAGE * idx;
+ start_addr += LP55xx_BYTES_PER_PAGE * (idx - 1);
for (page = 0; page < program_length / LP55xx_BYTES_PER_PAGE; page++) {
/* Write to the next page each 32 bytes (if supported) */
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 082/563] PCI/MSI: Check MSI_FLAG_PCI_MSI_MASK_PARENT in cond_[startup|shutdown]_parent()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 081/563] leds: leds-lp55xx: Use correct address for memory programming Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 083/563] block: use int to store blk_stack_limits() return value Greg Kroah-Hartman
` (494 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linux Kernel Functional Testing,
Nathan Chancellor, Wei Fang, Inochi Amaoto, Thomas Gleixner,
Jon Hunter, Bjorn Helgaas, Sasha Levin, Chen Wang
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Inochi Amaoto <inochiama@gmail.com>
[ Upstream commit 727e914bbfbbda9e6efa5cb1abe4e96a949d576f ]
For MSI controllers which only support MSI_FLAG_PCI_MSI_MASK_PARENT, the
newly added callback irq_startup() and irq_shutdown() for
pci_msi[x]_template will not unmask or mask the interrupt when startup()
resp. shutdown() is invoked. This prevents the interrupt from being
enabled resp. disabled.
Invoke irq_[un]mask_parent() in cond_[startup|shutdown]_parent(), when the
interrupt has the MSI_FLAG_PCI_MSI_MASK_PARENT flag set.
Fixes: 54f45a30c0d0 ("PCI/MSI: Add startup/shutdown for per device domains")
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
Reported-by: Nathan Chancellor <nathan@kernel.org>
Reported-by: Wei Fang <wei.fang@nxp.com>
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Wei Fang <wei.fang@nxp.com>
Tested-by: Chen Wang <unicorn_wang@outlook.com> # Pioneerbox/SG2042
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://lore.kernel.org/all/20250827230943.17829-1-inochiama@gmail.com
Closes: https://lore.kernel.org/regressions/aK4O7Hl8NCVEMznB@monster/
Closes: https://lore.kernel.org/regressions/20250826220959.GA4119563@ax162/
Closes: https://lore.kernel.org/all/20250827093911.1218640-1-wei.fang@nxp.com/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/msi/irqdomain.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/pci/msi/irqdomain.c b/drivers/pci/msi/irqdomain.c
index e0a800f918e81..b11b7f63f0d6f 100644
--- a/drivers/pci/msi/irqdomain.c
+++ b/drivers/pci/msi/irqdomain.c
@@ -154,6 +154,8 @@ static void cond_shutdown_parent(struct irq_data *data)
if (unlikely(info->flags & MSI_FLAG_PCI_MSI_STARTUP_PARENT))
irq_chip_shutdown_parent(data);
+ else if (unlikely(info->flags & MSI_FLAG_PCI_MSI_MASK_PARENT))
+ irq_chip_mask_parent(data);
}
static unsigned int cond_startup_parent(struct irq_data *data)
@@ -162,6 +164,9 @@ static unsigned int cond_startup_parent(struct irq_data *data)
if (unlikely(info->flags & MSI_FLAG_PCI_MSI_STARTUP_PARENT))
return irq_chip_startup_parent(data);
+ else if (unlikely(info->flags & MSI_FLAG_PCI_MSI_MASK_PARENT))
+ irq_chip_unmask_parent(data);
+
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 083/563] block: use int to store blk_stack_limits() return value
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 082/563] PCI/MSI: Check MSI_FLAG_PCI_MSI_MASK_PARENT in cond_[startup|shutdown]_parent() Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 084/563] ARM: dts: stm32: stm32mp151c-plyaqm: Use correct dai-format property Greg Kroah-Hartman
` (493 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qianfeng Rong, John Garry,
Bart Van Assche, Jens Axboe, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <rongqianfeng@vivo.com>
[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ]
Change the 'ret' variable in blk_stack_limits() from unsigned int to int,
as it needs to store negative value -1.
Storing the negative error codes in unsigned type, or performing equality
comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but
can be confusing. Additionally, assigning negative error codes to unsigned
type may trigger a GCC warning when the -Wsign-conversion flag is enabled.
No effect on runtime.
Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1
Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment")
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20250902130930.68317-1-rongqianfeng@vivo.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-settings.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/block/blk-settings.c b/block/blk-settings.c
index d6438e6c276dc..693bc8d20acf3 100644
--- a/block/blk-settings.c
+++ b/block/blk-settings.c
@@ -763,7 +763,8 @@ static void blk_stack_atomic_writes_limits(struct queue_limits *t,
int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
sector_t start)
{
- unsigned int top, bottom, alignment, ret = 0;
+ unsigned int top, bottom, alignment;
+ int ret = 0;
t->features |= (b->features & BLK_FEAT_INHERIT_MASK);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 084/563] ARM: dts: stm32: stm32mp151c-plyaqm: Use correct dai-format property
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 083/563] block: use int to store blk_stack_limits() return value Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 085/563] dt-bindings: vendor-prefixes: Add undocumented vendor prefixes Greg Kroah-Hartman
` (492 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jihed Chaibi, Alexandre Torgue,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
[ Upstream commit 0b367e60c73c05721cf2156fe8fe077320115ffd ]
The stm32-i2s binding inherits from the standard audio-graph-port
schema for its 'port' subnode, audio-graph-port requires the use
of the 'dai-format' property. The stm32mp151c-plyaqm dts file was
using the non-standard name 'format'.
Correct the property name to 'dai-format' to fix the dtbs_check
validation error.
Fixes: 9365fa46be358 ("ARM: dts: stm32: Add Plymovent AQM devicetree")
Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
Link: https://lore.kernel.org/r/20250830225115.303663-1-jihed.chaibi.dev@gmail.com
Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts b/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts
index 39a3211c61337..55fe916740d7c 100644
--- a/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts
+++ b/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts
@@ -239,7 +239,7 @@ &i2s1 {
i2s1_port: port {
i2s1_endpoint: endpoint {
- format = "i2s";
+ dai-format = "i2s";
mclk-fs = <256>;
remote-endpoint = <&codec_endpoint>;
};
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 085/563] dt-bindings: vendor-prefixes: Add undocumented vendor prefixes
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 084/563] ARM: dts: stm32: stm32mp151c-plyaqm: Use correct dai-format property Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 086/563] genirq/test: Fix depth tests on architectures with NOREQUEST by default Greg Kroah-Hartman
` (491 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rob Herring (Arm), Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring (Arm) <robh@kernel.org>
[ Upstream commit 4ed46073274a5b23baf0b992c459762e28faf549 ]
Add various vendor prefixes which are in use in compatible strings
already. These were found by modifying vendor-prefixes.yaml into a
schema to check compatible strings.
The added prefixes doesn't include various duplicate prefixes in use
such as "lge".
Link: https://lore.kernel.org/r/20250821222136.1027269-1-robh@kernel.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../devicetree/bindings/vendor-prefixes.yaml | 50 +++++++++++++++++++
1 file changed, 50 insertions(+)
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.yaml b/Documentation/devicetree/bindings/vendor-prefixes.yaml
index 9ec8947dfcad2..ed7fec614473d 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.yaml
+++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml
@@ -86,6 +86,8 @@ patternProperties:
description: Allegro DVT
"^allegromicro,.*":
description: Allegro MicroSystems, Inc.
+ "^alliedtelesis,.*":
+ description: Allied Telesis, Inc.
"^alliedvision,.*":
description: Allied Vision Technologies GmbH
"^allo,.*":
@@ -229,6 +231,8 @@ patternProperties:
description: Bitmain Technologies
"^blaize,.*":
description: Blaize, Inc.
+ "^bluegiga,.*":
+ description: Bluegiga Technologies Ltd.
"^blutek,.*":
description: BluTek Power
"^boe,.*":
@@ -247,6 +251,8 @@ patternProperties:
description: Bticino International
"^buffalo,.*":
description: Buffalo, Inc.
+ "^buglabs,.*":
+ description: Bug Labs, Inc.
"^bur,.*":
description: B&R Industrial Automation GmbH
"^bytedance,.*":
@@ -325,6 +331,8 @@ patternProperties:
description: Conexant Systems, Inc.
"^colorfly,.*":
description: Colorful GRP, Shenzhen Xueyushi Technology Ltd.
+ "^compal,.*":
+ description: Compal Electronics, Inc.
"^compulab,.*":
description: CompuLab Ltd.
"^comvetia,.*":
@@ -353,6 +361,8 @@ patternProperties:
description: Guangzhou China Star Optoelectronics Technology Co., Ltd
"^csq,.*":
description: Shenzen Chuangsiqi Technology Co.,Ltd.
+ "^csr,.*":
+ description: Cambridge Silicon Radio
"^ctera,.*":
description: CTERA Networks Intl.
"^ctu,.*":
@@ -455,6 +465,8 @@ patternProperties:
description: Emtop Embedded Solutions
"^eeti,.*":
description: eGalax_eMPIA Technology Inc
+ "^egnite,.*":
+ description: egnite GmbH
"^einfochips,.*":
description: Einfochips
"^eink,.*":
@@ -485,8 +497,12 @@ patternProperties:
description: Empire Electronix
"^emtrion,.*":
description: emtrion GmbH
+ "^enbw,.*":
+ description: Energie Baden-Württemberg AG
"^enclustra,.*":
description: Enclustra GmbH
+ "^endian,.*":
+ description: Endian SRL
"^endless,.*":
description: Endless Mobile, Inc.
"^ene,.*":
@@ -554,6 +570,8 @@ patternProperties:
description: FocalTech Systems Co.,Ltd
"^forlinx,.*":
description: Baoding Forlinx Embedded Technology Co., Ltd.
+ "^foxlink,.*":
+ description: Foxlink Group
"^freebox,.*":
description: Freebox SAS
"^freecom,.*":
@@ -642,6 +660,10 @@ patternProperties:
description: Haoyu Microelectronic Co. Ltd.
"^hardkernel,.*":
description: Hardkernel Co., Ltd
+ "^hce,.*":
+ description: HCE Engineering SRL
+ "^headacoustics,.*":
+ description: HEAD acoustics
"^hechuang,.*":
description: Shenzhen Hechuang Intelligent Co.
"^hideep,.*":
@@ -725,6 +747,8 @@ patternProperties:
description: Shenzhen INANBO Electronic Technology Co., Ltd.
"^incircuit,.*":
description: In-Circuit GmbH
+ "^incostartec,.*":
+ description: INCOstartec GmbH
"^indiedroid,.*":
description: Indiedroid
"^inet-tek,.*":
@@ -933,6 +957,8 @@ patternProperties:
description: Maxim Integrated Products
"^maxlinear,.*":
description: MaxLinear Inc.
+ "^maxtor,.*":
+ description: Maxtor Corporation
"^mbvl,.*":
description: Mobiveil Inc.
"^mcube,.*":
@@ -1096,6 +1122,8 @@ patternProperties:
description: Nordic Semiconductor
"^nothing,.*":
description: Nothing Technology Limited
+ "^novatech,.*":
+ description: NovaTech Automation
"^novatek,.*":
description: Novatek
"^novtech,.*":
@@ -1191,6 +1219,8 @@ patternProperties:
description: Pervasive Displays, Inc.
"^phicomm,.*":
description: PHICOMM Co., Ltd.
+ "^phontech,.*":
+ description: Phontech
"^phytec,.*":
description: PHYTEC Messtechnik GmbH
"^picochip,.*":
@@ -1275,6 +1305,8 @@ patternProperties:
description: Ramtron International
"^raspberrypi,.*":
description: Raspberry Pi Foundation
+ "^raumfeld,.*":
+ description: Raumfeld GmbH
"^raydium,.*":
description: Raydium Semiconductor Corp.
"^rda,.*":
@@ -1313,6 +1345,8 @@ patternProperties:
description: ROHM Semiconductor Co., Ltd
"^ronbo,.*":
description: Ronbo Electronics
+ "^ronetix,.*":
+ description: Ronetix GmbH
"^roofull,.*":
description: Shenzhen Roofull Technology Co, Ltd
"^roseapplepi,.*":
@@ -1339,8 +1373,12 @@ patternProperties:
description: Schindler
"^schneider,.*":
description: Schneider Electric
+ "^schulercontrol,.*":
+ description: Schuler Group
"^sciosense,.*":
description: ScioSense B.V.
+ "^sdmc,.*":
+ description: SDMC Technology Co., Ltd
"^seagate,.*":
description: Seagate Technology PLC
"^seeed,.*":
@@ -1379,6 +1417,8 @@ patternProperties:
description: Si-En Technology Ltd.
"^si-linux,.*":
description: Silicon Linux Corporation
+ "^sielaff,.*":
+ description: Sielaff GmbH & Co.
"^siemens,.*":
description: Siemens AG
"^sifive,.*":
@@ -1447,6 +1487,8 @@ patternProperties:
description: SolidRun
"^solomon,.*":
description: Solomon Systech Limited
+ "^somfy,.*":
+ description: Somfy Systems Inc.
"^sony,.*":
description: Sony Corporation
"^sophgo,.*":
@@ -1517,6 +1559,8 @@ patternProperties:
"^synopsys,.*":
description: Synopsys, Inc. (deprecated, use snps)
deprecated: true
+ "^taos,.*":
+ description: Texas Advanced Optoelectronic Solutions Inc.
"^tbs,.*":
description: TBS Technologies
"^tbs-biometrics,.*":
@@ -1547,6 +1591,8 @@ patternProperties:
description: Teltonika Networks
"^tempo,.*":
description: Tempo Semiconductor
+ "^tenda,.*":
+ description: Shenzhen Tenda Technology Co., Ltd.
"^terasic,.*":
description: Terasic Inc.
"^tesla,.*":
@@ -1650,6 +1696,8 @@ patternProperties:
description: V3 Semiconductor
"^vaisala,.*":
description: Vaisala
+ "^valve,.*":
+ description: Valve Corporation
"^vamrs,.*":
description: Vamrs Ltd.
"^variscite,.*":
@@ -1750,6 +1798,8 @@ patternProperties:
description: Extreme Engineering Solutions (X-ES)
"^xiaomi,.*":
description: Xiaomi Technology Co., Ltd.
+ "^xicor,.*":
+ description: Xicor Inc.
"^xillybus,.*":
description: Xillybus Ltd.
"^xingbangda,.*":
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 086/563] genirq/test: Fix depth tests on architectures with NOREQUEST by default.
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 085/563] dt-bindings: vendor-prefixes: Add undocumented vendor prefixes Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 087/563] genirq/test: Select IRQ_DOMAIN Greg Kroah-Hartman
` (490 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Gow, Thomas Gleixner,
Guenter Roeck, Brian Norris, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Gow <davidgow@google.com>
[ Upstream commit c9163915a93d40e32c4e4aeb942c0adcb190d72e ]
The new irq KUnit tests fail on some architectures (notably PowerPC and
32-bit ARM), as the request_irq() call fails due to the ARCH_IRQ_INIT_FLAGS
containing IRQ_NOREQUEST, yielding the following errors:
[10:17:45] # irq_free_disabled_test: EXPECTATION FAILED at kernel/irq/irq_test.c:88
[10:17:45] Expected ret == 0, but
[10:17:45] ret == -22 (0xffffffffffffffea)
[10:17:45] # irq_free_disabled_test: EXPECTATION FAILED at kernel/irq/irq_test.c:90
[10:17:45] Expected desc->depth == 0, but
[10:17:45] desc->depth == 1 (0x1)
[10:17:45] # irq_free_disabled_test: EXPECTATION FAILED at kernel/irq/irq_test.c:93
[10:17:45] Expected desc->depth == 1, but
[10:17:45] desc->depth == 2 (0x2)
By clearing IRQ_NOREQUEST from the interrupt descriptor, these tests now
pass on ARM and PowerPC.
Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts")
Signed-off-by: David Gow <davidgow@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Brian Norris <briannorris@chromium.org>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Link: https://lore.kernel.org/all/20250816094528.3560222-2-davidgow@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/irq/irq_test.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/kernel/irq/irq_test.c b/kernel/irq/irq_test.c
index a75abebed7f24..e220e7b2fc187 100644
--- a/kernel/irq/irq_test.c
+++ b/kernel/irq/irq_test.c
@@ -54,6 +54,9 @@ static void irq_disable_depth_test(struct kunit *test)
desc = irq_to_desc(virq);
KUNIT_ASSERT_PTR_NE(test, desc, NULL);
+ /* On some architectures, IRQs are NOREQUEST | NOPROBE by default. */
+ irq_settings_clr_norequest(desc);
+
ret = request_irq(virq, noop_handler, 0, "test_irq", NULL);
KUNIT_EXPECT_EQ(test, ret, 0);
@@ -81,6 +84,9 @@ static void irq_free_disabled_test(struct kunit *test)
desc = irq_to_desc(virq);
KUNIT_ASSERT_PTR_NE(test, desc, NULL);
+ /* On some architectures, IRQs are NOREQUEST | NOPROBE by default. */
+ irq_settings_clr_norequest(desc);
+
ret = request_irq(virq, noop_handler, 0, "test_irq", NULL);
KUNIT_EXPECT_EQ(test, ret, 0);
@@ -120,6 +126,9 @@ static void irq_shutdown_depth_test(struct kunit *test)
desc = irq_to_desc(virq);
KUNIT_ASSERT_PTR_NE(test, desc, NULL);
+ /* On some architectures, IRQs are NOREQUEST | NOPROBE by default. */
+ irq_settings_clr_norequest(desc);
+
data = irq_desc_get_irq_data(desc);
KUNIT_ASSERT_PTR_NE(test, data, NULL);
@@ -180,6 +189,9 @@ static void irq_cpuhotplug_test(struct kunit *test)
desc = irq_to_desc(virq);
KUNIT_ASSERT_PTR_NE(test, desc, NULL);
+ /* On some architectures, IRQs are NOREQUEST | NOPROBE by default. */
+ irq_settings_clr_norequest(desc);
+
data = irq_desc_get_irq_data(desc);
KUNIT_ASSERT_PTR_NE(test, data, NULL);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 087/563] genirq/test: Select IRQ_DOMAIN
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 086/563] genirq/test: Fix depth tests on architectures with NOREQUEST by default Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 088/563] genirq/test: Depend on SPARSE_IRQ Greg Kroah-Hartman
` (489 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Brian Norris,
Thomas Gleixner, David Gow, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <briannorris@chromium.org>
[ Upstream commit f8a44f9babd054ff19e20a30cab661d716ad5459 ]
These tests use irq_domain_alloc_descs() and so require CONFIG_IRQ_DOMAIN.
Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts")
Reported-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: David Gow <davidgow@google.com>
Link: https://lore.kernel.org/all/20250822190140.2154646-2-briannorris@chromium.org
Closes: https://lore.kernel.org/lkml/ded44edf-eeb7-420c-b8a8-d6543b955e6e@roeck-us.net/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/irq/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/irq/Kconfig b/kernel/irq/Kconfig
index 1da5e9d9da719..08088b8e95ae9 100644
--- a/kernel/irq/Kconfig
+++ b/kernel/irq/Kconfig
@@ -148,6 +148,7 @@ config IRQ_KUNIT_TEST
bool "KUnit tests for IRQ management APIs" if !KUNIT_ALL_TESTS
depends on KUNIT=y
default KUNIT_ALL_TESTS
+ select IRQ_DOMAIN
imply SMP
help
This option enables KUnit tests for the IRQ subsystem API. These are
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 088/563] genirq/test: Depend on SPARSE_IRQ
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 087/563] genirq/test: Select IRQ_DOMAIN Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 089/563] genirq/test: Drop CONFIG_GENERIC_IRQ_MIGRATION assumptions Greg Kroah-Hartman
` (488 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Brian Norris,
Thomas Gleixner, David Gow, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <briannorris@chromium.org>
[ Upstream commit 0c888bc86d672e551ce5c58b891c8b44f8967643 ]
Some architectures have a static interrupt layout, with a limited number of
interrupts. Without SPARSE_IRQ, the test may not be able to allocate any
fake interrupts, and the test will fail. (This occurs on ARCH=m68k, for
example.)
Additionally, managed-affinity is only supported with CONFIG_SPARSE_IRQ=y,
so irq_shutdown_depth_test() and irq_cpuhotplug_test() would fail without
it.
Add a 'SPARSE_IRQ' dependency to avoid these problems.
Many architectures 'select SPARSE_IRQ', so this is easy to miss.
Notably, this also excludes ARCH=um from running any of these tests, even
though some of them might work.
Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts")
Reported-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: David Gow <davidgow@google.com>
Link: https://lore.kernel.org/all/20250822190140.2154646-5-briannorris@chromium.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/irq/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/irq/Kconfig b/kernel/irq/Kconfig
index 08088b8e95ae9..a75df2bb9db66 100644
--- a/kernel/irq/Kconfig
+++ b/kernel/irq/Kconfig
@@ -147,6 +147,7 @@ config GENERIC_IRQ_KEXEC_CLEAR_VM_FORWARD
config IRQ_KUNIT_TEST
bool "KUnit tests for IRQ management APIs" if !KUNIT_ALL_TESTS
depends on KUNIT=y
+ depends on SPARSE_IRQ
default KUNIT_ALL_TESTS
select IRQ_DOMAIN
imply SMP
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 089/563] genirq/test: Drop CONFIG_GENERIC_IRQ_MIGRATION assumptions
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 088/563] genirq/test: Depend on SPARSE_IRQ Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 090/563] genirq/test: Ensure CPU 1 is online for hotplug test Greg Kroah-Hartman
` (487 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Brian Norris,
Thomas Gleixner, David Gow, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <briannorris@chromium.org>
[ Upstream commit add03fdb9d52411cabb3872fb7692df6f4c67586 ]
Not all platforms use the generic IRQ migration code, even if they select
GENERIC_IRQ_MIGRATION. (See, for example, powerpc / pseries_cpu_disable().)
If such platforms don't perform managed shutdown the same way, the interrupt
may not actually shut down, and these tests fail:
[ 4.357022][ T101] # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:211
[ 4.357022][ T101] Expected irqd_is_activated(data) to be false, but is true
[ 4.358128][ T101] # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:212
[ 4.358128][ T101] Expected irqd_is_started(data) to be false, but is true
[ 4.375558][ T101] # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:216
[ 4.375558][ T101] Expected irqd_is_activated(data) to be false, but is true
[ 4.376088][ T101] # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:217
[ 4.376088][ T101] Expected irqd_is_started(data) to be false, but is true
[ 4.377851][ T1] # irq_cpuhotplug_test: pass:0 fail:1 skip:0 total:1
[ 4.377901][ T1] not ok 4 irq_cpuhotplug_test
[ 4.378073][ T1] # irq_test_cases: pass:3 fail:1 skip:0 total:4
Rather than test that PowerPC performs migration the same way as the
unterrupt core, just drop the state checks. The point of the test was to
ensure that the code kept |depth| balanced, which still can be tested for.
Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts")
Reported-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: David Gow <davidgow@google.com>
Link: https://lore.kernel.org/all/20250822190140.2154646-6-briannorris@chromium.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/irq/irq_test.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/kernel/irq/irq_test.c b/kernel/irq/irq_test.c
index e220e7b2fc187..37568ec714b51 100644
--- a/kernel/irq/irq_test.c
+++ b/kernel/irq/irq_test.c
@@ -208,13 +208,9 @@ static void irq_cpuhotplug_test(struct kunit *test)
KUNIT_EXPECT_EQ(test, desc->depth, 1);
KUNIT_EXPECT_EQ(test, remove_cpu(1), 0);
- KUNIT_EXPECT_FALSE(test, irqd_is_activated(data));
- KUNIT_EXPECT_FALSE(test, irqd_is_started(data));
KUNIT_EXPECT_GE(test, desc->depth, 1);
KUNIT_EXPECT_EQ(test, add_cpu(1), 0);
- KUNIT_EXPECT_FALSE(test, irqd_is_activated(data));
- KUNIT_EXPECT_FALSE(test, irqd_is_started(data));
KUNIT_EXPECT_EQ(test, desc->depth, 1);
enable_irq(virq);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 090/563] genirq/test: Ensure CPU 1 is online for hotplug test
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 089/563] genirq/test: Drop CONFIG_GENERIC_IRQ_MIGRATION assumptions Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 091/563] selftests/bpf: Fix count write in testapp_xdp_metadata_copy() Greg Kroah-Hartman
` (486 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Brian Norris,
Thomas Gleixner, David Gow, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <briannorris@chromium.org>
[ Upstream commit 8ad25ebfa70e86860559b306bbc923c7db4fcac6 ]
It's possible to run these tests on platforms that think they have a
hotpluggable CPU1, but for whatever reason, CPU1 is not online and can't be
brought online:
# irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:210
Expected remove_cpu(1) == 0, but
remove_cpu(1) == 1 (0x1)
CPU1: failed to boot: -38
# irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:214
Expected add_cpu(1) == 0, but
add_cpu(1) == -38 (0xffffffffffffffda)
Check that CPU1 is actually online before trying to run the test.
Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts")
Reported-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: David Gow <davidgow@google.com>
Link: https://lore.kernel.org/all/20250822190140.2154646-7-briannorris@chromium.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/irq/irq_test.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/irq/irq_test.c b/kernel/irq/irq_test.c
index 37568ec714b51..f71f46fdcfd5e 100644
--- a/kernel/irq/irq_test.c
+++ b/kernel/irq/irq_test.c
@@ -178,6 +178,8 @@ static void irq_cpuhotplug_test(struct kunit *test)
kunit_skip(test, "requires more than 1 CPU for CPU hotplug");
if (!cpu_is_hotpluggable(1))
kunit_skip(test, "CPU 1 must be hotpluggable");
+ if (!cpu_online(1))
+ kunit_skip(test, "CPU 1 must be online");
cpumask_copy(&affinity.mask, cpumask_of(1));
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 091/563] selftests/bpf: Fix count write in testapp_xdp_metadata_copy()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 090/563] genirq/test: Ensure CPU 1 is online for hotplug test Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 092/563] vdso/datastore: Gate time data behind CONFIG_GENERIC_GETTIMEOFDAY Greg Kroah-Hartman
` (485 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo B . Marlière,
Andrii Nakryiko, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <rbm@suse.com>
[ Upstream commit c9110e6f7237f4a314e2b87b75a8a158b9877a7b ]
Commit 4b302092553c ("selftests/xsk: Add tail adjustment tests and support
check") added a new global to xsk_xdp_progs.c, but left out the access in
the testapp_xdp_metadata_copy() function. Since bpf_map_update_elem() will
write to the whole bss section, it gets truncated. Fix by writing to
skel_rx->bss->count directly.
Fixes: 4b302092553c ("selftests/xsk: Add tail adjustment tests and support check")
Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20250829-selftests-bpf-xsk_regression_fix-v1-1-5f5acdb9fe6b@suse.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/xskxceiver.c | 14 +-------------
1 file changed, 1 insertion(+), 13 deletions(-)
diff --git a/tools/testing/selftests/bpf/xskxceiver.c b/tools/testing/selftests/bpf/xskxceiver.c
index a29de0713f19f..352adc8df2d1c 100644
--- a/tools/testing/selftests/bpf/xskxceiver.c
+++ b/tools/testing/selftests/bpf/xskxceiver.c
@@ -2276,25 +2276,13 @@ static int testapp_xdp_metadata_copy(struct test_spec *test)
{
struct xsk_xdp_progs *skel_rx = test->ifobj_rx->xdp_progs;
struct xsk_xdp_progs *skel_tx = test->ifobj_tx->xdp_progs;
- struct bpf_map *data_map;
- int count = 0;
- int key = 0;
test_spec_set_xdp_prog(test, skel_rx->progs.xsk_xdp_populate_metadata,
skel_tx->progs.xsk_xdp_populate_metadata,
skel_rx->maps.xsk, skel_tx->maps.xsk);
test->ifobj_rx->use_metadata = true;
- data_map = bpf_object__find_map_by_name(skel_rx->obj, "xsk_xdp_.bss");
- if (!data_map || !bpf_map__is_internal(data_map)) {
- ksft_print_msg("Error: could not find bss section of XDP program\n");
- return TEST_FAILURE;
- }
-
- if (bpf_map_update_elem(bpf_map__fd(data_map), &key, &count, BPF_ANY)) {
- ksft_print_msg("Error: could not update count element\n");
- return TEST_FAILURE;
- }
+ skel_rx->bss->count = 0;
return testapp_validate_traffic(test);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 092/563] vdso/datastore: Gate time data behind CONFIG_GENERIC_GETTIMEOFDAY
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 091/563] selftests/bpf: Fix count write in testapp_xdp_metadata_copy() Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 093/563] PM: sleep: core: Clear power.must_resume in noirq suspend error path Greg Kroah-Hartman
` (484 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh,
Thomas Gleixner, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit 7c0c01a216e6d9e1d169c0f6f3b5522e6da708ed ]
When the generic vDSO does not provide time functions, as for example on
riscv32, then the time data store is not necessary.
Avoid allocating these time data pages when not used.
Fixes: df7fcbefa710 ("vdso: Add generic time data storage")
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/all/20250826-vdso-cleanups-v1-1-d9b65750e49f@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/vdso/datastore.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/lib/vdso/datastore.c b/lib/vdso/datastore.c
index 3693c6caf2c4d..a565c30c71a04 100644
--- a/lib/vdso/datastore.c
+++ b/lib/vdso/datastore.c
@@ -11,14 +11,14 @@
/*
* The vDSO data page.
*/
-#ifdef CONFIG_HAVE_GENERIC_VDSO
+#ifdef CONFIG_GENERIC_GETTIMEOFDAY
static union {
struct vdso_time_data data;
u8 page[PAGE_SIZE];
} vdso_time_data_store __page_aligned_data;
struct vdso_time_data *vdso_k_time_data = &vdso_time_data_store.data;
static_assert(sizeof(vdso_time_data_store) == PAGE_SIZE);
-#endif /* CONFIG_HAVE_GENERIC_VDSO */
+#endif /* CONFIG_GENERIC_GETTIMEOFDAY */
#ifdef CONFIG_VDSO_GETRANDOM
static union {
@@ -46,7 +46,7 @@ static vm_fault_t vvar_fault(const struct vm_special_mapping *sm,
switch (vmf->pgoff) {
case VDSO_TIME_PAGE_OFFSET:
- if (!IS_ENABLED(CONFIG_HAVE_GENERIC_VDSO))
+ if (!IS_ENABLED(CONFIG_GENERIC_GETTIMEOFDAY))
return VM_FAULT_SIGBUS;
pfn = __phys_to_pfn(__pa_symbol(vdso_k_time_data));
if (timens_page) {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 093/563] PM: sleep: core: Clear power.must_resume in noirq suspend error path
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 092/563] vdso/datastore: Gate time data behind CONFIG_GENERIC_GETTIMEOFDAY Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 094/563] blk-mq: fix elevator depth_updated method Greg Kroah-Hartman
` (483 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki, Ulf Hansson,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit be82483d1b60baf6747884bd74cb7de484deaf76 ]
If system suspend is aborted in the "noirq" phase (for instance, due to
an error returned by one of the device callbacks), power.is_noirq_suspended
will not be set for some devices and device_resume_noirq() will return
early for them. Consequently, noirq resume callbacks will not run for
them at all because the noirq suspend callbacks have not run for them
yet.
If any of them has power.must_resume set and late suspend has been
skipped for it (due to power.smart_suspend), early resume should be
skipped for it either, or its state may become inconsistent (for
instance, if the early resume assumes that it will always follow
noirq resume).
Make that happen by clearing power.must_resume in device_resume_noirq()
for devices with power.is_noirq_suspended clear that have been left in
suspend by device_suspend_late(), which will subsequently cause
device_resume_early() to leave the device in suspend and avoid
changing its state.
Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag")
Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowland.harvard.edu/
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/power/main.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index 2ea6e05e6ec90..c883b01ffbddc 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -724,8 +724,20 @@ static void device_resume_noirq(struct device *dev, pm_message_t state, bool asy
if (dev->power.syscore || dev->power.direct_complete)
goto Out;
- if (!dev->power.is_noirq_suspended)
+ if (!dev->power.is_noirq_suspended) {
+ /*
+ * This means that system suspend has been aborted in the noirq
+ * phase before invoking the noirq suspend callback for the
+ * device, so if device_suspend_late() has left it in suspend,
+ * device_resume_early() should leave it in suspend either in
+ * case the early resume of it depends on the noirq resume that
+ * has not run.
+ */
+ if (dev_pm_skip_suspend(dev))
+ dev->power.must_resume = false;
+
goto Out;
+ }
if (!dpm_wait_for_superior(dev, async))
goto Out;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 094/563] blk-mq: fix elevator depth_updated method
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 093/563] PM: sleep: core: Clear power.must_resume in noirq suspend error path Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 095/563] vdso: Add struct __kernel_old_timeval forward declaration to gettime.h Greg Kroah-Hartman
` (482 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yu Kuai, Hannes Reinecke, Li Nan,
Nilay Shroff, Jens Axboe, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit 7d337eef4affc5e26e0570513168c69ddbc40f92 ]
Current depth_updated has some problems:
1) depth_updated() will be called for each hctx, while all elevators
will update async_depth for the disk level, this is not related to hctx;
2) In blk_mq_update_nr_requests(), if previous hctx update succeed and
this hctx update failed, q->nr_requests will not be updated, while
async_depth is already updated with new nr_reqeuests in previous
depth_updated();
3) All elevators are using q->nr_requests to calculate async_depth now,
however, q->nr_requests is still the old value when depth_updated() is
called from blk_mq_update_nr_requests();
Those problems are first from error path, then mq-deadline, and recently
for bfq and kyber, fix those problems by:
- pass in request_queue instead of hctx;
- move depth_updated() after q->nr_requests is updated in
blk_mq_update_nr_requests();
- add depth_updated() call inside init_sched() method to initialize
async_depth;
- remove init_hctx() method for mq-deadline and bfq that is useless now;
Fixes: 77f1e0a52d26 ("bfq: update internal depth state when queue depth changes")
Fixes: 39823b47bbd4 ("block/mq-deadline: Fix the tag reservation code")
Fixes: 42e6c6ce03fd ("lib/sbitmap: convert shallow_depth from one word to the whole sbitmap")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Li Nan <linan122@huawei.com>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Link: https://lore.kernel.org/r/20250821060612.1729939-2-yukuai1@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/bfq-iosched.c | 22 +++++-----------------
block/blk-mq-sched.h | 11 +++++++++++
block/blk-mq.c | 23 ++++++++++++-----------
block/elevator.h | 2 +-
block/kyber-iosched.c | 19 +++++++++----------
block/mq-deadline.c | 16 +++-------------
6 files changed, 41 insertions(+), 52 deletions(-)
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 50e51047e1fe5..4a8d3d96bfe49 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -7109,9 +7109,10 @@ void bfq_put_async_queues(struct bfq_data *bfqd, struct bfq_group *bfqg)
* See the comments on bfq_limit_depth for the purpose of
* the depths set in the function. Return minimum shallow depth we'll use.
*/
-static void bfq_update_depths(struct bfq_data *bfqd, struct sbitmap_queue *bt)
+static void bfq_depth_updated(struct request_queue *q)
{
- unsigned int nr_requests = bfqd->queue->nr_requests;
+ struct bfq_data *bfqd = q->elevator->elevator_data;
+ unsigned int nr_requests = q->nr_requests;
/*
* In-word depths if no bfq_queue is being weight-raised:
@@ -7143,21 +7144,8 @@ static void bfq_update_depths(struct bfq_data *bfqd, struct sbitmap_queue *bt)
bfqd->async_depths[1][0] = max((nr_requests * 3) >> 4, 1U);
/* no more than ~37% of tags for sync writes (~20% extra tags) */
bfqd->async_depths[1][1] = max((nr_requests * 6) >> 4, 1U);
-}
-
-static void bfq_depth_updated(struct blk_mq_hw_ctx *hctx)
-{
- struct bfq_data *bfqd = hctx->queue->elevator->elevator_data;
- struct blk_mq_tags *tags = hctx->sched_tags;
- bfq_update_depths(bfqd, &tags->bitmap_tags);
- sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, 1);
-}
-
-static int bfq_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int index)
-{
- bfq_depth_updated(hctx);
- return 0;
+ blk_mq_set_min_shallow_depth(q, 1);
}
static void bfq_exit_queue(struct elevator_queue *e)
@@ -7369,6 +7357,7 @@ static int bfq_init_queue(struct request_queue *q, struct elevator_queue *eq)
goto out_free;
bfq_init_root_group(bfqd->root_group, bfqd);
bfq_init_entity(&bfqd->oom_bfqq.entity, bfqd->root_group);
+ bfq_depth_updated(q);
/* We dispatch from request queue wide instead of hw queue */
blk_queue_flag_set(QUEUE_FLAG_SQ_SCHED, q);
@@ -7628,7 +7617,6 @@ static struct elevator_type iosched_bfq_mq = {
.request_merged = bfq_request_merged,
.has_work = bfq_has_work,
.depth_updated = bfq_depth_updated,
- .init_hctx = bfq_init_hctx,
.init_sched = bfq_init_queue,
.exit_sched = bfq_exit_queue,
},
diff --git a/block/blk-mq-sched.h b/block/blk-mq-sched.h
index b554e1d559508..fe83187f41db4 100644
--- a/block/blk-mq-sched.h
+++ b/block/blk-mq-sched.h
@@ -92,4 +92,15 @@ static inline bool blk_mq_sched_needs_restart(struct blk_mq_hw_ctx *hctx)
return test_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
}
+static inline void blk_mq_set_min_shallow_depth(struct request_queue *q,
+ unsigned int depth)
+{
+ struct blk_mq_hw_ctx *hctx;
+ unsigned long i;
+
+ queue_for_each_hw_ctx(q, hctx, i)
+ sbitmap_queue_min_shallow_depth(&hctx->sched_tags->bitmap_tags,
+ depth);
+}
+
#endif
diff --git a/block/blk-mq.c b/block/blk-mq.c
index ba3a4b77f5786..9055cd6247004 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -4951,20 +4951,21 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
false);
}
if (ret)
- break;
- if (q->elevator && q->elevator->type->ops.depth_updated)
- q->elevator->type->ops.depth_updated(hctx);
+ goto out;
}
- if (!ret) {
- q->nr_requests = nr;
- if (blk_mq_is_shared_tags(set->flags)) {
- if (q->elevator)
- blk_mq_tag_update_sched_shared_tags(q);
- else
- blk_mq_tag_resize_shared_tags(set, nr);
- }
+
+ q->nr_requests = nr;
+ if (q->elevator && q->elevator->type->ops.depth_updated)
+ q->elevator->type->ops.depth_updated(q);
+
+ if (blk_mq_is_shared_tags(set->flags)) {
+ if (q->elevator)
+ blk_mq_tag_update_sched_shared_tags(q);
+ else
+ blk_mq_tag_resize_shared_tags(set, nr);
}
+out:
blk_mq_unquiesce_queue(q);
return ret;
diff --git a/block/elevator.h b/block/elevator.h
index adc5c157e17e5..c4d20155065e8 100644
--- a/block/elevator.h
+++ b/block/elevator.h
@@ -37,7 +37,7 @@ struct elevator_mq_ops {
void (*exit_sched)(struct elevator_queue *);
int (*init_hctx)(struct blk_mq_hw_ctx *, unsigned int);
void (*exit_hctx)(struct blk_mq_hw_ctx *, unsigned int);
- void (*depth_updated)(struct blk_mq_hw_ctx *);
+ void (*depth_updated)(struct request_queue *);
bool (*allow_merge)(struct request_queue *, struct request *, struct bio *);
bool (*bio_merge)(struct request_queue *, struct bio *, unsigned int);
diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c
index 70cbc7b2deb40..18efd6ef2a2b9 100644
--- a/block/kyber-iosched.c
+++ b/block/kyber-iosched.c
@@ -399,6 +399,14 @@ static struct kyber_queue_data *kyber_queue_data_alloc(struct request_queue *q)
return ERR_PTR(ret);
}
+static void kyber_depth_updated(struct request_queue *q)
+{
+ struct kyber_queue_data *kqd = q->elevator->elevator_data;
+
+ kqd->async_depth = q->nr_requests * KYBER_ASYNC_PERCENT / 100U;
+ blk_mq_set_min_shallow_depth(q, kqd->async_depth);
+}
+
static int kyber_init_sched(struct request_queue *q, struct elevator_queue *eq)
{
struct kyber_queue_data *kqd;
@@ -413,6 +421,7 @@ static int kyber_init_sched(struct request_queue *q, struct elevator_queue *eq)
eq->elevator_data = kqd;
q->elevator = eq;
+ kyber_depth_updated(q);
return 0;
}
@@ -440,15 +449,6 @@ static void kyber_ctx_queue_init(struct kyber_ctx_queue *kcq)
INIT_LIST_HEAD(&kcq->rq_list[i]);
}
-static void kyber_depth_updated(struct blk_mq_hw_ctx *hctx)
-{
- struct kyber_queue_data *kqd = hctx->queue->elevator->elevator_data;
- struct blk_mq_tags *tags = hctx->sched_tags;
-
- kqd->async_depth = hctx->queue->nr_requests * KYBER_ASYNC_PERCENT / 100U;
- sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, kqd->async_depth);
-}
-
static int kyber_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx)
{
struct kyber_hctx_data *khd;
@@ -493,7 +493,6 @@ static int kyber_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx)
khd->batching = 0;
hctx->sched_data = khd;
- kyber_depth_updated(hctx);
return 0;
diff --git a/block/mq-deadline.c b/block/mq-deadline.c
index b9b7cdf1d3c98..2e689b2c40213 100644
--- a/block/mq-deadline.c
+++ b/block/mq-deadline.c
@@ -507,22 +507,12 @@ static void dd_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data)
}
/* Called by blk_mq_update_nr_requests(). */
-static void dd_depth_updated(struct blk_mq_hw_ctx *hctx)
+static void dd_depth_updated(struct request_queue *q)
{
- struct request_queue *q = hctx->queue;
struct deadline_data *dd = q->elevator->elevator_data;
- struct blk_mq_tags *tags = hctx->sched_tags;
dd->async_depth = q->nr_requests;
-
- sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, 1);
-}
-
-/* Called by blk_mq_init_hctx() and blk_mq_init_sched(). */
-static int dd_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx)
-{
- dd_depth_updated(hctx);
- return 0;
+ blk_mq_set_min_shallow_depth(q, 1);
}
static void dd_exit_sched(struct elevator_queue *e)
@@ -587,6 +577,7 @@ static int dd_init_sched(struct request_queue *q, struct elevator_queue *eq)
blk_queue_flag_set(QUEUE_FLAG_SQ_SCHED, q);
q->elevator = eq;
+ dd_depth_updated(q);
return 0;
}
@@ -1048,7 +1039,6 @@ static struct elevator_type mq_deadline = {
.has_work = dd_has_work,
.init_sched = dd_init_sched,
.exit_sched = dd_exit_sched,
- .init_hctx = dd_init_hctx,
},
#ifdef CONFIG_BLK_DEBUG_FS
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 095/563] vdso: Add struct __kernel_old_timeval forward declaration to gettime.h
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 094/563] blk-mq: fix elevator depth_updated method Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 096/563] ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax Greg Kroah-Hartman
` (481 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh,
Thomas Gleixner, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit 437054b1bbe11be87ab0a522b8ccbae3f785c642 ]
The prototype of __vdso_gettimeofday() uses this struct. However
gettime.h's own includes do not provide a definition for it.
Add a forward declaration, similar to other used structs.
Fixes: 42874e4eb35b ("arch: vdso: consolidate gettime prototypes")
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/all/20250815-vdso-sparc64-generic-2-v2-1-b5ff80672347@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/vdso/gettime.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/include/vdso/gettime.h b/include/vdso/gettime.h
index c50d152e7b3e0..9ac161866653a 100644
--- a/include/vdso/gettime.h
+++ b/include/vdso/gettime.h
@@ -5,6 +5,7 @@
#include <linux/types.h>
struct __kernel_timespec;
+struct __kernel_old_timeval;
struct timezone;
#if !defined(CONFIG_64BIT) || defined(BUILD_VDSO32_64)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 096/563] ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 095/563] vdso: Add struct __kernel_old_timeval forward declaration to gettime.h Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 097/563] ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS Greg Kroah-Hartman
` (480 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jihed Chaibi, Kevin Hilman,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
[ Upstream commit 9658a92fad1889ff92fa4bd668cd61052687245a ]
The ti,en-ck32k-xtal property, defined as a boolean in the Device Tree
schema, was incorrectly assigned a value (<1>) in the DTS file, causing
a validation error: "size (4) error for type flag". The driver uses
of_property_read_bool(), expecting a boolean. Remove the value to fix
the dtbs_check error.
Fixes: 262178b6b8e5 ("ARM: dts: split am335x-baltos-ir5221 into dts and dtsi files")
Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
Link: https://lore.kernel.org/all/20250822222530.113520-1-jihed.chaibi.dev@gmail.com/
Link: https://lore.kernel.org/r/20250822222530.113520-1-jihed.chaibi.dev@gmail.com
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
index ae2e8dffbe049..ea47f9960c356 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
+++ b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
@@ -269,7 +269,7 @@ &tps {
vcc7-supply = <&vbat>;
vccio-supply = <&vbat>;
- ti,en-ck32k-xtal = <1>;
+ ti,en-ck32k-xtal;
regulators {
vrtc_reg: regulator@0 {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 097/563] ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 096/563] ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 098/563] ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property Greg Kroah-Hartman
` (479 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jihed Chaibi, Kevin Hilman,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
[ Upstream commit 5af5b85505bc859adb338fe5d6e4842e72cdf932 ]
The ti,keep-vref-on property, defined as a boolean flag in the Device
Tree schema, was incorrectly assigned a value (<1>) in the DTS file,
causing a validation error: "size (4) error for type flag". Remove
the value to match the schema and ensure compatibility with the driver
using device_property_read_bool(). This fixes the dtbs_check error.
Fixes: ed05637c30e6 ("ARM: dts: omap3-devkit8000: Add ADS7846 Touchscreen support")
Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
Link: https://lore.kernel.org/r/20250822225052.136919-1-jihed.chaibi.dev@gmail.com
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
index a7f99ae0c1fe9..78c657429f641 100644
--- a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
+++ b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
@@ -65,7 +65,7 @@ ads7846@0 {
ti,debounce-max = /bits/ 16 <10>;
ti,debounce-tol = /bits/ 16 <5>;
ti,debounce-rep = /bits/ 16 <1>;
- ti,keep-vref-on = <1>;
+ ti,keep-vref-on;
ti,settle-delay-usec = /bits/ 16 <150>;
wakeup-source;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 098/563] ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 097/563] ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 099/563] PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() Greg Kroah-Hartman
` (478 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jihed Chaibi, Kevin Hilman,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
[ Upstream commit 27322753c8b913fba05250e7b5abb1da31e6ed23 ]
The dtbs_check validation for am335x-cm-t335.dtb flags an error
for an unevaluated 'num-serializer' property in the mcasp0 node.
This property is obsolete; it is not defined in the davinci-mcasp-audio
schema and is not used by the corresponding (or any) driver.
Remove this unused property to fix the schema validation warning.
Fixes: 48ab364478e77 ("ARM: dts: cm-t335: add audio support")
Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
Link: https://lore.kernel.org/r/20250830215957.285694-1-jihed.chaibi.dev@gmail.com
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts | 2 --
1 file changed, 2 deletions(-)
diff --git a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
index 06767ea164b59..ece7f7854f6aa 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
+++ b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
@@ -483,8 +483,6 @@ &mcasp1 {
op-mode = <0>; /* MCASP_IIS_MODE */
tdm-slots = <2>;
- /* 16 serializers */
- num-serializer = <16>;
serial-dir = < /* 0: INACTIVE, 1: TX, 2: RX */
0 0 2 1 0 0 0 0 0 0 0 0 0 0 0 0
>;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 099/563] PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 098/563] ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 100/563] power: supply: cw2015: Fix a alignment coding style issue Greg Kroah-Hartman
` (477 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Chanwoo Choi,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit fc33bf0e097c6834646b98a7b3da0ae5b617f0f9 ]
The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which
would lead to a error pointer dereference. Use IS_ERR_OR_NULL() to check
that the pointer is valid.
Fixes: e09bd5757b52 ("PM / devfreq: mtk-cci: Handle sram regulator probe deferral")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Link: https://patchwork.kernel.org/project/linux-pm/patch/aJTNHz8kk8s6Q2os@stanley.mountain/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/devfreq/mtk-cci-devfreq.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/devfreq/mtk-cci-devfreq.c b/drivers/devfreq/mtk-cci-devfreq.c
index 22fe9e631f8aa..5730076846e1b 100644
--- a/drivers/devfreq/mtk-cci-devfreq.c
+++ b/drivers/devfreq/mtk-cci-devfreq.c
@@ -386,7 +386,8 @@ static int mtk_ccifreq_probe(struct platform_device *pdev)
out_free_resources:
if (regulator_is_enabled(drv->proc_reg))
regulator_disable(drv->proc_reg);
- if (drv->sram_reg && regulator_is_enabled(drv->sram_reg))
+ if (!IS_ERR_OR_NULL(drv->sram_reg) &&
+ regulator_is_enabled(drv->sram_reg))
regulator_disable(drv->sram_reg);
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 100/563] power: supply: cw2015: Fix a alignment coding style issue
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 099/563] PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 101/563] hwmon: (asus-ec-sensors) Narrow lock for X870E-CREATOR WIFI Greg Kroah-Hartman
` (476 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Yan, Sebastian Reichel,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Yan <andyshrk@163.com>
[ Upstream commit def5612170a8c6c4c6a3ea5bd6c3cfc8de6ba4b1 ]
Fix the checkpatch warning:
CHECK: Alignment should match open parenthesis
Fixes: 0cb172a4918e ("power: supply: cw2015: Use device managed API to simplify the code")
Signed-off-by: Andy Yan <andyshrk@163.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/cw2015_battery.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c
index f63c3c4104515..382dff8805c62 100644
--- a/drivers/power/supply/cw2015_battery.c
+++ b/drivers/power/supply/cw2015_battery.c
@@ -702,8 +702,7 @@ static int cw_bat_probe(struct i2c_client *client)
if (!cw_bat->battery_workqueue)
return -ENOMEM;
- devm_delayed_work_autocancel(&client->dev,
- &cw_bat->battery_delay_work, cw_bat_work);
+ devm_delayed_work_autocancel(&client->dev, &cw_bat->battery_delay_work, cw_bat_work);
queue_delayed_work(cw_bat->battery_workqueue,
&cw_bat->battery_delay_work, msecs_to_jiffies(10));
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 101/563] hwmon: (asus-ec-sensors) Narrow lock for X870E-CREATOR WIFI
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 100/563] power: supply: cw2015: Fix a alignment coding style issue Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 102/563] pinctrl: renesas: Use int type to store negative error codes Greg Kroah-Hartman
` (475 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eugene Shalygin, Guenter Roeck,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eugene Shalygin <eugene.shalygin@gmail.com>
[ Upstream commit 3aa72cf03924d04c8d20f8b319df8f73550dd26c ]
Use mutex from the SIO device rather than the global lock.
Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com>
Fixes: 3e538b52157b ("hwmon: (asus-ec-sensors) add ProArt X870E-CREATOR WIFI")
Link: https://lore.kernel.org/r/20250805203157.18446-1-eugene.shalygin@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/asus-ec-sensors.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
index 4ac554731e98a..f43efb80aabf3 100644
--- a/drivers/hwmon/asus-ec-sensors.c
+++ b/drivers/hwmon/asus-ec-sensors.c
@@ -396,7 +396,7 @@ static const struct ec_board_info board_info_pro_art_x870E_creator_wifi = {
.sensors = SENSOR_TEMP_CPU | SENSOR_TEMP_CPU_PACKAGE |
SENSOR_TEMP_MB | SENSOR_TEMP_VRM |
SENSOR_TEMP_T_SENSOR | SENSOR_FAN_CPU_OPT,
- .mutex_path = ACPI_GLOBAL_LOCK_PSEUDO_PATH,
+ .mutex_path = ASUS_HW_ACCESS_MUTEX_SB_PCI0_SBRG_SIO1_MUT0,
.family = family_amd_800_series,
};
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 102/563] pinctrl: renesas: Use int type to store negative error codes
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 101/563] hwmon: (asus-ec-sensors) Narrow lock for X870E-CREATOR WIFI Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 103/563] pinctrl: eswin: Fix regulator error check and Kconfig dependency Greg Kroah-Hartman
` (474 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qianfeng Rong, Geert Uytterhoeven,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <rongqianfeng@vivo.com>
[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ]
Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned
int to int, as it needs to store either negative error codes or zero
returned by sh_pfc_pinconf_set().
No effect on runtime.
Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Fixes: d0593c363f04ccc4 ("pinctrl: sh-pfc: Propagate errors on group config")
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/20250831084958.431913-4-rongqianfeng@vivo.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/renesas/pinctrl.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c
index 29d16c9c1bd19..3a742f74ecd1d 100644
--- a/drivers/pinctrl/renesas/pinctrl.c
+++ b/drivers/pinctrl/renesas/pinctrl.c
@@ -726,7 +726,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group,
struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev);
const unsigned int *pins;
unsigned int num_pins;
- unsigned int i, ret;
+ unsigned int i;
+ int ret;
pins = pmx->pfc->info->groups[group].pins;
num_pins = pmx->pfc->info->groups[group].nr_pins;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 103/563] pinctrl: eswin: Fix regulator error check and Kconfig dependency
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 102/563] pinctrl: renesas: Use int type to store negative error codes Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 104/563] null_blk: Fix the description of the cache_size module argument Greg Kroah-Hartman
` (473 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Yulin Lu,
Linus Walleij, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yulin Lu <luyulin@eswincomputing.com>
[ Upstream commit a6a2f50ab1721343ee2d5d2be888709aa886e3aa ]
Smatch reported the following warning in eic7700_pinctrl_probe():
drivers/pinctrl/pinctrl-eic7700.c:638 eic7700_pinctrl_probe()
warn: passing zero to 'PTR_ERR'
The root cause is that devm_regulator_get() may return NULL when
CONFIG_REGULATOR is disabled. In such case, IS_ERR_OR_NULL() triggers
PTR_ERR(NULL) which evaluates to 0, leading to passing a success code
as an error.
However, this driver cannot work without a regulator. To fix this:
- Change the check from IS_ERR_OR_NULL() to IS_ERR()
- Update Kconfig to explicitly select REGULATOR and
REGULATOR_FIXED_VOLTAGE, ensuring that the regulator framework is
always available.
This resolves the Smatch warning and enforces the correct dependency.
Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
Fixes: 5b797bcc00ef ("pinctrl: eswin: Add EIC7700 pinctrl driver")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/linux-gpio/aKRGiZ-fai0bv0tG@stanley.mountain/
Signed-off-by: Yulin Lu <luyulin@eswincomputing.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/Kconfig | 2 ++
drivers/pinctrl/pinctrl-eic7700.c | 2 +-
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
index be1ca8e85754b..0402626c4b98b 100644
--- a/drivers/pinctrl/Kconfig
+++ b/drivers/pinctrl/Kconfig
@@ -211,6 +211,8 @@ config PINCTRL_EIC7700
depends on ARCH_ESWIN || COMPILE_TEST
select PINMUX
select GENERIC_PINCONF
+ select REGULATOR
+ select REGULATOR_FIXED_VOLTAGE
help
This driver support for the pin controller in ESWIN's EIC7700 SoC,
which supports pin multiplexing, pin configuration,and rgmii voltage
diff --git a/drivers/pinctrl/pinctrl-eic7700.c b/drivers/pinctrl/pinctrl-eic7700.c
index 4874b55323439..ffcd0ec5c2dc6 100644
--- a/drivers/pinctrl/pinctrl-eic7700.c
+++ b/drivers/pinctrl/pinctrl-eic7700.c
@@ -634,7 +634,7 @@ static int eic7700_pinctrl_probe(struct platform_device *pdev)
return PTR_ERR(pc->base);
regulator = devm_regulator_get(dev, "vrgmii");
- if (IS_ERR_OR_NULL(regulator)) {
+ if (IS_ERR(regulator)) {
return dev_err_probe(dev, PTR_ERR(regulator),
"failed to get vrgmii regulator\n");
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 104/563] null_blk: Fix the description of the cache_size module argument
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 103/563] pinctrl: eswin: Fix regulator error check and Kconfig dependency Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 105/563] blk-throttle: fix access race during throttle policy activation Greg Kroah-Hartman
` (472 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Genjian Zhang, Damien Le Moal,
Jens Axboe, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Genjian Zhang <zhanggenjian@kylinos.cn>
[ Upstream commit 7942b226e6b84df13b46b76c01d3b6e07a1b349e ]
When executing modinfo null_blk, there is an error in the description
of module parameter mbps, and the output information of cache_size is
incomplete.The output of modinfo before and after applying this patch
is as follows:
Before:
[...]
parm: cache_size:ulong
[...]
parm: mbps:Cache size in MiB for memory-backed device.
Default: 0 (none) (uint)
[...]
After:
[...]
parm: cache_size:Cache size in MiB for memory-backed device.
Default: 0 (none) (ulong)
[...]
parm: mbps:Limit maximum bandwidth (in MiB/s).
Default: 0 (no limit) (uint)
[...]
Fixes: 058efe000b31 ("null_blk: add module parameters for 4 options")
Signed-off-by: Genjian Zhang <zhanggenjian@kylinos.cn>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/null_blk/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
index 91642c9a3b293..f982027e8c858 100644
--- a/drivers/block/null_blk/main.c
+++ b/drivers/block/null_blk/main.c
@@ -223,7 +223,7 @@ MODULE_PARM_DESC(discard, "Support discard operations (requires memory-backed nu
static unsigned long g_cache_size;
module_param_named(cache_size, g_cache_size, ulong, 0444);
-MODULE_PARM_DESC(mbps, "Cache size in MiB for memory-backed device. Default: 0 (none)");
+MODULE_PARM_DESC(cache_size, "Cache size in MiB for memory-backed device. Default: 0 (none)");
static bool g_fua = true;
module_param_named(fua, g_fua, bool, 0444);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 105/563] blk-throttle: fix access race during throttle policy activation
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 104/563] null_blk: Fix the description of the cache_size module argument Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 106/563] selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper Greg Kroah-Hartman
` (471 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liang Jie, Han Guangjiang, Yu Kuai,
Jens Axboe, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Han Guangjiang <hanguangjiang@lixiang.com>
[ Upstream commit bd9fd5be6bc0836820500f68fff144609fbd85a9 ]
On repeated cold boots we occasionally hit a NULL pointer crash in
blk_should_throtl() when throttling is consulted before the throttle
policy is fully enabled for the queue. Checking only q->td != NULL is
insufficient during early initialization, so blkg_to_pd() for the
throttle policy can still return NULL and blkg_to_tg() becomes NULL,
which later gets dereferenced.
Unable to handle kernel NULL pointer dereference
at virtual address 0000000000000156
...
pc : submit_bio_noacct+0x14c/0x4c8
lr : submit_bio_noacct+0x48/0x4c8
sp : ffff800087f0b690
x29: ffff800087f0b690 x28: 0000000000005f90 x27: ffff00068af393c0
x26: 0000000000080000 x25: 000000000002fbc0 x24: ffff000684ddcc70
x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000
x20: 0000000000080000 x19: ffff000684ddcd08 x18: ffffffffffffffff
x17: 0000000000000000 x16: ffff80008132a550 x15: 0000ffff98020fff
x14: 0000000000000000 x13: 1fffe000d11d7021 x12: ffff000688eb810c
x11: ffff00077ec4bb80 x10: ffff000688dcb720 x9 : ffff80008068ef60
x8 : 00000a6fb8a86e85 x7 : 000000000000111e x6 : 0000000000000002
x5 : 0000000000000246 x4 : 0000000000015cff x3 : 0000000000394500
x2 : ffff000682e35e40 x1 : 0000000000364940 x0 : 000000000000001a
Call trace:
submit_bio_noacct+0x14c/0x4c8
verity_map+0x178/0x2c8
__map_bio+0x228/0x250
dm_submit_bio+0x1c4/0x678
__submit_bio+0x170/0x230
submit_bio_noacct_nocheck+0x16c/0x388
submit_bio_noacct+0x16c/0x4c8
submit_bio+0xb4/0x210
f2fs_submit_read_bio+0x4c/0xf0
f2fs_mpage_readpages+0x3b0/0x5f0
f2fs_readahead+0x90/0xe8
Tighten blk_throtl_activated() to also require that the throttle policy
bit is set on the queue:
return q->td != NULL &&
test_bit(blkcg_policy_throtl.plid, q->blkcg_pols);
This prevents blk_should_throtl() from accessing throttle group state
until policy data has been attached to blkgs.
Fixes: a3166c51702b ("blk-throttle: delay initialization until configuration")
Co-developed-by: Liang Jie <liangjie@lixiang.com>
Signed-off-by: Liang Jie <liangjie@lixiang.com>
Signed-off-by: Han Guangjiang <hanguangjiang@lixiang.com>
Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-cgroup.c | 6 ------
block/blk-cgroup.h | 6 ++++++
block/blk-throttle.c | 6 +-----
block/blk-throttle.h | 18 +++++++++++-------
4 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index fe9ebd6a2e14d..7246fc2563152 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -110,12 +110,6 @@ static struct cgroup_subsys_state *blkcg_css(void)
return task_css(current, io_cgrp_id);
}
-static bool blkcg_policy_enabled(struct request_queue *q,
- const struct blkcg_policy *pol)
-{
- return pol && test_bit(pol->plid, q->blkcg_pols);
-}
-
static void blkg_free_workfn(struct work_struct *work)
{
struct blkcg_gq *blkg = container_of(work, struct blkcg_gq,
diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
index 81868ad86330c..83367086cb6ae 100644
--- a/block/blk-cgroup.h
+++ b/block/blk-cgroup.h
@@ -459,6 +459,12 @@ static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio)
bio_issue_as_root_blkg(rq->bio) == bio_issue_as_root_blkg(bio);
}
+static inline bool blkcg_policy_enabled(struct request_queue *q,
+ const struct blkcg_policy *pol)
+{
+ return pol && test_bit(pol->plid, q->blkcg_pols);
+}
+
void blk_cgroup_bio_start(struct bio *bio);
void blkcg_add_delay(struct blkcg_gq *blkg, u64 now, u64 delta);
#else /* CONFIG_BLK_CGROUP */
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index 397b6a410f9e5..cfa1cd60d2c5f 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -1327,17 +1327,13 @@ static int blk_throtl_init(struct gendisk *disk)
INIT_WORK(&td->dispatch_work, blk_throtl_dispatch_work_fn);
throtl_service_queue_init(&td->service_queue);
- /*
- * Freeze queue before activating policy, to synchronize with IO path,
- * which is protected by 'q_usage_counter'.
- */
memflags = blk_mq_freeze_queue(disk->queue);
blk_mq_quiesce_queue(disk->queue);
q->td = td;
td->queue = q;
- /* activate policy */
+ /* activate policy, blk_throtl_activated() will return true */
ret = blkcg_activate_policy(disk, &blkcg_policy_throtl);
if (ret) {
q->td = NULL;
diff --git a/block/blk-throttle.h b/block/blk-throttle.h
index 3b27755bfbff1..9d7a42c039a15 100644
--- a/block/blk-throttle.h
+++ b/block/blk-throttle.h
@@ -156,7 +156,13 @@ void blk_throtl_cancel_bios(struct gendisk *disk);
static inline bool blk_throtl_activated(struct request_queue *q)
{
- return q->td != NULL;
+ /*
+ * q->td guarantees that the blk-throttle module is already loaded,
+ * and the plid of blk-throttle is assigned.
+ * blkcg_policy_enabled() guarantees that the policy is activated
+ * in the request_queue.
+ */
+ return q->td != NULL && blkcg_policy_enabled(q, &blkcg_policy_throtl);
}
static inline bool blk_should_throtl(struct bio *bio)
@@ -164,11 +170,6 @@ static inline bool blk_should_throtl(struct bio *bio)
struct throtl_grp *tg;
int rw = bio_data_dir(bio);
- /*
- * This is called under bio_queue_enter(), and it's synchronized with
- * the activation of blk-throtl, which is protected by
- * blk_mq_freeze_queue().
- */
if (!blk_throtl_activated(bio->bi_bdev->bd_queue))
return false;
@@ -194,7 +195,10 @@ static inline bool blk_should_throtl(struct bio *bio)
static inline bool blk_throtl_bio(struct bio *bio)
{
-
+ /*
+ * block throttling takes effect if the policy is activated
+ * in the bio's request_queue.
+ */
if (!blk_should_throtl(bio))
return false;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 106/563] selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 105/563] blk-throttle: fix access race during throttle policy activation Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 107/563] selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO Greg Kroah-Hartman
` (470 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot,
Thomas Weißschuh, Thomas Gleixner, Christophe Leroy,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit 9f15e0f9ef514b8e1a80707931f6d07362e8ebc4 ]
The _rval register variable is meant to be an output operand of the asm
statement but is instead used as input operand.
clang 20.1 notices this and triggers -Wuninitialized warnings:
tools/testing/selftests/timers/auxclock.c:154:10: error: variable '_rval' is uninitialized when used here [-Werror,-Wuninitialized]
154 | return VDSO_CALL(self->vdso_clock_gettime64, 2, clockid, ts);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/testing/selftests/timers/../vDSO/vdso_call.h:59:10: note: expanded from macro 'VDSO_CALL'
59 | : "r" (_rval) \
| ^~~~~
tools/testing/selftests/timers/auxclock.c:154:10: note: variable '_rval' is declared here
tools/testing/selftests/timers/../vDSO/vdso_call.h:47:2: note: expanded from macro 'VDSO_CALL'
47 | register long _rval asm ("r3"); \
| ^
It seems the list of input and output operands have been switched around.
However as the argument registers are not always initialized they can not
be marked as pure inputs as that would trigger -Wuninitialized warnings.
Adding _rval as another input and output operand does also not work as it
would collide with the existing _r3 variable.
Instead reuse _r3 for both the argument and the return value.
Fixes: 6eda706a535c ("selftests: vDSO: fix the way vDSO functions are called for powerpc")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-1-90f499dd35f8@linutronix.de
Closes: https://lore.kernel.org/oe-kbuild-all/202506180223.BOOk5jDK-lkp@intel.com/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/vDSO/vdso_call.h | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/tools/testing/selftests/vDSO/vdso_call.h b/tools/testing/selftests/vDSO/vdso_call.h
index bb237d771051b..e7205584cbdca 100644
--- a/tools/testing/selftests/vDSO/vdso_call.h
+++ b/tools/testing/selftests/vDSO/vdso_call.h
@@ -44,7 +44,6 @@
register long _r6 asm ("r6"); \
register long _r7 asm ("r7"); \
register long _r8 asm ("r8"); \
- register long _rval asm ("r3"); \
\
LOADARGS_##nr(fn, args); \
\
@@ -54,13 +53,13 @@
" bns+ 1f\n" \
" neg 3, 3\n" \
"1:" \
- : "+r" (_r0), "=r" (_r3), "+r" (_r4), "+r" (_r5), \
+ : "+r" (_r0), "+r" (_r3), "+r" (_r4), "+r" (_r5), \
"+r" (_r6), "+r" (_r7), "+r" (_r8) \
- : "r" (_rval) \
+ : \
: "r9", "r10", "r11", "r12", "cr0", "cr1", "cr5", \
"cr6", "cr7", "xer", "lr", "ctr", "memory" \
); \
- _rval; \
+ _r3; \
})
#else
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 107/563] selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 106/563] selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 108/563] irqchip/gic-v5: Fix loop in gicv5_its_create_itt_two_level() cleanup path Greg Kroah-Hartman
` (469 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh,
Thomas Gleixner, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit 4b59a9f7628fd82b24f2148f62cf327a84d26555 ]
If AT_SYSINFO_EHDR is missing the whole test needs to be skipped.
Currently this results in the following output:
TAP version 13
1..16
# AT_SYSINFO_EHDR is not present!
This output is incorrect, as "1..16" still requires the subtest lines to
be printed, which isn't done however.
Switch to the correct skipping functions, so the output now correctly
indicates that no subtests are being run:
TAP version 13
1..0 # SKIP AT_SYSINFO_EHDR is not present!
Fixes: 693f5ca08ca0 ("kselftest: Extend vDSO selftest")
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-2-90f499dd35f8@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/vDSO/vdso_test_abi.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/tools/testing/selftests/vDSO/vdso_test_abi.c b/tools/testing/selftests/vDSO/vdso_test_abi.c
index a54424e2336f4..67cbfc56e4e1b 100644
--- a/tools/testing/selftests/vDSO/vdso_test_abi.c
+++ b/tools/testing/selftests/vDSO/vdso_test_abi.c
@@ -182,12 +182,11 @@ int main(int argc, char **argv)
unsigned long sysinfo_ehdr = getauxval(AT_SYSINFO_EHDR);
ksft_print_header();
- ksft_set_plan(VDSO_TEST_PLAN);
- if (!sysinfo_ehdr) {
- ksft_print_msg("AT_SYSINFO_EHDR is not present!\n");
- return KSFT_SKIP;
- }
+ if (!sysinfo_ehdr)
+ ksft_exit_skip("AT_SYSINFO_EHDR is not present!\n");
+
+ ksft_set_plan(VDSO_TEST_PLAN);
version = versions[VDSO_VERSION];
name = (const char **)&names[VDSO_NAMES];
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 108/563] irqchip/gic-v5: Fix loop in gicv5_its_create_itt_two_level() cleanup path
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 107/563] selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 109/563] irqchip/gic-v5: Fix error handling in gicv5_its_irq_domain_alloc() Greg Kroah-Hartman
` (468 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Lorenzo Pieralisi,
Thomas Gleixner, Zenghui Yu, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit bfcd1fdaae92faa8cae880eb4c3aaaa60c54bf0d ]
The "i" variable in gicv5_its_create_itt_two_level() needs to be signed
otherwise it can cause a forever loop in the function's cleanup path.
[ lpieralisi: Reworded commit message ]
Fixes: 57d72196dfc8 ("irqchip/gic-v5: Add GICv5 ITS support")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Zenghui Yu <yuzenghui@huawei.com>
Link: https://lore.kernel.org/all/20250908082745.113718-3-lpieralisi@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-gic-v5-its.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
index 9290ac741949c..4701ef62b8b27 100644
--- a/drivers/irqchip/irq-gic-v5-its.c
+++ b/drivers/irqchip/irq-gic-v5-its.c
@@ -191,9 +191,9 @@ static int gicv5_its_create_itt_two_level(struct gicv5_its_chip_data *its,
unsigned int num_events)
{
unsigned int l1_bits, l2_bits, span, events_per_l2_table;
- unsigned int i, complete_tables, final_span, num_ents;
+ unsigned int complete_tables, final_span, num_ents;
__le64 *itt_l1, *itt_l2, **l2ptrs;
- int ret;
+ int i, ret;
u64 val;
ret = gicv5_its_l2sz_to_l2_bits(itt_l2sz);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 109/563] irqchip/gic-v5: Fix error handling in gicv5_its_irq_domain_alloc()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 108/563] irqchip/gic-v5: Fix loop in gicv5_its_create_itt_two_level() cleanup path Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 110/563] tick: Do not set device to detached state in tick_shutdown() Greg Kroah-Hartman
` (467 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Lorenzo Pieralisi,
Thomas Gleixner, Zenghui Yu, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit a186120c780e21e4cfd186a925e34f718e30de88 ]
Code in gicv5_its_irq_domain_alloc() has two issues:
- it checks the wrong return value/variable when calling gicv5_alloc_lpi()
- The cleanup code does not take previous loop iterations into account
Fix both issues at once by adding the right gicv5_alloc_lpi() variable
check and by reworking the function cleanup code to take into account
current and previous iterations.
[ lpieralisi: Reworded commit message ]
Fixes: 57d72196dfc8 ("irqchip/gic-v5: Add GICv5 ITS support")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Zenghui Yu <yuzenghui@huawei.com>
Link: https://lore.kernel.org/all/20250908082745.113718-4-lpieralisi@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-gic-v5-its.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
index 4701ef62b8b27..2fb58d76f5214 100644
--- a/drivers/irqchip/irq-gic-v5-its.c
+++ b/drivers/irqchip/irq-gic-v5-its.c
@@ -949,15 +949,18 @@ static int gicv5_its_irq_domain_alloc(struct irq_domain *domain, unsigned int vi
device_id = its_dev->device_id;
for (i = 0; i < nr_irqs; i++) {
- lpi = gicv5_alloc_lpi();
+ ret = gicv5_alloc_lpi();
if (ret < 0) {
pr_debug("Failed to find free LPI!\n");
- goto out_eventid;
+ goto out_free_irqs;
}
+ lpi = ret;
ret = irq_domain_alloc_irqs_parent(domain, virq + i, 1, &lpi);
- if (ret)
- goto out_free_lpi;
+ if (ret) {
+ gicv5_free_lpi(lpi);
+ goto out_free_irqs;
+ }
/*
* Store eventid and deviceid into the hwirq for later use.
@@ -977,8 +980,13 @@ static int gicv5_its_irq_domain_alloc(struct irq_domain *domain, unsigned int vi
return 0;
-out_free_lpi:
- gicv5_free_lpi(lpi);
+out_free_irqs:
+ while (--i >= 0) {
+ irqd = irq_domain_get_irq_data(domain, virq + i);
+ gicv5_free_lpi(irqd->parent_data->hwirq);
+ irq_domain_reset_irq_data(irqd);
+ irq_domain_free_irqs_parent(domain, virq + i, 1);
+ }
out_eventid:
gicv5_its_free_eventid(its_dev, event_id_base, nr_irqs);
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 110/563] tick: Do not set device to detached state in tick_shutdown()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 109/563] irqchip/gic-v5: Fix error handling in gicv5_its_irq_domain_alloc() Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 111/563] arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 Greg Kroah-Hartman
` (466 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bibo Mao, Thomas Gleixner,
Frederic Weisbecker, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bibo Mao <maobibo@loongson.cn>
[ Upstream commit fe2a449a45b13df1562419e0104b4777b6ea5248 ]
tick_shutdown() sets the state of the clockevent device to detached
first and the invokes clockevents_exchange_device(), which in turn
invokes clockevents_switch_state().
But clockevents_switch_state() returns without invoking the device shutdown
callback as the device is already in detached state. As a consequence the
timer device is not shutdown when a CPU goes offline.
tick_shutdown() does this because it was originally invoked on a online CPU
and not on the outgoing CPU. It therefore could not access the clockevent
device of the already offlined CPU and just set the state.
Since commit 3b1596a21fbf tick_shutdown() is called on the outgoing CPU, so
the hardware device can be accessed.
Remove the state set before calling clockevents_exchange_device(), so that
the subsequent clockevents_switch_state() handles the state transition and
invokes the shutdown callback of the clockevent device.
[ tglx: Massaged change log ]
Fixes: 3b1596a21fbf ("clockevents: Shutdown and unregister current clockevents at CPUHP_AP_TICK_DYING")
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Link: https://lore.kernel.org/all/20250906064952.3749122-2-maobibo@loongson.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/time/clockevents.c | 2 +-
kernel/time/tick-common.c | 16 +++++-----------
kernel/time/tick-internal.h | 2 +-
3 files changed, 7 insertions(+), 13 deletions(-)
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index f3e831f62906f..a59bc75ab7c5b 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -633,7 +633,7 @@ void tick_offline_cpu(unsigned int cpu)
raw_spin_lock(&clockevents_lock);
tick_broadcast_offline(cpu);
- tick_shutdown(cpu);
+ tick_shutdown();
/*
* Unregister the clock event devices which were
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index 9a3859443c042..7e33d3f2e889b 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -411,24 +411,18 @@ int tick_cpu_dying(unsigned int dying_cpu)
}
/*
- * Shutdown an event device on a given cpu:
+ * Shutdown an event device on the outgoing CPU:
*
- * This is called on a life CPU, when a CPU is dead. So we cannot
- * access the hardware device itself.
- * We just set the mode and remove it from the lists.
+ * Called by the dying CPU during teardown, with clockevents_lock held
+ * and interrupts disabled.
*/
-void tick_shutdown(unsigned int cpu)
+void tick_shutdown(void)
{
- struct tick_device *td = &per_cpu(tick_cpu_device, cpu);
+ struct tick_device *td = this_cpu_ptr(&tick_cpu_device);
struct clock_event_device *dev = td->evtdev;
td->mode = TICKDEV_MODE_PERIODIC;
if (dev) {
- /*
- * Prevent that the clock events layer tries to call
- * the set mode function!
- */
- clockevent_set_state(dev, CLOCK_EVT_STATE_DETACHED);
clockevents_exchange_device(dev, NULL);
dev->event_handler = clockevents_handle_noop;
td->evtdev = NULL;
diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
index faac36de35b9e..4e4f7bbe2a64b 100644
--- a/kernel/time/tick-internal.h
+++ b/kernel/time/tick-internal.h
@@ -26,7 +26,7 @@ extern void tick_setup_periodic(struct clock_event_device *dev, int broadcast);
extern void tick_handle_periodic(struct clock_event_device *dev);
extern void tick_check_new_device(struct clock_event_device *dev);
extern void tick_offline_cpu(unsigned int cpu);
-extern void tick_shutdown(unsigned int cpu);
+extern void tick_shutdown(void);
extern void tick_suspend(void);
extern void tick_resume(void);
extern bool tick_check_replacement(struct clock_event_device *curdev,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 111/563] arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 110/563] tick: Do not set device to detached state in tick_shutdown() Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 112/563] arm64: dts: mediatek: mt8183: Fix out of range pull values Greg Kroah-Hartman
` (465 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guoqing Jiang,
AngeloGioacchino Del Regno, Macpaul Lin, Matthias Brugger,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoqing Jiang <guoqing.jiang@canonical.com>
[ Upstream commit 3374b5fb26b300809ecd6aed9f414987dd17c313 ]
When test suspend resume with 6.8 based kernel, system can't resume
and I got below error which can be also reproduced with 6.16 rc6+
kernel.
mtk-pcie-gen3 112f0000.pcie: PCIe link down, current LTSSM state: detect.quiet (0x0)
mtk-pcie-gen3 112f0000.pcie: PM: dpm_run_callback(): genpd_resume_noirq returns -110
mtk-pcie-gen3 112f0000.pcie: PM: failed to resume noirq: error -110
After investigation, looks pcie0 has the same problem as pcie1 as
decribed in commit 3d7fdd8e38aa ("arm64: dts: mediatek: mt8195:
Remove suspend-breaking reset from pcie1").
Fixes: ecc0af6a3fe6 ("arm64: dts: mt8195: Add pcie and pcie phy nodes")
Signed-off-by: Guoqing Jiang <guoqing.jiang@canonical.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: Macpaul Lin <macpaul.lin@mediatek.com>
Link: https://lore.kernel.org/r/20250721095959.57703-1-guoqing.jiang@canonical.com
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/mediatek/mt8195.dtsi | 3 ---
1 file changed, 3 deletions(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
index 8877953ce292b..ab0b2f606eb43 100644
--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
@@ -1588,9 +1588,6 @@ pcie0: pcie@112f0000 {
power-domains = <&spm MT8195_POWER_DOMAIN_PCIE_MAC_P0>;
- resets = <&infracfg_ao MT8195_INFRA_RST2_PCIE_P0_SWRST>;
- reset-names = "mac";
-
#interrupt-cells = <1>;
interrupt-map-mask = <0 0 0 7>;
interrupt-map = <0 0 0 1 &pcie_intc0 0>,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 112/563] arm64: dts: mediatek: mt8183: Fix out of range pull values
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 111/563] arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 113/563] nbd: restrict sockets to TCP and UDP Greg Kroah-Hartman
` (464 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rob Herring (Arm),
AngeloGioacchino Del Regno, Matthias Brugger, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring (Arm) <robh@kernel.org>
[ Upstream commit 0aeb7ed4bcb244862a35f880053cd64d28c6fb04 ]
A value of 10 is not valid for "mediatek,pull-down-adv" and
"mediatek,pull-up-adv" properties which have defined values of 0-3. It
appears the "10" was written as a binary value. The driver only looks at
the lowest 2 bits, so the value "10" decimal works out the same as if
"2" was used.
Fixes: cd894e274b74 ("arm64: dts: mt8183: Add krane-sku176 board")
Fixes: 19b6403f1e2a ("arm64: dts: mt8183: add mt8183 pumpkin board")
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20250722171152.58923-2-robh@kernel.org
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 14 +++++++-------
arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts | 14 +++++++-------
2 files changed, 14 insertions(+), 14 deletions(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
index 400c61d110356..fff93e26eb760 100644
--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
@@ -580,7 +580,7 @@ pins-cmd-dat {
pins-clk {
pinmux = <PINMUX_GPIO124__FUNC_MSDC0_CLK>;
drive-strength = <MTK_DRIVE_14mA>;
- mediatek,pull-down-adv = <10>;
+ mediatek,pull-down-adv = <2>;
};
pins-rst {
@@ -609,13 +609,13 @@ pins-cmd-dat {
pins-clk {
pinmux = <PINMUX_GPIO124__FUNC_MSDC0_CLK>;
drive-strength = <MTK_DRIVE_14mA>;
- mediatek,pull-down-adv = <10>;
+ mediatek,pull-down-adv = <2>;
};
pins-ds {
pinmux = <PINMUX_GPIO131__FUNC_MSDC0_DSL>;
drive-strength = <MTK_DRIVE_14mA>;
- mediatek,pull-down-adv = <10>;
+ mediatek,pull-down-adv = <2>;
};
pins-rst {
@@ -633,13 +633,13 @@ pins-cmd-dat {
<PINMUX_GPIO33__FUNC_MSDC1_DAT2>,
<PINMUX_GPIO30__FUNC_MSDC1_DAT3>;
input-enable;
- mediatek,pull-up-adv = <10>;
+ mediatek,pull-up-adv = <2>;
};
pins-clk {
pinmux = <PINMUX_GPIO29__FUNC_MSDC1_CLK>;
input-enable;
- mediatek,pull-down-adv = <10>;
+ mediatek,pull-down-adv = <2>;
};
};
@@ -652,13 +652,13 @@ pins-cmd-dat {
<PINMUX_GPIO30__FUNC_MSDC1_DAT3>;
drive-strength = <6>;
input-enable;
- mediatek,pull-up-adv = <10>;
+ mediatek,pull-up-adv = <2>;
};
pins-clk {
pinmux = <PINMUX_GPIO29__FUNC_MSDC1_CLK>;
drive-strength = <8>;
- mediatek,pull-down-adv = <10>;
+ mediatek,pull-down-adv = <2>;
input-enable;
};
};
diff --git a/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts
index dbdee604edab4..7c3010889ae73 100644
--- a/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts
+++ b/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts
@@ -324,7 +324,7 @@ pins_cmd_dat {
pins_clk {
pinmux = <PINMUX_GPIO124__FUNC_MSDC0_CLK>;
drive-strength = <MTK_DRIVE_14mA>;
- mediatek,pull-down-adv = <10>;
+ mediatek,pull-down-adv = <2>;
};
pins_rst {
@@ -353,13 +353,13 @@ pins_cmd_dat {
pins_clk {
pinmux = <PINMUX_GPIO124__FUNC_MSDC0_CLK>;
drive-strength = <MTK_DRIVE_14mA>;
- mediatek,pull-down-adv = <10>;
+ mediatek,pull-down-adv = <2>;
};
pins_ds {
pinmux = <PINMUX_GPIO131__FUNC_MSDC0_DSL>;
drive-strength = <MTK_DRIVE_14mA>;
- mediatek,pull-down-adv = <10>;
+ mediatek,pull-down-adv = <2>;
};
pins_rst {
@@ -377,13 +377,13 @@ pins_cmd_dat {
<PINMUX_GPIO33__FUNC_MSDC1_DAT2>,
<PINMUX_GPIO30__FUNC_MSDC1_DAT3>;
input-enable;
- mediatek,pull-up-adv = <10>;
+ mediatek,pull-up-adv = <2>;
};
pins_clk {
pinmux = <PINMUX_GPIO29__FUNC_MSDC1_CLK>;
input-enable;
- mediatek,pull-down-adv = <10>;
+ mediatek,pull-down-adv = <2>;
};
pins_pmu {
@@ -401,13 +401,13 @@ pins_cmd_dat {
<PINMUX_GPIO30__FUNC_MSDC1_DAT3>;
drive-strength = <6>;
input-enable;
- mediatek,pull-up-adv = <10>;
+ mediatek,pull-up-adv = <2>;
};
pins_clk {
pinmux = <PINMUX_GPIO29__FUNC_MSDC1_CLK>;
drive-strength = <8>;
- mediatek,pull-down-adv = <10>;
+ mediatek,pull-down-adv = <2>;
input-enable;
};
};
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 113/563] nbd: restrict sockets to TCP and UDP
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 112/563] arm64: dts: mediatek: mt8183: Fix out of range pull values Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 114/563] PM / devfreq: rockchip-dfi: double count on RK3588 Greg Kroah-Hartman
` (463 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+e1cd6bd8493060bd701d,
Eric Dumazet, Mike Christie, Richard W.M. Jones, Jens Axboe,
Yu Kuai, linux-block, nbd, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 9f7c02e031570e8291a63162c6c046dc15ff85b0 ]
Recently, syzbot started to abuse NBD with all kinds of sockets.
Commit cf1b2326b734 ("nbd: verify socket is supported during setup")
made sure the socket supported a shutdown() method.
Explicitely accept TCP and UNIX stream sockets.
Fixes: cf1b2326b734 ("nbd: verify socket is supported during setup")
Reported-by: syzbot+e1cd6bd8493060bd701d@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/CANn89iJ+76eE3A_8S_zTpSyW5hvPRn6V57458hCZGY5hbH_bFA@mail.gmail.com/T/#m081036e8747cd7e2626c1da5d78c8b9d1e55b154
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Mike Christie <mchristi@redhat.com>
Cc: Richard W.M. Jones <rjones@redhat.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Yu Kuai <yukuai1@huaweicloud.com>
Cc: linux-block@vger.kernel.org
Cc: nbd@other.debian.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/nbd.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 6463d0e8d0cef..87b0b78249da3 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1217,6 +1217,14 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd,
if (!sock)
return NULL;
+ if (!sk_is_tcp(sock->sk) &&
+ !sk_is_stream_unix(sock->sk)) {
+ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: should be TCP or UNIX.\n");
+ *err = -EINVAL;
+ sockfd_put(sock);
+ return NULL;
+ }
+
if (sock->ops->shutdown == sock_no_shutdown) {
dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n");
*err = -EINVAL;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 114/563] PM / devfreq: rockchip-dfi: double count on RK3588
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 113/563] nbd: restrict sockets to TCP and UDP Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 115/563] firmware: firmware: meson-sm: fix compile-test default Greg Kroah-Hartman
` (462 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Frattaroli, Chanwoo Choi,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
[ Upstream commit f89c7fb83ae95578e355bed1a7aeea5f3ca5a067 ]
On RK3588 with LPDDR4X memory, the cycle count as returned by
perf stat -a -e rockchip_ddr/cycles/ sleep 1
consistently reads half as much as what the actual DDR frequency is at.
For a LPDDR4X module running at 2112MHz, I get more like 1056059916
cycles per second, which is almost bang-on half what it should be. No,
I'm not mixing up megatransfers and megahertz.
Consulting the downstream driver, this appears to be because the RK3588
hardware specifically (and RK3528 as well, for future reference) needs a
multiplier of 2 to get to the correct frequency with everything but
LPDDR5.
The RK3588's actual memory bandwidth measurements in MB/s are correct
however, as confirmed with stress-ng --stream. This makes me think the
access counters are not affected in the same way. This tracks with the
vendor kernel not multiplying the access counts either.
Solve this by adding a new member to the dfi struct, which each SoC can
set to whatever they want, but defaults to 1 if left unset by the SoC
init functions. The event_get_count op can then use this multiplier if
the cycle count is requested.
The cycle multiplier is not used in rockchip_dfi_get_event because the
vendor driver doesn't use it there either, and we don't do other actual
bandwidth unit conversion stuff in there anyway.
Fixes: 481d97ba61e1 ("PM / devfreq: rockchip-dfi: add support for RK3588")
Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Link: https://lore.kernel.org/lkml/20250530-rk3588-dfi-improvements-v1-1-6e077c243a95@collabora.com/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/devfreq/event/rockchip-dfi.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/devfreq/event/rockchip-dfi.c b/drivers/devfreq/event/rockchip-dfi.c
index 0470d7c175f4f..54effb6351965 100644
--- a/drivers/devfreq/event/rockchip-dfi.c
+++ b/drivers/devfreq/event/rockchip-dfi.c
@@ -116,6 +116,7 @@ struct rockchip_dfi {
int buswidth[DMC_MAX_CHANNELS];
int ddrmon_stride;
bool ddrmon_ctrl_single;
+ unsigned int count_multiplier; /* number of data clocks per count */
};
static int rockchip_dfi_enable(struct rockchip_dfi *dfi)
@@ -435,7 +436,7 @@ static u64 rockchip_ddr_perf_event_get_count(struct perf_event *event)
switch (event->attr.config) {
case PERF_EVENT_CYCLES:
- count = total.c[0].clock_cycles;
+ count = total.c[0].clock_cycles * dfi->count_multiplier;
break;
case PERF_EVENT_READ_BYTES:
for (i = 0; i < dfi->max_channels; i++)
@@ -655,6 +656,9 @@ static int rockchip_ddr_perf_init(struct rockchip_dfi *dfi)
break;
}
+ if (!dfi->count_multiplier)
+ dfi->count_multiplier = 1;
+
ret = perf_pmu_register(pmu, "rockchip_ddr", -1);
if (ret)
return ret;
@@ -751,6 +755,7 @@ static int rk3588_dfi_init(struct rockchip_dfi *dfi)
dfi->max_channels = 4;
dfi->ddrmon_stride = 0x4000;
+ dfi->count_multiplier = 2;
return 0;
};
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 115/563] firmware: firmware: meson-sm: fix compile-test default
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 114/563] PM / devfreq: rockchip-dfi: double count on RK3588 Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 116/563] dts: arm: amlogic: fix pwm node for c3 Greg Kroah-Hartman
` (461 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Neil Armstrong,
Martin Blumenstingl, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 0454346d1c5f7fccb3ef6e3103985de8ab3469f3 ]
Enabling compile testing should not enable every individual driver (we
have "allyesconfig" for that).
Fixes: 4a434abc40d2 ("firmware: meson-sm: enable build as module")
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Link: https://lore.kernel.org/r/20250725075429.10056-1-johan@kernel.org
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/meson/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/firmware/meson/Kconfig b/drivers/firmware/meson/Kconfig
index f2fdd37566482..179f5d46d8ddf 100644
--- a/drivers/firmware/meson/Kconfig
+++ b/drivers/firmware/meson/Kconfig
@@ -5,7 +5,7 @@
config MESON_SM
tristate "Amlogic Secure Monitor driver"
depends on ARCH_MESON || COMPILE_TEST
- default y
+ default ARCH_MESON
depends on ARM64_4K_PAGES
help
Say y here to enable the Amlogic secure monitor driver
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 116/563] dts: arm: amlogic: fix pwm node for c3
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 115/563] firmware: firmware: meson-sm: fix compile-test default Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 117/563] soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure Greg Kroah-Hartman
` (460 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xianwei Zhao, Martin Blumenstingl,
Neil Armstrong, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xianwei Zhao <xianwei.zhao@amlogic.com>
[ Upstream commit f8c9fabf2f3d87773613734a8479d0ef9b662b11 ]
Fix reg address for c3 pwm node.
Fixes: be90cd4bd422 ("arm64: dts: amlogic: Add Amlogic C3 PWM")
Signed-off-by: Xianwei Zhao <xianwei.zhao@amlogic.com>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Link: https://lore.kernel.org/r/20250717-fix-pwm-node-v2-1-7365ac7d5320@amlogic.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi b/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi
index cb9ea3ca6ee0f..71b2b3b547f7c 100644
--- a/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi
+++ b/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi
@@ -792,7 +792,7 @@ spicc1: spi@52000 {
pwm_mn: pwm@54000 {
compatible = "amlogic,c3-pwm",
"amlogic,meson-s4-pwm";
- reg = <0x0 54000 0x0 0x24>;
+ reg = <0x0 0x54000 0x0 0x24>;
clocks = <&clkc_periphs CLKID_PWM_M>,
<&clkc_periphs CLKID_PWM_N>;
#pwm-cells = <3>;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 117/563] soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 116/563] dts: arm: amlogic: fix pwm node for c3 Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 118/563] soc: mediatek: mtk-svs: fix device leaks on mt8192 " Greg Kroah-Hartman
` (459 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Roger Lu, Johan Hovold,
AngeloGioacchino Del Regno, Matthias Brugger, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 6ab4f79ea92324f7f2eb22692054a34bbba7cf35 ]
Make sure to drop the references taken by of_find_device_by_node() when
looking up the thermal sensor and opp devices during probe on probe
failure (e.g. probe deferral) and on driver unbind.
Fixes: 681a02e95000 ("soc: mediatek: SVS: introduce MTK SVS engine")
Cc: Roger Lu <roger.lu@mediatek.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20250909095651.5530-2-johan@kernel.org
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/mediatek/mtk-svs.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c
index 7c349a94b45c0..48804e1e5a6c8 100644
--- a/drivers/soc/mediatek/mtk-svs.c
+++ b/drivers/soc/mediatek/mtk-svs.c
@@ -2165,6 +2165,13 @@ static struct device *svs_add_device_link(struct svs_platform *svsp,
return dev;
}
+static void svs_put_device(void *_dev)
+{
+ struct device *dev = _dev;
+
+ put_device(dev);
+}
+
static int svs_mt8192_platform_probe(struct svs_platform *svsp)
{
struct device *dev;
@@ -2216,11 +2223,13 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
{
struct device *dev;
u32 idx;
+ int ret;
dev = svs_add_device_link(svsp, "thermal-sensor");
if (IS_ERR(dev))
return dev_err_probe(svsp->dev, PTR_ERR(dev),
"failed to get thermal device\n");
+ put_device(dev);
for (idx = 0; idx < svsp->bank_max; idx++) {
struct svs_bank *svsb = &svsp->banks[idx];
@@ -2230,6 +2239,7 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
case SVSB_SWID_CPU_LITTLE:
case SVSB_SWID_CPU_BIG:
svsb->opp_dev = get_cpu_device(bdata->cpu_id);
+ get_device(svsb->opp_dev);
break;
case SVSB_SWID_CCI:
svsb->opp_dev = svs_add_device_link(svsp, "cci");
@@ -2246,6 +2256,11 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev),
"failed to get OPP device for bank %d\n",
idx);
+
+ ret = devm_add_action_or_reset(svsp->dev, svs_put_device,
+ svsb->opp_dev);
+ if (ret)
+ return ret;
}
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 118/563] soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 117/563] soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 119/563] cpuidle: qcom-spm: fix device and OF node leaks at probe Greg Kroah-Hartman
` (458 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Roger Lu, Johan Hovold,
AngeloGioacchino Del Regno, Matthias Brugger, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit f1a68ba5739e42353609438e27a83b08d7f5cfd6 ]
Make sure to drop the references taken by of_find_device_by_node() when
looking up the thermal sensor and opp devices during probe on probe
failure (e.g. probe deferral) and on driver unbind.
Fixes: 0bbb09b2af9d ("soc: mediatek: SVS: add mt8192 SVS GPU driver")
Cc: Roger Lu <roger.lu@mediatek.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20250909095651.5530-3-johan@kernel.org
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/mediatek/mtk-svs.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c
index 48804e1e5a6c8..f45537546553e 100644
--- a/drivers/soc/mediatek/mtk-svs.c
+++ b/drivers/soc/mediatek/mtk-svs.c
@@ -2176,6 +2176,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
{
struct device *dev;
u32 idx;
+ int ret;
svsp->rst = devm_reset_control_get_optional(svsp->dev, "svs_rst");
if (IS_ERR(svsp->rst))
@@ -2186,6 +2187,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
if (IS_ERR(dev))
return dev_err_probe(svsp->dev, PTR_ERR(dev),
"failed to get lvts device\n");
+ put_device(dev);
for (idx = 0; idx < svsp->bank_max; idx++) {
struct svs_bank *svsb = &svsp->banks[idx];
@@ -2195,6 +2197,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
case SVSB_SWID_CPU_LITTLE:
case SVSB_SWID_CPU_BIG:
svsb->opp_dev = get_cpu_device(bdata->cpu_id);
+ get_device(svsb->opp_dev);
break;
case SVSB_SWID_CCI:
svsb->opp_dev = svs_add_device_link(svsp, "cci");
@@ -2214,6 +2217,11 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev),
"failed to get OPP device for bank %d\n",
idx);
+
+ ret = devm_add_action_or_reset(svsp->dev, svs_put_device,
+ svsb->opp_dev);
+ if (ret)
+ return ret;
}
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 119/563] cpuidle: qcom-spm: fix device and OF node leaks at probe
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 118/563] soc: mediatek: mtk-svs: fix device leaks on mt8192 " Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 120/563] block: cleanup bio_issue Greg Kroah-Hartman
` (457 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Konrad Dybcio,
Rafael J. Wysocki, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit cdc06f912670c8c199d5fa9e78b64b7ed8e871d0 ]
Make sure to drop the reference to the saw device taken by
of_find_device_by_node() after retrieving its driver data during
probe().
Also drop the reference to the CPU node sooner to avoid leaking it in
case there is no saw node or device.
Fixes: 60f3692b5f0b ("cpuidle: qcom_spm: Detach state machine from main SPM handling")
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpuidle/cpuidle-qcom-spm.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/cpuidle/cpuidle-qcom-spm.c b/drivers/cpuidle/cpuidle-qcom-spm.c
index 5f386761b1562..f60a4cf536423 100644
--- a/drivers/cpuidle/cpuidle-qcom-spm.c
+++ b/drivers/cpuidle/cpuidle-qcom-spm.c
@@ -96,20 +96,23 @@ static int spm_cpuidle_register(struct device *cpuidle_dev, int cpu)
return -ENODEV;
saw_node = of_parse_phandle(cpu_node, "qcom,saw", 0);
+ of_node_put(cpu_node);
if (!saw_node)
return -ENODEV;
pdev = of_find_device_by_node(saw_node);
of_node_put(saw_node);
- of_node_put(cpu_node);
if (!pdev)
return -ENODEV;
data = devm_kzalloc(cpuidle_dev, sizeof(*data), GFP_KERNEL);
- if (!data)
+ if (!data) {
+ put_device(&pdev->dev);
return -ENOMEM;
+ }
data->spm = dev_get_drvdata(&pdev->dev);
+ put_device(&pdev->dev);
if (!data->spm)
return -EINVAL;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 120/563] block: cleanup bio_issue
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 119/563] cpuidle: qcom-spm: fix device and OF node leaks at probe Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 121/563] block: initialize bio issue time in blk_mq_submit_bio() Greg Kroah-Hartman
` (456 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yu Kuai, Christoph Hellwig,
Jens Axboe, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit 1733e88874838ddebf7774440c285700865e6b08 ]
Now that bio->bi_issue is only used by blk-iolatency to get bio issue
time, replace bio_issue with u64 time directly and remove bio_issue to
make code cleaner.
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Stable-dep-of: 1f963bdd6420 ("block: initialize bio issue time in blk_mq_submit_bio()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/bio.c | 2 +-
block/blk-cgroup.h | 2 +-
block/blk-iolatency.c | 14 +++----------
block/blk.h | 42 ---------------------------------------
include/linux/blk_types.h | 7 ++-----
5 files changed, 7 insertions(+), 60 deletions(-)
diff --git a/block/bio.c b/block/bio.c
index 3b371a5da159e..1904683f7ab05 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -261,7 +261,7 @@ void bio_init(struct bio *bio, struct block_device *bdev, struct bio_vec *table,
bio->bi_private = NULL;
#ifdef CONFIG_BLK_CGROUP
bio->bi_blkg = NULL;
- bio->bi_issue.value = 0;
+ bio->issue_time_ns = 0;
if (bdev)
bio_associate_blkg(bio);
#ifdef CONFIG_BLK_CGROUP_IOCOST
diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
index 83367086cb6ae..8328427e31657 100644
--- a/block/blk-cgroup.h
+++ b/block/blk-cgroup.h
@@ -372,7 +372,7 @@ static inline void blkg_put(struct blkcg_gq *blkg)
static inline void blkcg_bio_issue_init(struct bio *bio)
{
- bio_issue_init(&bio->bi_issue, bio_sectors(bio));
+ bio->issue_time_ns = blk_time_get_ns();
}
static inline void blkcg_use_delay(struct blkcg_gq *blkg)
diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c
index 2f8fdecdd7a9b..554b191a68921 100644
--- a/block/blk-iolatency.c
+++ b/block/blk-iolatency.c
@@ -485,19 +485,11 @@ static void blkcg_iolatency_throttle(struct rq_qos *rqos, struct bio *bio)
mod_timer(&blkiolat->timer, jiffies + HZ);
}
-static void iolatency_record_time(struct iolatency_grp *iolat,
- struct bio_issue *issue, u64 now,
- bool issue_as_root)
+static void iolatency_record_time(struct iolatency_grp *iolat, u64 start,
+ u64 now, bool issue_as_root)
{
- u64 start = bio_issue_time(issue);
u64 req_time;
- /*
- * Have to do this so we are truncated to the correct time that our
- * issue is truncated to.
- */
- now = __bio_issue_time(now);
-
if (now <= start)
return;
@@ -625,7 +617,7 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio)
* submitted, so do not account for it.
*/
if (iolat->min_lat_nsec && bio->bi_status != BLK_STS_AGAIN) {
- iolatency_record_time(iolat, &bio->bi_issue, now,
+ iolatency_record_time(iolat, bio->issue_time_ns, now,
issue_as_root);
window_start = atomic64_read(&iolat->window_start);
if (now > window_start &&
diff --git a/block/blk.h b/block/blk.h
index 46f566f9b1266..0268deb222688 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -680,48 +680,6 @@ static inline ktime_t blk_time_get(void)
return ns_to_ktime(blk_time_get_ns());
}
-/*
- * From most significant bit:
- * 1 bit: reserved for other usage, see below
- * 12 bits: original size of bio
- * 51 bits: issue time of bio
- */
-#define BIO_ISSUE_RES_BITS 1
-#define BIO_ISSUE_SIZE_BITS 12
-#define BIO_ISSUE_RES_SHIFT (64 - BIO_ISSUE_RES_BITS)
-#define BIO_ISSUE_SIZE_SHIFT (BIO_ISSUE_RES_SHIFT - BIO_ISSUE_SIZE_BITS)
-#define BIO_ISSUE_TIME_MASK ((1ULL << BIO_ISSUE_SIZE_SHIFT) - 1)
-#define BIO_ISSUE_SIZE_MASK \
- (((1ULL << BIO_ISSUE_SIZE_BITS) - 1) << BIO_ISSUE_SIZE_SHIFT)
-#define BIO_ISSUE_RES_MASK (~((1ULL << BIO_ISSUE_RES_SHIFT) - 1))
-
-/* Reserved bit for blk-throtl */
-#define BIO_ISSUE_THROTL_SKIP_LATENCY (1ULL << 63)
-
-static inline u64 __bio_issue_time(u64 time)
-{
- return time & BIO_ISSUE_TIME_MASK;
-}
-
-static inline u64 bio_issue_time(struct bio_issue *issue)
-{
- return __bio_issue_time(issue->value);
-}
-
-static inline sector_t bio_issue_size(struct bio_issue *issue)
-{
- return ((issue->value & BIO_ISSUE_SIZE_MASK) >> BIO_ISSUE_SIZE_SHIFT);
-}
-
-static inline void bio_issue_init(struct bio_issue *issue,
- sector_t size)
-{
- size &= (1ULL << BIO_ISSUE_SIZE_BITS) - 1;
- issue->value = ((issue->value & BIO_ISSUE_RES_MASK) |
- (blk_time_get_ns() & BIO_ISSUE_TIME_MASK) |
- ((u64)size << BIO_ISSUE_SIZE_SHIFT));
-}
-
void bdev_release(struct file *bdev_file);
int bdev_open(struct block_device *bdev, blk_mode_t mode, void *holder,
const struct blk_holder_ops *hops, struct file *bdev_file);
diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
index 09b99d52fd365..f78145be77df5 100644
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -198,10 +198,6 @@ static inline bool blk_path_error(blk_status_t error)
return true;
}
-struct bio_issue {
- u64 value;
-};
-
typedef __u32 __bitwise blk_opf_t;
typedef unsigned int blk_qc_t;
@@ -242,7 +238,8 @@ struct bio {
* on release of the bio.
*/
struct blkcg_gq *bi_blkg;
- struct bio_issue bi_issue;
+ /* Time that this bio was issued. */
+ u64 issue_time_ns;
#ifdef CONFIG_BLK_CGROUP_IOCOST
u64 bi_iocost_cost;
#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 121/563] block: initialize bio issue time in blk_mq_submit_bio()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 120/563] block: cleanup bio_issue Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 122/563] block: factor out a helper bio_submit_split_bioset() Greg Kroah-Hartman
` (455 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yu Kuai, Jens Axboe, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit 1f963bdd6420b6080bcfd0ee84a75c96f35545a6 ]
bio->issue_time_ns is only used by blk-iolatency, which can only be
enabled for rq-based disk, hence it's not necessary to initialize
the time for bio-based disk.
Meanwhile, if bio is split by blk_crypto_fallback_split_bio_if_needed(),
the issue time is not initialized for new split bio, this can be fixed
as well.
Noted the next patch will optimize better that bio issue time will
only be used when blk-iolatency is really enabled by the disk.
Fixes: 488f6682c832 ("block: blk-crypto-fallback for Inline Encryption")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-cgroup.h | 6 ------
block/blk-core.c | 1 -
block/blk-merge.c | 1 -
block/blk-mq.c | 8 ++++++++
4 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
index 8328427e31657..1cce3294634d1 100644
--- a/block/blk-cgroup.h
+++ b/block/blk-cgroup.h
@@ -370,11 +370,6 @@ static inline void blkg_put(struct blkcg_gq *blkg)
if (((d_blkg) = blkg_lookup(css_to_blkcg(pos_css), \
(p_blkg)->q)))
-static inline void blkcg_bio_issue_init(struct bio *bio)
-{
- bio->issue_time_ns = blk_time_get_ns();
-}
-
static inline void blkcg_use_delay(struct blkcg_gq *blkg)
{
if (WARN_ON_ONCE(atomic_read(&blkg->use_delay) < 0))
@@ -497,7 +492,6 @@ static inline struct blkg_policy_data *blkg_to_pd(struct blkcg_gq *blkg,
static inline struct blkcg_gq *pd_to_blkg(struct blkg_policy_data *pd) { return NULL; }
static inline void blkg_get(struct blkcg_gq *blkg) { }
static inline void blkg_put(struct blkcg_gq *blkg) { }
-static inline void blkcg_bio_issue_init(struct bio *bio) { }
static inline void blk_cgroup_bio_start(struct bio *bio) { }
static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio) { return true; }
diff --git a/block/blk-core.c b/block/blk-core.c
index a27185cd8edea..e5af6eda5a459 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -730,7 +730,6 @@ static void __submit_bio_noacct_mq(struct bio *bio)
void submit_bio_noacct_nocheck(struct bio *bio)
{
blk_cgroup_bio_start(bio);
- blkcg_bio_issue_init(bio);
if (!bio_flagged(bio, BIO_TRACE_COMPLETION)) {
trace_block_bio_queue(bio);
diff --git a/block/blk-merge.c b/block/blk-merge.c
index 70d704615be52..5538356770a47 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -119,7 +119,6 @@ static struct bio *bio_submit_split(struct bio *bio, int split_sectors)
goto error;
}
split->bi_opf |= REQ_NOMERGE;
- blkcg_bio_issue_init(split);
bio_chain(split, bio);
trace_block_split(split, bio->bi_iter.bi_sector);
WARN_ON_ONCE(bio_zone_write_plugging(bio));
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 9055cd6247004..19b50110376c6 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -396,6 +396,13 @@ static inline void blk_mq_rq_time_init(struct request *rq, u64 alloc_time_ns)
#endif
}
+static inline void blk_mq_bio_issue_init(struct bio *bio)
+{
+#ifdef CONFIG_BLK_CGROUP
+ bio->issue_time_ns = blk_time_get_ns();
+#endif
+}
+
static struct request *blk_mq_rq_ctx_init(struct blk_mq_alloc_data *data,
struct blk_mq_tags *tags, unsigned int tag)
{
@@ -3168,6 +3175,7 @@ void blk_mq_submit_bio(struct bio *bio)
if (!bio_integrity_prep(bio))
goto queue_exit;
+ blk_mq_bio_issue_init(bio);
if (blk_mq_attempt_bio_merge(q, bio, nr_segs))
goto queue_exit;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 122/563] block: factor out a helper bio_submit_split_bioset()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 121/563] block: initialize bio issue time in blk_mq_submit_bio() Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 123/563] block: skip unnecessary checks for split bio Greg Kroah-Hartman
` (454 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yu Kuai, Bart Van Assche,
Christoph Hellwig, Jens Axboe, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit e37b5596a19be9a150cb194ec32e78f295a3574b ]
No functional changes are intended, some drivers like mdraid will split
bio by internal processing, prepare to unify bio split codes.
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Stable-dep-of: b2f5974079d8 ("block: fix ordering of recursive split IO")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-merge.c | 59 ++++++++++++++++++++++++++++--------------
include/linux/blkdev.h | 2 ++
2 files changed, 42 insertions(+), 19 deletions(-)
diff --git a/block/blk-merge.c b/block/blk-merge.c
index 5538356770a47..51fe4ed5b7c0b 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -104,33 +104,54 @@ static unsigned int bio_allowed_max_sectors(const struct queue_limits *lim)
return round_down(UINT_MAX, lim->logical_block_size) >> SECTOR_SHIFT;
}
+/*
+ * bio_submit_split_bioset - Submit a bio, splitting it at a designated sector
+ * @bio: the original bio to be submitted and split
+ * @split_sectors: the sector count at which to split
+ * @bs: the bio set used for allocating the new split bio
+ *
+ * The original bio is modified to contain the remaining sectors and submitted.
+ * The caller is responsible for submitting the returned bio.
+ *
+ * If succeed, the newly allocated bio representing the initial part will be
+ * returned, on failure NULL will be returned and original bio will fail.
+ */
+struct bio *bio_submit_split_bioset(struct bio *bio, unsigned int split_sectors,
+ struct bio_set *bs)
+{
+ struct bio *split = bio_split(bio, split_sectors, GFP_NOIO, bs);
+
+ if (IS_ERR(split)) {
+ bio->bi_status = errno_to_blk_status(PTR_ERR(split));
+ bio_endio(bio);
+ return NULL;
+ }
+
+ bio_chain(split, bio);
+ trace_block_split(split, bio->bi_iter.bi_sector);
+ WARN_ON_ONCE(bio_zone_write_plugging(bio));
+ submit_bio_noacct(bio);
+
+ return split;
+}
+EXPORT_SYMBOL_GPL(bio_submit_split_bioset);
+
static struct bio *bio_submit_split(struct bio *bio, int split_sectors)
{
- if (unlikely(split_sectors < 0))
- goto error;
+ if (unlikely(split_sectors < 0)) {
+ bio->bi_status = errno_to_blk_status(split_sectors);
+ bio_endio(bio);
+ return NULL;
+ }
if (split_sectors) {
- struct bio *split;
-
- split = bio_split(bio, split_sectors, GFP_NOIO,
+ bio = bio_submit_split_bioset(bio, split_sectors,
&bio->bi_bdev->bd_disk->bio_split);
- if (IS_ERR(split)) {
- split_sectors = PTR_ERR(split);
- goto error;
- }
- split->bi_opf |= REQ_NOMERGE;
- bio_chain(split, bio);
- trace_block_split(split, bio->bi_iter.bi_sector);
- WARN_ON_ONCE(bio_zone_write_plugging(bio));
- submit_bio_noacct(bio);
- return split;
+ if (bio)
+ bio->bi_opf |= REQ_NOMERGE;
}
return bio;
-error:
- bio->bi_status = errno_to_blk_status(split_sectors);
- bio_endio(bio);
- return NULL;
}
struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim,
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index fe1797bbec420..cc221318712e7 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -999,6 +999,8 @@ extern int blk_register_queue(struct gendisk *disk);
extern void blk_unregister_queue(struct gendisk *disk);
void submit_bio_noacct(struct bio *bio);
struct bio *bio_split_to_limits(struct bio *bio);
+struct bio *bio_submit_split_bioset(struct bio *bio, unsigned int split_sectors,
+ struct bio_set *bs);
extern int blk_lld_busy(struct request_queue *q);
extern int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 123/563] block: skip unnecessary checks for split bio
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 122/563] block: factor out a helper bio_submit_split_bioset() Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 124/563] block: fix ordering of recursive split IO Greg Kroah-Hartman
` (453 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yu Kuai, Christoph Hellwig,
Jens Axboe, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit 0b64682e78f7a53ea863e368b1aa66f05767858d ]
Lots of checks are already done while submitting this bio the first
time, and there is no need to check them again when this bio is
resubmitted after split.
Hence open code should_fail_bio() and blk_throtl_bio() that are still
necessary from submit_bio_split_bioset().
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Stable-dep-of: b2f5974079d8 ("block: fix ordering of recursive split IO")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-core.c | 2 +-
block/blk-merge.c | 6 +++++-
block/blk.h | 1 +
3 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/block/blk-core.c b/block/blk-core.c
index e5af6eda5a459..03a5d4c9cbf72 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -539,7 +539,7 @@ static inline void bio_check_ro(struct bio *bio)
}
}
-static noinline int should_fail_bio(struct bio *bio)
+int should_fail_bio(struct bio *bio)
{
if (should_fail_request(bdev_whole(bio->bi_bdev), bio->bi_iter.bi_size))
return -EIO;
diff --git a/block/blk-merge.c b/block/blk-merge.c
index 51fe4ed5b7c0b..c411045fcf03a 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -130,7 +130,11 @@ struct bio *bio_submit_split_bioset(struct bio *bio, unsigned int split_sectors,
bio_chain(split, bio);
trace_block_split(split, bio->bi_iter.bi_sector);
WARN_ON_ONCE(bio_zone_write_plugging(bio));
- submit_bio_noacct(bio);
+
+ if (should_fail_bio(bio))
+ bio_io_error(bio);
+ else if (!blk_throtl_bio(bio))
+ submit_bio_noacct_nocheck(bio);
return split;
}
diff --git a/block/blk.h b/block/blk.h
index 0268deb222688..18cc3c2afdd4d 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -615,6 +615,7 @@ extern const struct address_space_operations def_blk_aops;
int disk_register_independent_access_ranges(struct gendisk *disk);
void disk_unregister_independent_access_ranges(struct gendisk *disk);
+int should_fail_bio(struct bio *bio);
#ifdef CONFIG_FAIL_MAKE_REQUEST
bool should_fail_request(struct block_device *part, unsigned int bytes);
#else /* CONFIG_FAIL_MAKE_REQUEST */
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 124/563] block: fix ordering of recursive split IO
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 123/563] block: skip unnecessary checks for split bio Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 125/563] blk-mq: remove useless checkings in blk_mq_update_nr_requests() Greg Kroah-Hartman
` (452 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tie Ren, Yu Kuai, Bart Van Assche,
Christoph Hellwig, Jens Axboe, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit b2f5974079d82a4761f002e80601064d4e39a81f ]
Currently, split bio will be chained to original bio, and original bio
will be resubmitted to the tail of current->bio_list, waiting for
split bio to be issued. However, if split bio get split again, the IO
order will be messed up. This problem, on the one hand, will cause
performance degradation, especially for mdraid with large IO size; on
the other hand, will cause write errors for zoned block devices[1].
For example, in raid456 IO will first be split by max_sector from
md_submit_bio(), and then later be split again by chunksize for internal
handling:
For example, assume max_sectors is 1M, and chunksize is 512k
1) issue a 2M IO:
bio issuing: 0+2M
current->bio_list: NULL
2) md_submit_bio() split by max_sector:
bio issuing: 0+1M
current->bio_list: 1M+1M
3) chunk_aligned_read() split by chunksize:
bio issuing: 0+512k
current->bio_list: 1M+1M -> 512k+512k
4) after first bio issued, __submit_bio_noacct() will contuine issuing
next bio:
bio issuing: 1M+1M
current->bio_list: 512k+512k
bio issued: 0+512k
5) chunk_aligned_read() split by chunksize:
bio issuing: 1M+512k
current->bio_list: 512k+512k -> 1536k+512k
bio issued: 0+512k
6) no split afterwards, finally the issue order is:
0+512k -> 1M+512k -> 512k+512k -> 1536k+512k
This behaviour will cause large IO read on raid456 endup to be small
discontinuous IO in underlying disks. Fix this problem by placing split
bio to the head of current->bio_list.
Test script: test on 8 disk raid5 with 64k chunksize
dd if=/dev/md0 of=/dev/null bs=4480k iflag=direct
Test results:
Before this patch
1) iostat results:
Device r/s rMB/s rrqm/s %rrqm r_await rareq-sz aqu-sz %util
md0 52430.00 3276.87 0.00 0.00 0.62 64.00 32.60 80.10
sd* 4487.00 409.00 2054.00 31.40 0.82 93.34 3.68 71.20
2) blktrace G stage:
8,0 0 486445 11.357392936 843 G R 14071424 + 128 [dd]
8,0 0 486451 11.357466360 843 G R 14071168 + 128 [dd]
8,0 0 486454 11.357515868 843 G R 14071296 + 128 [dd]
8,0 0 486468 11.357968099 843 G R 14072192 + 128 [dd]
8,0 0 486474 11.358031320 843 G R 14071936 + 128 [dd]
8,0 0 486480 11.358096298 843 G R 14071552 + 128 [dd]
8,0 0 486490 11.358303858 843 G R 14071808 + 128 [dd]
3) io seek for sdx:
Noted io seek is the result from blktrace D stage, statistic of:
ABS((offset of next IO) - (offset + len of previous IO))
Read|Write seek
cnt 55175, zero cnt 25079
>=(KB) .. <(KB) : count ratio |distribution |
0 .. 1 : 25079 45.5% |########################################|
1 .. 2 : 0 0.0% | |
2 .. 4 : 0 0.0% | |
4 .. 8 : 0 0.0% | |
8 .. 16 : 0 0.0% | |
16 .. 32 : 0 0.0% | |
32 .. 64 : 12540 22.7% |##################### |
64 .. 128 : 2508 4.5% |##### |
128 .. 256 : 0 0.0% | |
256 .. 512 : 10032 18.2% |################# |
512 .. 1024 : 5016 9.1% |######### |
After this patch:
1) iostat results:
Device r/s rMB/s rrqm/s %rrqm r_await rareq-sz aqu-sz %util
md0 87965.00 5271.88 0.00 0.00 0.16 61.37 14.03 90.60
sd* 6020.00 658.44 5117.00 45.95 0.44 112.00 2.68 86.50
2) blktrace G stage:
8,0 0 206296 5.354894072 664 G R 7156992 + 128 [dd]
8,0 0 206305 5.355018179 664 G R 7157248 + 128 [dd]
8,0 0 206316 5.355204438 664 G R 7157504 + 128 [dd]
8,0 0 206319 5.355241048 664 G R 7157760 + 128 [dd]
8,0 0 206333 5.355500923 664 G R 7158016 + 128 [dd]
8,0 0 206344 5.355837806 664 G R 7158272 + 128 [dd]
8,0 0 206353 5.355960395 664 G R 7158528 + 128 [dd]
8,0 0 206357 5.356020772 664 G R 7158784 + 128 [dd]
3) io seek for sdx
Read|Write seek
cnt 28644, zero cnt 21483
>=(KB) .. <(KB) : count ratio |distribution |
0 .. 1 : 21483 75.0% |########################################|
1 .. 2 : 0 0.0% | |
2 .. 4 : 0 0.0% | |
4 .. 8 : 0 0.0% | |
8 .. 16 : 0 0.0% | |
16 .. 32 : 0 0.0% | |
32 .. 64 : 7161 25.0% |############## |
BTW, this looks like a long term problem from day one, and large
sequential IO read is pretty common case like video playing.
And even with this patch, in this test case IO is merged to at most 128k
is due to block layer plug limit BLK_PLUG_FLUSH_SIZE, increase such
limit can get even better performance. However, we'll figure out how to do
this properly later.
[1] https://lore.kernel.org/all/e40b076d-583d-406b-b223-005910a9f46f@acm.org/
Fixes: d89d87965dcb ("When stacked block devices are in-use (e.g. md or dm), the recursive calls")
Reported-by: Tie Ren <tieren@fnnas.com>
Closes: https://lore.kernel.org/all/7dro5o7u5t64d6bgiansesjavxcuvkq5p2pok7dtwkav7b7ape@3isfr44b6352/
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-core.c | 16 ++++++++++------
block/blk-merge.c | 2 +-
block/blk-throttle.c | 2 +-
block/blk.h | 2 +-
4 files changed, 13 insertions(+), 9 deletions(-)
diff --git a/block/blk-core.c b/block/blk-core.c
index 03a5d4c9cbf72..14ae73eebe0d7 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -727,7 +727,7 @@ static void __submit_bio_noacct_mq(struct bio *bio)
current->bio_list = NULL;
}
-void submit_bio_noacct_nocheck(struct bio *bio)
+void submit_bio_noacct_nocheck(struct bio *bio, bool split)
{
blk_cgroup_bio_start(bio);
@@ -746,12 +746,16 @@ void submit_bio_noacct_nocheck(struct bio *bio)
* to collect a list of requests submited by a ->submit_bio method while
* it is active, and then process them after it returned.
*/
- if (current->bio_list)
- bio_list_add(¤t->bio_list[0], bio);
- else if (!bdev_test_flag(bio->bi_bdev, BD_HAS_SUBMIT_BIO))
+ if (current->bio_list) {
+ if (split)
+ bio_list_add_head(¤t->bio_list[0], bio);
+ else
+ bio_list_add(¤t->bio_list[0], bio);
+ } else if (!bdev_test_flag(bio->bi_bdev, BD_HAS_SUBMIT_BIO)) {
__submit_bio_noacct_mq(bio);
- else
+ } else {
__submit_bio_noacct(bio);
+ }
}
static blk_status_t blk_validate_atomic_write_op_size(struct request_queue *q,
@@ -872,7 +876,7 @@ void submit_bio_noacct(struct bio *bio)
if (blk_throtl_bio(bio))
return;
- submit_bio_noacct_nocheck(bio);
+ submit_bio_noacct_nocheck(bio, false);
return;
not_supported:
diff --git a/block/blk-merge.c b/block/blk-merge.c
index c411045fcf03a..77488f11a9441 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -134,7 +134,7 @@ struct bio *bio_submit_split_bioset(struct bio *bio, unsigned int split_sectors,
if (should_fail_bio(bio))
bio_io_error(bio);
else if (!blk_throtl_bio(bio))
- submit_bio_noacct_nocheck(bio);
+ submit_bio_noacct_nocheck(bio, true);
return split;
}
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index cfa1cd60d2c5f..f510ae072868c 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -1224,7 +1224,7 @@ static void blk_throtl_dispatch_work_fn(struct work_struct *work)
if (!bio_list_empty(&bio_list_on_stack)) {
blk_start_plug(&plug);
while ((bio = bio_list_pop(&bio_list_on_stack)))
- submit_bio_noacct_nocheck(bio);
+ submit_bio_noacct_nocheck(bio, false);
blk_finish_plug(&plug);
}
}
diff --git a/block/blk.h b/block/blk.h
index 18cc3c2afdd4d..d9efc8693aa48 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -54,7 +54,7 @@ bool blk_queue_start_drain(struct request_queue *q);
bool __blk_freeze_queue_start(struct request_queue *q,
struct task_struct *owner);
int __bio_queue_enter(struct request_queue *q, struct bio *bio);
-void submit_bio_noacct_nocheck(struct bio *bio);
+void submit_bio_noacct_nocheck(struct bio *bio, bool split);
void bio_await_chain(struct bio *bio);
static inline bool blk_try_enter_queue(struct request_queue *q, bool pm)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 125/563] blk-mq: remove useless checkings in blk_mq_update_nr_requests()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 124/563] block: fix ordering of recursive split IO Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 126/563] blk-mq: check invalid nr_requests in queue_requests_store() Greg Kroah-Hartman
` (451 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yu Kuai, Nilay Shroff, Jens Axboe,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit 8bd7195fea6d9662aa3b32498a3828bfd9b63185 ]
1) queue_requests_store() is the only caller of
blk_mq_update_nr_requests(), where queue is already freezed, no need to
check mq_freeze_depth;
2) q->tag_set must be set for request based device, and queue_is_mq() is
already checked in blk_mq_queue_attr_visible(), no need to check
q->tag_set.
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Stable-dep-of: b86433721f46 ("blk-mq: fix potential deadlock while nr_requests grown")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-mq.c | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 19b50110376c6..f5e713224d819 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -4929,21 +4929,14 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
{
struct blk_mq_tag_set *set = q->tag_set;
struct blk_mq_hw_ctx *hctx;
- int ret;
+ int ret = 0;
unsigned long i;
- if (WARN_ON_ONCE(!q->mq_freeze_depth))
- return -EINVAL;
-
- if (!set)
- return -EINVAL;
-
if (q->nr_requests == nr)
return 0;
blk_mq_quiesce_queue(q);
- ret = 0;
queue_for_each_hw_ctx(q, hctx, i) {
if (!hctx->tags)
continue;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 126/563] blk-mq: check invalid nr_requests in queue_requests_store()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 125/563] blk-mq: remove useless checkings in blk_mq_update_nr_requests() Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 127/563] blk-mq: convert to serialize updating nr_requests with update_nr_hwq_lock Greg Kroah-Hartman
` (450 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yu Kuai, Nilay Shroff, Jens Axboe,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit b46d4c447db76e36906ed59ebb9b3ef8f3383322 ]
queue_requests_store() is the only caller of
blk_mq_update_nr_requests(), and blk_mq_update_nr_requests() is the
only caller of blk_mq_tag_update_depth(), however, they all have
checkings for nr_requests input by user.
Make code cleaner by moving all the checkings to the top function:
1) nr_requests > reserved tags;
2) if there is elevator, 4 <= nr_requests <= 2048;
3) if elevator is none, 4 <= nr_requests <= tag_set->queue_depth;
Meanwhile, case 2 is the only case tags can grow and -ENOMEM might be
returned.
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Stable-dep-of: b86433721f46 ("blk-mq: fix potential deadlock while nr_requests grown")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-mq-tag.c | 16 +---------------
block/blk-mq.c | 8 ++------
block/blk-mq.h | 2 +-
block/blk-sysfs.c | 13 +++++++++++++
4 files changed, 17 insertions(+), 22 deletions(-)
diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index 5cffa5668d0c3..725210f27471c 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -584,14 +584,10 @@ void blk_mq_free_tags(struct blk_mq_tags *tags)
}
int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx,
- struct blk_mq_tags **tagsptr, unsigned int tdepth,
- bool can_grow)
+ struct blk_mq_tags **tagsptr, unsigned int tdepth)
{
struct blk_mq_tags *tags = *tagsptr;
- if (tdepth <= tags->nr_reserved_tags)
- return -EINVAL;
-
/*
* If we are allowed to grow beyond the original size, allocate
* a new set of tags before freeing the old one.
@@ -600,16 +596,6 @@ int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx,
struct blk_mq_tag_set *set = hctx->queue->tag_set;
struct blk_mq_tags *new;
- if (!can_grow)
- return -EINVAL;
-
- /*
- * We need some sort of upper limit, set it high enough that
- * no valid use cases should require more.
- */
- if (tdepth > MAX_SCHED_RQ)
- return -EINVAL;
-
/*
* Only the sbitmap needs resizing since we allocated the max
* initially.
diff --git a/block/blk-mq.c b/block/blk-mq.c
index f5e713224d819..a81ef562014d6 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -4932,9 +4932,6 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
int ret = 0;
unsigned long i;
- if (q->nr_requests == nr)
- return 0;
-
blk_mq_quiesce_queue(q);
queue_for_each_hw_ctx(q, hctx, i) {
@@ -4946,10 +4943,9 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
*/
if (hctx->sched_tags) {
ret = blk_mq_tag_update_depth(hctx, &hctx->sched_tags,
- nr, true);
+ nr);
} else {
- ret = blk_mq_tag_update_depth(hctx, &hctx->tags, nr,
- false);
+ ret = blk_mq_tag_update_depth(hctx, &hctx->tags, nr);
}
if (ret)
goto out;
diff --git a/block/blk-mq.h b/block/blk-mq.h
index affb2e14b56e3..2b3ade60c90b2 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -171,7 +171,7 @@ void blk_mq_put_tag(struct blk_mq_tags *tags, struct blk_mq_ctx *ctx,
unsigned int tag);
void blk_mq_put_tags(struct blk_mq_tags *tags, int *tag_array, int nr_tags);
int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx,
- struct blk_mq_tags **tags, unsigned int depth, bool can_grow);
+ struct blk_mq_tags **tags, unsigned int depth);
void blk_mq_tag_resize_shared_tags(struct blk_mq_tag_set *set,
unsigned int size);
void blk_mq_tag_update_sched_shared_tags(struct request_queue *q);
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 4a7f1a349998b..b61e956a868e7 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -78,12 +78,25 @@ queue_requests_store(struct gendisk *disk, const char *page, size_t count)
memflags = blk_mq_freeze_queue(q);
mutex_lock(&q->elevator_lock);
+
+ if (nr == q->nr_requests)
+ goto unlock;
+
if (nr < BLKDEV_MIN_RQ)
nr = BLKDEV_MIN_RQ;
+ if (nr <= q->tag_set->reserved_tags ||
+ (q->elevator && nr > MAX_SCHED_RQ) ||
+ (!q->elevator && nr > q->tag_set->queue_depth)) {
+ ret = -EINVAL;
+ goto unlock;
+ }
+
err = blk_mq_update_nr_requests(disk->queue, nr);
if (err)
ret = err;
+
+unlock:
mutex_unlock(&q->elevator_lock);
blk_mq_unfreeze_queue(q, memflags);
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 127/563] blk-mq: convert to serialize updating nr_requests with update_nr_hwq_lock
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 126/563] blk-mq: check invalid nr_requests in queue_requests_store() Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 128/563] blk-mq: cleanup shared tags case in blk_mq_update_nr_requests() Greg Kroah-Hartman
` (449 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yu Kuai, Nilay Shroff, Jens Axboe,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit 626ff4f8ebcb7207f01e7810acb85812ccf06bd8 ]
request_queue->nr_requests can be changed by:
a) switch elevator by updating nr_hw_queues
b) switch elevator by elevator sysfs attribute
c) configue queue sysfs attribute nr_requests
Current lock order is:
1) update_nr_hwq_lock, case a,b
2) freeze_queue
3) elevator_lock, case a,b,c
And update nr_requests is seriablized by elevator_lock() already,
however, in the case c, we'll have to allocate new sched_tags if
nr_requests grow, and do this with elevator_lock held and queue
freezed has the risk of deadlock.
Hence use update_nr_hwq_lock instead, make it possible to allocate
memory if tags grow, meanwhile also prevent nr_requests to be changed
concurrently.
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Stable-dep-of: b86433721f46 ("blk-mq: fix potential deadlock while nr_requests grown")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-sysfs.c | 25 ++++++++++++++++++++-----
1 file changed, 20 insertions(+), 5 deletions(-)
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index b61e956a868e7..163264e4ec629 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -68,6 +68,7 @@ queue_requests_store(struct gendisk *disk, const char *page, size_t count)
int ret, err;
unsigned int memflags;
struct request_queue *q = disk->queue;
+ struct blk_mq_tag_set *set = q->tag_set;
if (!queue_is_mq(q))
return -EINVAL;
@@ -76,8 +77,11 @@ queue_requests_store(struct gendisk *disk, const char *page, size_t count)
if (ret < 0)
return ret;
- memflags = blk_mq_freeze_queue(q);
- mutex_lock(&q->elevator_lock);
+ /*
+ * Serialize updating nr_requests with concurrent queue_requests_store()
+ * and switching elevator.
+ */
+ down_write(&set->update_nr_hwq_lock);
if (nr == q->nr_requests)
goto unlock;
@@ -85,20 +89,31 @@ queue_requests_store(struct gendisk *disk, const char *page, size_t count)
if (nr < BLKDEV_MIN_RQ)
nr = BLKDEV_MIN_RQ;
- if (nr <= q->tag_set->reserved_tags ||
+ /*
+ * Switching elevator is protected by update_nr_hwq_lock:
+ * - read lock is held from elevator sysfs attribute;
+ * - write lock is held from updating nr_hw_queues;
+ * Hence it's safe to access q->elevator here with write lock held.
+ */
+ if (nr <= set->reserved_tags ||
(q->elevator && nr > MAX_SCHED_RQ) ||
- (!q->elevator && nr > q->tag_set->queue_depth)) {
+ (!q->elevator && nr > set->queue_depth)) {
ret = -EINVAL;
goto unlock;
}
+ memflags = blk_mq_freeze_queue(q);
+ mutex_lock(&q->elevator_lock);
+
err = blk_mq_update_nr_requests(disk->queue, nr);
if (err)
ret = err;
-unlock:
mutex_unlock(&q->elevator_lock);
blk_mq_unfreeze_queue(q, memflags);
+
+unlock:
+ up_write(&set->update_nr_hwq_lock);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 128/563] blk-mq: cleanup shared tags case in blk_mq_update_nr_requests()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 127/563] blk-mq: convert to serialize updating nr_requests with update_nr_hwq_lock Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 129/563] blk-mq: split bitmap grow and resize " Greg Kroah-Hartman
` (448 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yu Kuai, Nilay Shroff, Jens Axboe,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit 7f2799c546dba9e12f9ff4d07936601e416c640d ]
For shared tags case, all hctx->sched_tags/tags are the same, it doesn't
make sense to call into blk_mq_tag_update_depth() multiple times for the
same tags.
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Stable-dep-of: b86433721f46 ("blk-mq: fix potential deadlock while nr_requests grown")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-mq-tag.c | 7 -------
block/blk-mq.c | 43 ++++++++++++++++++++++---------------------
2 files changed, 22 insertions(+), 28 deletions(-)
diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index 725210f27471c..aed84c5d5c2b2 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -596,13 +596,6 @@ int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx,
struct blk_mq_tag_set *set = hctx->queue->tag_set;
struct blk_mq_tags *new;
- /*
- * Only the sbitmap needs resizing since we allocated the max
- * initially.
- */
- if (blk_mq_is_shared_tags(set->flags))
- return 0;
-
new = blk_mq_alloc_map_and_rqs(set, hctx->queue_num, tdepth);
if (!new)
return -ENOMEM;
diff --git a/block/blk-mq.c b/block/blk-mq.c
index a81ef562014d6..bcb7495893a09 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -4934,34 +4934,35 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
blk_mq_quiesce_queue(q);
- queue_for_each_hw_ctx(q, hctx, i) {
- if (!hctx->tags)
- continue;
- /*
- * If we're using an MQ scheduler, just update the scheduler
- * queue depth. This is similar to what the old code would do.
- */
- if (hctx->sched_tags) {
- ret = blk_mq_tag_update_depth(hctx, &hctx->sched_tags,
- nr);
- } else {
- ret = blk_mq_tag_update_depth(hctx, &hctx->tags, nr);
- }
- if (ret)
- goto out;
- }
-
- q->nr_requests = nr;
- if (q->elevator && q->elevator->type->ops.depth_updated)
- q->elevator->type->ops.depth_updated(q);
-
if (blk_mq_is_shared_tags(set->flags)) {
if (q->elevator)
blk_mq_tag_update_sched_shared_tags(q);
else
blk_mq_tag_resize_shared_tags(set, nr);
+ } else {
+ queue_for_each_hw_ctx(q, hctx, i) {
+ if (!hctx->tags)
+ continue;
+ /*
+ * If we're using an MQ scheduler, just update the
+ * scheduler queue depth. This is similar to what the
+ * old code would do.
+ */
+ if (hctx->sched_tags)
+ ret = blk_mq_tag_update_depth(hctx,
+ &hctx->sched_tags, nr);
+ else
+ ret = blk_mq_tag_update_depth(hctx,
+ &hctx->tags, nr);
+ if (ret)
+ goto out;
+ }
}
+ q->nr_requests = nr;
+ if (q->elevator && q->elevator->type->ops.depth_updated)
+ q->elevator->type->ops.depth_updated(q);
+
out:
blk_mq_unquiesce_queue(q);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 129/563] blk-mq: split bitmap grow and resize case in blk_mq_update_nr_requests()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 128/563] blk-mq: cleanup shared tags case in blk_mq_update_nr_requests() Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 130/563] blk-mq-sched: add new parameter nr_requests in blk_mq_alloc_sched_tags() Greg Kroah-Hartman
` (447 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yu Kuai, Nilay Shroff, Jens Axboe,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit e63200404477456ec60c62dd8b3b1092aba2e211 ]
No functional changes are intended, make code cleaner and prepare to fix
the grow case in following patches.
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Stable-dep-of: b86433721f46 ("blk-mq: fix potential deadlock while nr_requests grown")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-mq.c | 39 +++++++++++++++++++++++++++------------
1 file changed, 27 insertions(+), 12 deletions(-)
diff --git a/block/blk-mq.c b/block/blk-mq.c
index bcb7495893a09..1bafbdced7bd5 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -4935,25 +4935,40 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
blk_mq_quiesce_queue(q);
if (blk_mq_is_shared_tags(set->flags)) {
+ /*
+ * Shared tags, for sched tags, we allocate max initially hence
+ * tags can't grow, see blk_mq_alloc_sched_tags().
+ */
if (q->elevator)
blk_mq_tag_update_sched_shared_tags(q);
else
blk_mq_tag_resize_shared_tags(set, nr);
- } else {
+ } else if (!q->elevator) {
+ /*
+ * Non-shared hardware tags, nr is already checked from
+ * queue_requests_store() and tags can't grow.
+ */
queue_for_each_hw_ctx(q, hctx, i) {
if (!hctx->tags)
continue;
- /*
- * If we're using an MQ scheduler, just update the
- * scheduler queue depth. This is similar to what the
- * old code would do.
- */
- if (hctx->sched_tags)
- ret = blk_mq_tag_update_depth(hctx,
- &hctx->sched_tags, nr);
- else
- ret = blk_mq_tag_update_depth(hctx,
- &hctx->tags, nr);
+ sbitmap_queue_resize(&hctx->tags->bitmap_tags,
+ nr - hctx->tags->nr_reserved_tags);
+ }
+ } else if (nr <= q->elevator->et->nr_requests) {
+ /* Non-shared sched tags, and tags don't grow. */
+ queue_for_each_hw_ctx(q, hctx, i) {
+ if (!hctx->sched_tags)
+ continue;
+ sbitmap_queue_resize(&hctx->sched_tags->bitmap_tags,
+ nr - hctx->sched_tags->nr_reserved_tags);
+ }
+ } else {
+ /* Non-shared sched tags, and tags grow */
+ queue_for_each_hw_ctx(q, hctx, i) {
+ if (!hctx->sched_tags)
+ continue;
+ ret = blk_mq_tag_update_depth(hctx, &hctx->sched_tags,
+ nr);
if (ret)
goto out;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 130/563] blk-mq-sched: add new parameter nr_requests in blk_mq_alloc_sched_tags()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 129/563] blk-mq: split bitmap grow and resize " Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 131/563] blk-mq: fix potential deadlock while nr_requests grown Greg Kroah-Hartman
` (446 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yu Kuai, Nilay Shroff, Jens Axboe,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit 6293e336f6d7d3f3415346ce34993b3398846166 ]
This helper only support to allocate the default number of requests,
add a new parameter to support specific number of requests.
Prepare to fix potential deadlock in the case nr_requests grow.
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Stable-dep-of: b86433721f46 ("blk-mq: fix potential deadlock while nr_requests grown")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-mq-sched.c | 14 +++++---------
block/blk-mq-sched.h | 2 +-
block/blk-mq.h | 11 +++++++++++
block/elevator.c | 3 ++-
4 files changed, 19 insertions(+), 11 deletions(-)
diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
index e2ce4a28e6c9e..d06bb137a7437 100644
--- a/block/blk-mq-sched.c
+++ b/block/blk-mq-sched.c
@@ -454,7 +454,7 @@ void blk_mq_free_sched_tags_batch(struct xarray *et_table,
}
struct elevator_tags *blk_mq_alloc_sched_tags(struct blk_mq_tag_set *set,
- unsigned int nr_hw_queues)
+ unsigned int nr_hw_queues, unsigned int nr_requests)
{
unsigned int nr_tags;
int i;
@@ -470,13 +470,8 @@ struct elevator_tags *blk_mq_alloc_sched_tags(struct blk_mq_tag_set *set,
nr_tags * sizeof(struct blk_mq_tags *), gfp);
if (!et)
return NULL;
- /*
- * Default to double of smaller one between hw queue_depth and
- * 128, since we don't split into sync/async like the old code
- * did. Additionally, this is a per-hw queue depth.
- */
- et->nr_requests = 2 * min_t(unsigned int, set->queue_depth,
- BLKDEV_DEFAULT_RQ);
+
+ et->nr_requests = nr_requests;
et->nr_hw_queues = nr_hw_queues;
if (blk_mq_is_shared_tags(set->flags)) {
@@ -521,7 +516,8 @@ int blk_mq_alloc_sched_tags_batch(struct xarray *et_table,
* concurrently.
*/
if (q->elevator) {
- et = blk_mq_alloc_sched_tags(set, nr_hw_queues);
+ et = blk_mq_alloc_sched_tags(set, nr_hw_queues,
+ blk_mq_default_nr_requests(set));
if (!et)
goto out_unwind;
if (xa_insert(et_table, q->id, et, gfp))
diff --git a/block/blk-mq-sched.h b/block/blk-mq-sched.h
index fe83187f41db4..8e21a6b1415d9 100644
--- a/block/blk-mq-sched.h
+++ b/block/blk-mq-sched.h
@@ -24,7 +24,7 @@ void blk_mq_exit_sched(struct request_queue *q, struct elevator_queue *e);
void blk_mq_sched_free_rqs(struct request_queue *q);
struct elevator_tags *blk_mq_alloc_sched_tags(struct blk_mq_tag_set *set,
- unsigned int nr_hw_queues);
+ unsigned int nr_hw_queues, unsigned int nr_requests);
int blk_mq_alloc_sched_tags_batch(struct xarray *et_table,
struct blk_mq_tag_set *set, unsigned int nr_hw_queues);
void blk_mq_free_sched_tags(struct elevator_tags *et,
diff --git a/block/blk-mq.h b/block/blk-mq.h
index 2b3ade60c90b2..731f4578d9a84 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -109,6 +109,17 @@ static inline struct blk_mq_hw_ctx *blk_mq_map_queue(blk_opf_t opf,
return ctx->hctxs[blk_mq_get_hctx_type(opf)];
}
+/*
+ * Default to double of smaller one between hw queue_depth and
+ * 128, since we don't split into sync/async like the old code
+ * did. Additionally, this is a per-hw queue depth.
+ */
+static inline unsigned int blk_mq_default_nr_requests(
+ struct blk_mq_tag_set *set)
+{
+ return 2 * min_t(unsigned int, set->queue_depth, BLKDEV_DEFAULT_RQ);
+}
+
/*
* sysfs helpers
*/
diff --git a/block/elevator.c b/block/elevator.c
index fe96c6f4753ca..e2ebfbf107b3a 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -669,7 +669,8 @@ static int elevator_change(struct request_queue *q, struct elv_change_ctx *ctx)
lockdep_assert_held(&set->update_nr_hwq_lock);
if (strncmp(ctx->name, "none", 4)) {
- ctx->et = blk_mq_alloc_sched_tags(set, set->nr_hw_queues);
+ ctx->et = blk_mq_alloc_sched_tags(set, set->nr_hw_queues,
+ blk_mq_default_nr_requests(set));
if (!ctx->et)
return -ENOMEM;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 131/563] blk-mq: fix potential deadlock while nr_requests grown
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 130/563] blk-mq-sched: add new parameter nr_requests in blk_mq_alloc_sched_tags() Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 132/563] arm64: dts: allwinner: a527: cubie-a5e: Add ethernet PHY reset setting Greg Kroah-Hartman
` (445 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yu Kuai, Nilay Shroff, Jens Axboe,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit b86433721f46d934940528f28d49c1dedb690df1 ]
Allocate and free sched_tags while queue is freezed can deadlock[1],
this is a long term problem, hence allocate memory before freezing
queue and free memory after queue is unfreezed.
[1] https://lore.kernel.org/all/0659ea8d-a463-47c8-9180-43c719e106eb@linux.ibm.com/
Fixes: e3a2b3f931f5 ("blk-mq: allow changing of queue depth through sysfs")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-mq.c | 22 +++++++++-------------
block/blk-mq.h | 5 ++++-
block/blk-sysfs.c | 29 +++++++++++++++++++++--------
3 files changed, 34 insertions(+), 22 deletions(-)
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 1bafbdced7bd5..f8a8a23b90402 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -4925,11 +4925,13 @@ void blk_mq_free_tag_set(struct blk_mq_tag_set *set)
}
EXPORT_SYMBOL(blk_mq_free_tag_set);
-int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
+struct elevator_tags *blk_mq_update_nr_requests(struct request_queue *q,
+ struct elevator_tags *et,
+ unsigned int nr)
{
struct blk_mq_tag_set *set = q->tag_set;
+ struct elevator_tags *old_et = NULL;
struct blk_mq_hw_ctx *hctx;
- int ret = 0;
unsigned long i;
blk_mq_quiesce_queue(q);
@@ -4964,24 +4966,18 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
}
} else {
/* Non-shared sched tags, and tags grow */
- queue_for_each_hw_ctx(q, hctx, i) {
- if (!hctx->sched_tags)
- continue;
- ret = blk_mq_tag_update_depth(hctx, &hctx->sched_tags,
- nr);
- if (ret)
- goto out;
- }
+ queue_for_each_hw_ctx(q, hctx, i)
+ hctx->sched_tags = et->tags[i];
+ old_et = q->elevator->et;
+ q->elevator->et = et;
}
q->nr_requests = nr;
if (q->elevator && q->elevator->type->ops.depth_updated)
q->elevator->type->ops.depth_updated(q);
-out:
blk_mq_unquiesce_queue(q);
-
- return ret;
+ return old_et;
}
/*
diff --git a/block/blk-mq.h b/block/blk-mq.h
index 731f4578d9a84..6c9d03625ba12 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -6,6 +6,7 @@
#include "blk-stat.h"
struct blk_mq_tag_set;
+struct elevator_tags;
struct blk_mq_ctxs {
struct kobject kobj;
@@ -45,7 +46,9 @@ void blk_mq_submit_bio(struct bio *bio);
int blk_mq_poll(struct request_queue *q, blk_qc_t cookie, struct io_comp_batch *iob,
unsigned int flags);
void blk_mq_exit_queue(struct request_queue *q);
-int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr);
+struct elevator_tags *blk_mq_update_nr_requests(struct request_queue *q,
+ struct elevator_tags *tags,
+ unsigned int nr);
void blk_mq_wake_waiters(struct request_queue *q);
bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *,
bool);
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 163264e4ec629..9b03261b3e042 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -64,11 +64,12 @@ static ssize_t queue_requests_show(struct gendisk *disk, char *page)
static ssize_t
queue_requests_store(struct gendisk *disk, const char *page, size_t count)
{
- unsigned long nr;
- int ret, err;
- unsigned int memflags;
struct request_queue *q = disk->queue;
struct blk_mq_tag_set *set = q->tag_set;
+ struct elevator_tags *et = NULL;
+ unsigned int memflags;
+ unsigned long nr;
+ int ret;
if (!queue_is_mq(q))
return -EINVAL;
@@ -102,16 +103,28 @@ queue_requests_store(struct gendisk *disk, const char *page, size_t count)
goto unlock;
}
+ if (!blk_mq_is_shared_tags(set->flags) && q->elevator &&
+ nr > q->elevator->et->nr_requests) {
+ /*
+ * Tags will grow, allocate memory before freezing queue to
+ * prevent deadlock.
+ */
+ et = blk_mq_alloc_sched_tags(set, q->nr_hw_queues, nr);
+ if (!et) {
+ ret = -ENOMEM;
+ goto unlock;
+ }
+ }
+
memflags = blk_mq_freeze_queue(q);
mutex_lock(&q->elevator_lock);
-
- err = blk_mq_update_nr_requests(disk->queue, nr);
- if (err)
- ret = err;
-
+ et = blk_mq_update_nr_requests(q, et, nr);
mutex_unlock(&q->elevator_lock);
blk_mq_unfreeze_queue(q, memflags);
+ if (et)
+ blk_mq_free_sched_tags(et, set);
+
unlock:
up_write(&set->update_nr_hwq_lock);
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 132/563] arm64: dts: allwinner: a527: cubie-a5e: Add ethernet PHY reset setting
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 131/563] blk-mq: fix potential deadlock while nr_requests grown Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 133/563] arm64: dts: allwinner: t527: avaota-a1: " Greg Kroah-Hartman
` (444 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jernej Skrabec, Chen-Yu Tsai,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wens@csie.org>
[ Upstream commit a15f095b590bcc1968fbf2ced8fe87fbd8d012e0 ]
The external Ethernet PHY has a reset pin that is connected to the SoC.
It is missing from the original submission.
Add it to complete the description.
Fixes: acca163f3f51 ("arm64: dts: allwinner: a527: add EMAC0 to Radxa A5E board")
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Link: https://patch.msgid.link/20250908181059.1785605-7-wens@kernel.org
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
index 553ad774ed13d..43251042d1bd5 100644
--- a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
+++ b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
@@ -75,6 +75,9 @@ &mdio0 {
ext_rgmii_phy: ethernet-phy@1 {
compatible = "ethernet-phy-ieee802.3-c22";
reg = <1>;
+ reset-gpios = <&pio 7 8 GPIO_ACTIVE_LOW>; /* PH8 */
+ reset-assert-us = <10000>;
+ reset-deassert-us = <150000>;
};
};
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 133/563] arm64: dts: allwinner: t527: avaota-a1: Add ethernet PHY reset setting
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 132/563] arm64: dts: allwinner: a527: cubie-a5e: Add ethernet PHY reset setting Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 134/563] arm64: dts: rockchip: Add RTC on rk3576-evb1-v10 Greg Kroah-Hartman
` (443 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jernej Skrabec, Chen-Yu Tsai,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wens@csie.org>
[ Upstream commit 8dc3f973b2ff7ea19f7637983c11b005daa8fe45 ]
The external Ethernet PHY has a reset pin that is connected to the SoC.
It is missing from the original submission.
Add it to complete the description.
Fixes: c6800f15998b ("arm64: dts: allwinner: t527: add EMAC0 to Avaota-A1 board")
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Link: https://patch.msgid.link/20250908181059.1785605-9-wens@kernel.org
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
index b9eeb6753e9e3..e7713678208d4 100644
--- a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
+++ b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
@@ -85,6 +85,9 @@ &mdio0 {
ext_rgmii_phy: ethernet-phy@1 {
compatible = "ethernet-phy-ieee802.3-c22";
reg = <1>;
+ reset-gpios = <&pio 7 8 GPIO_ACTIVE_LOW>; /* PH8 */
+ reset-assert-us = <10000>;
+ reset-deassert-us = <150000>;
};
};
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 134/563] arm64: dts: rockchip: Add RTC on rk3576-evb1-v10
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 133/563] arm64: dts: allwinner: t527: avaota-a1: " Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 135/563] arm64: dts: rockchip: Add WiFi " Greg Kroah-Hartman
` (442 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pavel Zhovner, Alexey Charkov,
Heiko Stuebner, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Charkov <alchark@gmail.com>
[ Upstream commit 0adaae77862932a19cc14c086d7fd15ec0ef7703 ]
Add the I2C connected RTC chip to the Rockchip RK3576 EVB1 board.
Apart from the realtime clock functionality, it also provides a 32 kHz
clock source for the onboard WiFi chip.
Tested-by: Pavel Zhovner <pavel@flipperdevices.com>
Signed-off-by: Alexey Charkov <alchark@gmail.com>
Link: https://lore.kernel.org/r/20250813-evb1-rtcwifibt-v1-1-d13c83422971@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Stable-dep-of: 843367c7ed19 ("arm64: dts: rockchip: Fix network on rk3576 evb1 board")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../boot/dts/rockchip/rk3576-evb1-v10.dts | 22 +++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
index 56527c56830e3..bfefd37a1ab8c 100644
--- a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
@@ -680,6 +680,22 @@ regulator-state-mem {
};
};
+&i2c2 {
+ status = "okay";
+
+ hym8563: rtc@51 {
+ compatible = "haoyu,hym8563";
+ reg = <0x51>;
+ clock-output-names = "hym8563";
+ interrupt-parent = <&gpio0>;
+ interrupts = <RK_PA0 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&rtc_int>;
+ wakeup-source;
+ #clock-cells = <0>;
+ };
+};
+
&mdio0 {
rgmii_phy0: phy@1 {
compatible = "ethernet-phy-ieee802.3-c22";
@@ -708,6 +724,12 @@ &pcie1 {
};
&pinctrl {
+ hym8563 {
+ rtc_int: rtc-int {
+ rockchip,pins = <0 RK_PA0 RK_FUNC_GPIO &pcfg_pull_up>;
+ };
+ };
+
usb {
usb_host_pwren: usb-host-pwren {
rockchip,pins = <0 RK_PC7 RK_FUNC_GPIO &pcfg_pull_none>;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 135/563] arm64: dts: rockchip: Add WiFi on rk3576-evb1-v10
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 134/563] arm64: dts: rockchip: Add RTC on rk3576-evb1-v10 Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 136/563] arm64: dts: rockchip: Fix network on rk3576 evb1 board Greg Kroah-Hartman
` (441 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pavel Zhovner, Alexey Charkov,
Heiko Stuebner, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Charkov <alchark@gmail.com>
[ Upstream commit ebf8183ad08afc4fcabe1379a5098354829d950d ]
Add device tree nodes to enable the onboard Ampak AP6275P WiFi chip
connected over a PCIe link on Rockchip RK3576 EVB1.
It takes an external 32 kHz clock from the RTC chip and requires the
WIFI_REG_ON signal to be enabled before the bus is enumerated to
initialize properly.
Tested-by: Pavel Zhovner <pavel@flipperdevices.com>
Signed-off-by: Alexey Charkov <alchark@gmail.com>
Link: https://lore.kernel.org/r/20250813-evb1-rtcwifibt-v1-2-d13c83422971@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Stable-dep-of: 843367c7ed19 ("arm64: dts: rockchip: Fix network on rk3576 evb1 board")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../boot/dts/rockchip/rk3576-evb1-v10.dts | 58 +++++++++++++++++++
1 file changed, 58 insertions(+)
diff --git a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
index bfefd37a1ab8c..3007e0179611b 100644
--- a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
@@ -232,6 +232,20 @@ vcc_ufs_s0: regulator-vcc-ufs-s0 {
regulator-max-microvolt = <3300000>;
vin-supply = <&vcc_sys>;
};
+
+ vcc_wifi_reg_on: regulator-wifi-reg-on {
+ compatible = "regulator-fixed";
+ enable-active-high;
+ gpios = <&gpio1 RK_PC6 GPIO_ACTIVE_HIGH>;
+ pinctrl-0 = <&wifi_reg_on>;
+ pinctrl-names = "default";
+ regulator-name = "wifi_reg_on";
+ regulator-always-on;
+ regulator-boot-on;
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ vin-supply = <&vcc_1v8_s3>;
+ };
};
&cpu_l0 {
@@ -242,6 +256,10 @@ &cpu_b0 {
cpu-supply = <&vdd_cpu_big_s0>;
};
+&combphy0_ps {
+ status = "okay";
+};
+
&combphy1_psu {
status = "okay";
};
@@ -712,6 +730,30 @@ rgmii_phy1: phy@1 {
};
};
+&pcie0 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pcie0_rst>;
+ reset-gpios = <&gpio2 RK_PB4 GPIO_ACTIVE_HIGH>;
+ vpcie3v3-supply = <&vcc_3v3_s3>;
+ status = "okay";
+
+ pcie@0,0 {
+ reg = <0x0 0 0 0 0>;
+ bus-range = <0x0 0xf>;
+ device_type = "pci";
+ ranges;
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+ wifi: wifi@0,0 {
+ compatible = "pci14e4,449d";
+ reg = <0x10000 0 0 0 0>;
+ clocks = <&hym8563>;
+ clock-names = "lpo";
+ };
+ };
+};
+
&pcie1 {
reset-gpios = <&gpio4 RK_PC4 GPIO_ACTIVE_HIGH>;
vpcie3v3-supply = <&vcc3v3_pcie1>;
@@ -730,6 +772,12 @@ rtc_int: rtc-int {
};
};
+ pcie0 {
+ pcie0_rst: pcie0-rst {
+ rockchip,pins = <2 RK_PB4 RK_FUNC_GPIO &pcfg_pull_none>;
+ };
+ };
+
usb {
usb_host_pwren: usb-host-pwren {
rockchip,pins = <0 RK_PC7 RK_FUNC_GPIO &pcfg_pull_none>;
@@ -743,6 +791,16 @@ usbc0_int: usbc0-int {
rockchip,pins = <0 RK_PA5 RK_FUNC_GPIO &pcfg_pull_up>;
};
};
+
+ wifi {
+ wifi_reg_on: wifi-reg-on {
+ rockchip,pins = <1 RK_PC6 RK_FUNC_GPIO &pcfg_pull_up>;
+ };
+
+ wifi_wake_host: wifi-wake-host {
+ rockchip,pins = <0 RK_PB0 RK_FUNC_GPIO &pcfg_pull_down>;
+ };
+ };
};
&sdmmc {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 136/563] arm64: dts: rockchip: Fix network on rk3576 evb1 board
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 135/563] arm64: dts: rockchip: Add WiFi " Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 137/563] arm64: dts: ti: k3-j742s2-mcu-wakeup: Override firmware-name for MCU R5F cores Greg Kroah-Hartman
` (440 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Reichel, Heiko Stuebner,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Reichel <sebastian.reichel@collabora.com>
[ Upstream commit 843367c7ed196bd0806c8776cba108aaf6923b82 ]
The RK3576 EVB1 has a RTL8211F PHY for each GMAC interface with
a dedicated reset line and the 25MHz clock provided by the SoC.
The current description results in non-working Ethernet as the
clocks are only enabled by the PHY driver, but probing the right
PHY driver currently requires that the PHY ID register can be read
for automatic identification.
This fixes up the network description to get the network functionality
working reliably and cleans up usage of deprecated DT properties while
at it.
Fixes: f135a1a07352 ("arm64: dts: rockchip: Add rk3576 evb1 board")
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Link: https://lore.kernel.org/r/20250910-rk3576-evb-network-v1-1-68ed4df272a2@collabora.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../boot/dts/rockchip/rk3576-evb1-v10.dts | 38 ++++++++++++++-----
1 file changed, 28 insertions(+), 10 deletions(-)
diff --git a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
index 3007e0179611b..012c21b58a5a1 100644
--- a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
@@ -275,9 +275,6 @@ ð0m0_rx_bus2
ð0m0_rgmii_clk
ð0m0_rgmii_bus
ðm0_clk0_25m_out>;
- snps,reset-gpio = <&gpio2 RK_PB5 GPIO_ACTIVE_LOW>;
- snps,reset-active-low;
- snps,reset-delays-us = <0 20000 100000>;
tx_delay = <0x21>;
status = "okay";
};
@@ -293,9 +290,6 @@ ð1m0_rx_bus2
ð1m0_rgmii_clk
ð1m0_rgmii_bus
ðm0_clk1_25m_out>;
- snps,reset-gpio = <&gpio3 RK_PA3 GPIO_ACTIVE_LOW>;
- snps,reset-active-low;
- snps,reset-delays-us = <0 20000 100000>;
tx_delay = <0x20>;
status = "okay";
};
@@ -715,18 +709,32 @@ hym8563: rtc@51 {
};
&mdio0 {
- rgmii_phy0: phy@1 {
- compatible = "ethernet-phy-ieee802.3-c22";
+ rgmii_phy0: ethernet-phy@1 {
+ compatible = "ethernet-phy-id001c.c916";
reg = <0x1>;
clocks = <&cru REFCLKO25M_GMAC0_OUT>;
+ assigned-clocks = <&cru REFCLKO25M_GMAC0_OUT>;
+ assigned-clock-rates = <25000000>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&rgmii_phy0_rst>;
+ reset-assert-us = <20000>;
+ reset-deassert-us = <100000>;
+ reset-gpios = <&gpio2 RK_PB5 GPIO_ACTIVE_LOW>;
};
};
&mdio1 {
- rgmii_phy1: phy@1 {
- compatible = "ethernet-phy-ieee802.3-c22";
+ rgmii_phy1: ethernet-phy@1 {
+ compatible = "ethernet-phy-id001c.c916";
reg = <0x1>;
clocks = <&cru REFCLKO25M_GMAC1_OUT>;
+ assigned-clocks = <&cru REFCLKO25M_GMAC1_OUT>;
+ assigned-clock-rates = <25000000>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&rgmii_phy1_rst>;
+ reset-assert-us = <20000>;
+ reset-deassert-us = <100000>;
+ reset-gpios = <&gpio3 RK_PA3 GPIO_ACTIVE_LOW>;
};
};
@@ -772,6 +780,16 @@ rtc_int: rtc-int {
};
};
+ network {
+ rgmii_phy0_rst: rgmii-phy0-rst {
+ rockchip,pins = <2 RK_PB5 RK_FUNC_GPIO &pcfg_pull_none>;
+ };
+
+ rgmii_phy1_rst: rgmii-phy1-rst {
+ rockchip,pins = <3 RK_PA3 RK_FUNC_GPIO &pcfg_pull_none>;
+ };
+ };
+
pcie0 {
pcie0_rst: pcie0-rst {
rockchip,pins = <2 RK_PB4 RK_FUNC_GPIO &pcfg_pull_none>;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 137/563] arm64: dts: ti: k3-j742s2-mcu-wakeup: Override firmware-name for MCU R5F cores
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 136/563] arm64: dts: rockchip: Fix network on rk3576 evb1 board Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:39 ` [PATCH 6.17 138/563] arm64: dts: ti: k3: Rename rproc reserved-mem nodes to memory@addr Greg Kroah-Hartman
` (439 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Beleswar Padhi, Udit Kumar,
Nishanth Menon, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Beleswar Padhi <b-padhi@ti.com>
[ Upstream commit 00c8fdc2809f05422d919809106f54c23de3cba3 ]
The J742S2 SoC reuses the common k3-j784s4-j742s2-mcu-wakeup-common.dtsi
for its MCU domain, but it does not override the firmware-name property
for its R5F cores. This causes the wrong firmware binaries to be
referenced.
Introduce a new k3-j742s2-mcu-wakeup.dtsi file to override the
firmware-name property with correct names for J742s2.
Fixes: 38fd90a3e1ac ("arm64: dts: ti: Introduce J742S2 SoC family")
Signed-off-by: Beleswar Padhi <b-padhi@ti.com>
Reviewed-by: Udit Kumar <u-kumar1@ti.com>
Link: https://patch.msgid.link/20250823163111.2237199-1-b-padhi@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi | 17 +++++++++++++++++
arch/arm64/boot/dts/ti/k3-j742s2.dtsi | 1 +
2 files changed, 18 insertions(+)
create mode 100644 arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi
diff --git a/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi
new file mode 100644
index 0000000000000..61db2348d6a47
--- /dev/null
+++ b/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi
@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+/*
+ * Device Tree Source for J742S2 SoC Family
+ *
+ * TRM: https://www.ti.com/lit/pdf/spruje3
+ *
+ * Copyright (C) 2025 Texas Instruments Incorporated - https://www.ti.com/
+ *
+ */
+
+&mcu_r5fss0_core0 {
+ firmware-name = "j742s2-mcu-r5f0_0-fw";
+};
+
+&mcu_r5fss0_core1 {
+ firmware-name = "j742s2-mcu-r5f0_1-fw";
+};
diff --git a/arch/arm64/boot/dts/ti/k3-j742s2.dtsi b/arch/arm64/boot/dts/ti/k3-j742s2.dtsi
index 7a72f82f56d68..d265df1abade1 100644
--- a/arch/arm64/boot/dts/ti/k3-j742s2.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j742s2.dtsi
@@ -96,3 +96,4 @@ cpu3: cpu@3 {
};
#include "k3-j742s2-main.dtsi"
+#include "k3-j742s2-mcu-wakeup.dtsi"
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 138/563] arm64: dts: ti: k3: Rename rproc reserved-mem nodes to memory@addr
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 137/563] arm64: dts: ti: k3-j742s2-mcu-wakeup: Override firmware-name for MCU R5F cores Greg Kroah-Hartman
@ 2025-10-13 14:39 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 139/563] Revert "arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations" Greg Kroah-Hartman
` (438 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Beleswar Padhi, Francesco Dolcini,
Nishanth Menon, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Beleswar Padhi <b-padhi@ti.com>
[ Upstream commit aee0678597c63e5427e91b2e49a6c5ed4951f277 ]
Currently, the reserved memory carveouts used by remote processors are
named like 'rproc-name-<dma>-memory-region@addr'. While it is
descriptive, the node label already serves that purpose. Rename reserved
memory nodes to generic 'memory@addr' to align with the device tree
specifications. This is done for all TI K3 based boards.
Signed-off-by: Beleswar Padhi <b-padhi@ti.com>
Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Link: https://patch.msgid.link/20250908142826.1828676-14-b-padhi@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Stable-dep-of: 79a1778c7819 ("Revert "arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations"")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../boot/dts/ti/k3-am62-phycore-som.dtsi | 10 ++--
.../boot/dts/ti/k3-am62-pocketbeagle2.dts | 6 +--
arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 2 +-
.../arm64/boot/dts/ti/k3-am625-beagleplay.dts | 2 +-
.../boot/dts/ti/k3-am62a-phycore-som.dtsi | 12 ++---
arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 12 ++---
arch/arm64/boot/dts/ti/k3-am62d2-evm.dts | 14 +++---
arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi | 2 +-
arch/arm64/boot/dts/ti/k3-am62p5-sk.dts | 8 ++--
.../arm64/boot/dts/ti/k3-am62x-sk-common.dtsi | 8 ++--
.../boot/dts/ti/k3-am64-phycore-som.dtsi | 22 ++++-----
arch/arm64/boot/dts/ti/k3-am642-evm.dts | 22 ++++-----
arch/arm64/boot/dts/ti/k3-am642-sk.dts | 22 ++++-----
arch/arm64/boot/dts/ti/k3-am642-sr-som.dtsi | 16 +++----
.../arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi | 18 +++----
.../boot/dts/ti/k3-am65-iot2050-common.dtsi | 10 ++--
.../arm64/boot/dts/ti/k3-am654-base-board.dts | 10 ++--
.../arm64/boot/dts/ti/k3-am67a-beagley-ai.dts | 22 ++++-----
.../boot/dts/ti/k3-am68-phycore-som.dtsi | 34 ++++++-------
arch/arm64/boot/dts/ti/k3-am68-sk-som.dtsi | 34 ++++++-------
arch/arm64/boot/dts/ti/k3-am69-sk.dts | 48 +++++++++----------
arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi | 18 +++----
.../boot/dts/ti/k3-j721e-beagleboneai64.dts | 38 +++++++--------
arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 38 +++++++--------
arch/arm64/boot/dts/ti/k3-j721e-som-p0.dtsi | 38 +++++++--------
arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi | 34 ++++++-------
arch/arm64/boot/dts/ti/k3-j722s-evm.dts | 22 ++++-----
arch/arm64/boot/dts/ti/k3-j784s4-evm.dts | 4 +-
.../dts/ti/k3-j784s4-j742s2-evm-common.dtsi | 44 ++++++++---------
29 files changed, 285 insertions(+), 285 deletions(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi
index 10e6b5c08619e..737ff54c3cd2f 100644
--- a/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi
@@ -46,31 +46,31 @@ ramoops@9c700000 {
pmsg-size = <0x8000>;
};
- rtos_ipc_memory_region: ipc-memories@9c800000 {
+ rtos_ipc_memory_region: memory@9c800000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9c800000 0x00 0x00300000>;
no-map;
};
- mcu_m4fss_dma_memory_region: m4f-dma-memory@9cb00000 {
+ mcu_m4fss_dma_memory_region: memory@9cb00000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9cb00000 0x00 0x100000>;
no-map;
};
- mcu_m4fss_memory_region: m4f-memory@9cc00000 {
+ mcu_m4fss_memory_region: memory@9cc00000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9cc00000 0x00 0xe00000>;
no-map;
};
- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9da00000 {
+ wkup_r5fss0_core0_dma_memory_region: memory@9da00000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9da00000 0x00 0x100000>;
no-map;
};
- wkup_r5fss0_core0_memory_region: r5f-memory@9db00000 {
+ wkup_r5fss0_core0_memory_region: memory@9db00000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9db00000 0x00 0xc00000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts b/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts
index 2e4cf65ee3239..1c95947430d3e 100644
--- a/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts
@@ -54,13 +54,13 @@ linux,cma {
linux,cma-default;
};
- mcu_m4fss_dma_memory_region: m4f-dma-memory@9cb00000 {
+ mcu_m4fss_dma_memory_region: memory@9cb00000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9cb00000 0x00 0x100000>;
no-map;
};
- mcu_m4fss_memory_region: m4f-memory@9cc00000 {
+ mcu_m4fss_memory_region: memory@9cc00000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9cc00000 0x00 0xe00000>;
no-map;
@@ -78,7 +78,7 @@ secure_ddr: optee@9e800000 {
no-map;
};
- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9db00000 {
+ wkup_r5fss0_core0_dma_memory_region: memory@9db00000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9db00000 0x00 0xc00000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi b/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
index bc2289d747745..2b8b2c76e9946 100644
--- a/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
@@ -206,7 +206,7 @@ secure_ddr: optee@9e800000 {
no-map;
};
- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9db00000 {
+ wkup_r5fss0_core0_dma_memory_region: memory@9db00000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9db00000 0x00 0xc00000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts b/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts
index 72b09f9c69d8c..7028d9835c4a8 100644
--- a/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts
+++ b/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts
@@ -83,7 +83,7 @@ secure_ddr: optee@9e800000 {
no-map;
};
- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9db00000 {
+ wkup_r5fss0_core0_dma_memory_region: memory@9db00000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9db00000 0x00 0xc00000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi
index 5dc5d2cb20ccd..175fa5048a0bc 100644
--- a/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi
@@ -59,37 +59,37 @@ linux,cma {
linux,cma-default;
};
- c7x_0_dma_memory_region: c7x-dma-memory@99800000 {
+ c7x_0_dma_memory_region: memory@99800000 {
compatible = "shared-dma-pool";
reg = <0x00 0x99800000 0x00 0x100000>;
no-map;
};
- c7x_0_memory_region: c7x-memory@99900000 {
+ c7x_0_memory_region: memory@99900000 {
compatible = "shared-dma-pool";
reg = <0x00 0x99900000 0x00 0xf00000>;
no-map;
};
- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@9b800000 {
+ mcu_r5fss0_core0_dma_memory_region: memory@9b800000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9b800000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core0_memory_region: r5f-dma-memory@9b900000 {
+ mcu_r5fss0_core0_memory_region: memory@9b900000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9b900000 0x00 0xf00000>;
no-map;
};
- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9c800000 {
+ wkup_r5fss0_core0_dma_memory_region: memory@9c800000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9c800000 0x00 0x100000>;
no-map;
};
- wkup_r5fss0_core0_memory_region: r5f-dma-memory@9c900000 {
+ wkup_r5fss0_core0_memory_region: memory@9c900000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9c900000 0x00 0xf00000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
index bceead5e288e6..4761c3dc2d8e6 100644
--- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
@@ -53,37 +53,37 @@ linux,cma {
linux,cma-default;
};
- c7x_0_dma_memory_region: c7x-dma-memory@99800000 {
+ c7x_0_dma_memory_region: memory@99800000 {
compatible = "shared-dma-pool";
reg = <0x00 0x99800000 0x00 0x100000>;
no-map;
};
- c7x_0_memory_region: c7x-memory@99900000 {
+ c7x_0_memory_region: memory@99900000 {
compatible = "shared-dma-pool";
reg = <0x00 0x99900000 0x00 0xf00000>;
no-map;
};
- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@9b800000 {
+ mcu_r5fss0_core0_dma_memory_region: memory@9b800000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9b800000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core0_memory_region: r5f-dma-memory@9b900000 {
+ mcu_r5fss0_core0_memory_region: memory@9b900000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9b900000 0x00 0xf00000>;
no-map;
};
- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9c800000 {
+ wkup_r5fss0_core0_dma_memory_region: memory@9c800000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9c800000 0x00 0x100000>;
no-map;
};
- wkup_r5fss0_core0_memory_region: r5f-dma-memory@9c900000 {
+ wkup_r5fss0_core0_memory_region: memory@9c900000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9c900000 0x00 0xf00000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts b/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts
index daea18b0bc61c..19a7ca7ee173a 100644
--- a/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts
@@ -58,37 +58,37 @@ secure_tfa_ddr: tfa@80000000 {
no-map;
};
- c7x_0_dma_memory_region: c7x-dma-memory@99800000 {
+ c7x_0_dma_memory_region: memory@99800000 {
compatible = "shared-dma-pool";
reg = <0x00 0x99800000 0x00 0x100000>;
no-map;
};
- c7x_0_memory_region: c7x-memory@99900000 {
+ c7x_0_memory_region: memory@99900000 {
compatible = "shared-dma-pool";
reg = <0x00 0x99900000 0x00 0xf00000>;
no-map;
};
- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@9b800000 {
+ mcu_r5fss0_core0_dma_memory_region: memory@9b800000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9b800000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core0_memory_region: r5f-dma-memory@9b900000 {
+ mcu_r5fss0_core0_memory_region: memory@9b900000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9b900000 0x00 0xf00000>;
no-map;
};
- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9c800000 {
+ wkup_r5fss0_core0_dma_memory_region: memory@9c800000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9c800000 0x00 0x100000>;
no-map;
};
- wkup_r5fss0_core0_memory_region: r5f-dma-memory@9c900000 {
+ wkup_r5fss0_core0_memory_region: memory@9c900000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9c900000 0x00 0xf00000>;
no-map;
@@ -100,7 +100,7 @@ secure_ddr: optee@9e800000 {
no-map;
};
- rtos_ipc_memory_region: ipc-memories@a0000000 {
+ rtos_ipc_memory_region: memory@a0000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0000000 0x00 0x01000000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi b/arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi
index a2fdc6741da2c..3963dbc1faeff 100644
--- a/arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi
@@ -162,7 +162,7 @@ secure_ddr: optee@9e800000 {
no-map;
};
- wkup_r5fss0_core0_memory_region: r5f-dma-memory@9c900000 {
+ wkup_r5fss0_core0_memory_region: memory@9c900000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9c900000 0x00 0x01e00000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts b/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts
index 899da7896563b..2e081c329d6c2 100644
--- a/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts
@@ -49,25 +49,25 @@ reserved-memory {
#size-cells = <2>;
ranges;
- mcu_r5fss0_core0_dma_memory_region: mcu-r5fss-dma-memory-region@9b800000 {
+ mcu_r5fss0_core0_dma_memory_region: memory@9b800000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9b800000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core0_memory_region: mcu-r5fss-memory-region@9b900000 {
+ mcu_r5fss0_core0_memory_region: memory@9b900000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9b900000 0x00 0xf00000>;
no-map;
};
- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9c800000 {
+ wkup_r5fss0_core0_dma_memory_region: memory@9c800000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9c800000 0x00 0x100000>;
no-map;
};
- wkup_r5fss0_core0_memory_region: r5f-memory@9c900000 {
+ wkup_r5fss0_core0_memory_region: memory@9c900000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9c900000 0x00 0xf00000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi b/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi
index 13e1d36123d51..8eed8be2e8bad 100644
--- a/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi
@@ -58,25 +58,25 @@ linux,cma {
linux,cma-default;
};
- mcu_m4fss_dma_memory_region: m4f-dma-memory@9cb00000 {
+ mcu_m4fss_dma_memory_region: memory@9cb00000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9cb00000 0x00 0x100000>;
no-map;
};
- mcu_m4fss_memory_region: m4f-memory@9cc00000 {
+ mcu_m4fss_memory_region: memory@9cc00000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9cc00000 0x00 0xe00000>;
no-map;
};
- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9da00000 {
+ wkup_r5fss0_core0_dma_memory_region: memory@9da00000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9da00000 0x00 0x100000>;
no-map;
};
- wkup_r5fss0_core0_memory_region: r5f-memory@9db00000 {
+ wkup_r5fss0_core0_memory_region: memory@9db00000 {
compatible = "shared-dma-pool";
reg = <0x00 0x9db00000 0x00 0xc00000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi
index d9d491b12c33a..97ad433e49394 100644
--- a/arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi
@@ -41,67 +41,67 @@ secure_ddr: optee@9e800000 {
no-map;
};
- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+ main_r5fss0_core0_dma_memory_region: memory@a0000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+ main_r5fss0_core0_memory_region: memory@a0100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+ main_r5fss0_core1_dma_memory_region: memory@a1000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+ main_r5fss0_core1_memory_region: memory@a1100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+ main_r5fss1_core0_dma_memory_region: memory@a2000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core0_memory_region: r5f-memory@a2100000 {
+ main_r5fss1_core0_memory_region: memory@a2100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+ main_r5fss1_core1_dma_memory_region: memory@a3000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core1_memory_region: r5f-memory@a3100000 {
+ main_r5fss1_core1_memory_region: memory@a3100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3100000 0x00 0xf00000>;
no-map;
};
- mcu_m4fss_dma_memory_region: m4f-dma-memory@a4000000 {
+ mcu_m4fss_dma_memory_region: memory@a4000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4000000 0x00 0x100000>;
no-map;
};
- mcu_m4fss_memory_region: m4f-memory@a4100000 {
+ mcu_m4fss_memory_region: memory@a4100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4100000 0x00 0xf00000>;
no-map;
};
- rtos_ipc_memory_region: ipc-memories@a5000000 {
+ rtos_ipc_memory_region: memory@a5000000 {
reg = <0x00 0xa5000000 0x00 0x00800000>;
alignment = <0x1000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am642-evm.dts b/arch/arm64/boot/dts/ti/k3-am642-evm.dts
index e01866372293b..ccb04a3d97c9a 100644
--- a/arch/arm64/boot/dts/ti/k3-am642-evm.dts
+++ b/arch/arm64/boot/dts/ti/k3-am642-evm.dts
@@ -53,67 +53,67 @@ secure_ddr: optee@9e800000 {
no-map;
};
- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+ main_r5fss0_core0_dma_memory_region: memory@a0000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+ main_r5fss0_core0_memory_region: memory@a0100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+ main_r5fss0_core1_dma_memory_region: memory@a1000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+ main_r5fss0_core1_memory_region: memory@a1100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+ main_r5fss1_core0_dma_memory_region: memory@a2000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core0_memory_region: r5f-memory@a2100000 {
+ main_r5fss1_core0_memory_region: memory@a2100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+ main_r5fss1_core1_dma_memory_region: memory@a3000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core1_memory_region: r5f-memory@a3100000 {
+ main_r5fss1_core1_memory_region: memory@a3100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3100000 0x00 0xf00000>;
no-map;
};
- mcu_m4fss_dma_memory_region: m4f-dma-memory@a4000000 {
+ mcu_m4fss_dma_memory_region: memory@a4000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4000000 0x00 0x100000>;
no-map;
};
- mcu_m4fss_memory_region: m4f-memory@a4100000 {
+ mcu_m4fss_memory_region: memory@a4100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4100000 0x00 0xf00000>;
no-map;
};
- rtos_ipc_memory_region: ipc-memories@a5000000 {
+ rtos_ipc_memory_region: memory@a5000000 {
reg = <0x00 0xa5000000 0x00 0x00800000>;
alignment = <0x1000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am642-sk.dts b/arch/arm64/boot/dts/ti/k3-am642-sk.dts
index 1deaa0be0085c..1982608732ee2 100644
--- a/arch/arm64/boot/dts/ti/k3-am642-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am642-sk.dts
@@ -51,67 +51,67 @@ secure_ddr: optee@9e800000 {
no-map;
};
- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+ main_r5fss0_core0_dma_memory_region: memory@a0000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+ main_r5fss0_core0_memory_region: memory@a0100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+ main_r5fss0_core1_dma_memory_region: memory@a1000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+ main_r5fss0_core1_memory_region: memory@a1100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+ main_r5fss1_core0_dma_memory_region: memory@a2000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core0_memory_region: r5f-memory@a2100000 {
+ main_r5fss1_core0_memory_region: memory@a2100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+ main_r5fss1_core1_dma_memory_region: memory@a3000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core1_memory_region: r5f-memory@a3100000 {
+ main_r5fss1_core1_memory_region: memory@a3100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3100000 0x00 0xf00000>;
no-map;
};
- mcu_m4fss_dma_memory_region: m4f-dma-memory@a4000000 {
+ mcu_m4fss_dma_memory_region: memory@a4000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4000000 0x00 0x100000>;
no-map;
};
- mcu_m4fss_memory_region: m4f-memory@a4100000 {
+ mcu_m4fss_memory_region: memory@a4100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4100000 0x00 0xf00000>;
no-map;
};
- rtos_ipc_memory_region: ipc-memories@a5000000 {
+ rtos_ipc_memory_region: memory@a5000000 {
reg = <0x00 0xa5000000 0x00 0x00800000>;
alignment = <0x1000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am642-sr-som.dtsi b/arch/arm64/boot/dts/ti/k3-am642-sr-som.dtsi
index a5cec9a075109..dfe570e0b7071 100644
--- a/arch/arm64/boot/dts/ti/k3-am642-sr-som.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am642-sr-som.dtsi
@@ -115,49 +115,49 @@ secure_ddr: optee@9e800000 {
no-map;
};
- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+ main_r5fss0_core0_dma_memory_region: memory@a0000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+ main_r5fss0_core0_memory_region: memory@a0100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+ main_r5fss0_core1_dma_memory_region: memory@a1000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+ main_r5fss0_core1_memory_region: memory@a1100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+ main_r5fss1_core0_dma_memory_region: memory@a2000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core0_memory_region: r5f-memory@a2100000 {
+ main_r5fss1_core0_memory_region: memory@a2100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+ main_r5fss1_core1_dma_memory_region: memory@a3000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core1_memory_region: r5f-memory@a3100000 {
+ main_r5fss1_core1_memory_region: memory@a3100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3100000 0x00 0xf00000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi b/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi
index 828d815d6bdfc..a8d5144ab1b33 100644
--- a/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi
@@ -31,55 +31,55 @@ secure_ddr: optee@9e800000 {
no-map;
};
- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+ main_r5fss0_core0_dma_memory_region: memory@a0000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+ main_r5fss0_core0_memory_region: memory@a0100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+ main_r5fss0_core1_dma_memory_region: memory@a1000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+ main_r5fss0_core1_memory_region: memory@a1100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+ main_r5fss1_core0_dma_memory_region: memory@a2000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core0_memory_region: r5f-memory@a2100000 {
+ main_r5fss1_core0_memory_region: memory@a2100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+ main_r5fss1_core1_dma_memory_region: memory@a3000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core1_memory_region: r5f-memory@a3100000 {
+ main_r5fss1_core1_memory_region: memory@a3100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3100000 0x00 0xf00000>;
no-map;
};
- rtos_ipc_memory_region: ipc-memories@a5000000 {
+ rtos_ipc_memory_region: memory@a5000000 {
reg = <0x00 0xa5000000 0x00 0x00800000>;
alignment = <0x1000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi b/arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi
index e5136ed947651..211eb9d93159d 100644
--- a/arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi
@@ -47,31 +47,31 @@ secure_ddr: secure-ddr@9e800000 {
no-map;
};
- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
compatible = "shared-dma-pool";
reg = <0 0xa0000000 0 0x100000>;
no-map;
};
- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+ mcu_r5fss0_core0_memory_region: memory@a0100000 {
compatible = "shared-dma-pool";
reg = <0 0xa0100000 0 0xf00000>;
no-map;
};
- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
compatible = "shared-dma-pool";
reg = <0 0xa1000000 0 0x100000>;
no-map;
};
- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+ mcu_r5fss0_core1_memory_region: memory@a1100000 {
compatible = "shared-dma-pool";
reg = <0 0xa1100000 0 0xf00000>;
no-map;
};
- rtos_ipc_memory_region: ipc-memories@a2000000 {
+ rtos_ipc_memory_region: memory@a2000000 {
reg = <0x00 0xa2000000 0x00 0x00200000>;
alignment = <0x1000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am654-base-board.dts b/arch/arm64/boot/dts/ti/k3-am654-base-board.dts
index e589690c7c821..dac36ca77a30e 100644
--- a/arch/arm64/boot/dts/ti/k3-am654-base-board.dts
+++ b/arch/arm64/boot/dts/ti/k3-am654-base-board.dts
@@ -50,31 +50,31 @@ secure_ddr: secure-ddr@9e800000 {
no-map;
};
- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
compatible = "shared-dma-pool";
reg = <0 0xa0000000 0 0x100000>;
no-map;
};
- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+ mcu_r5fss0_core0_memory_region: memory@a0100000 {
compatible = "shared-dma-pool";
reg = <0 0xa0100000 0 0xf00000>;
no-map;
};
- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
compatible = "shared-dma-pool";
reg = <0 0xa1000000 0 0x100000>;
no-map;
};
- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+ mcu_r5fss0_core1_memory_region: memory@a1100000 {
compatible = "shared-dma-pool";
reg = <0 0xa1100000 0 0xf00000>;
no-map;
};
- rtos_ipc_memory_region: ipc-memories@a2000000 {
+ rtos_ipc_memory_region: memory@a2000000 {
reg = <0x00 0xa2000000 0x00 0x00100000>;
alignment = <0x1000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am67a-beagley-ai.dts b/arch/arm64/boot/dts/ti/k3-am67a-beagley-ai.dts
index bf9b23df1da2a..859294b9a2f31 100644
--- a/arch/arm64/boot/dts/ti/k3-am67a-beagley-ai.dts
+++ b/arch/arm64/boot/dts/ti/k3-am67a-beagley-ai.dts
@@ -50,67 +50,67 @@ secure_ddr: optee@9e800000 {
no-map;
};
- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+ wkup_r5fss0_core0_dma_memory_region: memory@a0000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0000000 0x00 0x100000>;
no-map;
};
- wkup_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+ wkup_r5fss0_core0_memory_region: memory@a0100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0100000 0x00 0xf00000>;
no-map;
};
- mcu_r5fss0_core0_dma_memory_region: mcu-r5fss-dma-memory-region@a1000000 {
+ mcu_r5fss0_core0_dma_memory_region: memory@a1000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1000000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core0_memory_region: mcu-r5fss-memory-region@a1100000 {
+ mcu_r5fss0_core0_memory_region: memory@a1100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core0_dma_memory_region: main-r5fss-dma-memory-region@a2000000 {
+ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core0_memory_region: main-r5fss-memory-region@a2100000 {
+ main_r5fss0_core0_memory_region: memory@a2100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2100000 0x00 0xf00000>;
no-map;
};
- c7x_0_dma_memory_region: c7x-dma-memory@a3000000 {
+ c7x_0_dma_memory_region: memory@a3000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3000000 0x00 0x100000>;
no-map;
};
- c7x_0_memory_region: c7x-memory@a3100000 {
+ c7x_0_memory_region: memory@a3100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3100000 0x00 0xf00000>;
no-map;
};
- c7x_1_dma_memory_region: c7x-dma-memory@a4000000 {
+ c7x_1_dma_memory_region: memory@a4000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4000000 0x00 0x100000>;
no-map;
};
- c7x_1_memory_region: c7x-memory@a4100000 {
+ c7x_1_memory_region: memory@a4100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4100000 0x00 0xf00000>;
no-map;
};
- rtos_ipc_memory_region: ipc-memories@a5000000 {
+ rtos_ipc_memory_region: memory@a5000000 {
reg = <0x00 0xa5000000 0x00 0x1c00000>;
alignment = <0x1000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am68-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am68-phycore-som.dtsi
index fd715fee8170e..71f56f0f5363c 100644
--- a/arch/arm64/boot/dts/ti/k3-am68-phycore-som.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am68-phycore-som.dtsi
@@ -49,103 +49,103 @@ secure_ddr: optee@9e800000 {
no-map;
};
- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0000000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+ mcu_r5fss0_core0_memory_region: memory@a0100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0100000 0x00 0xf00000>;
no-map;
};
- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1000000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+ mcu_r5fss0_core1_memory_region: memory@a1100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
+ main_r5fss0_core0_memory_region: memory@a2100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+ main_r5fss0_core1_dma_memory_region: memory@a3000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
+ main_r5fss0_core1_memory_region: memory@a3100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
+ main_r5fss1_core0_dma_memory_region: memory@a4000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
+ main_r5fss1_core0_memory_region: memory@a4100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
+ main_r5fss1_core1_dma_memory_region: memory@a5000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa5000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
+ main_r5fss1_core1_memory_region: memory@a5100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa5100000 0x00 0xf00000>;
no-map;
};
- c71_0_dma_memory_region: c71-dma-memory@a6000000 {
+ c71_0_dma_memory_region: memory@a6000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa6000000 0x00 0x100000>;
no-map;
};
- c71_0_memory_region: c71-memory@a6100000 {
+ c71_0_memory_region: memory@a6100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa6100000 0x00 0xf00000>;
no-map;
};
- c71_1_dma_memory_region: c71-dma-memory@a7000000 {
+ c71_1_dma_memory_region: memory@a7000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa7000000 0x00 0x100000>;
no-map;
};
- c71_1_memory_region: c71-memory@a7100000 {
+ c71_1_memory_region: memory@a7100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa7100000 0x00 0xf00000>;
no-map;
};
- rtos_ipc_memory_region: ipc-memories@a8000000 {
+ rtos_ipc_memory_region: memory@a8000000 {
reg = <0x00 0xa8000000 0x00 0x01c00000>;
alignment = <0x1000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am68-sk-som.dtsi b/arch/arm64/boot/dts/ti/k3-am68-sk-som.dtsi
index 4ca2d4e2fb9b0..ecc7b3a100d00 100644
--- a/arch/arm64/boot/dts/ti/k3-am68-sk-som.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am68-sk-som.dtsi
@@ -27,103 +27,103 @@ secure_ddr: optee@9e800000 {
no-map;
};
- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0000000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+ mcu_r5fss0_core0_memory_region: memory@a0100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0100000 0x00 0xf00000>;
no-map;
};
- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1000000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+ mcu_r5fss0_core1_memory_region: memory@a1100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
+ main_r5fss0_core0_memory_region: memory@a2100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+ main_r5fss0_core1_dma_memory_region: memory@a3000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
+ main_r5fss0_core1_memory_region: memory@a3100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
+ main_r5fss1_core0_dma_memory_region: memory@a4000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
+ main_r5fss1_core0_memory_region: memory@a4100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
+ main_r5fss1_core1_dma_memory_region: memory@a5000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa5000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
+ main_r5fss1_core1_memory_region: memory@a5100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa5100000 0x00 0xf00000>;
no-map;
};
- c71_0_dma_memory_region: c71-dma-memory@a6000000 {
+ c71_0_dma_memory_region: memory@a6000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa6000000 0x00 0x100000>;
no-map;
};
- c71_0_memory_region: c71-memory@a6100000 {
+ c71_0_memory_region: memory@a6100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa6100000 0x00 0xf00000>;
no-map;
};
- c71_1_dma_memory_region: c71-dma-memory@a7000000 {
+ c71_1_dma_memory_region: memory@a7000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa7000000 0x00 0x100000>;
no-map;
};
- c71_1_memory_region: c71-memory@a7100000 {
+ c71_1_memory_region: memory@a7100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa7100000 0x00 0xf00000>;
no-map;
};
- rtos_ipc_memory_region: ipc-memories@a8000000 {
+ rtos_ipc_memory_region: memory@a8000000 {
reg = <0x00 0xa8000000 0x00 0x01c00000>;
alignment = <0x1000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am69-sk.dts b/arch/arm64/boot/dts/ti/k3-am69-sk.dts
index 612ac27643d2c..922866b96e66a 100644
--- a/arch/arm64/boot/dts/ti/k3-am69-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am69-sk.dts
@@ -49,145 +49,145 @@ secure_ddr: optee@9e800000 {
no-map;
};
- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0000000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+ mcu_r5fss0_core0_memory_region: memory@a0100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0100000 0x00 0xf00000>;
no-map;
};
- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1000000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+ mcu_r5fss0_core1_memory_region: memory@a1100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
+ main_r5fss0_core0_memory_region: memory@a2100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+ main_r5fss0_core1_dma_memory_region: memory@a3000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
+ main_r5fss0_core1_memory_region: memory@a3100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
+ main_r5fss1_core0_dma_memory_region: memory@a4000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
+ main_r5fss1_core0_memory_region: memory@a4100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
+ main_r5fss1_core1_dma_memory_region: memory@a5000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa5000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
+ main_r5fss1_core1_memory_region: memory@a5100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa5100000 0x00 0xf00000>;
no-map;
};
- main_r5fss2_core0_dma_memory_region: r5f-dma-memory@a6000000 {
+ main_r5fss2_core0_dma_memory_region: memory@a6000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa6000000 0x00 0x100000>;
no-map;
};
- main_r5fss2_core0_memory_region: r5f-memory@a6100000 {
+ main_r5fss2_core0_memory_region: memory@a6100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa6100000 0x00 0xf00000>;
no-map;
};
- main_r5fss2_core1_dma_memory_region: r5f-dma-memory@a7000000 {
+ main_r5fss2_core1_dma_memory_region: memory@a7000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa7000000 0x00 0x100000>;
no-map;
};
- main_r5fss2_core1_memory_region: r5f-memory@a7100000 {
+ main_r5fss2_core1_memory_region: memory@a7100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa7100000 0x00 0xf00000>;
no-map;
};
- c71_0_dma_memory_region: c71-dma-memory@a8000000 {
+ c71_0_dma_memory_region: memory@a8000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa8000000 0x00 0x100000>;
no-map;
};
- c71_0_memory_region: c71-memory@a8100000 {
+ c71_0_memory_region: memory@a8100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa8100000 0x00 0xf00000>;
no-map;
};
- c71_1_dma_memory_region: c71-dma-memory@a9000000 {
+ c71_1_dma_memory_region: memory@a9000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa9000000 0x00 0x100000>;
no-map;
};
- c71_1_memory_region: c71-memory@a9100000 {
+ c71_1_memory_region: memory@a9100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa9100000 0x00 0xf00000>;
no-map;
};
- c71_2_dma_memory_region: c71-dma-memory@aa000000 {
+ c71_2_dma_memory_region: memory@aa000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xaa000000 0x00 0x100000>;
no-map;
};
- c71_2_memory_region: c71-memory@aa100000 {
+ c71_2_memory_region: memory@aa100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xaa100000 0x00 0xf00000>;
no-map;
};
- c71_3_dma_memory_region: c71-dma-memory@ab000000 {
+ c71_3_dma_memory_region: memory@ab000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xab000000 0x00 0x100000>;
no-map;
};
- c71_3_memory_region: c71-memory@ab100000 {
+ c71_3_memory_region: memory@ab100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xab100000 0x00 0xf00000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi b/arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi
index 291ab9bb414d7..e8cec315e381b 100644
--- a/arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi
@@ -29,55 +29,55 @@ secure_ddr: optee@9e800000 {
no-map;
};
- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0000000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+ mcu_r5fss0_core0_memory_region: memory@a0100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0100000 0x00 0xf00000>;
no-map;
};
- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1000000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+ mcu_r5fss0_core1_memory_region: memory@a1100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
+ main_r5fss0_core0_memory_region: memory@a2100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+ main_r5fss0_core1_dma_memory_region: memory@a3000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
+ main_r5fss0_core1_memory_region: memory@a3100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3100000 0x00 0xf00000>;
no-map;
};
- rtos_ipc_memory_region: ipc-memories@a4000000 {
+ rtos_ipc_memory_region: memory@a4000000 {
reg = <0x00 0xa4000000 0x00 0x00800000>;
alignment = <0x1000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts b/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts
index fb899c99753ec..6a1b32169678e 100644
--- a/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts
+++ b/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts
@@ -51,115 +51,115 @@ secure_ddr: optee@9e800000 {
no-map;
};
- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0000000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+ mcu_r5fss0_core0_memory_region: memory@a0100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0100000 0x00 0xf00000>;
no-map;
};
- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1000000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+ mcu_r5fss0_core1_memory_region: memory@a1100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
+ main_r5fss0_core0_memory_region: memory@a2100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+ main_r5fss0_core1_dma_memory_region: memory@a3000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
+ main_r5fss0_core1_memory_region: memory@a3100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
+ main_r5fss1_core0_dma_memory_region: memory@a4000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
+ main_r5fss1_core0_memory_region: memory@a4100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
+ main_r5fss1_core1_dma_memory_region: memory@a5000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa5000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
+ main_r5fss1_core1_memory_region: memory@a5100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa5100000 0x00 0xf00000>;
no-map;
};
- c66_0_dma_memory_region: c66-dma-memory@a6000000 {
+ c66_0_dma_memory_region: memory@a6000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa6000000 0x00 0x100000>;
no-map;
};
- c66_0_memory_region: c66-memory@a6100000 {
+ c66_0_memory_region: memory@a6100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa6100000 0x00 0xf00000>;
no-map;
};
- c66_1_dma_memory_region: c66-dma-memory@a7000000 {
+ c66_1_dma_memory_region: memory@a7000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa7000000 0x00 0x100000>;
no-map;
};
- c66_1_memory_region: c66-memory@a7100000 {
+ c66_1_memory_region: memory@a7100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa7100000 0x00 0xf00000>;
no-map;
};
- c71_0_dma_memory_region: c71-dma-memory@a8000000 {
+ c71_0_dma_memory_region: memory@a8000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa8000000 0x00 0x100000>;
no-map;
};
- c71_0_memory_region: c71-memory@a8100000 {
+ c71_0_memory_region: memory@a8100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa8100000 0x00 0xf00000>;
no-map;
};
- rtos_ipc_memory_region: ipc-memories@aa000000 {
+ rtos_ipc_memory_region: memory@aa000000 {
reg = <0x00 0xaa000000 0x00 0x01c00000>;
alignment = <0x1000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
index ffef3d1cfd553..d1b0257048de2 100644
--- a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
@@ -48,115 +48,115 @@ secure_ddr: optee@9e800000 {
no-map;
};
- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0000000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+ mcu_r5fss0_core0_memory_region: memory@a0100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0100000 0x00 0xf00000>;
no-map;
};
- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1000000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+ mcu_r5fss0_core1_memory_region: memory@a1100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
+ main_r5fss0_core0_memory_region: memory@a2100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+ main_r5fss0_core1_dma_memory_region: memory@a3000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
+ main_r5fss0_core1_memory_region: memory@a3100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
+ main_r5fss1_core0_dma_memory_region: memory@a4000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
+ main_r5fss1_core0_memory_region: memory@a4100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
+ main_r5fss1_core1_dma_memory_region: memory@a5000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa5000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
+ main_r5fss1_core1_memory_region: memory@a5100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa5100000 0x00 0xf00000>;
no-map;
};
- c66_0_dma_memory_region: c66-dma-memory@a6000000 {
+ c66_0_dma_memory_region: memory@a6000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa6000000 0x00 0x100000>;
no-map;
};
- c66_0_memory_region: c66-memory@a6100000 {
+ c66_0_memory_region: memory@a6100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa6100000 0x00 0xf00000>;
no-map;
};
- c66_1_dma_memory_region: c66-dma-memory@a7000000 {
+ c66_1_dma_memory_region: memory@a7000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa7000000 0x00 0x100000>;
no-map;
};
- c66_1_memory_region: c66-memory@a7100000 {
+ c66_1_memory_region: memory@a7100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa7100000 0x00 0xf00000>;
no-map;
};
- c71_0_dma_memory_region: c71-dma-memory@a8000000 {
+ c71_0_dma_memory_region: memory@a8000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa8000000 0x00 0x100000>;
no-map;
};
- c71_0_memory_region: c71-memory@a8100000 {
+ c71_0_memory_region: memory@a8100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa8100000 0x00 0xf00000>;
no-map;
};
- rtos_ipc_memory_region: ipc-memories@aa000000 {
+ rtos_ipc_memory_region: memory@aa000000 {
reg = <0x00 0xaa000000 0x00 0x01c00000>;
alignment = <0x1000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-j721e-som-p0.dtsi b/arch/arm64/boot/dts/ti/k3-j721e-som-p0.dtsi
index 0722f6361cc8b..ef11a5fb6ad56 100644
--- a/arch/arm64/boot/dts/ti/k3-j721e-som-p0.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j721e-som-p0.dtsi
@@ -29,115 +29,115 @@ secure_ddr: optee@9e800000 {
no-map;
};
- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0000000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+ mcu_r5fss0_core0_memory_region: memory@a0100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0100000 0x00 0xf00000>;
no-map;
};
- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1000000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+ mcu_r5fss0_core1_memory_region: memory@a1100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
+ main_r5fss0_core0_memory_region: memory@a2100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+ main_r5fss0_core1_dma_memory_region: memory@a3000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
+ main_r5fss0_core1_memory_region: memory@a3100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
+ main_r5fss1_core0_dma_memory_region: memory@a4000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
+ main_r5fss1_core0_memory_region: memory@a4100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
+ main_r5fss1_core1_dma_memory_region: memory@a5000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa5000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
+ main_r5fss1_core1_memory_region: memory@a5100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa5100000 0x00 0xf00000>;
no-map;
};
- c66_1_dma_memory_region: c66-dma-memory@a6000000 {
+ c66_1_dma_memory_region: memory@a6000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa6000000 0x00 0x100000>;
no-map;
};
- c66_0_memory_region: c66-memory@a6100000 {
+ c66_0_memory_region: memory@a6100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa6100000 0x00 0xf00000>;
no-map;
};
- c66_0_dma_memory_region: c66-dma-memory@a7000000 {
+ c66_0_dma_memory_region: memory@a7000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa7000000 0x00 0x100000>;
no-map;
};
- c66_1_memory_region: c66-memory@a7100000 {
+ c66_1_memory_region: memory@a7100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa7100000 0x00 0xf00000>;
no-map;
};
- c71_0_dma_memory_region: c71-dma-memory@a8000000 {
+ c71_0_dma_memory_region: memory@a8000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa8000000 0x00 0x100000>;
no-map;
};
- c71_0_memory_region: c71-memory@a8100000 {
+ c71_0_memory_region: memory@a8100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa8100000 0x00 0xf00000>;
no-map;
};
- rtos_ipc_memory_region: ipc-memories@aa000000 {
+ rtos_ipc_memory_region: memory@aa000000 {
reg = <0x00 0xaa000000 0x00 0x01c00000>;
alignment = <0x1000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi b/arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi
index 54fc5c4f8c3f5..391e8e3ac2680 100644
--- a/arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi
@@ -31,103 +31,103 @@ secure_ddr: optee@9e800000 {
no-map;
};
- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0000000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+ mcu_r5fss0_core0_memory_region: memory@a0100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0100000 0x00 0xf00000>;
no-map;
};
- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1000000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+ mcu_r5fss0_core1_memory_region: memory@a1100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
+ main_r5fss0_core0_memory_region: memory@a2100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+ main_r5fss0_core1_dma_memory_region: memory@a3000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
+ main_r5fss0_core1_memory_region: memory@a3100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
+ main_r5fss1_core0_dma_memory_region: memory@a4000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
+ main_r5fss1_core0_memory_region: memory@a4100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
+ main_r5fss1_core1_dma_memory_region: memory@a5000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa5000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
+ main_r5fss1_core1_memory_region: memory@a5100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa5100000 0x00 0xf00000>;
no-map;
};
- c71_0_dma_memory_region: c71-dma-memory@a6000000 {
+ c71_0_dma_memory_region: memory@a6000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa6000000 0x00 0x100000>;
no-map;
};
- c71_0_memory_region: c71-memory@a6100000 {
+ c71_0_memory_region: memory@a6100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa6100000 0x00 0xf00000>;
no-map;
};
- c71_1_dma_memory_region: c71-dma-memory@a7000000 {
+ c71_1_dma_memory_region: memory@a7000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa7000000 0x00 0x100000>;
no-map;
};
- c71_1_memory_region: c71-memory@a7100000 {
+ c71_1_memory_region: memory@a7100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa7100000 0x00 0xf00000>;
no-map;
};
- rtos_ipc_memory_region: ipc-memories@a8000000 {
+ rtos_ipc_memory_region: memory@a8000000 {
reg = <0x00 0xa8000000 0x00 0x01c00000>;
alignment = <0x1000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-j722s-evm.dts b/arch/arm64/boot/dts/ti/k3-j722s-evm.dts
index 9d8abfa9afd27..4cfe5c88e48f5 100644
--- a/arch/arm64/boot/dts/ti/k3-j722s-evm.dts
+++ b/arch/arm64/boot/dts/ti/k3-j722s-evm.dts
@@ -52,67 +52,67 @@ secure_ddr: optee@9e800000 {
no-map;
};
- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+ wkup_r5fss0_core0_dma_memory_region: memory@a0000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0000000 0x00 0x100000>;
no-map;
};
- wkup_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+ wkup_r5fss0_core0_memory_region: memory@a0100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0100000 0x00 0xf00000>;
no-map;
};
- mcu_r5fss0_core0_dma_memory_region: mcu-r5fss-dma-memory-region@a1000000 {
+ mcu_r5fss0_core0_dma_memory_region: memory@a1000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1000000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core0_memory_region: mcu-r5fss-memory-region@a1100000 {
+ mcu_r5fss0_core0_memory_region: memory@a1100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core0_dma_memory_region: main-r5fss-dma-memory-region@a2000000 {
+ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core0_memory_region: main-r5fss-memory-region@a2100000 {
+ main_r5fss0_core0_memory_region: memory@a2100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2100000 0x00 0xf00000>;
no-map;
};
- c7x_0_dma_memory_region: c7x-dma-memory@a3000000 {
+ c7x_0_dma_memory_region: memory@a3000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3000000 0x00 0x100000>;
no-map;
};
- c7x_0_memory_region: c7x-memory@a3100000 {
+ c7x_0_memory_region: memory@a3100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3100000 0x00 0xf00000>;
no-map;
};
- c7x_1_dma_memory_region: c7x-dma-memory@a4000000 {
+ c7x_1_dma_memory_region: memory@a4000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4000000 0x00 0x100000>;
no-map;
};
- c7x_1_memory_region: c7x-memory@a4100000 {
+ c7x_1_memory_region: memory@a4100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4100000 0x00 0xf00000>;
no-map;
};
- rtos_ipc_memory_region: ipc-memories@a5000000 {
+ rtos_ipc_memory_region: memory@a5000000 {
reg = <0x00 0xa5000000 0x00 0x1c00000>;
alignment = <0x1000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts b/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts
index a84bde08f85e4..2ed1ec6d53c88 100644
--- a/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts
+++ b/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts
@@ -28,13 +28,13 @@ reserved_memory: reserved-memory {
#address-cells = <2>;
#size-cells = <2>;
- c71_3_dma_memory_region: c71-dma-memory@ab000000 {
+ c71_3_dma_memory_region: memory@ab000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xab000000 0x00 0x100000>;
no-map;
};
- c71_3_memory_region: c71-memory@ab100000 {
+ c71_3_memory_region: memory@ab100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xab100000 0x00 0xf00000>;
no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi b/arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi
index fa656b7b13a1d..877b50991ee69 100644
--- a/arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi
@@ -35,133 +35,133 @@ secure_ddr: optee@9e800000 {
no-map;
};
- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0000000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+ mcu_r5fss0_core0_memory_region: memory@a0100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa0100000 0x00 0xf00000>;
no-map;
};
- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1000000 0x00 0x100000>;
no-map;
};
- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+ mcu_r5fss0_core1_memory_region: memory@a1100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa1100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
+ main_r5fss0_core0_memory_region: memory@a2100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa2100000 0x00 0xf00000>;
no-map;
};
- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+ main_r5fss0_core1_dma_memory_region: memory@a3000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3000000 0x00 0x100000>;
no-map;
};
- main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
+ main_r5fss0_core1_memory_region: memory@a3100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa3100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
+ main_r5fss1_core0_dma_memory_region: memory@a4000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
+ main_r5fss1_core0_memory_region: memory@a4100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa4100000 0x00 0xf00000>;
no-map;
};
- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
+ main_r5fss1_core1_dma_memory_region: memory@a5000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa5000000 0x00 0x100000>;
no-map;
};
- main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
+ main_r5fss1_core1_memory_region: memory@a5100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa5100000 0x00 0xf00000>;
no-map;
};
- main_r5fss2_core0_dma_memory_region: r5f-dma-memory@a6000000 {
+ main_r5fss2_core0_dma_memory_region: memory@a6000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa6000000 0x00 0x100000>;
no-map;
};
- main_r5fss2_core0_memory_region: r5f-memory@a6100000 {
+ main_r5fss2_core0_memory_region: memory@a6100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa6100000 0x00 0xf00000>;
no-map;
};
- main_r5fss2_core1_dma_memory_region: r5f-dma-memory@a7000000 {
+ main_r5fss2_core1_dma_memory_region: memory@a7000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa7000000 0x00 0x100000>;
no-map;
};
- main_r5fss2_core1_memory_region: r5f-memory@a7100000 {
+ main_r5fss2_core1_memory_region: memory@a7100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa7100000 0x00 0xf00000>;
no-map;
};
- c71_0_dma_memory_region: c71-dma-memory@a8000000 {
+ c71_0_dma_memory_region: memory@a8000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa8000000 0x00 0x100000>;
no-map;
};
- c71_0_memory_region: c71-memory@a8100000 {
+ c71_0_memory_region: memory@a8100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa8100000 0x00 0xf00000>;
no-map;
};
- c71_1_dma_memory_region: c71-dma-memory@a9000000 {
+ c71_1_dma_memory_region: memory@a9000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa9000000 0x00 0x100000>;
no-map;
};
- c71_1_memory_region: c71-memory@a9100000 {
+ c71_1_memory_region: memory@a9100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa9100000 0x00 0xf00000>;
no-map;
};
- c71_2_dma_memory_region: c71-dma-memory@aa000000 {
+ c71_2_dma_memory_region: memory@aa000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xaa000000 0x00 0x100000>;
no-map;
};
- c71_2_memory_region: c71-memory@aa100000 {
+ c71_2_memory_region: memory@aa100000 {
compatible = "shared-dma-pool";
reg = <0x00 0xaa100000 0x00 0xf00000>;
no-map;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 139/563] Revert "arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations"
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2025-10-13 14:39 ` [PATCH 6.17 138/563] arm64: dts: ti: k3: Rename rproc reserved-mem nodes to memory@addr Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 140/563] Revert "arm64: dts: ti: k3-j721e-beagleboneai64: " Greg Kroah-Hartman
` (437 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Beleswar Padhi, Andrew Davis,
Nishanth Menon, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Beleswar Padhi <b-padhi@ti.com>
[ Upstream commit 79a1778c7819c8491cdbdc1f7e46d478cb84d5cf ]
This reverts commit 9f3814a7c06b7c7296cf8c1622078ad71820454b.
The C6x carveouts are reversed intentionally. This is due to the
requirement to keep the DMA memory region as non-cached, however the
minimum granular cache region for C6x is 16MB. So, C66x_0 marks the
entire C66x_1 16MB memory carveouts as non-cached, and uses the DMA
memory region of C66x_1 as its own, and vice-versa.
This was also called out in the original commit which introduced these
reversed carveouts:
"The minimum granularity on the Cache settings on C66x DSP cores
is 16MB, so the DMA memory regions are chosen such that they are
in separate 16MB regions for each DSP, while reserving a total
of 16 MB for each DSP and not changing the overall DSP
remoteproc carveouts."
Fixes: 9f3814a7c06b ("arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations")
Signed-off-by: Beleswar Padhi <b-padhi@ti.com>
Acked-by: Andrew Davis <afd@ti.com>
Link: https://patch.msgid.link/20250908142826.1828676-22-b-padhi@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
index d1b0257048de2..488c5ebe9e272 100644
--- a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
@@ -120,7 +120,8 @@ main_r5fss1_core1_memory_region: memory@a5100000 {
no-map;
};
- c66_0_dma_memory_region: memory@a6000000 {
+ /* Carveout locations are flipped due to caching */
+ c66_1_dma_memory_region: memory@a6000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa6000000 0x00 0x100000>;
no-map;
@@ -132,7 +133,8 @@ c66_0_memory_region: memory@a6100000 {
no-map;
};
- c66_1_dma_memory_region: memory@a7000000 {
+ /* Carveout locations are flipped due to caching */
+ c66_0_dma_memory_region: memory@a7000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa7000000 0x00 0x100000>;
no-map;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 140/563] Revert "arm64: dts: ti: k3-j721e-beagleboneai64: Fix reversed C6x carveout locations"
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 139/563] Revert "arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations" Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 141/563] arm64: dts: mediatek: mt8188: Change efuse fallback compatible to mt8186 Greg Kroah-Hartman
` (436 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Beleswar Padhi, Andrew Davis,
Nishanth Menon, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Beleswar Padhi <b-padhi@ti.com>
[ Upstream commit 932424a925ce79cbed0a93d36c5f1b69a0128de1 ]
This reverts commit 1a314099b7559690fe23cdf3300dfff6e830ecb1.
The C6x carveouts are reversed intentionally. This is due to the
requirement to keep the DMA memory region as non-cached, however the
minimum granular cache region for C6x is 16MB. So, C66x_0 marks the
entire C66x_1 16MB memory carveouts as non-cached, and uses the DMA
memory region of C66x_1 as its own, and vice-versa.
This was also called out in the original commit which introduced these
reversed carveouts:
"The minimum granularity on the Cache settings on C66x DSP
cores is 16MB, so the DMA memory regions are chosen such that
they are in separate 16MB regions for each DSP, while reserving
a total of 16 MB for each DSP and not changing the overall DSP
remoteproc carveouts."
Fixes: 1a314099b755 ("arm64: dts: ti: k3-j721e-beagleboneai64: Fix reversed C6x carveout locations")
Signed-off-by: Beleswar Padhi <b-padhi@ti.com>
Acked-by: Andrew Davis <afd@ti.com>
Link: https://patch.msgid.link/20250908142826.1828676-23-b-padhi@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts b/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts
index 6a1b32169678e..bb771ce823ec1 100644
--- a/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts
+++ b/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts
@@ -123,7 +123,8 @@ main_r5fss1_core1_memory_region: memory@a5100000 {
no-map;
};
- c66_0_dma_memory_region: memory@a6000000 {
+ /* Carveout locations are flipped due to caching */
+ c66_1_dma_memory_region: memory@a6000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa6000000 0x00 0x100000>;
no-map;
@@ -135,7 +136,8 @@ c66_0_memory_region: memory@a6100000 {
no-map;
};
- c66_1_dma_memory_region: memory@a7000000 {
+ /* Carveout locations are flipped due to caching */
+ c66_0_dma_memory_region: memory@a7000000 {
compatible = "shared-dma-pool";
reg = <0x00 0xa7000000 0x00 0x100000>;
no-map;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 141/563] arm64: dts: mediatek: mt8188: Change efuse fallback compatible to mt8186
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 140/563] Revert "arm64: dts: ti: k3-j721e-beagleboneai64: " Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 142/563] arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model Greg Kroah-Hartman
` (435 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen-Yu Tsai,
AngeloGioacchino Del Regno, Matthias Brugger, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wenst@chromium.org>
[ Upstream commit c881d1c37b2c159d908203dba5c4920bc776046f ]
The efuse block in the MT8188 contains the GPU speed bin cell, and like
the MT8186 one, has the same conversion scheme to work with the GPU OPP
binding. This was reflected in a corresponding change to the efuse DT
binding.
Change the fallback compatible of the MT8188's efuse block from the
generic one to the MT8186 one. This also makes GPU DVFS work properly.
Fixes: d39aacd1021a ("arm64: dts: mediatek: mt8188: add lvts definitions")
Fixes: 50e7592cb696 ("arm64: dts: mediatek: mt8188: Add GPU speed bin NVMEM cells")
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20250610063431.2955757-3-wenst@chromium.org
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/mediatek/mt8188.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8188.dtsi b/arch/arm64/boot/dts/mediatek/mt8188.dtsi
index 202478407727e..90c388f1890f5 100644
--- a/arch/arm64/boot/dts/mediatek/mt8188.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8188.dtsi
@@ -2183,7 +2183,7 @@ imp_iic_wrap_en: clock-controller@11ec2000 {
};
efuse: efuse@11f20000 {
- compatible = "mediatek,mt8188-efuse", "mediatek,efuse";
+ compatible = "mediatek,mt8188-efuse", "mediatek,mt8186-efuse";
reg = <0 0x11f20000 0 0x1000>;
#address-cells = <1>;
#size-cells = <1>;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 142/563] arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 141/563] arm64: dts: mediatek: mt8188: Change efuse fallback compatible to mt8186 Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 143/563] arm64: dts: ti: k3-pinctrl: Fix the bug in existing macros Greg Kroah-Hartman
` (434 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen-Yu Tsai, Matthias Brugger,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wenst@chromium.org>
[ Upstream commit 0370911565869384f19b35ea9e71ee7a57b48a33 ]
The touchscreen controller used with the original Krabby design is the
Elan eKTH6918, which is in the same family as eKTH6915, but supporting
a larger screen size with more sense lines.
OTOH, the touchscreen controller that actually shipped on the Tentacruel
devices is the Elan eKTH6A12NAY. A compatible string was added for it
specifically because it has different power sequencing timings.
Fix up the touchscreen nodes for both these. This also includes adding
a previously missing reset line. Also add "no-reset-on-power-off" since
the power is always on, and putting it in reset would consume more
power.
Fixes: 8855d01fb81f ("arm64: dts: mediatek: Add MT8186 Krabby platform based Tentacruel / Tentacool")
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Link: https://lore.kernel.org/r/20250812090135.3310374-1-wenst@chromium.org
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi | 8 ++++----
.../dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts | 4 ++++
2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi b/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi
index 7c971198fa956..72a2a2bff0a93 100644
--- a/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi
@@ -71,14 +71,14 @@ &i2c1 {
i2c-scl-internal-delay-ns = <10000>;
touchscreen: touchscreen@10 {
- compatible = "hid-over-i2c";
+ compatible = "elan,ekth6915";
reg = <0x10>;
interrupts-extended = <&pio 12 IRQ_TYPE_LEVEL_LOW>;
pinctrl-names = "default";
pinctrl-0 = <&touchscreen_pins>;
- post-power-on-delay-ms = <10>;
- hid-descr-addr = <0x0001>;
- vdd-supply = <&pp3300_s3>;
+ reset-gpios = <&pio 60 GPIO_ACTIVE_LOW>;
+ vcc33-supply = <&pp3300_s3>;
+ no-reset-on-power-off;
};
};
diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts b/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts
index 26d3451a5e47c..24d9ede63eaa2 100644
--- a/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts
+++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts
@@ -42,3 +42,7 @@ MATRIX_KEY(0x00, 0x04, KEY_VOLUMEUP)
CROS_STD_MAIN_KEYMAP
>;
};
+
+&touchscreen {
+ compatible = "elan,ekth6a12nay";
+};
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 143/563] arm64: dts: ti: k3-pinctrl: Fix the bug in existing macros
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 142/563] arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 144/563] arm64: dts: renesas: r9a09g047e57-smarc: Fix gpio keys pin control node Greg Kroah-Hartman
` (433 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kendall Willis, Dhruva Gole,
Vignesh Raghavendra, Akashdeep Kaur, Nishanth Menon, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akashdeep Kaur <a-kaur@ti.com>
[ Upstream commit 2e79ee4d64e9ba4a3fc90e91dfd715407efab16d ]
Currently, DS_IO_OVERRIDE_EN_SHIFT macro is not defined anywhere but
used for defining other macro.
Replace this undefined macro with valid macro. Rename the existing macro
to reflect the actual behavior.
Fixes: 325aa0f6b36e ("arm64: dts: ti: k3-pinctrl: Introduce deep sleep macros")
Reviewed-by: Kendall Willis <k-willis@ti.com>
Reviewed-by: Dhruva Gole <d-gole@ti.com>
Reviewed-by: Vignesh Raghavendra <vigneshr@ti.com>
Signed-off-by: Akashdeep Kaur <a-kaur@ti.com>
Fixes: 325aa0f6b36e ("arm64: dts: ti: k3-pinctrl: Introduce deep sleep macros")
Link: https://patch.msgid.link/20250909044108.2541534-5-a-kaur@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-pinctrl.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/ti/k3-pinctrl.h b/arch/arm64/boot/dts/ti/k3-pinctrl.h
index c0f09be8d3f94..146b780f3bd4a 100644
--- a/arch/arm64/boot/dts/ti/k3-pinctrl.h
+++ b/arch/arm64/boot/dts/ti/k3-pinctrl.h
@@ -55,8 +55,8 @@
#define PIN_DS_FORCE_DISABLE (0 << FORCE_DS_EN_SHIFT)
#define PIN_DS_FORCE_ENABLE (1 << FORCE_DS_EN_SHIFT)
-#define PIN_DS_IO_OVERRIDE_DISABLE (0 << DS_IO_OVERRIDE_EN_SHIFT)
-#define PIN_DS_IO_OVERRIDE_ENABLE (1 << DS_IO_OVERRIDE_EN_SHIFT)
+#define PIN_DS_ISO_OVERRIDE_DISABLE (0 << ISO_OVERRIDE_EN_SHIFT)
+#define PIN_DS_ISO_OVERRIDE_ENABLE (1 << ISO_OVERRIDE_EN_SHIFT)
#define PIN_DS_OUT_ENABLE (0 << DS_OUT_DIS_SHIFT)
#define PIN_DS_OUT_DISABLE (1 << DS_OUT_DIS_SHIFT)
#define PIN_DS_OUT_VALUE_ZERO (0 << DS_OUT_VAL_SHIFT)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 144/563] arm64: dts: renesas: r9a09g047e57-smarc: Fix gpio keys pin control node
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 143/563] arm64: dts: ti: k3-pinctrl: Fix the bug in existing macros Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 145/563] arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names Greg Kroah-Hartman
` (432 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Biju Das, Geert Uytterhoeven,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <biju.das.jz@bp.renesas.com>
[ Upstream commit 3e5df910b592d47734b6dcd03d57498d4766bf6c ]
Adding pin control node to the child won't parse the pins during driver
bind. Fix the issue by moving it to parent node.
This issue is observed while adding Schmitt input enable for PS0 pin on
later patch. Currently the reset value of the PIN is set to NMI function
and hence there is no breakage.
Fixes: 9e95446b0cf9 ("arm64: dts: renesas: r9a09g047e57-smarc: Add gpio keys")
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20250817145135.166591-2-biju.das.jz@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts b/arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts
index 1e67f0a2a945c..9f6716fa10860 100644
--- a/arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts
+++ b/arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts
@@ -90,10 +90,10 @@ &i2c0 {
};
&keys {
- key-sleep {
- pinctrl-0 = <&nmi_pins>;
- pinctrl-names = "default";
+ pinctrl-0 = <&nmi_pins>;
+ pinctrl-names = "default";
+ key-sleep {
interrupts-extended = <&icu 0 IRQ_TYPE_EDGE_FALLING>;
linux,code = <KEY_SLEEP>;
label = "SLEEP";
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 145/563] arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 144/563] arm64: dts: renesas: r9a09g047e57-smarc: Fix gpio keys pin control node Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 146/563] mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() Greg Kroah-Hartman
` (431 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, AngeloGioacchino Del Regno, Fei Shao,
Matthias Brugger, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
[ Upstream commit 98967109c9c0e2de4140827628c63f96314099ab ]
The node names for "pmic", "regulators", "rtc", and "keys" are
dictated by the PMIC MFD binding: change those to adhere to it.
Fixes: aef783f3e0ca ("arm64: dts: mediatek: Add MT6331 PMIC devicetree")
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: Fei Shao <fshao@chromium.org>
Link: https://lore.kernel.org/r/20250724083914.61351-17-angelogioacchino.delregno@collabora.com
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/mediatek/mt6331.dtsi | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt6331.dtsi b/arch/arm64/boot/dts/mediatek/mt6331.dtsi
index d89858c73ab1b..243afbffa21fd 100644
--- a/arch/arm64/boot/dts/mediatek/mt6331.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt6331.dtsi
@@ -6,12 +6,12 @@
#include <dt-bindings/input/input.h>
&pwrap {
- pmic: mt6331 {
+ pmic: pmic {
compatible = "mediatek,mt6331";
interrupt-controller;
#interrupt-cells = <2>;
- mt6331regulator: mt6331regulator {
+ mt6331regulator: regulators {
compatible = "mediatek,mt6331-regulator";
mt6331_vdvfs11_reg: buck-vdvfs11 {
@@ -258,7 +258,7 @@ mt6331_vrtc_reg: ldo-vrtc {
};
mt6331_vdig18_reg: ldo-vdig18 {
- regulator-name = "dvdd18_dig";
+ regulator-name = "vdig18";
regulator-min-microvolt = <1800000>;
regulator-max-microvolt = <1800000>;
regulator-ramp-delay = <0>;
@@ -266,11 +266,11 @@ mt6331_vdig18_reg: ldo-vdig18 {
};
};
- mt6331rtc: mt6331rtc {
+ mt6331rtc: rtc {
compatible = "mediatek,mt6331-rtc";
};
- mt6331keys: mt6331keys {
+ mt6331keys: keys {
compatible = "mediatek,mt6331-keys";
power {
linux,keycodes = <KEY_POWER>;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 146/563] mmc: core: Fix variable shadowing in mmc_route_rpmb_frames()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 145/563] arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 147/563] arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value Greg Kroah-Hartman
` (430 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Avri Altman, Jens Wiklander,
Bean Huo, Ulf Hansson, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bean Huo <beanhuo@micron.com>
[ Upstream commit 072755cca7e743c28a273fcb69b0e826109473d7 ]
Rename the inner 'frm' variable to 'resp_frm' in the write path of
mmc_route_rpmb_frames() to avoid shadowing the outer 'frm' variable.
The function declares 'frm' at function scope pointing to the request
frame, but then redeclares another 'frm' variable inside the write
block pointing to the response frame. This shadowing makes the code
confusing and error-prone.
Using 'resp_frm' for the response frame makes the distinction clear
and improves code readability.
Fixes: 7852028a35f0 ("mmc: block: register RPMB partition with the RPMB subsystem")
Reviewed-by: Avri Altman <avri.altman@sandisk.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Bean Huo <beanhuo@micron.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/core/block.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 9cc47bf94804b..dd6cffc0df729 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -2936,15 +2936,15 @@ static int mmc_route_rpmb_frames(struct device *dev, u8 *req,
return -ENOMEM;
if (write) {
- struct rpmb_frame *frm = (struct rpmb_frame *)resp;
+ struct rpmb_frame *resp_frm = (struct rpmb_frame *)resp;
/* Send write request frame(s) */
set_idata(idata[0], MMC_WRITE_MULTIPLE_BLOCK,
1 | MMC_CMD23_ARG_REL_WR, req, req_len);
/* Send result request frame */
- memset(frm, 0, sizeof(*frm));
- frm->req_resp = cpu_to_be16(RPMB_RESULT_READ);
+ memset(resp_frm, 0, sizeof(*resp_frm));
+ resp_frm->req_resp = cpu_to_be16(RPMB_RESULT_READ);
set_idata(idata[1], MMC_WRITE_MULTIPLE_BLOCK, 1, resp,
resp_len);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 147/563] arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 146/563] mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 148/563] arm64: dts: mediatek: mt7986a: Fix PCI-Express T-PHY node address Greg Kroah-Hartman
` (429 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, AngeloGioacchino Del Regno,
Matthias Brugger, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
[ Upstream commit 236681fb64102f25ed11df55999e6985c1bc2f7d ]
Change the latch-ck value from 0x14 to 4: as only bits [0-3] are
actually used, the final value that gets written to the register
field for DAT_LATCH_CK_SEL is just 0x4.
This also fixes dtbs_check warnings.
Fixes: 5a65dcccf483 ("arm64: dts: mediatek: mt6795-xperia-m5: Add eMMC, MicroSD slot, SDIO")
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20250724083914.61351-21-angelogioacchino.delregno@collabora.com
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
index 91de920c22457..03cc48321a3f4 100644
--- a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
+++ b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
@@ -212,7 +212,7 @@ proximity@48 {
&mmc0 {
/* eMMC controller */
- mediatek,latch-ck = <0x14>; /* hs400 */
+ mediatek,latch-ck = <4>; /* hs400 */
mediatek,hs200-cmd-int-delay = <1>;
mediatek,hs400-cmd-int-delay = <1>;
mediatek,hs400-ds-dly3 = <0x1a>;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 148/563] arm64: dts: mediatek: mt7986a: Fix PCI-Express T-PHY node address
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 147/563] arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 149/563] arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes Greg Kroah-Hartman
` (428 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, AngeloGioacchino Del Regno, Fei Shao,
Matthias Brugger, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
[ Upstream commit 6b3fff78c13f1a2ba5a355a101fa1ca0a13054ad ]
The PCIe TPHY is under the soc bus, which provides MMIO, and all
nodes under that must use the bus, otherwise those would clearly
be out of place.
Add ranges to the PCIe tphy and assign the address to the main
node to silence a dtbs_check warning, and fix the children to
use the MMIO range of t-phy.
Fixes: 963c3b0c47ec ("arm64: dts: mediatek: fix t-phy unit name")
Fixes: 918aed7abd2d ("arm64: dts: mt7986: add pcie related device nodes")
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: Fei Shao <fshao@chromium.org>
Link: https://lore.kernel.org/r/20250724083914.61351-24-angelogioacchino.delregno@collabora.com
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
index 559990dcd1d17..3211905b6f86d 100644
--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
@@ -428,16 +428,16 @@ pcie_intc: interrupt-controller {
};
};
- pcie_phy: t-phy {
+ pcie_phy: t-phy@11c00000 {
compatible = "mediatek,mt7986-tphy",
"mediatek,generic-tphy-v2";
- ranges;
- #address-cells = <2>;
- #size-cells = <2>;
+ ranges = <0 0 0x11c00000 0x20000>;
+ #address-cells = <1>;
+ #size-cells = <1>;
status = "disabled";
- pcie_port: pcie-phy@11c00000 {
- reg = <0 0x11c00000 0 0x20000>;
+ pcie_port: pcie-phy@0 {
+ reg = <0 0x20000>;
clocks = <&clk40m>;
clock-names = "ref";
#phy-cells = <1>;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 149/563] arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 148/563] arm64: dts: mediatek: mt7986a: Fix PCI-Express T-PHY node address Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 150/563] arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible Greg Kroah-Hartman
` (427 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, AngeloGioacchino Del Regno, Fei Shao,
Matthias Brugger, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
[ Upstream commit 09a1e9c973973aff26e66a5673c19442d91b9e3d ]
All of the MT6360 regulator nodes were wrong and would not probe
because the regulator names are supposed to be lower case, but
they are upper case in this devicetree.
Change all nodes to be lower case to get working regulators.
Fixes: 94aaf79a6af5 ("arm64: dts: mediatek: add Kontron 3.5"-SBC-i1200")
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: Fei Shao <fshao@chromium.org>
Link: https://lore.kernel.org/r/20250724083914.61351-38-angelogioacchino.delregno@collabora.com
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../mediatek/mt8395-kontron-3-5-sbc-i1200.dts | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts b/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts
index 4985b65925a9e..d16f545cbbb27 100644
--- a/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts
+++ b/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts
@@ -352,7 +352,7 @@ regulator {
LDO_VIN2-supply = <&vsys>;
LDO_VIN3-supply = <&vsys>;
- mt6360_buck1: BUCK1 {
+ mt6360_buck1: buck1 {
regulator-name = "emi_vdd2";
regulator-min-microvolt = <600000>;
regulator-max-microvolt = <1800000>;
@@ -362,7 +362,7 @@ MT6360_OPMODE_LP
regulator-always-on;
};
- mt6360_buck2: BUCK2 {
+ mt6360_buck2: buck2 {
regulator-name = "emi_vddq";
regulator-min-microvolt = <300000>;
regulator-max-microvolt = <1300000>;
@@ -372,7 +372,7 @@ MT6360_OPMODE_LP
regulator-always-on;
};
- mt6360_ldo1: LDO1 {
+ mt6360_ldo1: ldo1 {
regulator-name = "mt6360_ldo1"; /* Test point */
regulator-min-microvolt = <1200000>;
regulator-max-microvolt = <3600000>;
@@ -380,7 +380,7 @@ mt6360_ldo1: LDO1 {
MT6360_OPMODE_LP>;
};
- mt6360_ldo2: LDO2 {
+ mt6360_ldo2: ldo2 {
regulator-name = "panel1_p1v8";
regulator-min-microvolt = <1800000>;
regulator-max-microvolt = <1800000>;
@@ -388,7 +388,7 @@ mt6360_ldo2: LDO2 {
MT6360_OPMODE_LP>;
};
- mt6360_ldo3: LDO3 {
+ mt6360_ldo3: ldo3 {
regulator-name = "vmc_pmu";
regulator-min-microvolt = <1800000>;
regulator-max-microvolt = <3300000>;
@@ -396,7 +396,7 @@ mt6360_ldo3: LDO3 {
MT6360_OPMODE_LP>;
};
- mt6360_ldo5: LDO5 {
+ mt6360_ldo5: ldo5 {
regulator-name = "vmch_pmu";
regulator-min-microvolt = <3300000>;
regulator-max-microvolt = <3300000>;
@@ -404,7 +404,7 @@ mt6360_ldo5: LDO5 {
MT6360_OPMODE_LP>;
};
- mt6360_ldo6: LDO6 {
+ mt6360_ldo6: ldo6 {
regulator-name = "mt6360_ldo6"; /* Test point */
regulator-min-microvolt = <500000>;
regulator-max-microvolt = <2100000>;
@@ -412,7 +412,7 @@ mt6360_ldo6: LDO6 {
MT6360_OPMODE_LP>;
};
- mt6360_ldo7: LDO7 {
+ mt6360_ldo7: ldo7 {
regulator-name = "emi_vmddr_en";
regulator-min-microvolt = <1800000>;
regulator-max-microvolt = <1800000>;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 150/563] arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 149/563] arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 151/563] arm64: dts: allwinner: a527: cubie-a5e: Add LEDs Greg Kroah-Hartman
` (426 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, AngeloGioacchino Del Regno, Fei Shao,
Matthias Brugger, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ]
This devicetree contained only the SoC compatible but lacked the
machine specific one: add a "mediatek,mt8516-pumpkin" compatible
to the list to fix dtbs_check warnings.
Fixes: 9983822c8cf9 ("arm64: dts: mediatek: add pumpkin board dts")
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: Fei Shao <fshao@chromium.org>
Link: https://lore.kernel.org/r/20250724083914.61351-39-angelogioacchino.delregno@collabora.com
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
index cce642c538128..3d3db33a64dc6 100644
--- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
+++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
@@ -11,7 +11,7 @@
/ {
model = "Pumpkin MT8516";
- compatible = "mediatek,mt8516";
+ compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516";
memory@40000000 {
device_type = "memory";
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 151/563] arm64: dts: allwinner: a527: cubie-a5e: Add LEDs
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 150/563] arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 152/563] arm64: dts: allwinner: a527: cubie-a5e: Drop external 32.768 KHz crystal Greg Kroah-Hartman
` (425 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jernej Skrabec, Chen-Yu Tsai,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wens@csie.org>
[ Upstream commit 4184f0190792aea06553af963741a24cc9b47689 ]
The Radxa Cubie A5E has a 3-color LED. The green and blue LEDs are wired
to GPIO pins on the SoC, and the green one is lit by default to serve as
a power indicator. The red LED is wired to the M.2 slot.
Add device nodes for the green and blue LEDs.
A default "heartbeat" trigger is set for the green power LED, though in
practice it might be better if it were inverted, i.e. lit most of the
time.
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Link: https://patch.msgid.link/20250812175927.2199219-1-wens@kernel.org
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Stable-dep-of: 9f01e1e14e71 ("arm64: dts: allwinner: a527: cubie-a5e: Drop external 32.768 KHz crystal")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../dts/allwinner/sun55i-a527-cubie-a5e.dts | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
index 43251042d1bd5..d4cee22221045 100644
--- a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
+++ b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
@@ -6,6 +6,7 @@
#include "sun55i-a523.dtsi"
#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
/ {
model = "Radxa Cubie A5E";
@@ -27,6 +28,24 @@ ext_osc32k: ext-osc32k-clk {
clock-output-names = "ext_osc32k";
};
+ leds {
+ compatible = "gpio-leds";
+
+ power-led {
+ function = LED_FUNCTION_POWER;
+ color = <LED_COLOR_ID_GREEN>;
+ gpios = <&r_pio 0 4 GPIO_ACTIVE_LOW>; /* PL4 */
+ default-state = "on";
+ linux,default-trigger = "heartbeat";
+ };
+
+ use-led {
+ function = LED_FUNCTION_ACTIVITY;
+ color = <LED_COLOR_ID_BLUE>;
+ gpios = <&r_pio 0 5 GPIO_ACTIVE_LOW>; /* PL5 */
+ };
+ };
+
reg_vcc5v: vcc5v {
/* board wide 5V supply from the USB-C connector */
compatible = "regulator-fixed";
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 152/563] arm64: dts: allwinner: a527: cubie-a5e: Drop external 32.768 KHz crystal
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 151/563] arm64: dts: allwinner: a527: cubie-a5e: Add LEDs Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 153/563] arm64: dts: allwinner: t527: avaota-a1: hook up external 32k crystal Greg Kroah-Hartman
` (424 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jernej Skrabec, Chen-Yu Tsai,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wens@csie.org>
[ Upstream commit 9f01e1e14e71defefcb4d6823b8476a15f3cf04a ]
The Radxa Cubie A5E has empty pads for a 32.768 KHz crystal, but it is
left unpopulated, as per the schematics and seen on board images. A dead
give away is the RTC's LOSC auto switch register showing the external
OSC to be abnormal.
Drop the external crystal from the device tree. It was not referenced
anyway.
Fixes: c2520cd032ae ("arm64: dts: allwinner: a523: add Radxa A5E support")
Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Link: https://patch.msgid.link/20250913102450.3935943-1-wens@kernel.org
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts | 7 -------
1 file changed, 7 deletions(-)
diff --git a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
index d4cee22221045..514c221a7a866 100644
--- a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
+++ b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
@@ -21,13 +21,6 @@ chosen {
stdout-path = "serial0:115200n8";
};
- ext_osc32k: ext-osc32k-clk {
- #clock-cells = <0>;
- compatible = "fixed-clock";
- clock-frequency = <32768>;
- clock-output-names = "ext_osc32k";
- };
-
leds {
compatible = "gpio-leds";
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 153/563] arm64: dts: allwinner: t527: avaota-a1: hook up external 32k crystal
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 152/563] arm64: dts: allwinner: a527: cubie-a5e: Drop external 32.768 KHz crystal Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 154/563] arm64: dts: allwinner: t527: orangepi-4a: " Greg Kroah-Hartman
` (423 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jernej Skrabec, Chen-Yu Tsai,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wens@csie.org>
[ Upstream commit 3d5e1ba00af8dd34ae1e573c2c07e00b5ec65267 ]
When the board was added, its external 32.768 KHz crystal was described
but not hooked up correctly. This meant the device had to fall back to
the SoC's internal oscillator or divide a 32 KHz clock from the main
oscillator, neither of which are accurate for the RTC. As a result the
RTC clock will drift badly.
Hook the crystal up to the RTC block and request the correct clock rate.
Fixes: dbe54efa32af ("arm64: dts: allwinner: a523: add Avaota-A1 router support")
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Link: https://patch.msgid.link/20250913102450.3935943-2-wens@kernel.org
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
index e7713678208d4..4e71055fbd159 100644
--- a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
+++ b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
@@ -309,6 +309,14 @@ &r_pio {
vcc-pm-supply = <®_aldo3>;
};
+&rtc {
+ clocks = <&r_ccu CLK_BUS_R_RTC>, <&osc24M>,
+ <&r_ccu CLK_R_AHB>, <&ext_osc32k>;
+ clock-names = "bus", "hosc", "ahb", "ext-osc32k";
+ assigned-clocks = <&rtc CLK_OSC32K>;
+ assigned-clock-rates = <32768>;
+};
+
&uart0 {
pinctrl-names = "default";
pinctrl-0 = <&uart0_pb_pins>;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 154/563] arm64: dts: allwinner: t527: orangepi-4a: hook up external 32k crystal
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 153/563] arm64: dts: allwinner: t527: avaota-a1: hook up external 32k crystal Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 155/563] pwm: tiehrpwm: Dont drop runtime PM reference in .free() Greg Kroah-Hartman
` (422 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jernej Skrabec, Chen-Yu Tsai,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wens@csie.org>
[ Upstream commit bd1ce7ef6aef4ee7349eb3124166e712693650ce ]
When the board was added, its external 32.768 KHz crystal was described
but not hooked up correctly. This meant the device had to fall back to
the SoC's internal oscillator or divide a 32 KHz clock from the main
oscillator, neither of which are accurate for the RTC. As a result the
RTC clock will drift badly.
Hook the crystal up to the RTC block and request the correct clock rate.
Fixes: de713ccb9934 ("arm64: dts: allwinner: t527: Add OrangePi 4A board")
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Link: https://patch.msgid.link/20250913102450.3935943-3-wens@kernel.org
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/allwinner/sun55i-t527-orangepi-4a.dts | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/arch/arm64/boot/dts/allwinner/sun55i-t527-orangepi-4a.dts b/arch/arm64/boot/dts/allwinner/sun55i-t527-orangepi-4a.dts
index d07bb9193b438..b5483bd7b8d5d 100644
--- a/arch/arm64/boot/dts/allwinner/sun55i-t527-orangepi-4a.dts
+++ b/arch/arm64/boot/dts/allwinner/sun55i-t527-orangepi-4a.dts
@@ -346,6 +346,14 @@ &r_pio {
vcc-pm-supply = <®_bldo2>;
};
+&rtc {
+ clocks = <&r_ccu CLK_BUS_R_RTC>, <&osc24M>,
+ <&r_ccu CLK_R_AHB>, <&ext_osc32k>;
+ clock-names = "bus", "hosc", "ahb", "ext-osc32k";
+ assigned-clocks = <&rtc CLK_OSC32K>;
+ assigned-clock-rates = <32768>;
+};
+
&uart0 {
pinctrl-names = "default";
pinctrl-0 = <&uart0_pb_pins>;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 155/563] pwm: tiehrpwm: Dont drop runtime PM reference in .free()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 154/563] arm64: dts: allwinner: t527: orangepi-4a: " Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 156/563] pwm: tiehrpwm: Make code comment in .free() more useful Greg Kroah-Hartman
` (421 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König,
Uwe Kleine-König, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
[ Upstream commit 21a5e91fda50fc662ce1a12bd0aae9d103455b43 ]
The pwm driver calls pm_runtime_get_sync() when the hardware becomes
enabled and pm_runtime_put_sync() when it becomes disabled. The PWM's
state is kept when a consumer goes away, so the call to
pm_runtime_put_sync() in the .free() callback is unbalanced resulting in
a non-functional device and a reference underlow for the second consumer.
The easiest fix for that issue is to just not drop the runtime PM
reference in .free(), so do that.
Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Link: https://lore.kernel.org/r/bbb089c4b5650cc1f7b25cf582d817543fd25384.1754927682.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pwm/pwm-tiehrpwm.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
index 0125e73b98dfb..5e674a7bbf3be 100644
--- a/drivers/pwm/pwm-tiehrpwm.c
+++ b/drivers/pwm/pwm-tiehrpwm.c
@@ -391,11 +391,6 @@ static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
{
struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
- if (pwm_is_enabled(pwm)) {
- dev_warn(pwmchip_parent(chip), "Removing PWM device without disabling\n");
- pm_runtime_put_sync(pwmchip_parent(chip));
- }
-
/* set period value to zero on free */
pc->period_cycles[pwm->hwpwm] = 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 156/563] pwm: tiehrpwm: Make code comment in .free() more useful
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 155/563] pwm: tiehrpwm: Dont drop runtime PM reference in .free() Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 157/563] pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation Greg Kroah-Hartman
` (420 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König,
Uwe Kleine-König, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
[ Upstream commit 878dbfc12cc52b17d79d205560c0fafcf5332b13 ]
Instead of explaining trivia to everyone who can read C describe the
higher-level effect of setting pc->period_cycles[pwm->hwpwm] to zero.
Fixes: 01b2d4536f02 ("pwm: pwm-tiehrpwm: Fix conflicting channel period setting")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Link: https://lore.kernel.org/r/4c38dd119a77d7017115318a3f2c50bde62a6f21.1754927682.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pwm/pwm-tiehrpwm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
index 5e674a7bbf3be..a94b1e387b924 100644
--- a/drivers/pwm/pwm-tiehrpwm.c
+++ b/drivers/pwm/pwm-tiehrpwm.c
@@ -391,7 +391,7 @@ static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
{
struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
- /* set period value to zero on free */
+ /* Don't let a pwm without consumer block requests to the other channel */
pc->period_cycles[pwm->hwpwm] = 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 157/563] pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 156/563] pwm: tiehrpwm: Make code comment in .free() more useful Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 158/563] pwm: tiehrpwm: Fix corner case in clock divisor calculation Greg Kroah-Hartman
` (419 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König,
Uwe Kleine-König, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
[ Upstream commit bc7ce5bfc504eea9eac0eb0215017b9fcfc62c59 ]
In Up-Count Mode the timer is reset to zero one tick after it reaches
TBPRD, so the period length is (TBPRD + 1) * T_TBCLK. This matches both
the documentation and measurements. So the value written to the TBPRD has
to be one less than the calculated period_cycles value.
A complication here is that for a 100% relative duty-cycle the value
written to the CMPx register has to be TBPRD + 1 which might overflow if
TBPRD is 0xffff. To handle that the calculation of the AQCTLx register
has to be moved to ehrpwm_pwm_config() and the edge at CTR = CMPx has to
be skipped.
Additionally the AQCTL_PRD register field has to be 0 because that defines
the hardware's action when the maximal counter value is reached, which is
(as above) one clock tick before the period's end. The period start edge
has to happen when the counter is reset and so is defined in the AQCTL_ZRO
field.
Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Link: https://lore.kernel.org/r/dc818c69b7cf05109ecda9ee6b0043a22de757c1.1754927682.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pwm/pwm-tiehrpwm.c | 143 +++++++++++++++----------------------
1 file changed, 58 insertions(+), 85 deletions(-)
diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
index a94b1e387b924..a23e48b8523db 100644
--- a/drivers/pwm/pwm-tiehrpwm.c
+++ b/drivers/pwm/pwm-tiehrpwm.c
@@ -36,7 +36,7 @@
#define CLKDIV_MAX 7
#define HSPCLKDIV_MAX 7
-#define PERIOD_MAX 0xFFFF
+#define PERIOD_MAX 0x10000
/* compare module registers */
#define CMPA 0x12
@@ -65,14 +65,10 @@
#define AQCTL_ZRO_FRCHIGH BIT(1)
#define AQCTL_ZRO_FRCTOGGLE (BIT(1) | BIT(0))
-#define AQCTL_CHANA_POLNORMAL (AQCTL_CAU_FRCLOW | AQCTL_PRD_FRCHIGH | \
- AQCTL_ZRO_FRCHIGH)
-#define AQCTL_CHANA_POLINVERSED (AQCTL_CAU_FRCHIGH | AQCTL_PRD_FRCLOW | \
- AQCTL_ZRO_FRCLOW)
-#define AQCTL_CHANB_POLNORMAL (AQCTL_CBU_FRCLOW | AQCTL_PRD_FRCHIGH | \
- AQCTL_ZRO_FRCHIGH)
-#define AQCTL_CHANB_POLINVERSED (AQCTL_CBU_FRCHIGH | AQCTL_PRD_FRCLOW | \
- AQCTL_ZRO_FRCLOW)
+#define AQCTL_CHANA_POLNORMAL (AQCTL_CAU_FRCLOW | AQCTL_ZRO_FRCHIGH)
+#define AQCTL_CHANA_POLINVERSED (AQCTL_CAU_FRCHIGH | AQCTL_ZRO_FRCLOW)
+#define AQCTL_CHANB_POLNORMAL (AQCTL_CBU_FRCLOW | AQCTL_ZRO_FRCHIGH)
+#define AQCTL_CHANB_POLINVERSED (AQCTL_CBU_FRCHIGH | AQCTL_ZRO_FRCLOW)
#define AQSFRC_RLDCSF_MASK (BIT(7) | BIT(6))
#define AQSFRC_RLDCSF_ZRO 0
@@ -108,7 +104,6 @@ struct ehrpwm_pwm_chip {
unsigned long clk_rate;
void __iomem *mmio_base;
unsigned long period_cycles[NUM_PWM_CHANNEL];
- enum pwm_polarity polarity[NUM_PWM_CHANNEL];
struct clk *tbclk;
struct ehrpwm_context ctx;
};
@@ -177,51 +172,20 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div,
return 1;
}
-static void configure_polarity(struct ehrpwm_pwm_chip *pc, int chan)
-{
- u16 aqctl_val, aqctl_mask;
- unsigned int aqctl_reg;
-
- /*
- * Configure PWM output to HIGH/LOW level on counter
- * reaches compare register value and LOW/HIGH level
- * on counter value reaches period register value and
- * zero value on counter
- */
- if (chan == 1) {
- aqctl_reg = AQCTLB;
- aqctl_mask = AQCTL_CBU_MASK;
-
- if (pc->polarity[chan] == PWM_POLARITY_INVERSED)
- aqctl_val = AQCTL_CHANB_POLINVERSED;
- else
- aqctl_val = AQCTL_CHANB_POLNORMAL;
- } else {
- aqctl_reg = AQCTLA;
- aqctl_mask = AQCTL_CAU_MASK;
-
- if (pc->polarity[chan] == PWM_POLARITY_INVERSED)
- aqctl_val = AQCTL_CHANA_POLINVERSED;
- else
- aqctl_val = AQCTL_CHANA_POLNORMAL;
- }
-
- aqctl_mask |= AQCTL_PRD_MASK | AQCTL_ZRO_MASK;
- ehrpwm_modify(pc->mmio_base, aqctl_reg, aqctl_mask, aqctl_val);
-}
-
/*
* period_ns = 10^9 * (ps_divval * period_cycles) / PWM_CLK_RATE
* duty_ns = 10^9 * (ps_divval * duty_cycles) / PWM_CLK_RATE
*/
static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
- u64 duty_ns, u64 period_ns)
+ u64 duty_ns, u64 period_ns, enum pwm_polarity polarity)
{
struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
u32 period_cycles, duty_cycles;
u16 ps_divval, tb_divval;
unsigned int i, cmp_reg;
unsigned long long c;
+ u16 aqctl_val, aqctl_mask;
+ unsigned int aqctl_reg;
if (period_ns > NSEC_PER_SEC)
return -ERANGE;
@@ -231,15 +195,10 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
do_div(c, NSEC_PER_SEC);
period_cycles = (unsigned long)c;
- if (period_cycles < 1) {
- period_cycles = 1;
- duty_cycles = 1;
- } else {
- c = pc->clk_rate;
- c = c * duty_ns;
- do_div(c, NSEC_PER_SEC);
- duty_cycles = (unsigned long)c;
- }
+ c = pc->clk_rate;
+ c = c * duty_ns;
+ do_div(c, NSEC_PER_SEC);
+ duty_cycles = (unsigned long)c;
/*
* Period values should be same for multiple PWM channels as IP uses
@@ -271,46 +230,67 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
return -EINVAL;
}
- pm_runtime_get_sync(pwmchip_parent(chip));
-
- /* Update clock prescaler values */
- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CLKDIV_MASK, tb_divval);
-
/* Update period & duty cycle with presacler division */
period_cycles = period_cycles / ps_divval;
duty_cycles = duty_cycles / ps_divval;
- /* Configure shadow loading on Period register */
- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_PRDLD_MASK, TBCTL_PRDLD_SHDW);
+ if (period_cycles < 1)
+ period_cycles = 1;
- ehrpwm_write(pc->mmio_base, TBPRD, period_cycles);
+ pm_runtime_get_sync(pwmchip_parent(chip));
- /* Configure ehrpwm counter for up-count mode */
- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CTRMODE_MASK,
- TBCTL_CTRMODE_UP);
+ /* Update clock prescaler values */
+ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CLKDIV_MASK, tb_divval);
- if (pwm->hwpwm == 1)
+ if (pwm->hwpwm == 1) {
/* Channel 1 configured with compare B register */
cmp_reg = CMPB;
- else
+
+ aqctl_reg = AQCTLB;
+ aqctl_mask = AQCTL_CBU_MASK;
+
+ if (polarity == PWM_POLARITY_INVERSED)
+ aqctl_val = AQCTL_CHANB_POLINVERSED;
+ else
+ aqctl_val = AQCTL_CHANB_POLNORMAL;
+
+ /* if duty_cycle is big, don't toggle on CBU */
+ if (duty_cycles > period_cycles)
+ aqctl_val &= ~AQCTL_CBU_MASK;
+
+ } else {
/* Channel 0 configured with compare A register */
cmp_reg = CMPA;
- ehrpwm_write(pc->mmio_base, cmp_reg, duty_cycles);
+ aqctl_reg = AQCTLA;
+ aqctl_mask = AQCTL_CAU_MASK;
- pm_runtime_put_sync(pwmchip_parent(chip));
+ if (polarity == PWM_POLARITY_INVERSED)
+ aqctl_val = AQCTL_CHANA_POLINVERSED;
+ else
+ aqctl_val = AQCTL_CHANA_POLNORMAL;
- return 0;
-}
+ /* if duty_cycle is big, don't toggle on CAU */
+ if (duty_cycles > period_cycles)
+ aqctl_val &= ~AQCTL_CAU_MASK;
+ }
-static int ehrpwm_pwm_set_polarity(struct pwm_chip *chip,
- struct pwm_device *pwm,
- enum pwm_polarity polarity)
-{
- struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
+ aqctl_mask |= AQCTL_PRD_MASK | AQCTL_ZRO_MASK;
+ ehrpwm_modify(pc->mmio_base, aqctl_reg, aqctl_mask, aqctl_val);
+
+ /* Configure shadow loading on Period register */
+ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_PRDLD_MASK, TBCTL_PRDLD_SHDW);
+
+ ehrpwm_write(pc->mmio_base, TBPRD, period_cycles - 1);
+
+ /* Configure ehrpwm counter for up-count mode */
+ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CTRMODE_MASK,
+ TBCTL_CTRMODE_UP);
+
+ if (!(duty_cycles > period_cycles))
+ ehrpwm_write(pc->mmio_base, cmp_reg, duty_cycles);
- /* Configuration of polarity in hardware delayed, do at enable */
- pc->polarity[pwm->hwpwm] = polarity;
+ pm_runtime_put_sync(pwmchip_parent(chip));
return 0;
}
@@ -339,9 +319,6 @@ static int ehrpwm_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
ehrpwm_modify(pc->mmio_base, AQCSFRC, aqcsfrc_mask, aqcsfrc_val);
- /* Channels polarity can be configured from action qualifier module */
- configure_polarity(pc, pwm->hwpwm);
-
/* Enable TBCLK */
ret = clk_enable(pc->tbclk);
if (ret) {
@@ -406,10 +383,6 @@ static int ehrpwm_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
ehrpwm_pwm_disable(chip, pwm);
enabled = false;
}
-
- err = ehrpwm_pwm_set_polarity(chip, pwm, state->polarity);
- if (err)
- return err;
}
if (!state->enabled) {
@@ -418,7 +391,7 @@ static int ehrpwm_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
return 0;
}
- err = ehrpwm_pwm_config(chip, pwm, state->duty_cycle, state->period);
+ err = ehrpwm_pwm_config(chip, pwm, state->duty_cycle, state->period, state->polarity);
if (err)
return err;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 158/563] pwm: tiehrpwm: Fix corner case in clock divisor calculation
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 157/563] pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 159/563] ACPICA: Apply ACPI_NONSTRING Greg Kroah-Hartman
` (418 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König,
Uwe Kleine-König, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ]
The function set_prescale_div() is responsible for calculating the clock
divisor settings such that the input clock rate is divided down such that
the required period length is at most 0x10000 clock ticks. If period_cycles
is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is
good enough. So round up in the calculation of the required divisor and
compare it using >= instead of >.
Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Link: https://lore.kernel.org/r/85488616d7bfcd9c32717651d0be7e330e761b9c.1754927682.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pwm/pwm-tiehrpwm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
index a23e48b8523db..7a86cb090f76f 100644
--- a/drivers/pwm/pwm-tiehrpwm.c
+++ b/drivers/pwm/pwm-tiehrpwm.c
@@ -161,7 +161,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div,
*prescale_div = (1 << clkdiv) *
(hspclkdiv ? (hspclkdiv * 2) : 1);
- if (*prescale_div > rqst_prescaler) {
+ if (*prescale_div >= rqst_prescaler) {
*tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) |
(hspclkdiv << TBCTL_HSPCLKDIV_SHIFT);
return 0;
@@ -224,7 +224,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
pc->period_cycles[pwm->hwpwm] = period_cycles;
/* Configure clock prescaler to support Low frequency PWM wave */
- if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval,
+ if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval,
&tb_divval)) {
dev_err(pwmchip_parent(chip), "Unsupported values\n");
return -EINVAL;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 159/563] ACPICA: Apply ACPI_NONSTRING
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 158/563] pwm: tiehrpwm: Fix corner case in clock divisor calculation Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 160/563] ACPICA: Fix largest possible resource descriptor index Greg Kroah-Hartman
` (417 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ahmed Salem, Rafael J. Wysocki,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmed Salem <x0rw3ll@gmail.com>
[ Upstream commit 12fd607554c4efb4856959f0e5823f541bc0e701 ]
Add ACPI_NONSTRING for destination char arrays without a terminating NUL
character.
This is a follow-up to commit 2b82118845e0 ("ACPICA: Apply ACPI_NONSTRING")
where a few more destination arrays were missed.
Link: https://github.com/acpica/acpica/commit/f359e5ed
Fixes: 2b82118845e0 ("ACPICA: Apply ACPI_NONSTRING")
Signed-off-by: Ahmed Salem <x0rw3ll@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/acpi/actbl.h | 2 +-
tools/power/acpi/os_specific/service_layers/oslinuxtbl.c | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/include/acpi/actbl.h b/include/acpi/actbl.h
index 243097a3da636..8a67d4ea6e3fe 100644
--- a/include/acpi/actbl.h
+++ b/include/acpi/actbl.h
@@ -73,7 +73,7 @@ struct acpi_table_header {
char oem_id[ACPI_OEM_ID_SIZE] ACPI_NONSTRING; /* ASCII OEM identification */
char oem_table_id[ACPI_OEM_TABLE_ID_SIZE] ACPI_NONSTRING; /* ASCII OEM table identification */
u32 oem_revision; /* OEM revision number */
- char asl_compiler_id[ACPI_NAMESEG_SIZE]; /* ASCII ASL compiler vendor ID */
+ char asl_compiler_id[ACPI_NAMESEG_SIZE] ACPI_NONSTRING; /* ASCII ASL compiler vendor ID */
u32 asl_compiler_revision; /* ASL compiler version */
};
diff --git a/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c b/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c
index 9741e7503591c..de93067a5da32 100644
--- a/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c
+++ b/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c
@@ -995,7 +995,7 @@ static acpi_status osl_list_customized_tables(char *directory)
{
void *table_dir;
u32 instance;
- char temp_name[ACPI_NAMESEG_SIZE];
+ char temp_name[ACPI_NAMESEG_SIZE] ACPI_NONSTRING;
char *filename;
acpi_status status = AE_OK;
@@ -1312,7 +1312,7 @@ osl_get_customized_table(char *pathname,
{
void *table_dir;
u32 current_instance = 0;
- char temp_name[ACPI_NAMESEG_SIZE];
+ char temp_name[ACPI_NAMESEG_SIZE] ACPI_NONSTRING;
char table_filename[PATH_MAX];
char *filename;
acpi_status status;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 160/563] ACPICA: Fix largest possible resource descriptor index
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 159/563] ACPICA: Apply ACPI_NONSTRING Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 161/563] riscv, bpf: Sign extend struct ops return values properly Greg Kroah-Hartman
` (416 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Antipov, Rafael J. Wysocki,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <dmantipov@yandex.ru>
[ Upstream commit 8ca944fea4d6d9019e01f2d6f6e766f315a9d73f ]
ACPI_RESOURCE_NAME_LARGE_MAX should be equal to the last actually
used resource descriptor index (ACPI_RESOURCE_NAME_CLOCK_INPUT).
Otherwise 'resource_index' in 'acpi_ut_validate_resource()' may be
clamped incorrectly and resulting value may issue an out-of-bounds
access for 'acpi_gbl_resource_types' array. Compile tested only.
Fixes: 520d4a0ee5b6 ("ACPICA: add support for ClockInput resource (v6.5)")
Link: https://github.com/acpica/acpica/commit/cf00116c
Link: https://marc.info/?l=linux-acpi&m=175449676131260&w=2
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/aclocal.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
index 0c41f0097e8d7..f98640086f4ef 100644
--- a/drivers/acpi/acpica/aclocal.h
+++ b/drivers/acpi/acpica/aclocal.h
@@ -1141,7 +1141,7 @@ struct acpi_port_info {
#define ACPI_RESOURCE_NAME_PIN_GROUP_FUNCTION 0x91
#define ACPI_RESOURCE_NAME_PIN_GROUP_CONFIG 0x92
#define ACPI_RESOURCE_NAME_CLOCK_INPUT 0x93
-#define ACPI_RESOURCE_NAME_LARGE_MAX 0x94
+#define ACPI_RESOURCE_NAME_LARGE_MAX 0x93
/*****************************************************************************
*
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 161/563] riscv, bpf: Sign extend struct ops return values properly
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 160/563] ACPICA: Fix largest possible resource descriptor index Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 162/563] nvme-auth: update bi_directional flag Greg Kroah-Hartman
` (415 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hengqi Chen, Daniel Borkmann,
Pu Lehui, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengqi Chen <hengqi.chen@gmail.com>
[ Upstream commit fd2e08128944a7679e753f920e9eda72057e427c ]
The ns_bpf_qdisc selftest triggers a kernel panic:
Unable to handle kernel paging request at virtual address ffffffffa38dbf58
Current test_progs pgtable: 4K pagesize, 57-bit VAs, pgdp=0x00000001109cc000
[ffffffffa38dbf58] pgd=000000011fffd801, p4d=000000011fffd401, pud=000000011fffd001, pmd=0000000000000000
Oops [#1]
Modules linked in: bpf_testmod(OE) xt_conntrack nls_iso8859_1 [...] [last unloaded: bpf_testmod(OE)]
CPU: 1 UID: 0 PID: 23584 Comm: test_progs Tainted: G W OE 6.17.0-rc1-g2465bb83e0b4 #1 NONE
Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01+dfsg-1ubuntu5.1 01/01/2024
epc : __qdisc_run+0x82/0x6f0
ra : __qdisc_run+0x6e/0x6f0
epc : ffffffff80bd5c7a ra : ffffffff80bd5c66 sp : ff2000000eecb550
gp : ffffffff82472098 tp : ff60000096895940 t0 : ffffffff8001f180
t1 : ffffffff801e1664 t2 : 0000000000000000 s0 : ff2000000eecb5d0
s1 : ff60000093a6a600 a0 : ffffffffa38dbee8 a1 : 0000000000000001
a2 : ff2000000eecb510 a3 : 0000000000000001 a4 : 0000000000000000
a5 : 0000000000000010 a6 : 0000000000000000 a7 : 0000000000735049
s2 : ffffffffa38dbee8 s3 : 0000000000000040 s4 : ff6000008bcda000
s5 : 0000000000000008 s6 : ff60000093a6a680 s7 : ff60000093a6a6f0
s8 : ff60000093a6a6ac s9 : ff60000093140000 s10: 0000000000000000
s11: ff2000000eecb9d0 t3 : 0000000000000000 t4 : 0000000000ff0000
t5 : 0000000000000000 t6 : ff60000093a6a8b6
status: 0000000200000120 badaddr: ffffffffa38dbf58 cause: 000000000000000d
[<ffffffff80bd5c7a>] __qdisc_run+0x82/0x6f0
[<ffffffff80b6fe58>] __dev_queue_xmit+0x4c0/0x1128
[<ffffffff80b80ae0>] neigh_resolve_output+0xd0/0x170
[<ffffffff80d2daf6>] ip6_finish_output2+0x226/0x6c8
[<ffffffff80d31254>] ip6_finish_output+0x10c/0x2a0
[<ffffffff80d31446>] ip6_output+0x5e/0x178
[<ffffffff80d2e232>] ip6_xmit+0x29a/0x608
[<ffffffff80d6f4c6>] inet6_csk_xmit+0xe6/0x140
[<ffffffff80c985e4>] __tcp_transmit_skb+0x45c/0xaa8
[<ffffffff80c995fe>] tcp_connect+0x9ce/0xd10
[<ffffffff80d66524>] tcp_v6_connect+0x4ac/0x5e8
[<ffffffff80cc19b8>] __inet_stream_connect+0xd8/0x318
[<ffffffff80cc1c36>] inet_stream_connect+0x3e/0x68
[<ffffffff80b42b20>] __sys_connect_file+0x50/0x88
[<ffffffff80b42bee>] __sys_connect+0x96/0xc8
[<ffffffff80b42c40>] __riscv_sys_connect+0x20/0x30
[<ffffffff80e5bcae>] do_trap_ecall_u+0x256/0x378
[<ffffffff80e69af2>] handle_exception+0x14a/0x156
Code: 892a 0363 1205 489c 8bc1 c7e5 2d03 084a 2703 080a (2783) 0709
---[ end trace 0000000000000000 ]---
The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer
is treated as a 32bit value and sign extend to 64bit in epilogue. This
behavior is right for most bpf prog types but wrong for struct ops which
requires RISC-V ABI.
So let's sign extend struct ops return values according to the function
model and RISC-V ABI([0]).
[0]: https://riscv.org/wp-content/uploads/2024/12/riscv-calling.pdf
Fixes: 25ad10658dc1 ("riscv, bpf: Adapt bpf trampoline to optimized riscv ftrace framework")
Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Pu Lehui <pulehui@huawei.com>
Reviewed-by: Pu Lehui <pulehui@huawei.com>
Link: https://lore.kernel.org/bpf/20250908012448.1695-1-hengqi.chen@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/net/bpf_jit_comp64.c | 42 ++++++++++++++++++++++++++++++++-
1 file changed, 41 insertions(+), 1 deletion(-)
diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
index 9883a55d61b5b..f1efa4d6b27f3 100644
--- a/arch/riscv/net/bpf_jit_comp64.c
+++ b/arch/riscv/net/bpf_jit_comp64.c
@@ -765,6 +765,39 @@ static int emit_atomic_rmw(u8 rd, u8 rs, const struct bpf_insn *insn,
return 0;
}
+/*
+ * Sign-extend the register if necessary
+ */
+static int sign_extend(u8 rd, u8 rs, u8 sz, bool sign, struct rv_jit_context *ctx)
+{
+ if (!sign && (sz == 1 || sz == 2)) {
+ if (rd != rs)
+ emit_mv(rd, rs, ctx);
+ return 0;
+ }
+
+ switch (sz) {
+ case 1:
+ emit_sextb(rd, rs, ctx);
+ break;
+ case 2:
+ emit_sexth(rd, rs, ctx);
+ break;
+ case 4:
+ emit_sextw(rd, rs, ctx);
+ break;
+ case 8:
+ if (rd != rs)
+ emit_mv(rd, rs, ctx);
+ break;
+ default:
+ pr_err("bpf-jit: invalid size %d for sign_extend\n", sz);
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
#define BPF_FIXUP_OFFSET_MASK GENMASK(26, 0)
#define BPF_FIXUP_REG_MASK GENMASK(31, 27)
#define REG_DONT_CLEAR_MARKER 0 /* RV_REG_ZERO unused in pt_regmap */
@@ -1226,8 +1259,15 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
restore_args(min_t(int, nr_arg_slots, RV_MAX_REG_ARGS), args_off, ctx);
if (save_ret) {
- emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx);
emit_ld(regmap[BPF_REG_0], -(retval_off - 8), RV_REG_FP, ctx);
+ if (is_struct_ops) {
+ ret = sign_extend(RV_REG_A0, regmap[BPF_REG_0], m->ret_size,
+ m->ret_flags & BTF_FMODEL_SIGNED_ARG, ctx);
+ if (ret)
+ goto out;
+ } else {
+ emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx);
+ }
}
emit_ld(RV_REG_S1, -sreg_off, RV_REG_FP, ctx);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 162/563] nvme-auth: update bi_directional flag
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 161/563] riscv, bpf: Sign extend struct ops return values properly Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 163/563] nvmet-fc: move lsop put work to nvmet_fc_ls_req_op Greg Kroah-Hartman
` (414 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin George, Hannes Reinecke,
Keith Busch, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin George <martinus.gpy@gmail.com>
[ Upstream commit 6ff1bd7846680dfdaafc68d7fcd0ab7e3bcbc4a0 ]
While setting chap->s2 to zero as part of secure channel
concatenation, the host missed out to disable the bi_directional
flag to indicate that controller authentication is not requested.
Fix the same.
Fixes: e88a7595b57f ("nvme-tcp: request secure channel concatenation")
Signed-off-by: Martin George <marting@netapp.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/auth.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
index 201fc8809a628..012fcfc79a73b 100644
--- a/drivers/nvme/host/auth.c
+++ b/drivers/nvme/host/auth.c
@@ -331,9 +331,10 @@ static int nvme_auth_set_dhchap_reply_data(struct nvme_ctrl *ctrl,
} else {
memset(chap->c2, 0, chap->hash_len);
}
- if (ctrl->opts->concat)
+ if (ctrl->opts->concat) {
chap->s2 = 0;
- else
+ chap->bi_directional = false;
+ } else
chap->s2 = nvme_auth_get_seqnum();
data->seqnum = cpu_to_le32(chap->s2);
if (chap->host_key_len) {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 163/563] nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 162/563] nvme-auth: update bi_directional flag Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 164/563] nvmet-fcloop: call done callback even when remote port is gone Greg Kroah-Hartman
` (413 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hannes Reinecke, Daniel Wagner,
Keith Busch, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <wagi@kernel.org>
[ Upstream commit db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 ]
It’s possible for more than one async command to be in flight from
__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken.
In the current code, only one put work item is queued at a time, which
results in a leaked reference.
To fix this, move the work item to the nvmet_fc_ls_req_op struct, which
already tracks all resources related to the command.
Fixes: 710c69dbaccd ("nvmet-fc: avoid deadlock on delete association path")
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Daniel Wagner <wagi@kernel.org>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/fc.c | 19 +++++++++----------
1 file changed, 9 insertions(+), 10 deletions(-)
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index a9b18c051f5bd..6725c34dd7c90 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -54,6 +54,8 @@ struct nvmet_fc_ls_req_op { /* for an LS RQST XMT */
int ls_error;
struct list_head lsreq_list; /* tgtport->ls_req_list */
bool req_queued;
+
+ struct work_struct put_work;
};
@@ -111,8 +113,6 @@ struct nvmet_fc_tgtport {
struct nvmet_fc_port_entry *pe;
struct kref ref;
u32 max_sg_cnt;
-
- struct work_struct put_work;
};
struct nvmet_fc_port_entry {
@@ -235,12 +235,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc);
static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue);
static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue);
static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport);
-static void nvmet_fc_put_tgtport_work(struct work_struct *work)
+static void nvmet_fc_put_lsop_work(struct work_struct *work)
{
- struct nvmet_fc_tgtport *tgtport =
- container_of(work, struct nvmet_fc_tgtport, put_work);
+ struct nvmet_fc_ls_req_op *lsop =
+ container_of(work, struct nvmet_fc_ls_req_op, put_work);
- nvmet_fc_tgtport_put(tgtport);
+ nvmet_fc_tgtport_put(lsop->tgtport);
+ kfree(lsop);
}
static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport);
static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport,
@@ -367,7 +368,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop)
DMA_BIDIRECTIONAL);
out_putwork:
- queue_work(nvmet_wq, &tgtport->put_work);
+ queue_work(nvmet_wq, &lsop->put_work);
}
static int
@@ -388,6 +389,7 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport,
lsreq->done = done;
lsop->req_queued = false;
INIT_LIST_HEAD(&lsop->lsreq_list);
+ INIT_WORK(&lsop->put_work, nvmet_fc_put_lsop_work);
lsreq->rqstdma = fc_dma_map_single(tgtport->dev, lsreq->rqstaddr,
lsreq->rqstlen + lsreq->rsplen,
@@ -447,8 +449,6 @@ nvmet_fc_disconnect_assoc_done(struct nvmefc_ls_req *lsreq, int status)
__nvmet_fc_finish_ls_req(lsop);
/* fc-nvme target doesn't care about success or failure of cmd */
-
- kfree(lsop);
}
/*
@@ -1410,7 +1410,6 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo,
kref_init(&newrec->ref);
ida_init(&newrec->assoc_cnt);
newrec->max_sg_cnt = template->max_sgl_segments;
- INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work);
ret = nvmet_fc_alloc_ls_iodlist(newrec);
if (ret) {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 164/563] nvmet-fcloop: call done callback even when remote port is gone
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 163/563] nvmet-fc: move lsop put work to nvmet_fc_ls_req_op Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 165/563] nvme-tcp: send only permitted commands for secure concat Greg Kroah-Hartman
` (412 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yi Zhang, Hannes Reinecke,
Daniel Wagner, Keith Busch, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <wagi@kernel.org>
[ Upstream commit 10c165af35d225eb033f4edc7fcc699a8d2d533d ]
When the target port is gone, it's not possible to access any of the
request resources. The function should just silently drop the response.
The comment is misleading in this regard.
Though it's still necessary to call the driver via the ->done callback
so the driver is able to release all resources.
Reported-by: Yi Zhang <yi.zhang@redhat.com>
Closes: https://lore.kernel.org/all/CAHj4cs-OBA0WMt5f7R0dz+rR4HcEz19YLhnyGsj-MRV3jWDsPg@mail.gmail.com/
Fixes: 84eedced1c5b ("nvmet-fcloop: drop response if targetport is gone")
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Daniel Wagner <wagi@kernel.org>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/fcloop.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
index 257b497d515a8..5dffcc5becae8 100644
--- a/drivers/nvme/target/fcloop.c
+++ b/drivers/nvme/target/fcloop.c
@@ -496,13 +496,15 @@ fcloop_t2h_xmt_ls_rsp(struct nvme_fc_local_port *localport,
if (!targetport) {
/*
* The target port is gone. The target doesn't expect any
- * response anymore and the ->done call is not valid
- * because the resources have been freed by
- * nvmet_fc_free_pending_reqs.
+ * response anymore and thus lsreq can't be accessed anymore.
*
* We end up here from delete association exchange:
* nvmet_fc_xmt_disconnect_assoc sends an async request.
+ *
+ * Return success because this is what LLDDs do; silently
+ * drop the response.
*/
+ lsrsp->done(lsrsp);
kmem_cache_free(lsreq_cache, tls_req);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 165/563] nvme-tcp: send only permitted commands for secure concat
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 164/563] nvmet-fcloop: call done callback even when remote port is gone Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 166/563] i3c: master: svc: Use manual response for IBI events Greg Kroah-Hartman
` (411 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin George, Hannes Reinecke,
Keith Busch, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin George <martinus.gpy@gmail.com>
[ Upstream commit df4666a4908a6d883f628f93a3e6c80981332035 ]
In addition to sending permitted commands such as connect/auth
over the initial unencrypted admin connection as part of secure
channel concatenation, the host also sends commands such as
Property Get and Identify on the same. This is a spec violation
leading to secure concat failures. Fix this by ensuring these
additional commands are avoided on this connection.
Fixes: 104d0e2f6222 ("nvme-fabrics: reset admin connection for secure concatenation")
Signed-off-by: Martin George <marting@netapp.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/tcp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index c0fe8cfb7229e..1413788ca7d52 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -2250,6 +2250,9 @@ static int nvme_tcp_configure_admin_queue(struct nvme_ctrl *ctrl, bool new)
if (error)
goto out_cleanup_tagset;
+ if (ctrl->opts->concat && !ctrl->tls_pskid)
+ return 0;
+
error = nvme_enable_ctrl(ctrl);
if (error)
goto out_stop_queue;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 166/563] i3c: master: svc: Use manual response for IBI events
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 165/563] nvme-tcp: send only permitted commands for secure concat Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 167/563] i3c: master: svc: Recycle unused IBI slot Greg Kroah-Hartman
` (410 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stanley Chu, Frank Li,
Alexandre Belloni, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanley Chu <yschu@nuvoton.com>
[ Upstream commit a7869b0a2540fd122eccec00ae7d4243166b0a60 ]
Driver wants to nack the IBI request when the target is not in the
known address list. In below code, svc_i3c_master_nack_ibi() will
cause undefined behavior when using AUTOIBI with auto response rule,
because hw always auto ack the IBI request.
switch (ibitype) {
case SVC_I3C_MSTATUS_IBITYPE_IBI:
dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
svc_i3c_master_nack_ibi(master);
...
break;
AutoIBI has another issue that the controller doesn't quit AutoIBI state
after IBIWON polling timeout when there is a SDA glitch(high->low->high).
1. SDA high->low: raising an interrupt to execute IBI ISR
2. SDA low->high
3. Driver writes an AutoIBI request
4. AutoIBI process does not start because SDA is not low
5. IBIWON polling times out
6. Controller reamins in AutoIBI state and doesn't accept EmitStop request
Emitting broadcast address with IBIRESP_MANUAL avoids both issues.
Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver")
Signed-off-by: Stanley Chu <yschu@nuvoton.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://lore.kernel.org/r/20250829012309.3562585-2-yschu@nuvoton.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i3c/master/svc-i3c-master.c | 30 ++++++++++++++++++++++++-----
1 file changed, 25 insertions(+), 5 deletions(-)
diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
index 701ae165b25b7..8e7b4ab919e3d 100644
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -517,9 +517,24 @@ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master)
*/
writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS);
- /* Acknowledge the incoming interrupt with the AUTOIBI mechanism */
- writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI |
- SVC_I3C_MCTRL_IBIRESP_AUTO,
+ /*
+ * Write REQUEST_START_ADDR request to emit broadcast address for arbitration,
+ * instend of using AUTO_IBI.
+ *
+ * Using AutoIBI request may cause controller to remain in AutoIBI state when
+ * there is a glitch on SDA line (high->low->high).
+ * 1. SDA high->low, raising an interrupt to execute IBI isr.
+ * 2. SDA low->high.
+ * 3. IBI isr writes an AutoIBI request.
+ * 4. The controller will not start AutoIBI process because SDA is not low.
+ * 5. IBIWON polling times out.
+ * 6. Controller reamins in AutoIBI state and doesn't accept EmitStop request.
+ */
+ writel(SVC_I3C_MCTRL_REQUEST_START_ADDR |
+ SVC_I3C_MCTRL_TYPE_I3C |
+ SVC_I3C_MCTRL_IBIRESP_MANUAL |
+ SVC_I3C_MCTRL_DIR(SVC_I3C_MCTRL_DIR_WRITE) |
+ SVC_I3C_MCTRL_ADDR(I3C_BROADCAST_ADDR),
master->regs + SVC_I3C_MCTRL);
/* Wait for IBIWON, should take approximately 100us */
@@ -539,10 +554,15 @@ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master)
switch (ibitype) {
case SVC_I3C_MSTATUS_IBITYPE_IBI:
dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
- if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
+ if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) {
svc_i3c_master_nack_ibi(master);
- else
+ } else {
+ if (dev->info.bcr & I3C_BCR_IBI_PAYLOAD)
+ svc_i3c_master_ack_ibi(master, true);
+ else
+ svc_i3c_master_ack_ibi(master, false);
svc_i3c_master_handle_ibi(master, dev);
+ }
break;
case SVC_I3C_MSTATUS_IBITYPE_HOT_JOIN:
if (is_events_enabled(master, SVC_I3C_EVENT_HOTJOIN))
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 167/563] i3c: master: svc: Recycle unused IBI slot
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 166/563] i3c: master: svc: Use manual response for IBI events Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 168/563] block: update validation of atomic writes boundary for stacked devices Greg Kroah-Hartman
` (409 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stanley Chu, Frank Li,
Alexandre Belloni, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanley Chu <stanley.chuys@gmail.com>
[ Upstream commit 3448a934ba6f803911ac084d05a2ffce507ea6c6 ]
In svc_i3c_master_handle_ibi(), an IBI slot is fetched from the pool
to store the IBI payload. However, when an error condition is encountered,
the function returns without recycling the IBI slot, resulting in an IBI
slot leak.
Fixes: c85e209b799f ("i3c: master: svc: fix ibi may not return mandatory data byte")
Signed-off-by: Stanley Chu <yschu@nuvoton.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://lore.kernel.org/r/20250829012309.3562585-3-yschu@nuvoton.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i3c/master/svc-i3c-master.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
index 8e7b4ab919e3d..9641e66a4e5f2 100644
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -417,6 +417,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master,
SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000);
if (ret) {
dev_err(master->dev, "Timeout when polling for COMPLETE\n");
+ i3c_generic_ibi_recycle_slot(data->ibi_pool, slot);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 168/563] block: update validation of atomic writes boundary for stacked devices
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 167/563] i3c: master: svc: Recycle unused IBI slot Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 169/563] block: fix stacking of atomic writes when atomics are not supported Greg Kroah-Hartman
` (408 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Garry, Martin K. Petersen,
Jens Axboe, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <john.g.garry@oracle.com>
[ Upstream commit bfd4037296bd7e1f95394a2e3daf8e3c1796c3b3 ]
In commit 63d092d1c1b1 ("block: use chunk_sectors when evaluating stacked
atomic write limits"), it was missed to use a chunk sectors limit check
in blk_stack_atomic_writes_boundary_head(), so update that function to
do the proper check.
Fixes: 63d092d1c1b1 ("block: use chunk_sectors when evaluating stacked atomic write limits")
Signed-off-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-settings.c | 22 ++++++++++++++--------
1 file changed, 14 insertions(+), 8 deletions(-)
diff --git a/block/blk-settings.c b/block/blk-settings.c
index 693bc8d20acf3..6760dbf130b24 100644
--- a/block/blk-settings.c
+++ b/block/blk-settings.c
@@ -643,18 +643,24 @@ static bool blk_stack_atomic_writes_tail(struct queue_limits *t,
static bool blk_stack_atomic_writes_boundary_head(struct queue_limits *t,
struct queue_limits *b)
{
+ unsigned int boundary_sectors;
+
+ if (!b->atomic_write_hw_boundary || !t->chunk_sectors)
+ return true;
+
+ boundary_sectors = b->atomic_write_hw_boundary >> SECTOR_SHIFT;
+
/*
* Ensure atomic write boundary is aligned with chunk sectors. Stacked
- * devices store chunk sectors in t->io_min.
+ * devices store any stripe size in t->chunk_sectors.
*/
- if (b->atomic_write_hw_boundary > t->io_min &&
- b->atomic_write_hw_boundary % t->io_min)
+ if (boundary_sectors > t->chunk_sectors &&
+ boundary_sectors % t->chunk_sectors)
return false;
- if (t->io_min > b->atomic_write_hw_boundary &&
- t->io_min % b->atomic_write_hw_boundary)
+ if (t->chunk_sectors > boundary_sectors &&
+ t->chunk_sectors % boundary_sectors)
return false;
- t->atomic_write_hw_boundary = b->atomic_write_hw_boundary;
return true;
}
@@ -695,13 +701,13 @@ static void blk_stack_atomic_writes_chunk_sectors(struct queue_limits *t)
static bool blk_stack_atomic_writes_head(struct queue_limits *t,
struct queue_limits *b)
{
- if (b->atomic_write_hw_boundary &&
- !blk_stack_atomic_writes_boundary_head(t, b))
+ if (!blk_stack_atomic_writes_boundary_head(t, b))
return false;
t->atomic_write_hw_unit_max = b->atomic_write_hw_unit_max;
t->atomic_write_hw_unit_min = b->atomic_write_hw_unit_min;
t->atomic_write_hw_max = b->atomic_write_hw_max;
+ t->atomic_write_hw_boundary = b->atomic_write_hw_boundary;
return true;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 169/563] block: fix stacking of atomic writes when atomics are not supported
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 168/563] block: update validation of atomic writes boundary for stacked devices Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 170/563] selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING " Greg Kroah-Hartman
` (407 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Garry, Martin K. Petersen,
Jens Axboe, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <john.g.garry@oracle.com>
[ Upstream commit f2d8c5a2f79c28569edf4948b611052253b5e99a ]
Atomic writes support may not always be possible when stacking devices
which support atomic writes. Such as case is a different atomic write
boundary between stacked devices (which is not supported).
In the case that atomic writes cannot supported, the top device queue HW
limits are set to 0.
However, in blk_stack_atomic_writes_limits(), we detect that we are
stacking the first bottom device by checking the top device
atomic_write_hw_max value == 0. This get confused with the case of atomic
writes not supported, above.
Make the distinction between stacking the first bottom device and no
atomics supported by initializing stacked device atomic_write_hw_max =
UINT_MAX and checking that for stacking the first bottom device.
Fixes: d7f36dc446e8 ("block: Support atomic writes limits for stacked devices")
Signed-off-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-settings.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/block/blk-settings.c b/block/blk-settings.c
index 6760dbf130b24..8fa52914e16b0 100644
--- a/block/blk-settings.c
+++ b/block/blk-settings.c
@@ -56,6 +56,7 @@ void blk_set_stacking_limits(struct queue_limits *lim)
lim->max_user_wzeroes_unmap_sectors = UINT_MAX;
lim->max_hw_zone_append_sectors = UINT_MAX;
lim->max_user_discard_sectors = UINT_MAX;
+ lim->atomic_write_hw_max = UINT_MAX;
}
EXPORT_SYMBOL(blk_set_stacking_limits);
@@ -232,6 +233,10 @@ static void blk_validate_atomic_write_limits(struct queue_limits *lim)
if (!(lim->features & BLK_FEAT_ATOMIC_WRITES))
goto unsupported;
+ /* UINT_MAX indicates stacked limits in initial state */
+ if (lim->atomic_write_hw_max == UINT_MAX)
+ goto unsupported;
+
if (!lim->atomic_write_hw_max)
goto unsupported;
@@ -723,18 +728,14 @@ static void blk_stack_atomic_writes_limits(struct queue_limits *t,
if (!blk_atomic_write_start_sect_aligned(start, b))
goto unsupported;
- /*
- * If atomic_write_hw_max is set, we have already stacked 1x bottom
- * device, so check for compliance.
- */
- if (t->atomic_write_hw_max) {
+ /* UINT_MAX indicates no stacking of bottom devices yet */
+ if (t->atomic_write_hw_max == UINT_MAX) {
+ if (!blk_stack_atomic_writes_head(t, b))
+ goto unsupported;
+ } else {
if (!blk_stack_atomic_writes_tail(t, b))
goto unsupported;
- return;
}
-
- if (!blk_stack_atomic_writes_head(t, b))
- goto unsupported;
blk_stack_atomic_writes_chunk_sectors(t);
return;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 170/563] selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 169/563] block: fix stacking of atomic writes when atomics are not supported Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 171/563] selftests/kselftest_harness: Add harness-selftest.expected to TEST_FILES Greg Kroah-Hartman
` (406 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Akhilesh Patil, Shuah Khan,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ]
Check if watchdog device supports WDIOF_KEEPALIVEPING option before
entering keep_alive() ping test loop. Fix watchdog-test silently looping
if ioctl based ping is not supported by the device. Exit from test in
such case instead of getting stuck in loop executing failing keep_alive()
watchdog_info:
identity: m41t93 rtc Watchdog
firmware_version: 0
Support/Status: Set timeout (in seconds)
Support/Status: Watchdog triggers a management or other external alarm not a reboot
Watchdog card disabled.
Watchdog timeout set to 5 seconds.
Watchdog ping rate set to 2 seconds.
Watchdog card enabled.
WDIOC_KEEPALIVE not supported by this device
without this change
Watchdog card disabled.
Watchdog timeout set to 5 seconds.
Watchdog ping rate set to 2 seconds.
Watchdog card enabled.
Watchdog Ticking Away!
(Where test stuck here forver silently)
Updated change log at commit time:
Shuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/20250914152840.GA3047348@bhairav-test.ee.iitb.ac.in
Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path")
Signed-off-by: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c
index a1f506ba55786..4f09c5db0c7f3 100644
--- a/tools/testing/selftests/watchdog/watchdog-test.c
+++ b/tools/testing/selftests/watchdog/watchdog-test.c
@@ -332,6 +332,12 @@ int main(int argc, char *argv[])
if (oneshot)
goto end;
+ /* Check if WDIOF_KEEPALIVEPING is supported */
+ if (!(info.options & WDIOF_KEEPALIVEPING)) {
+ printf("WDIOC_KEEPALIVE not supported by this device\n");
+ goto end;
+ }
+
printf("Watchdog Ticking Away!\n");
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 171/563] selftests/kselftest_harness: Add harness-selftest.expected to TEST_FILES
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 170/563] selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING " Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 172/563] blk-throttle: fix throtl_data leak during disk release Greg Kroah-Hartman
` (405 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yi Lai, Thomas Weißschuh,
Shuah Khan, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Lai <yi1.lai@intel.com>
[ Upstream commit 3e23a3f688b457288c37899f8898180cc231ff97 ]
The harness-selftest.expected is not installed in INSTALL_PATH.
Attempting to execute harness-selftest.sh shows warning:
diff: ./kselftest_harness/harness-selftest.expected: No such file or
directory
Add harness-selftest.expected to TEST_FILES.
Link: https://lore.kernel.org/r/20250909082619.584470-1-yi1.lai@intel.com
Fixes: df82ffc5a3c1 ("selftests: harness: Add kselftest harness selftest")
Signed-off-by: Yi Lai <yi1.lai@intel.com>
Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/kselftest_harness/Makefile | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/testing/selftests/kselftest_harness/Makefile b/tools/testing/selftests/kselftest_harness/Makefile
index 0617535a6ce42..d2369c01701a0 100644
--- a/tools/testing/selftests/kselftest_harness/Makefile
+++ b/tools/testing/selftests/kselftest_harness/Makefile
@@ -2,6 +2,7 @@
TEST_GEN_PROGS_EXTENDED := harness-selftest
TEST_PROGS := harness-selftest.sh
+TEST_FILES := harness-selftest.expected
EXTRA_CLEAN := harness-selftest.seen
include ../lib.mk
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 172/563] blk-throttle: fix throtl_data leak during disk release
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 171/563] selftests/kselftest_harness: Add harness-selftest.expected to TEST_FILES Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 173/563] bpf: Explicitly check accesses to bpf_sock_addr Greg Kroah-Hartman
` (404 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yi Zhang, Yu Kuai, Jens Axboe,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit 336aec7b06be860477be80a4299263a2e9355789 ]
Tightening the throttle activation check in blk_throtl_activated() to
require both q->td presence and policy bit set introduced a memory leak
during disk release:
blkg_destroy_all() clears the policy bit first during queue deactivation,
causing subsequent blk_throtl_exit() to skip throtl_data cleanup when
blk_throtl_activated() fails policy check.
Idealy we should avoid modifying blk_throtl_exit() activation check because
it's intuitive that blk-throtl start from blk_throtl_init() and end in
blk_throtl_exit(). However, call blk_throtl_exit() before
blkg_destroy_all() will make a long term deadlock problem easier to
trigger[1], hence fix this problem by checking if q->td is NULL from
blk_throtl_exit(), and remove policy deactivation as well since it's
useless.
[1] https://lore.kernel.org/all/CAHj4cs9p9H5yx+ywsb3CMUdbqGPhM+8tuBvhW=9ADiCjAqza9w@mail.gmail.com/#t
Fixes: bd9fd5be6bc0 ("blk-throttle: fix access race during throttle policy activation")
Reported-by: Yi Zhang <yi.zhang@redhat.com>
Closes: https://lore.kernel.org/all/CAHj4cs-p-ZwBEKigBj7T6hQCOo-H68-kVwCrV6ZvRovrr9Z+HA@mail.gmail.com/
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-throttle.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index f510ae072868c..2c5b64b1a724a 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -1842,12 +1842,15 @@ void blk_throtl_exit(struct gendisk *disk)
{
struct request_queue *q = disk->queue;
- if (!blk_throtl_activated(q))
+ /*
+ * blkg_destroy_all() already deactivate throtl policy, just check and
+ * free throtl data.
+ */
+ if (!q->td)
return;
timer_delete_sync(&q->td->service_queue.pending_timer);
throtl_shutdown_wq(q);
- blkcg_deactivate_policy(disk, &blkcg_policy_throtl);
kfree(q->td);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 173/563] bpf: Explicitly check accesses to bpf_sock_addr
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 172/563] blk-throttle: fix throtl_data leak during disk release Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 174/563] mmc: select REGMAP_MMIO with MMC_LOONGSON2 Greg Kroah-Hartman
` (403 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+136ca59d411f92e821b7,
Paul Chaignon, Daniel Borkmann, Eduard Zingerman, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Chaignon <paul.chaignon@gmail.com>
[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ]
Syzkaller found a kernel warning on the following sock_addr program:
0: r0 = 0
1: r2 = *(u32 *)(r1 +60)
2: exit
which triggers:
verifier bug: error during ctx access conversion (0)
This is happening because offset 60 in bpf_sock_addr corresponds to an
implicit padding of 4 bytes, right after msg_src_ip4. Access to this
padding isn't rejected in sock_addr_is_valid_access and it thus later
fails to convert the access.
This patch fixes it by explicitly checking the various fields of
bpf_sock_addr in sock_addr_is_valid_access.
I checked the other ctx structures and is_valid_access functions and
didn't find any other similar cases. Other cases of (properly handled)
padding are covered in new tests in a subsequent patch.
Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg")
Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7
Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/filter.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index da391e2b0788d..2d326d35c3871 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -9284,13 +9284,17 @@ static bool sock_addr_is_valid_access(int off, int size,
return false;
info->reg_type = PTR_TO_SOCKET;
break;
- default:
- if (type == BPF_READ) {
- if (size != size_default)
- return false;
- } else {
+ case bpf_ctx_range(struct bpf_sock_addr, user_family):
+ case bpf_ctx_range(struct bpf_sock_addr, family):
+ case bpf_ctx_range(struct bpf_sock_addr, type):
+ case bpf_ctx_range(struct bpf_sock_addr, protocol):
+ if (type != BPF_READ)
return false;
- }
+ if (size != size_default)
+ return false;
+ break;
+ default:
+ return false;
}
return true;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 174/563] mmc: select REGMAP_MMIO with MMC_LOONGSON2
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 173/563] bpf: Explicitly check accesses to bpf_sock_addr Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 175/563] selftests/futex: Fix futex_wait() for 32bit ARM Greg Kroah-Hartman
` (402 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Binbin Zhou,
Mikko Rapeli, Ulf Hansson, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Rapeli <mikko.rapeli@linaro.org>
[ Upstream commit 67da3f16e5f97a864a0beb4f9758d09e1890a76e ]
COMPILE_TEST with MMC_LOONGSON2 failed to link due to
undeclared dependency:
ERROR: modpost: "__devm_regmap_init_mmio_clk"
[drivers/mmc/host/loongson2-mmc.ko] undefined!
Fixes: 2115772014bd ("mmc: loongson2: Add Loongson-2K SD/SDIO controller driver")
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Suggested-by: Binbin Zhou <zhoubinbin@loongson.cn>
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index 7232de1c06887..5cc415ba4f550 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -1115,6 +1115,7 @@ config MMC_LOONGSON2
tristate "Loongson-2K SD/SDIO/eMMC Host Interface support"
depends on LOONGARCH || COMPILE_TEST
depends on HAS_DMA
+ select REGMAP_MMIO
help
This selects support for the SD/SDIO/eMMC Host Controller on
Loongson-2K series CPUs.
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 175/563] selftests/futex: Fix futex_wait() for 32bit ARM
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 174/563] mmc: select REGMAP_MMIO with MMC_LOONGSON2 Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 176/563] selftest/futex: Make the error check more precise for futex_numa_mpol Greg Kroah-Hartman
` (401 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter,
Sebastian Andrzej Siewior, Borislav Petkov (AMD),
André Almeida, Anders Roxell, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 237bfb76c90b184f57bb18fe35ff366c19393dc8 ]
On 32bit ARM systems gcc-12 will use 32bit timestamps while gcc-13 and later
will use 64bit timestamps. The problem is that SYS_futex will continue
pointing at the 32bit system call. This makes the futex_wait test fail like
this:
waiter failed errno 110
not ok 1 futex_wake private returned: 0 Success
waiter failed errno 110
not ok 2 futex_wake shared (page anon) returned: 0 Success
waiter failed errno 110
not ok 3 futex_wake shared (file backed) returned: 0 Success
Instead of compiling differently depending on the gcc version, use the
-D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64 options to ensure that 64bit timestamps
are used. Then use ifdefs to make SYS_futex point to the 64bit system call.
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: André Almeida <andrealmeid@igalia.com>
Tested-by: Anders Roxell <anders.roxell@linaro.org>
Link: https://lore.kernel.org/20250827130011.677600-6-bigeasy@linutronix.de
Stable-dep-of: ed323aeda5e0 ("selftest/futex: Compile also with libnuma < 2.0.16")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/futex/functional/Makefile | 2 +-
tools/testing/selftests/futex/include/futextest.h | 11 +++++++++++
2 files changed, 12 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/futex/functional/Makefile b/tools/testing/selftests/futex/functional/Makefile
index 8cfb87f7f7c50..ddfa61d857b9b 100644
--- a/tools/testing/selftests/futex/functional/Makefile
+++ b/tools/testing/selftests/futex/functional/Makefile
@@ -1,6 +1,6 @@
# SPDX-License-Identifier: GPL-2.0
INCLUDES := -I../include -I../../ $(KHDR_INCLUDES)
-CFLAGS := $(CFLAGS) -g -O2 -Wall -pthread $(INCLUDES) $(KHDR_INCLUDES)
+CFLAGS := $(CFLAGS) -g -O2 -Wall -pthread -D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64 $(INCLUDES) $(KHDR_INCLUDES)
LDLIBS := -lpthread -lrt -lnuma
LOCAL_HDRS := \
diff --git a/tools/testing/selftests/futex/include/futextest.h b/tools/testing/selftests/futex/include/futextest.h
index 7a5fd1d5355e7..3d48e9789d9fe 100644
--- a/tools/testing/selftests/futex/include/futextest.h
+++ b/tools/testing/selftests/futex/include/futextest.h
@@ -58,6 +58,17 @@ typedef volatile u_int32_t futex_t;
#define SYS_futex SYS_futex_time64
#endif
+/*
+ * On 32bit systems if we use "-D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64" or if
+ * we are using a newer compiler then the size of the timestamps will be 64bit,
+ * however, the SYS_futex will still point to the 32bit futex system call.
+ */
+#if __SIZEOF_POINTER__ == 4 && defined(SYS_futex_time64) && \
+ defined(_TIME_BITS) && _TIME_BITS == 64
+# undef SYS_futex
+# define SYS_futex SYS_futex_time64
+#endif
+
/**
* futex() - SYS_futex syscall wrapper
* @uaddr: address of first futex
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 176/563] selftest/futex: Make the error check more precise for futex_numa_mpol
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 175/563] selftests/futex: Fix futex_wait() for 32bit ARM Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 177/563] selftest/futex: Compile also with libnuma < 2.0.16 Greg Kroah-Hartman
` (400 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, André Almeida,
Sebastian Andrzej Siewior, Peter Zijlstra (Intel), Waiman Long,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Almeida <andrealmeid@igalia.com>
[ Upstream commit c1c863457780adfb2e29fa9a85897179ad3903e6 ]
Instead of just checking if the syscall failed as expected, check as
well if the returned error code matches the expected error code.
[ bigeasy: reword the commmit message ]
Signed-off-by: André Almeida <andrealmeid@igalia.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Waiman Long <longman@redhat.com>
Stable-dep-of: ed323aeda5e0 ("selftest/futex: Compile also with libnuma < 2.0.16")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../futex/functional/futex_numa_mpol.c | 36 +++++++++++--------
1 file changed, 21 insertions(+), 15 deletions(-)
diff --git a/tools/testing/selftests/futex/functional/futex_numa_mpol.c b/tools/testing/selftests/futex/functional/futex_numa_mpol.c
index 802c15c821906..dd7b05e8cda45 100644
--- a/tools/testing/selftests/futex/functional/futex_numa_mpol.c
+++ b/tools/testing/selftests/futex/functional/futex_numa_mpol.c
@@ -77,7 +77,7 @@ static void join_max_threads(void)
}
}
-static void __test_futex(void *futex_ptr, int must_fail, unsigned int futex_flags)
+static void __test_futex(void *futex_ptr, int err_value, unsigned int futex_flags)
{
int to_wake, ret, i, need_exit = 0;
@@ -88,11 +88,17 @@ static void __test_futex(void *futex_ptr, int must_fail, unsigned int futex_flag
do {
ret = futex2_wake(futex_ptr, to_wake, futex_flags);
- if (must_fail) {
- if (ret < 0)
- break;
- ksft_exit_fail_msg("futex2_wake(%d, 0x%x) should fail, but didn't\n",
- to_wake, futex_flags);
+
+ if (err_value) {
+ if (ret >= 0)
+ ksft_exit_fail_msg("futex2_wake(%d, 0x%x) should fail, but didn't\n",
+ to_wake, futex_flags);
+
+ if (errno != err_value)
+ ksft_exit_fail_msg("futex2_wake(%d, 0x%x) expected error was %d, but returned %d (%s)\n",
+ to_wake, futex_flags, err_value, errno, strerror(errno));
+
+ break;
}
if (ret < 0) {
ksft_exit_fail_msg("Failed futex2_wake(%d, 0x%x): %m\n",
@@ -106,12 +112,12 @@ static void __test_futex(void *futex_ptr, int must_fail, unsigned int futex_flag
join_max_threads();
for (i = 0; i < MAX_THREADS; i++) {
- if (must_fail && thread_args[i].result != -1) {
+ if (err_value && thread_args[i].result != -1) {
ksft_print_msg("Thread %d should fail but succeeded (%d)\n",
i, thread_args[i].result);
need_exit = 1;
}
- if (!must_fail && thread_args[i].result != 0) {
+ if (!err_value && thread_args[i].result != 0) {
ksft_print_msg("Thread %d failed (%d)\n", i, thread_args[i].result);
need_exit = 1;
}
@@ -120,14 +126,14 @@ static void __test_futex(void *futex_ptr, int must_fail, unsigned int futex_flag
ksft_exit_fail_msg("Aborting due to earlier errors.\n");
}
-static void test_futex(void *futex_ptr, int must_fail)
+static void test_futex(void *futex_ptr, int err_value)
{
- __test_futex(futex_ptr, must_fail, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA);
+ __test_futex(futex_ptr, err_value, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA);
}
-static void test_futex_mpol(void *futex_ptr, int must_fail)
+static void test_futex_mpol(void *futex_ptr, int err_value)
{
- __test_futex(futex_ptr, must_fail, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA | FUTEX2_MPOL);
+ __test_futex(futex_ptr, err_value, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA | FUTEX2_MPOL);
}
static void usage(char *prog)
@@ -184,16 +190,16 @@ int main(int argc, char *argv[])
/* FUTEX2_NUMA futex must be 8-byte aligned */
ksft_print_msg("Mis-aligned futex\n");
- test_futex(futex_ptr + mem_size - 4, 1);
+ test_futex(futex_ptr + mem_size - 4, EINVAL);
futex_numa->numa = FUTEX_NO_NODE;
mprotect(futex_ptr, mem_size, PROT_READ);
ksft_print_msg("Memory, RO\n");
- test_futex(futex_ptr, 1);
+ test_futex(futex_ptr, EFAULT);
mprotect(futex_ptr, mem_size, PROT_NONE);
ksft_print_msg("Memory, no access\n");
- test_futex(futex_ptr, 1);
+ test_futex(futex_ptr, EFAULT);
mprotect(futex_ptr, mem_size, PROT_READ | PROT_WRITE);
ksft_print_msg("Memory back to RW\n");
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 177/563] selftest/futex: Compile also with libnuma < 2.0.16
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 176/563] selftest/futex: Make the error check more precise for futex_numa_mpol Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 178/563] bpf: dont report verifier bug for missing bpf_scc_visit on speculative path Greg Kroah-Hartman
` (399 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot,
Sebastian Andrzej Siewior, Peter Zijlstra (Intel), Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ Upstream commit ed323aeda5e09fa1ab95946673939c8c425c329c ]
After using numa_set_mempolicy_home_node() the test fails to compile on
systems with libnuma library versioned lower than 2.0.16.
In order to allow lower library version add a pkg-config related check
and exclude that part of the code. Without the proper MPOL setup it
can't be tested.
Make a total number of tests two. The first one is the first batch and
the second is the MPOL related one. The goal is to let the user know if
it has been skipped due to library limitation.
Remove test_futex_mpol(), it was unused and it is now complained by the
compiler if the part is not compiled.
Fixes: 0ecb4232fc65e ("selftests/futex: Set the home_node in futex_numa_mpol")
Closes: https://lore.kernel.org/oe-lkp/202507150858.bedaf012-lkp@intel.com
Reported-by: kernel test robot <oliver.sang@intel.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../selftests/futex/functional/Makefile | 5 ++++-
.../futex/functional/futex_numa_mpol.c | 21 +++++++++----------
2 files changed, 14 insertions(+), 12 deletions(-)
diff --git a/tools/testing/selftests/futex/functional/Makefile b/tools/testing/selftests/futex/functional/Makefile
index ddfa61d857b9b..bd50aecfca8a3 100644
--- a/tools/testing/selftests/futex/functional/Makefile
+++ b/tools/testing/selftests/futex/functional/Makefile
@@ -1,6 +1,9 @@
# SPDX-License-Identifier: GPL-2.0
+PKG_CONFIG ?= pkg-config
+LIBNUMA_TEST = $(shell sh -c "$(PKG_CONFIG) numa --atleast-version 2.0.16 > /dev/null 2>&1 && echo SUFFICIENT || echo NO")
+
INCLUDES := -I../include -I../../ $(KHDR_INCLUDES)
-CFLAGS := $(CFLAGS) -g -O2 -Wall -pthread -D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64 $(INCLUDES) $(KHDR_INCLUDES)
+CFLAGS := $(CFLAGS) -g -O2 -Wall -pthread -D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64 $(INCLUDES) $(KHDR_INCLUDES) -DLIBNUMA_VER_$(LIBNUMA_TEST)=1
LDLIBS := -lpthread -lrt -lnuma
LOCAL_HDRS := \
diff --git a/tools/testing/selftests/futex/functional/futex_numa_mpol.c b/tools/testing/selftests/futex/functional/futex_numa_mpol.c
index dd7b05e8cda45..7f2b2e1ff9f8a 100644
--- a/tools/testing/selftests/futex/functional/futex_numa_mpol.c
+++ b/tools/testing/selftests/futex/functional/futex_numa_mpol.c
@@ -131,11 +131,6 @@ static void test_futex(void *futex_ptr, int err_value)
__test_futex(futex_ptr, err_value, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA);
}
-static void test_futex_mpol(void *futex_ptr, int err_value)
-{
- __test_futex(futex_ptr, err_value, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA | FUTEX2_MPOL);
-}
-
static void usage(char *prog)
{
printf("Usage: %s\n", prog);
@@ -148,7 +143,7 @@ static void usage(char *prog)
int main(int argc, char *argv[])
{
struct futex32_numa *futex_numa;
- int mem_size, i;
+ int mem_size;
void *futex_ptr;
int c;
@@ -171,7 +166,7 @@ int main(int argc, char *argv[])
}
ksft_print_header();
- ksft_set_plan(1);
+ ksft_set_plan(2);
mem_size = sysconf(_SC_PAGE_SIZE);
futex_ptr = mmap(NULL, mem_size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
@@ -205,8 +200,11 @@ int main(int argc, char *argv[])
ksft_print_msg("Memory back to RW\n");
test_futex(futex_ptr, 0);
+ ksft_test_result_pass("futex2 memory boundarie tests passed\n");
+
/* MPOL test. Does not work as expected */
- for (i = 0; i < 4; i++) {
+#ifdef LIBNUMA_VER_SUFFICIENT
+ for (int i = 0; i < 4; i++) {
unsigned long nodemask;
int ret;
@@ -225,15 +223,16 @@ int main(int argc, char *argv[])
ret = futex2_wake(futex_ptr, 0, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA | FUTEX2_MPOL);
if (ret < 0)
ksft_test_result_fail("Failed to wake 0 with MPOL: %m\n");
- if (0)
- test_futex_mpol(futex_numa, 0);
if (futex_numa->numa != i) {
ksft_exit_fail_msg("Returned NUMA node is %d expected %d\n",
futex_numa->numa, i);
}
}
}
- ksft_test_result_pass("NUMA MPOL tests passed\n");
+ ksft_test_result_pass("futex2 MPOL hints test passed\n");
+#else
+ ksft_test_result_skip("futex2 MPOL hints test requires libnuma 2.0.16+\n");
+#endif
ksft_finished();
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 178/563] bpf: dont report verifier bug for missing bpf_scc_visit on speculative path
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 177/563] selftest/futex: Compile also with libnuma < 2.0.16 Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 179/563] bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() Greg Kroah-Hartman
` (398 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+3afc814e8df1af64b653,
Eduard Zingerman, Alexei Starovoitov, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eduard Zingerman <eddyz87@gmail.com>
[ Upstream commit a3c73d629ea1373af3c0c954d41fd1af555492e3 ]
Syzbot generated a program that triggers a verifier_bug() call in
maybe_exit_scc(). maybe_exit_scc() assumes that, when called for a
state with insn_idx in some SCC, there should be an instance of struct
bpf_scc_visit allocated for that SCC. Turns out the assumption does
not hold for speculative execution paths. See example in the next
patch.
maybe_scc_exit() is called from update_branch_counts() for states that
reach branch count of zero, meaning that path exploration for a
particular path is finished. Path exploration can finish in one of
three ways:
a. Verification error is found. In this case, update_branch_counts()
is called only for non-speculative paths.
b. Top level BPF_EXIT is reached. Such instructions are never a part of
an SCC, so compute_scc_callchain() in maybe_scc_exit() will return
false, and maybe_scc_exit() will return early.
c. A checkpoint is reached and matched. Checkpoints are created by
is_state_visited(), which calls maybe_enter_scc(), which allocates
bpf_scc_visit instances for checkpoints within SCCs.
Hence, for non-speculative symbolic execution paths, the assumption
still holds: if maybe_scc_exit() is called for a state within an SCC,
bpf_scc_visit instance must exist.
This patch removes the verifier_bug() call for speculative paths.
Fixes: c9e31900b54c ("bpf: propagate read/precision marks over state graph backedges")
Reported-by: syzbot+3afc814e8df1af64b653@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/bpf/68c85acd.050a0220.2ff435.03a4.GAE@google.com/
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20250916212251.3490455-1-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 21 ++++++++++++++++++---
1 file changed, 18 insertions(+), 3 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 9fb1f957a0937..6ad0dc226183a 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1946,9 +1946,24 @@ static int maybe_exit_scc(struct bpf_verifier_env *env, struct bpf_verifier_stat
return 0;
visit = scc_visit_lookup(env, callchain);
if (!visit) {
- verifier_bug(env, "scc exit: no visit info for call chain %s",
- format_callchain(env, callchain));
- return -EFAULT;
+ /*
+ * If path traversal stops inside an SCC, corresponding bpf_scc_visit
+ * must exist for non-speculative paths. For non-speculative paths
+ * traversal stops when:
+ * a. Verification error is found, maybe_exit_scc() is not called.
+ * b. Top level BPF_EXIT is reached. Top level BPF_EXIT is not a member
+ * of any SCC.
+ * c. A checkpoint is reached and matched. Checkpoints are created by
+ * is_state_visited(), which calls maybe_enter_scc(), which allocates
+ * bpf_scc_visit instances for checkpoints within SCCs.
+ * (c) is the only case that can reach this point.
+ */
+ if (!st->speculative) {
+ verifier_bug(env, "scc exit: no visit info for call chain %s",
+ format_callchain(env, callchain));
+ return -EFAULT;
+ }
+ return 0;
}
if (visit->entry_state != st)
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 179/563] bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 178/563] bpf: dont report verifier bug for missing bpf_scc_visit on speculative path Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 180/563] arm64: dts: apple: t600x: Add missing WiFi properties Greg Kroah-Hartman
` (397 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Puranjay Mohan, Hengqi Chen,
Song Liu, Alexei Starovoitov, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengqi Chen <hengqi.chen@gmail.com>
[ Upstream commit 6ff4a0fa3e1b2b9756254b477fb2f0fbe04ff378 ]
The current implementation seems incorrect and does NOT match the
comment above, use bpf_jit_binary_pack_finalize() instead.
Fixes: 1dad391daef1 ("bpf, arm64: use bpf_prog_pack for memory management")
Acked-by: Puranjay Mohan <puranjay@kernel.org>
Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
Acked-by: Song Liu <song@kernel.org>
Acked-by: Puranjay Mohan <puranjay@kernel.org>
Link: https://lore.kernel.org/r/20250916232653.101004-1-hengqi.chen@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/net/bpf_jit_comp.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index 52ffe115a8c47..4ef9b7b8fb404 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -3064,8 +3064,7 @@ void bpf_jit_free(struct bpf_prog *prog)
* before freeing it.
*/
if (jit_data) {
- bpf_arch_text_copy(&jit_data->ro_header->size, &jit_data->header->size,
- sizeof(jit_data->header->size));
+ bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header);
kfree(jit_data);
}
prog->bpf_func -= cfi_get_offset();
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 180/563] arm64: dts: apple: t600x: Add missing WiFi properties
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 179/563] bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 181/563] arm64: dts: apple: t600x: Add bluetooth device nodes Greg Kroah-Hartman
` (396 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hector Martin, Neal Gompa,
Sven Peter, Janne Grunau, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hector Martin <marcan@marcan.st>
[ Upstream commit 3050713d84f58d2e4ba463c5474092fa6738c527 ]
Add compatible and antenna-sku properties to the shared node and
brcm,board-type property to individuall board device trees.
Signed-off-by: Hector Martin <marcan@marcan.st>
Reviewed-by: Neal Gompa <neal@gompa.dev>
Reviewed-by: Sven Peter <sven@kernel.org>
Signed-off-by: Janne Grunau <j@jannau.net>
Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-2-6dc0daeb4786@jannau.net
Signed-off-by: Sven Peter <sven@kernel.org>
Stable-dep-of: 6313115c55f4 ("arm64: dts: apple: Add ethernet0 alias for J375 template")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/apple/t6000-j314s.dts | 4 ++++
arch/arm64/boot/dts/apple/t6000-j316s.dts | 4 ++++
arch/arm64/boot/dts/apple/t6001-j314c.dts | 4 ++++
arch/arm64/boot/dts/apple/t6001-j316c.dts | 4 ++++
arch/arm64/boot/dts/apple/t6001-j375c.dts | 4 ++++
arch/arm64/boot/dts/apple/t6002-j375d.dts | 4 ++++
arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi | 2 ++
arch/arm64/boot/dts/apple/t600x-j375.dtsi | 2 ++
8 files changed, 28 insertions(+)
diff --git a/arch/arm64/boot/dts/apple/t6000-j314s.dts b/arch/arm64/boot/dts/apple/t6000-j314s.dts
index c9e192848fe3f..ac35870ca129c 100644
--- a/arch/arm64/boot/dts/apple/t6000-j314s.dts
+++ b/arch/arm64/boot/dts/apple/t6000-j314s.dts
@@ -16,3 +16,7 @@ / {
compatible = "apple,j314s", "apple,t6000", "apple,arm-platform";
model = "Apple MacBook Pro (14-inch, M1 Pro, 2021)";
};
+
+&wifi0 {
+ brcm,board-type = "apple,maldives";
+};
diff --git a/arch/arm64/boot/dts/apple/t6000-j316s.dts b/arch/arm64/boot/dts/apple/t6000-j316s.dts
index ff1803ce23001..77d6d8c14d741 100644
--- a/arch/arm64/boot/dts/apple/t6000-j316s.dts
+++ b/arch/arm64/boot/dts/apple/t6000-j316s.dts
@@ -16,3 +16,7 @@ / {
compatible = "apple,j316s", "apple,t6000", "apple,arm-platform";
model = "Apple MacBook Pro (16-inch, M1 Pro, 2021)";
};
+
+&wifi0 {
+ brcm,board-type = "apple,madagascar";
+};
diff --git a/arch/arm64/boot/dts/apple/t6001-j314c.dts b/arch/arm64/boot/dts/apple/t6001-j314c.dts
index 1761d15b98c12..0a5655792a8f1 100644
--- a/arch/arm64/boot/dts/apple/t6001-j314c.dts
+++ b/arch/arm64/boot/dts/apple/t6001-j314c.dts
@@ -16,3 +16,7 @@ / {
compatible = "apple,j314c", "apple,t6001", "apple,arm-platform";
model = "Apple MacBook Pro (14-inch, M1 Max, 2021)";
};
+
+&wifi0 {
+ brcm,board-type = "apple,maldives";
+};
diff --git a/arch/arm64/boot/dts/apple/t6001-j316c.dts b/arch/arm64/boot/dts/apple/t6001-j316c.dts
index 750e9beeffc0a..9c215531ea543 100644
--- a/arch/arm64/boot/dts/apple/t6001-j316c.dts
+++ b/arch/arm64/boot/dts/apple/t6001-j316c.dts
@@ -16,3 +16,7 @@ / {
compatible = "apple,j316c", "apple,t6001", "apple,arm-platform";
model = "Apple MacBook Pro (16-inch, M1 Max, 2021)";
};
+
+&wifi0 {
+ brcm,board-type = "apple,madagascar";
+};
diff --git a/arch/arm64/boot/dts/apple/t6001-j375c.dts b/arch/arm64/boot/dts/apple/t6001-j375c.dts
index 62ea437b58b25..88ca2037556ce 100644
--- a/arch/arm64/boot/dts/apple/t6001-j375c.dts
+++ b/arch/arm64/boot/dts/apple/t6001-j375c.dts
@@ -16,3 +16,7 @@ / {
compatible = "apple,j375c", "apple,t6001", "apple,arm-platform";
model = "Apple Mac Studio (M1 Max, 2022)";
};
+
+&wifi0 {
+ brcm,board-type = "apple,okinawa";
+};
diff --git a/arch/arm64/boot/dts/apple/t6002-j375d.dts b/arch/arm64/boot/dts/apple/t6002-j375d.dts
index 3365429bdc8be..f56d13b37eaff 100644
--- a/arch/arm64/boot/dts/apple/t6002-j375d.dts
+++ b/arch/arm64/boot/dts/apple/t6002-j375d.dts
@@ -38,6 +38,10 @@ hpm5: usb-pd@3a {
};
};
+&wifi0 {
+ brcm,board-type = "apple,okinawa";
+};
+
/* delete unused always-on power-domains on die 1 */
/delete-node/ &ps_atc2_usb_aon_die1;
diff --git a/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi b/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi
index 22ebc78e120bf..b699672a5543c 100644
--- a/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi
+++ b/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi
@@ -99,9 +99,11 @@ &port00 {
/* WLAN */
bus-range = <1 1>;
wifi0: wifi@0,0 {
+ compatible = "pci14e4,4433";
reg = <0x10000 0x0 0x0 0x0 0x0>;
/* To be filled by the loader */
local-mac-address = [00 10 18 00 00 10];
+ apple,antenna-sku = "XX";
};
};
diff --git a/arch/arm64/boot/dts/apple/t600x-j375.dtsi b/arch/arm64/boot/dts/apple/t600x-j375.dtsi
index d5b985ad56793..95560bf3798bf 100644
--- a/arch/arm64/boot/dts/apple/t600x-j375.dtsi
+++ b/arch/arm64/boot/dts/apple/t600x-j375.dtsi
@@ -84,9 +84,11 @@ &port00 {
/* WLAN */
bus-range = <1 1>;
wifi0: wifi@0,0 {
+ compatible = "pci14e4,4433";
reg = <0x10000 0x0 0x0 0x0 0x0>;
/* To be filled by the loader */
local-mac-address = [00 10 18 00 00 10];
+ apple,antenna-sku = "XX";
};
};
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 181/563] arm64: dts: apple: t600x: Add bluetooth device nodes
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 180/563] arm64: dts: apple: t600x: Add missing WiFi properties Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 182/563] arm64: dts: apple: Add ethernet0 alias for J375 template Greg Kroah-Hartman
` (395 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hector Martin, Neal Gompa,
Sven Peter, Janne Grunau, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hector Martin <marcan@marcan.st>
[ Upstream commit c34e2ec6a84ea3f7a01d8fcd3073f858c4f47605 ]
Add bluetooth PCIe device nodes to specify per device brcm,board-type
and provide the bootloader filled "local-bd-address" and calibration
data.
Signed-off-by: Hector Martin <marcan@marcan.st>
Reviewed-by: Neal Gompa <neal@gompa.dev>
Reviewed-by: Sven Peter <sven@kernel.org>
Signed-off-by: Janne Grunau <j@jannau.net>
Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-3-6dc0daeb4786@jannau.net
Signed-off-by: Sven Peter <sven@kernel.org>
Stable-dep-of: 6313115c55f4 ("arm64: dts: apple: Add ethernet0 alias for J375 template")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/apple/t6000-j314s.dts | 4 ++++
arch/arm64/boot/dts/apple/t6000-j316s.dts | 4 ++++
arch/arm64/boot/dts/apple/t6001-j314c.dts | 4 ++++
arch/arm64/boot/dts/apple/t6001-j316c.dts | 4 ++++
arch/arm64/boot/dts/apple/t6001-j375c.dts | 4 ++++
arch/arm64/boot/dts/apple/t6002-j375d.dts | 4 ++++
arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi | 8 ++++++++
arch/arm64/boot/dts/apple/t600x-j375.dtsi | 8 ++++++++
8 files changed, 40 insertions(+)
diff --git a/arch/arm64/boot/dts/apple/t6000-j314s.dts b/arch/arm64/boot/dts/apple/t6000-j314s.dts
index ac35870ca129c..1430b91ff1b15 100644
--- a/arch/arm64/boot/dts/apple/t6000-j314s.dts
+++ b/arch/arm64/boot/dts/apple/t6000-j314s.dts
@@ -20,3 +20,7 @@ / {
&wifi0 {
brcm,board-type = "apple,maldives";
};
+
+&bluetooth0 {
+ brcm,board-type = "apple,maldives";
+};
diff --git a/arch/arm64/boot/dts/apple/t6000-j316s.dts b/arch/arm64/boot/dts/apple/t6000-j316s.dts
index 77d6d8c14d741..da0cbe7d96736 100644
--- a/arch/arm64/boot/dts/apple/t6000-j316s.dts
+++ b/arch/arm64/boot/dts/apple/t6000-j316s.dts
@@ -20,3 +20,7 @@ / {
&wifi0 {
brcm,board-type = "apple,madagascar";
};
+
+&bluetooth0 {
+ brcm,board-type = "apple,madagascar";
+};
diff --git a/arch/arm64/boot/dts/apple/t6001-j314c.dts b/arch/arm64/boot/dts/apple/t6001-j314c.dts
index 0a5655792a8f1..c37097dcfdb30 100644
--- a/arch/arm64/boot/dts/apple/t6001-j314c.dts
+++ b/arch/arm64/boot/dts/apple/t6001-j314c.dts
@@ -20,3 +20,7 @@ / {
&wifi0 {
brcm,board-type = "apple,maldives";
};
+
+&bluetooth0 {
+ brcm,board-type = "apple,maldives";
+};
diff --git a/arch/arm64/boot/dts/apple/t6001-j316c.dts b/arch/arm64/boot/dts/apple/t6001-j316c.dts
index 9c215531ea543..3bc6e0c3294cf 100644
--- a/arch/arm64/boot/dts/apple/t6001-j316c.dts
+++ b/arch/arm64/boot/dts/apple/t6001-j316c.dts
@@ -20,3 +20,7 @@ / {
&wifi0 {
brcm,board-type = "apple,madagascar";
};
+
+&bluetooth0 {
+ brcm,board-type = "apple,madagascar";
+};
diff --git a/arch/arm64/boot/dts/apple/t6001-j375c.dts b/arch/arm64/boot/dts/apple/t6001-j375c.dts
index 88ca2037556ce..2e7c23714d4d0 100644
--- a/arch/arm64/boot/dts/apple/t6001-j375c.dts
+++ b/arch/arm64/boot/dts/apple/t6001-j375c.dts
@@ -20,3 +20,7 @@ / {
&wifi0 {
brcm,board-type = "apple,okinawa";
};
+
+&bluetooth0 {
+ brcm,board-type = "apple,okinawa";
+};
diff --git a/arch/arm64/boot/dts/apple/t6002-j375d.dts b/arch/arm64/boot/dts/apple/t6002-j375d.dts
index f56d13b37eaff..2b7f80119618a 100644
--- a/arch/arm64/boot/dts/apple/t6002-j375d.dts
+++ b/arch/arm64/boot/dts/apple/t6002-j375d.dts
@@ -42,6 +42,10 @@ &wifi0 {
brcm,board-type = "apple,okinawa";
};
+&bluetooth0 {
+ brcm,board-type = "apple,okinawa";
+};
+
/* delete unused always-on power-domains on die 1 */
/delete-node/ &ps_atc2_usb_aon_die1;
diff --git a/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi b/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi
index b699672a5543c..c0aac59a6fae4 100644
--- a/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi
+++ b/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi
@@ -13,6 +13,7 @@
/ {
aliases {
+ bluetooth0 = &bluetooth0;
serial0 = &serial0;
wifi0 = &wifi0;
};
@@ -105,6 +106,13 @@ wifi0: wifi@0,0 {
local-mac-address = [00 10 18 00 00 10];
apple,antenna-sku = "XX";
};
+
+ bluetooth0: bluetooth@0,1 {
+ compatible = "pci14e4,5f71";
+ reg = <0x10100 0x0 0x0 0x0 0x0>;
+ /* To be filled by the loader */
+ local-bd-address = [00 00 00 00 00 00];
+ };
};
&port01 {
diff --git a/arch/arm64/boot/dts/apple/t600x-j375.dtsi b/arch/arm64/boot/dts/apple/t600x-j375.dtsi
index 95560bf3798bf..ed38acc0dfc36 100644
--- a/arch/arm64/boot/dts/apple/t600x-j375.dtsi
+++ b/arch/arm64/boot/dts/apple/t600x-j375.dtsi
@@ -11,6 +11,7 @@
/ {
aliases {
+ bluetooth0 = &bluetooth0;
serial0 = &serial0;
wifi0 = &wifi0;
};
@@ -90,6 +91,13 @@ wifi0: wifi@0,0 {
local-mac-address = [00 10 18 00 00 10];
apple,antenna-sku = "XX";
};
+
+ bluetooth0: bluetooth@0,1 {
+ compatible = "pci14e4,5f71";
+ reg = <0x10100 0x0 0x0 0x0 0x0>;
+ /* To be filled by the loader */
+ local-bd-address = [00 00 00 00 00 00];
+ };
};
&port01 {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 182/563] arm64: dts: apple: Add ethernet0 alias for J375 template
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 181/563] arm64: dts: apple: t600x: Add bluetooth device nodes Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 183/563] selftests: always install UAPI headers to the correct directory Greg Kroah-Hartman
` (394 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neal Gompa, Janne Grunau, Sven Peter,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janne Grunau <j@jannau.net>
[ Upstream commit 6313115c55f44f7bee3f469c91d3de60d724eabd ]
The alias is used by the boot loader to fill the MAC address.
Fixes: aaa1d42a4ce3 ("arm64: dts: apple: Add J375 devicetrees")
Reviewed-by: Neal Gompa <neal@gompa.dev>
Signed-off-by: Janne Grunau <j@jannau.net>
Reviewed-by: Sven Peter <sven@kernel.org>
Signed-off-by: Sven Peter <sven@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/apple/t600x-j375.dtsi | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/apple/t600x-j375.dtsi b/arch/arm64/boot/dts/apple/t600x-j375.dtsi
index ed38acc0dfc36..c0fb93ae72f4d 100644
--- a/arch/arm64/boot/dts/apple/t600x-j375.dtsi
+++ b/arch/arm64/boot/dts/apple/t600x-j375.dtsi
@@ -12,6 +12,7 @@
/ {
aliases {
bluetooth0 = &bluetooth0;
+ ethernet0 = ðernet0;
serial0 = &serial0;
wifi0 = &wifi0;
};
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 183/563] selftests: always install UAPI headers to the correct directory
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 182/563] arm64: dts: apple: Add ethernet0 alias for J375 template Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 184/563] smp: Fix up and expand the smp_call_function_many() kerneldoc Greg Kroah-Hartman
` (393 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe,
Thomas Weißschuh, Shuah Khan, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit 2c55daf7de07158df2ab3835321086beca25a691 ]
Currently the UAPI headers are always installed into the source directory.
When building out-of-tree this doesn't work, as the include path will be
wrong and it dirties the source tree, leading to complains by kbuild.
Make sure the 'headers' target installs the UAPI headers in the correctly.
The real target directory can come from multiple places. To handle them all
extract the target directory from KHDR_INCLUDES.
Link: https://lore.kernel.org/r/20250918-kselftest-uapi-out-of-tree-v1-1-f4434f28adcd@linutronix.de
Reported-by: Jason Gunthorpe <jgg@nvidia.com>
Closes: https://lore.kernel.org/lkml/20250917153209.GA2023406@nvidia.com/
Fixes: 1a59f5d31569 ("selftests: Add headers target")
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/lib.mk | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
index 5303900339292..a448fae57831d 100644
--- a/tools/testing/selftests/lib.mk
+++ b/tools/testing/selftests/lib.mk
@@ -228,7 +228,10 @@ $(OUTPUT)/%:%.S
$(LINK.S) $^ $(LDLIBS) -o $@
endif
+# Extract the expected header directory
+khdr_output := $(patsubst %/usr/include,%,$(filter %/usr/include,$(KHDR_INCLUDES)))
+
headers:
- $(Q)$(MAKE) -C $(top_srcdir) headers
+ $(Q)$(MAKE) -f $(top_srcdir)/Makefile -C $(khdr_output) headers
.PHONY: run_tests all clean install emit_tests gen_mods_dir clean_mods_dir headers
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 184/563] smp: Fix up and expand the smp_call_function_many() kerneldoc
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 183/563] selftests: always install UAPI headers to the correct directory Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 185/563] mfd: max77705: max77705_charger: move active discharge setting to mfd parent Greg Kroah-Hartman
` (392 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki, Thomas Gleixner,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit ccf09357ffef2ab472369ab9cdf470c9bc9b821a ]
The smp_call_function_many() kerneldoc comment got out of sync with the
function definition (bool parameter "wait" is incorrectly described as a
bitmask in it), so fix it up by copying the "wait" description from the
smp_call_function() kerneldoc and add information regarding the handling
of the local CPU to it.
Fixes: 49b3bd213a9f ("smp: Fix all kernel-doc warnings")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/smp.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/kernel/smp.c b/kernel/smp.c
index 56f83aa58ec82..02f52291fae42 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -884,16 +884,15 @@ static void smp_call_function_many_cond(const struct cpumask *mask,
* @mask: The set of cpus to run on (only runs on online subset).
* @func: The function to run. This must be fast and non-blocking.
* @info: An arbitrary pointer to pass to the function.
- * @wait: Bitmask that controls the operation. If %SCF_WAIT is set, wait
- * (atomically) until function has completed on other CPUs. If
- * %SCF_RUN_LOCAL is set, the function will also be run locally
- * if the local CPU is set in the @cpumask.
- *
- * If @wait is true, then returns once @func has returned.
+ * @wait: If true, wait (atomically) until function has completed
+ * on other CPUs.
*
* You must not call this function with disabled interrupts or from a
* hardware interrupt handler or from a bottom half handler. Preemption
* must be disabled when calling this function.
+ *
+ * @func is not called on the local CPU even if @mask contains it. Consider
+ * using on_each_cpu_cond_mask() instead if this is not desirable.
*/
void smp_call_function_many(const struct cpumask *mask,
smp_call_func_t func, void *info, bool wait)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 185/563] mfd: max77705: max77705_charger: move active discharge setting to mfd parent
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 184/563] smp: Fix up and expand the smp_call_function_many() kerneldoc Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 186/563] power: supply: max77705_charger: refactoring: rename charger to chg Greg Kroah-Hartman
` (391 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dzmitry Sankouski, Lee Jones,
Sebastian Reichel, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dzmitry Sankouski <dsankouski@gmail.com>
[ Upstream commit c24928ac69be2390cdf456d126b464af079c57ef ]
Active discharge setting is a part of MFD top level i2c device, hence
cannot be controlled by charger. Writing to MAX77705_PMIC_REG_MAINCTRL1
register from charger driver is a mistake.
Move active discharge setting to MFD parent driver.
Fixes: a6a494c8e3ce ("power: supply: max77705: Add charger driver for Maxim 77705")
Signed-off-by: Dzmitry Sankouski <dsankouski@gmail.com>
Acked-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/max77705.c | 3 +++
drivers/power/supply/max77705_charger.c | 3 ---
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/mfd/max77705.c b/drivers/mfd/max77705.c
index 6b263bacb8c28..ff07d0e0d5f8e 100644
--- a/drivers/mfd/max77705.c
+++ b/drivers/mfd/max77705.c
@@ -108,6 +108,9 @@ static int max77705_i2c_probe(struct i2c_client *i2c)
if (pmic_rev != MAX77705_PASS3)
return dev_err_probe(dev, -ENODEV, "Rev.0x%x is not tested\n", pmic_rev);
+ /* Active Discharge Enable */
+ regmap_update_bits(max77705->regmap, MAX77705_PMIC_REG_MAINCTRL1, 1, 1);
+
ret = devm_regmap_add_irq_chip(dev, max77705->regmap,
i2c->irq,
IRQF_ONESHOT | IRQF_SHARED, 0,
diff --git a/drivers/power/supply/max77705_charger.c b/drivers/power/supply/max77705_charger.c
index 329b430d0e506..3b75c82b9b9ea 100644
--- a/drivers/power/supply/max77705_charger.c
+++ b/drivers/power/supply/max77705_charger.c
@@ -487,9 +487,6 @@ static void max77705_charger_initialize(struct max77705_charger_data *chg)
regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_00,
MAX77705_WDTEN_MASK, 0);
- /* Active Discharge Enable */
- regmap_update_bits(regmap, MAX77705_PMIC_REG_MAINCTRL1, 1, 1);
-
/* VBYPSET=5.0V */
regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_11, MAX77705_VBYPSET_MASK, 0);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 186/563] power: supply: max77705_charger: refactoring: rename charger to chg
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 185/563] mfd: max77705: max77705_charger: move active discharge setting to mfd parent Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 187/563] power: supply: max77705_charger: use regfields for config registers Greg Kroah-Hartman
` (390 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dzmitry Sankouski, Sebastian Reichel,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dzmitry Sankouski <dsankouski@gmail.com>
[ Upstream commit d84510db8c1414b67167cdc452103c1f429588cc ]
Rename struct max77705_charger_data variable to chg for consistency.
Signed-off-by: Dzmitry Sankouski <dsankouski@gmail.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Stable-dep-of: 12a1185a06e3 ("power: supply: max77705_charger: rework interrupts")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/max77705_charger.c | 80 ++++++++++++-------------
1 file changed, 40 insertions(+), 40 deletions(-)
diff --git a/drivers/power/supply/max77705_charger.c b/drivers/power/supply/max77705_charger.c
index 3b75c82b9b9ea..7855f890e0a9f 100644
--- a/drivers/power/supply/max77705_charger.c
+++ b/drivers/power/supply/max77705_charger.c
@@ -42,9 +42,9 @@ static enum power_supply_property max77705_charger_props[] = {
static int max77705_chgin_irq(void *irq_drv_data)
{
- struct max77705_charger_data *charger = irq_drv_data;
+ struct max77705_charger_data *chg = irq_drv_data;
- queue_work(charger->wqueue, &charger->chgin_work);
+ queue_work(chg->wqueue, &chg->chgin_work);
return 0;
}
@@ -109,19 +109,19 @@ static int max77705_get_online(struct regmap *regmap, int *val)
return 0;
}
-static int max77705_check_battery(struct max77705_charger_data *charger, int *val)
+static int max77705_check_battery(struct max77705_charger_data *chg, int *val)
{
unsigned int reg_data;
unsigned int reg_data2;
- struct regmap *regmap = charger->regmap;
+ struct regmap *regmap = chg->regmap;
regmap_read(regmap, MAX77705_CHG_REG_INT_OK, ®_data);
- dev_dbg(charger->dev, "CHG_INT_OK(0x%x)\n", reg_data);
+ dev_dbg(chg->dev, "CHG_INT_OK(0x%x)\n", reg_data);
regmap_read(regmap, MAX77705_CHG_REG_DETAILS_00, ®_data2);
- dev_dbg(charger->dev, "CHG_DETAILS00(0x%x)\n", reg_data2);
+ dev_dbg(chg->dev, "CHG_DETAILS00(0x%x)\n", reg_data2);
if ((reg_data & MAX77705_BATP_OK) || !(reg_data2 & MAX77705_BATP_DTLS))
*val = true;
@@ -131,9 +131,9 @@ static int max77705_check_battery(struct max77705_charger_data *charger, int *va
return 0;
}
-static int max77705_get_charge_type(struct max77705_charger_data *charger, int *val)
+static int max77705_get_charge_type(struct max77705_charger_data *chg, int *val)
{
- struct regmap *regmap = charger->regmap;
+ struct regmap *regmap = chg->regmap;
unsigned int reg_data;
regmap_read(regmap, MAX77705_CHG_REG_CNFG_09, ®_data);
@@ -159,9 +159,9 @@ static int max77705_get_charge_type(struct max77705_charger_data *charger, int *
return 0;
}
-static int max77705_get_status(struct max77705_charger_data *charger, int *val)
+static int max77705_get_status(struct max77705_charger_data *chg, int *val)
{
- struct regmap *regmap = charger->regmap;
+ struct regmap *regmap = chg->regmap;
unsigned int reg_data;
regmap_read(regmap, MAX77705_CHG_REG_CNFG_09, ®_data);
@@ -234,10 +234,10 @@ static int max77705_get_vbus_state(struct regmap *regmap, int *value)
return 0;
}
-static int max77705_get_battery_health(struct max77705_charger_data *charger,
+static int max77705_get_battery_health(struct max77705_charger_data *chg,
int *value)
{
- struct regmap *regmap = charger->regmap;
+ struct regmap *regmap = chg->regmap;
unsigned int bat_dtls;
regmap_read(regmap, MAX77705_CHG_REG_DETAILS_01, &bat_dtls);
@@ -245,16 +245,16 @@ static int max77705_get_battery_health(struct max77705_charger_data *charger,
switch (bat_dtls) {
case MAX77705_BATTERY_NOBAT:
- dev_dbg(charger->dev, "%s: No battery and the charger is suspended\n",
+ dev_dbg(chg->dev, "%s: No battery and the chg is suspended\n",
__func__);
*value = POWER_SUPPLY_HEALTH_NO_BATTERY;
break;
case MAX77705_BATTERY_PREQUALIFICATION:
- dev_dbg(charger->dev, "%s: battery is okay but its voltage is low(~VPQLB)\n",
+ dev_dbg(chg->dev, "%s: battery is okay but its voltage is low(~VPQLB)\n",
__func__);
break;
case MAX77705_BATTERY_DEAD:
- dev_dbg(charger->dev, "%s: battery dead\n", __func__);
+ dev_dbg(chg->dev, "%s: battery dead\n", __func__);
*value = POWER_SUPPLY_HEALTH_DEAD;
break;
case MAX77705_BATTERY_GOOD:
@@ -262,11 +262,11 @@ static int max77705_get_battery_health(struct max77705_charger_data *charger,
*value = POWER_SUPPLY_HEALTH_GOOD;
break;
case MAX77705_BATTERY_OVERVOLTAGE:
- dev_dbg(charger->dev, "%s: battery ovp\n", __func__);
+ dev_dbg(chg->dev, "%s: battery ovp\n", __func__);
*value = POWER_SUPPLY_HEALTH_OVERVOLTAGE;
break;
default:
- dev_dbg(charger->dev, "%s: battery unknown\n", __func__);
+ dev_dbg(chg->dev, "%s: battery unknown\n", __func__);
*value = POWER_SUPPLY_HEALTH_UNSPEC_FAILURE;
break;
}
@@ -274,9 +274,9 @@ static int max77705_get_battery_health(struct max77705_charger_data *charger,
return 0;
}
-static int max77705_get_health(struct max77705_charger_data *charger, int *val)
+static int max77705_get_health(struct max77705_charger_data *chg, int *val)
{
- struct regmap *regmap = charger->regmap;
+ struct regmap *regmap = chg->regmap;
int ret, is_online = 0;
ret = max77705_get_online(regmap, &is_online);
@@ -287,15 +287,15 @@ static int max77705_get_health(struct max77705_charger_data *charger, int *val)
if (ret || (*val != POWER_SUPPLY_HEALTH_GOOD))
return ret;
}
- return max77705_get_battery_health(charger, val);
+ return max77705_get_battery_health(chg, val);
}
-static int max77705_get_input_current(struct max77705_charger_data *charger,
+static int max77705_get_input_current(struct max77705_charger_data *chg,
int *val)
{
unsigned int reg_data;
int get_current = 0;
- struct regmap *regmap = charger->regmap;
+ struct regmap *regmap = chg->regmap;
regmap_read(regmap, MAX77705_CHG_REG_CNFG_09, ®_data);
@@ -313,11 +313,11 @@ static int max77705_get_input_current(struct max77705_charger_data *charger,
return 0;
}
-static int max77705_get_charge_current(struct max77705_charger_data *charger,
+static int max77705_get_charge_current(struct max77705_charger_data *chg,
int *val)
{
unsigned int reg_data;
- struct regmap *regmap = charger->regmap;
+ struct regmap *regmap = chg->regmap;
regmap_read(regmap, MAX77705_CHG_REG_CNFG_02, ®_data);
reg_data &= MAX77705_CHG_CC;
@@ -327,12 +327,12 @@ static int max77705_get_charge_current(struct max77705_charger_data *charger,
return 0;
}
-static int max77705_set_float_voltage(struct max77705_charger_data *charger,
+static int max77705_set_float_voltage(struct max77705_charger_data *chg,
int float_voltage)
{
int float_voltage_mv;
unsigned int reg_data = 0;
- struct regmap *regmap = charger->regmap;
+ struct regmap *regmap = chg->regmap;
float_voltage_mv = float_voltage / 1000;
reg_data = float_voltage_mv <= 4000 ? 0x0 :
@@ -345,12 +345,12 @@ static int max77705_set_float_voltage(struct max77705_charger_data *charger,
(reg_data << MAX77705_CHG_CV_PRM_SHIFT));
}
-static int max77705_get_float_voltage(struct max77705_charger_data *charger,
+static int max77705_get_float_voltage(struct max77705_charger_data *chg,
int *val)
{
unsigned int reg_data = 0;
int voltage_mv;
- struct regmap *regmap = charger->regmap;
+ struct regmap *regmap = chg->regmap;
regmap_read(regmap, MAX77705_CHG_REG_CNFG_04, ®_data);
reg_data &= MAX77705_CHG_PRM_MASK;
@@ -365,28 +365,28 @@ static int max77705_chg_get_property(struct power_supply *psy,
enum power_supply_property psp,
union power_supply_propval *val)
{
- struct max77705_charger_data *charger = power_supply_get_drvdata(psy);
- struct regmap *regmap = charger->regmap;
+ struct max77705_charger_data *chg = power_supply_get_drvdata(psy);
+ struct regmap *regmap = chg->regmap;
switch (psp) {
case POWER_SUPPLY_PROP_ONLINE:
return max77705_get_online(regmap, &val->intval);
case POWER_SUPPLY_PROP_PRESENT:
- return max77705_check_battery(charger, &val->intval);
+ return max77705_check_battery(chg, &val->intval);
case POWER_SUPPLY_PROP_STATUS:
- return max77705_get_status(charger, &val->intval);
+ return max77705_get_status(chg, &val->intval);
case POWER_SUPPLY_PROP_CHARGE_TYPE:
- return max77705_get_charge_type(charger, &val->intval);
+ return max77705_get_charge_type(chg, &val->intval);
case POWER_SUPPLY_PROP_HEALTH:
- return max77705_get_health(charger, &val->intval);
+ return max77705_get_health(chg, &val->intval);
case POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT:
- return max77705_get_input_current(charger, &val->intval);
+ return max77705_get_input_current(chg, &val->intval);
case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT:
- return max77705_get_charge_current(charger, &val->intval);
+ return max77705_get_charge_current(chg, &val->intval);
case POWER_SUPPLY_PROP_CONSTANT_CHARGE_VOLTAGE:
- return max77705_get_float_voltage(charger, &val->intval);
+ return max77705_get_float_voltage(chg, &val->intval);
case POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN:
- val->intval = charger->bat_info->voltage_max_design_uv;
+ val->intval = chg->bat_info->voltage_max_design_uv;
break;
case POWER_SUPPLY_PROP_MODEL_NAME:
val->strval = max77705_charger_model;
@@ -410,10 +410,10 @@ static const struct power_supply_desc max77705_charger_psy_desc = {
static void max77705_chgin_isr_work(struct work_struct *work)
{
- struct max77705_charger_data *charger =
+ struct max77705_charger_data *chg =
container_of(work, struct max77705_charger_data, chgin_work);
- power_supply_changed(charger->psy_chg);
+ power_supply_changed(chg->psy_chg);
}
static void max77705_charger_initialize(struct max77705_charger_data *chg)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 187/563] power: supply: max77705_charger: use regfields for config registers
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 186/563] power: supply: max77705_charger: refactoring: rename charger to chg Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 188/563] power: supply: max77705_charger: rework interrupts Greg Kroah-Hartman
` (389 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dzmitry Sankouski, Sebastian Reichel,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dzmitry Sankouski <dsankouski@gmail.com>
[ Upstream commit ef1e734dbe257ce8bc42383b9977b5558f061288 ]
Using regfields allows to cleanup masks and register offset definition,
allowing to access register info by it's functional name.
Signed-off-by: Dzmitry Sankouski <dsankouski@gmail.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Stable-dep-of: 12a1185a06e3 ("power: supply: max77705_charger: rework interrupts")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/max77705_charger.c | 105 +++++++++---------------
include/linux/power/max77705_charger.h | 102 ++++++++++++-----------
2 files changed, 93 insertions(+), 114 deletions(-)
diff --git a/drivers/power/supply/max77705_charger.c b/drivers/power/supply/max77705_charger.c
index 7855f890e0a9f..2d2201a6ba687 100644
--- a/drivers/power/supply/max77705_charger.c
+++ b/drivers/power/supply/max77705_charger.c
@@ -74,8 +74,7 @@ static int max77705_charger_enable(struct max77705_charger_data *chg)
{
int rv;
- rv = regmap_update_bits(chg->regmap, MAX77705_CHG_REG_CNFG_09,
- MAX77705_CHG_EN_MASK, MAX77705_CHG_EN_MASK);
+ rv = regmap_field_write(chg->rfield[MAX77705_CHG_EN], 1);
if (rv)
dev_err(chg->dev, "unable to enable the charger: %d\n", rv);
@@ -87,10 +86,7 @@ static void max77705_charger_disable(void *data)
struct max77705_charger_data *chg = data;
int rv;
- rv = regmap_update_bits(chg->regmap,
- MAX77705_CHG_REG_CNFG_09,
- MAX77705_CHG_EN_MASK,
- MAX77705_CHG_DISABLE);
+ rv = regmap_field_write(chg->rfield[MAX77705_CHG_EN], MAX77705_CHG_DISABLE);
if (rv)
dev_err(chg->dev, "unable to disable the charger: %d\n", rv);
}
@@ -134,10 +130,10 @@ static int max77705_check_battery(struct max77705_charger_data *chg, int *val)
static int max77705_get_charge_type(struct max77705_charger_data *chg, int *val)
{
struct regmap *regmap = chg->regmap;
- unsigned int reg_data;
+ unsigned int reg_data, chg_en;
- regmap_read(regmap, MAX77705_CHG_REG_CNFG_09, ®_data);
- if (!MAX77705_CHARGER_CHG_CHARGING(reg_data)) {
+ regmap_field_read(chg->rfield[MAX77705_CHG_EN], &chg_en);
+ if (!chg_en) {
*val = POWER_SUPPLY_CHARGE_TYPE_NONE;
return 0;
}
@@ -162,10 +158,10 @@ static int max77705_get_charge_type(struct max77705_charger_data *chg, int *val)
static int max77705_get_status(struct max77705_charger_data *chg, int *val)
{
struct regmap *regmap = chg->regmap;
- unsigned int reg_data;
+ unsigned int reg_data, chg_en;
- regmap_read(regmap, MAX77705_CHG_REG_CNFG_09, ®_data);
- if (!MAX77705_CHARGER_CHG_CHARGING(reg_data)) {
+ regmap_field_read(chg->rfield[MAX77705_CHG_EN], &chg_en);
+ if (!chg_en) {
*val = POWER_SUPPLY_CHARGE_TYPE_NONE;
return 0;
}
@@ -295,16 +291,11 @@ static int max77705_get_input_current(struct max77705_charger_data *chg,
{
unsigned int reg_data;
int get_current = 0;
- struct regmap *regmap = chg->regmap;
- regmap_read(regmap, MAX77705_CHG_REG_CNFG_09, ®_data);
-
- reg_data &= MAX77705_CHG_CHGIN_LIM_MASK;
+ regmap_field_read(chg->rfield[MAX77705_CHG_CHGIN_LIM], ®_data);
if (reg_data <= 3)
get_current = MAX77705_CURRENT_CHGIN_MIN;
- else if (reg_data >= MAX77705_CHG_CHGIN_LIM_MASK)
- get_current = MAX77705_CURRENT_CHGIN_MAX;
else
get_current = (reg_data + 1) * MAX77705_CURRENT_CHGIN_STEP;
@@ -317,10 +308,8 @@ static int max77705_get_charge_current(struct max77705_charger_data *chg,
int *val)
{
unsigned int reg_data;
- struct regmap *regmap = chg->regmap;
- regmap_read(regmap, MAX77705_CHG_REG_CNFG_02, ®_data);
- reg_data &= MAX77705_CHG_CC;
+ regmap_field_read(chg->rfield[MAX77705_CHG_CC_LIM], ®_data);
*val = reg_data <= 0x2 ? MAX77705_CURRENT_CHGIN_MIN : reg_data * MAX77705_CURRENT_CHG_STEP;
@@ -332,7 +321,6 @@ static int max77705_set_float_voltage(struct max77705_charger_data *chg,
{
int float_voltage_mv;
unsigned int reg_data = 0;
- struct regmap *regmap = chg->regmap;
float_voltage_mv = float_voltage / 1000;
reg_data = float_voltage_mv <= 4000 ? 0x0 :
@@ -340,9 +328,7 @@ static int max77705_set_float_voltage(struct max77705_charger_data *chg,
(float_voltage_mv <= 4200) ? (float_voltage_mv - 4000) / 50 :
(((float_voltage_mv - 4200) / 10) + 0x04);
- return regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_04,
- MAX77705_CHG_CV_PRM_MASK,
- (reg_data << MAX77705_CHG_CV_PRM_SHIFT));
+ return regmap_field_write(chg->rfield[MAX77705_CHG_CV_PRM], reg_data);
}
static int max77705_get_float_voltage(struct max77705_charger_data *chg,
@@ -350,10 +336,8 @@ static int max77705_get_float_voltage(struct max77705_charger_data *chg,
{
unsigned int reg_data = 0;
int voltage_mv;
- struct regmap *regmap = chg->regmap;
- regmap_read(regmap, MAX77705_CHG_REG_CNFG_04, ®_data);
- reg_data &= MAX77705_CHG_PRM_MASK;
+ regmap_field_read(chg->rfield[MAX77705_CHG_CV_PRM], ®_data);
voltage_mv = reg_data <= 0x04 ? reg_data * 50 + 4000 :
(reg_data - 4) * 10 + 4200;
*val = voltage_mv * 1000;
@@ -418,7 +402,6 @@ static void max77705_chgin_isr_work(struct work_struct *work)
static void max77705_charger_initialize(struct max77705_charger_data *chg)
{
- u8 reg_data;
struct power_supply_battery_info *info;
struct regmap *regmap = chg->regmap;
@@ -429,45 +412,31 @@ static void max77705_charger_initialize(struct max77705_charger_data *chg)
/* unlock charger setting protect */
/* slowest LX slope */
- reg_data = MAX77705_CHGPROT_MASK | MAX77705_SLOWEST_LX_SLOPE;
- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_06, reg_data,
- reg_data);
+ regmap_field_write(chg->rfield[MAX77705_CHGPROT], MAX77705_CHGPROT_UNLOCKED);
+ regmap_field_write(chg->rfield[MAX77705_LX_SLOPE], MAX77705_SLOWEST_LX_SLOPE);
/* fast charge timer disable */
/* restart threshold disable */
/* pre-qual charge disable */
- reg_data = (MAX77705_FCHGTIME_DISABLE << MAX77705_FCHGTIME_SHIFT) |
- (MAX77705_CHG_RSTRT_DISABLE << MAX77705_CHG_RSTRT_SHIFT) |
- (MAX77705_CHG_PQEN_DISABLE << MAX77705_PQEN_SHIFT);
- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_01,
- (MAX77705_FCHGTIME_MASK |
- MAX77705_CHG_RSTRT_MASK |
- MAX77705_PQEN_MASK),
- reg_data);
-
- /* OTG off(UNO on), boost off */
- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_00,
- MAX77705_OTG_CTRL, 0);
+ regmap_field_write(chg->rfield[MAX77705_FCHGTIME], MAX77705_FCHGTIME_DISABLE);
+ regmap_field_write(chg->rfield[MAX77705_CHG_RSTRT], MAX77705_CHG_RSTRT_DISABLE);
+ regmap_field_write(chg->rfield[MAX77705_CHG_PQEN], MAX77705_CHG_PQEN_DISABLE);
+
+ regmap_field_write(chg->rfield[MAX77705_MODE],
+ MAX77705_CHG_MASK | MAX77705_BUCK_MASK);
/* charge current 450mA(default) */
/* otg current limit 900mA */
- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_02,
- MAX77705_OTG_ILIM_MASK,
- MAX77705_OTG_ILIM_900 << MAX77705_OTG_ILIM_SHIFT);
+ regmap_field_write(chg->rfield[MAX77705_OTG_ILIM], MAX77705_OTG_ILIM_900);
/* BAT to SYS OCP 4.80A */
- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_05,
- MAX77705_REG_B2SOVRC_MASK,
- MAX77705_B2SOVRC_4_8A << MAX77705_REG_B2SOVRC_SHIFT);
+ regmap_field_write(chg->rfield[MAX77705_REG_B2SOVRC], MAX77705_B2SOVRC_4_8A);
+
/* top off current 150mA */
/* top off timer 30min */
- reg_data = (MAX77705_TO_ITH_150MA << MAX77705_TO_ITH_SHIFT) |
- (MAX77705_TO_TIME_30M << MAX77705_TO_TIME_SHIFT) |
- (MAX77705_SYS_TRACK_DISABLE << MAX77705_SYS_TRACK_DIS_SHIFT);
- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_03,
- (MAX77705_TO_ITH_MASK |
- MAX77705_TO_TIME_MASK |
- MAX77705_SYS_TRACK_DIS_MASK), reg_data);
+ regmap_field_write(chg->rfield[MAX77705_TO], MAX77705_TO_ITH_150MA);
+ regmap_field_write(chg->rfield[MAX77705_TO_TIME], MAX77705_TO_TIME_30M);
+ regmap_field_write(chg->rfield[MAX77705_SYS_TRACK], MAX77705_SYS_TRACK_DISABLE);
/* cv voltage 4.2V or 4.35V */
/* MINVSYS 3.6V(default) */
@@ -478,25 +447,21 @@ static void max77705_charger_initialize(struct max77705_charger_data *chg)
max77705_set_float_voltage(chg, info->voltage_max_design_uv);
}
- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_12,
- MAX77705_VCHGIN_REG_MASK, MAX77705_VCHGIN_4_5);
- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_12,
- MAX77705_WCIN_REG_MASK, MAX77705_WCIN_4_5);
+ regmap_field_write(chg->rfield[MAX77705_VCHGIN], MAX77705_VCHGIN_4_5);
+ regmap_field_write(chg->rfield[MAX77705_WCIN], MAX77705_WCIN_4_5);
/* Watchdog timer */
regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_00,
MAX77705_WDTEN_MASK, 0);
/* VBYPSET=5.0V */
- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_11, MAX77705_VBYPSET_MASK, 0);
+ regmap_field_write(chg->rfield[MAX77705_VBYPSET], 0);
/* Switching Frequency : 1.5MHz */
- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_08, MAX77705_REG_FSW_MASK,
- (MAX77705_CHG_FSW_1_5MHz << MAX77705_REG_FSW_SHIFT));
+ regmap_field_write(chg->rfield[MAX77705_REG_FSW], MAX77705_CHG_FSW_1_5MHz);
/* Auto skip mode */
- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_12, MAX77705_REG_DISKIP_MASK,
- (MAX77705_AUTO_SKIP << MAX77705_REG_DISKIP_SHIFT));
+ regmap_field_write(chg->rfield[MAX77705_REG_DISKIP], MAX77705_AUTO_SKIP);
}
static int max77705_charger_probe(struct i2c_client *i2c)
@@ -520,6 +485,14 @@ static int max77705_charger_probe(struct i2c_client *i2c)
if (IS_ERR(chg->regmap))
return PTR_ERR(chg->regmap);
+ for (int i = 0; i < MAX77705_N_REGMAP_FIELDS; i++) {
+ chg->rfield[i] = devm_regmap_field_alloc(dev, chg->regmap,
+ max77705_reg_field[i]);
+ if (IS_ERR(chg->rfield[i]))
+ return dev_err_probe(dev, PTR_ERR(chg->rfield[i]),
+ "cannot allocate regmap field\n");
+ }
+
ret = regmap_update_bits(chg->regmap,
MAX77705_CHG_REG_INT_MASK,
MAX77705_CHGIN_IM, 0);
diff --git a/include/linux/power/max77705_charger.h b/include/linux/power/max77705_charger.h
index fdec9af9c5418..a612795577b62 100644
--- a/include/linux/power/max77705_charger.h
+++ b/include/linux/power/max77705_charger.h
@@ -9,6 +9,8 @@
#ifndef __MAX77705_CHARGER_H
#define __MAX77705_CHARGER_H __FILE__
+#include <linux/regmap.h>
+
/* MAX77705_CHG_REG_CHG_INT */
#define MAX77705_BYP_I BIT(0)
#define MAX77705_INP_LIMIT_I BIT(1)
@@ -63,7 +65,6 @@
#define MAX77705_BUCK_SHIFT 2
#define MAX77705_BOOST_SHIFT 3
#define MAX77705_WDTEN_SHIFT 4
-#define MAX77705_MODE_MASK GENMASK(3, 0)
#define MAX77705_CHG_MASK BIT(MAX77705_CHG_SHIFT)
#define MAX77705_UNO_MASK BIT(MAX77705_UNO_SHIFT)
#define MAX77705_OTG_MASK BIT(MAX77705_OTG_SHIFT)
@@ -74,34 +75,19 @@
#define MAX77705_OTG_CTRL (MAX77705_OTG_MASK | MAX77705_BOOST_MASK)
/* MAX77705_CHG_REG_CNFG_01 */
-#define MAX77705_FCHGTIME_SHIFT 0
-#define MAX77705_FCHGTIME_MASK GENMASK(2, 0)
-#define MAX77705_CHG_RSTRT_SHIFT 4
-#define MAX77705_CHG_RSTRT_MASK GENMASK(5, 4)
#define MAX77705_FCHGTIME_DISABLE 0
#define MAX77705_CHG_RSTRT_DISABLE 0x3
-#define MAX77705_PQEN_SHIFT 7
-#define MAX77705_PQEN_MASK BIT(7)
#define MAX77705_CHG_PQEN_DISABLE 0
#define MAX77705_CHG_PQEN_ENABLE 1
/* MAX77705_CHG_REG_CNFG_02 */
-#define MAX77705_OTG_ILIM_SHIFT 6
-#define MAX77705_OTG_ILIM_MASK GENMASK(7, 6)
#define MAX77705_OTG_ILIM_500 0
#define MAX77705_OTG_ILIM_900 1
#define MAX77705_OTG_ILIM_1200 2
#define MAX77705_OTG_ILIM_1500 3
-#define MAX77705_CHG_CC GENMASK(5, 0)
/* MAX77705_CHG_REG_CNFG_03 */
-#define MAX77705_TO_ITH_SHIFT 0
-#define MAX77705_TO_ITH_MASK GENMASK(2, 0)
-#define MAX77705_TO_TIME_SHIFT 3
-#define MAX77705_TO_TIME_MASK GENMASK(5, 3)
-#define MAX77705_SYS_TRACK_DIS_SHIFT 7
-#define MAX77705_SYS_TRACK_DIS_MASK BIT(7)
#define MAX77705_TO_ITH_150MA 0
#define MAX77705_TO_TIME_30M 3
#define MAX77705_SYS_TRACK_ENABLE 0
@@ -110,15 +96,8 @@
/* MAX77705_CHG_REG_CNFG_04 */
#define MAX77705_CHG_MINVSYS_SHIFT 6
#define MAX77705_CHG_MINVSYS_MASK GENMASK(7, 6)
-#define MAX77705_CHG_PRM_SHIFT 0
-#define MAX77705_CHG_PRM_MASK GENMASK(5, 0)
-
-#define MAX77705_CHG_CV_PRM_SHIFT 0
-#define MAX77705_CHG_CV_PRM_MASK GENMASK(5, 0)
/* MAX77705_CHG_REG_CNFG_05 */
-#define MAX77705_REG_B2SOVRC_SHIFT 0
-#define MAX77705_REG_B2SOVRC_MASK GENMASK(3, 0)
#define MAX77705_B2SOVRC_DISABLE 0
#define MAX77705_B2SOVRC_4_5A 6
#define MAX77705_B2SOVRC_4_8A 8
@@ -128,9 +107,8 @@
#define MAX77705_WDTCLR_SHIFT 0
#define MAX77705_WDTCLR_MASK GENMASK(1, 0)
#define MAX77705_WDTCLR 1
-#define MAX77705_CHGPROT_MASK GENMASK(3, 2)
-#define MAX77705_CHGPROT_UNLOCKED GENMASK(3, 2)
-#define MAX77705_SLOWEST_LX_SLOPE GENMASK(6, 5)
+#define MAX77705_CHGPROT_UNLOCKED 3
+#define MAX77705_SLOWEST_LX_SLOPE 3
/* MAX77705_CHG_REG_CNFG_07 */
#define MAX77705_CHG_FMBST 4
@@ -140,36 +118,14 @@
#define MAX77705_REG_FGSRC_MASK BIT(MAX77705_REG_FGSRC_SHIFT)
/* MAX77705_CHG_REG_CNFG_08 */
-#define MAX77705_REG_FSW_SHIFT 0
-#define MAX77705_REG_FSW_MASK GENMASK(1, 0)
#define MAX77705_CHG_FSW_3MHz 0
#define MAX77705_CHG_FSW_2MHz 1
#define MAX77705_CHG_FSW_1_5MHz 2
/* MAX77705_CHG_REG_CNFG_09 */
-#define MAX77705_CHG_CHGIN_LIM_MASK GENMASK(6, 0)
-#define MAX77705_CHG_EN_MASK BIT(7)
#define MAX77705_CHG_DISABLE 0
-#define MAX77705_CHARGER_CHG_CHARGING(_reg) \
- (((_reg) & MAX77705_CHG_EN_MASK) > 1)
-
-
-/* MAX77705_CHG_REG_CNFG_10 */
-#define MAX77705_CHG_WCIN_LIM GENMASK(5, 0)
-
-/* MAX77705_CHG_REG_CNFG_11 */
-#define MAX77705_VBYPSET_SHIFT 0
-#define MAX77705_VBYPSET_MASK GENMASK(6, 0)
/* MAX77705_CHG_REG_CNFG_12 */
-#define MAX77705_CHGINSEL_SHIFT 5
-#define MAX77705_CHGINSEL_MASK BIT(MAX77705_CHGINSEL_SHIFT)
-#define MAX77705_WCINSEL_SHIFT 6
-#define MAX77705_WCINSEL_MASK BIT(MAX77705_WCINSEL_SHIFT)
-#define MAX77705_VCHGIN_REG_MASK GENMASK(4, 3)
-#define MAX77705_WCIN_REG_MASK GENMASK(2, 1)
-#define MAX77705_REG_DISKIP_SHIFT 0
-#define MAX77705_REG_DISKIP_MASK BIT(MAX77705_REG_DISKIP_SHIFT)
/* REG=4.5V, UVLO=4.7V */
#define MAX77705_VCHGIN_4_5 0
/* REG=4.5V, UVLO=4.7V */
@@ -183,9 +139,59 @@
#define MAX77705_CURRENT_CHGIN_MIN 100000
#define MAX77705_CURRENT_CHGIN_MAX 3200000
+enum max77705_field_idx {
+ MAX77705_CHGPROT,
+ MAX77705_CHG_EN,
+ MAX77705_CHG_CC_LIM,
+ MAX77705_CHG_CHGIN_LIM,
+ MAX77705_CHG_CV_PRM,
+ MAX77705_CHG_PQEN,
+ MAX77705_CHG_RSTRT,
+ MAX77705_CHG_WCIN,
+ MAX77705_FCHGTIME,
+ MAX77705_LX_SLOPE,
+ MAX77705_MODE,
+ MAX77705_OTG_ILIM,
+ MAX77705_REG_B2SOVRC,
+ MAX77705_REG_DISKIP,
+ MAX77705_REG_FSW,
+ MAX77705_SYS_TRACK,
+ MAX77705_TO,
+ MAX77705_TO_TIME,
+ MAX77705_VBYPSET,
+ MAX77705_VCHGIN,
+ MAX77705_WCIN,
+ MAX77705_N_REGMAP_FIELDS,
+};
+
+static const struct reg_field max77705_reg_field[MAX77705_N_REGMAP_FIELDS] = {
+ [MAX77705_MODE] = REG_FIELD(MAX77705_CHG_REG_CNFG_00, 0, 3),
+ [MAX77705_FCHGTIME] = REG_FIELD(MAX77705_CHG_REG_CNFG_01, 0, 2),
+ [MAX77705_CHG_RSTRT] = REG_FIELD(MAX77705_CHG_REG_CNFG_01, 4, 5),
+ [MAX77705_CHG_PQEN] = REG_FIELD(MAX77705_CHG_REG_CNFG_01, 7, 7),
+ [MAX77705_CHG_CC_LIM] = REG_FIELD(MAX77705_CHG_REG_CNFG_02, 0, 5),
+ [MAX77705_OTG_ILIM] = REG_FIELD(MAX77705_CHG_REG_CNFG_02, 6, 7),
+ [MAX77705_TO] = REG_FIELD(MAX77705_CHG_REG_CNFG_03, 0, 2),
+ [MAX77705_TO_TIME] = REG_FIELD(MAX77705_CHG_REG_CNFG_03, 3, 5),
+ [MAX77705_SYS_TRACK] = REG_FIELD(MAX77705_CHG_REG_CNFG_03, 7, 7),
+ [MAX77705_CHG_CV_PRM] = REG_FIELD(MAX77705_CHG_REG_CNFG_04, 0, 5),
+ [MAX77705_REG_B2SOVRC] = REG_FIELD(MAX77705_CHG_REG_CNFG_05, 0, 3),
+ [MAX77705_CHGPROT] = REG_FIELD(MAX77705_CHG_REG_CNFG_06, 2, 3),
+ [MAX77705_LX_SLOPE] = REG_FIELD(MAX77705_CHG_REG_CNFG_06, 5, 6),
+ [MAX77705_REG_FSW] = REG_FIELD(MAX77705_CHG_REG_CNFG_08, 0, 1),
+ [MAX77705_CHG_CHGIN_LIM] = REG_FIELD(MAX77705_CHG_REG_CNFG_09, 0, 6),
+ [MAX77705_CHG_EN] = REG_FIELD(MAX77705_CHG_REG_CNFG_09, 7, 7),
+ [MAX77705_CHG_WCIN] = REG_FIELD(MAX77705_CHG_REG_CNFG_10, 0, 5),
+ [MAX77705_VBYPSET] = REG_FIELD(MAX77705_CHG_REG_CNFG_11, 0, 6),
+ [MAX77705_REG_DISKIP] = REG_FIELD(MAX77705_CHG_REG_CNFG_12, 0, 0),
+ [MAX77705_WCIN] = REG_FIELD(MAX77705_CHG_REG_CNFG_12, 1, 2),
+ [MAX77705_VCHGIN] = REG_FIELD(MAX77705_CHG_REG_CNFG_12, 3, 4),
+};
+
struct max77705_charger_data {
struct device *dev;
struct regmap *regmap;
+ struct regmap_field *rfield[MAX77705_N_REGMAP_FIELDS];
struct power_supply_battery_info *bat_info;
struct workqueue_struct *wqueue;
struct work_struct chgin_work;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 188/563] power: supply: max77705_charger: rework interrupts
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 187/563] power: supply: max77705_charger: use regfields for config registers Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 189/563] tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers Greg Kroah-Hartman
` (388 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dzmitry Sankouski, Sebastian Reichel,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dzmitry Sankouski <dsankouski@gmail.com>
[ Upstream commit 12a1185a06e3377af777e792ba7436862f8e528a ]
Current implementation uses handle_post_irq to actually handle chgin
irq. This is not how things are meant to work in regmap-irq.
Remove handle_post_irq, and request a threaded interrupt for chgin.
Fixes: a6a494c8e3ce ("power: supply: max77705: Add charger driver for Maxim 77705")
Signed-off-by: Dzmitry Sankouski <dsankouski@gmail.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/max77705_charger.c | 22 ++++++++++++----------
1 file changed, 12 insertions(+), 10 deletions(-)
diff --git a/drivers/power/supply/max77705_charger.c b/drivers/power/supply/max77705_charger.c
index 2d2201a6ba687..a8762bdd2c7c6 100644
--- a/drivers/power/supply/max77705_charger.c
+++ b/drivers/power/supply/max77705_charger.c
@@ -40,13 +40,13 @@ static enum power_supply_property max77705_charger_props[] = {
POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT,
};
-static int max77705_chgin_irq(void *irq_drv_data)
+static irqreturn_t max77705_chgin_irq(int irq, void *irq_drv_data)
{
struct max77705_charger_data *chg = irq_drv_data;
queue_work(chg->wqueue, &chg->chgin_work);
- return 0;
+ return IRQ_HANDLED;
}
static const struct regmap_irq max77705_charger_irqs[] = {
@@ -64,7 +64,6 @@ static struct regmap_irq_chip max77705_charger_irq_chip = {
.name = "max77705-charger",
.status_base = MAX77705_CHG_REG_INT,
.mask_base = MAX77705_CHG_REG_INT_MASK,
- .handle_post_irq = max77705_chgin_irq,
.num_regs = 1,
.irqs = max77705_charger_irqs,
.num_irqs = ARRAY_SIZE(max77705_charger_irqs),
@@ -493,12 +492,6 @@ static int max77705_charger_probe(struct i2c_client *i2c)
"cannot allocate regmap field\n");
}
- ret = regmap_update_bits(chg->regmap,
- MAX77705_CHG_REG_INT_MASK,
- MAX77705_CHGIN_IM, 0);
- if (ret)
- return ret;
-
pscfg.fwnode = dev_fwnode(dev);
pscfg.drv_data = chg;
@@ -508,7 +501,7 @@ static int max77705_charger_probe(struct i2c_client *i2c)
max77705_charger_irq_chip.irq_drv_data = chg;
ret = devm_regmap_add_irq_chip(chg->dev, chg->regmap, i2c->irq,
- IRQF_ONESHOT | IRQF_SHARED, 0,
+ IRQF_ONESHOT, 0,
&max77705_charger_irq_chip,
&irq_data);
if (ret)
@@ -526,6 +519,15 @@ static int max77705_charger_probe(struct i2c_client *i2c)
max77705_charger_initialize(chg);
+ ret = devm_request_threaded_irq(dev, regmap_irq_get_virq(irq_data, MAX77705_CHGIN_I),
+ NULL, max77705_chgin_irq,
+ IRQF_TRIGGER_NONE,
+ "chgin-irq", chg);
+ if (ret) {
+ dev_err_probe(dev, ret, "Failed to Request chgin IRQ\n");
+ goto destroy_wq;
+ }
+
ret = max77705_charger_enable(chg);
if (ret) {
dev_err_probe(dev, ret, "failed to enable charge\n");
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 189/563] tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 188/563] power: supply: max77705_charger: rework interrupts Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 190/563] spi: fix return code when spi device has too many chipselects Greg Kroah-Hartman
` (387 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhouyi Zhou, Thomas Weißschuh,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhouyi Zhou <zhouzhouyi@gmail.com>
[ Upstream commit 0ff52df6b32a6b04a7c9dfe3d7a387aff215b482 ]
Commit d5094bcb5bfd ("tools/nolibc: define time_t in terms of
__kernel_old_time_t") made nolibc use the kernel's time type so that
`time_t` matches `timespec::tv_sec` on all ABIs (notably x32).
But since __kernel_old_time_t is fairly new, notably from 2020 in commit
94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t"),
nolibc builds that rely on host headers may fail.
Switch to __kernel_time_t, which is the same as __kernel_old_time_t and
has existed for longer.
Tested in PPC VM of Open Source Lab of Oregon State University
(./tools/testing/selftests/rcutorture/bin/mkinitrd.sh)
Fixes: d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t")
Signed-off-by: Zhouyi Zhou <zhouzhouyi@gmail.com>
[Thomas: Reformat commit and its message a bit]
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/include/nolibc/std.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h
index ba950f0e73384..2c1ad23b9b5c1 100644
--- a/tools/include/nolibc/std.h
+++ b/tools/include/nolibc/std.h
@@ -29,6 +29,6 @@ typedef unsigned long nlink_t;
typedef signed long off_t;
typedef signed long blksize_t;
typedef signed long blkcnt_t;
-typedef __kernel_old_time_t time_t;
+typedef __kernel_time_t time_t;
#endif /* _NOLIBC_STD_H */
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 190/563] spi: fix return code when spi device has too many chipselects
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 189/563] tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 191/563] clocksource/drivers/timer-tegra186: Avoid 64-bit divide operation Greg Kroah-Hartman
` (386 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jonas Gorski, Mark Brown,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit 188f63235bcdd207646773a8739387d85347ed76 ]
Don't return a positive value when there are too many chipselects.
Fixes: 4d8ff6b0991d ("spi: Add multi-cs memories support in SPI core")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Link: https://patch.msgid.link/20250915183725.219473-2-jonas.gorski@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index a388f372b27a7..19c2a6eb9922a 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -2449,7 +2449,7 @@ static int of_spi_parse_dt(struct spi_controller *ctlr, struct spi_device *spi,
if (rc > ctlr->num_chipselect) {
dev_err(&ctlr->dev, "%pOF has number of CS > ctlr->num_chipselect (%d)\n",
nc, rc);
- return rc;
+ return -EINVAL;
}
if ((of_property_present(nc, "parallel-memories")) &&
(!(ctlr->flags & SPI_CONTROLLER_MULTI_CS))) {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 191/563] clocksource/drivers/timer-tegra186: Avoid 64-bit divide operation
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 190/563] spi: fix return code when spi device has too many chipselects Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 192/563] clocksource/drivers/tegra186: Avoid 64-bit division Greg Kroah-Hartman
` (385 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Daniel Lezcano,
Jon Hunter, Pohsun Su, Robert Lin, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <linux@roeck-us.net>
[ Upstream commit 916aa36042db8ee230543ffe0d192f900e8b8c9f ]
Building the driver on xtensa fails with
tensa-linux-ld: drivers/clocksource/timer-tegra186.o:
in function `tegra186_timer_remove':
timer-tegra186.c:(.text+0x350):
undefined reference to `__udivdi3'
Avoid the problem by rearranging the offending code to avoid the 64-bit
divide operation.
Fixes: 28c842c8b0f5 ("clocksource/drivers/timer-tegra186: Add WDIOC_GETTIMELEFT support")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Cc: Pohsun Su <pohsuns@nvidia.com>
Cc: Robert Lin <robelin@nvidia.com>
Link: https://lore.kernel.org/r/20250614175556.922159-1-linux@roeck-us.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/timer-tegra186.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clocksource/timer-tegra186.c b/drivers/clocksource/timer-tegra186.c
index e5394f98a02e6..7b506de654386 100644
--- a/drivers/clocksource/timer-tegra186.c
+++ b/drivers/clocksource/timer-tegra186.c
@@ -267,7 +267,7 @@ static unsigned int tegra186_wdt_get_timeleft(struct watchdog_device *wdd)
* counter value to the time of the counter expirations that
* remain.
*/
- timeleft += (((u64)wdt->base.timeout * USEC_PER_SEC) / 5) * (4 - expiration);
+ timeleft += ((u64)wdt->base.timeout * (USEC_PER_SEC / 5)) * (4 - expiration);
/*
* Convert the current counter value to seconds,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 192/563] clocksource/drivers/tegra186: Avoid 64-bit division
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 191/563] clocksource/drivers/timer-tegra186: Avoid 64-bit divide operation Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 193/563] bpf: Mark kfuncs as __noclone Greg Kroah-Hartman
` (384 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Daniel Lezcano,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 409f8fe03e08f92bf5be96cedbcd7a3e8fb2eeaf ]
The newly added function causes a build failure on 32-bit targets with
older compiler version such as gcc-10:
arm-linux-gnueabi-ld: drivers/clocksource/timer-tegra186.o: in function `tegra186_wdt_get_timeleft':
timer-tegra186.c:(.text+0x3c2): undefined reference to `__aeabi_uldivmod'
The calculation can trivially be changed to avoid the division entirely,
as USEC_PER_SEC is a multiple of 5. Change both such calculation for
consistency, even though gcc apparently managed to optimize the other one
properly already.
[dlezcano : Fixed conflict with 20250614175556.922159-2-linux@roeck-us.net ]
Fixes: 28c842c8b0f5 ("clocksource/drivers/timer-tegra186: Add WDIOC_GETTIMELEFT support")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20250620111939.3395525-1-arnd@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/timer-tegra186.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clocksource/timer-tegra186.c b/drivers/clocksource/timer-tegra186.c
index 7b506de654386..47bdb1e320af9 100644
--- a/drivers/clocksource/timer-tegra186.c
+++ b/drivers/clocksource/timer-tegra186.c
@@ -159,7 +159,7 @@ static void tegra186_wdt_enable(struct tegra186_wdt *wdt)
tmr_writel(wdt->tmr, TMRCSSR_SRC_USEC, TMRCSSR);
/* configure timer (system reset happens on the fifth expiration) */
- value = TMRCR_PTV(wdt->base.timeout * USEC_PER_SEC / 5) |
+ value = TMRCR_PTV(wdt->base.timeout * (USEC_PER_SEC / 5)) |
TMRCR_PERIODIC | TMRCR_ENABLE;
tmr_writel(wdt->tmr, value, TMRCR);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 193/563] bpf: Mark kfuncs as __noclone
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 192/563] clocksource/drivers/tegra186: Avoid 64-bit division Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 194/563] once: fix race by moving DO_ONCE to separate section Greg Kroah-Hartman
` (383 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Vernet, Yonghong Song,
Andrea Righi, Alexei Starovoitov, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Righi <arighi@nvidia.com>
[ Upstream commit d4680a11e14c7baf683cb8453d91d71d2e0b9d3e ]
Some distributions (e.g., CachyOS) support building the kernel with -O3,
but doing so may break kfuncs, resulting in their symbols not being
properly exported.
In fact, with gcc -O3, some kfuncs may be optimized away despite being
annotated as noinline. This happens because gcc can still clone the
function during IPA optimizations, e.g., by duplicating or inlining it
into callers, and then dropping the standalone symbol. This breaks BTF
ID resolution since resolve_btfids relies on the presence of a global
symbol for each kfunc.
Currently, this is not an issue for upstream, because we don't allow
building the kernel with -O3, but it may be safer to address it anyway,
to prevent potential issues in the future if compilers become more
aggressive with optimizations.
Therefore, add __noclone to __bpf_kfunc to ensure kfuncs are never
cloned and remain distinct, globally visible symbols, regardless of
the optimization level.
Fixes: 57e7c169cd6af ("bpf: Add __bpf_kfunc tag for marking kernel functions as kfuncs")
Acked-by: David Vernet <void@manifault.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Signed-off-by: Andrea Righi <arighi@nvidia.com>
Link: https://lore.kernel.org/r/20250924081426.156934-1-arighi@nvidia.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/btf.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/btf.h b/include/linux/btf.h
index 9eda6b113f9b4..f06976ffb63f9 100644
--- a/include/linux/btf.h
+++ b/include/linux/btf.h
@@ -86,7 +86,7 @@
* as to avoid issues such as the compiler inlining or eliding either a static
* kfunc, or a global kfunc in an LTO build.
*/
-#define __bpf_kfunc __used __retain noinline
+#define __bpf_kfunc __used __retain __noclone noinline
#define __bpf_kfunc_start_defs() \
__diag_push(); \
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 194/563] once: fix race by moving DO_ONCE to separate section
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 193/563] bpf: Mark kfuncs as __noclone Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 195/563] hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems Greg Kroah-Hartman
` (382 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hulk Robot, Qi Xi, Arnd Bergmann,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Xi <xiqi2@huawei.com>
[ Upstream commit edcc8a38b5ac1a3dbd05e113a38a25b937ebefe5 ]
The commit c2c60ea37e5b ("once: use __section(".data.once")") moved
DO_ONCE's ___done variable to .data.once section, which conflicts with
DO_ONCE_LITE() that also uses the same section.
This creates a race condition when clear_warn_once is used:
Thread 1 (DO_ONCE) Thread 2 (DO_ONCE)
__do_once_start
read ___done (false)
acquire once_lock
execute func
__do_once_done
write ___done (true) __do_once_start
release once_lock // Thread 3 clear_warn_once reset ___done
read ___done (false)
acquire once_lock
execute func
schedule once_work __do_once_done
once_deferred: OK write ___done (true)
static_branch_disable release once_lock
schedule once_work
once_deferred:
BUG_ON(!static_key_enabled)
DO_ONCE_LITE() in once_lite.h is used by WARN_ON_ONCE() and other warning
macros. Keep its ___done flag in the .data..once section and allow resetting
by clear_warn_once, as originally intended.
In contrast, DO_ONCE() is used for functions like get_random_once() and
relies on its ___done flag for internal synchronization. We should not reset
DO_ONCE() by clear_warn_once.
Fix it by isolating DO_ONCE's ___done into a separate .data..do_once section,
shielding it from clear_warn_once.
Fixes: c2c60ea37e5b ("once: use __section(".data.once")")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qi Xi <xiqi2@huawei.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/asm-generic/vmlinux.lds.h | 1 +
include/linux/once.h | 4 ++--
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index ae2d2359b79e9..8efbe8c4874ee 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -361,6 +361,7 @@ defined(CONFIG_AUTOFDO_CLANG) || defined(CONFIG_PROPELLER_CLANG)
__start_once = .; \
*(.data..once) \
__end_once = .; \
+ *(.data..do_once) \
STRUCT_ALIGN(); \
*(__tracepoints) \
/* implement dynamic printk debug */ \
diff --git a/include/linux/once.h b/include/linux/once.h
index 30346fcdc7995..449a0e34ad5ad 100644
--- a/include/linux/once.h
+++ b/include/linux/once.h
@@ -46,7 +46,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key,
#define DO_ONCE(func, ...) \
({ \
bool ___ret = false; \
- static bool __section(".data..once") ___done = false; \
+ static bool __section(".data..do_once") ___done = false; \
static DEFINE_STATIC_KEY_TRUE(___once_key); \
if (static_branch_unlikely(&___once_key)) { \
unsigned long ___flags; \
@@ -64,7 +64,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key,
#define DO_ONCE_SLEEPABLE(func, ...) \
({ \
bool ___ret = false; \
- static bool __section(".data..once") ___done = false; \
+ static bool __section(".data..do_once") ___done = false; \
static DEFINE_STATIC_KEY_TRUE(___once_key); \
if (static_branch_unlikely(&___once_key)) { \
___ret = __do_once_sleepable_start(&___done); \
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 195/563] hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 194/563] once: fix race by moving DO_ONCE to separate section Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 196/563] tools/nolibc: add stdbool.h to nolibc includes Greg Kroah-Hartman
` (381 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vadim Pasternak, Guenter Roeck,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vadim Pasternak <vadimp@nvidia.com>
[ Upstream commit c02e4644f8ac9c501077ef5ac53ae7fc51472d49 ]
Distinct between fan speed setting request coming for hwmon and
thermal subsystems.
There are fields 'last_hwmon_state' and 'last_thermal_state' in the
structure 'mlxreg_fan_pwm', which respectively store the cooling state
set by the 'hwmon' and 'thermal' subsystem.
The purpose is to make arbitration of fan speed setting. For example, if
fan speed required to be not lower than some limit, such setting is to
be performed through 'hwmon' subsystem, thus 'thermal' subsystem will
not set fan below this limit.
Currently, the 'last_thermal_state' is also be updated by 'hwmon' causing
cooling state to never be set to a lower value.
Eliminate update of 'last_thermal_state', when request is coming from
'hwmon' subsystem.
Fixes: da74944d3a46 ("hwmon: (mlxreg-fan) Use pwm attribute for setting fan speed low limit")
Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
Link: https://lore.kernel.org/r/20250113084859.27064-2-vadimp@nvidia.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/mlxreg-fan.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)
diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
index c25a54d5b39ad..0ba9195c9d713 100644
--- a/drivers/hwmon/mlxreg-fan.c
+++ b/drivers/hwmon/mlxreg-fan.c
@@ -113,8 +113,8 @@ struct mlxreg_fan {
int divider;
};
-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
- unsigned long state);
+static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+ unsigned long state, bool thermal);
static int
mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr,
@@ -224,8 +224,9 @@ mlxreg_fan_write(struct device *dev, enum hwmon_sensor_types type, u32 attr,
* last thermal state.
*/
if (pwm->last_hwmon_state >= pwm->last_thermal_state)
- return mlxreg_fan_set_cur_state(pwm->cdev,
- pwm->last_hwmon_state);
+ return _mlxreg_fan_set_cur_state(pwm->cdev,
+ pwm->last_hwmon_state,
+ false);
return 0;
}
return regmap_write(fan->regmap, pwm->reg, val);
@@ -357,9 +358,8 @@ static int mlxreg_fan_get_cur_state(struct thermal_cooling_device *cdev,
return 0;
}
-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
- unsigned long state)
-
+static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+ unsigned long state, bool thermal)
{
struct mlxreg_fan_pwm *pwm = cdev->devdata;
struct mlxreg_fan *fan = pwm->fan;
@@ -369,7 +369,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
return -EINVAL;
/* Save thermal state. */
- pwm->last_thermal_state = state;
+ if (thermal)
+ pwm->last_thermal_state = state;
state = max_t(unsigned long, state, pwm->last_hwmon_state);
err = regmap_write(fan->regmap, pwm->reg,
@@ -381,6 +382,13 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
return 0;
}
+static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+ unsigned long state)
+
+{
+ return _mlxreg_fan_set_cur_state(cdev, state, true);
+}
+
static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = {
.get_max_state = mlxreg_fan_get_max_state,
.get_cur_state = mlxreg_fan_get_cur_state,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 196/563] tools/nolibc: add stdbool.h to nolibc includes
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 195/563] hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 197/563] thermal/drivers/qcom: Make LMH select QCOM_SCM Greg Kroah-Hartman
` (380 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Brown, André Almeida,
Thomas Weißschuh, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Almeida <andrealmeid@igalia.com>
[ Upstream commit 2d965c1ae4135ed6f505661458f6dabd39488dac ]
Otherwise tests compiled with only "-include nolibc.h" will fail with
"error: unknown type name 'bool'", even though a stdbool.h is available
from nolibc.
Fixes: ae1f550efc11 ("tools/nolibc: add stdbool.h header")
Fixes: f2662ec26b26 ("selftests: kselftest: Create ksft_print_dbg_msg()")
Reported-by: Mark Brown <broonie@kernel.org>
Closes: https://lore.kernel.org/lkml/833f5ae5-190e-47ec-9ad9-127ad166c80c@sirena.org.uk/
Signed-off-by: André Almeida <andrealmeid@igalia.com>
[Thomas: add Fixes tags and massage commit message a bit]
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/include/nolibc/nolibc.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/include/nolibc/nolibc.h b/tools/include/nolibc/nolibc.h
index c199ade200c24..d2f5aa085f8e3 100644
--- a/tools/include/nolibc/nolibc.h
+++ b/tools/include/nolibc/nolibc.h
@@ -116,6 +116,7 @@
#include "sched.h"
#include "signal.h"
#include "unistd.h"
+#include "stdbool.h"
#include "stdio.h"
#include "stdlib.h"
#include "string.h"
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 197/563] thermal/drivers/qcom: Make LMH select QCOM_SCM
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 196/563] tools/nolibc: add stdbool.h to nolibc includes Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:40 ` [PATCH 6.17 198/563] thermal/drivers/qcom/lmh: Add missing IRQ includes Greg Kroah-Hartman
` (379 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Daniel Lezcano,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
[ Upstream commit 57eda47bd14b0c2876f2db42e757c57b7a671965 ]
The QCOM_SCM symbol is not user-visible, so it makes little sense to
depend on it. Make LMH driver select QCOM_SCM as all other drivers do
and, as the dependecy is now correctly handled, enable || COMPILE_TEST
in order to include the driver into broader set of build tests.
Fixes: 9e5a4fb84230 ("thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-1-33bc58388ca5@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/qcom/Kconfig | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/thermal/qcom/Kconfig b/drivers/thermal/qcom/Kconfig
index 2c7f3f9a26ebb..a6bb01082ec69 100644
--- a/drivers/thermal/qcom/Kconfig
+++ b/drivers/thermal/qcom/Kconfig
@@ -34,7 +34,8 @@ config QCOM_SPMI_TEMP_ALARM
config QCOM_LMH
tristate "Qualcomm Limits Management Hardware"
- depends on ARCH_QCOM && QCOM_SCM
+ depends on ARCH_QCOM || COMPILE_TEST
+ select QCOM_SCM
help
This enables initialization of Qualcomm limits management
hardware(LMh). LMh allows for hardware-enforced mitigation for cpus based on
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 198/563] thermal/drivers/qcom/lmh: Add missing IRQ includes
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 197/563] thermal/drivers/qcom: Make LMH select QCOM_SCM Greg Kroah-Hartman
@ 2025-10-13 14:40 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 199/563] i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD Greg Kroah-Hartman
` (378 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Dmitry Baryshkov,
Daniel Lezcano, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
[ Upstream commit b50b2c53f98fcdb6957e184eb488c16502db9575 ]
As reported by LKP, the Qualcomm LMH driver needs to include several
IRQ-related headers, which decrlare necessary IRQ functionality.
Currently driver builds on ARM64 platforms, where the headers are pulled
in implicitly by other headers, but fails to build on other platforms.
Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202507270042.KdK0KKht-lkp@intel.com/
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-2-33bc58388ca5@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/qcom/lmh.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c
index 75eaa9a68ab8a..c681a3c89ffa0 100644
--- a/drivers/thermal/qcom/lmh.c
+++ b/drivers/thermal/qcom/lmh.c
@@ -5,6 +5,8 @@
*/
#include <linux/module.h>
#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/irqdesc.h>
#include <linux/irqdomain.h>
#include <linux/err.h>
#include <linux/platform_device.h>
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 199/563] i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2025-10-13 14:40 ` [PATCH 6.17 198/563] thermal/drivers/qcom/lmh: Add missing IRQ includes Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 200/563] i2c: spacemit: ensure bus release check runs when wait_bus_idle() fails Greg Kroah-Hartman
` (377 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Leilk.Liu, Chen-Yu Tsai,
Wolfram Sang, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leilk.Liu <leilk.liu@mediatek.com>
[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ]
The old IC does not support the I2C_MASTER_WRRD (write-then-read)
function, but the current code’s handling of i2c->auto_restart may
potentially lead to entering the I2C_MASTER_WRRD software flow,
resulting in unexpected bugs.
Instead of repurposing the auto_restart flag, add a separate flag
to signal I2C_MASTER_WRRD operations.
Also fix handling of msgs. If the operation (i2c->op) is
I2C_MASTER_WRRD, then the msgs pointer is incremented by 2.
For all other operations, msgs is simply incremented by 1.
Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller")
Signed-off-by: Leilk.Liu <leilk.liu@mediatek.com>
Suggested-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)
diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
index ab456c3717db1..dee40704825cb 100644
--- a/drivers/i2c/busses/i2c-mt65xx.c
+++ b/drivers/i2c/busses/i2c-mt65xx.c
@@ -1243,6 +1243,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
{
int ret;
int left_num = num;
+ bool write_then_read_en = false;
struct mtk_i2c *i2c = i2c_get_adapdata(adap);
ret = clk_bulk_enable(I2C_MT65XX_CLK_MAX, i2c->clocks);
@@ -1256,6 +1257,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) &&
msgs[0].addr == msgs[1].addr) {
i2c->auto_restart = 0;
+ write_then_read_en = true;
}
}
@@ -1280,12 +1282,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
else
i2c->op = I2C_MASTER_WR;
- if (!i2c->auto_restart) {
- if (num > 1) {
- /* combined two messages into one transaction */
- i2c->op = I2C_MASTER_WRRD;
- left_num--;
- }
+ if (write_then_read_en) {
+ /* combined two messages into one transaction */
+ i2c->op = I2C_MASTER_WRRD;
+ left_num--;
}
/* always use DMA mode. */
@@ -1293,7 +1293,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
if (ret < 0)
goto err_exit;
- msgs++;
+ if (i2c->op == I2C_MASTER_WRRD)
+ msgs += 2;
+ else
+ msgs++;
}
/* the return value is number of executed messages */
ret = num;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 200/563] i2c: spacemit: ensure bus release check runs when wait_bus_idle() fails
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 199/563] i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 201/563] i2c: spacemit: remove stop function to avoid bus error Greg Kroah-Hartman
` (376 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aurelien Jarno, Troy Mitchell,
Wolfram Sang, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
[ Upstream commit 41d6f90ef5dc2841bdd09817c63a3d6188473b9b ]
spacemit_i2c_wait_bus_idle() only returns 0 on success or a negative
error code on failure.
Since 'ret' can never be positive, the final 'else' branch was
unreachable, and spacemit_i2c_check_bus_release() was never called.
This commit guarantees we attempt to release the bus whenever waiting for
an idle bus fails.
Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-k1.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
index b68a21fff0b56..ee08811f4087c 100644
--- a/drivers/i2c/busses/i2c-k1.c
+++ b/drivers/i2c/busses/i2c-k1.c
@@ -476,12 +476,13 @@ static int spacemit_i2c_xfer(struct i2c_adapter *adapt, struct i2c_msg *msgs, in
spacemit_i2c_enable(i2c);
ret = spacemit_i2c_wait_bus_idle(i2c);
- if (!ret)
+ if (!ret) {
ret = spacemit_i2c_xfer_msg(i2c);
- else if (ret < 0)
- dev_dbg(i2c->dev, "i2c transfer error: %d\n", ret);
- else
+ if (ret < 0)
+ dev_dbg(i2c->dev, "i2c transfer error: %d\n", ret);
+ } else {
spacemit_i2c_check_bus_release(i2c);
+ }
spacemit_i2c_disable(i2c);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 201/563] i2c: spacemit: remove stop function to avoid bus error
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 200/563] i2c: spacemit: ensure bus release check runs when wait_bus_idle() fails Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 202/563] i2c: spacemit: disable SDA glitch fix to avoid restart delay Greg Kroah-Hartman
` (375 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Troy Mitchell, Aurelien Jarno,
Wolfram Sang, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
[ Upstream commit 445522fe7aad6131b2747ae8c76f77266054cd84 ]
Previously, STOP handling was split into two separate steps:
1) clear TB/STOP/START/ACK bits
2) issue STOP by calling spacemit_i2c_stop()
This left a small window where the control register was updated
twice, which can confuse the controller. While this race has not
been observed with interrupt-driven transfers, it reliably causes
bus errors in PIO mode.
Inline the STOP sequence into the IRQ handler and ensure that
control register bits are updated atomically in a single writel().
Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-k1.c | 26 +++++++-------------------
1 file changed, 7 insertions(+), 19 deletions(-)
diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
index ee08811f4087c..84f132d0504dc 100644
--- a/drivers/i2c/busses/i2c-k1.c
+++ b/drivers/i2c/busses/i2c-k1.c
@@ -267,19 +267,6 @@ static void spacemit_i2c_start(struct spacemit_i2c_dev *i2c)
writel(val, i2c->base + SPACEMIT_ICR);
}
-static void spacemit_i2c_stop(struct spacemit_i2c_dev *i2c)
-{
- u32 val;
-
- val = readl(i2c->base + SPACEMIT_ICR);
- val |= SPACEMIT_CR_STOP | SPACEMIT_CR_ALDIE | SPACEMIT_CR_TB;
-
- if (i2c->read)
- val |= SPACEMIT_CR_ACKNAK;
-
- writel(val, i2c->base + SPACEMIT_ICR);
-}
-
static int spacemit_i2c_xfer_msg(struct spacemit_i2c_dev *i2c)
{
unsigned long time_left;
@@ -412,7 +399,6 @@ static irqreturn_t spacemit_i2c_irq_handler(int irq, void *devid)
val = readl(i2c->base + SPACEMIT_ICR);
val &= ~(SPACEMIT_CR_TB | SPACEMIT_CR_ACKNAK | SPACEMIT_CR_STOP | SPACEMIT_CR_START);
- writel(val, i2c->base + SPACEMIT_ICR);
switch (i2c->state) {
case SPACEMIT_STATE_START:
@@ -429,14 +415,16 @@ static irqreturn_t spacemit_i2c_irq_handler(int irq, void *devid)
}
if (i2c->state != SPACEMIT_STATE_IDLE) {
+ val |= SPACEMIT_CR_TB | SPACEMIT_CR_ALDIE;
+
if (spacemit_i2c_is_last_msg(i2c)) {
/* trigger next byte with stop */
- spacemit_i2c_stop(i2c);
- } else {
- /* trigger next byte */
- val |= SPACEMIT_CR_ALDIE | SPACEMIT_CR_TB;
- writel(val, i2c->base + SPACEMIT_ICR);
+ val |= SPACEMIT_CR_STOP;
+
+ if (i2c->read)
+ val |= SPACEMIT_CR_ACKNAK;
}
+ writel(val, i2c->base + SPACEMIT_ICR);
}
err_out:
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 202/563] i2c: spacemit: disable SDA glitch fix to avoid restart delay
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 201/563] i2c: spacemit: remove stop function to avoid bus error Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 203/563] i2c: spacemit: check SDA instead of SCL after bus reset Greg Kroah-Hartman
` (374 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aurelien Jarno, Troy Mitchell,
Wolfram Sang, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
[ Upstream commit 11f40684ccd84e792eced110f0a5d3d6adbdf90d ]
The K1 I2C controller has an SDA glitch fix that introduces a small
delay on restart signals. While this feature can suppress glitches
on SDA when SCL = 0, it also delays the restart signal, which may
cause unexpected behavior in some transfers.
The glitch itself does not affect normal I2C operation, because
the I2C specification allows SDA to change while SCL is low.
To ensure correct transmission for every message, we disable the
SDA glitch fix by setting the RCR.SDA_GLITCH_NOFIX bit during
initialization.
This guarantees that restarts are issued promptly without
unintended delays.
Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-k1.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
index 84f132d0504dc..9bf9f01aa68bd 100644
--- a/drivers/i2c/busses/i2c-k1.c
+++ b/drivers/i2c/busses/i2c-k1.c
@@ -14,6 +14,7 @@
#define SPACEMIT_ICR 0x0 /* Control register */
#define SPACEMIT_ISR 0x4 /* Status register */
#define SPACEMIT_IDBR 0xc /* Data buffer register */
+#define SPACEMIT_IRCR 0x18 /* Reset cycle counter */
#define SPACEMIT_IBMR 0x1c /* Bus monitor register */
/* SPACEMIT_ICR register fields */
@@ -76,6 +77,8 @@
SPACEMIT_SR_GCAD | SPACEMIT_SR_IRF | SPACEMIT_SR_ITE | \
SPACEMIT_SR_ALD)
+#define SPACEMIT_RCR_SDA_GLITCH_NOFIX BIT(7) /* bypass the SDA glitch fix */
+
/* SPACEMIT_IBMR register fields */
#define SPACEMIT_BMR_SDA BIT(0) /* SDA line level */
#define SPACEMIT_BMR_SCL BIT(1) /* SCL line level */
@@ -237,6 +240,14 @@ static void spacemit_i2c_init(struct spacemit_i2c_dev *i2c)
val |= SPACEMIT_CR_MSDE | SPACEMIT_CR_MSDIE;
writel(val, i2c->base + SPACEMIT_ICR);
+
+ /*
+ * The glitch fix in the K1 I2C controller introduces a delay
+ * on restart signals, so we disable the fix here.
+ */
+ val = readl(i2c->base + SPACEMIT_IRCR);
+ val |= SPACEMIT_RCR_SDA_GLITCH_NOFIX;
+ writel(val, i2c->base + SPACEMIT_IRCR);
}
static inline void
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 203/563] i2c: spacemit: check SDA instead of SCL after bus reset
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 202/563] i2c: spacemit: disable SDA glitch fix to avoid restart delay Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 204/563] i2c: spacemit: ensure SDA is released " Greg Kroah-Hartman
` (373 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aurelien Jarno, Troy Mitchell,
Wolfram Sang, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
[ Upstream commit db7720ef50e0103be70a3887bc66e9c909933ad9 ]
After calling spacemit_i2c_conditionally_reset_bus(),
the controller should ensure that the SDA line is release
before proceeding.
Previously, the driver checked the SCL line instead,
which does not guarantee that the bus is truly idle.
This patch changes the check to verify SDA. This ensures
proper bus recovery and avoids potential communication errors
after a conditional reset.
Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-k1.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
index 9bf9f01aa68bd..848dfaf634f63 100644
--- a/drivers/i2c/busses/i2c-k1.c
+++ b/drivers/i2c/busses/i2c-k1.c
@@ -172,9 +172,9 @@ static void spacemit_i2c_conditionally_reset_bus(struct spacemit_i2c_dev *i2c)
spacemit_i2c_reset(i2c);
usleep_range(10, 20);
- /* check scl status again */
+ /* check sda again here */
status = readl(i2c->base + SPACEMIT_IBMR);
- if (!(status & SPACEMIT_BMR_SCL))
+ if (!(status & SPACEMIT_BMR_SDA))
dev_warn_ratelimited(i2c->dev, "unit reset failed\n");
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 204/563] i2c: spacemit: ensure SDA is released after bus reset
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 203/563] i2c: spacemit: check SDA instead of SCL after bus reset Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 205/563] i2c: designware: Fix clock issue when PM is disabled Greg Kroah-Hartman
` (372 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Troy Mitchell, Aurelien Jarno,
Wolfram Sang, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
[ Upstream commit 0de61943244dec418d396633a587adca1c350b55 ]
After performing a conditional bus reset, the controller must ensure
that the SDA line is actually released.
Previously, the reset routine only performed a single check,
which could leave the bus in a locked state in some situations.
This patch introduces a loop that toggles the reset cycle and issues
a reset request up to SPACEMIT_BUS_RESET_CLK_CNT_MAX times, checking
SDA after each attempt. If SDA is released before the maximum count,
the function returns early. Otherwise, a warning is emitted.
This change improves bus recovery reliability.
Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-k1.c | 21 ++++++++++++++++++++-
1 file changed, 20 insertions(+), 1 deletion(-)
diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
index 848dfaf634f63..6b918770e612e 100644
--- a/drivers/i2c/busses/i2c-k1.c
+++ b/drivers/i2c/busses/i2c-k1.c
@@ -3,6 +3,7 @@
* Copyright (C) 2024-2025 Troy Mitchell <troymitchell988@gmail.com>
*/
+#include <linux/bitfield.h>
#include <linux/clk.h>
#include <linux/i2c.h>
#include <linux/iopoll.h>
@@ -26,7 +27,8 @@
#define SPACEMIT_CR_MODE_FAST BIT(8) /* bus mode (master operation) */
/* Bit 9 is reserved */
#define SPACEMIT_CR_UR BIT(10) /* unit reset */
-/* Bits 11-12 are reserved */
+#define SPACEMIT_CR_RSTREQ BIT(11) /* i2c bus reset request */
+/* Bit 12 is reserved */
#define SPACEMIT_CR_SCLE BIT(13) /* master clock enable */
#define SPACEMIT_CR_IUE BIT(14) /* unit enable */
/* Bits 15-17 are reserved */
@@ -78,6 +80,8 @@
SPACEMIT_SR_ALD)
#define SPACEMIT_RCR_SDA_GLITCH_NOFIX BIT(7) /* bypass the SDA glitch fix */
+/* the cycles of SCL during bus reset */
+#define SPACEMIT_RCR_FIELD_RST_CYC GENMASK(3, 0)
/* SPACEMIT_IBMR register fields */
#define SPACEMIT_BMR_SDA BIT(0) /* SDA line level */
@@ -91,6 +95,8 @@
#define SPACEMIT_SR_ERR (SPACEMIT_SR_BED | SPACEMIT_SR_RXOV | SPACEMIT_SR_ALD)
+#define SPACEMIT_BUS_RESET_CLK_CNT_MAX 9
+
enum spacemit_i2c_state {
SPACEMIT_STATE_IDLE,
SPACEMIT_STATE_START,
@@ -163,6 +169,7 @@ static int spacemit_i2c_handle_err(struct spacemit_i2c_dev *i2c)
static void spacemit_i2c_conditionally_reset_bus(struct spacemit_i2c_dev *i2c)
{
u32 status;
+ u8 clk_cnt;
/* if bus is locked, reset unit. 0: locked */
status = readl(i2c->base + SPACEMIT_IBMR);
@@ -172,6 +179,18 @@ static void spacemit_i2c_conditionally_reset_bus(struct spacemit_i2c_dev *i2c)
spacemit_i2c_reset(i2c);
usleep_range(10, 20);
+ for (clk_cnt = 0; clk_cnt < SPACEMIT_BUS_RESET_CLK_CNT_MAX; clk_cnt++) {
+ status = readl(i2c->base + SPACEMIT_IBMR);
+ if (status & SPACEMIT_BMR_SDA)
+ return;
+
+ /* There's nothing left to save here, we are about to exit */
+ writel(FIELD_PREP(SPACEMIT_RCR_FIELD_RST_CYC, 1),
+ i2c->base + SPACEMIT_IRCR);
+ writel(SPACEMIT_CR_RSTREQ, i2c->base + SPACEMIT_ICR);
+ usleep_range(20, 30);
+ }
+
/* check sda again here */
status = readl(i2c->base + SPACEMIT_IBMR);
if (!(status & SPACEMIT_BMR_SDA))
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 205/563] i2c: designware: Fix clock issue when PM is disabled
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 204/563] i2c: spacemit: ensure SDA is released " Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 206/563] i2c: designware: Add disabling clocks when probe fails Greg Kroah-Hartman
` (371 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kohei Ito, Kunihiko Hayashi,
Jarkko Nikula, Wolfram Sang, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
[ Upstream commit 70e633bedeeb4a7290d3b1dd9d49cc2bae25a46f ]
When the driver is removed, the clocks are first enabled by
calling pm_runtime_get_sync(), and then disabled with
pm_runtime_put_sync().
If CONFIG_PM=y, clocks for this controller are disabled when it's in
the idle state. So the clocks are properly disabled when the driver
exits.
Othewise, the clocks are always enabled and the PM functions have
no effect. Therefore, the driver exits without disabling the clocks.
# cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
18
# echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/bind
# cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
20
# echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/unbind
# cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
20
To ensure that the clocks can be disabled correctly even without
CONFIG_PM=y, should add the following fixes:
- Replace with pm_runtime_put_noidle(), which only decrements the runtime
PM usage count.
- Call i2c_dw_prepare_clk(false) to explicitly disable the clocks.
Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
Co-developed-by: Kohei Ito <ito.kohei@socionext.com>
Signed-off-by: Kohei Ito <ito.kohei@socionext.com>
Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
Tested-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-designware-platdrv.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index a35e4c64a1d46..b4bfdd2dd35e4 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -331,9 +331,11 @@ static void dw_i2c_plat_remove(struct platform_device *pdev)
i2c_dw_disable(dev);
pm_runtime_dont_use_autosuspend(device);
- pm_runtime_put_sync(device);
+ pm_runtime_put_noidle(device);
dw_i2c_plat_pm_cleanup(dev);
+ i2c_dw_prepare_clk(dev, false);
+
i2c_dw_remove_lock_support(dev);
reset_control_assert(dev->rst);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 206/563] i2c: designware: Add disabling clocks when probe fails
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 205/563] i2c: designware: Fix clock issue when PM is disabled Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 207/563] libbpf: Fix error when st-prefix_ops and ops from differ btf Greg Kroah-Hartman
` (370 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kohei Ito, Kunihiko Hayashi,
Jarkko Nikula, Wolfram Sang, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ]
After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is
called. However, this function doesn't disable clocks and the clock-enable
count keeps increasing. Should disable these clocks explicitly.
Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
Co-developed-by: Kohei Ito <ito.kohei@socionext.com>
Signed-off-by: Kohei Ito <ito.kohei@socionext.com>
Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-designware-platdrv.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index b4bfdd2dd35e4..e37210d6c5f26 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -314,6 +314,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
exit_probe:
dw_i2c_plat_pm_cleanup(dev);
+ i2c_dw_prepare_clk(dev, false);
exit_reset:
reset_control_assert(dev->rst);
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 207/563] libbpf: Fix error when st-prefix_ops and ops from differ btf
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 206/563] i2c: designware: Add disabling clocks when probe fails Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 208/563] bpf: Enforce expected_attach_type for tailcall compatibility Greg Kroah-Hartman
` (369 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, D. Wythe, Andrii Nakryiko,
Martin KaFai Lau, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: D. Wythe <alibuda@linux.alibaba.com>
[ Upstream commit 0cc114dc358cf8da2ca23a366e761e89a46ca277 ]
When a module registers a struct_ops, the struct_ops type and its
corresponding map_value type ("bpf_struct_ops_") may reside in different
btf objects, here are four possible case:
+--------+---------------+-------------+---------------------------------+
| |bpf_struct_ops_| xxx_ops | |
+--------+---------------+-------------+---------------------------------+
| case 0 | btf_vmlinux | btf_vmlinux | be used and reg only in vmlinux |
+--------+---------------+-------------+---------------------------------+
| case 1 | btf_vmlinux | mod_btf | INVALID |
+--------+---------------+-------------+---------------------------------+
| case 2 | mod_btf | btf_vmlinux | reg in mod but be used both in |
| | | | vmlinux and mod. |
+--------+---------------+-------------+---------------------------------+
| case 3 | mod_btf | mod_btf | be used and reg only in mod |
+--------+---------------+-------------+---------------------------------+
Currently we figure out the mod_btf by searching with the struct_ops type,
which makes it impossible to figure out the mod_btf when the struct_ops
type is in btf_vmlinux while it's corresponding map_value type is in
mod_btf (case 2).
The fix is to use the corresponding map_value type ("bpf_struct_ops_")
as the lookup anchor instead of the struct_ops type to figure out the
`btf` and `mod_btf` via find_ksym_btf_id(), and then we can locate
the kern_type_id via btf__find_by_name_kind() with the `btf` we just
obtained from find_ksym_btf_id().
With this change the lookup obtains the correct btf and mod_btf for case 2,
preserves correct behavior for other valid cases, and still fails as
expected for the invalid scenario (case 1).
Fixes: 590a00888250 ("bpf: libbpf: Add STRUCT_OPS support")
Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://lore.kernel.org/bpf/20250926071751.108293-1-alibuda@linux.alibaba.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/libbpf.c | 36 +++++++++++++++++-------------------
1 file changed, 17 insertions(+), 19 deletions(-)
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index fe4fc5438678c..8f9261279b921 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -1013,35 +1013,33 @@ find_struct_ops_kern_types(struct bpf_object *obj, const char *tname_raw,
const struct btf_member *kern_data_member;
struct btf *btf = NULL;
__s32 kern_vtype_id, kern_type_id;
- char tname[256];
+ char tname[192], stname[256];
__u32 i;
snprintf(tname, sizeof(tname), "%.*s",
(int)bpf_core_essential_name_len(tname_raw), tname_raw);
- kern_type_id = find_ksym_btf_id(obj, tname, BTF_KIND_STRUCT,
- &btf, mod_btf);
- if (kern_type_id < 0) {
- pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n",
- tname);
- return kern_type_id;
- }
- kern_type = btf__type_by_id(btf, kern_type_id);
+ snprintf(stname, sizeof(stname), "%s%s", STRUCT_OPS_VALUE_PREFIX, tname);
- /* Find the corresponding "map_value" type that will be used
- * in map_update(BPF_MAP_TYPE_STRUCT_OPS). For example,
- * find "struct bpf_struct_ops_tcp_congestion_ops" from the
- * btf_vmlinux.
+ /* Look for the corresponding "map_value" type that will be used
+ * in map_update(BPF_MAP_TYPE_STRUCT_OPS) first, figure out the btf
+ * and the mod_btf.
+ * For example, find "struct bpf_struct_ops_tcp_congestion_ops".
*/
- kern_vtype_id = find_btf_by_prefix_kind(btf, STRUCT_OPS_VALUE_PREFIX,
- tname, BTF_KIND_STRUCT);
+ kern_vtype_id = find_ksym_btf_id(obj, stname, BTF_KIND_STRUCT, &btf, mod_btf);
if (kern_vtype_id < 0) {
- pr_warn("struct_ops init_kern: struct %s%s is not found in kernel BTF\n",
- STRUCT_OPS_VALUE_PREFIX, tname);
+ pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", stname);
return kern_vtype_id;
}
kern_vtype = btf__type_by_id(btf, kern_vtype_id);
+ kern_type_id = btf__find_by_name_kind(btf, tname, BTF_KIND_STRUCT);
+ if (kern_type_id < 0) {
+ pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", tname);
+ return kern_type_id;
+ }
+ kern_type = btf__type_by_id(btf, kern_type_id);
+
/* Find "struct tcp_congestion_ops" from
* struct bpf_struct_ops_tcp_congestion_ops {
* [ ... ]
@@ -1054,8 +1052,8 @@ find_struct_ops_kern_types(struct bpf_object *obj, const char *tname_raw,
break;
}
if (i == btf_vlen(kern_vtype)) {
- pr_warn("struct_ops init_kern: struct %s data is not found in struct %s%s\n",
- tname, STRUCT_OPS_VALUE_PREFIX, tname);
+ pr_warn("struct_ops init_kern: struct %s data is not found in struct %s\n",
+ tname, stname);
return -EINVAL;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 208/563] bpf: Enforce expected_attach_type for tailcall compatibility
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 207/563] libbpf: Fix error when st-prefix_ops and ops from differ btf Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 209/563] i3c: fix big-endian FIFO transfers Greg Kroah-Hartman
` (368 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yinhao Hu, Kaiyan Mei, Dongliang Mu,
Daniel Borkmann, Alexei Starovoitov, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
[ Upstream commit 4540aed51b12bc13364149bf95f6ecef013197c0 ]
Yinhao et al. recently reported:
Our fuzzer tool discovered an uninitialized pointer issue in the
bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem.
This leads to a NULL pointer dereference when a BPF program attempts to
deference the txq member of struct xdp_buff object.
The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the
entry point for bpf_prog_test_run_xdp() and its expected_attach_type can
neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot
of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP
to pass xdp_is_valid_access() validation. The program returns struct xdp_md's
egress_ifindex, and the latter is only allowed to be accessed under mentioned
expected_attach_type. progB is then inserted into the tailcall which progA
calls.
The underlying issue goes beyond XDP though. Another example are programs
of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well
as sock_addr_func_proto() have different logic depending on the programs'
expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME
should not be allowed doing a tailcall into a program which calls bpf_bind()
out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT.
In short, specifying expected_attach_type allows to open up additional
functionality or restrictions beyond what the basic bpf_prog_type enables.
The use of tailcalls must not violate these constraints. Fix it by enforcing
expected_attach_type in __bpf_prog_map_compatible().
Note that we only enforce this for tailcall maps, but not for BPF devmaps or
cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and
cpu_map_bpf_prog_run*() which set up a new environment / context and therefore
these situations are not prone to this issue.
Fixes: 5e43f899b03a ("bpf: Check attach type at prog load time")
Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20250926171201.188490-1-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/bpf.h | 1 +
kernel/bpf/core.c | 5 +++++
2 files changed, 6 insertions(+)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index cc700925b802f..84826dc0a3268 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -285,6 +285,7 @@ struct bpf_map_owner {
bool xdp_has_frags;
u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE];
const struct btf_type *attach_func_proto;
+ enum bpf_attach_type expected_attach_type;
};
struct bpf_map {
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index e4568d44e8279..f6dd071f5e38c 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -2393,6 +2393,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
map->owner->type = prog_type;
map->owner->jited = fp->jited;
map->owner->xdp_has_frags = aux->xdp_has_frags;
+ map->owner->expected_attach_type = fp->expected_attach_type;
map->owner->attach_func_proto = aux->attach_func_proto;
for_each_cgroup_storage_type(i) {
map->owner->storage_cookie[i] =
@@ -2404,6 +2405,10 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
ret = map->owner->type == prog_type &&
map->owner->jited == fp->jited &&
map->owner->xdp_has_frags == aux->xdp_has_frags;
+ if (ret &&
+ map->map_type == BPF_MAP_TYPE_PROG_ARRAY &&
+ map->owner->expected_attach_type != fp->expected_attach_type)
+ ret = false;
for_each_cgroup_storage_type(i) {
if (!ret)
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 209/563] i3c: fix big-endian FIFO transfers
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 208/563] bpf: Enforce expected_attach_type for tailcall compatibility Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 15:36 ` Guntupalli, Manikanta
2025-10-13 14:41 ` [PATCH 6.17 210/563] mfd: max77705: Setup the core driver as an interrupt controller Greg Kroah-Hartman
` (367 subsequent siblings)
576 siblings, 1 reply; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manikanta Guntupalli, Arnd Bergmann,
Jorge Marques, Alexandre Belloni, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit d6ddd9beb1a5c32acb9b80f5c2cd8b17f41371d1 ]
Short MMIO transfers that are not a multiple of four bytes in size need
a special case for the final bytes, however the existing implementation
is not endian-safe and introduces an incorrect byteswap on big-endian
kernels.
This usually does not cause problems because most systems are
little-endian and most transfers are multiple of four bytes long, but
still needs to be fixed to avoid the extra byteswap.
Change the special case for both i3c_writel_fifo() and i3c_readl_fifo()
to use non-byteswapping writesl() and readsl() with a single element
instead of the byteswapping writel()/readl() that are meant for individual
MMIO registers. As data is copied between a FIFO and a memory buffer,
the writesl()/readsl() loops are typically based on __raw_readl()/
__raw_writel(), resulting in the order of bytes in the FIFO to match
the order in the buffer, regardless of the CPU endianess.
The earlier versions in the dw-i3c and i3c-master-cdns had a correct
implementation, but the generic version that was recently added broke it.
Fixes: 733b439375b4 ("i3c: master: Add inline i3c_readl_fifo() and i3c_writel_fifo()")
Cc: Manikanta Guntupalli <manikanta.guntupalli@amd.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Jorge Marques <jorge.marques@analog.com>
Link: https://lore.kernel.org/r/20250924201837.3691486-1-arnd@kernel.org
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i3c/internals.h | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/i3c/internals.h b/drivers/i3c/internals.h
index 0d857cc68cc5d..79ceaa5f5afd6 100644
--- a/drivers/i3c/internals.h
+++ b/drivers/i3c/internals.h
@@ -38,7 +38,11 @@ static inline void i3c_writel_fifo(void __iomem *addr, const void *buf,
u32 tmp = 0;
memcpy(&tmp, buf + (nbytes & ~3), nbytes & 3);
- writel(tmp, addr);
+ /*
+ * writesl() instead of writel() to keep FIFO
+ * byteorder on big-endian targets
+ */
+ writesl(addr, &tmp, 1);
}
}
@@ -55,7 +59,11 @@ static inline void i3c_readl_fifo(const void __iomem *addr, void *buf,
if (nbytes & 3) {
u32 tmp;
- tmp = readl(addr);
+ /*
+ * readsl() instead of readl() to keep FIFO
+ * byteorder on big-endian targets
+ */
+ readsl(addr, &tmp, 1);
memcpy(buf + (nbytes & ~3), &tmp, nbytes & 3);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* RE: [PATCH 6.17 209/563] i3c: fix big-endian FIFO transfers
2025-10-13 14:41 ` [PATCH 6.17 209/563] i3c: fix big-endian FIFO transfers Greg Kroah-Hartman
@ 2025-10-13 15:36 ` Guntupalli, Manikanta
2025-10-13 17:33 ` Greg Kroah-Hartman
0 siblings, 1 reply; 591+ messages in thread
From: Guntupalli, Manikanta @ 2025-10-13 15:36 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable@vger.kernel.org
Cc: patches@lists.linux.dev, Arnd Bergmann, Jorge Marques,
Alexandre Belloni, Sasha Levin
[AMD Official Use Only - AMD Internal Distribution Only]
Hi Greg,
Please ignore this one - the next version of it has already been merged.
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v6.18-rc1&id=d6ddd9beb1a5c32acb9b80f5c2cd8b17f41371d1
Thanks,
Manikanta
> -----Original Message-----
> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Sent: Monday, October 13, 2025 8:11 PM
> To: stable@vger.kernel.org
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>; patches@lists.linux.dev;
> Guntupalli, Manikanta <manikanta.guntupalli@amd.com>; Arnd Bergmann
> <arnd@arndb.de>; Jorge Marques <jorge.marques@analog.com>; Alexandre
> Belloni <alexandre.belloni@bootlin.com>; Sasha Levin <sashal@kernel.org>
> Subject: [PATCH 6.17 209/563] i3c: fix big-endian FIFO transfers
>
> 6.17-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Arnd Bergmann <arnd@arndb.de>
>
> [ Upstream commit d6ddd9beb1a5c32acb9b80f5c2cd8b17f41371d1 ]
>
> Short MMIO transfers that are not a multiple of four bytes in size need a special case
> for the final bytes, however the existing implementation is not endian-safe and
> introduces an incorrect byteswap on big-endian kernels.
>
> This usually does not cause problems because most systems are little-endian and
> most transfers are multiple of four bytes long, but still needs to be fixed to avoid the
> extra byteswap.
>
> Change the special case for both i3c_writel_fifo() and i3c_readl_fifo() to use non-
> byteswapping writesl() and readsl() with a single element instead of the
> byteswapping writel()/readl() that are meant for individual MMIO registers. As data is
> copied between a FIFO and a memory buffer, the writesl()/readsl() loops are typically
> based on __raw_readl()/ __raw_writel(), resulting in the order of bytes in the FIFO to
> match the order in the buffer, regardless of the CPU endianess.
>
> The earlier versions in the dw-i3c and i3c-master-cdns had a correct implementation,
> but the generic version that was recently added broke it.
>
> Fixes: 733b439375b4 ("i3c: master: Add inline i3c_readl_fifo() and i3c_writel_fifo()")
> Cc: Manikanta Guntupalli <manikanta.guntupalli@amd.com>
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> Reviewed-by: Jorge Marques <jorge.marques@analog.com>
> Link: https://lore.kernel.org/r/20250924201837.3691486-1-arnd@kernel.org
> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/i3c/internals.h | 12 ++++++++++--
> 1 file changed, 10 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/i3c/internals.h b/drivers/i3c/internals.h index
> 0d857cc68cc5d..79ceaa5f5afd6 100644
> --- a/drivers/i3c/internals.h
> +++ b/drivers/i3c/internals.h
> @@ -38,7 +38,11 @@ static inline void i3c_writel_fifo(void __iomem *addr, const
> void *buf,
> u32 tmp = 0;
>
> memcpy(&tmp, buf + (nbytes & ~3), nbytes & 3);
> - writel(tmp, addr);
> + /*
> + * writesl() instead of writel() to keep FIFO
> + * byteorder on big-endian targets
> + */
> + writesl(addr, &tmp, 1);
> }
> }
>
> @@ -55,7 +59,11 @@ static inline void i3c_readl_fifo(const void __iomem *addr,
> void *buf,
> if (nbytes & 3) {
> u32 tmp;
>
> - tmp = readl(addr);
> + /*
> + * readsl() instead of readl() to keep FIFO
> + * byteorder on big-endian targets
> + */
> + readsl(addr, &tmp, 1);
> memcpy(buf + (nbytes & ~3), &tmp, nbytes & 3);
> }
> }
> --
> 2.51.0
>
>
^ permalink raw reply [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 209/563] i3c: fix big-endian FIFO transfers
2025-10-13 15:36 ` Guntupalli, Manikanta
@ 2025-10-13 17:33 ` Greg Kroah-Hartman
0 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 17:33 UTC (permalink / raw)
To: Guntupalli, Manikanta
Cc: stable@vger.kernel.org, patches@lists.linux.dev, Arnd Bergmann,
Jorge Marques, Alexandre Belloni, Sasha Levin
On Mon, Oct 13, 2025 at 03:36:42PM +0000, Guntupalli, Manikanta wrote:
> [AMD Official Use Only - AMD Internal Distribution Only]
>
> Hi Greg,
>
> Please ignore this one - the next version of it has already been merged.
>
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v6.18-rc1&id=d6ddd9beb1a5c32acb9b80f5c2cd8b17f41371d1
I do not understand, that is what this commit is:
> > 6.17-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Arnd Bergmann <arnd@arndb.de>
> >
> > [ Upstream commit d6ddd9beb1a5c32acb9b80f5c2cd8b17f41371d1 ]
We reference the git id here.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 591+ messages in thread
* [PATCH 6.17 210/563] mfd: max77705: Setup the core driver as an interrupt controller
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 209/563] i3c: fix big-endian FIFO transfers Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 211/563] drm/sched: Fix a race in DRM_GPU_SCHED_STAT_NO_HANG test Greg Kroah-Hartman
` (366 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dzmitry Sankouski, Lee Jones,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dzmitry Sankouski <dsankouski@gmail.com>
[ Upstream commit 605c9820e44de2da7d67acf66484136561da63a2 ]
Current implementation describes only MFD's own topsys interrupts.
However, max77705 has a register which indicates interrupt source, i.e.
it acts as an interrupt controller. There's 4 interrupt sources in
max77705: topsys, charger, fuelgauge, usb type-c manager.
Setup max77705 MFD parent as an interrupt controller. Delete topsys
interrupts because currently unused.
Remove shared interrupt flag, because we're are an interrupt controller
now, and subdevices should request interrupts from us.
Fixes: c8d50f029748 ("mfd: Add new driver for MAX77705 PMIC")
Signed-off-by: Dzmitry Sankouski <dsankouski@gmail.com>
Link: https://lore.kernel.org/r/20250909-max77705-fix_interrupt_handling-v3-1-233c5a1a20b5@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/max77705.c | 35 ++++++++++++++---------------------
1 file changed, 14 insertions(+), 21 deletions(-)
diff --git a/drivers/mfd/max77705.c b/drivers/mfd/max77705.c
index ff07d0e0d5f8e..e1a9bfd658560 100644
--- a/drivers/mfd/max77705.c
+++ b/drivers/mfd/max77705.c
@@ -61,21 +61,21 @@ static const struct regmap_config max77705_regmap_config = {
.max_register = MAX77705_PMIC_REG_USBC_RESET,
};
-static const struct regmap_irq max77705_topsys_irqs[] = {
- { .mask = MAX77705_SYSTEM_IRQ_BSTEN_INT, },
- { .mask = MAX77705_SYSTEM_IRQ_SYSUVLO_INT, },
- { .mask = MAX77705_SYSTEM_IRQ_SYSOVLO_INT, },
- { .mask = MAX77705_SYSTEM_IRQ_TSHDN_INT, },
- { .mask = MAX77705_SYSTEM_IRQ_TM_INT, },
+static const struct regmap_irq max77705_irqs[] = {
+ { .mask = MAX77705_SRC_IRQ_CHG, },
+ { .mask = MAX77705_SRC_IRQ_TOP, },
+ { .mask = MAX77705_SRC_IRQ_FG, },
+ { .mask = MAX77705_SRC_IRQ_USBC, },
};
-static const struct regmap_irq_chip max77705_topsys_irq_chip = {
- .name = "max77705-topsys",
- .status_base = MAX77705_PMIC_REG_SYSTEM_INT,
- .mask_base = MAX77705_PMIC_REG_SYSTEM_INT_MASK,
+static const struct regmap_irq_chip max77705_irq_chip = {
+ .name = "max77705",
+ .status_base = MAX77705_PMIC_REG_INTSRC,
+ .ack_base = MAX77705_PMIC_REG_INTSRC,
+ .mask_base = MAX77705_PMIC_REG_INTSRC_MASK,
.num_regs = 1,
- .irqs = max77705_topsys_irqs,
- .num_irqs = ARRAY_SIZE(max77705_topsys_irqs),
+ .irqs = max77705_irqs,
+ .num_irqs = ARRAY_SIZE(max77705_irqs),
};
static int max77705_i2c_probe(struct i2c_client *i2c)
@@ -113,19 +113,12 @@ static int max77705_i2c_probe(struct i2c_client *i2c)
ret = devm_regmap_add_irq_chip(dev, max77705->regmap,
i2c->irq,
- IRQF_ONESHOT | IRQF_SHARED, 0,
- &max77705_topsys_irq_chip,
+ IRQF_ONESHOT, 0,
+ &max77705_irq_chip,
&irq_data);
if (ret)
return dev_err_probe(dev, ret, "Failed to add IRQ chip\n");
- /* Unmask interrupts from all blocks in interrupt source register */
- ret = regmap_update_bits(max77705->regmap,
- MAX77705_PMIC_REG_INTSRC_MASK,
- MAX77705_SRC_IRQ_ALL, (unsigned int)~MAX77705_SRC_IRQ_ALL);
- if (ret < 0)
- return dev_err_probe(dev, ret, "Could not unmask interrupts in INTSRC\n");
-
domain = regmap_irq_get_domain(irq_data);
ret = devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 211/563] drm/sched: Fix a race in DRM_GPU_SCHED_STAT_NO_HANG test
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 210/563] mfd: max77705: Setup the core driver as an interrupt controller Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 212/563] drm/panel-edp: Add disable to 100ms for MNB601LS1-4 Greg Kroah-Hartman
` (365 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tvrtko Ursulin, Maíra Canal,
Philipp Stanner, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
[ Upstream commit 2650bc4007c15e05f995f472b4fc89e793162bc4 ]
The "skip reset" test waits for the timeout handler to run for the
duration of 2 * MOCK_TIMEOUT, and because the mock scheduler opted to
remove the "skip reset" flag once it fires, this gives opportunity for the
timeout handler to run twice. Second time the job will be removed from the
mock scheduler job list and the drm_mock_sched_advance() call in the test
will fail.
Fix it by making the "don't reset" flag persist for the lifetime of the
job and add a new flag to verify that the code path had executed as
expected.
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Fixes: 1472e7549f84 ("drm/sched: Add new test for DRM_GPU_SCHED_STAT_NO_HANG")
Cc: Maíra Canal <mcanal@igalia.com>
Cc: Philipp Stanner <phasta@kernel.org>
Reviewed-by: Maíra Canal <mcanal@igalia.com>
Signed-off-by: Philipp Stanner <phasta@kernel.org>
Link: https://lore.kernel.org/r/20250716084817.56797-1-tvrtko.ursulin@igalia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/scheduler/tests/mock_scheduler.c | 2 +-
drivers/gpu/drm/scheduler/tests/sched_tests.h | 7 ++++---
drivers/gpu/drm/scheduler/tests/tests_basic.c | 4 ++--
3 files changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/scheduler/tests/mock_scheduler.c b/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
index 65acffc3fea82..8e9ae7d980eb2 100644
--- a/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
+++ b/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
@@ -219,7 +219,7 @@ mock_sched_timedout_job(struct drm_sched_job *sched_job)
unsigned long flags;
if (job->flags & DRM_MOCK_SCHED_JOB_DONT_RESET) {
- job->flags &= ~DRM_MOCK_SCHED_JOB_DONT_RESET;
+ job->flags |= DRM_MOCK_SCHED_JOB_RESET_SKIPPED;
return DRM_GPU_SCHED_STAT_NO_HANG;
}
diff --git a/drivers/gpu/drm/scheduler/tests/sched_tests.h b/drivers/gpu/drm/scheduler/tests/sched_tests.h
index 63d4f2ac70749..5b262126b7760 100644
--- a/drivers/gpu/drm/scheduler/tests/sched_tests.h
+++ b/drivers/gpu/drm/scheduler/tests/sched_tests.h
@@ -95,9 +95,10 @@ struct drm_mock_sched_job {
struct completion done;
-#define DRM_MOCK_SCHED_JOB_DONE 0x1
-#define DRM_MOCK_SCHED_JOB_TIMEDOUT 0x2
-#define DRM_MOCK_SCHED_JOB_DONT_RESET 0x4
+#define DRM_MOCK_SCHED_JOB_DONE 0x1
+#define DRM_MOCK_SCHED_JOB_TIMEDOUT 0x2
+#define DRM_MOCK_SCHED_JOB_DONT_RESET 0x4
+#define DRM_MOCK_SCHED_JOB_RESET_SKIPPED 0x8
unsigned long flags;
struct list_head link;
diff --git a/drivers/gpu/drm/scheduler/tests/tests_basic.c b/drivers/gpu/drm/scheduler/tests/tests_basic.c
index 55eb142bd7c5d..82a41a456b0a8 100644
--- a/drivers/gpu/drm/scheduler/tests/tests_basic.c
+++ b/drivers/gpu/drm/scheduler/tests/tests_basic.c
@@ -317,8 +317,8 @@ static void drm_sched_skip_reset(struct kunit *test)
KUNIT_ASSERT_FALSE(test, done);
KUNIT_ASSERT_EQ(test,
- job->flags & DRM_MOCK_SCHED_JOB_DONT_RESET,
- 0);
+ job->flags & DRM_MOCK_SCHED_JOB_RESET_SKIPPED,
+ DRM_MOCK_SCHED_JOB_RESET_SKIPPED);
i = drm_mock_sched_advance(sched, 1);
KUNIT_ASSERT_EQ(test, i, 1);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 212/563] drm/panel-edp: Add disable to 100ms for MNB601LS1-4
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 211/563] drm/sched: Fix a race in DRM_GPU_SCHED_STAT_NO_HANG test Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 213/563] drm/display: bridge-connector: correct CEC bridge pointers in drm_bridge_connector_init Greg Kroah-Hartman
` (364 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Langyan Ye, Douglas Anderson,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Langyan Ye <yelangyan@huaqin.corp-partner.google.com>
[ Upstream commit 9b3700b15cb581d748c3d46e7eb30ffced1642e8 ]
For the MNB601LS1-4 panel, the T9+T10 timing does not meet the
requirements of the specification, so disable is set to 100ms.
Fixes: 9d8e91439fc3 ("drm/panel-edp: Add CSW MNB601LS1-4")
Signed-off-by: Langyan Ye <yelangyan@huaqin.corp-partner.google.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20250721061627.3816612-1-yelangyan@huaqin.corp-partner.google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-edp.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
index 9a56e208cbddb..09170470b3ef1 100644
--- a/drivers/gpu/drm/panel/panel-edp.c
+++ b/drivers/gpu/drm/panel/panel-edp.c
@@ -1828,6 +1828,13 @@ static const struct panel_delay delay_50_500_e200_d200_po2e335 = {
.powered_on_to_enable = 335,
};
+static const struct panel_delay delay_200_500_e50_d100 = {
+ .hpd_absent = 200,
+ .unprepare = 500,
+ .enable = 50,
+ .disable = 100,
+};
+
#define EDP_PANEL_ENTRY(vend_chr_0, vend_chr_1, vend_chr_2, product_id, _delay, _name) \
{ \
.ident = { \
@@ -1984,7 +1991,7 @@ static const struct edp_panel_entry edp_panels[] = {
EDP_PANEL_ENTRY('C', 'S', 'W', 0x1100, &delay_200_500_e80_d50, "MNB601LS1-1"),
EDP_PANEL_ENTRY('C', 'S', 'W', 0x1103, &delay_200_500_e80_d50, "MNB601LS1-3"),
- EDP_PANEL_ENTRY('C', 'S', 'W', 0x1104, &delay_200_500_e50, "MNB601LS1-4"),
+ EDP_PANEL_ENTRY('C', 'S', 'W', 0x1104, &delay_200_500_e50_d100, "MNB601LS1-4"),
EDP_PANEL_ENTRY('C', 'S', 'W', 0x1448, &delay_200_500_e50, "MNE007QS3-7"),
EDP_PANEL_ENTRY('C', 'S', 'W', 0x1457, &delay_80_500_e80_p2e200, "MNE007QS3-8"),
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 213/563] drm/display: bridge-connector: correct CEC bridge pointers in drm_bridge_connector_init
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 212/563] drm/panel-edp: Add disable to 100ms for MNB601LS1-4 Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 214/563] drm/panel-edp: Add 50ms disable delay for four panels Greg Kroah-Hartman
` (363 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Ceresoli, Dmitry Baryshkov,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
[ Upstream commit 92e34a5241ddf4b084df20e6953275d16f156aa8 ]
The bridge used in drm_bridge_connector_init() for CEC init does not
correctly point to the required HDMI CEC bridge, which can lead to
errors during CEC initialization.
Fixes: 65a2575a68e4 ("drm/display: bridge-connector: hook in CEC notifier support")
Fixes: a74288c8ded7 ("drm/display: bridge-connector: handle CEC adapters")
Reported-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Closes: http://lore.kernel.org/r/20250718164156.194702d9@booty/
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Link: https://lore.kernel.org/r/20250719-fix-cec-bridges-v1-1-a60b1333c87d@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/display/drm_bridge_connector.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/display/drm_bridge_connector.c b/drivers/gpu/drm/display/drm_bridge_connector.c
index 5eb7e9bfe3611..8c915427d0538 100644
--- a/drivers/gpu/drm/display/drm_bridge_connector.c
+++ b/drivers/gpu/drm/display/drm_bridge_connector.c
@@ -816,6 +816,8 @@ struct drm_connector *drm_bridge_connector_init(struct drm_device *drm,
if (bridge_connector->bridge_hdmi_cec &&
bridge_connector->bridge_hdmi_cec->ops & DRM_BRIDGE_OP_HDMI_CEC_NOTIFIER) {
+ bridge = bridge_connector->bridge_hdmi_cec;
+
ret = drmm_connector_hdmi_cec_notifier_register(connector,
NULL,
bridge->hdmi_cec_dev);
@@ -825,6 +827,8 @@ struct drm_connector *drm_bridge_connector_init(struct drm_device *drm,
if (bridge_connector->bridge_hdmi_cec &&
bridge_connector->bridge_hdmi_cec->ops & DRM_BRIDGE_OP_HDMI_CEC_ADAPTER) {
+ bridge = bridge_connector->bridge_hdmi_cec;
+
ret = drmm_connector_hdmi_cec_register(connector,
&drm_bridge_connector_hdmi_cec_funcs,
bridge->hdmi_cec_adapter_name,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 214/563] drm/panel-edp: Add 50ms disable delay for four panels
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 213/563] drm/display: bridge-connector: correct CEC bridge pointers in drm_bridge_connector_init Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 215/563] drm/vmwgfx: fix missing assignment to ts Greg Kroah-Hartman
` (362 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Langyan Ye, Douglas Anderson,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Langyan Ye <yelangyan@huaqin.corp-partner.google.com>
[ Upstream commit 1511d3c4d2bb30f784924a877f3cef518bb73077 ]
Add 50ms disable delay for NV116WHM-N49, NV122WUM-N41, and MNC207QS1-1
to satisfy T9+T10 timing. Add 50ms disable delay for MNE007JA1-2
as well, since MNE007JA1-2 copies the timing of MNC207QS1-1.
Specifically, it should be noted that the MNE007JA1-2 panel was added
by someone who did not have the panel documentation, so they simply
copied the timing from the MNC207QS1-1 panel. Adding an extra 50 ms
of delay should be safe.
Fixes: 0547692ac146 ("drm/panel-edp: Add several generic edp panels")
Fixes: 50625eab3972 ("drm/edp-panel: Add panel used by T14s Gen6 Snapdragon")
Signed-off-by: Langyan Ye <yelangyan@huaqin.corp-partner.google.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20250723072513.2880369-1-yelangyan@huaqin.corp-partner.google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-edp.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
index 09170470b3ef1..d0aa602ecc9de 100644
--- a/drivers/gpu/drm/panel/panel-edp.c
+++ b/drivers/gpu/drm/panel/panel-edp.c
@@ -1736,10 +1736,11 @@ static const struct panel_delay delay_200_500_e50 = {
.enable = 50,
};
-static const struct panel_delay delay_200_500_e50_p2e200 = {
+static const struct panel_delay delay_200_500_e50_d50_p2e200 = {
.hpd_absent = 200,
.unprepare = 500,
.enable = 50,
+ .disable = 50,
.prepare_to_enable = 200,
};
@@ -1941,13 +1942,13 @@ static const struct edp_panel_entry edp_panels[] = {
EDP_PANEL_ENTRY('B', 'O', 'E', 0x09dd, &delay_200_500_e50, "NT116WHM-N21"),
EDP_PANEL_ENTRY('B', 'O', 'E', 0x0a1b, &delay_200_500_e50, "NV133WUM-N63"),
EDP_PANEL_ENTRY('B', 'O', 'E', 0x0a36, &delay_200_500_e200, "Unknown"),
- EDP_PANEL_ENTRY('B', 'O', 'E', 0x0a3e, &delay_200_500_e80, "NV116WHM-N49"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0a3e, &delay_200_500_e80_d50, "NV116WHM-N49"),
EDP_PANEL_ENTRY('B', 'O', 'E', 0x0a5d, &delay_200_500_e50, "NV116WHM-N45"),
EDP_PANEL_ENTRY('B', 'O', 'E', 0x0ac5, &delay_200_500_e50, "NV116WHM-N4C"),
EDP_PANEL_ENTRY('B', 'O', 'E', 0x0ae8, &delay_200_500_e50_p2e80, "NV140WUM-N41"),
EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b09, &delay_200_500_e50_po2e200, "NV140FHM-NZ"),
EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b1e, &delay_200_500_e80, "NE140QDM-N6A"),
- EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b34, &delay_200_500_e80, "NV122WUM-N41"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b34, &delay_200_500_e80_d50, "NV122WUM-N41"),
EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b43, &delay_200_500_e200, "NV140FHM-T09"),
EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b56, &delay_200_500_e80, "NT140FHM-N47"),
EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b66, &delay_200_500_e80, "NE140WUM-N6G"),
@@ -1986,8 +1987,8 @@ static const struct edp_panel_entry edp_panels[] = {
EDP_PANEL_ENTRY('C', 'M', 'N', 0x14e5, &delay_200_500_e80_d50, "N140HGA-EA1"),
EDP_PANEL_ENTRY('C', 'M', 'N', 0x162b, &delay_200_500_e80_d50, "N160JCE-ELL"),
- EDP_PANEL_ENTRY('C', 'S', 'O', 0x1200, &delay_200_500_e50_p2e200, "MNC207QS1-1"),
- EDP_PANEL_ENTRY('C', 'S', 'O', 0x1413, &delay_200_500_e50_p2e200, "MNE007JA1-2"),
+ EDP_PANEL_ENTRY('C', 'S', 'O', 0x1200, &delay_200_500_e50_d50_p2e200, "MNC207QS1-1"),
+ EDP_PANEL_ENTRY('C', 'S', 'O', 0x1413, &delay_200_500_e50_d50_p2e200, "MNE007JA1-2"),
EDP_PANEL_ENTRY('C', 'S', 'W', 0x1100, &delay_200_500_e80_d50, "MNB601LS1-1"),
EDP_PANEL_ENTRY('C', 'S', 'W', 0x1103, &delay_200_500_e80_d50, "MNB601LS1-3"),
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 215/563] drm/vmwgfx: fix missing assignment to ts
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 214/563] drm/panel-edp: Add 50ms disable delay for four panels Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 216/563] drm/amd/display: Reduce Stack Usage by moving audio_output into stream_res v4 Greg Kroah-Hartman
` (361 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Colin Ian King, Ian Forbes,
Zack Rusin, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <colin.i.king@gmail.com>
[ Upstream commit 33f8f321e7aa7715ce19560801ee5223ba8b9a7d ]
The assignment to ts is missing on the call to ktime_to_timespec64.
Fix this by adding the missing assignment.
Fixes: db6a94b26354 ("drm/vmwgfx: Implement dma_fence_ops properly")
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Reviewed-by: Ian Forbes <ian.forbes@broadcom.com>
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Link: https://lore.kernel.org/r/20250623223526.281398-1-colin.i.king@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
index c2294abbe7534..00be92da55097 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@@ -538,7 +538,7 @@ static void vmw_event_fence_action_seq_passed(struct dma_fence *f,
if (likely(eaction->tv_sec != NULL)) {
struct timespec64 ts;
- ktime_to_timespec64(f->timestamp);
+ ts = ktime_to_timespec64(f->timestamp);
/* monotonic time, so no y2038 overflow */
*eaction->tv_sec = ts.tv_sec;
*eaction->tv_usec = ts.tv_nsec / NSEC_PER_USEC;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 216/563] drm/amd/display: Reduce Stack Usage by moving audio_output into stream_res v4
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 215/563] drm/vmwgfx: fix missing assignment to ts Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 217/563] drm/panel: novatek-nt35560: Fix invalid return value Greg Kroah-Hartman
` (360 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wayne Lin, George Shen,
Michael Strauss, Alvin Lee, Ray Wu, Wenjing Liu, Harry Wentland,
Tom Chung, Roman Li, Alex Hung, Aurabindo Pillai,
Srinivasan Shanmugam, Alex Deucher, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
[ Upstream commit 1cf1205ef2685cf43db3785706b017d1e54e0bec ]
The function `dp_retrain_link_dp_test` currently allocates a large
audio_output array on the stack, causing the stack frame size to exceed
the compiler limit (1080 bytes > 1024 bytes).
This change prevents stack overflow issues:
amdgpu/../display/dc/link/accessories/link_dp_cts.c:65:13: warning: stack frame size (1080) exceeds limit (1024) in 'dp_retrain_link_dp_test' [-Wframe-larger-than]
static void dp_retrain_link_dp_test(struct dc_link *link,
v2: Move audio-related data like `audio_output` is kept "per pipe" to
manage the audio for that specific display pipeline/display output path
(stream). (Wenjing)
v3: Update in all the places where `build_audio_output` is currently
called with a separate audio_output variable on the stack & wherever
`audio_output` is passed to other functions
`dce110_apply_single_controller_ctx_to_hw()` &
`dce110_setup_audio_dto()` (like `az_configure`, `wall_dto_setup`)
replace with usage of `pipe_ctx->stream_res.audio_output`
to centralize audio data per pipe.
v4: Remove empty lines before `build_audio_output`. (Alex)
Fixes: 9c6669c2e21a ("drm/amd/display: Fix Link Override Sequencing When Switching Between DIO/HPO")
Cc: Wayne Lin <wayne.lin@amd.com>
Cc: George Shen <george.shen@amd.com>
Cc: Michael Strauss <michael.strauss@amd.com>
Cc: Alvin Lee <Alvin.Lee2@amd.com>
Cc: Ray Wu <ray.wu@amd.com>
Cc: Wenjing Liu <wenjing.liu@amd.com>
Cc: Harry Wentland <harry.wentland@amd.com>
Cc: Tom Chung <chiahsuan.chung@amd.com>
Cc: Roman Li <roman.li@amd.com>
Cc: Alex Hung <alex.hung@amd.com>
Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../amd/display/dc/hwss/dce110/dce110_hwseq.c | 32 ++++++++-----------
.../gpu/drm/amd/display/dc/inc/core_types.h | 5 +--
.../display/dc/link/accessories/link_dp_cts.c | 12 +++----
.../dc/resource/dcn31/dcn31_resource.c | 5 ++-
.../dc/resource/dcn31/dcn31_resource.h | 3 +-
5 files changed, 26 insertions(+), 31 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
index 4ea13d0bf815e..c69194e04ff93 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
@@ -1600,19 +1600,17 @@ enum dc_status dce110_apply_single_controller_ctx_to_hw(
}
if (pipe_ctx->stream_res.audio != NULL) {
- struct audio_output audio_output = {0};
+ build_audio_output(context, pipe_ctx, &pipe_ctx->stream_res.audio_output);
- build_audio_output(context, pipe_ctx, &audio_output);
-
- link_hwss->setup_audio_output(pipe_ctx, &audio_output,
+ link_hwss->setup_audio_output(pipe_ctx, &pipe_ctx->stream_res.audio_output,
pipe_ctx->stream_res.audio->inst);
pipe_ctx->stream_res.audio->funcs->az_configure(
pipe_ctx->stream_res.audio,
pipe_ctx->stream->signal,
- &audio_output.crtc_info,
+ &pipe_ctx->stream_res.audio_output.crtc_info,
&pipe_ctx->stream->audio_info,
- &audio_output.dp_link_info);
+ &pipe_ctx->stream_res.audio_output.dp_link_info);
if (dc->config.disable_hbr_audio_dp2)
if (pipe_ctx->stream_res.audio->funcs->az_disable_hbr_audio &&
@@ -2386,9 +2384,7 @@ static void dce110_setup_audio_dto(
if (pipe_ctx->stream->signal != SIGNAL_TYPE_HDMI_TYPE_A)
continue;
if (pipe_ctx->stream_res.audio != NULL) {
- struct audio_output audio_output;
-
- build_audio_output(context, pipe_ctx, &audio_output);
+ build_audio_output(context, pipe_ctx, &pipe_ctx->stream_res.audio_output);
if (dc->res_pool->dccg && dc->res_pool->dccg->funcs->set_audio_dtbclk_dto) {
struct dtbclk_dto_params dto_params = {0};
@@ -2399,14 +2395,14 @@ static void dce110_setup_audio_dto(
pipe_ctx->stream_res.audio->funcs->wall_dto_setup(
pipe_ctx->stream_res.audio,
pipe_ctx->stream->signal,
- &audio_output.crtc_info,
- &audio_output.pll_info);
+ &pipe_ctx->stream_res.audio_output.crtc_info,
+ &pipe_ctx->stream_res.audio_output.pll_info);
} else
pipe_ctx->stream_res.audio->funcs->wall_dto_setup(
pipe_ctx->stream_res.audio,
pipe_ctx->stream->signal,
- &audio_output.crtc_info,
- &audio_output.pll_info);
+ &pipe_ctx->stream_res.audio_output.crtc_info,
+ &pipe_ctx->stream_res.audio_output.pll_info);
break;
}
}
@@ -2426,15 +2422,15 @@ static void dce110_setup_audio_dto(
continue;
if (pipe_ctx->stream_res.audio != NULL) {
- struct audio_output audio_output = {0};
-
- build_audio_output(context, pipe_ctx, &audio_output);
+ build_audio_output(context,
+ pipe_ctx,
+ &pipe_ctx->stream_res.audio_output);
pipe_ctx->stream_res.audio->funcs->wall_dto_setup(
pipe_ctx->stream_res.audio,
pipe_ctx->stream->signal,
- &audio_output.crtc_info,
- &audio_output.pll_info);
+ &pipe_ctx->stream_res.audio_output.crtc_info,
+ &pipe_ctx->stream_res.audio_output.pll_info);
break;
}
}
diff --git a/drivers/gpu/drm/amd/display/dc/inc/core_types.h b/drivers/gpu/drm/amd/display/dc/inc/core_types.h
index f0d7185153b2a..f896cce87b8d4 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/core_types.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/core_types.h
@@ -228,8 +228,7 @@ struct resource_funcs {
enum dc_status (*update_dc_state_for_encoder_switch)(struct dc_link *link,
struct dc_link_settings *link_setting,
uint8_t pipe_count,
- struct pipe_ctx *pipes,
- struct audio_output *audio_output);
+ struct pipe_ctx *pipes);
};
struct audio_support{
@@ -361,6 +360,8 @@ struct stream_resource {
uint8_t gsl_group;
struct test_pattern_params test_pattern_params;
+
+ struct audio_output audio_output;
};
struct plane_resource {
diff --git a/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c b/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c
index 2956c2b3ad1aa..b12d61701d4d9 100644
--- a/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c
+++ b/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c
@@ -75,7 +75,6 @@ static void dp_retrain_link_dp_test(struct dc_link *link,
bool is_hpo_acquired;
uint8_t count;
int i;
- struct audio_output audio_output[MAX_PIPES];
needs_divider_update = (link->dc->link_srv->dp_get_encoding_format(link_setting) !=
link->dc->link_srv->dp_get_encoding_format((const struct dc_link_settings *) &link->cur_link_settings));
@@ -99,7 +98,7 @@ static void dp_retrain_link_dp_test(struct dc_link *link,
if (needs_divider_update && link->dc->res_pool->funcs->update_dc_state_for_encoder_switch) {
link->dc->res_pool->funcs->update_dc_state_for_encoder_switch(link,
link_setting, count,
- *pipes, &audio_output[0]);
+ *pipes);
for (i = 0; i < count; i++) {
pipes[i]->clock_source->funcs->program_pix_clk(
pipes[i]->clock_source,
@@ -111,15 +110,16 @@ static void dp_retrain_link_dp_test(struct dc_link *link,
const struct link_hwss *link_hwss = get_link_hwss(
link, &pipes[i]->link_res);
- link_hwss->setup_audio_output(pipes[i], &audio_output[i],
- pipes[i]->stream_res.audio->inst);
+ link_hwss->setup_audio_output(pipes[i],
+ &pipes[i]->stream_res.audio_output,
+ pipes[i]->stream_res.audio->inst);
pipes[i]->stream_res.audio->funcs->az_configure(
pipes[i]->stream_res.audio,
pipes[i]->stream->signal,
- &audio_output[i].crtc_info,
+ &pipes[i]->stream_res.audio_output.crtc_info,
&pipes[i]->stream->audio_info,
- &audio_output[i].dp_link_info);
+ &pipes[i]->stream_res.audio_output.dp_link_info);
if (link->dc->config.disable_hbr_audio_dp2 &&
pipes[i]->stream_res.audio->funcs->az_disable_hbr_audio &&
diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c
index 3ed7f50554e21..ca17e5d8fdc2a 100644
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c
@@ -2239,8 +2239,7 @@ struct resource_pool *dcn31_create_resource_pool(
enum dc_status dcn31_update_dc_state_for_encoder_switch(struct dc_link *link,
struct dc_link_settings *link_setting,
uint8_t pipe_count,
- struct pipe_ctx *pipes,
- struct audio_output *audio_output)
+ struct pipe_ctx *pipes)
{
struct dc_state *state = link->dc->current_state;
int i;
@@ -2255,7 +2254,7 @@ enum dc_status dcn31_update_dc_state_for_encoder_switch(struct dc_link *link,
// Setup audio
if (pipes[i].stream_res.audio != NULL)
- build_audio_output(state, &pipes[i], &audio_output[i]);
+ build_audio_output(state, &pipes[i], &pipes[i].stream_res.audio_output);
}
#else
/* This DCN requires rate divider updates and audio reprogramming to allow DP1<-->DP2 link rate switching,
diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.h b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.h
index c32c85ef0ba47..7e8fde65528f1 100644
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.h
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.h
@@ -69,8 +69,7 @@ unsigned int dcn31_get_det_buffer_size(
enum dc_status dcn31_update_dc_state_for_encoder_switch(struct dc_link *link,
struct dc_link_settings *link_setting,
uint8_t pipe_count,
- struct pipe_ctx *pipes,
- struct audio_output *audio_output);
+ struct pipe_ctx *pipes);
/*temp: B0 specific before switch to dcn313 headers*/
#ifndef regPHYPLLF_PIXCLK_RESYNC_CNTL
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 217/563] drm/panel: novatek-nt35560: Fix invalid return value
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 216/563] drm/amd/display: Reduce Stack Usage by moving audio_output into stream_res v4 Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 218/563] drm/amdgpu: fix link error for !PM_SLEEP Greg Kroah-Hartman
` (359 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Douglas Anderson, Neil Armstrong,
Brigham Campbell, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brigham Campbell <me@brighamcampbell.com>
[ Upstream commit 125459e19ec654924e472f3ff5aeea40358dbebf ]
Fix bug in nt35560_set_brightness() which causes the function to
erroneously report an error. mipi_dsi_dcs_write() returns either a
negative value when an error occurred or a positive number of bytes
written when no error occurred. The buggy code reports an error under
either condition.
Fixes: 8152c2bfd780 ("drm/panel: Add driver for Sony ACX424AKP panel")
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Brigham Campbell <me@brighamcampbell.com>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://lore.kernel.org/r/20250731032343.1258366-2-me@brighamcampbell.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-novatek-nt35560.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35560.c b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
index 98f0782c84111..17898a29efe87 100644
--- a/drivers/gpu/drm/panel/panel-novatek-nt35560.c
+++ b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
@@ -161,7 +161,7 @@ static int nt35560_set_brightness(struct backlight_device *bl)
par = 0x00;
ret = mipi_dsi_dcs_write(dsi, MIPI_DCS_WRITE_CONTROL_DISPLAY,
&par, 1);
- if (ret) {
+ if (ret < 0) {
dev_err(nt->dev, "failed to disable display backlight (%d)\n", ret);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 218/563] drm/amdgpu: fix link error for !PM_SLEEP
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 217/563] drm/panel: novatek-nt35560: Fix invalid return value Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 219/563] drm/amdgpu: Fix jpeg v4.0.3 poison irq call trace on sriov guest Greg Kroah-Hartman
` (358 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Mario Limonciello,
Alex Deucher, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 4d22db6d070ed3934f02ed15391283f6feb258ad ]
When power management is not enabled in the kernel build, the newly
added hibernation changes cause a link failure:
arm-linux-gnueabi-ld: drivers/gpu/drm/amd/amdgpu/amdgpu_drv.o: in function `amdgpu_pmops_thaw':
amdgpu_drv.c:(.text+0x1514): undefined reference to `pm_hibernate_is_recovering'
Make the power management code in this driver conditional on
CONFIG_PM and CONFIG_PM_SLEEP
Fixes: 530694f54dd5 ("drm/amdgpu: do not resume device in thaw for normal hibernation")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://lore.kernel.org/r/20250714081635.4071570-1-arnd@kernel.org
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 395c6be901ce7..dbbb3407fa13b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -2964,15 +2964,15 @@ long amdgpu_drm_ioctl(struct file *filp,
}
static const struct dev_pm_ops amdgpu_pm_ops = {
- .prepare = amdgpu_pmops_prepare,
- .complete = amdgpu_pmops_complete,
- .suspend = amdgpu_pmops_suspend,
- .suspend_noirq = amdgpu_pmops_suspend_noirq,
- .resume = amdgpu_pmops_resume,
- .freeze = amdgpu_pmops_freeze,
- .thaw = amdgpu_pmops_thaw,
- .poweroff = amdgpu_pmops_poweroff,
- .restore = amdgpu_pmops_restore,
+ .prepare = pm_sleep_ptr(amdgpu_pmops_prepare),
+ .complete = pm_sleep_ptr(amdgpu_pmops_complete),
+ .suspend = pm_sleep_ptr(amdgpu_pmops_suspend),
+ .suspend_noirq = pm_sleep_ptr(amdgpu_pmops_suspend_noirq),
+ .resume = pm_sleep_ptr(amdgpu_pmops_resume),
+ .freeze = pm_sleep_ptr(amdgpu_pmops_freeze),
+ .thaw = pm_sleep_ptr(amdgpu_pmops_thaw),
+ .poweroff = pm_sleep_ptr(amdgpu_pmops_poweroff),
+ .restore = pm_sleep_ptr(amdgpu_pmops_restore),
.runtime_suspend = amdgpu_pmops_runtime_suspend,
.runtime_resume = amdgpu_pmops_runtime_resume,
.runtime_idle = amdgpu_pmops_runtime_idle,
@@ -3117,7 +3117,7 @@ static struct pci_driver amdgpu_kms_pci_driver = {
.probe = amdgpu_pci_probe,
.remove = amdgpu_pci_remove,
.shutdown = amdgpu_pci_shutdown,
- .driver.pm = &amdgpu_pm_ops,
+ .driver.pm = pm_ptr(&amdgpu_pm_ops),
.err_handler = &amdgpu_pci_err_handler,
.dev_groups = amdgpu_sysfs_groups,
};
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 219/563] drm/amdgpu: Fix jpeg v4.0.3 poison irq call trace on sriov guest
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 218/563] drm/amdgpu: fix link error for !PM_SLEEP Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 220/563] drm/amdgpu: Fix vcn " Greg Kroah-Hartman
` (357 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Liu, Stanley.Yang,
Alex Deucher, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Liu <xiang.liu@amd.com>
[ Upstream commit d3d73bdb02e8cc4a1b2b721a42908504cd18ebf9 ]
Sriov guest side doesn't init ras feature hence the poison irq shouldn't
be put during hw fini.
[25209.467154] Call Trace:
[25209.467156] <TASK>
[25209.467158] ? srso_alias_return_thunk+0x5/0x7f
[25209.467162] ? show_trace_log_lvl+0x28e/0x2ea
[25209.467166] ? show_trace_log_lvl+0x28e/0x2ea
[25209.467171] ? jpeg_v4_0_3_hw_fini+0x6f/0x90 [amdgpu]
[25209.467300] ? show_regs.part.0+0x23/0x29
[25209.467303] ? show_regs.cold+0x8/0xd
[25209.467304] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
[25209.467403] ? __warn+0x8c/0x100
[25209.467407] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
[25209.467503] ? report_bug+0xa4/0xd0
[25209.467508] ? handle_bug+0x39/0x90
[25209.467511] ? exc_invalid_op+0x19/0x70
[25209.467513] ? asm_exc_invalid_op+0x1b/0x20
[25209.467518] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
[25209.467613] ? amdgpu_irq_put+0x5f/0xc0 [amdgpu]
[25209.467709] jpeg_v4_0_3_hw_fini+0x6f/0x90 [amdgpu]
[25209.467805] amdgpu_ip_block_hw_fini+0x34/0x61 [amdgpu]
[25209.467971] amdgpu_device_fini_hw+0x3b3/0x467 [amdgpu]
Fixes: 1b2231de4163 ("drm/amdgpu: Register aqua vanjaram jpeg poison irq")
Signed-off-by: Xiang Liu <xiang.liu@amd.com>
Reviewed-by: Stanley.Yang <Stanley.Yang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c
index b86288a69e7b7..a78144773fabb 100644
--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c
+++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c
@@ -444,7 +444,7 @@ static int jpeg_v4_0_3_hw_fini(struct amdgpu_ip_block *ip_block)
ret = jpeg_v4_0_3_set_powergating_state(ip_block, AMD_PG_STATE_GATE);
}
- if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__JPEG))
+ if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__JPEG) && !amdgpu_sriov_vf(adev))
amdgpu_irq_put(adev, &adev->jpeg.inst->ras_poison_irq, 0);
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 220/563] drm/amdgpu: Fix vcn v4.0.3 poison irq call trace on sriov guest
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 219/563] drm/amdgpu: Fix jpeg v4.0.3 poison irq call trace on sriov guest Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 221/563] PCI: endpoint: pci-ep-msi: Fix NULL vs IS_ERR() check in pci_epf_write_msi_msg() Greg Kroah-Hartman
` (356 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Liu, Stanley.Yang,
Alex Deucher, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Liu <xiang.liu@amd.com>
[ Upstream commit 58364f01db4a155356f92cce1474761d7a0eda3d ]
Sriov guest side doesn't init ras feature hence the poison irq shouldn't
be put during hw fini.
[25209.468816] Call Trace:
[25209.468817] <TASK>
[25209.468818] ? srso_alias_return_thunk+0x5/0x7f
[25209.468820] ? show_trace_log_lvl+0x28e/0x2ea
[25209.468822] ? show_trace_log_lvl+0x28e/0x2ea
[25209.468825] ? vcn_v4_0_3_hw_fini+0xaf/0xe0 [amdgpu]
[25209.468936] ? show_regs.part.0+0x23/0x29
[25209.468939] ? show_regs.cold+0x8/0xd
[25209.468940] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
[25209.469038] ? __warn+0x8c/0x100
[25209.469040] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
[25209.469135] ? report_bug+0xa4/0xd0
[25209.469138] ? handle_bug+0x39/0x90
[25209.469140] ? exc_invalid_op+0x19/0x70
[25209.469142] ? asm_exc_invalid_op+0x1b/0x20
[25209.469146] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
[25209.469241] vcn_v4_0_3_hw_fini+0xaf/0xe0 [amdgpu]
[25209.469343] amdgpu_ip_block_hw_fini+0x34/0x61 [amdgpu]
[25209.469511] amdgpu_device_fini_hw+0x3b3/0x467 [amdgpu]
Fixes: 4c4a89149608 ("drm/amdgpu: Register aqua vanjaram vcn poison irq")
Signed-off-by: Xiang Liu <xiang.liu@amd.com>
Reviewed-by: Stanley.Yang <Stanley.Yang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
index 2a3663b551af9..52613205669e1 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
@@ -391,7 +391,7 @@ static int vcn_v4_0_3_hw_fini(struct amdgpu_ip_block *ip_block)
vinst->set_pg_state(vinst, AMD_PG_STATE_GATE);
}
- if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN))
+ if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN) && !amdgpu_sriov_vf(adev))
amdgpu_irq_put(adev, &adev->vcn.inst->ras_poison_irq, 0);
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 221/563] PCI: endpoint: pci-ep-msi: Fix NULL vs IS_ERR() check in pci_epf_write_msi_msg()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 220/563] drm/amdgpu: Fix vcn " Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 222/563] PCI: xgene-msi: Return negative -EINVAL in xgene_msi_handler_setup() Greg Kroah-Hartman
` (355 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Manivannan Sadhasivam,
Frank Li, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 57a75fa9d56e310e883e4377205690e88c05781b ]
The pci_epc_get() function returns error pointers. It never returns NULL.
Update the check to match.
Fixes: 1c3b002c6bf6 ("PCI: endpoint: Add RC-to-EP doorbell support using platform MSI controller")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/aIzCdV8jyBeql-Oa@stanley.mountain
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/endpoint/pci-ep-msi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/endpoint/pci-ep-msi.c b/drivers/pci/endpoint/pci-ep-msi.c
index 9ca89cbfec15d..1b58357b905fa 100644
--- a/drivers/pci/endpoint/pci-ep-msi.c
+++ b/drivers/pci/endpoint/pci-ep-msi.c
@@ -24,7 +24,7 @@ static void pci_epf_write_msi_msg(struct msi_desc *desc, struct msi_msg *msg)
struct pci_epf *epf;
epc = pci_epc_get(dev_name(msi_desc_to_dev(desc)));
- if (!epc)
+ if (IS_ERR(epc))
return;
epf = list_first_entry_or_null(&epc->pci_epf, struct pci_epf, list);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 222/563] PCI: xgene-msi: Return negative -EINVAL in xgene_msi_handler_setup()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 221/563] PCI: endpoint: pci-ep-msi: Fix NULL vs IS_ERR() check in pci_epf_write_msi_msg() Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 223/563] drm/radeon/r600_cs: clean up of dead code in r600_cs Greg Kroah-Hartman
` (354 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Manivannan Sadhasivam,
Marc Zyngier, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit b26fc701a25195134ff0327709a0421767c4c7b2 ]
There is a typo so we accidentally return positive EINVAL instead of
negative -EINVAL. Add the missing '-' character.
Fixes: 6aceb36f17ab ("PCI: xgene-msi: Restructure handler setup/teardown")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Acked-by: Marc Zyngier <maz@kernel.org>
Link: https://patch.msgid.link/aIzCbVd93ivPinne@stanley.mountain
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pci-xgene-msi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/controller/pci-xgene-msi.c b/drivers/pci/controller/pci-xgene-msi.c
index 0a37a3f1809c5..654639bccd10e 100644
--- a/drivers/pci/controller/pci-xgene-msi.c
+++ b/drivers/pci/controller/pci-xgene-msi.c
@@ -311,7 +311,7 @@ static int xgene_msi_handler_setup(struct platform_device *pdev)
msi_val = xgene_msi_int_read(xgene_msi, i);
if (msi_val) {
dev_err(&pdev->dev, "Failed to clear spurious IRQ\n");
- return EINVAL;
+ return -EINVAL;
}
irq = platform_get_irq(pdev, i);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 223/563] drm/radeon/r600_cs: clean up of dead code in r600_cs
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 222/563] PCI: xgene-msi: Return negative -EINVAL in xgene_msi_handler_setup() Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 224/563] f2fs: fix condition in __allow_reserved_blocks() Greg Kroah-Hartman
` (353 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, Brahmajit Das,
Alex Deucher, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brahmajit Das <listout@listout.xyz>
[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ]
GCC 16 enables -Werror=unused-but-set-variable= which results in build
error with the following message.
drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’:
drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=]
1411 | unsigned offset, i, level;
| ^~~~~
cc1: all warnings being treated as errors
make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1
level although is set, but in never used in the function
r600_texture_size. Thus resulting in dead code and this error getting
triggered.
Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)")
Acked-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Brahmajit Das <listout@listout.xyz>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/radeon/r600_cs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index ac77d1246b945..811265648a582 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -1408,7 +1408,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
unsigned block_align, unsigned height_align, unsigned base_align,
unsigned *l0_size, unsigned *mipmap_size)
{
- unsigned offset, i, level;
+ unsigned offset, i;
unsigned width, height, depth, size;
unsigned blocksize;
unsigned nbx, nby;
@@ -1420,7 +1420,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
w0 = r600_mip_minify(w0, 0);
h0 = r600_mip_minify(h0, 0);
d0 = r600_mip_minify(d0, 0);
- for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) {
+ for (i = 0, offset = 0; i < nlevels; i++) {
width = r600_mip_minify(w0, i);
nbx = r600_fmt_get_nblocksx(format, width);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 224/563] f2fs: fix condition in __allow_reserved_blocks()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 223/563] drm/radeon/r600_cs: clean up of dead code in r600_cs Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 225/563] f2fs: fix to avoid overflow while left shift operation Greg Kroah-Hartman
` (352 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chao Yu, Jaegeuk Kim, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit e75ce117905d2830976a289e718470f3230fa30a ]
If reserve_root mount option is not assigned, __allow_reserved_blocks()
will return false, it's not correct, fix it.
Fixes: 7e65be49ed94 ("f2fs: add reserved blocks for root user")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/f2fs.h | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index b4b62ac46bc64..dac7d44885e47 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -2361,8 +2361,6 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi,
{
if (!inode)
return true;
- if (!test_opt(sbi, RESERVE_ROOT))
- return false;
if (IS_NOQUOTA(inode))
return true;
if (uid_eq(F2FS_OPTION(sbi).s_resuid, current_fsuid()))
@@ -2383,7 +2381,7 @@ static inline unsigned int get_available_block_count(struct f2fs_sb_info *sbi,
avail_user_block_count = sbi->user_block_count -
sbi->current_reserved_blocks;
- if (!__allow_reserved_blocks(sbi, inode, cap))
+ if (test_opt(sbi, RESERVE_ROOT) && !__allow_reserved_blocks(sbi, inode, cap))
avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks;
if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 225/563] f2fs: fix to avoid overflow while left shift operation
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 224/563] f2fs: fix condition in __allow_reserved_blocks() Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 226/563] f2fs: fix to zero data after EOF for compressed file correctly Greg Kroah-Hartman
` (351 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chao Yu, Jaegeuk Kim, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit 0fe1c6bec54ea68ed8c987b3890f2296364e77bb ]
Should cast type of folio->index from pgoff_t to loff_t to avoid overflow
while left shift operation.
Fixes: 3265d3db1f16 ("f2fs: support partial truncation on compressed inode")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/compress.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
index 5c1f47e45dab4..6cd8902849cf6 100644
--- a/fs/f2fs/compress.c
+++ b/fs/f2fs/compress.c
@@ -1245,7 +1245,7 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock)
for (i = cluster_size - 1; i >= 0; i--) {
struct folio *folio = page_folio(rpages[i]);
- loff_t start = folio->index << PAGE_SHIFT;
+ loff_t start = (loff_t)folio->index << PAGE_SHIFT;
if (from <= start) {
folio_zero_segment(folio, 0, folio_size(folio));
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 226/563] f2fs: fix to zero data after EOF for compressed file correctly
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 225/563] f2fs: fix to avoid overflow while left shift operation Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 227/563] drm/bridge: it6505: select REGMAP_I2C Greg Kroah-Hartman
` (350 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Prusakowski, Chao Yu,
Jaegeuk Kim, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit 0b2cd5092139f499544c77b5107a74e5fdb3a386 ]
generic/091 may fail, then it bisects to the bad commit ba8dac350faf
("f2fs: fix to zero post-eof page").
What will cause generic/091 to fail is something like below Testcase #1:
1. write 16k as compressed blocks
2. truncate to 12k
3. truncate to 20k
4. verify data in range of [12k, 16k], however data is not zero as
expected
Script of Testcase #1
mkfs.f2fs -f -O extra_attr,compression /dev/vdb
mount -t f2fs -o compress_extension=* /dev/vdb /mnt/f2fs
dd if=/dev/zero of=/mnt/f2fs/file bs=12k count=1
dd if=/dev/random of=/mnt/f2fs/file bs=4k count=1 seek=3 conv=notrunc
sync
truncate -s $((12*1024)) /mnt/f2fs/file
truncate -s $((20*1024)) /mnt/f2fs/file
dd if=/mnt/f2fs/file of=/mnt/f2fs/data bs=4k count=1 skip=3
od /mnt/f2fs/data
umount /mnt/f2fs
Analisys:
in step 2), we will redirty all data pages from #0 to #3 in compressed
cluster, and zero page #3,
in step 3), f2fs_setattr() will call f2fs_zero_post_eof_page() to drop
all page cache post eof, includeing dirtied page #3,
in step 4) when we read data from page #3, it will decompressed cluster
and extra random data to page #3, finally, we hit the non-zeroed data
post eof.
However, the commit ba8dac350faf ("f2fs: fix to zero post-eof page") just
let the issue be reproduced easily, w/o the commit, it can reproduce this
bug w/ below Testcase #2:
1. write 16k as compressed blocks
2. truncate to 8k
3. truncate to 12k
4. truncate to 20k
5. verify data in range of [12k, 16k], however data is not zero as
expected
Script of Testcase #2
mkfs.f2fs -f -O extra_attr,compression /dev/vdb
mount -t f2fs -o compress_extension=* /dev/vdb /mnt/f2fs
dd if=/dev/zero of=/mnt/f2fs/file bs=12k count=1
dd if=/dev/random of=/mnt/f2fs/file bs=4k count=1 seek=3 conv=notrunc
sync
truncate -s $((8*1024)) /mnt/f2fs/file
truncate -s $((12*1024)) /mnt/f2fs/file
truncate -s $((20*1024)) /mnt/f2fs/file
echo 3 > /proc/sys/vm/drop_caches
dd if=/mnt/f2fs/file of=/mnt/f2fs/data bs=4k count=1 skip=3
od /mnt/f2fs/data
umount /mnt/f2fs
Anlysis:
in step 2), we will redirty all data pages from #0 to #3 in compressed
cluster, and zero page #2 and #3,
in step 3), we will truncate page #3 in page cache,
in step 4), expand file size,
in step 5), hit random data post eof w/ the same reason in Testcase #1.
Root Cause:
In f2fs_truncate_partial_cluster(), after we truncate partial data block
on compressed cluster, all pages in cluster including the one post eof
will be dirtied, after another tuncation, dirty page post eof will be
dropped, however on-disk compressed cluster is still valid, it may
include non-zero data post eof, result in exposing previous non-zero data
post eof while reading.
Fix:
In f2fs_truncate_partial_cluster(), let change as below to fix:
- call filemap_write_and_wait_range() to flush dirty page
- call truncate_pagecache() to drop pages or zero partial page post eof
- call f2fs_do_truncate_blocks() to truncate non-compress cluster to
last valid block
Fixes: 3265d3db1f16 ("f2fs: support partial truncation on compressed inode")
Reported-by: Jan Prusakowski <jprusakowski@google.com>
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/compress.c | 23 ++++++++++++++++-------
1 file changed, 16 insertions(+), 7 deletions(-)
diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
index 6cd8902849cf6..72bc05b913af7 100644
--- a/fs/f2fs/compress.c
+++ b/fs/f2fs/compress.c
@@ -1246,19 +1246,28 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock)
for (i = cluster_size - 1; i >= 0; i--) {
struct folio *folio = page_folio(rpages[i]);
loff_t start = (loff_t)folio->index << PAGE_SHIFT;
+ loff_t offset = from > start ? from - start : 0;
- if (from <= start) {
- folio_zero_segment(folio, 0, folio_size(folio));
- } else {
- folio_zero_segment(folio, from - start,
- folio_size(folio));
+ folio_zero_segment(folio, offset, folio_size(folio));
+
+ if (from >= start)
break;
- }
}
f2fs_compress_write_end(inode, fsdata, start_idx, true);
+
+ err = filemap_write_and_wait_range(inode->i_mapping,
+ round_down(from, cluster_size << PAGE_SHIFT),
+ LLONG_MAX);
+ if (err)
+ return err;
+
+ truncate_pagecache(inode, from);
+
+ err = f2fs_do_truncate_blocks(inode,
+ round_up(from, PAGE_SIZE), lock);
}
- return 0;
+ return err;
}
static int f2fs_write_compressed_pages(struct compress_ctx *cc,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 227/563] drm/bridge: it6505: select REGMAP_I2C
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 226/563] f2fs: fix to zero data after EOF for compressed file correctly Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 228/563] wifi: rtw88: Lock rtwdev->mutex before setting the LED Greg Kroah-Hartman
` (349 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chia-I Wu, Chen-Yu Tsai, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chia-I Wu <olvaffe@gmail.com>
[ Upstream commit 21b137f651cf9d981e22d2c60a2a8105f50a6361 ]
Fix
aarch64-linux-gnu-ld: drivers/gpu/drm/bridge/ite-it6505.o: in function `it6505_i2c_probe':
ite-it6505.c:(.text+0x754): undefined reference to `__devm_regmap_init_i2c'
Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver")
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Link: https://patch.msgid.link/20250610235825.3113075-1-olvaffe@gmail.com
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig
index b9e0ca85226a6..a6d6e62071a0e 100644
--- a/drivers/gpu/drm/bridge/Kconfig
+++ b/drivers/gpu/drm/bridge/Kconfig
@@ -122,6 +122,7 @@ config DRM_ITE_IT6505
select EXTCON
select CRYPTO
select CRYPTO_HASH
+ select REGMAP_I2C
help
ITE IT6505 DisplayPort bridge chip driver.
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 228/563] wifi: rtw88: Lock rtwdev->mutex before setting the LED
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 227/563] drm/bridge: it6505: select REGMAP_I2C Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 229/563] HID: steelseries: refactor probe() and remove() Greg Kroah-Hartman
` (348 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bitterblue Smith, Ping-Ke Shih,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
[ Upstream commit 26a8bf978ae9cd7688af1d08bc8760674d372e22 ]
Some users report that the LED blinking breaks AP mode somehow. Most
likely the LED code and the dynamic mechanism are trying to access the
hardware registers at the same time. Fix it by locking rtwdev->mutex
before setting the LED and unlocking it after.
Fixes: 4b6652bc6d8d ("wifi: rtw88: Add support for LED blinking")
Closes: https://github.com/lwfinger/rtw88/issues/305
Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/ed69fa07-8678-4a40-af44-65e7b1862197@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw88/led.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw88/led.c b/drivers/net/wireless/realtek/rtw88/led.c
index 25aa6cbaa7286..7f9ace351a5b7 100644
--- a/drivers/net/wireless/realtek/rtw88/led.c
+++ b/drivers/net/wireless/realtek/rtw88/led.c
@@ -6,13 +6,23 @@
#include "debug.h"
#include "led.h"
-static int rtw_led_set_blocking(struct led_classdev *led,
- enum led_brightness brightness)
+static void rtw_led_set(struct led_classdev *led,
+ enum led_brightness brightness)
{
struct rtw_dev *rtwdev = container_of(led, struct rtw_dev, led_cdev);
+ mutex_lock(&rtwdev->mutex);
+
rtwdev->chip->ops->led_set(led, brightness);
+ mutex_unlock(&rtwdev->mutex);
+}
+
+static int rtw_led_set_blocking(struct led_classdev *led,
+ enum led_brightness brightness)
+{
+ rtw_led_set(led, brightness);
+
return 0;
}
@@ -37,7 +47,7 @@ void rtw_led_init(struct rtw_dev *rtwdev)
return;
if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_PCIE)
- led->brightness_set = rtwdev->chip->ops->led_set;
+ led->brightness_set = rtw_led_set;
else
led->brightness_set_blocking = rtw_led_set_blocking;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 229/563] HID: steelseries: refactor probe() and remove()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 228/563] wifi: rtw88: Lock rtwdev->mutex before setting the LED Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 230/563] drm/amdgpu: fix incorrect vm flags to map bo Greg Kroah-Hartman
` (347 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeongjun Park, Jiri Kosina,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <aha310510@gmail.com>
[ Upstream commit a84eeacbf9325fd7f604b80f246aaba157730cd5 ]
steelseries_srws1_probe() still does not use devm_kzalloc() and
devm_led_classdev_register(), so there is a lot of code to safely manage
heap, which reduces readability and may cause memory leaks due to minor
patch mistakes in the future.
Therefore, it should be changed to use devm_kzalloc() and
devm_led_classdev_register() to easily and safely manage heap.
Also, the current steelseries driver mainly checks sd->quriks to determine
which product a specific HID device is, which is not the correct way.
remove(), unlike probe(), does not receive struct hid_device_id as an
argument, so it must check hdev unconditionally to know which product
it is.
However, since struct steelseries_device and struct steelseries_srws1_data
have different structures, if SRWS1 is removed in remove(), converts
hdev->dev, which is initialized to struct steelseries_srws1_data,
to struct steelseries_device and uses it. This causes various
memory-related bugs as completely unexpected values exist in member
variables of the structure.
Therefore, in order to modify probe() and remove() to work properly,
Arctis 1, 9 should be added to HID_USB_DEVICE and some functions should be
modified to check hdev->product when determining HID device product.
Fixes: a0c76896c3fb ("HID: steelseries: Add support for Arctis 1 XBox")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-ids.h | 2 +
drivers/hid/hid-quirks.c | 2 +
drivers/hid/hid-steelseries.c | 109 ++++++++++++----------------------
3 files changed, 43 insertions(+), 70 deletions(-)
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 149798754570d..ded5348d190c5 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -1296,6 +1296,8 @@
#define USB_VENDOR_ID_STEELSERIES 0x1038
#define USB_DEVICE_ID_STEELSERIES_SRWS1 0x1410
+#define USB_DEVICE_ID_STEELSERIES_ARCTIS_1 0x12b6
+#define USB_DEVICE_ID_STEELSERIES_ARCTIS_9 0x12c2
#define USB_VENDOR_ID_SUN 0x0430
#define USB_DEVICE_ID_RARITAN_KVM_DONGLE 0xcdab
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index f619ed10535d7..ffd034566e2e1 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -695,6 +695,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
#endif
#if IS_ENABLED(CONFIG_HID_STEELSERIES)
{ HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_SRWS1) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_1) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_9) },
#endif
#if IS_ENABLED(CONFIG_HID_SUNPLUS)
{ HID_USB_DEVICE(USB_VENDOR_ID_SUNPLUS, USB_DEVICE_ID_SUNPLUS_WDESKTOP) },
diff --git a/drivers/hid/hid-steelseries.c b/drivers/hid/hid-steelseries.c
index d4bd7848b8c66..8af98d67959e0 100644
--- a/drivers/hid/hid-steelseries.c
+++ b/drivers/hid/hid-steelseries.c
@@ -249,11 +249,11 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
{
int ret, i;
struct led_classdev *led;
+ struct steelseries_srws1_data *drv_data;
size_t name_sz;
char *name;
- struct steelseries_srws1_data *drv_data = kzalloc(sizeof(*drv_data), GFP_KERNEL);
-
+ drv_data = devm_kzalloc(&hdev->dev, sizeof(*drv_data), GFP_KERNEL);
if (drv_data == NULL) {
hid_err(hdev, "can't alloc SRW-S1 memory\n");
return -ENOMEM;
@@ -264,18 +264,18 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
ret = hid_parse(hdev);
if (ret) {
hid_err(hdev, "parse failed\n");
- goto err_free;
+ goto err;
}
if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, 0, 0, 16)) {
ret = -ENODEV;
- goto err_free;
+ goto err;
}
ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
if (ret) {
hid_err(hdev, "hw start failed\n");
- goto err_free;
+ goto err;
}
/* register led subsystem */
@@ -288,10 +288,10 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
name_sz = strlen(hdev->uniq) + 16;
/* 'ALL', for setting all LEDs simultaneously */
- led = kzalloc(sizeof(struct led_classdev)+name_sz, GFP_KERNEL);
+ led = devm_kzalloc(&hdev->dev, sizeof(struct led_classdev)+name_sz, GFP_KERNEL);
if (!led) {
hid_err(hdev, "can't allocate memory for LED ALL\n");
- goto err_led;
+ goto out;
}
name = (void *)(&led[1]);
@@ -303,16 +303,18 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
led->brightness_set = steelseries_srws1_led_all_set_brightness;
drv_data->led[SRWS1_NUMBER_LEDS] = led;
- ret = led_classdev_register(&hdev->dev, led);
- if (ret)
- goto err_led;
+ ret = devm_led_classdev_register(&hdev->dev, led);
+ if (ret) {
+ hid_err(hdev, "failed to register LED %d. Aborting.\n", SRWS1_NUMBER_LEDS);
+ goto out; /* let the driver continue without LEDs */
+ }
/* Each individual LED */
for (i = 0; i < SRWS1_NUMBER_LEDS; i++) {
- led = kzalloc(sizeof(struct led_classdev)+name_sz, GFP_KERNEL);
+ led = devm_kzalloc(&hdev->dev, sizeof(struct led_classdev)+name_sz, GFP_KERNEL);
if (!led) {
hid_err(hdev, "can't allocate memory for LED %d\n", i);
- goto err_led;
+ break;
}
name = (void *)(&led[1]);
@@ -324,53 +326,18 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
led->brightness_set = steelseries_srws1_led_set_brightness;
drv_data->led[i] = led;
- ret = led_classdev_register(&hdev->dev, led);
+ ret = devm_led_classdev_register(&hdev->dev, led);
if (ret) {
hid_err(hdev, "failed to register LED %d. Aborting.\n", i);
-err_led:
- /* Deregister all LEDs (if any) */
- for (i = 0; i < SRWS1_NUMBER_LEDS + 1; i++) {
- led = drv_data->led[i];
- drv_data->led[i] = NULL;
- if (!led)
- continue;
- led_classdev_unregister(led);
- kfree(led);
- }
- goto out; /* but let the driver continue without LEDs */
+ break; /* but let the driver continue without LEDs */
}
}
out:
return 0;
-err_free:
- kfree(drv_data);
+err:
return ret;
}
-
-static void steelseries_srws1_remove(struct hid_device *hdev)
-{
- int i;
- struct led_classdev *led;
-
- struct steelseries_srws1_data *drv_data = hid_get_drvdata(hdev);
-
- if (drv_data) {
- /* Deregister LEDs (if any) */
- for (i = 0; i < SRWS1_NUMBER_LEDS + 1; i++) {
- led = drv_data->led[i];
- drv_data->led[i] = NULL;
- if (!led)
- continue;
- led_classdev_unregister(led);
- kfree(led);
- }
-
- }
-
- hid_hw_stop(hdev);
- kfree(drv_data);
-}
#endif
#define STEELSERIES_HEADSET_BATTERY_TIMEOUT_MS 3000
@@ -405,13 +372,12 @@ static int steelseries_headset_request_battery(struct hid_device *hdev,
static void steelseries_headset_fetch_battery(struct hid_device *hdev)
{
- struct steelseries_device *sd = hid_get_drvdata(hdev);
int ret = 0;
- if (sd->quirks & STEELSERIES_ARCTIS_1)
+ if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_1)
ret = steelseries_headset_request_battery(hdev,
arctis_1_battery_request, sizeof(arctis_1_battery_request));
- else if (sd->quirks & STEELSERIES_ARCTIS_9)
+ else if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_9)
ret = steelseries_headset_request_battery(hdev,
arctis_9_battery_request, sizeof(arctis_9_battery_request));
@@ -567,14 +533,7 @@ static int steelseries_probe(struct hid_device *hdev, const struct hid_device_id
struct steelseries_device *sd;
int ret;
- sd = devm_kzalloc(&hdev->dev, sizeof(*sd), GFP_KERNEL);
- if (!sd)
- return -ENOMEM;
- hid_set_drvdata(hdev, sd);
- sd->hdev = hdev;
- sd->quirks = id->driver_data;
-
- if (sd->quirks & STEELSERIES_SRWS1) {
+ if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1) {
#if IS_BUILTIN(CONFIG_LEDS_CLASS) || \
(IS_MODULE(CONFIG_LEDS_CLASS) && IS_MODULE(CONFIG_HID_STEELSERIES))
return steelseries_srws1_probe(hdev, id);
@@ -583,6 +542,13 @@ static int steelseries_probe(struct hid_device *hdev, const struct hid_device_id
#endif
}
+ sd = devm_kzalloc(&hdev->dev, sizeof(*sd), GFP_KERNEL);
+ if (!sd)
+ return -ENOMEM;
+ hid_set_drvdata(hdev, sd);
+ sd->hdev = hdev;
+ sd->quirks = id->driver_data;
+
ret = hid_parse(hdev);
if (ret)
return ret;
@@ -610,17 +576,19 @@ static int steelseries_probe(struct hid_device *hdev, const struct hid_device_id
static void steelseries_remove(struct hid_device *hdev)
{
- struct steelseries_device *sd = hid_get_drvdata(hdev);
+ struct steelseries_device *sd;
unsigned long flags;
- if (sd->quirks & STEELSERIES_SRWS1) {
+ if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1) {
#if IS_BUILTIN(CONFIG_LEDS_CLASS) || \
(IS_MODULE(CONFIG_LEDS_CLASS) && IS_MODULE(CONFIG_HID_STEELSERIES))
- steelseries_srws1_remove(hdev);
+ goto srws1_remove;
#endif
return;
}
+ sd = hid_get_drvdata(hdev);
+
spin_lock_irqsave(&sd->lock, flags);
sd->removed = true;
spin_unlock_irqrestore(&sd->lock, flags);
@@ -628,6 +596,7 @@ static void steelseries_remove(struct hid_device *hdev)
cancel_delayed_work_sync(&sd->battery_work);
hid_hw_close(hdev);
+srws1_remove:
hid_hw_stop(hdev);
}
@@ -667,10 +636,10 @@ static int steelseries_headset_raw_event(struct hid_device *hdev,
unsigned long flags;
/* Not a headset */
- if (sd->quirks & STEELSERIES_SRWS1)
+ if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1)
return 0;
- if (sd->quirks & STEELSERIES_ARCTIS_1) {
+ if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_1) {
hid_dbg(sd->hdev,
"Parsing raw event for Arctis 1 headset (%*ph)\n", size, read_buf);
if (size < ARCTIS_1_BATTERY_RESPONSE_LEN ||
@@ -688,7 +657,7 @@ static int steelseries_headset_raw_event(struct hid_device *hdev,
}
}
- if (sd->quirks & STEELSERIES_ARCTIS_9) {
+ if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_9) {
hid_dbg(sd->hdev,
"Parsing raw event for Arctis 9 headset (%*ph)\n", size, read_buf);
if (size < ARCTIS_9_BATTERY_RESPONSE_LEN) {
@@ -757,11 +726,11 @@ static const struct hid_device_id steelseries_devices[] = {
.driver_data = STEELSERIES_SRWS1 },
{ /* SteelSeries Arctis 1 Wireless for XBox */
- HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, 0x12b6),
- .driver_data = STEELSERIES_ARCTIS_1 },
+ HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_1),
+ .driver_data = STEELSERIES_ARCTIS_1 },
{ /* SteelSeries Arctis 9 Wireless for XBox */
- HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, 0x12c2),
+ HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_9),
.driver_data = STEELSERIES_ARCTIS_9 },
{ }
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 230/563] drm/amdgpu: fix incorrect vm flags to map bo
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 229/563] HID: steelseries: refactor probe() and remove() Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-14 6:04 ` Jiri Slaby
2025-10-13 14:41 ` [PATCH 6.17 231/563] media: zoran: Remove zoran_fh structure Greg Kroah-Hartman
` (346 subsequent siblings)
576 siblings, 1 reply; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jack Xiao, Likun Gao, Alex Deucher,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Xiao <Jack.Xiao@amd.com>
[ Upstream commit b08425fa77ad2f305fe57a33dceb456be03b653f ]
It should use vm flags instead of pte flags
to specify bo vm attributes.
Fixes: 7946340fa389 ("drm/amdgpu: Move csa related code to separate file")
Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
Reviewed-by: Likun Gao <Likun.Gao@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
index 02138aa557935..dfb6cfd837606 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
@@ -88,8 +88,8 @@ int amdgpu_map_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm,
}
r = amdgpu_vm_bo_map(adev, *bo_va, csa_addr, 0, size,
- AMDGPU_PTE_READABLE | AMDGPU_PTE_WRITEABLE |
- AMDGPU_PTE_EXECUTABLE);
+ AMDGPU_VM_PAGE_READABLE | AMDGPU_VM_PAGE_WRITEABLE |
+ AMDGPU_VM_PAGE_EXECUTABLE);
if (r) {
DRM_ERROR("failed to do bo_map on static CSA, err=%d\n", r);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 230/563] drm/amdgpu: fix incorrect vm flags to map bo
2025-10-13 14:41 ` [PATCH 6.17 230/563] drm/amdgpu: fix incorrect vm flags to map bo Greg Kroah-Hartman
@ 2025-10-14 6:04 ` Jiri Slaby
2025-10-15 8:50 ` Greg Kroah-Hartman
0 siblings, 1 reply; 591+ messages in thread
From: Jiri Slaby @ 2025-10-14 6:04 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, Jack Xiao, Likun Gao, Alex Deucher, Sasha Levin
On 13. 10. 25, 16:41, Greg Kroah-Hartman wrote:
> 6.17-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Jack Xiao <Jack.Xiao@amd.com>
>
> [ Upstream commit b08425fa77ad2f305fe57a33dceb456be03b653f ]
>
> It should use vm flags instead of pte flags
> to specify bo vm attributes.
Note this was reverted by:
commit be33e8a239aac204d7e9e673c4220ef244eb1ba3
Author: Alex Deucher <alexander.deucher@amd.com>
Date: Mon Aug 25 13:40:22 2025 -0400
Revert "drm/amdgpu: fix incorrect vm flags to map bo"
This reverts commit b08425fa77ad2f305fe57a33dceb456be03b653f.
Revert this to align with 6.17 because the fixes tag
was wrong on this commit.
> Fixes: 7946340fa389 ("drm/amdgpu: Move csa related code to separate file")
> Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
> Reviewed-by: Likun Gao <Likun.Gao@amd.com>
> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
> index 02138aa557935..dfb6cfd837606 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
> @@ -88,8 +88,8 @@ int amdgpu_map_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm,
> }
>
> r = amdgpu_vm_bo_map(adev, *bo_va, csa_addr, 0, size,
> - AMDGPU_PTE_READABLE | AMDGPU_PTE_WRITEABLE |
> - AMDGPU_PTE_EXECUTABLE);
> + AMDGPU_VM_PAGE_READABLE | AMDGPU_VM_PAGE_WRITEABLE |
> + AMDGPU_VM_PAGE_EXECUTABLE);
>
> if (r) {
> DRM_ERROR("failed to do bo_map on static CSA, err=%d\n", r);
--
js
suse labs
^ permalink raw reply [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 230/563] drm/amdgpu: fix incorrect vm flags to map bo
2025-10-14 6:04 ` Jiri Slaby
@ 2025-10-15 8:50 ` Greg Kroah-Hartman
0 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-15 8:50 UTC (permalink / raw)
To: Jiri Slaby
Cc: stable, patches, Jack Xiao, Likun Gao, Alex Deucher, Sasha Levin
On Tue, Oct 14, 2025 at 08:04:39AM +0200, Jiri Slaby wrote:
> On 13. 10. 25, 16:41, Greg Kroah-Hartman wrote:
> > 6.17-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Jack Xiao <Jack.Xiao@amd.com>
> >
> > [ Upstream commit b08425fa77ad2f305fe57a33dceb456be03b653f ]
> >
> > It should use vm flags instead of pte flags
> > to specify bo vm attributes.
>
> Note this was reverted by:
> commit be33e8a239aac204d7e9e673c4220ef244eb1ba3
> Author: Alex Deucher <alexander.deucher@amd.com>
> Date: Mon Aug 25 13:40:22 2025 -0400
>
> Revert "drm/amdgpu: fix incorrect vm flags to map bo"
>
> This reverts commit b08425fa77ad2f305fe57a33dceb456be03b653f.
>
> Revert this to align with 6.17 because the fixes tag
> was wrong on this commit.
Ugh, we already took this patch, and the revert, in previous releases,
but it got added here again for some reason. I'll go drop this from all
queues now, thanks for catching this!
greg k-h
^ permalink raw reply [flat|nested] 591+ messages in thread
* [PATCH 6.17 231/563] media: zoran: Remove zoran_fh structure
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 230/563] drm/amdgpu: fix incorrect vm flags to map bo Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 232/563] phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 Greg Kroah-Hartman
` (345 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacopo Mondi, Laurent Pinchart,
Hans Verkuil, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
[ Upstream commit dc322d13cf417552b59e313e809a6da40b8b36ef ]
The zoran_fh structure is a wrapper around v4l2_fh. Its usage has been
mostly removed by commit 83f89a8bcbc3 ("media: zoran: convert to vb2"),
but the structure stayed by mistake. It is now used in a single
location, assigned from a void pointer and then recast to a void
pointer, without being every accessed. Drop it.
Fixes: 83f89a8bcbc3 ("media: zoran: convert to vb2")
Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/zoran/zoran.h | 6 ------
drivers/media/pci/zoran/zoran_driver.c | 3 +--
2 files changed, 1 insertion(+), 8 deletions(-)
diff --git a/drivers/media/pci/zoran/zoran.h b/drivers/media/pci/zoran/zoran.h
index 1cd990468d3de..d05e222b39215 100644
--- a/drivers/media/pci/zoran/zoran.h
+++ b/drivers/media/pci/zoran/zoran.h
@@ -154,12 +154,6 @@ struct zoran_jpg_settings {
struct zoran;
-/* zoran_fh contains per-open() settings */
-struct zoran_fh {
- struct v4l2_fh fh;
- struct zoran *zr;
-};
-
struct card_info {
enum card_type type;
char name[32];
diff --git a/drivers/media/pci/zoran/zoran_driver.c b/drivers/media/pci/zoran/zoran_driver.c
index f42f596d3e629..ec7fc1da4cc02 100644
--- a/drivers/media/pci/zoran/zoran_driver.c
+++ b/drivers/media/pci/zoran/zoran_driver.c
@@ -511,12 +511,11 @@ static int zoran_s_fmt_vid_cap(struct file *file, void *__fh,
struct v4l2_format *fmt)
{
struct zoran *zr = video_drvdata(file);
- struct zoran_fh *fh = __fh;
int i;
int res = 0;
if (fmt->fmt.pix.pixelformat == V4L2_PIX_FMT_MJPEG)
- return zoran_s_fmt_vid_out(file, fh, fmt);
+ return zoran_s_fmt_vid_out(file, __fh, fmt);
for (i = 0; i < NUM_FORMATS; i++)
if (fmt->fmt.pix.pixelformat == zoran_formats[i].fourcc)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 232/563] phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 231/563] media: zoran: Remove zoran_fh structure Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 233/563] drm/bridge: cdns-dsi: Fix the _atomic_check() Greg Kroah-Hartman
` (344 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jonas Karlman, Vinod Koul,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <jonas@kwiboo.se>
[ Upstream commit 7bb14b61b7d03db770b7e8871493f5b9b2be2b79 ]
The boot firmware may disable the U3 port early during boot and leave it
up to the controller or PHY driver to re-enable U3 when needed.
The Rockchip USBDP PHY driver currently does this for RK3576 and RK3588,
something the Rockchip Naneng Combo PHY driver never does for RK3568.
This may result in USB 3.0 ports being limited to only using USB 2.0 or
in special cases not working at all on RK3568.
Write to PIPE_GRF USB3OTGx_CON1 reg to ensure the U3 port is enabled
when a PHY with PHY_TYPE_USB3 mode is used.
Fixes: 7160820d742a ("phy: rockchip: add naneng combo phy for RK3568")
Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
Link: https://lore.kernel.org/r/20250723072324.2246498-1-jonas@kwiboo.se
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
index ce91fb1d51671..17c6310f4b54b 100644
--- a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
+++ b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
@@ -137,6 +137,8 @@ struct rockchip_combphy_grfcfg {
struct combphy_reg pipe_xpcs_phy_ready;
struct combphy_reg pipe_pcie1l0_sel;
struct combphy_reg pipe_pcie1l1_sel;
+ struct combphy_reg u3otg0_port_en;
+ struct combphy_reg u3otg1_port_en;
};
struct rockchip_combphy_cfg {
@@ -594,6 +596,14 @@ static int rk3568_combphy_cfg(struct rockchip_combphy_priv *priv)
rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txcomp_sel, false);
rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txelec_sel, false);
rockchip_combphy_param_write(priv->phy_grf, &cfg->usb_mode_set, true);
+ switch (priv->id) {
+ case 0:
+ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg0_port_en, true);
+ break;
+ case 1:
+ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg1_port_en, true);
+ break;
+ }
break;
case PHY_TYPE_SATA:
@@ -737,6 +747,8 @@ static const struct rockchip_combphy_grfcfg rk3568_combphy_grfcfgs = {
/* pipe-grf */
.pipe_con0_for_sata = { 0x0000, 15, 0, 0x00, 0x2220 },
.pipe_xpcs_phy_ready = { 0x0040, 2, 2, 0x00, 0x01 },
+ .u3otg0_port_en = { 0x0104, 15, 0, 0x0181, 0x1100 },
+ .u3otg1_port_en = { 0x0144, 15, 0, 0x0181, 0x1100 },
};
static const struct rockchip_combphy_cfg rk3568_combphy_cfgs = {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 233/563] drm/bridge: cdns-dsi: Fix the _atomic_check()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 232/563] phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 234/563] usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup Greg Kroah-Hartman
` (343 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aradhya Bhatia, Tomi Valkeinen,
Jayesh Choudhary, Devarsh Thakkar, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aradhya Bhatia <aradhya.bhatia@linux.dev>
[ Upstream commit 04864af849d9ae0dd020798f5b3632d9cf26fa03 ]
Use the "adjusted_mode" for the dsi configuration check, as that is the
more appropriate display_mode for validation, and later bridge enable.
Also, fix the mode_valid_check parameter from false to true, as the dsi
configuration check is taking place during the check-phase, and the
crtc_* mode values are not expected to be populated yet.
Fixes: a53d987756ea ("drm/bridge: cdns-dsi: Move DSI mode check to _atomic_check()")
Signed-off-by: Aradhya Bhatia <aradhya.bhatia@linux.dev>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Tested-by: Jayesh Choudhary <j-choudhary@ti.com>
Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-1-e61cc06074c2@ideasonboard.com
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
index a57ca8c3bdaea..695b6246b280f 100644
--- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
+++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
@@ -997,10 +997,10 @@ static int cdns_dsi_bridge_atomic_check(struct drm_bridge *bridge,
struct cdns_dsi_input *input = bridge_to_cdns_dsi_input(bridge);
struct cdns_dsi *dsi = input_to_dsi(input);
struct cdns_dsi_bridge_state *dsi_state = to_cdns_dsi_bridge_state(bridge_state);
- const struct drm_display_mode *mode = &crtc_state->mode;
+ const struct drm_display_mode *adjusted_mode = &crtc_state->adjusted_mode;
struct cdns_dsi_cfg *dsi_cfg = &dsi_state->dsi_cfg;
- return cdns_dsi_check_conf(dsi, mode, dsi_cfg, false);
+ return cdns_dsi_check_conf(dsi, adjusted_mode, dsi_cfg, true);
}
static struct drm_bridge_state *
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 234/563] usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 233/563] drm/bridge: cdns-dsi: Fix the _atomic_check() Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 235/563] usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls Greg Kroah-Hartman
` (342 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ]
The kthread_run() function returns error pointers so the
max3421_hcd->spi_thread pointer can be either error pointers or NULL.
Check for both before dereferencing it.
Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/aJTMVAPtRe5H6jug@stanley.mountain
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/max3421-hcd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
index dcf31a592f5d1..4b5f03f683f77 100644
--- a/drivers/usb/host/max3421-hcd.c
+++ b/drivers/usb/host/max3421-hcd.c
@@ -1916,7 +1916,7 @@ max3421_probe(struct spi_device *spi)
if (hcd) {
kfree(max3421_hcd->tx);
kfree(max3421_hcd->rx);
- if (max3421_hcd->spi_thread)
+ if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread))
kthread_stop(max3421_hcd->spi_thread);
usb_put_hcd(hcd);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 235/563] usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 234/563] usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 236/563] PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure Greg Kroah-Hartman
` (341 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Melody Olvera, Konrad Dybcio,
Dmitry Baryshkov, Souradeep Chowdhury, Komal Bajaj, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Komal Bajaj <komal.bajaj@oss.qualcomm.com>
[ Upstream commit c0485e864a2eaa1d5a84c71e573dd236d0e885ae ]
EUD_MODE_MANAGER2 register is mapped to a memory region that is marked
as read-only for operating system running at EL1, enforcing access
restrictions that prohibit direct memory-mapped writes via writel().
Attempts to write to this region from HLOS can result in silent failures
or memory access violations, particularly when toggling EUD (Embedded
USB Debugger) state. To ensure secure register access, modify the driver
to use qcom_scm_io_writel(), which routes the write operation to Qualcomm
Secure Channel Monitor (SCM). SCM has the necessary permissions to access
protected memory regions, enabling reliable control over EUD state.
SC7280, the only user of EUD is also affected, indicating that this could
never have worked on a properly fused device.
Fixes: 9a1bf58ccd44 ("usb: misc: eud: Add driver support for Embedded USB Debugger(EUD)")
Signed-off-by: Melody Olvera <quic_molvera@quicinc.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Souradeep Chowdhury <quic_schowdhu@quicinc.com>
Signed-off-by: Komal Bajaj <komal.bajaj@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250731-eud_mode_manager_secure_access-v8-1-4a5dcbb79f41@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/misc/Kconfig | 1 +
drivers/usb/misc/qcom_eud.c | 33 ++++++++++++++++++++++++---------
2 files changed, 25 insertions(+), 9 deletions(-)
diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig
index 6497c4e81e951..9bf8fc6247bac 100644
--- a/drivers/usb/misc/Kconfig
+++ b/drivers/usb/misc/Kconfig
@@ -147,6 +147,7 @@ config USB_APPLEDISPLAY
config USB_QCOM_EUD
tristate "QCOM Embedded USB Debugger(EUD) Driver"
depends on ARCH_QCOM || COMPILE_TEST
+ select QCOM_SCM
select USB_ROLE_SWITCH
help
This module enables support for Qualcomm Technologies, Inc.
diff --git a/drivers/usb/misc/qcom_eud.c b/drivers/usb/misc/qcom_eud.c
index 83079c414b4f2..05c8bdc943a88 100644
--- a/drivers/usb/misc/qcom_eud.c
+++ b/drivers/usb/misc/qcom_eud.c
@@ -15,6 +15,7 @@
#include <linux/slab.h>
#include <linux/sysfs.h>
#include <linux/usb/role.h>
+#include <linux/firmware/qcom/qcom_scm.h>
#define EUD_REG_INT1_EN_MASK 0x0024
#define EUD_REG_INT_STATUS_1 0x0044
@@ -34,7 +35,7 @@ struct eud_chip {
struct device *dev;
struct usb_role_switch *role_sw;
void __iomem *base;
- void __iomem *mode_mgr;
+ phys_addr_t mode_mgr;
unsigned int int_status;
int irq;
bool enabled;
@@ -43,18 +44,29 @@ struct eud_chip {
static int enable_eud(struct eud_chip *priv)
{
+ int ret;
+
+ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 1);
+ if (ret)
+ return ret;
+
writel(EUD_ENABLE, priv->base + EUD_REG_CSR_EUD_EN);
writel(EUD_INT_VBUS | EUD_INT_SAFE_MODE,
priv->base + EUD_REG_INT1_EN_MASK);
- writel(1, priv->mode_mgr + EUD_REG_EUD_EN2);
return usb_role_switch_set_role(priv->role_sw, USB_ROLE_DEVICE);
}
-static void disable_eud(struct eud_chip *priv)
+static int disable_eud(struct eud_chip *priv)
{
+ int ret;
+
+ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 0);
+ if (ret)
+ return ret;
+
writel(0, priv->base + EUD_REG_CSR_EUD_EN);
- writel(0, priv->mode_mgr + EUD_REG_EUD_EN2);
+ return 0;
}
static ssize_t enable_show(struct device *dev,
@@ -82,11 +94,12 @@ static ssize_t enable_store(struct device *dev,
chip->enabled = enable;
else
disable_eud(chip);
+
} else {
- disable_eud(chip);
+ ret = disable_eud(chip);
}
- return count;
+ return ret < 0 ? ret : count;
}
static DEVICE_ATTR_RW(enable);
@@ -178,6 +191,7 @@ static void eud_role_switch_release(void *data)
static int eud_probe(struct platform_device *pdev)
{
struct eud_chip *chip;
+ struct resource *res;
int ret;
chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL);
@@ -200,9 +214,10 @@ static int eud_probe(struct platform_device *pdev)
if (IS_ERR(chip->base))
return PTR_ERR(chip->base);
- chip->mode_mgr = devm_platform_ioremap_resource(pdev, 1);
- if (IS_ERR(chip->mode_mgr))
- return PTR_ERR(chip->mode_mgr);
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+ if (!res)
+ return -ENODEV;
+ chip->mode_mgr = res->start;
chip->irq = platform_get_irq(pdev, 0);
if (chip->irq < 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 236/563] PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 235/563] usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 237/563] misc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl() Greg Kroah-Hartman
` (340 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Bjorn Helgaas,
Manivannan Sadhasivam, Marek Vasut, Bartosz Golaszewski,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit ab81f2f79c683c94bac622aafafbe8232e547159 ]
When devm_add_action_or_reset() fails, it calls the passed cleanup
function. Hence the caller must not repeat that cleanup.
Replace the "goto err_regulator_free" by the actual freeing, as there
will never be a need again for a second user of this label.
Fixes: 75996c92f4de309f ("PCI/pwrctrl: Add pwrctrl driver for PCI slots")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Marek Vasut <marek.vasut+renesas@mailbox.org> # V4H Sparrow Hawk
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Link: https://patch.msgid.link/7b1386e6162e70e6d631c87f6323d2ab971bc1c5.1755100324.git.geert+renesas@glider.be
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pwrctrl/slot.c | 12 +++---------
1 file changed, 3 insertions(+), 9 deletions(-)
diff --git a/drivers/pci/pwrctrl/slot.c b/drivers/pci/pwrctrl/slot.c
index 6e138310b45b9..3320494b62d89 100644
--- a/drivers/pci/pwrctrl/slot.c
+++ b/drivers/pci/pwrctrl/slot.c
@@ -49,13 +49,14 @@ static int pci_pwrctrl_slot_probe(struct platform_device *pdev)
ret = regulator_bulk_enable(slot->num_supplies, slot->supplies);
if (ret < 0) {
dev_err_probe(dev, ret, "Failed to enable slot regulators\n");
- goto err_regulator_free;
+ regulator_bulk_free(slot->num_supplies, slot->supplies);
+ return ret;
}
ret = devm_add_action_or_reset(dev, devm_pci_pwrctrl_slot_power_off,
slot);
if (ret)
- goto err_regulator_disable;
+ return ret;
clk = devm_clk_get_optional_enabled(dev, NULL);
if (IS_ERR(clk)) {
@@ -70,13 +71,6 @@ static int pci_pwrctrl_slot_probe(struct platform_device *pdev)
return dev_err_probe(dev, ret, "Failed to register pwrctrl driver\n");
return 0;
-
-err_regulator_disable:
- regulator_bulk_disable(slot->num_supplies, slot->supplies);
-err_regulator_free:
- regulator_bulk_free(slot->num_supplies, slot->supplies);
-
- return ret;
}
static const struct of_device_id pci_pwrctrl_slot_of_match[] = {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 237/563] misc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 236/563] PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 238/563] serial: max310x: Add error checking in probe() Greg Kroah-Hartman
` (339 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Manivannan Sadhasivam,
Bjorn Helgaas, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 1ad82f9db13d85667366044acdfb02009d576c5a ]
Commit eefb83790a0d ("misc: pci_endpoint_test: Add doorbell test case")
added NO_BAR (-1) to the pci_barno enum which, in practical terms,
changes the enum from an unsigned int to a signed int. If the user
passes a negative number in pci_endpoint_test_ioctl() then it results in
an array underflow in pci_endpoint_test_bar().
Fixes: eefb83790a0d ("misc: pci_endpoint_test: Add doorbell test case")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/aIzzZ4vc6ZrmM9rI@suswa
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/pci_endpoint_test.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
index 1c156a3f845e1..f935175d8bf55 100644
--- a/drivers/misc/pci_endpoint_test.c
+++ b/drivers/misc/pci_endpoint_test.c
@@ -937,7 +937,7 @@ static long pci_endpoint_test_ioctl(struct file *file, unsigned int cmd,
switch (cmd) {
case PCITEST_BAR:
bar = arg;
- if (bar > BAR_5)
+ if (bar <= NO_BAR || bar > BAR_5)
goto ret;
if (is_am654_pci_dev(pdev) && bar == BAR_0)
goto ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 238/563] serial: max310x: Add error checking in probe()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 237/563] misc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl() Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 239/563] drm/amd/display: Remove redundant semicolons Greg Kroah-Hartman
` (338 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 ]
Check if devm_i2c_new_dummy_device() fails.
Fixes: 2e1f2d9a9bdb ("serial: max310x: implement I2C support")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/aJTMPZiKqeXSE-KM@stanley.mountain
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/max310x.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
index ce260e9949c3c..d9a0100b92d2b 100644
--- a/drivers/tty/serial/max310x.c
+++ b/drivers/tty/serial/max310x.c
@@ -1644,6 +1644,8 @@ static int max310x_i2c_probe(struct i2c_client *client)
port_client = devm_i2c_new_dummy_device(&client->dev,
client->adapter,
port_addr);
+ if (IS_ERR(port_client))
+ return PTR_ERR(port_client);
regcfg_i2c.name = max310x_regmap_name(i);
regmaps[i] = devm_regmap_init_i2c(port_client, ®cfg_i2c);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 239/563] drm/amd/display: Remove redundant semicolons
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 238/563] serial: max310x: Add error checking in probe() Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 240/563] drm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions Greg Kroah-Hartman
` (337 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liao Yuanhong, Alex Deucher,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Yuanhong <liaoyuanhong@vivo.com>
[ Upstream commit 90b810dd859c0df9db2290da1ac5842e5f031267 ]
Remove unnecessary semicolons.
Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321")
Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
index 9ba6cb67655f4..6c75aa82327ac 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
@@ -139,7 +139,6 @@ void dml32_rq_dlg_get_rq_reg(display_rq_regs_st *rq_regs,
if (dual_plane) {
unsigned int p1_pte_row_height_linear = get_dpte_row_height_linear_c(mode_lib, e2e_pipe_param,
num_pipes, pipe_idx);
- ;
if (src->sw_mode == dm_sw_linear)
ASSERT(p1_pte_row_height_linear >= 8);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 240/563] drm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 239/563] drm/amd/display: Remove redundant semicolons Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 241/563] crypto: keembay - Add missing check after sg_nents_for_len() Greg Kroah-Hartman
` (336 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Alex Hung, Alvin Lee,
Ray Wu, Dillon Varone, Aurabindo Pillai, Roman Li,
ChiaHsuan Chung, Harry Wentland, Daniel Wheeler, Wenjing Liu,
Jun Lei, Srinivasan Shanmugam, Dillon Varone, Alex Deucher,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
[ Upstream commit bf4e4b97d0fdc66f04fc19d807e24dd8421b8f11 ]
The function dc_stream_set_cursor_attributes() currently dereferences
the `stream` pointer and nested members `stream->ctx->dc->current_state`
without checking for NULL.
All callers of these functions, such as in
`dcn30_apply_idle_power_optimizations()` and
`amdgpu_dm_plane_handle_cursor_update()`, already perform NULL checks
before calling these functions.
Fixes below:
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:336 dc_stream_program_cursor_attributes()
error: we previously assumed 'stream' could be null (see line 334)
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c
327 bool dc_stream_program_cursor_attributes(
328 struct dc_stream_state *stream,
329 const struct dc_cursor_attributes *attributes)
330 {
331 struct dc *dc;
332 bool reset_idle_optimizations = false;
333
334 dc = stream ? stream->ctx->dc : NULL;
^^^^^^
The old code assumed stream could be NULL.
335
--> 336 if (dc_stream_set_cursor_attributes(stream, attributes)) {
^^^^^^
The refactor added an unchecked dereference.
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c
313 bool dc_stream_set_cursor_attributes(
314 struct dc_stream_state *stream,
315 const struct dc_cursor_attributes *attributes)
316 {
317 bool result = false;
318
319 if (dc_stream_check_cursor_attributes(stream, stream->ctx->dc->current_state, attributes)) {
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Here.
This function used to check for if stream as NULL and return false at
the start. Probably we should add that back.
Fixes: 4465dd0e41e8 ("drm/amd/display: Refactor SubVP cursor limiting logic")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Cc: Alex Hung <alex.hung@amd.com>
Cc: Alvin Lee <alvin.lee2@amd.com>
Cc: Ray Wu <ray.wu@amd.com>
Cc: Dillon Varone <dillon.varone@amd.com>
Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
Cc: Roman Li <roman.li@amd.com>
Cc: ChiaHsuan Chung <chiahsuan.chung@amd.com>
Cc: Harry Wentland <harry.wentland@amd.com>
Cc: Daniel Wheeler <daniel.wheeler@amd.com>
Cc: Tom Chung <chiahsuan.chung@amd.com>
Cc: Wenjing Liu <wenjing.liu@amd.com>
Cc: Jun Lei <Jun.Lei@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Dillon Varone <Dillon.varone@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index 4d6bc9fd4faa8..9ac2d41f8fcae 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -316,6 +316,9 @@ bool dc_stream_set_cursor_attributes(
{
bool result = false;
+ if (!stream)
+ return false;
+
if (dc_stream_check_cursor_attributes(stream, stream->ctx->dc->current_state, attributes)) {
stream->cursor_attributes = *attributes;
result = true;
@@ -331,7 +334,10 @@ bool dc_stream_program_cursor_attributes(
struct dc *dc;
bool reset_idle_optimizations = false;
- dc = stream ? stream->ctx->dc : NULL;
+ if (!stream)
+ return false;
+
+ dc = stream->ctx->dc;
if (dc_stream_set_cursor_attributes(stream, attributes)) {
dc_z10_restore(dc);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 241/563] crypto: keembay - Add missing check after sg_nents_for_len()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 240/563] drm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 242/563] hwrng: nomadik - add ARM_AMBA dependency Greg Kroah-Hartman
` (335 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thomas Fourier, Herbert Xu,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <fourier.thomas@gmail.com>
[ Upstream commit 4e53be21dd0315c00eaf40cc8f8c0facd4d9a6b2 ]
sg_nents_for_len() returns an int which is negative in case of error.
Fixes: 472b04444cd3 ("crypto: keembay - Add Keem Bay OCS HCU driver")
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
index 8f9e21ced0fe1..48281d8822603 100644
--- a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
+++ b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
@@ -232,7 +232,7 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req)
struct device *dev = rctx->hcu_dev->dev;
unsigned int remainder = 0;
unsigned int total;
- size_t nents;
+ int nents;
size_t count;
int rc;
int i;
@@ -253,6 +253,9 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req)
/* Determine the number of scatter gather list entries to process. */
nents = sg_nents_for_len(req->src, rctx->sg_data_total - remainder);
+ if (nents < 0)
+ return nents;
+
/* If there are entries to process, map them. */
if (nents) {
rctx->sg_dma_nents = dma_map_sg(dev, req->src, nents,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 242/563] hwrng: nomadik - add ARM_AMBA dependency
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 241/563] crypto: keembay - Add missing check after sg_nents_for_len() Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 243/563] docs: iio: ad3552r: Fix malformed code-block directive Greg Kroah-Hartman
` (334 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Herbert Xu,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit efaa2d815a0e4d1c06750e587100f6f7f4ee5497 ]
Compile-testing this driver is only possible when the AMBA bus driver is
available in the kernel:
x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_remove':
nomadik-rng.c:(.text+0x67): undefined reference to `amba_release_regions'
x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_probe':
nomadik-rng.c:(.text+0xee): undefined reference to `amba_request_regions'
x86_64-linux-ld: nomadik-rng.c:(.text+0x18d): undefined reference to `amba_release_regions'
The was previously implied by the 'depends on ARCH_NOMADIK', but needs to be
specified for the COMPILE_TEST case.
Fixes: d5e93b3374e4 ("hwrng: Kconfig - Add helper dependency on COMPILE_TEST")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/hw_random/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
index c858278434475..7826fd7c4603f 100644
--- a/drivers/char/hw_random/Kconfig
+++ b/drivers/char/hw_random/Kconfig
@@ -312,6 +312,7 @@ config HW_RANDOM_INGENIC_TRNG
config HW_RANDOM_NOMADIK
tristate "ST-Ericsson Nomadik Random Number Generator support"
depends on ARCH_NOMADIK || COMPILE_TEST
+ depends on ARM_AMBA
default HW_RANDOM
help
This driver provides kernel-side support for the Random Number
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 243/563] docs: iio: ad3552r: Fix malformed code-block directive
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 242/563] hwrng: nomadik - add ARM_AMBA dependency Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 244/563] fwctl/mlx5: Fix memory alloc/free in mlx5ctl_fw_rpc() Greg Kroah-Hartman
` (333 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jorge Marques, David Lechner,
Jonathan Cameron, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jorge Marques <jorge.marques@analog.com>
[ Upstream commit 788c57f4766bd5802af9918ea350053a91488c60 ]
Missing required double dot and line break.
Fixes: ede84c455659 ("docs: iio: add documentation for ad3552r driver")
Signed-off-by: Jorge Marques <jorge.marques@analog.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Link: https://patch.msgid.link/20250818-docs-ad3552r-code-block-fix-v1-1-4430cbc26676@analog.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/iio/ad3552r.rst | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/Documentation/iio/ad3552r.rst b/Documentation/iio/ad3552r.rst
index f5d59e4e86c7e..4274e35f503d9 100644
--- a/Documentation/iio/ad3552r.rst
+++ b/Documentation/iio/ad3552r.rst
@@ -64,7 +64,8 @@ specific debugfs path ``/sys/kernel/debug/iio/iio:deviceX``.
Usage examples
--------------
-. code-block:: bash
+.. code-block:: bash
+
root:/sys/bus/iio/devices/iio:device0# cat data_source
normal
root:/sys/bus/iio/devices/iio:device0# echo -n ramp-16bit > data_source
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 244/563] fwctl/mlx5: Fix memory alloc/free in mlx5ctl_fw_rpc()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 243/563] docs: iio: ad3552r: Fix malformed code-block directive Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 245/563] scsi: pm80xx: Restore support for expanders Greg Kroah-Hartman
` (332 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Akhilesh Patil, Dave Jiang,
Alison Schofield, Jason Gunthorpe, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
[ Upstream commit 7f059e47326746ceebe2a984bd6124459df3b458 ]
Use kvfree() to free memory allocated by kvzalloc() instead of kfree().
Avoid potential memory management issue considering kvzalloc() can
internally choose to use either kmalloc() or vmalloc() based on memory
request and current system memory state. Hence, use more appropriate
kvfree() which automatically determines correct free method to avoid
potential hard to debug memory issues. Fix this issue discovered by
running spatch static analysis tool using coccinelle script -
scripts/coccinelle/api/kfree_mismatch.cocci
Fixes: 52929c2142041 ("fwctl/mlx5: Support for communicating with mlx5 fw")
Link: https://patch.msgid.link/r/aKAjCoF9cT3VEbSE@bhairav-test.ee.iitb.ac.in
Signed-off-by: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/fwctl/mlx5/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/fwctl/mlx5/main.c b/drivers/fwctl/mlx5/main.c
index f93aa0cecdb97..4b379f695eb73 100644
--- a/drivers/fwctl/mlx5/main.c
+++ b/drivers/fwctl/mlx5/main.c
@@ -345,7 +345,7 @@ static void *mlx5ctl_fw_rpc(struct fwctl_uctx *uctx, enum fwctl_rpc_scope scope,
*/
if (ret && ret != -EREMOTEIO) {
if (rpc_out != rpc_in)
- kfree(rpc_out);
+ kvfree(rpc_out);
return ERR_PTR(ret);
}
return rpc_out;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 245/563] scsi: pm80xx: Restore support for expanders
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 244/563] fwctl/mlx5: Fix memory alloc/free in mlx5ctl_fw_rpc() Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 246/563] scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod Greg Kroah-Hartman
` (331 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Igor Pylypiv, Niklas Cassel,
Damien Le Moal, Martin K. Petersen, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit eeee1086073e0058243c8554738271561bde81f1 ]
Commit 0f630c58e31a ("scsi: pm80xx: Do not use libsas port ID") broke
support for expanders. After the commit, devices behind an expander are
no longer detected.
Simply reverting the commit restores support for devices behind an
expander.
Instead of reverting the commit (and reintroducing a helper to get the
port), get the port directly from the lldd_port pointer in struct
asd_sas_port.
Fixes: 0f630c58e31a ("scsi: pm80xx: Do not use libsas port ID")
Suggested-by: Igor Pylypiv <ipylypiv@google.com>
Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Link: https://lore.kernel.org/r/20250814173215.1765055-13-cassel@kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Tested-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/pm8001/pm8001_sas.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index f7067878b34f3..753c09363cbbc 100644
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -477,7 +477,7 @@ int pm8001_queue_command(struct sas_task *task, gfp_t gfp_flags)
struct pm8001_device *pm8001_dev = dev->lldd_dev;
bool internal_abort = sas_is_internal_abort(task);
struct pm8001_hba_info *pm8001_ha;
- struct pm8001_port *port = NULL;
+ struct pm8001_port *port;
struct pm8001_ccb_info *ccb;
unsigned long flags;
u32 n_elem = 0;
@@ -502,8 +502,7 @@ int pm8001_queue_command(struct sas_task *task, gfp_t gfp_flags)
spin_lock_irqsave(&pm8001_ha->lock, flags);
- pm8001_dev = dev->lldd_dev;
- port = pm8001_ha->phy[pm8001_dev->attached_phy].port;
+ port = dev->port->lldd_port;
if (!internal_abort &&
(DEV_IS_GONE(pm8001_dev) || !port || !port->port_attached)) {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 246/563] scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 245/563] scsi: pm80xx: Restore support for expanders Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 247/563] scsi: libsas: Add dev_parent_is_expander() helper Greg Kroah-Hartman
` (330 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Igor Pylypiv, Niklas Cassel,
Damien Le Moal, Martin K. Petersen, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ]
Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when
device is gone") UBSAN reports:
UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17
index 28 is out of range for type 'pm8001_phy [16]'
on rmmod when using an expander.
For a direct attached device, attached_phy contains the local phy id.
For a device behind an expander, attached_phy contains the remote phy
id, not the local phy id.
I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a
device behind an expander, attached_phy can be much larger than
pm8001_ha->chip->n_phy (depending on the amount of phys of the
expander).
E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the
ports has an expander connected. The expander has 31 phys with phy ids
0-30.
The pm8001_ha->phy array only contains the phys of the HBA. It does not
contain the phys of the expander. Thus, it is wrong to use attached_phy
to index the pm8001_ha->phy array for a device behind an expander.
Thus, we can only clear phy_attached for devices that are directly
attached.
Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone")
Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Tested-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index 753c09363cbbc..3e1dac4b820fe 100644
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -749,6 +749,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
unsigned long flags = 0;
struct pm8001_hba_info *pm8001_ha;
struct pm8001_device *pm8001_dev = dev->lldd_dev;
+ struct domain_device *parent_dev = dev->parent;
pm8001_ha = pm8001_find_ha_by_dev(dev);
spin_lock_irqsave(&pm8001_ha->lock, flags);
@@ -765,7 +766,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
spin_lock_irqsave(&pm8001_ha->lock, flags);
}
PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id);
- pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
+
+ /*
+ * The phy array only contains local phys. Thus, we cannot clear
+ * phy_attached for a device behind an expander.
+ */
+ if (!(parent_dev && dev_is_expander(parent_dev->dev_type)))
+ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
pm8001_free_dev(pm8001_dev);
} else {
pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n");
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 247/563] scsi: libsas: Add dev_parent_is_expander() helper
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 246/563] scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 248/563] scsi: pm80xx: Use " Greg Kroah-Hartman
` (329 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Niklas Cassel,
John Garry, Jason Yan, Martin K. Petersen, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit e5eb72c92eb724aa14c50c7d92d1a576dd50d7e6 ]
Many libsas drivers check if the parent of the device is an expander.
Create a helper that the libsas drivers will use in follow up commits.
Suggested-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Link: https://lore.kernel.org/r/20250814173215.1765055-15-cassel@kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Jason Yan <yanaijie@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: ad70c6bc776b ("scsi: pm80xx: Fix pm8001_abort_task() for chip_8006 when using an expander")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/libsas/sas_expander.c | 5 +----
include/scsi/libsas.h | 8 ++++++++
2 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index 869b5d4db44cb..d953225f6cc24 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -1313,10 +1313,7 @@ static int sas_check_parent_topology(struct domain_device *child)
int i;
int res = 0;
- if (!child->parent)
- return 0;
-
- if (!dev_is_expander(child->parent->dev_type))
+ if (!dev_parent_is_expander(child))
return 0;
parent_ex = &child->parent->ex_dev;
diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h
index ba460b6c0374d..8d38565e99fa1 100644
--- a/include/scsi/libsas.h
+++ b/include/scsi/libsas.h
@@ -203,6 +203,14 @@ static inline bool dev_is_expander(enum sas_device_type type)
type == SAS_FANOUT_EXPANDER_DEVICE;
}
+static inline bool dev_parent_is_expander(struct domain_device *dev)
+{
+ if (!dev->parent)
+ return false;
+
+ return dev_is_expander(dev->parent->dev_type);
+}
+
static inline void INIT_SAS_WORK(struct sas_work *sw, void (*fn)(struct work_struct *))
{
INIT_WORK(&sw->work, fn);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 248/563] scsi: pm80xx: Use dev_parent_is_expander() helper
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 247/563] scsi: libsas: Add dev_parent_is_expander() helper Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 249/563] scsi: pm80xx: Add helper function to get the local phy id Greg Kroah-Hartman
` (328 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Cassel, Damien Le Moal,
John Garry, Igor Pylypiv, Jack Wang, Martin K. Petersen,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit 35e388696c3f3b6bf70e2010873c5e0c1d37d579 ]
Make use of the dev_parent_is_expander() helper.
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Link: https://lore.kernel.org/r/20250814173215.1765055-19-cassel@kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
Acked-by: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: ad70c6bc776b ("scsi: pm80xx: Fix pm8001_abort_task() for chip_8006 when using an expander")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/pm8001/pm8001_hwi.c | 8 +++-----
drivers/scsi/pm8001/pm8001_sas.c | 5 ++---
drivers/scsi/pm8001/pm80xx_hwi.c | 8 +++-----
3 files changed, 8 insertions(+), 13 deletions(-)
diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
index 42a4eeac24c94..fb4913547b00f 100644
--- a/drivers/scsi/pm8001/pm8001_hwi.c
+++ b/drivers/scsi/pm8001/pm8001_hwi.c
@@ -2163,8 +2163,7 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
/* Print sas address of IO failed device */
if ((status != IO_SUCCESS) && (status != IO_OVERFLOW) &&
(status != IO_UNDERFLOW)) {
- if (!((t->dev->parent) &&
- (dev_is_expander(t->dev->parent->dev_type)))) {
+ if (!dev_parent_is_expander(t->dev)) {
for (i = 0, j = 4; j <= 7 && i <= 3; i++, j++)
sata_addr_low[i] = pm8001_ha->sas_addr[j];
for (i = 0, j = 0; j <= 3 && i <= 3; i++, j++)
@@ -4168,7 +4167,6 @@ static int pm8001_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha,
u16 firstBurstSize = 0;
u16 ITNT = 2000;
struct domain_device *dev = pm8001_dev->sas_device;
- struct domain_device *parent_dev = dev->parent;
struct pm8001_port *port = dev->port->lldd_port;
memset(&payload, 0, sizeof(payload));
@@ -4186,8 +4184,8 @@ static int pm8001_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha,
dev_is_expander(pm8001_dev->dev_type))
stp_sspsmp_sata = 0x01; /*ssp or smp*/
}
- if (parent_dev && dev_is_expander(parent_dev->dev_type))
- phy_id = parent_dev->ex_dev.ex_phy->phy_id;
+ if (dev_parent_is_expander(dev))
+ phy_id = dev->parent->ex_dev.ex_phy->phy_id;
else
phy_id = pm8001_dev->attached_phy;
opc = OPC_INB_REG_DEV;
diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index 3e1dac4b820fe..2bdeace6c6bfe 100644
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -700,7 +700,7 @@ static int pm8001_dev_found_notify(struct domain_device *dev)
dev->lldd_dev = pm8001_device;
pm8001_device->dev_type = dev->dev_type;
pm8001_device->dcompletion = &completion;
- if (parent_dev && dev_is_expander(parent_dev->dev_type)) {
+ if (dev_parent_is_expander(dev)) {
int phy_id;
phy_id = sas_find_attached_phy_id(&parent_dev->ex_dev, dev);
@@ -749,7 +749,6 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
unsigned long flags = 0;
struct pm8001_hba_info *pm8001_ha;
struct pm8001_device *pm8001_dev = dev->lldd_dev;
- struct domain_device *parent_dev = dev->parent;
pm8001_ha = pm8001_find_ha_by_dev(dev);
spin_lock_irqsave(&pm8001_ha->lock, flags);
@@ -771,7 +770,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
* The phy array only contains local phys. Thus, we cannot clear
* phy_attached for a device behind an expander.
*/
- if (!(parent_dev && dev_is_expander(parent_dev->dev_type)))
+ if (!dev_parent_is_expander(dev))
pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
pm8001_free_dev(pm8001_dev);
} else {
diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
index c1bae995a4128..546d0d26f7a17 100644
--- a/drivers/scsi/pm8001/pm80xx_hwi.c
+++ b/drivers/scsi/pm8001/pm80xx_hwi.c
@@ -2340,8 +2340,7 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha,
/* Print sas address of IO failed device */
if ((status != IO_SUCCESS) && (status != IO_OVERFLOW) &&
(status != IO_UNDERFLOW)) {
- if (!((t->dev->parent) &&
- (dev_is_expander(t->dev->parent->dev_type)))) {
+ if (!dev_parent_is_expander(t->dev)) {
for (i = 0, j = 4; i <= 3 && j <= 7; i++, j++)
sata_addr_low[i] = pm8001_ha->sas_addr[j];
for (i = 0, j = 0; i <= 3 && j <= 3; i++, j++)
@@ -4780,7 +4779,6 @@ static int pm80xx_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha,
u16 firstBurstSize = 0;
u16 ITNT = 2000;
struct domain_device *dev = pm8001_dev->sas_device;
- struct domain_device *parent_dev = dev->parent;
struct pm8001_port *port = dev->port->lldd_port;
memset(&payload, 0, sizeof(payload));
@@ -4799,8 +4797,8 @@ static int pm80xx_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha,
dev_is_expander(pm8001_dev->dev_type))
stp_sspsmp_sata = 0x01; /*ssp or smp*/
}
- if (parent_dev && dev_is_expander(parent_dev->dev_type))
- phy_id = parent_dev->ex_dev.ex_phy->phy_id;
+ if (dev_parent_is_expander(dev))
+ phy_id = dev->parent->ex_dev.ex_phy->phy_id;
else
phy_id = pm8001_dev->attached_phy;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 249/563] scsi: pm80xx: Add helper function to get the local phy id
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 248/563] scsi: pm80xx: Use " Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 250/563] scsi: pm80xx: Fix pm8001_abort_task() for chip_8006 when using an expander Greg Kroah-Hartman
` (327 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Cassel, Damien Le Moal,
Martin K. Petersen, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit b4ec98303f9fc9b1da0053106716db6a7e002d8b ]
Avoid duplicated code by adding a helper to get the local phy id.
No functional changes intended.
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Link: https://lore.kernel.org/r/20250814173215.1765055-20-cassel@kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: ad70c6bc776b ("scsi: pm80xx: Fix pm8001_abort_task() for chip_8006 when using an expander")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/pm8001/pm8001_hwi.c | 7 +++----
drivers/scsi/pm8001/pm8001_sas.c | 10 ++++++++++
drivers/scsi/pm8001/pm8001_sas.h | 1 +
drivers/scsi/pm8001/pm80xx_hwi.c | 6 ++----
4 files changed, 16 insertions(+), 8 deletions(-)
diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
index fb4913547b00f..8005995a317c1 100644
--- a/drivers/scsi/pm8001/pm8001_hwi.c
+++ b/drivers/scsi/pm8001/pm8001_hwi.c
@@ -4184,10 +4184,9 @@ static int pm8001_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha,
dev_is_expander(pm8001_dev->dev_type))
stp_sspsmp_sata = 0x01; /*ssp or smp*/
}
- if (dev_parent_is_expander(dev))
- phy_id = dev->parent->ex_dev.ex_phy->phy_id;
- else
- phy_id = pm8001_dev->attached_phy;
+
+ phy_id = pm80xx_get_local_phy_id(dev);
+
opc = OPC_INB_REG_DEV;
linkrate = (pm8001_dev->sas_device->linkrate < dev->port->linkrate) ?
pm8001_dev->sas_device->linkrate : dev->port->linkrate;
diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index 2bdeace6c6bfe..5595913eb7fc1 100644
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -130,6 +130,16 @@ static void pm80xx_get_tag_opcodes(struct sas_task *task, int *ata_op,
}
}
+u32 pm80xx_get_local_phy_id(struct domain_device *dev)
+{
+ struct pm8001_device *pm8001_dev = dev->lldd_dev;
+
+ if (dev_parent_is_expander(dev))
+ return dev->parent->ex_dev.ex_phy->phy_id;
+
+ return pm8001_dev->attached_phy;
+}
+
void pm80xx_show_pending_commands(struct pm8001_hba_info *pm8001_ha,
struct pm8001_device *target_pm8001_dev)
{
diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
index 334485bb2c12d..91b2cdf3535cd 100644
--- a/drivers/scsi/pm8001/pm8001_sas.h
+++ b/drivers/scsi/pm8001/pm8001_sas.h
@@ -798,6 +798,7 @@ void pm8001_setds_completion(struct domain_device *dev);
void pm8001_tmf_aborted(struct sas_task *task);
void pm80xx_show_pending_commands(struct pm8001_hba_info *pm8001_ha,
struct pm8001_device *dev);
+u32 pm80xx_get_local_phy_id(struct domain_device *dev);
#endif
diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
index 546d0d26f7a17..31960b72c1e92 100644
--- a/drivers/scsi/pm8001/pm80xx_hwi.c
+++ b/drivers/scsi/pm8001/pm80xx_hwi.c
@@ -4797,10 +4797,8 @@ static int pm80xx_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha,
dev_is_expander(pm8001_dev->dev_type))
stp_sspsmp_sata = 0x01; /*ssp or smp*/
}
- if (dev_parent_is_expander(dev))
- phy_id = dev->parent->ex_dev.ex_phy->phy_id;
- else
- phy_id = pm8001_dev->attached_phy;
+
+ phy_id = pm80xx_get_local_phy_id(dev);
opc = OPC_INB_REG_DEV;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 250/563] scsi: pm80xx: Fix pm8001_abort_task() for chip_8006 when using an expander
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 249/563] scsi: pm80xx: Add helper function to get the local phy id Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 251/563] mptcp: Fix up subflows memcg when CONFIG_SOCK_CGROUP_DATA=n Greg Kroah-Hartman
` (326 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Igor Pylypiv, Niklas Cassel,
Damien Le Moal, Martin K. Petersen, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit ad70c6bc776b53e61c8db6533c833aff0ff5da8b ]
For a direct attached device, attached_phy contains the local phy id.
For a device behind an expander, attached_phy contains the remote phy
id, not the local phy id.
The pm8001_ha->phy array only contains the phys of the HBA. It does not
contain the phys of the expander.
Thus, you cannot use attached_phy to index the pm8001_ha->phy array,
without first verifying that the device is directly attached.
Use the pm80xx_get_local_phy_id() helper to make sure that we use the
local phy id to index the array, regardless if the device is directly
attached or not.
Fixes: 869ddbdcae3b ("scsi: pm80xx: corrected SATA abort handling sequence.")
Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Link: https://lore.kernel.org/r/20250814173215.1765055-21-cassel@kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/pm8001/pm8001_sas.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index 5595913eb7fc1..c5354263b45e8 100644
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -1063,7 +1063,7 @@ int pm8001_abort_task(struct sas_task *task)
struct pm8001_hba_info *pm8001_ha;
struct pm8001_device *pm8001_dev;
int rc = TMF_RESP_FUNC_FAILED, ret;
- u32 phy_id, port_id;
+ u32 port_id;
struct sas_task_slow slow_task;
if (!task->lldd_task || !task->dev)
@@ -1072,7 +1072,6 @@ int pm8001_abort_task(struct sas_task *task)
dev = task->dev;
pm8001_dev = dev->lldd_dev;
pm8001_ha = pm8001_find_ha_by_dev(dev);
- phy_id = pm8001_dev->attached_phy;
if (PM8001_CHIP_DISP->fatal_errors(pm8001_ha)) {
// If the controller is seeing fatal errors
@@ -1104,7 +1103,8 @@ int pm8001_abort_task(struct sas_task *task)
if (pm8001_ha->chip_id == chip_8006) {
DECLARE_COMPLETION_ONSTACK(completion_reset);
DECLARE_COMPLETION_ONSTACK(completion);
- struct pm8001_phy *phy = pm8001_ha->phy + phy_id;
+ u32 phy_id = pm80xx_get_local_phy_id(dev);
+ struct pm8001_phy *phy = &pm8001_ha->phy[phy_id];
port_id = phy->port->port_id;
/* 1. Set Device state as Recovery */
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 251/563] mptcp: Fix up subflows memcg when CONFIG_SOCK_CGROUP_DATA=n.
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 250/563] scsi: pm80xx: Fix pm8001_abort_task() for chip_8006 when using an expander Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 252/563] scsi: myrs: Fix dma_alloc_coherent() error check Greg Kroah-Hartman
` (325 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Eric Dumazet,
Matthieu Baerts (NGI0), Shakeel Butt, Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 68889dfd547bd8eabc5a98b58475d7b901cf5129 ]
When sk_alloc() allocates a socket, mem_cgroup_sk_alloc() sets
sk->sk_memcg based on the current task.
MPTCP subflow socket creation is triggered from userspace or
an in-kernel worker.
In the latter case, sk->sk_memcg is not what we want. So, we fix
it up from the parent socket's sk->sk_memcg in mptcp_attach_cgroup().
Although the code is placed under #ifdef CONFIG_MEMCG, it is buried
under #ifdef CONFIG_SOCK_CGROUP_DATA.
The two configs are orthogonal. If CONFIG_MEMCG is enabled without
CONFIG_SOCK_CGROUP_DATA, the subflow's memory usage is not charged
correctly.
Let's move the code out of the wrong ifdef guard.
Note that sk->sk_memcg is freed in sk_prot_free() and the parent
sk holds the refcnt of memcg->css here, so we don't need to use
css_tryget().
Fixes: 3764b0c5651e3 ("mptcp: attach subflow socket to parent cgroup")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Acked-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Link: https://patch.msgid.link/20250815201712.1745332-2-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/memcontrol.h | 6 ++++++
mm/memcontrol.c | 13 +++++++++++++
net/mptcp/subflow.c | 11 +++--------
3 files changed, 22 insertions(+), 8 deletions(-)
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 785173aa0739c..25921fbec6856 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -1604,6 +1604,7 @@ extern struct static_key_false memcg_sockets_enabled_key;
#define mem_cgroup_sockets_enabled static_branch_unlikely(&memcg_sockets_enabled_key)
void mem_cgroup_sk_alloc(struct sock *sk);
void mem_cgroup_sk_free(struct sock *sk);
+void mem_cgroup_sk_inherit(const struct sock *sk, struct sock *newsk);
#if BITS_PER_LONG < 64
static inline void mem_cgroup_set_socket_pressure(struct mem_cgroup *memcg)
@@ -1661,6 +1662,11 @@ void reparent_shrinker_deferred(struct mem_cgroup *memcg);
#define mem_cgroup_sockets_enabled 0
static inline void mem_cgroup_sk_alloc(struct sock *sk) { };
static inline void mem_cgroup_sk_free(struct sock *sk) { };
+
+static inline void mem_cgroup_sk_inherit(const struct sock *sk, struct sock *newsk)
+{
+}
+
static inline bool mem_cgroup_under_socket_pressure(struct mem_cgroup *memcg)
{
return false;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 8dd7fbed5a942..46713b9ece063 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5024,6 +5024,19 @@ void mem_cgroup_sk_free(struct sock *sk)
css_put(&sk->sk_memcg->css);
}
+void mem_cgroup_sk_inherit(const struct sock *sk, struct sock *newsk)
+{
+ if (sk->sk_memcg == newsk->sk_memcg)
+ return;
+
+ mem_cgroup_sk_free(newsk);
+
+ if (sk->sk_memcg)
+ css_get(&sk->sk_memcg->css);
+
+ newsk->sk_memcg = sk->sk_memcg;
+}
+
/**
* mem_cgroup_charge_skmem - charge socket memory
* @memcg: memcg to charge
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index f31a3a79531a2..e8325890a3223 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -1721,19 +1721,14 @@ static void mptcp_attach_cgroup(struct sock *parent, struct sock *child)
/* only the additional subflows created by kworkers have to be modified */
if (cgroup_id(sock_cgroup_ptr(parent_skcd)) !=
cgroup_id(sock_cgroup_ptr(child_skcd))) {
-#ifdef CONFIG_MEMCG
- struct mem_cgroup *memcg = parent->sk_memcg;
-
- mem_cgroup_sk_free(child);
- if (memcg && css_tryget(&memcg->css))
- child->sk_memcg = memcg;
-#endif /* CONFIG_MEMCG */
-
cgroup_sk_free(child_skcd);
*child_skcd = *parent_skcd;
cgroup_sk_clone(child_skcd);
}
#endif /* CONFIG_SOCK_CGROUP_DATA */
+
+ if (mem_cgroup_sockets_enabled)
+ mem_cgroup_sk_inherit(parent, child);
}
static void mptcp_subflow_ops_override(struct sock *ssk)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 252/563] scsi: myrs: Fix dma_alloc_coherent() error check
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 251/563] mptcp: Fix up subflows memcg when CONFIG_SOCK_CGROUP_DATA=n Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 253/563] f2fs: fix to clear unusable_cap for checkpoint=enable Greg Kroah-Hartman
` (324 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Fourier, Martin K. Petersen,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <fourier.thomas@gmail.com>
[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ]
Check for NULL return value with dma_alloc_coherent(), because DMA
address is not always set by dma_alloc_coherent() on failure.
Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)")
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Link: https://lore.kernel.org/r/20250725083112.43975-2-fourier.thomas@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/myrs.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c
index 95af3bb03834c..a58abd796603b 100644
--- a/drivers/scsi/myrs.c
+++ b/drivers/scsi/myrs.c
@@ -498,14 +498,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
/* Temporary dma mapping, used only in the scope of this function */
mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox),
&mbox_addr, GFP_KERNEL);
- if (dma_mapping_error(&pdev->dev, mbox_addr))
+ if (!mbox)
return false;
/* These are the base addresses for the command memory mailbox array */
cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox);
cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size,
&cs->cmd_mbox_addr, GFP_KERNEL);
- if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) {
+ if (!cmd_mbox) {
dev_err(&pdev->dev, "Failed to map command mailbox\n");
goto out_free;
}
@@ -520,7 +520,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox);
stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size,
&cs->stat_mbox_addr, GFP_KERNEL);
- if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) {
+ if (!stat_mbox) {
dev_err(&pdev->dev, "Failed to map status mailbox\n");
goto out_free;
}
@@ -533,7 +533,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
cs->fwstat_buf = dma_alloc_coherent(&pdev->dev,
sizeof(struct myrs_fwstat),
&cs->fwstat_addr, GFP_KERNEL);
- if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) {
+ if (!cs->fwstat_buf) {
dev_err(&pdev->dev, "Failed to map firmware health buffer\n");
cs->fwstat_buf = NULL;
goto out_free;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 253/563] f2fs: fix to clear unusable_cap for checkpoint=enable
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 252/563] scsi: myrs: Fix dma_alloc_coherent() error check Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 254/563] f2fs: fix to avoid NULL pointer dereference in f2fs_check_quota_consistency() Greg Kroah-Hartman
` (323 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chao Yu, Jaegeuk Kim, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit 2e8f4c2b2bb12fc3d40762f1bb778e95c6ddbc93 ]
mount -t f2fs -o checkpoint=disable:10% /dev/vdb /mnt/f2fs/
mount -t f2fs -o remount,checkpoint=enable /dev/vdb /mnt/f2fs/
kernel log:
F2FS-fs (vdb): Adjust unusable cap for checkpoint=disable = 204440 / 10%
If we has assigned checkpoint=enable mount option, unusable_cap{,_perc}
parameters of checkpoint=disable should be reset, then calculation and
log print could be avoid in adjust_unusable_cap_perc().
Fixes: 1ae18f71cb52 ("f2fs: fix checkpoint=disable:%u%%")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/super.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index e16c4e2830c29..9f2ae3ac6078e 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -988,6 +988,10 @@ static int f2fs_parse_param(struct fs_context *fc, struct fs_parameter *param)
ctx_set_opt(ctx, F2FS_MOUNT_DISABLE_CHECKPOINT);
break;
case Opt_checkpoint_enable:
+ F2FS_CTX_INFO(ctx).unusable_cap_perc = 0;
+ ctx->spec_mask |= F2FS_SPEC_checkpoint_disable_cap_perc;
+ F2FS_CTX_INFO(ctx).unusable_cap = 0;
+ ctx->spec_mask |= F2FS_SPEC_checkpoint_disable_cap;
ctx_clear_opt(ctx, F2FS_MOUNT_DISABLE_CHECKPOINT);
break;
default:
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 254/563] f2fs: fix to avoid NULL pointer dereference in f2fs_check_quota_consistency()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 253/563] f2fs: fix to clear unusable_cap for checkpoint=enable Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 255/563] f2fs: fix to allow removing qf_name Greg Kroah-Hartman
` (322 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+d371efea57d5aeab877b,
Hongbo Li, Chao Yu, Jaegeuk Kim, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit 930a9a6ee8e7ffa20af4bffbfc2bbd21d83bf81c ]
syzbot reported a f2fs bug as below:
Oops: gen[ 107.736417][ T5848] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 UID: 0 PID: 5848 Comm: syz-executor263 Tainted: G W 6.17.0-rc1-syzkaller-00014-g0e39a731820a #0 PREEMPT_{RT,(full)}
RIP: 0010:strcmp+0x3c/0xc0 lib/string.c:284
Call Trace:
<TASK>
f2fs_check_quota_consistency fs/f2fs/super.c:1188 [inline]
f2fs_check_opt_consistency+0x1378/0x2c10 fs/f2fs/super.c:1436
__f2fs_remount fs/f2fs/super.c:2653 [inline]
f2fs_reconfigure+0x482/0x1770 fs/f2fs/super.c:5297
reconfigure_super+0x224/0x890 fs/super.c:1077
do_remount fs/namespace.c:3314 [inline]
path_mount+0xd18/0xfe0 fs/namespace.c:4112
do_mount fs/namespace.c:4133 [inline]
__do_sys_mount fs/namespace.c:4344 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4321
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The direct reason is f2fs_check_quota_consistency() may suffer null-ptr-deref
issue in strcmp().
The bug can be reproduced w/ below scripts:
mkfs.f2fs -f /dev/vdb
mount -t f2fs -o usrquota /dev/vdb /mnt/f2fs
quotacheck -uc /mnt/f2fs/
umount /mnt/f2fs
mount -t f2fs -o usrjquota=aquota.user,jqfmt=vfsold /dev/vdb /mnt/f2fs
mount -t f2fs -o remount,usrjquota=,jqfmt=vfsold /dev/vdb /mnt/f2fs
umount /mnt/f2fs
So, before old_qname and new_qname comparison, we need to check whether
they are all valid pointers, fix it.
Reported-by: syzbot+d371efea57d5aeab877b@syzkaller.appspotmail.com
Fixes: d18535132523 ("f2fs: separate the options parsing and options checking")
Closes: https://lore.kernel.org/linux-f2fs-devel/689ff889.050a0220.e29e5.0037.GAE@google.com
Cc: Hongbo Li <lihongbo22@huawei.com>
Signed-off-by: Chao Yu <chao@kernel.org>
Reviewed-by: Hongbo Li <lihongbo22@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/super.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 9f2ae3ac6078e..bf0497187bdff 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -1189,7 +1189,8 @@ static int f2fs_check_quota_consistency(struct fs_context *fc,
goto err_jquota_change;
if (old_qname) {
- if (strcmp(old_qname, new_qname) == 0) {
+ if (new_qname &&
+ strcmp(old_qname, new_qname) == 0) {
ctx->qname_mask &= ~(1 << i);
continue;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 255/563] f2fs: fix to allow removing qf_name
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 254/563] f2fs: fix to avoid NULL pointer dereference in f2fs_check_quota_consistency() Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 256/563] drm/dp: drm_edp_backlight_set_level: do not always send 3-byte commands Greg Kroah-Hartman
` (321 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongbo Li, Chao Yu, Jaegeuk Kim,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit ff11d8701b77e303593fd86cf9ef74ef3ac4048e ]
The mount behavior changed after commit d18535132523 ("f2fs: separate the
options parsing and options checking"), let's fix it.
[Scripts]
mkfs.f2fs -f /dev/vdb
mount -t f2fs -o usrquota /dev/vdb /mnt/f2fs
quotacheck -uc /mnt/f2fs
umount /mnt/f2fs
mount -t f2fs -o usrjquota=aquota.user,jqfmt=vfsold /dev/vdb /mnt/f2fs
mount|grep f2fs
mount -t f2fs -o remount,usrjquota=,jqfmt=vfsold /dev/vdb /mnt/f2fs
mount|grep f2fs
dmesg
[Before commit]
mount#1: ...,quota,jqfmt=vfsold,usrjquota=aquota.user,...
mount#2: ...,quota,jqfmt=vfsold,...
kmsg: no output
[After commit]
mount#1: ...,quota,jqfmt=vfsold,usrjquota=aquota.user,...
mount#2: ...,quota,jqfmt=vfsold,usrjquota=aquota.user,...
kmsg: "user quota file already specified"
[After patch]
mount#1: ...,quota,jqfmt=vfsold,usrjquota=aquota.user,...
mount#2: ...,quota,jqfmt=vfsold,...
kmsg: "remove qf_name aquota.user"
Fixes: d18535132523 ("f2fs: separate the options parsing and options checking")
Cc: Hongbo Li <lihongbo22@huawei.com>
Signed-off-by: Chao Yu <chao@kernel.org>
Reviewed-by: Hongbo Li <lihongbo22@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/super.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index bf0497187bdff..8086a3456e4d3 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -1189,8 +1189,11 @@ static int f2fs_check_quota_consistency(struct fs_context *fc,
goto err_jquota_change;
if (old_qname) {
- if (new_qname &&
- strcmp(old_qname, new_qname) == 0) {
+ if (!new_qname) {
+ f2fs_info(sbi, "remove qf_name %s",
+ old_qname);
+ continue;
+ } else if (strcmp(old_qname, new_qname) == 0) {
ctx->qname_mask &= ~(1 << i);
continue;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 256/563] drm/dp: drm_edp_backlight_set_level: do not always send 3-byte commands
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 255/563] f2fs: fix to allow removing qf_name Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 257/563] crypto: octeontx2 - Call strscpy() with correct size argument Greg Kroah-Hartman
` (320 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Val Packett, Abel Vesa,
Suraj Kandpal, Dmitry Baryshkov, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Val Packett <val@packett.cool>
[ Upstream commit 4aa8961b1b9c7498550b41168a91cf1558133dd3 ]
At least some panels using the LSB register are not happy with the
unconditional increase of the command buffer to 3 bytes.
With the BOE NE14QDM in my Dell Latitude 7455, the recent patches for
luminance based brightness have introduced a regression: the brightness
range stopped being contiguous and became nonsensical (it probably was
interpreting the last 2 bytes of the buffer and not the first 2).
Change from using a fixed sizeof() to a length variable that's only
set to 3 when luminance is used. Let's leave the default as 2 even for
the single-byte version, since that's how it worked before.
Fixes: f2db78e37fe7 ("drm/dp: Modify drm_edp_backlight_set_level")
Signed-off-by: Val Packett <val@packett.cool>
Tested-by: Abel Vesa <abel.vesa@linaro.org>
Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
Link: https://lore.kernel.org/r/20250706204446.8918-1-val@packett.cool
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/display/drm_dp_helper.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/display/drm_dp_helper.c b/drivers/gpu/drm/display/drm_dp_helper.c
index 1ecc3df7e3167..4aaeae4fa03c3 100644
--- a/drivers/gpu/drm/display/drm_dp_helper.c
+++ b/drivers/gpu/drm/display/drm_dp_helper.c
@@ -3962,6 +3962,7 @@ int drm_edp_backlight_set_level(struct drm_dp_aux *aux, const struct drm_edp_bac
int ret;
unsigned int offset = DP_EDP_BACKLIGHT_BRIGHTNESS_MSB;
u8 buf[3] = { 0 };
+ size_t len = 2;
/* The panel uses the PWM for controlling brightness levels */
if (!(bl->aux_set || bl->luminance_set))
@@ -3974,6 +3975,7 @@ int drm_edp_backlight_set_level(struct drm_dp_aux *aux, const struct drm_edp_bac
buf[1] = (level & 0x00ff00) >> 8;
buf[2] = (level & 0xff0000) >> 16;
offset = DP_EDP_PANEL_TARGET_LUMINANCE_VALUE;
+ len = 3;
} else if (bl->lsb_reg_used) {
buf[0] = (level & 0xff00) >> 8;
buf[1] = (level & 0x00ff);
@@ -3981,7 +3983,7 @@ int drm_edp_backlight_set_level(struct drm_dp_aux *aux, const struct drm_edp_bac
buf[0] = level;
}
- ret = drm_dp_dpcd_write_data(aux, offset, buf, sizeof(buf));
+ ret = drm_dp_dpcd_write_data(aux, offset, buf, len);
if (ret < 0) {
drm_err(aux->drm_dev,
"%s: Failed to write aux backlight level: %d\n",
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 257/563] crypto: octeontx2 - Call strscpy() with correct size argument
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 256/563] drm/dp: drm_edp_backlight_set_level: do not always send 3-byte commands Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:41 ` [PATCH 6.17 258/563] drm: re-allow no-op changes on non-primary planes in async flips Greg Kroah-Hartman
` (319 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Herbert Xu,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
[ Upstream commit 361fa7f813e7056cecdb24f3582ab0ad4a088e4e ]
In otx2_cpt_dl_custom_egrp_create(), strscpy() is called with the length
of the source string rather than the size of the destination buffer.
This is fine as long as the destination buffer is larger than the source
string, but we should still use the destination buffer size instead to
call strscpy() as intended. And since 'tmp_buf' is a fixed-size buffer,
we can safely omit the size argument and let strscpy() infer it using
sizeof().
Fixes: d9d7749773e8 ("crypto: octeontx2 - add apis for custom engine groups")
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
index cc47e361089a0..ebdf4efa09d4d 100644
--- a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
+++ b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
@@ -1615,7 +1615,7 @@ int otx2_cpt_dl_custom_egrp_create(struct otx2_cptpf_dev *cptpf,
return -EINVAL;
}
err_msg = "Invalid engine group format";
- strscpy(tmp_buf, ctx->val.vstr, strlen(ctx->val.vstr) + 1);
+ strscpy(tmp_buf, ctx->val.vstr);
start = tmp_buf;
has_se = has_ie = has_ae = false;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 258/563] drm: re-allow no-op changes on non-primary planes in async flips
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 257/563] crypto: octeontx2 - Call strscpy() with correct size argument Greg Kroah-Hartman
@ 2025-10-13 14:41 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 259/563] media: rj54n1cb0c: Fix memleak in rj54n1_probe() Greg Kroah-Hartman
` (318 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xaver Hugl, André Almeida,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xaver Hugl <xaver.hugl@kde.org>
[ Upstream commit b065bd213caf6d35b57c5089d6507d7e8598a586 ]
Commit fd40a63c63a1 ("drm/atomic: Let drivers decide which planes to
async flip") unintentionally disallowed no-op changes on non-primary
planes that the driver doesn't allow async flips on. This broke async
flips for compositors that disable the cursor plane in every async
atomic commit. To fix that, change drm_atomic_set_property to again
only run atomic_async_check if the plane would actually be changed by
the atomic commit.
Fixes: fd40a63c63a1 ("drm/atomic: Let drivers decide which planes to async flip")
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4263
Signed-off-by: Xaver Hugl <xaver.hugl@kde.org>
Reviewed-by: André Almeida <andrealmeid@igalia.com>
Link: https://lore.kernel.org/r/20250822152849.87843-1-xaver.hugl@kde.org
[andrealmeid: fix checkpatch warning]
Signed-off-by: André Almeida <andrealmeid@igalia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_atomic_uapi.c | 23 ++++++++++++-----------
1 file changed, 12 insertions(+), 11 deletions(-)
diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c
index ecc73d52bfae4..85dbdaa4a2e25 100644
--- a/drivers/gpu/drm/drm_atomic_uapi.c
+++ b/drivers/gpu/drm/drm_atomic_uapi.c
@@ -1078,19 +1078,20 @@ int drm_atomic_set_property(struct drm_atomic_state *state,
}
if (async_flip) {
- /* check if the prop does a nop change */
- if ((prop != config->prop_fb_id &&
- prop != config->prop_in_fence_fd &&
- prop != config->prop_fb_damage_clips)) {
- ret = drm_atomic_plane_get_property(plane, plane_state,
- prop, &old_val);
- ret = drm_atomic_check_prop_changes(ret, old_val, prop_value, prop);
- }
+ /* no-op changes are always allowed */
+ ret = drm_atomic_plane_get_property(plane, plane_state,
+ prop, &old_val);
+ ret = drm_atomic_check_prop_changes(ret, old_val, prop_value, prop);
- /* ask the driver if this non-primary plane is supported */
- if (plane->type != DRM_PLANE_TYPE_PRIMARY) {
- ret = -EINVAL;
+ /* fail everything that isn't no-op or a pure flip */
+ if (ret && prop != config->prop_fb_id &&
+ prop != config->prop_in_fence_fd &&
+ prop != config->prop_fb_damage_clips) {
+ break;
+ }
+ if (ret && plane->type != DRM_PLANE_TYPE_PRIMARY) {
+ /* ask the driver if this non-primary plane is supported */
if (plane_funcs && plane_funcs->atomic_async_check)
ret = plane_funcs->atomic_async_check(plane, state, true);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 259/563] media: rj54n1cb0c: Fix memleak in rj54n1_probe()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2025-10-13 14:41 ` [PATCH 6.17 258/563] drm: re-allow no-op changes on non-primary planes in async flips Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 260/563] media: staging/ipu7: convert to use pci_alloc_irq_vectors() API Greg Kroah-Hartman
` (317 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Shurong, Jacopo Mondi,
Sakari Ailus, Hans Verkuil, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Shurong <zhang_shurong@foxmail.com>
[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ]
rj54n1_probe() won't clean all the allocated resources in fail
path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to
prevent memleak.
Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver")
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/rj54n1cb0c.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c
index b7ca39f63dba8..6dfc912168510 100644
--- a/drivers/media/i2c/rj54n1cb0c.c
+++ b/drivers/media/i2c/rj54n1cb0c.c
@@ -1329,10 +1329,13 @@ static int rj54n1_probe(struct i2c_client *client)
V4L2_CID_GAIN, 0, 127, 1, 66);
v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops,
V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1);
- rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
- if (rj54n1->hdl.error)
- return rj54n1->hdl.error;
+ if (rj54n1->hdl.error) {
+ ret = rj54n1->hdl.error;
+ goto err_free_ctrl;
+ }
+
+ rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
rj54n1->clk_div = clk_div;
rj54n1->rect.left = RJ54N1_COLUMN_SKIP;
rj54n1->rect.top = RJ54N1_ROW_SKIP;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 260/563] media: staging/ipu7: convert to use pci_alloc_irq_vectors() API
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 259/563] media: rj54n1cb0c: Fix memleak in rj54n1_probe() Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 261/563] media: staging/ipu7: Dont set name for IPU7 PCI device Greg Kroah-Hartman
` (316 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bingbu Cao, Sakari Ailus,
Hans Verkuil, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bingbu Cao <bingbu.cao@intel.com>
[ Upstream commit 283f7638c26c0f36e4ef5e147884e241b24fbebd ]
pci_enable_msi() is a deprecated API, thus switch to use modern
pci_alloc_irq_vectors().
Fixes: b7fe4c0019b1 ("media: staging/ipu7: add Intel IPU7 PCI device driver")
Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/ipu7/ipu7.c | 21 +++++++++------------
1 file changed, 9 insertions(+), 12 deletions(-)
diff --git a/drivers/staging/media/ipu7/ipu7.c b/drivers/staging/media/ipu7/ipu7.c
index 1b4f01db13ca2..a8e8b0e231989 100644
--- a/drivers/staging/media/ipu7/ipu7.c
+++ b/drivers/staging/media/ipu7/ipu7.c
@@ -2248,20 +2248,13 @@ void ipu7_dump_fw_error_log(const struct ipu7_bus_device *adev)
}
EXPORT_SYMBOL_NS_GPL(ipu7_dump_fw_error_log, "INTEL_IPU7");
-static int ipu7_pci_config_setup(struct pci_dev *dev)
+static void ipu7_pci_config_setup(struct pci_dev *dev)
{
u16 pci_command;
- int ret;
pci_read_config_word(dev, PCI_COMMAND, &pci_command);
pci_command |= PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER;
pci_write_config_word(dev, PCI_COMMAND, pci_command);
-
- ret = pci_enable_msi(dev);
- if (ret)
- dev_err(&dev->dev, "Failed to enable msi (%d)\n", ret);
-
- return ret;
}
static int ipu7_map_fw_code_region(struct ipu7_bus_device *sys,
@@ -2510,13 +2503,15 @@ static int ipu7_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
dma_set_max_seg_size(dev, UINT_MAX);
- ret = ipu7_pci_config_setup(pdev);
- if (ret)
- return ret;
+ ipu7_pci_config_setup(pdev);
+
+ ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_ALL_TYPES);
+ if (ret < 0)
+ return dev_err_probe(dev, ret, "Failed to alloc irq vector\n");
ret = ipu_buttress_init(isp);
if (ret)
- return ret;
+ goto pci_irq_free;
dev_info(dev, "firmware cpd file: %s\n", isp->cpd_fw_name);
@@ -2632,6 +2627,8 @@ static int ipu7_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
release_firmware(isp->cpd_fw);
buttress_exit:
ipu_buttress_exit(isp);
+pci_irq_free:
+ pci_free_irq_vectors(pdev);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 261/563] media: staging/ipu7: Dont set name for IPU7 PCI device
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 260/563] media: staging/ipu7: convert to use pci_alloc_irq_vectors() API Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 262/563] media: staging/ipu7: cleanup the MMU correctly in IPU7 driver release Greg Kroah-Hartman
` (315 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bingbu Cao, Sakari Ailus,
Hans Verkuil, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bingbu Cao <bingbu.cao@intel.com>
[ Upstream commit 8abb489f9aa181882ece7c24712ad39cbb9dab81 ]
Driver better not dev_set_name() to change the PCI device
name, so remove it.
Fixes: b7fe4c0019b1 ("media: staging/ipu7: add Intel IPU7 PCI device driver")
Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/ipu7/ipu7.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/staging/media/ipu7/ipu7.c b/drivers/staging/media/ipu7/ipu7.c
index a8e8b0e231989..aef931d235108 100644
--- a/drivers/staging/media/ipu7/ipu7.c
+++ b/drivers/staging/media/ipu7/ipu7.c
@@ -2428,7 +2428,6 @@ static int ipu7_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
if (!isp)
return -ENOMEM;
- dev_set_name(dev, "intel-ipu7");
isp->pdev = pdev;
INIT_LIST_HEAD(&isp->devices);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 262/563] media: staging/ipu7: cleanup the MMU correctly in IPU7 driver release
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 261/563] media: staging/ipu7: Dont set name for IPU7 PCI device Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 263/563] media: i2c: vd55g1: Fix duster register address Greg Kroah-Hartman
` (314 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bingbu Cao, Sakari Ailus,
Hans Verkuil, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bingbu Cao <bingbu.cao@intel.com>
[ Upstream commit 01a80b6649e69e4889b8521de022d3ee4bc5cb6f ]
IPU7 ISYS and PSYS auxiliary devices are released after
ipu7_bus_del_devices(), so driver can not reference the MMU devices
from ISYS and PSYS auxiliary devices, so move the MMUs cleanup before
releasing the auxiliary devices.
Fixes: b7fe4c0019b1 ("media: staging/ipu7: add Intel IPU7 PCI device driver")
Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
[Sakari Ailus: Drop extra newline.]
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/ipu7/ipu7.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/media/ipu7/ipu7.c b/drivers/staging/media/ipu7/ipu7.c
index aef931d235108..ee6b63717ed36 100644
--- a/drivers/staging/media/ipu7/ipu7.c
+++ b/drivers/staging/media/ipu7/ipu7.c
@@ -2644,6 +2644,9 @@ static void ipu7_pci_remove(struct pci_dev *pdev)
if (!IS_ERR_OR_NULL(isp->fw_code_region))
vfree(isp->fw_code_region);
+ ipu7_mmu_cleanup(isp->isys->mmu);
+ ipu7_mmu_cleanup(isp->psys->mmu);
+
ipu7_bus_del_devices(pdev);
pm_runtime_forbid(&pdev->dev);
@@ -2652,9 +2655,6 @@ static void ipu7_pci_remove(struct pci_dev *pdev)
ipu_buttress_exit(isp);
release_firmware(isp->cpd_fw);
-
- ipu7_mmu_cleanup(isp->psys->mmu);
- ipu7_mmu_cleanup(isp->isys->mmu);
}
static void ipu7_pci_reset_prepare(struct pci_dev *pdev)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 263/563] media: i2c: vd55g1: Fix duster register address
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 262/563] media: staging/ipu7: cleanup the MMU correctly in IPU7 driver release Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 264/563] drm/panel: Allow powering on panel follower after panel is enabled Greg Kroah-Hartman
` (313 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Mugnier, Sakari Ailus,
Hans Verkuil, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Mugnier <benjamin.mugnier@foss.st.com>
[ Upstream commit ba4b8886c22a3e8c3f41c6dd373b177d7d41bcf8 ]
The duster register needs to be disabled on test patterns. While the
code is correctly doing so, the register address contained a typo, thus
not disabling the duster correctly. Fix the typo.
Fixes: e56616d7b23c ("media: i2c: Add driver for ST VD55G1 camera sensor")
Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/vd55g1.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/vd55g1.c b/drivers/media/i2c/vd55g1.c
index 7c39183dd44bf..4a62d35006829 100644
--- a/drivers/media/i2c/vd55g1.c
+++ b/drivers/media/i2c/vd55g1.c
@@ -66,7 +66,7 @@
#define VD55G1_REG_READOUT_CTRL CCI_REG8(0x052e)
#define VD55G1_READOUT_CTRL_BIN_MODE_NORMAL 0
#define VD55G1_READOUT_CTRL_BIN_MODE_DIGITAL_X2 1
-#define VD55G1_REG_DUSTER_CTRL CCI_REG8(0x03ea)
+#define VD55G1_REG_DUSTER_CTRL CCI_REG8(0x03ae)
#define VD55G1_DUSTER_ENABLE BIT(0)
#define VD55G1_DUSTER_DISABLE 0
#define VD55G1_DUSTER_DYN_ENABLE BIT(1)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 264/563] drm/panel: Allow powering on panel follower after panel is enabled
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 263/563] media: i2c: vd55g1: Fix duster register address Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 265/563] HID: i2c-hid: Make elan touch controllers power on " Greg Kroah-Hartman
` (312 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pin-yen Lin, Douglas Anderson,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pin-yen Lin <treapking@chromium.org>
[ Upstream commit 2eb22214c132374e11e681c44d7879c91f67f614 ]
Some touch controllers have to be powered on after the panel's backlight
is enabled. To support these controllers, introduce .panel_enabled() and
.panel_disabling() to panel_follower_funcs and use them to power on the
device after the panel and its backlight are enabled.
Signed-off-by: Pin-yen Lin <treapking@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20250818115015.2909525-1-treapking@chromium.org
Stable-dep-of: cbdd16b818ee ("HID: i2c-hid: Make elan touch controllers power on after panel is enabled")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_panel.c | 73 +++++++++++++++++++++++++++++++------
include/drm/drm_panel.h | 14 +++++++
2 files changed, 76 insertions(+), 11 deletions(-)
diff --git a/drivers/gpu/drm/drm_panel.c b/drivers/gpu/drm/drm_panel.c
index c8bb28dccdc1b..d1e6598ea3bc0 100644
--- a/drivers/gpu/drm/drm_panel.c
+++ b/drivers/gpu/drm/drm_panel.c
@@ -134,6 +134,9 @@ void drm_panel_prepare(struct drm_panel *panel)
panel->prepared = true;
list_for_each_entry(follower, &panel->followers, list) {
+ if (!follower->funcs->panel_prepared)
+ continue;
+
ret = follower->funcs->panel_prepared(follower);
if (ret < 0)
dev_info(panel->dev, "%ps failed: %d\n",
@@ -179,6 +182,9 @@ void drm_panel_unprepare(struct drm_panel *panel)
mutex_lock(&panel->follower_lock);
list_for_each_entry(follower, &panel->followers, list) {
+ if (!follower->funcs->panel_unpreparing)
+ continue;
+
ret = follower->funcs->panel_unpreparing(follower);
if (ret < 0)
dev_info(panel->dev, "%ps failed: %d\n",
@@ -209,6 +215,7 @@ EXPORT_SYMBOL(drm_panel_unprepare);
*/
void drm_panel_enable(struct drm_panel *panel)
{
+ struct drm_panel_follower *follower;
int ret;
if (!panel)
@@ -219,10 +226,12 @@ void drm_panel_enable(struct drm_panel *panel)
return;
}
+ mutex_lock(&panel->follower_lock);
+
if (panel->funcs && panel->funcs->enable) {
ret = panel->funcs->enable(panel);
if (ret < 0)
- return;
+ goto exit;
}
panel->enabled = true;
@@ -230,6 +239,19 @@ void drm_panel_enable(struct drm_panel *panel)
if (ret < 0)
DRM_DEV_INFO(panel->dev, "failed to enable backlight: %d\n",
ret);
+
+ list_for_each_entry(follower, &panel->followers, list) {
+ if (!follower->funcs->panel_enabled)
+ continue;
+
+ ret = follower->funcs->panel_enabled(follower);
+ if (ret < 0)
+ dev_info(panel->dev, "%ps failed: %d\n",
+ follower->funcs->panel_enabled, ret);
+ }
+
+exit:
+ mutex_unlock(&panel->follower_lock);
}
EXPORT_SYMBOL(drm_panel_enable);
@@ -243,6 +265,7 @@ EXPORT_SYMBOL(drm_panel_enable);
*/
void drm_panel_disable(struct drm_panel *panel)
{
+ struct drm_panel_follower *follower;
int ret;
if (!panel)
@@ -262,6 +285,18 @@ void drm_panel_disable(struct drm_panel *panel)
return;
}
+ mutex_lock(&panel->follower_lock);
+
+ list_for_each_entry(follower, &panel->followers, list) {
+ if (!follower->funcs->panel_disabling)
+ continue;
+
+ ret = follower->funcs->panel_disabling(follower);
+ if (ret < 0)
+ dev_info(panel->dev, "%ps failed: %d\n",
+ follower->funcs->panel_disabling, ret);
+ }
+
ret = backlight_disable(panel->backlight);
if (ret < 0)
DRM_DEV_INFO(panel->dev, "failed to disable backlight: %d\n",
@@ -270,9 +305,12 @@ void drm_panel_disable(struct drm_panel *panel)
if (panel->funcs && panel->funcs->disable) {
ret = panel->funcs->disable(panel);
if (ret < 0)
- return;
+ goto exit;
}
panel->enabled = false;
+
+exit:
+ mutex_unlock(&panel->follower_lock);
}
EXPORT_SYMBOL(drm_panel_disable);
@@ -539,13 +577,13 @@ EXPORT_SYMBOL(drm_is_panel_follower);
* @follower_dev: The 'struct device' for the follower.
* @follower: The panel follower descriptor for the follower.
*
- * A panel follower is called right after preparing the panel and right before
- * unpreparing the panel. It's primary intention is to power on an associated
- * touchscreen, though it could be used for any similar devices. Multiple
- * devices are allowed the follow the same panel.
+ * A panel follower is called right after preparing/enabling the panel and right
+ * before unpreparing/disabling the panel. It's primary intention is to power on
+ * an associated touchscreen, though it could be used for any similar devices.
+ * Multiple devices are allowed the follow the same panel.
*
- * If a follower is added to a panel that's already been turned on, the
- * follower's prepare callback is called right away.
+ * If a follower is added to a panel that's already been prepared/enabled, the
+ * follower's prepared/enabled callback is called right away.
*
* The "panel" property of the follower points to the panel to be followed.
*
@@ -569,12 +607,18 @@ int drm_panel_add_follower(struct device *follower_dev,
mutex_lock(&panel->follower_lock);
list_add_tail(&follower->list, &panel->followers);
- if (panel->prepared) {
+ if (panel->prepared && follower->funcs->panel_prepared) {
ret = follower->funcs->panel_prepared(follower);
if (ret < 0)
dev_info(panel->dev, "%ps failed: %d\n",
follower->funcs->panel_prepared, ret);
}
+ if (panel->enabled && follower->funcs->panel_enabled) {
+ ret = follower->funcs->panel_enabled(follower);
+ if (ret < 0)
+ dev_info(panel->dev, "%ps failed: %d\n",
+ follower->funcs->panel_enabled, ret);
+ }
mutex_unlock(&panel->follower_lock);
@@ -587,7 +631,8 @@ EXPORT_SYMBOL(drm_panel_add_follower);
* @follower: The panel follower descriptor for the follower.
*
* Undo drm_panel_add_follower(). This includes calling the follower's
- * unprepare function if we're removed from a panel that's currently prepared.
+ * unpreparing/disabling function if we're removed from a panel that's currently
+ * prepared/enabled.
*
* Return: 0 or an error code.
*/
@@ -598,7 +643,13 @@ void drm_panel_remove_follower(struct drm_panel_follower *follower)
mutex_lock(&panel->follower_lock);
- if (panel->prepared) {
+ if (panel->enabled && follower->funcs->panel_disabling) {
+ ret = follower->funcs->panel_disabling(follower);
+ if (ret < 0)
+ dev_info(panel->dev, "%ps failed: %d\n",
+ follower->funcs->panel_disabling, ret);
+ }
+ if (panel->prepared && follower->funcs->panel_unpreparing) {
ret = follower->funcs->panel_unpreparing(follower);
if (ret < 0)
dev_info(panel->dev, "%ps failed: %d\n",
diff --git a/include/drm/drm_panel.h b/include/drm/drm_panel.h
index 843fb756a2950..2407bfa60236f 100644
--- a/include/drm/drm_panel.h
+++ b/include/drm/drm_panel.h
@@ -160,6 +160,20 @@ struct drm_panel_follower_funcs {
* Called before the panel is powered off.
*/
int (*panel_unpreparing)(struct drm_panel_follower *follower);
+
+ /**
+ * @panel_enabled:
+ *
+ * Called after the panel and the backlight have been enabled.
+ */
+ int (*panel_enabled)(struct drm_panel_follower *follower);
+
+ /**
+ * @panel_disabling:
+ *
+ * Called before the panel and the backlight are disabled.
+ */
+ int (*panel_disabling)(struct drm_panel_follower *follower);
};
struct drm_panel_follower {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 265/563] HID: i2c-hid: Make elan touch controllers power on after panel is enabled
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 264/563] drm/panel: Allow powering on panel follower after panel is enabled Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 266/563] RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count Greg Kroah-Hartman
` (311 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Douglas Anderson, Pin-yen Lin,
Jiri Kosina, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pin-yen Lin <treapking@chromium.org>
[ Upstream commit cbdd16b818eef876dd2de9d503fe7397a0666cbe ]
Introduce a new HID quirk to indicate that this device has to be enabled
after the panel's backlight is enabled, and update the driver data for
the elan devices to enable this quirk. This cannot be a I2C HID quirk
because the kernel needs to acknowledge this before powering up the
device and read the VID/PID. When this quirk is enabled, register
.panel_enabled()/.panel_disabling() instead for the panel follower.
Also rename the *panel_prepare* functions into *panel_follower* because
they could be called in other situations now.
Fixes: bd3cba00dcc63 ("HID: i2c-hid: elan: Add support for Elan eKTH6915 i2c-hid touchscreens")
Fixes: d06651bebf99e ("HID: i2c-hid: elan: Add elan-ekth6a12nay timing")
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Pin-yen Lin <treapking@chromium.org>
Acked-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20250818115015.2909525-2-treapking@chromium.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/i2c-hid/i2c-hid-core.c | 46 ++++++++++++++++-----------
drivers/hid/i2c-hid/i2c-hid-of-elan.c | 11 ++++++-
include/linux/hid.h | 2 ++
3 files changed, 40 insertions(+), 19 deletions(-)
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index d3912e3f2f13a..99ce6386176c6 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -112,9 +112,9 @@ struct i2c_hid {
struct i2chid_ops *ops;
struct drm_panel_follower panel_follower;
- struct work_struct panel_follower_prepare_work;
+ struct work_struct panel_follower_work;
bool is_panel_follower;
- bool prepare_work_finished;
+ bool panel_follower_work_finished;
};
static const struct i2c_hid_quirks {
@@ -1110,10 +1110,10 @@ static int i2c_hid_core_probe_panel_follower(struct i2c_hid *ihid)
return ret;
}
-static void ihid_core_panel_prepare_work(struct work_struct *work)
+static void ihid_core_panel_follower_work(struct work_struct *work)
{
struct i2c_hid *ihid = container_of(work, struct i2c_hid,
- panel_follower_prepare_work);
+ panel_follower_work);
struct hid_device *hid = ihid->hid;
int ret;
@@ -1130,7 +1130,7 @@ static void ihid_core_panel_prepare_work(struct work_struct *work)
if (ret)
dev_warn(&ihid->client->dev, "Power on failed: %d\n", ret);
else
- WRITE_ONCE(ihid->prepare_work_finished, true);
+ WRITE_ONCE(ihid->panel_follower_work_finished, true);
/*
* The work APIs provide a number of memory ordering guarantees
@@ -1139,12 +1139,12 @@ static void ihid_core_panel_prepare_work(struct work_struct *work)
* guarantee that a write that happened in the work is visible after
* cancel_work_sync(). We'll add a write memory barrier here to match
* with i2c_hid_core_panel_unpreparing() to ensure that our write to
- * prepare_work_finished is visible there.
+ * panel_follower_work_finished is visible there.
*/
smp_wmb();
}
-static int i2c_hid_core_panel_prepared(struct drm_panel_follower *follower)
+static int i2c_hid_core_panel_follower_resume(struct drm_panel_follower *follower)
{
struct i2c_hid *ihid = container_of(follower, struct i2c_hid, panel_follower);
@@ -1152,29 +1152,36 @@ static int i2c_hid_core_panel_prepared(struct drm_panel_follower *follower)
* Powering on a touchscreen can be a slow process. Queue the work to
* the system workqueue so we don't block the panel's power up.
*/
- WRITE_ONCE(ihid->prepare_work_finished, false);
- schedule_work(&ihid->panel_follower_prepare_work);
+ WRITE_ONCE(ihid->panel_follower_work_finished, false);
+ schedule_work(&ihid->panel_follower_work);
return 0;
}
-static int i2c_hid_core_panel_unpreparing(struct drm_panel_follower *follower)
+static int i2c_hid_core_panel_follower_suspend(struct drm_panel_follower *follower)
{
struct i2c_hid *ihid = container_of(follower, struct i2c_hid, panel_follower);
- cancel_work_sync(&ihid->panel_follower_prepare_work);
+ cancel_work_sync(&ihid->panel_follower_work);
- /* Match with ihid_core_panel_prepare_work() */
+ /* Match with ihid_core_panel_follower_work() */
smp_rmb();
- if (!READ_ONCE(ihid->prepare_work_finished))
+ if (!READ_ONCE(ihid->panel_follower_work_finished))
return 0;
return i2c_hid_core_suspend(ihid, true);
}
-static const struct drm_panel_follower_funcs i2c_hid_core_panel_follower_funcs = {
- .panel_prepared = i2c_hid_core_panel_prepared,
- .panel_unpreparing = i2c_hid_core_panel_unpreparing,
+static const struct drm_panel_follower_funcs
+ i2c_hid_core_panel_follower_prepare_funcs = {
+ .panel_prepared = i2c_hid_core_panel_follower_resume,
+ .panel_unpreparing = i2c_hid_core_panel_follower_suspend,
+};
+
+static const struct drm_panel_follower_funcs
+ i2c_hid_core_panel_follower_enable_funcs = {
+ .panel_enabled = i2c_hid_core_panel_follower_resume,
+ .panel_disabling = i2c_hid_core_panel_follower_suspend,
};
static int i2c_hid_core_register_panel_follower(struct i2c_hid *ihid)
@@ -1182,7 +1189,10 @@ static int i2c_hid_core_register_panel_follower(struct i2c_hid *ihid)
struct device *dev = &ihid->client->dev;
int ret;
- ihid->panel_follower.funcs = &i2c_hid_core_panel_follower_funcs;
+ if (ihid->hid->initial_quirks | HID_QUIRK_POWER_ON_AFTER_BACKLIGHT)
+ ihid->panel_follower.funcs = &i2c_hid_core_panel_follower_enable_funcs;
+ else
+ ihid->panel_follower.funcs = &i2c_hid_core_panel_follower_prepare_funcs;
/*
* If we're not in control of our own power up/power down then we can't
@@ -1237,7 +1247,7 @@ int i2c_hid_core_probe(struct i2c_client *client, struct i2chid_ops *ops,
init_waitqueue_head(&ihid->wait);
mutex_init(&ihid->cmd_lock);
mutex_init(&ihid->reset_lock);
- INIT_WORK(&ihid->panel_follower_prepare_work, ihid_core_panel_prepare_work);
+ INIT_WORK(&ihid->panel_follower_work, ihid_core_panel_follower_work);
/* we need to allocate the command buffer without knowing the maximum
* size of the reports. Let's use HID_MIN_BUFFER_SIZE, then we do the
diff --git a/drivers/hid/i2c-hid/i2c-hid-of-elan.c b/drivers/hid/i2c-hid/i2c-hid-of-elan.c
index 3fcff6daa0d3a..0215f217f6d86 100644
--- a/drivers/hid/i2c-hid/i2c-hid-of-elan.c
+++ b/drivers/hid/i2c-hid/i2c-hid-of-elan.c
@@ -8,6 +8,7 @@
#include <linux/delay.h>
#include <linux/device.h>
#include <linux/gpio/consumer.h>
+#include <linux/hid.h>
#include <linux/i2c.h>
#include <linux/kernel.h>
#include <linux/module.h>
@@ -23,6 +24,7 @@ struct elan_i2c_hid_chip_data {
unsigned int post_power_delay_ms;
u16 hid_descriptor_address;
const char *main_supply_name;
+ bool power_after_backlight;
};
struct i2c_hid_of_elan {
@@ -97,6 +99,7 @@ static int i2c_hid_of_elan_probe(struct i2c_client *client)
{
struct i2c_hid_of_elan *ihid_elan;
int ret;
+ u32 quirks = 0;
ihid_elan = devm_kzalloc(&client->dev, sizeof(*ihid_elan), GFP_KERNEL);
if (!ihid_elan)
@@ -131,8 +134,12 @@ static int i2c_hid_of_elan_probe(struct i2c_client *client)
}
}
+ if (ihid_elan->chip_data->power_after_backlight)
+ quirks = HID_QUIRK_POWER_ON_AFTER_BACKLIGHT;
+
ret = i2c_hid_core_probe(client, &ihid_elan->ops,
- ihid_elan->chip_data->hid_descriptor_address, 0);
+ ihid_elan->chip_data->hid_descriptor_address,
+ quirks);
if (ret)
goto err_deassert_reset;
@@ -150,6 +157,7 @@ static const struct elan_i2c_hid_chip_data elan_ekth6915_chip_data = {
.post_gpio_reset_on_delay_ms = 300,
.hid_descriptor_address = 0x0001,
.main_supply_name = "vcc33",
+ .power_after_backlight = true,
};
static const struct elan_i2c_hid_chip_data elan_ekth6a12nay_chip_data = {
@@ -157,6 +165,7 @@ static const struct elan_i2c_hid_chip_data elan_ekth6a12nay_chip_data = {
.post_gpio_reset_on_delay_ms = 300,
.hid_descriptor_address = 0x0001,
.main_supply_name = "vcc33",
+ .power_after_backlight = true,
};
static const struct elan_i2c_hid_chip_data ilitek_ili9882t_chip_data = {
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 2cc4f1e4ea963..c32425b5d0119 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -364,6 +364,7 @@ struct hid_item {
* | @HID_QUIRK_HAVE_SPECIAL_DRIVER:
* | @HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE:
* | @HID_QUIRK_IGNORE_SPECIAL_DRIVER
+ * | @HID_QUIRK_POWER_ON_AFTER_BACKLIGHT
* | @HID_QUIRK_FULLSPEED_INTERVAL:
* | @HID_QUIRK_NO_INIT_REPORTS:
* | @HID_QUIRK_NO_IGNORE:
@@ -391,6 +392,7 @@ struct hid_item {
#define HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE BIT(20)
#define HID_QUIRK_NOINVERT BIT(21)
#define HID_QUIRK_IGNORE_SPECIAL_DRIVER BIT(22)
+#define HID_QUIRK_POWER_ON_AFTER_BACKLIGHT BIT(23)
#define HID_QUIRK_FULLSPEED_INTERVAL BIT(28)
#define HID_QUIRK_NO_INIT_REPORTS BIT(29)
#define HID_QUIRK_NO_IGNORE BIT(30)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 266/563] RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 265/563] HID: i2c-hid: Make elan touch controllers power on " Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 267/563] RDMA/mlx5: Fix vport loopback forcing for MPV device Greg Kroah-Hartman
` (310 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuck Lever, Or Har-Toov,
Leon Romanovsky, Jason Gunthorpe, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Or Har-Toov <ohartoov@nvidia.com>
[ Upstream commit 1a7c18c485bf17ef408d5ebb7f83e1f8ef329585 ]
The mlx5 driver currently derives max_qp_wr directly from the
log_max_qp_sz HCA capability:
props->max_qp_wr = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
However, this value represents the number of WQEs in units of Basic
Blocks (see MLX5_SEND_WQE_BB), not actual number of WQEs. Since the size
of a WQE can vary depending on transport type and features (e.g., atomic
operations, UMR, LSO), the actual number of WQEs can be significantly
smaller than the WQEBB count suggests.
This patch introduces a conservative estimation of the worst-case WQE size
— considering largest segments possible with 1 SGE and no inline data or
special features. It uses this to derive a more accurate max_qp_wr value.
Fixes: 938fe83c8dcb ("net/mlx5_core: New device capabilities handling")
Link: https://patch.msgid.link/r/7d992c9831c997ed5c33d30973406dc2dcaf5e89.1755088725.git.leon@kernel.org
Reported-by: Chuck Lever <cel@kernel.org>
Closes: https://lore.kernel.org/all/20250506142202.GJ2260621@ziepe.ca/
Signed-off-by: Or Har-Toov <ohartoov@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/main.c | 48 ++++++++++++++++++++++++++++++-
1 file changed, 47 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index d456e4fde3e1f..20d15207a5f1f 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -13,6 +13,7 @@
#include <linux/dma-mapping.h>
#include <linux/slab.h>
#include <linux/bitmap.h>
+#include <linux/log2.h>
#include <linux/sched.h>
#include <linux/sched/mm.h>
#include <linux/sched/task.h>
@@ -883,6 +884,51 @@ static void fill_esw_mgr_reg_c0(struct mlx5_core_dev *mdev,
resp->reg_c0.mask = mlx5_eswitch_get_vport_metadata_mask();
}
+/*
+ * Calculate maximum SQ overhead across all QP types.
+ * Other QP types (REG_UMR, UC, RC, UD/SMI/GSI, XRC_TGT)
+ * have smaller overhead than the types calculated below,
+ * so they are implicitly included.
+ */
+static u32 mlx5_ib_calc_max_sq_overhead(void)
+{
+ u32 max_overhead_xrc, overhead_ud_lso, a, b;
+
+ /* XRC_INI */
+ max_overhead_xrc = sizeof(struct mlx5_wqe_xrc_seg);
+ max_overhead_xrc += sizeof(struct mlx5_wqe_ctrl_seg);
+ a = sizeof(struct mlx5_wqe_atomic_seg) +
+ sizeof(struct mlx5_wqe_raddr_seg);
+ b = sizeof(struct mlx5_wqe_umr_ctrl_seg) +
+ sizeof(struct mlx5_mkey_seg) +
+ MLX5_IB_SQ_UMR_INLINE_THRESHOLD / MLX5_IB_UMR_OCTOWORD;
+ max_overhead_xrc += max(a, b);
+
+ /* UD with LSO */
+ overhead_ud_lso = sizeof(struct mlx5_wqe_ctrl_seg);
+ overhead_ud_lso += sizeof(struct mlx5_wqe_eth_pad);
+ overhead_ud_lso += sizeof(struct mlx5_wqe_eth_seg);
+ overhead_ud_lso += sizeof(struct mlx5_wqe_datagram_seg);
+
+ return max(max_overhead_xrc, overhead_ud_lso);
+}
+
+static u32 mlx5_ib_calc_max_qp_wr(struct mlx5_ib_dev *dev)
+{
+ struct mlx5_core_dev *mdev = dev->mdev;
+ u32 max_wqe_bb_units = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
+ u32 max_wqe_size;
+ /* max QP overhead + 1 SGE, no inline, no special features */
+ max_wqe_size = mlx5_ib_calc_max_sq_overhead() +
+ sizeof(struct mlx5_wqe_data_seg);
+
+ max_wqe_size = roundup_pow_of_two(max_wqe_size);
+
+ max_wqe_size = ALIGN(max_wqe_size, MLX5_SEND_WQE_BB);
+
+ return (max_wqe_bb_units * MLX5_SEND_WQE_BB) / max_wqe_size;
+}
+
static int mlx5_ib_query_device(struct ib_device *ibdev,
struct ib_device_attr *props,
struct ib_udata *uhw)
@@ -1041,7 +1087,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
props->max_mr_size = ~0ull;
props->page_size_cap = ~(min_page_size - 1);
props->max_qp = 1 << MLX5_CAP_GEN(mdev, log_max_qp);
- props->max_qp_wr = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
+ props->max_qp_wr = mlx5_ib_calc_max_qp_wr(dev);
max_rq_sg = MLX5_CAP_GEN(mdev, max_wqe_sz_rq) /
sizeof(struct mlx5_wqe_data_seg);
max_sq_desc = min_t(int, MLX5_CAP_GEN(mdev, max_wqe_sz_sq), 512);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 267/563] RDMA/mlx5: Fix vport loopback forcing for MPV device
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 266/563] RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 268/563] wifi: rtw88: Use led->brightness_set_blocking for PCI too Greg Kroah-Hartman
` (309 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Patrisious Haddad, Mark Bloch,
Leon Romanovsky, Jason Gunthorpe, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <phaddad@nvidia.com>
[ Upstream commit 08aae7860450c89eebbc6fd4d38416e53c7a33d2 ]
Previously loopback for MPV was supposed to be permanently enabled,
however other driver flows were able to over-ride that configuration and
disable it.
Add force_lb parameter that indicates that loopback should always be
enabled which prevents all other driver flows from disabling it.
Fixes: a9a9e68954f2 ("RDMA/mlx5: Fix vport loopback for MPV device")
Link: https://patch.msgid.link/r/cfc6b1f0f99f8100b087483cc14da6025317f901.1755088808.git.leon@kernel.org
Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/main.c | 19 +++++++++++++++----
drivers/infiniband/hw/mlx5/mlx5_ib.h | 1 +
2 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 20d15207a5f1f..5fabd39b7492a 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1839,7 +1839,8 @@ static void deallocate_uars(struct mlx5_ib_dev *dev,
}
static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
- struct mlx5_core_dev *slave)
+ struct mlx5_core_dev *slave,
+ struct mlx5_ib_lb_state *lb_state)
{
int err;
@@ -1851,6 +1852,7 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
if (err)
goto out;
+ lb_state->force_enable = true;
return 0;
out:
@@ -1859,16 +1861,22 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
}
static void mlx5_ib_disable_lb_mp(struct mlx5_core_dev *master,
- struct mlx5_core_dev *slave)
+ struct mlx5_core_dev *slave,
+ struct mlx5_ib_lb_state *lb_state)
{
mlx5_nic_vport_update_local_lb(slave, false);
mlx5_nic_vport_update_local_lb(master, false);
+
+ lb_state->force_enable = false;
}
int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
{
int err = 0;
+ if (dev->lb.force_enable)
+ return 0;
+
mutex_lock(&dev->lb.mutex);
if (td)
dev->lb.user_td++;
@@ -1890,6 +1898,9 @@ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
void mlx5_ib_disable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
{
+ if (dev->lb.force_enable)
+ return;
+
mutex_lock(&dev->lb.mutex);
if (td)
dev->lb.user_td--;
@@ -3569,7 +3580,7 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev,
lockdep_assert_held(&mlx5_ib_multiport_mutex);
- mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev);
+ mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb);
mlx5_core_mp_event_replay(ibdev->mdev,
MLX5_DRIVER_EVENT_AFFILIATION_REMOVED,
@@ -3666,7 +3677,7 @@ static bool mlx5_ib_bind_slave_port(struct mlx5_ib_dev *ibdev,
MLX5_DRIVER_EVENT_AFFILIATION_DONE,
&key);
- err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev);
+ err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb);
if (err)
goto unbind;
diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index 7ffc7ee92cf03..8d21ecf8a996f 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -1109,6 +1109,7 @@ struct mlx5_ib_lb_state {
u32 user_td;
int qps;
bool enabled;
+ bool force_enable;
};
struct mlx5_ib_pf_eq {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 268/563] wifi: rtw88: Use led->brightness_set_blocking for PCI too
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 267/563] RDMA/mlx5: Fix vport loopback forcing for MPV device Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 269/563] net: phy: introduce phy_id_compare_vendor() PHY ID helper Greg Kroah-Hartman
` (308 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bitterblue Smith, Ping-Ke Shih,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
[ Upstream commit fce6fee0817b8899e0ee38ab6b98f0d7e939ceed ]
Commit 26a8bf978ae9 ("wifi: rtw88: Lock rtwdev->mutex before setting
the LED") made rtw_led_set() sleep, but that's not allowed. Fix it by
using the brightness_set_blocking member of struct led_classdev for
PCI devices too. This one is allowed to sleep.
bad: scheduling from the idle thread!
nix kernel: CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Tainted: G W O 6.16.0 #1-NixOS PREEMPT(voluntary)
nix kernel: Tainted: [W]=WARN, [O]=OOT_MODULE
nix kernel: Hardware name: [REDACTED]
nix kernel: Call Trace:
nix kernel: <IRQ>
nix kernel: dump_stack_lvl+0x63/0x90
nix kernel: dequeue_task_idle+0x2d/0x50
nix kernel: __schedule+0x191/0x1310
nix kernel: ? xas_load+0x11/0xd0
nix kernel: schedule+0x2b/0xe0
nix kernel: schedule_preempt_disabled+0x19/0x30
nix kernel: __mutex_lock.constprop.0+0x3fd/0x7d0
nix kernel: rtw_led_set+0x27/0x60 [rtw_core]
nix kernel: led_blink_set_nosleep+0x56/0xb0
nix kernel: led_trigger_blink+0x49/0x80
nix kernel: ? __pfx_tpt_trig_timer+0x10/0x10 [mac80211]
nix kernel: call_timer_fn+0x2f/0x140
nix kernel: ? __pfx_tpt_trig_timer+0x10/0x10 [mac80211]
nix kernel: __run_timers+0x21a/0x2b0
nix kernel: run_timer_softirq+0x8e/0x100
nix kernel: handle_softirqs+0xea/0x2c0
nix kernel: ? srso_alias_return_thunk+0x5/0xfbef5
nix kernel: __irq_exit_rcu+0xdc/0x100
nix kernel: sysvec_apic_timer_interrupt+0x7c/0x90
nix kernel: </IRQ>
nix kernel: <TASK>
nix kernel: asm_sysvec_apic_timer_interrupt+0x1a/0x20
nix kernel: RIP: 0010:cpuidle_enter_state+0xcc/0x450
nix kernel: Code: 00 e8 08 7c 2e ff e8 d3 ee ff ff 49 89 c6 0f 1f 44 00 00 31 ff e8 c4 d1 2c ff 80 7d d7 00 0f 85 5d 02 00 00 fb 0f 1f 44 00 00 <45> 85 ff 0f 88 a0 01 00 00 49 63 f7 4c 89 f2 48 8d 0>
nix kernel: RSP: 0018:ffffd579801c7e68 EFLAGS: 00000246
nix kernel: RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
nix kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
nix kernel: RBP: ffffd579801c7ea0 R08: 0000000000000000 R09: 0000000000000000
nix kernel: R10: 0000000000000000 R11: 0000000000000000 R12: ffff8eab0462a400
nix kernel: R13: ffffffff9a7d7a20 R14: 00000003aebe751d R15: 0000000000000003
nix kernel: ? cpuidle_enter_state+0xbc/0x450
nix kernel: cpuidle_enter+0x32/0x50
nix kernel: do_idle+0x1b1/0x210
nix kernel: cpu_startup_entry+0x2d/0x30
nix kernel: start_secondary+0x118/0x140
nix kernel: common_startup_64+0x13e/0x141
nix kernel: </TASK>
Fixes: 26a8bf978ae9 ("wifi: rtw88: Lock rtwdev->mutex before setting the LED")
Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/ad8a49ef-4f2d-4a61-8292-952db9c4eb65@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw88/led.c | 15 +++------------
1 file changed, 3 insertions(+), 12 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw88/led.c b/drivers/net/wireless/realtek/rtw88/led.c
index 7f9ace351a5b7..4cc62e49d1679 100644
--- a/drivers/net/wireless/realtek/rtw88/led.c
+++ b/drivers/net/wireless/realtek/rtw88/led.c
@@ -6,8 +6,8 @@
#include "debug.h"
#include "led.h"
-static void rtw_led_set(struct led_classdev *led,
- enum led_brightness brightness)
+static int rtw_led_set(struct led_classdev *led,
+ enum led_brightness brightness)
{
struct rtw_dev *rtwdev = container_of(led, struct rtw_dev, led_cdev);
@@ -16,12 +16,6 @@ static void rtw_led_set(struct led_classdev *led,
rtwdev->chip->ops->led_set(led, brightness);
mutex_unlock(&rtwdev->mutex);
-}
-
-static int rtw_led_set_blocking(struct led_classdev *led,
- enum led_brightness brightness)
-{
- rtw_led_set(led, brightness);
return 0;
}
@@ -46,10 +40,7 @@ void rtw_led_init(struct rtw_dev *rtwdev)
if (!rtwdev->chip->ops->led_set)
return;
- if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_PCIE)
- led->brightness_set = rtw_led_set;
- else
- led->brightness_set_blocking = rtw_led_set_blocking;
+ led->brightness_set_blocking = rtw_led_set;
snprintf(rtwdev->led_name, sizeof(rtwdev->led_name),
"rtw88-%s", dev_name(rtwdev->dev));
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 269/563] net: phy: introduce phy_id_compare_vendor() PHY ID helper
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 268/563] wifi: rtw88: Use led->brightness_set_blocking for PCI too Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 270/563] net: phy: as21xxx: better handle PHY HW reset on soft-reboot Greg Kroah-Hartman
` (307 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Marangi, Andrew Lunn,
Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Marangi <ansuelsmth@gmail.com>
[ Upstream commit 1abe21ef1adf0c5b6dbb5878c2fa4573df8d29fc ]
Introduce phy_id_compare_vendor() PHY ID helper to compare a PHY ID with
the PHY ID Vendor using the generic PHY ID Vendor mask.
While at it also rework the PHY_ID_MATCH macro and move the mask to
dedicated define so that PHY driver can make use of the mask if needed.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20250823134431.4854-1-ansuelsmth@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: b4d5cd20507b ("net: phy: as21xxx: better handle PHY HW reset on soft-reboot")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/phy.h | 23 ++++++++++++++++++++---
1 file changed, 20 insertions(+), 3 deletions(-)
diff --git a/include/linux/phy.h b/include/linux/phy.h
index bb45787d86848..04553419adc3f 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -1273,9 +1273,13 @@ struct phy_driver {
#define to_phy_driver(d) container_of_const(to_mdio_common_driver(d), \
struct phy_driver, mdiodrv)
-#define PHY_ID_MATCH_EXACT(id) .phy_id = (id), .phy_id_mask = GENMASK(31, 0)
-#define PHY_ID_MATCH_MODEL(id) .phy_id = (id), .phy_id_mask = GENMASK(31, 4)
-#define PHY_ID_MATCH_VENDOR(id) .phy_id = (id), .phy_id_mask = GENMASK(31, 10)
+#define PHY_ID_MATCH_EXTACT_MASK GENMASK(31, 0)
+#define PHY_ID_MATCH_MODEL_MASK GENMASK(31, 4)
+#define PHY_ID_MATCH_VENDOR_MASK GENMASK(31, 10)
+
+#define PHY_ID_MATCH_EXACT(id) .phy_id = (id), .phy_id_mask = PHY_ID_MATCH_EXTACT_MASK
+#define PHY_ID_MATCH_MODEL(id) .phy_id = (id), .phy_id_mask = PHY_ID_MATCH_MODEL_MASK
+#define PHY_ID_MATCH_VENDOR(id) .phy_id = (id), .phy_id_mask = PHY_ID_MATCH_VENDOR_MASK
/**
* phy_id_compare - compare @id1 with @id2 taking account of @mask
@@ -1291,6 +1295,19 @@ static inline bool phy_id_compare(u32 id1, u32 id2, u32 mask)
return !((id1 ^ id2) & mask);
}
+/**
+ * phy_id_compare_vendor - compare @id with @vendor mask
+ * @id: PHY ID
+ * @vendor_mask: PHY Vendor mask
+ *
+ * Return: true if the bits from @id match @vendor using the
+ * generic PHY Vendor mask.
+ */
+static inline bool phy_id_compare_vendor(u32 id, u32 vendor_mask)
+{
+ return phy_id_compare(id, vendor_mask, PHY_ID_MATCH_VENDOR_MASK);
+}
+
/**
* phydev_id_compare - compare @id with the PHY's Clause 22 ID
* @phydev: the PHY device
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 270/563] net: phy: as21xxx: better handle PHY HW reset on soft-reboot
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 269/563] net: phy: introduce phy_id_compare_vendor() PHY ID helper Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 271/563] PCI: rcar-host: Pass proper IRQ domain to generic_handle_domain_irq() Greg Kroah-Hartman
` (306 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Marangi, Jakub Kicinski,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Marangi <ansuelsmth@gmail.com>
[ Upstream commit b4d5cd20507b252c746fa6971d82ac96f3b3e5b7 ]
On soft-reboot, with a reset GPIO defined for an Aeonsemi PHY, the
special match_phy_device fails to correctly identify that the PHY
needs to load the firmware again.
This is caused by the fact that PHY ID is read BEFORE the PHY reset
GPIO (if present) is asserted, so we can be in the scenario where the
phydev have the previous PHY ID (with the PHY firmware loaded) but
after reset the generic AS21xxx PHY is present in the PHY ID registers.
To better handle this, skip reading the PHY ID register only for the PHY
that are not AS21xxx (by matching for the Aeonsemi Vendor) and always
read the PHY ID for the other case to handle both firmware already
loaded or an HW reset.
Fixes: 830877d89edc ("net: phy: Add support for Aeonsemi AS21xxx PHYs")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Link: https://patch.msgid.link/20250823134431.4854-2-ansuelsmth@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/as21xxx.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/net/phy/as21xxx.c b/drivers/net/phy/as21xxx.c
index 92697f43087dc..0052773606562 100644
--- a/drivers/net/phy/as21xxx.c
+++ b/drivers/net/phy/as21xxx.c
@@ -884,11 +884,12 @@ static int as21xxx_match_phy_device(struct phy_device *phydev,
u32 phy_id;
int ret;
- /* Skip PHY that are not AS21xxx or already have firmware loaded */
- if (phydev->c45_ids.device_ids[MDIO_MMD_PCS] != PHY_ID_AS21XXX)
+ /* Skip PHY that are not AS21xxx */
+ if (!phy_id_compare_vendor(phydev->c45_ids.device_ids[MDIO_MMD_PCS],
+ PHY_VENDOR_AEONSEMI))
return genphy_match_phy_device(phydev, phydrv);
- /* Read PHY ID to handle firmware just loaded */
+ /* Read PHY ID to handle firmware loaded or HW reset */
ret = phy_read_mmd(phydev, MDIO_MMD_PCS, MII_PHYSID1);
if (ret < 0)
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 271/563] PCI: rcar-host: Pass proper IRQ domain to generic_handle_domain_irq()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (269 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 270/563] net: phy: as21xxx: better handle PHY HW reset on soft-reboot Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 272/563] fuse: remove unneeded offset assignment when filling write pages Greg Kroah-Hartman
` (305 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea,
Manivannan Sadhasivam, Nam Cao, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
[ Upstream commit d3fee10e40a938331e2aae34348691136db31304 ]
Starting with commit dd26c1a23fd5 ("PCI: rcar-host: Switch to
msi_create_parent_irq_domain()"), the MSI parent IRQ domain is NULL because
the object of type struct irq_domain_info passed to:
msi_create_parent_irq_domain() ->
irq_domain_instantiate()() ->
__irq_domain_instantiate()
has no reference to the parent IRQ domain. Using msi->domain->parent as an
argument for generic_handle_domain_irq() leads to below error:
"Unable to handle kernel NULL pointer dereference at virtual address"
This error was identified while switching the upcoming RZ/G3S PCIe host
controller driver to msi_create_parent_irq_domain() (which was using a
similar pattern to handle MSIs (see link section)), but it was not tested
on hardware using the pcie-rcar-host controller driver due to lack of
hardware.
Fixes: dd26c1a23fd5 ("PCI: rcar-host: Switch to msi_create_parent_irq_domain()")
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
[mani: reworded subject and description]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Nam Cao <namcao@linutronix.de>
Link: https://lore.kernel.org/all/20250704161410.3931884-6-claudiu.beznea.uj@bp.renesas.com
Link: https://patch.msgid.link/20250809144447.3939284-1-claudiu.beznea.uj@bp.renesas.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-rcar-host.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/controller/pcie-rcar-host.c b/drivers/pci/controller/pcie-rcar-host.c
index fe288fd770c49..4780e0109e583 100644
--- a/drivers/pci/controller/pcie-rcar-host.c
+++ b/drivers/pci/controller/pcie-rcar-host.c
@@ -584,7 +584,7 @@ static irqreturn_t rcar_pcie_msi_irq(int irq, void *data)
unsigned int index = find_first_bit(®, 32);
int ret;
- ret = generic_handle_domain_irq(msi->domain->parent, index);
+ ret = generic_handle_domain_irq(msi->domain, index);
if (ret) {
/* Unknown MSI, just clear it */
dev_dbg(dev, "unexpected MSI\n");
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 272/563] fuse: remove unneeded offset assignment when filling write pages
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (270 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 271/563] PCI: rcar-host: Pass proper IRQ domain to generic_handle_domain_irq() Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 273/563] PCI: qcom: Restrict port parsing only to PCIe bridge child nodes Greg Kroah-Hartman
` (304 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joanne Koong, Miklos Szeredi,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joanne Koong <joannelkoong@gmail.com>
[ Upstream commit 6fd26f50857698c6f07a9e6b149247925fadb8fd ]
With the change in aee03ea7ff98 ("fuse: support large folios for
writethrough writes"), this old line for setting ap->descs[0].offset is
now obsolete and unneeded. This should have been removed as part of
aee03ea7ff98.
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Fixes: aee03ea7ff98 ("fuse: support large folios for writethrough writes")
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fuse/file.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 4adcf09d4b01a..c7351ca070652 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1175,7 +1175,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_io_args *ia,
num = min(iov_iter_count(ii), fc->max_write);
ap->args.in_pages = true;
- ap->descs[0].offset = offset;
while (num && ap->num_folios < max_folios) {
size_t tmp;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 273/563] PCI: qcom: Restrict port parsing only to PCIe bridge child nodes
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (271 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 272/563] fuse: remove unneeded offset assignment when filling write pages Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 274/563] cdx: dont select CONFIG_GENERIC_MSI_IRQ Greg Kroah-Hartman
` (303 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krishna Chaitanya Chundru,
Manivannan Sadhasivam, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
[ Upstream commit 45df22935bdc6bbddf87f38a57ae7257244cf3cf ]
The qcom_pcie_parse_ports() function currently iterates over all available
child nodes of the PCIe controller's device tree node. This includes
unrelated nodes such as OPP (Operating Performance Points) nodes, which do
not contain the expected 'reset' and 'phy' properties. As a result, parsing
fails and the driver falls back to the legacy method of parsing the
controller node directly. However, this fallback also fails when properties
are shifted to the Root Port node, leading to probe failure.
Fix this by restricting the parsing logic to only consider child nodes with
device_type = "pci", which is the expected and required property for PCIe
bridge nodes as per the pci-bus-common.yaml dtschema.
Fixes: a2fbecdbbb9d ("PCI: qcom: Add support for parsing the new Root Port binding")
Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
[mani: reworded subject and description]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20250826-pakala-v3-3-721627bd5bb0@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-qcom.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
index 294babe1816e4..fbed7130d7475 100644
--- a/drivers/pci/controller/dwc/pcie-qcom.c
+++ b/drivers/pci/controller/dwc/pcie-qcom.c
@@ -1740,6 +1740,8 @@ static int qcom_pcie_parse_ports(struct qcom_pcie *pcie)
int ret = -ENOENT;
for_each_available_child_of_node_scoped(dev->of_node, of_port) {
+ if (!of_node_is_type(of_port, "pci"))
+ continue;
ret = qcom_pcie_parse_port(pcie, of_port);
if (ret)
goto err_port_del;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 274/563] cdx: dont select CONFIG_GENERIC_MSI_IRQ
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (272 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 273/563] PCI: qcom: Restrict port parsing only to PCIe bridge child nodes Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 275/563] PCI/ACPI: Fix pci_acpi_preserve_config() memory leak Greg Kroah-Hartman
` (302 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robin Murphy, Nikhil Agarwal,
Arnd Bergmann, Nipun Gupta, Alex Williamson, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nipun Gupta <nipun.gupta@amd.com>
[ Upstream commit ab1d8dda32e9507ca3bfb6b43661aeaa27f7bd82 ]
x86 does not use CONFIG_GENERIC_MSI_IRQ, and trying to enable it anyway
results in a build failure:
In file included from include/linux/ssb/ssb.h:10,
from drivers/ssb/pcihost_wrapper.c:18:
include/linux/gpio/driver.h:41:33: error: field 'msiinfo' has incomplete type
41 | msi_alloc_info_t msiinfo;
| ^~~~~~~
In file included from include/linux/kvm_host.h:19,
from arch/x86/events/intel/core.c:17:
include/linux/msi.h:528:33: error: field 'alloc_info' has incomplete type
528 | msi_alloc_info_t alloc_info;
Change the driver to actually build without this symbol and remove the
incorrect 'select' statements.
Fixes: e8b18c11731d ("cdx: Fix missing GENERIC_MSI_IRQ on compile test")
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Nikhil Agarwal <nikhil.agarwal@amd.com>
Signed-off-by: Arnd Bergmann <arnd@kernel.org>
Signed-off-by: Nipun Gupta <nipun.gupta@amd.com>
Link: https://lore.kernel.org/r/20250826043852.2206008-1-nipun.gupta@amd.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cdx/Kconfig | 1 -
drivers/cdx/cdx.c | 4 ++--
drivers/cdx/controller/Kconfig | 1 -
drivers/cdx/controller/cdx_controller.c | 3 ++-
4 files changed, 4 insertions(+), 5 deletions(-)
diff --git a/drivers/cdx/Kconfig b/drivers/cdx/Kconfig
index 3af41f51cf38b..1f1e360507d7d 100644
--- a/drivers/cdx/Kconfig
+++ b/drivers/cdx/Kconfig
@@ -8,7 +8,6 @@
config CDX_BUS
bool "CDX Bus driver"
depends on OF && ARM64 || COMPILE_TEST
- select GENERIC_MSI_IRQ
help
Driver to enable Composable DMA Transfer(CDX) Bus. CDX bus
exposes Fabric devices which uses composable DMA IP to the
diff --git a/drivers/cdx/cdx.c b/drivers/cdx/cdx.c
index 092306ca2541c..3d50f8cd9c0bd 100644
--- a/drivers/cdx/cdx.c
+++ b/drivers/cdx/cdx.c
@@ -310,7 +310,7 @@ static int cdx_probe(struct device *dev)
* Setup MSI device data so that generic MSI alloc/free can
* be used by the device driver.
*/
- if (cdx->msi_domain) {
+ if (IS_ENABLED(CONFIG_GENERIC_MSI_IRQ) && cdx->msi_domain) {
error = msi_setup_device_data(&cdx_dev->dev);
if (error)
return error;
@@ -833,7 +833,7 @@ int cdx_device_add(struct cdx_dev_params *dev_params)
((cdx->id << CDX_CONTROLLER_ID_SHIFT) | (cdx_dev->bus_num & CDX_BUS_NUM_MASK)),
cdx_dev->dev_num);
- if (cdx->msi_domain) {
+ if (IS_ENABLED(CONFIG_GENERIC_MSI_IRQ) && cdx->msi_domain) {
cdx_dev->num_msi = dev_params->num_msi;
dev_set_msi_domain(&cdx_dev->dev, cdx->msi_domain);
}
diff --git a/drivers/cdx/controller/Kconfig b/drivers/cdx/controller/Kconfig
index 0641a4c21e660..a480b62cbd1f7 100644
--- a/drivers/cdx/controller/Kconfig
+++ b/drivers/cdx/controller/Kconfig
@@ -10,7 +10,6 @@ if CDX_BUS
config CDX_CONTROLLER
tristate "CDX bus controller"
depends on HAS_DMA
- select GENERIC_MSI_IRQ
select REMOTEPROC
select RPMSG
help
diff --git a/drivers/cdx/controller/cdx_controller.c b/drivers/cdx/controller/cdx_controller.c
index fca83141e3e66..5e3fd89b6b561 100644
--- a/drivers/cdx/controller/cdx_controller.c
+++ b/drivers/cdx/controller/cdx_controller.c
@@ -193,7 +193,8 @@ static int xlnx_cdx_probe(struct platform_device *pdev)
cdx->ops = &cdx_ops;
/* Create MSI domain */
- cdx->msi_domain = cdx_msi_domain_init(&pdev->dev);
+ if (IS_ENABLED(CONFIG_GENERIC_MSI_IRQ))
+ cdx->msi_domain = cdx_msi_domain_init(&pdev->dev);
if (!cdx->msi_domain) {
ret = dev_err_probe(&pdev->dev, -ENODEV, "cdx_msi_domain_init() failed");
goto cdx_msi_fail;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 275/563] PCI/ACPI: Fix pci_acpi_preserve_config() memory leak
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (273 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 274/563] cdx: dont select CONFIG_GENERIC_MSI_IRQ Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 276/563] HID: i2c-hid: Fix test in i2c_hid_core_register_panel_follower() Greg Kroah-Hartman
` (301 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nirmoy Das, Bjorn Helgaas,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nirmoy Das <nirmoyd@nvidia.com>
[ Upstream commit fac679df7580979174c90303f004b09cdc6f086f ]
pci_acpi_preserve_config() leaks memory by returning early without freeing
the ACPI object on success. Fix that by always freeing the obj, which is
not needed by the caller.
Fixes: 9d7d5db8e78e ("PCI: Move PRESERVE_BOOT_CONFIG _DSM evaluation to pci_register_host_bridge()")
Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20250825214642.142135-1-nirmoyd@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pci-acpi.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index ddb25960ea47d..9369377725fa0 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -122,6 +122,8 @@ phys_addr_t acpi_pci_root_get_mcfg_addr(acpi_handle handle)
bool pci_acpi_preserve_config(struct pci_host_bridge *host_bridge)
{
+ bool ret = false;
+
if (ACPI_HANDLE(&host_bridge->dev)) {
union acpi_object *obj;
@@ -135,11 +137,11 @@ bool pci_acpi_preserve_config(struct pci_host_bridge *host_bridge)
1, DSM_PCI_PRESERVE_BOOT_CONFIG,
NULL, ACPI_TYPE_INTEGER);
if (obj && obj->integer.value == 0)
- return true;
+ ret = true;
ACPI_FREE(obj);
}
- return false;
+ return ret;
}
/* _HPX PCI Setting Record (Type 0); same as _HPP */
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 276/563] HID: i2c-hid: Fix test in i2c_hid_core_register_panel_follower()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (274 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 275/563] PCI/ACPI: Fix pci_acpi_preserve_config() memory leak Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 277/563] ALSA: lx_core: use int type to store negative error codes Greg Kroah-Hartman
` (300 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Douglas Anderson,
Pin-yen Lin, Jiri Kosina, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 5c76c794bf29399394ebacaa5af8436b8bed0d46 ]
Bitwise AND was intended instead of OR. With the current code the
condition is always true.
Fixes: cbdd16b818ee ("HID: i2c-hid: Make elan touch controllers power on after panel is enabled")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Pin-yen Lin <treapking@chromium.org>
Acked-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/aK8Au3CgZSTvfEJ6@stanley.mountain
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/i2c-hid/i2c-hid-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 99ce6386176c6..30ebde1273be3 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -1189,7 +1189,7 @@ static int i2c_hid_core_register_panel_follower(struct i2c_hid *ihid)
struct device *dev = &ihid->client->dev;
int ret;
- if (ihid->hid->initial_quirks | HID_QUIRK_POWER_ON_AFTER_BACKLIGHT)
+ if (ihid->hid->initial_quirks & HID_QUIRK_POWER_ON_AFTER_BACKLIGHT)
ihid->panel_follower.funcs = &i2c_hid_core_panel_follower_enable_funcs;
else
ihid->panel_follower.funcs = &i2c_hid_core_panel_follower_prepare_funcs;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 277/563] ALSA: lx_core: use int type to store negative error codes
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (275 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 276/563] HID: i2c-hid: Fix test in i2c_hid_core_register_panel_follower() Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 278/563] media: st-delta: avoid excessive stack usage Greg Kroah-Hartman
` (299 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qianfeng Rong, Takashi Iwai,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <rongqianfeng@vivo.com>
[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ]
Change the 'ret' variable from u16 to int to store negative error codes or
zero returned by lx_message_send_atomic().
Storing the negative error codes in unsigned type, doesn't cause an issue
at runtime but it's ugly as pants. Additionally, assigning negative error
codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
flag is enabled.
No effect on runtime.
Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface")
Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Link: https://patch.msgid.link/20250828081312.393148-1-rongqianfeng@vivo.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/lx6464es/lx_core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c
index 9d95ecb299aed..a99acd1125e74 100644
--- a/sound/pci/lx6464es/lx_core.c
+++ b/sound/pci/lx6464es/lx_core.c
@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh)
/* low-level dsp access */
int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
{
- u16 ret;
+ int ret;
mutex_lock(&chip->msg_lock);
@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq)
{
- u16 ret = 0;
u32 freq_raw = 0;
u32 freq = 0;
u32 frequency = 0;
+ int ret;
mutex_lock(&chip->msg_lock);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 278/563] media: st-delta: avoid excessive stack usage
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (276 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 277/563] ALSA: lx_core: use int type to store negative error codes Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 279/563] drm/amdgpu/vcn: Add regdump helper functions Greg Kroah-Hartman
` (298 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Hans Verkuil,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 5954ad7d1af92cb6244c5f31216e43af55febbb7 ]
Building with a reduced stack warning limit shows that delta_mjpeg_decode()
copies a giant structure to the stack each time but only uses three of
its members:
drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c: In function 'delta_mjpeg_decode':
drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c:427:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=]
Open-code the passing of the structure members that are actually used here.
Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../platform/st/sti/delta/delta-mjpeg-dec.c | 20 ++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
index 0533d4a083d24..a078f1107300e 100644
--- a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
+++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
@@ -239,7 +239,7 @@ static int delta_mjpeg_ipc_open(struct delta_ctx *pctx)
return 0;
}
-static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au)
+static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, dma_addr_t pstart, dma_addr_t pend)
{
struct delta_dev *delta = pctx->dev;
struct delta_mjpeg_ctx *ctx = to_ctx(pctx);
@@ -256,8 +256,8 @@ static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au)
memset(params, 0, sizeof(*params));
- params->picture_start_addr_p = (u32)(au->paddr);
- params->picture_end_addr_p = (u32)(au->paddr + au->size - 1);
+ params->picture_start_addr_p = pstart;
+ params->picture_end_addr_p = pend;
/*
* !WARNING!
@@ -374,12 +374,14 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau)
struct delta_dev *delta = pctx->dev;
struct delta_mjpeg_ctx *ctx = to_ctx(pctx);
int ret;
- struct delta_au au = *pau;
+ void *au_vaddr = pau->vaddr;
+ dma_addr_t au_dma = pau->paddr;
+ size_t au_size = pau->size;
unsigned int data_offset = 0;
struct mjpeg_header *header = &ctx->header_struct;
if (!ctx->header) {
- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size,
+ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size,
header, &data_offset);
if (ret) {
pctx->stream_errors++;
@@ -405,17 +407,17 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau)
goto err;
}
- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size,
+ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size,
ctx->header, &data_offset);
if (ret) {
pctx->stream_errors++;
goto err;
}
- au.paddr += data_offset;
- au.vaddr += data_offset;
+ au_dma += data_offset;
+ au_vaddr += data_offset;
- ret = delta_mjpeg_ipc_decode(pctx, &au);
+ ret = delta_mjpeg_ipc_decode(pctx, au_dma, au_dma + au_size - 1);
if (ret)
goto err;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 279/563] drm/amdgpu/vcn: Add regdump helper functions
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (277 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 278/563] media: st-delta: avoid excessive stack usage Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 280/563] drm/amdgpu/vcn: Hold pg_lock before vcn power off Greg Kroah-Hartman
` (297 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sathishkumar S, Leo Liu,
Alex Deucher, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sathishkumar S <sathishkumar.sundararaju@amd.com>
[ Upstream commit de55cbff5ce93c316b0113535752e43079761f2c ]
Add generic helper functions for vcn devcoredump support
which can be re-used for all vcn versions.
Signed-off-by: Sathishkumar S <sathishkumar.sundararaju@amd.com>
Acked-by: Leo Liu <leo.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Stable-dep-of: 9c0442286f84 ("drm/amdgpu: Check vcn state before profile switch")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 87 +++++++++++++++++++++++++
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h | 8 +++
2 files changed, 95 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
index f1f67521c29ca..b497a67141384 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
@@ -92,6 +92,7 @@ MODULE_FIRMWARE(FIRMWARE_VCN5_0_0);
MODULE_FIRMWARE(FIRMWARE_VCN5_0_1);
static void amdgpu_vcn_idle_work_handler(struct work_struct *work);
+static void amdgpu_vcn_reg_dump_fini(struct amdgpu_device *adev);
int amdgpu_vcn_early_init(struct amdgpu_device *adev, int i)
{
@@ -285,6 +286,10 @@ int amdgpu_vcn_sw_fini(struct amdgpu_device *adev, int i)
amdgpu_ucode_release(&adev->vcn.inst[0].fw);
adev->vcn.inst[i].fw = NULL;
}
+
+ if (adev->vcn.reg_list)
+ amdgpu_vcn_reg_dump_fini(adev);
+
mutex_destroy(&adev->vcn.inst[i].vcn_pg_lock);
mutex_destroy(&adev->vcn.inst[i].vcn1_jpeg1_workaround);
@@ -1527,3 +1532,85 @@ int amdgpu_vcn_ring_reset(struct amdgpu_ring *ring,
return amdgpu_vcn_reset_engine(adev, ring->me);
}
+
+int amdgpu_vcn_reg_dump_init(struct amdgpu_device *adev,
+ const struct amdgpu_hwip_reg_entry *reg, u32 count)
+{
+ adev->vcn.ip_dump = kcalloc(adev->vcn.num_vcn_inst * count,
+ sizeof(uint32_t), GFP_KERNEL);
+ if (!adev->vcn.ip_dump)
+ return -ENOMEM;
+ adev->vcn.reg_list = reg;
+ adev->vcn.reg_count = count;
+
+ return 0;
+}
+
+static void amdgpu_vcn_reg_dump_fini(struct amdgpu_device *adev)
+{
+ kfree(adev->vcn.ip_dump);
+ adev->vcn.reg_list = NULL;
+ adev->vcn.reg_count = 0;
+}
+
+void amdgpu_vcn_dump_ip_state(struct amdgpu_ip_block *ip_block)
+{
+ struct amdgpu_device *adev = ip_block->adev;
+ int i, j;
+ bool is_powered;
+ u32 inst_off;
+
+ if (!adev->vcn.ip_dump)
+ return;
+
+ for (i = 0; i < adev->vcn.num_vcn_inst; i++) {
+ if (adev->vcn.harvest_config & (1 << i))
+ continue;
+
+ inst_off = i * adev->vcn.reg_count;
+ /* mmUVD_POWER_STATUS is always readable and is the first in reg_list */
+ adev->vcn.ip_dump[inst_off] =
+ RREG32(SOC15_REG_ENTRY_OFFSET_INST(adev->vcn.reg_list[0], i));
+ is_powered = (adev->vcn.ip_dump[inst_off] &
+ UVD_POWER_STATUS__UVD_POWER_STATUS_TILES_OFF) !=
+ UVD_POWER_STATUS__UVD_POWER_STATUS_TILES_OFF;
+
+ if (is_powered)
+ for (j = 1; j < adev->vcn.reg_count; j++)
+ adev->vcn.ip_dump[inst_off + j] =
+ RREG32(SOC15_REG_ENTRY_OFFSET_INST(adev->vcn.reg_list[j], i));
+ }
+}
+
+void amdgpu_vcn_print_ip_state(struct amdgpu_ip_block *ip_block, struct drm_printer *p)
+{
+ struct amdgpu_device *adev = ip_block->adev;
+ int i, j;
+ bool is_powered;
+ u32 inst_off;
+
+ if (!adev->vcn.ip_dump)
+ return;
+
+ drm_printf(p, "num_instances:%d\n", adev->vcn.num_vcn_inst);
+ for (i = 0; i < adev->vcn.num_vcn_inst; i++) {
+ if (adev->vcn.harvest_config & (1 << i)) {
+ drm_printf(p, "\nHarvested Instance:VCN%d Skipping dump\n", i);
+ continue;
+ }
+
+ inst_off = i * adev->vcn.reg_count;
+ is_powered = (adev->vcn.ip_dump[inst_off] &
+ UVD_POWER_STATUS__UVD_POWER_STATUS_TILES_OFF) !=
+ UVD_POWER_STATUS__UVD_POWER_STATUS_TILES_OFF;
+
+ if (is_powered) {
+ drm_printf(p, "\nActive Instance:VCN%d\n", i);
+ for (j = 0; j < adev->vcn.reg_count; j++)
+ drm_printf(p, "%-50s \t 0x%08x\n", adev->vcn.reg_list[j].reg_name,
+ adev->vcn.ip_dump[inst_off + j]);
+ } else {
+ drm_printf(p, "\nInactive Instance:VCN%d\n", i);
+ }
+ }
+}
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h
index 0bc0a94d7cf0f..b3fb1d0e43fc9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h
@@ -237,6 +237,8 @@
#define AMDGPU_DRM_KEY_INJECT_WORKAROUND_VCNFW_ASD_HANDSHAKING 2
+struct amdgpu_hwip_reg_entry;
+
enum amdgpu_vcn_caps {
AMDGPU_VCN_RRMT_ENABLED,
};
@@ -362,6 +364,8 @@ struct amdgpu_vcn {
bool workload_profile_active;
struct mutex workload_profile_mutex;
+ u32 reg_count;
+ const struct amdgpu_hwip_reg_entry *reg_list;
};
struct amdgpu_fw_shared_rb_ptrs_struct {
@@ -557,4 +561,8 @@ int vcn_set_powergating_state(struct amdgpu_ip_block *ip_block,
int amdgpu_vcn_ring_reset(struct amdgpu_ring *ring,
unsigned int vmid,
struct amdgpu_fence *guilty_fence);
+int amdgpu_vcn_reg_dump_init(struct amdgpu_device *adev,
+ const struct amdgpu_hwip_reg_entry *reg, u32 count);
+void amdgpu_vcn_dump_ip_state(struct amdgpu_ip_block *ip_block);
+void amdgpu_vcn_print_ip_state(struct amdgpu_ip_block *ip_block, struct drm_printer *p);
#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 280/563] drm/amdgpu/vcn: Hold pg_lock before vcn power off
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (278 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 279/563] drm/amdgpu/vcn: Add regdump helper functions Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 281/563] drm/amdgpu: Check vcn state before profile switch Greg Kroah-Hartman
` (296 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sathishkumar S, Leo Liu,
Alex Deucher, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sathishkumar S <sathishkumar.sundararaju@amd.com>
[ Upstream commit 111821e4b5a3105c42c7c99f4abd4d8af9f64248 ]
Acquire vcn_pg_lock before changes to vcn power state
and release it after power off in idle work handler.
Signed-off-by: Sathishkumar S <sathishkumar.sundararaju@amd.com>
Reviewed-by: Leo Liu <leo.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Stable-dep-of: 9c0442286f84 ("drm/amdgpu: Check vcn state before profile switch")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
index b497a67141384..e965b624efdb1 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
@@ -443,7 +443,9 @@ static void amdgpu_vcn_idle_work_handler(struct work_struct *work)
fences += fence[i];
if (!fences && !atomic_read(&vcn_inst->total_submission_cnt)) {
+ mutex_lock(&vcn_inst->vcn_pg_lock);
vcn_inst->set_pg_state(vcn_inst, AMD_PG_STATE_GATE);
+ mutex_unlock(&vcn_inst->vcn_pg_lock);
mutex_lock(&adev->vcn.workload_profile_mutex);
if (adev->vcn.workload_profile_active) {
r = amdgpu_dpm_switch_power_profile(adev, PP_SMC_POWER_PROFILE_VIDEO,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 281/563] drm/amdgpu: Check vcn state before profile switch
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (279 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 280/563] drm/amdgpu/vcn: Hold pg_lock before vcn power off Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 282/563] accel/amdxdna: Use int instead of u32 to store error codes Greg Kroah-Hartman
` (295 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lijo Lazar, Sathishkumar S,
Alex Deucher, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <lijo.lazar@amd.com>
[ Upstream commit 9c0442286f84a5036958b3d8eb00bf0bb070dbd1 ]
The patch uses power state of VCN instances for requesting video
profile.
In idle worker of a vcn instance, when there is no outstanding
submisssion or fence, the instance is put to power gated state. When
all instances are powered off that means video profile is no longer
required. A request is made to turn off video profile.
A job submission starts with begin_use of ring, and at that time
vcn instance state is changed to power on. Subsequently a check is
made for active video profile, and if not active, a request is made.
Fixes: 3b669df92c85 ("drm/amdgpu/vcn: adjust workload profile handling")
Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Sathishkumar S <sathishkumar.sundararaju@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 80 ++++++++++++++++---------
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h | 3 +
drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c | 27 +--------
3 files changed, 56 insertions(+), 54 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
index e965b624efdb1..e5e40d10bb14b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
@@ -410,6 +410,54 @@ int amdgpu_vcn_resume(struct amdgpu_device *adev, int i)
return 0;
}
+void amdgpu_vcn_get_profile(struct amdgpu_device *adev)
+{
+ int r;
+
+ mutex_lock(&adev->vcn.workload_profile_mutex);
+
+ if (adev->vcn.workload_profile_active) {
+ mutex_unlock(&adev->vcn.workload_profile_mutex);
+ return;
+ }
+ r = amdgpu_dpm_switch_power_profile(adev, PP_SMC_POWER_PROFILE_VIDEO,
+ true);
+ if (r)
+ dev_warn(adev->dev,
+ "(%d) failed to enable video power profile mode\n", r);
+ else
+ adev->vcn.workload_profile_active = true;
+ mutex_unlock(&adev->vcn.workload_profile_mutex);
+}
+
+void amdgpu_vcn_put_profile(struct amdgpu_device *adev)
+{
+ bool pg = true;
+ int r, i;
+
+ mutex_lock(&adev->vcn.workload_profile_mutex);
+ for (i = 0; i < adev->vcn.num_vcn_inst; i++) {
+ if (adev->vcn.inst[i].cur_state != AMD_PG_STATE_GATE) {
+ pg = false;
+ break;
+ }
+ }
+
+ if (pg) {
+ r = amdgpu_dpm_switch_power_profile(
+ adev, PP_SMC_POWER_PROFILE_VIDEO, false);
+ if (r)
+ dev_warn(
+ adev->dev,
+ "(%d) failed to disable video power profile mode\n",
+ r);
+ else
+ adev->vcn.workload_profile_active = false;
+ }
+
+ mutex_unlock(&adev->vcn.workload_profile_mutex);
+}
+
static void amdgpu_vcn_idle_work_handler(struct work_struct *work)
{
struct amdgpu_vcn_inst *vcn_inst =
@@ -417,7 +465,6 @@ static void amdgpu_vcn_idle_work_handler(struct work_struct *work)
struct amdgpu_device *adev = vcn_inst->adev;
unsigned int fences = 0, fence[AMDGPU_MAX_VCN_INSTANCES] = {0};
unsigned int i = vcn_inst->inst, j;
- int r = 0;
if (adev->vcn.harvest_config & (1 << i))
return;
@@ -446,15 +493,8 @@ static void amdgpu_vcn_idle_work_handler(struct work_struct *work)
mutex_lock(&vcn_inst->vcn_pg_lock);
vcn_inst->set_pg_state(vcn_inst, AMD_PG_STATE_GATE);
mutex_unlock(&vcn_inst->vcn_pg_lock);
- mutex_lock(&adev->vcn.workload_profile_mutex);
- if (adev->vcn.workload_profile_active) {
- r = amdgpu_dpm_switch_power_profile(adev, PP_SMC_POWER_PROFILE_VIDEO,
- false);
- if (r)
- dev_warn(adev->dev, "(%d) failed to disable video power profile mode\n", r);
- adev->vcn.workload_profile_active = false;
- }
- mutex_unlock(&adev->vcn.workload_profile_mutex);
+ amdgpu_vcn_put_profile(adev);
+
} else {
schedule_delayed_work(&vcn_inst->idle_work, VCN_IDLE_TIMEOUT);
}
@@ -464,30 +504,11 @@ void amdgpu_vcn_ring_begin_use(struct amdgpu_ring *ring)
{
struct amdgpu_device *adev = ring->adev;
struct amdgpu_vcn_inst *vcn_inst = &adev->vcn.inst[ring->me];
- int r = 0;
atomic_inc(&vcn_inst->total_submission_cnt);
cancel_delayed_work_sync(&vcn_inst->idle_work);
- /* We can safely return early here because we've cancelled the
- * the delayed work so there is no one else to set it to false
- * and we don't care if someone else sets it to true.
- */
- if (adev->vcn.workload_profile_active)
- goto pg_lock;
-
- mutex_lock(&adev->vcn.workload_profile_mutex);
- if (!adev->vcn.workload_profile_active) {
- r = amdgpu_dpm_switch_power_profile(adev, PP_SMC_POWER_PROFILE_VIDEO,
- true);
- if (r)
- dev_warn(adev->dev, "(%d) failed to switch to video power profile mode\n", r);
- adev->vcn.workload_profile_active = true;
- }
- mutex_unlock(&adev->vcn.workload_profile_mutex);
-
-pg_lock:
mutex_lock(&vcn_inst->vcn_pg_lock);
vcn_inst->set_pg_state(vcn_inst, AMD_PG_STATE_UNGATE);
@@ -515,6 +536,7 @@ void amdgpu_vcn_ring_begin_use(struct amdgpu_ring *ring)
vcn_inst->pause_dpg_mode(vcn_inst, &new_state);
}
mutex_unlock(&vcn_inst->vcn_pg_lock);
+ amdgpu_vcn_get_profile(adev);
}
void amdgpu_vcn_ring_end_use(struct amdgpu_ring *ring)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h
index b3fb1d0e43fc9..6d9acd36041d0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h
@@ -565,4 +565,7 @@ int amdgpu_vcn_reg_dump_init(struct amdgpu_device *adev,
const struct amdgpu_hwip_reg_entry *reg, u32 count);
void amdgpu_vcn_dump_ip_state(struct amdgpu_ip_block *ip_block);
void amdgpu_vcn_print_ip_state(struct amdgpu_ip_block *ip_block, struct drm_printer *p);
+void amdgpu_vcn_get_profile(struct amdgpu_device *adev);
+void amdgpu_vcn_put_profile(struct amdgpu_device *adev);
+
#endif
diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
index bc30a5326866c..f13ed3c1e29c2 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
@@ -116,7 +116,6 @@ static void vcn_v2_5_idle_work_handler(struct work_struct *work)
struct amdgpu_device *adev = vcn_inst->adev;
unsigned int fences = 0, fence[AMDGPU_MAX_VCN_INSTANCES] = {0};
unsigned int i, j;
- int r = 0;
for (i = 0; i < adev->vcn.num_vcn_inst; ++i) {
struct amdgpu_vcn_inst *v = &adev->vcn.inst[i];
@@ -149,15 +148,7 @@ static void vcn_v2_5_idle_work_handler(struct work_struct *work)
if (!fences && !atomic_read(&adev->vcn.inst[0].total_submission_cnt)) {
amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_VCN,
AMD_PG_STATE_GATE);
- mutex_lock(&adev->vcn.workload_profile_mutex);
- if (adev->vcn.workload_profile_active) {
- r = amdgpu_dpm_switch_power_profile(adev, PP_SMC_POWER_PROFILE_VIDEO,
- false);
- if (r)
- dev_warn(adev->dev, "(%d) failed to disable video power profile mode\n", r);
- adev->vcn.workload_profile_active = false;
- }
- mutex_unlock(&adev->vcn.workload_profile_mutex);
+ amdgpu_vcn_put_profile(adev);
} else {
schedule_delayed_work(&adev->vcn.inst[0].idle_work, VCN_IDLE_TIMEOUT);
}
@@ -167,7 +158,6 @@ static void vcn_v2_5_ring_begin_use(struct amdgpu_ring *ring)
{
struct amdgpu_device *adev = ring->adev;
struct amdgpu_vcn_inst *v = &adev->vcn.inst[ring->me];
- int r = 0;
atomic_inc(&adev->vcn.inst[0].total_submission_cnt);
@@ -177,20 +167,6 @@ static void vcn_v2_5_ring_begin_use(struct amdgpu_ring *ring)
* the delayed work so there is no one else to set it to false
* and we don't care if someone else sets it to true.
*/
- if (adev->vcn.workload_profile_active)
- goto pg_lock;
-
- mutex_lock(&adev->vcn.workload_profile_mutex);
- if (!adev->vcn.workload_profile_active) {
- r = amdgpu_dpm_switch_power_profile(adev, PP_SMC_POWER_PROFILE_VIDEO,
- true);
- if (r)
- dev_warn(adev->dev, "(%d) failed to switch to video power profile mode\n", r);
- adev->vcn.workload_profile_active = true;
- }
- mutex_unlock(&adev->vcn.workload_profile_mutex);
-
-pg_lock:
mutex_lock(&adev->vcn.inst[0].vcn_pg_lock);
amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_VCN,
AMD_PG_STATE_UNGATE);
@@ -218,6 +194,7 @@ static void vcn_v2_5_ring_begin_use(struct amdgpu_ring *ring)
v->pause_dpg_mode(v, &new_state);
}
mutex_unlock(&adev->vcn.inst[0].vcn_pg_lock);
+ amdgpu_vcn_get_profile(adev);
}
static void vcn_v2_5_ring_end_use(struct amdgpu_ring *ring)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 282/563] accel/amdxdna: Use int instead of u32 to store error codes
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (280 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 281/563] drm/amdgpu: Check vcn state before profile switch Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 283/563] efi: Explain OVMF acronym in OVMF_DEBUG_LOG help text Greg Kroah-Hartman
` (294 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Qianfeng Rong, Lizhi Hou,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <rongqianfeng@vivo.com>
[ Upstream commit 24de3daf6179bce3710527b8292d7ee6f1b56393 ]
Change the 'ret' variable from u32 to int to store -EINVAL. Storing the
negative error codes in unsigned type, doesn't cause an issue at runtime
but it's ugly as pants.
Additionally, assigning -EINVAL to u32 ret (i.e., u32 ret = -EINVAL) may
trigger a GCC warning when the -Wsign-conversion flag is enabled.
Fixes: aac243092b70 ("accel/amdxdna: Add command execution")
Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://lore.kernel.org/r/20250828033917.113364-1-rongqianfeng@vivo.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accel/amdxdna/aie2_ctx.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
index 2cff5419bd2fa..cda964ba33cd7 100644
--- a/drivers/accel/amdxdna/aie2_ctx.c
+++ b/drivers/accel/amdxdna/aie2_ctx.c
@@ -192,7 +192,7 @@ aie2_sched_resp_handler(void *handle, void __iomem *data, size_t size)
{
struct amdxdna_sched_job *job = handle;
struct amdxdna_gem_obj *cmd_abo;
- u32 ret = 0;
+ int ret = 0;
u32 status;
cmd_abo = job->cmd_bo;
@@ -222,7 +222,7 @@ static int
aie2_sched_nocmd_resp_handler(void *handle, void __iomem *data, size_t size)
{
struct amdxdna_sched_job *job = handle;
- u32 ret = 0;
+ int ret = 0;
u32 status;
if (unlikely(!data))
@@ -250,7 +250,7 @@ aie2_sched_cmdlist_resp_handler(void *handle, void __iomem *data, size_t size)
u32 fail_cmd_status;
u32 fail_cmd_idx;
u32 cmd_status;
- u32 ret = 0;
+ int ret = 0;
cmd_abo = job->cmd_bo;
if (unlikely(!data) || unlikely(size != sizeof(u32) * 3)) {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 283/563] efi: Explain OVMF acronym in OVMF_DEBUG_LOG help text
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (281 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 282/563] accel/amdxdna: Use int instead of u32 to store error codes Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 284/563] net: dst: introduce dst->dev_rcu Greg Kroah-Hartman
` (293 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Richard Lyu,
Gerd Hoffmann, Ard Biesheuvel, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit 05e75ac35ee9e38f96bbfebf1830ec2cace2e7f8 ]
People not very intimate with EFI may not know the meaning of the OVMF
acronym. Write it in full, to help users with making good decisions
when configuring their kernels.
Fixes: f393a761763c5427 ("efi: add ovmf debug log driver")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Richard Lyu <richard.lyu@suse.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/efi/Kconfig | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig
index d528c94c5859b..29e0729299f5b 100644
--- a/drivers/firmware/efi/Kconfig
+++ b/drivers/firmware/efi/Kconfig
@@ -267,9 +267,10 @@ config OVMF_DEBUG_LOG
bool "Expose OVMF firmware debug log via sysfs"
depends on EFI
help
- Recent OVMF versions (edk2-stable202508 + newer) can write
- their debug log to a memory buffer. This driver exposes the
- log content via sysfs (/sys/firmware/efi/ovmf_debug_log).
+ Recent versions of the Open Virtual Machine Firmware
+ (edk2-stable202508 + newer) can write their debug log to a memory
+ buffer. This driver exposes the log content via sysfs
+ (/sys/firmware/efi/ovmf_debug_log).
config UNACCEPTED_MEMORY
bool
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 284/563] net: dst: introduce dst->dev_rcu
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (282 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 283/563] efi: Explain OVMF acronym in OVMF_DEBUG_LOG help text Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 285/563] ipv6: mcast: Add ip6_mc_find_idev() helper Greg Kroah-Hartman
` (292 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, David Ahern,
Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit caedcc5b6df1b2e2b5f39079e3369c1d4d5c5f50 ]
Followup of commit 88fe14253e18 ("net: dst: add four helpers
to annotate data-races around dst->dev").
We want to gradually add explicit RCU protection to dst->dev,
including lockdep support.
Add an union to alias dst->dev_rcu and dst->dev.
Add dst_dev_net_rcu() helper.
Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250828195823.3958522-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/dst.h | 16 +++++++++++-----
net/core/dst.c | 2 +-
net/ipv4/route.c | 4 ++--
3 files changed, 14 insertions(+), 8 deletions(-)
diff --git a/include/net/dst.h b/include/net/dst.h
index bab01363bb975..f8aa1239b4db6 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -24,7 +24,10 @@
struct sk_buff;
struct dst_entry {
- struct net_device *dev;
+ union {
+ struct net_device *dev;
+ struct net_device __rcu *dev_rcu;
+ };
struct dst_ops *ops;
unsigned long _metrics;
unsigned long expires;
@@ -570,9 +573,12 @@ static inline struct net_device *dst_dev(const struct dst_entry *dst)
static inline struct net_device *dst_dev_rcu(const struct dst_entry *dst)
{
- /* In the future, use rcu_dereference(dst->dev) */
- WARN_ON_ONCE(!rcu_read_lock_held());
- return READ_ONCE(dst->dev);
+ return rcu_dereference(dst->dev_rcu);
+}
+
+static inline struct net *dst_dev_net_rcu(const struct dst_entry *dst)
+{
+ return dev_net_rcu(dst_dev_rcu(dst));
}
static inline struct net_device *skb_dst_dev(const struct sk_buff *skb)
@@ -592,7 +598,7 @@ static inline struct net *skb_dst_dev_net(const struct sk_buff *skb)
static inline struct net *skb_dst_dev_net_rcu(const struct sk_buff *skb)
{
- return dev_net_rcu(skb_dst_dev(skb));
+ return dev_net_rcu(skb_dst_dev_rcu(skb));
}
struct dst_entry *dst_blackhole_check(struct dst_entry *dst, u32 cookie);
diff --git a/net/core/dst.c b/net/core/dst.c
index e2de8b68c41d3..e9d35f49c9e78 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -150,7 +150,7 @@ void dst_dev_put(struct dst_entry *dst)
dst->ops->ifdown(dst, dev);
WRITE_ONCE(dst->input, dst_discard);
WRITE_ONCE(dst->output, dst_discard_out);
- WRITE_ONCE(dst->dev, blackhole_netdev);
+ rcu_assign_pointer(dst->dev_rcu, blackhole_netdev);
netdev_ref_replace(dev, blackhole_netdev, &dst->dev_tracker,
GFP_ATOMIC);
}
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index baa43e5966b19..97b96275a775d 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1026,7 +1026,7 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
return;
rcu_read_lock();
- net = dev_net_rcu(dst_dev(dst));
+ net = dst_dev_net_rcu(dst);
if (mtu < net->ipv4.ip_rt_min_pmtu) {
lock = true;
mtu = min(old_mtu, net->ipv4.ip_rt_min_pmtu);
@@ -1326,7 +1326,7 @@ static unsigned int ipv4_default_advmss(const struct dst_entry *dst)
struct net *net;
rcu_read_lock();
- net = dev_net_rcu(dst_dev(dst));
+ net = dst_dev_net_rcu(dst);
advmss = max_t(unsigned int, ipv4_mtu(dst) - header_size,
net->ipv4.ip_rt_min_advmss);
rcu_read_unlock();
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 285/563] ipv6: mcast: Add ip6_mc_find_idev() helper
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (283 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 284/563] net: dst: introduce dst->dev_rcu Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 286/563] ipv6: start using dst_dev_rcu() Greg Kroah-Hartman
` (291 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yue Haibing, Dawid Osuchowski,
Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yue Haibing <yuehaibing@huawei.com>
[ Upstream commit 60c481d4caa569001c708d4e9622d19650b6bedc ]
Extract the same code logic from __ipv6_sock_mc_join() and
ip6_mc_find_dev(), also add new helper ip6_mc_find_idev() to
reduce redundancy and enhance readability.
No functional changes intended.
Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
Reviewed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
Link: https://patch.msgid.link/20250822064051.2991480-1-yuehaibing@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: b775ecf1655c ("ipv6: start using dst_dev_rcu()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/mcast.c | 67 ++++++++++++++++++++++--------------------------
1 file changed, 31 insertions(+), 36 deletions(-)
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 36ca27496b3c0..55c49dc14b1bd 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -169,6 +169,29 @@ static int unsolicited_report_interval(struct inet6_dev *idev)
return iv > 0 ? iv : 1;
}
+static struct net_device *ip6_mc_find_dev(struct net *net,
+ const struct in6_addr *group,
+ int ifindex)
+{
+ struct net_device *dev = NULL;
+ struct rt6_info *rt;
+
+ if (ifindex == 0) {
+ rcu_read_lock();
+ rt = rt6_lookup(net, group, NULL, 0, NULL, 0);
+ if (rt) {
+ dev = dst_dev(&rt->dst);
+ dev_hold(dev);
+ ip6_rt_put(rt);
+ }
+ rcu_read_unlock();
+ } else {
+ dev = dev_get_by_index(net, ifindex);
+ }
+
+ return dev;
+}
+
/*
* socket join on multicast group
*/
@@ -191,28 +214,13 @@ static int __ipv6_sock_mc_join(struct sock *sk, int ifindex,
}
mc_lst = sock_kmalloc(sk, sizeof(struct ipv6_mc_socklist), GFP_KERNEL);
-
if (!mc_lst)
return -ENOMEM;
mc_lst->next = NULL;
mc_lst->addr = *addr;
- if (ifindex == 0) {
- struct rt6_info *rt;
-
- rcu_read_lock();
- rt = rt6_lookup(net, addr, NULL, 0, NULL, 0);
- if (rt) {
- dev = dst_dev(&rt->dst);
- dev_hold(dev);
- ip6_rt_put(rt);
- }
- rcu_read_unlock();
- } else {
- dev = dev_get_by_index(net, ifindex);
- }
-
+ dev = ip6_mc_find_dev(net, addr, ifindex);
if (!dev) {
sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
return -ENODEV;
@@ -302,27 +310,14 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
}
EXPORT_SYMBOL(ipv6_sock_mc_drop);
-static struct inet6_dev *ip6_mc_find_dev(struct net *net,
- const struct in6_addr *group,
- int ifindex)
+static struct inet6_dev *ip6_mc_find_idev(struct net *net,
+ const struct in6_addr *group,
+ int ifindex)
{
- struct net_device *dev = NULL;
+ struct net_device *dev;
struct inet6_dev *idev;
- if (ifindex == 0) {
- struct rt6_info *rt;
-
- rcu_read_lock();
- rt = rt6_lookup(net, group, NULL, 0, NULL, 0);
- if (rt) {
- dev = dst_dev(&rt->dst);
- dev_hold(dev);
- ip6_rt_put(rt);
- }
- rcu_read_unlock();
- } else {
- dev = dev_get_by_index(net, ifindex);
- }
+ dev = ip6_mc_find_dev(net, group, ifindex);
if (!dev)
return NULL;
@@ -374,7 +369,7 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
if (!ipv6_addr_is_multicast(group))
return -EINVAL;
- idev = ip6_mc_find_dev(net, group, pgsr->gsr_interface);
+ idev = ip6_mc_find_idev(net, group, pgsr->gsr_interface);
if (!idev)
return -ENODEV;
@@ -509,7 +504,7 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf,
gsf->gf_fmode != MCAST_EXCLUDE)
return -EINVAL;
- idev = ip6_mc_find_dev(net, group, gsf->gf_interface);
+ idev = ip6_mc_find_idev(net, group, gsf->gf_interface);
if (!idev)
return -ENODEV;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 286/563] ipv6: start using dst_dev_rcu()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (284 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 285/563] ipv6: mcast: Add ip6_mc_find_idev() helper Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 287/563] ipv6: use RCU in ip6_xmit() Greg Kroah-Hartman
` (290 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, David Ahern,
Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit b775ecf1655cedbc465fd6699ab18a2bc4e7a352 ]
Refactor icmpv6_xrlim_allow() and ip6_dst_hoplimit()
so that we acquire rcu_read_lock() a bit longer
to be able to use dst_dev_rcu() instead of dst_dev().
__ip6_rt_update_pmtu() and rt6_do_redirect can directly
use dst_dev_rcu() in sections already holding rcu_read_lock().
Small changes to use dst_dev_net_rcu() in
ip6_default_advmss(), ipv6_sock_ac_join(),
ip6_mc_find_dev() and ndisc_send_skb().
Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250828195823.3958522-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/anycast.c | 2 +-
net/ipv6/icmp.c | 6 +++---
net/ipv6/mcast.c | 2 +-
net/ipv6/ndisc.c | 2 +-
net/ipv6/output_core.c | 8 +++++---
net/ipv6/route.c | 7 +++----
6 files changed, 14 insertions(+), 13 deletions(-)
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index f8a8e46286b8e..52599584422bf 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -104,7 +104,7 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
rcu_read_lock();
rt = rt6_lookup(net, addr, NULL, 0, NULL, 0);
if (rt) {
- dev = dst_dev(&rt->dst);
+ dev = dst_dev_rcu(&rt->dst);
netdev_hold(dev, &dev_tracker, GFP_ATOMIC);
ip6_rt_put(rt);
} else if (ishost) {
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 44550957fd4e3..95cdd4cacb004 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -209,7 +209,8 @@ static bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
* this lookup should be more aggressive (not longer than timeout).
*/
dst = ip6_route_output(net, sk, fl6);
- dev = dst_dev(dst);
+ rcu_read_lock();
+ dev = dst_dev_rcu(dst);
if (dst->error) {
IP6_INC_STATS(net, ip6_dst_idev(dst),
IPSTATS_MIB_OUTNOROUTES);
@@ -224,11 +225,10 @@ static bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
if (rt->rt6i_dst.plen < 128)
tmo >>= ((128 - rt->rt6i_dst.plen)>>5);
- rcu_read_lock();
peer = inet_getpeer_v6(net->ipv6.peers, &fl6->daddr);
res = inet_peer_xrlim_allow(peer, tmo);
- rcu_read_unlock();
}
+ rcu_read_unlock();
if (!res)
__ICMP6_INC_STATS(net, ip6_dst_idev(dst),
ICMP6_MIB_RATELIMITHOST);
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 55c49dc14b1bd..016b572e7d6f0 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -180,7 +180,7 @@ static struct net_device *ip6_mc_find_dev(struct net *net,
rcu_read_lock();
rt = rt6_lookup(net, group, NULL, 0, NULL, 0);
if (rt) {
- dev = dst_dev(&rt->dst);
+ dev = dst_dev_rcu(&rt->dst);
dev_hold(dev);
ip6_rt_put(rt);
}
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 7d5abb3158ec9..d6bb1e2f6192e 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -505,7 +505,7 @@ void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr,
ip6_nd_hdr(skb, saddr, daddr, READ_ONCE(inet6_sk(sk)->hop_limit), skb->len);
- dev = dst_dev(dst);
+ dev = dst_dev_rcu(dst);
idev = __in6_dev_get(dev);
IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index d21fe27fe21e3..1c9b283a4132d 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -104,18 +104,20 @@ EXPORT_SYMBOL(ip6_find_1stfragopt);
int ip6_dst_hoplimit(struct dst_entry *dst)
{
int hoplimit = dst_metric_raw(dst, RTAX_HOPLIMIT);
+
+ rcu_read_lock();
if (hoplimit == 0) {
- struct net_device *dev = dst_dev(dst);
+ struct net_device *dev = dst_dev_rcu(dst);
struct inet6_dev *idev;
- rcu_read_lock();
idev = __in6_dev_get(dev);
if (idev)
hoplimit = READ_ONCE(idev->cnf.hop_limit);
else
hoplimit = READ_ONCE(dev_net(dev)->ipv6.devconf_all->hop_limit);
- rcu_read_unlock();
}
+ rcu_read_unlock();
+
return hoplimit;
}
EXPORT_SYMBOL(ip6_dst_hoplimit);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 3299cfa12e21c..3371f16b7a3e6 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2943,7 +2943,7 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
if (res.f6i->nh) {
struct fib6_nh_match_arg arg = {
- .dev = dst_dev(dst),
+ .dev = dst_dev_rcu(dst),
.gw = &rt6->rt6i_gateway,
};
@@ -3238,7 +3238,6 @@ EXPORT_SYMBOL_GPL(ip6_sk_redirect);
static unsigned int ip6_default_advmss(const struct dst_entry *dst)
{
- struct net_device *dev = dst_dev(dst);
unsigned int mtu = dst_mtu(dst);
struct net *net;
@@ -3246,7 +3245,7 @@ static unsigned int ip6_default_advmss(const struct dst_entry *dst)
rcu_read_lock();
- net = dev_net_rcu(dev);
+ net = dst_dev_net_rcu(dst);
if (mtu < net->ipv6.sysctl.ip6_rt_min_advmss)
mtu = net->ipv6.sysctl.ip6_rt_min_advmss;
@@ -4301,7 +4300,7 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu
if (res.f6i->nh) {
struct fib6_nh_match_arg arg = {
- .dev = dst_dev(dst),
+ .dev = dst_dev_rcu(dst),
.gw = &rt->rt6i_gateway,
};
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 287/563] ipv6: use RCU in ip6_xmit()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (285 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 286/563] ipv6: start using dst_dev_rcu() Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 288/563] ipv6: use RCU in ip6_output() Greg Kroah-Hartman
` (289 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, David Ahern,
Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 9085e56501d93af9f2d7bd16f7fcfacdde47b99c ]
Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent
possible UAF.
Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250828195823.3958522-4-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/ip6_output.c | 35 +++++++++++++++++++++--------------
1 file changed, 21 insertions(+), 14 deletions(-)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 1e1410237b6ef..e234640433d6b 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -268,35 +268,36 @@ bool ip6_autoflowlabel(struct net *net, const struct sock *sk)
int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
__u32 mark, struct ipv6_txoptions *opt, int tclass, u32 priority)
{
- struct net *net = sock_net(sk);
const struct ipv6_pinfo *np = inet6_sk(sk);
struct in6_addr *first_hop = &fl6->daddr;
struct dst_entry *dst = skb_dst(skb);
- struct net_device *dev = dst_dev(dst);
struct inet6_dev *idev = ip6_dst_idev(dst);
struct hop_jumbo_hdr *hop_jumbo;
int hoplen = sizeof(*hop_jumbo);
+ struct net *net = sock_net(sk);
unsigned int head_room;
+ struct net_device *dev;
struct ipv6hdr *hdr;
u8 proto = fl6->flowi6_proto;
int seg_len = skb->len;
- int hlimit = -1;
+ int ret, hlimit = -1;
u32 mtu;
+ rcu_read_lock();
+
+ dev = dst_dev_rcu(dst);
head_room = sizeof(struct ipv6hdr) + hoplen + LL_RESERVED_SPACE(dev);
if (opt)
head_room += opt->opt_nflen + opt->opt_flen;
if (unlikely(head_room > skb_headroom(skb))) {
- /* Make sure idev stays alive */
- rcu_read_lock();
+ /* idev stays alive while we hold rcu_read_lock(). */
skb = skb_expand_head(skb, head_room);
if (!skb) {
IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
- rcu_read_unlock();
- return -ENOBUFS;
+ ret = -ENOBUFS;
+ goto unlock;
}
- rcu_read_unlock();
}
if (opt) {
@@ -358,17 +359,21 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
* skb to its handler for processing
*/
skb = l3mdev_ip6_out((struct sock *)sk, skb);
- if (unlikely(!skb))
- return 0;
+ if (unlikely(!skb)) {
+ ret = 0;
+ goto unlock;
+ }
/* hooks should never assume socket lock is held.
* we promote our socket to non const
*/
- return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
- net, (struct sock *)sk, skb, NULL, dev,
- dst_output);
+ ret = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
+ net, (struct sock *)sk, skb, NULL, dev,
+ dst_output);
+ goto unlock;
}
+ ret = -EMSGSIZE;
skb->dev = dev;
/* ipv6_local_error() does not require socket lock,
* we promote our socket to non const
@@ -377,7 +382,9 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
IP6_INC_STATS(net, idev, IPSTATS_MIB_FRAGFAILS);
kfree_skb(skb);
- return -EMSGSIZE;
+unlock:
+ rcu_read_unlock();
+ return ret;
}
EXPORT_SYMBOL(ip6_xmit);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 288/563] ipv6: use RCU in ip6_output()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (286 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 287/563] ipv6: use RCU in ip6_xmit() Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 289/563] net: use dst_dev_rcu() in sk_setup_caps() Greg Kroah-Hartman
` (288 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, David Ahern,
Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 11709573cc4e48dc34c80fc7ab9ce5b159e29695 ]
Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent
possible UAF.
We can remove rcu_read_lock()/rcu_read_unlock() pairs
from ip6_finish_output2().
Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250828195823.3958522-5-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/ip6_output.c | 29 +++++++++++++++--------------
1 file changed, 15 insertions(+), 14 deletions(-)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index e234640433d6b..9d64c13bab5ea 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -60,7 +60,7 @@
static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *skb)
{
struct dst_entry *dst = skb_dst(skb);
- struct net_device *dev = dst_dev(dst);
+ struct net_device *dev = dst_dev_rcu(dst);
struct inet6_dev *idev = ip6_dst_idev(dst);
unsigned int hh_len = LL_RESERVED_SPACE(dev);
const struct in6_addr *daddr, *nexthop;
@@ -70,15 +70,12 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *
/* Be paranoid, rather than too clever. */
if (unlikely(hh_len > skb_headroom(skb)) && dev->header_ops) {
- /* Make sure idev stays alive */
- rcu_read_lock();
+ /* idev stays alive because we hold rcu_read_lock(). */
skb = skb_expand_head(skb, hh_len);
if (!skb) {
IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
- rcu_read_unlock();
return -ENOMEM;
}
- rcu_read_unlock();
}
hdr = ipv6_hdr(skb);
@@ -123,7 +120,6 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *
IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
- rcu_read_lock();
nexthop = rt6_nexthop(dst_rt6_info(dst), daddr);
neigh = __ipv6_neigh_lookup_noref(dev, nexthop);
@@ -131,7 +127,6 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *
if (unlikely(!neigh))
neigh = __neigh_create(&nd_tbl, nexthop, dev, false);
if (IS_ERR(neigh)) {
- rcu_read_unlock();
IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTNOROUTES);
kfree_skb_reason(skb, SKB_DROP_REASON_NEIGH_CREATEFAIL);
return -EINVAL;
@@ -139,7 +134,6 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *
}
sock_confirm_neigh(skb, neigh);
ret = neigh_output(neigh, skb, false);
- rcu_read_unlock();
return ret;
}
@@ -233,22 +227,29 @@ static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *s
int ip6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
{
struct dst_entry *dst = skb_dst(skb);
- struct net_device *dev = dst_dev(dst), *indev = skb->dev;
- struct inet6_dev *idev = ip6_dst_idev(dst);
+ struct net_device *dev, *indev = skb->dev;
+ struct inet6_dev *idev;
+ int ret;
skb->protocol = htons(ETH_P_IPV6);
+ rcu_read_lock();
+ dev = dst_dev_rcu(dst);
+ idev = ip6_dst_idev(dst);
skb->dev = dev;
if (unlikely(!idev || READ_ONCE(idev->cnf.disable_ipv6))) {
IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
+ rcu_read_unlock();
kfree_skb_reason(skb, SKB_DROP_REASON_IPV6DISABLED);
return 0;
}
- return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING,
- net, sk, skb, indev, dev,
- ip6_finish_output,
- !(IP6CB(skb)->flags & IP6SKB_REROUTED));
+ ret = NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING,
+ net, sk, skb, indev, dev,
+ ip6_finish_output,
+ !(IP6CB(skb)->flags & IP6SKB_REROUTED));
+ rcu_read_unlock();
+ return ret;
}
EXPORT_SYMBOL(ip6_output);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 289/563] net: use dst_dev_rcu() in sk_setup_caps()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (287 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 288/563] ipv6: use RCU in ip6_output() Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 290/563] tcp_metrics: use dst_dev_net_rcu() Greg Kroah-Hartman
` (287 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, David Ahern,
Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 99a2ace61b211b0be861b07fbaa062fca4b58879 ]
Use RCU to protect accesses to dst->dev from sk_setup_caps()
and sk_dst_gso_max_size().
Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(),
and ip_dst_mtu_maybe_forward().
ip4_dst_hoplimit() can use dst_dev_net_rcu().
Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250828195823.3958522-6-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/ip.h | 6 ++++--
include/net/ip6_route.h | 2 +-
include/net/route.h | 2 +-
net/core/sock.c | 16 ++++++++++------
4 files changed, 16 insertions(+), 10 deletions(-)
diff --git a/include/net/ip.h b/include/net/ip.h
index befcba575129a..6dbd2bf8fa9c9 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -467,12 +467,14 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
bool forwarding)
{
const struct rtable *rt = dst_rtable(dst);
+ const struct net_device *dev;
unsigned int mtu, res;
struct net *net;
rcu_read_lock();
- net = dev_net_rcu(dst_dev(dst));
+ dev = dst_dev_rcu(dst);
+ net = dev_net_rcu(dev);
if (READ_ONCE(net->ipv4.sysctl_ip_fwd_use_pmtu) ||
ip_mtu_locked(dst) ||
!forwarding) {
@@ -486,7 +488,7 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
if (mtu)
goto out;
- mtu = READ_ONCE(dst_dev(dst)->mtu);
+ mtu = READ_ONCE(dev->mtu);
if (unlikely(ip_mtu_locked(dst))) {
if (rt->rt_uses_gateway && mtu > 576)
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 9255f21818ee7..59f48ca3abdf5 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -337,7 +337,7 @@ static inline unsigned int ip6_dst_mtu_maybe_forward(const struct dst_entry *dst
mtu = IPV6_MIN_MTU;
rcu_read_lock();
- idev = __in6_dev_get(dst_dev(dst));
+ idev = __in6_dev_get(dst_dev_rcu(dst));
if (idev)
mtu = READ_ONCE(idev->cnf.mtu6);
rcu_read_unlock();
diff --git a/include/net/route.h b/include/net/route.h
index 7ea840daa775b..c916bbe25a774 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -390,7 +390,7 @@ static inline int ip4_dst_hoplimit(const struct dst_entry *dst)
const struct net *net;
rcu_read_lock();
- net = dev_net_rcu(dst_dev(dst));
+ net = dst_dev_net_rcu(dst);
hoplimit = READ_ONCE(net->ipv4.sysctl_ip_default_ttl);
rcu_read_unlock();
}
diff --git a/net/core/sock.c b/net/core/sock.c
index 158bddd23134c..e21348ead7e76 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2584,7 +2584,7 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
}
EXPORT_SYMBOL_GPL(sk_clone_lock);
-static u32 sk_dst_gso_max_size(struct sock *sk, struct dst_entry *dst)
+static u32 sk_dst_gso_max_size(struct sock *sk, const struct net_device *dev)
{
bool is_ipv6 = false;
u32 max_size;
@@ -2594,8 +2594,8 @@ static u32 sk_dst_gso_max_size(struct sock *sk, struct dst_entry *dst)
!ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr));
#endif
/* pairs with the WRITE_ONCE() in netif_set_gso(_ipv4)_max_size() */
- max_size = is_ipv6 ? READ_ONCE(dst_dev(dst)->gso_max_size) :
- READ_ONCE(dst_dev(dst)->gso_ipv4_max_size);
+ max_size = is_ipv6 ? READ_ONCE(dev->gso_max_size) :
+ READ_ONCE(dev->gso_ipv4_max_size);
if (max_size > GSO_LEGACY_MAX_SIZE && !sk_is_tcp(sk))
max_size = GSO_LEGACY_MAX_SIZE;
@@ -2604,9 +2604,12 @@ static u32 sk_dst_gso_max_size(struct sock *sk, struct dst_entry *dst)
void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
{
+ const struct net_device *dev;
u32 max_segs = 1;
- sk->sk_route_caps = dst_dev(dst)->features;
+ rcu_read_lock();
+ dev = dst_dev_rcu(dst);
+ sk->sk_route_caps = dev->features;
if (sk_is_tcp(sk)) {
struct inet_connection_sock *icsk = inet_csk(sk);
@@ -2622,13 +2625,14 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
} else {
sk->sk_route_caps |= NETIF_F_SG | NETIF_F_HW_CSUM;
- sk->sk_gso_max_size = sk_dst_gso_max_size(sk, dst);
+ sk->sk_gso_max_size = sk_dst_gso_max_size(sk, dev);
/* pairs with the WRITE_ONCE() in netif_set_gso_max_segs() */
- max_segs = max_t(u32, READ_ONCE(dst_dev(dst)->gso_max_segs), 1);
+ max_segs = max_t(u32, READ_ONCE(dev->gso_max_segs), 1);
}
}
sk->sk_gso_max_segs = max_segs;
sk_dst_set(sk, dst);
+ rcu_read_unlock();
}
EXPORT_SYMBOL_GPL(sk_setup_caps);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 290/563] tcp_metrics: use dst_dev_net_rcu()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (288 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 289/563] net: use dst_dev_rcu() in sk_setup_caps() Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 291/563] ipv4: start using dst_dev_rcu() Greg Kroah-Hartman
` (286 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, David Ahern,
Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 50c127a69cd6285300931853b352a1918cfa180f ]
Replace three dst_dev() with a lockdep enabled helper.
Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250828195823.3958522-7-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/tcp_metrics.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index 03c068ea27b6a..10e86f1008e9d 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -170,7 +170,7 @@ static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst,
struct net *net;
spin_lock_bh(&tcp_metrics_lock);
- net = dev_net_rcu(dst_dev(dst));
+ net = dst_dev_net_rcu(dst);
/* While waiting for the spin-lock the cache might have been populated
* with this entry and so we have to check again.
@@ -273,7 +273,7 @@ static struct tcp_metrics_block *__tcp_get_metrics_req(struct request_sock *req,
return NULL;
}
- net = dev_net_rcu(dst_dev(dst));
+ net = dst_dev_net_rcu(dst);
hash ^= net_hash_mix(net);
hash = hash_32(hash, tcp_metrics_hash_log);
@@ -318,7 +318,7 @@ static struct tcp_metrics_block *tcp_get_metrics(struct sock *sk,
else
return NULL;
- net = dev_net_rcu(dst_dev(dst));
+ net = dst_dev_net_rcu(dst);
hash ^= net_hash_mix(net);
hash = hash_32(hash, tcp_metrics_hash_log);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 291/563] ipv4: start using dst_dev_rcu()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (289 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 290/563] tcp_metrics: use dst_dev_net_rcu() Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 292/563] crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations Greg Kroah-Hartman
` (285 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, David Ahern,
Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8 ]
Change icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF.
Change ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(),
ipv4_neigh_lookup() to use lockdep enabled dst_dev_rcu().
Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250828195823.3958522-9-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/icmp.c | 6 +++---
net/ipv4/ip_fragment.c | 6 ++++--
net/ipv4/ipmr.c | 6 +++---
net/ipv4/route.c | 4 ++--
4 files changed, 12 insertions(+), 10 deletions(-)
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index c48c572f024da..1be0d91620a38 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -318,17 +318,17 @@ static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt,
return true;
/* No rate limit on loopback */
- dev = dst_dev(dst);
+ rcu_read_lock();
+ dev = dst_dev_rcu(dst);
if (dev && (dev->flags & IFF_LOOPBACK))
goto out;
- rcu_read_lock();
peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr,
l3mdev_master_ifindex_rcu(dev));
rc = inet_peer_xrlim_allow(peer,
READ_ONCE(net->ipv4.sysctl_icmp_ratelimit));
- rcu_read_unlock();
out:
+ rcu_read_unlock();
if (!rc)
__ICMP_INC_STATS(net, ICMP_MIB_RATELIMITHOST);
else
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index b2584cce90ae1..f7012479713ba 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -476,14 +476,16 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
/* Process an incoming IP datagram fragment. */
int ip_defrag(struct net *net, struct sk_buff *skb, u32 user)
{
- struct net_device *dev = skb->dev ? : skb_dst_dev(skb);
- int vif = l3mdev_master_ifindex_rcu(dev);
+ struct net_device *dev;
struct ipq *qp;
+ int vif;
__IP_INC_STATS(net, IPSTATS_MIB_REASMREQDS);
/* Lookup (or create) queue header */
rcu_read_lock();
+ dev = skb->dev ? : skb_dst_dev_rcu(skb);
+ vif = l3mdev_master_ifindex_rcu(dev);
qp = ip_find(net, ip_hdr(skb), user, vif);
if (qp) {
int ret, refs = 0;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index e86a8a862c411..8c568fbddb5fb 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1904,7 +1904,7 @@ static int ipmr_prepare_xmit(struct net *net, struct mr_table *mrt,
return -1;
}
- encap += LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len;
+ encap += LL_RESERVED_SPACE(dst_dev_rcu(&rt->dst)) + rt->dst.header_len;
if (skb_cow(skb, encap)) {
ip_rt_put(rt);
@@ -1957,7 +1957,7 @@ static void ipmr_queue_fwd_xmit(struct net *net, struct mr_table *mrt,
* result in receiving multiple packets.
*/
NF_HOOK(NFPROTO_IPV4, NF_INET_FORWARD,
- net, NULL, skb, skb->dev, rt->dst.dev,
+ net, NULL, skb, skb->dev, dst_dev_rcu(&rt->dst),
ipmr_forward_finish);
return;
@@ -2301,7 +2301,7 @@ int ip_mr_output(struct net *net, struct sock *sk, struct sk_buff *skb)
guard(rcu)();
- dev = rt->dst.dev;
+ dev = dst_dev_rcu(&rt->dst);
if (IPCB(skb)->flags & IPSKB_FORWARDED)
goto mc_output;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 97b96275a775d..5582ccd673eeb 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -413,11 +413,11 @@ static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
const void *daddr)
{
const struct rtable *rt = container_of(dst, struct rtable, dst);
- struct net_device *dev = dst_dev(dst);
+ struct net_device *dev;
struct neighbour *n;
rcu_read_lock();
-
+ dev = dst_dev_rcu(dst);
if (likely(rt->rt_gw_family == AF_INET)) {
n = ip_neigh_gw4(dev, rt->rt_gw4);
} else if (rt->rt_gw_family == AF_INET6) {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 292/563] crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (290 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 291/563] ipv4: start using dst_dev_rcu() Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 293/563] crypto: hisilicon - re-enable address prefetch after device resuming Greg Kroah-Hartman
` (284 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chenghai Huang, Herbert Xu,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenghai Huang <huangchenghai2@huawei.com>
[ Upstream commit d4e081510471e79171c4e0a11f6cb608e49bc082 ]
When configuring the high-performance mode register, there is no
need to verify whether the register has been successfully
enabled, as there is no possibility of a write failure for this
register.
Fixes: a9864bae1806 ("crypto: hisilicon/zip - add zip comp high perf mode configuration")
Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/hisilicon/zip/zip_main.c | 14 ++------------
1 file changed, 2 insertions(+), 12 deletions(-)
diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
index d8ba23b7cc7dd..fb7b19927dd32 100644
--- a/drivers/crypto/hisilicon/zip/zip_main.c
+++ b/drivers/crypto/hisilicon/zip/zip_main.c
@@ -448,10 +448,9 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg)
return false;
}
-static int hisi_zip_set_high_perf(struct hisi_qm *qm)
+static void hisi_zip_set_high_perf(struct hisi_qm *qm)
{
u32 val;
- int ret;
val = readl_relaxed(qm->io_base + HZIP_HIGH_PERF_OFFSET);
if (perf_mode == HZIP_HIGH_COMP_PERF)
@@ -461,13 +460,6 @@ static int hisi_zip_set_high_perf(struct hisi_qm *qm)
/* Set perf mode */
writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET);
- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_HIGH_PERF_OFFSET,
- val, val == perf_mode, HZIP_DELAY_1_US,
- HZIP_POLL_TIMEOUT_US);
- if (ret)
- pci_err(qm->pdev, "failed to set perf mode\n");
-
- return ret;
}
static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
@@ -1251,9 +1243,7 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
if (ret)
return ret;
- ret = hisi_zip_set_high_perf(qm);
- if (ret)
- return ret;
+ hisi_zip_set_high_perf(qm);
hisi_zip_open_sva_prefetch(qm);
hisi_qm_dev_err_init(qm);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 293/563] crypto: hisilicon - re-enable address prefetch after device resuming
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (291 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 292/563] crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 294/563] crypto: hisilicon - check the sva module status while enabling or disabling address prefetch Greg Kroah-Hartman
` (283 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chenghai Huang, Herbert Xu,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenghai Huang <huangchenghai2@huawei.com>
[ Upstream commit 0dcd21443d9308ed88909d35aa0490c3fc680a47 ]
When the device resumes from a suspended state, it will revert to its
initial state and requires re-enabling. Currently, the address prefetch
function is not re-enabled after device resuming. Move the address prefetch
enable to the initialization process. In this way, the address prefetch
can be enabled when the device resumes by calling the initialization
process.
Fixes: 607c191b371d ("crypto: hisilicon - support runtime PM for accelerator device")
Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/hisilicon/hpre/hpre_main.c | 3 +-
drivers/crypto/hisilicon/qm.c | 3 -
drivers/crypto/hisilicon/sec2/sec_main.c | 80 +++++++++++------------
drivers/crypto/hisilicon/zip/zip_main.c | 5 +-
4 files changed, 43 insertions(+), 48 deletions(-)
diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
index f5b47e5ff48a4..34f84978180f0 100644
--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
+++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
@@ -721,6 +721,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm)
/* Config data buffer pasid needed by Kunpeng 920 */
hpre_config_pasid(qm);
+ hpre_open_sva_prefetch(qm);
hpre_enable_clock_gate(qm);
@@ -1450,8 +1451,6 @@ static int hpre_pf_probe_init(struct hpre *hpre)
if (ret)
return ret;
- hpre_open_sva_prefetch(qm);
-
hisi_qm_dev_err_init(qm);
ret = hpre_show_last_regs_init(qm);
if (ret)
diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
index 2e4ee7ecfdfbb..a5cc0ccd94f1f 100644
--- a/drivers/crypto/hisilicon/qm.c
+++ b/drivers/crypto/hisilicon/qm.c
@@ -4447,9 +4447,6 @@ static void qm_restart_prepare(struct hisi_qm *qm)
{
u32 value;
- if (qm->err_ini->open_sva_prefetch)
- qm->err_ini->open_sva_prefetch(qm);
-
if (qm->ver >= QM_HW_V3)
return;
diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
index 72cf48d1f3ab8..ddb20f380b546 100644
--- a/drivers/crypto/hisilicon/sec2/sec_main.c
+++ b/drivers/crypto/hisilicon/sec2/sec_main.c
@@ -464,6 +464,45 @@ static void sec_set_endian(struct hisi_qm *qm)
writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG);
}
+static void sec_close_sva_prefetch(struct hisi_qm *qm)
+{
+ u32 val;
+ int ret;
+
+ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+ return;
+
+ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
+ val |= SEC_PREFETCH_DISABLE;
+ writel(val, qm->io_base + SEC_PREFETCH_CFG);
+
+ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS,
+ val, !(val & SEC_SVA_DISABLE_READY),
+ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+ if (ret)
+ pci_err(qm->pdev, "failed to close sva prefetch\n");
+}
+
+static void sec_open_sva_prefetch(struct hisi_qm *qm)
+{
+ u32 val;
+ int ret;
+
+ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+ return;
+
+ /* Enable prefetch */
+ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
+ val &= SEC_PREFETCH_ENABLE;
+ writel(val, qm->io_base + SEC_PREFETCH_CFG);
+
+ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
+ val, !(val & SEC_PREFETCH_DISABLE),
+ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+ if (ret)
+ pci_err(qm->pdev, "failed to open sva prefetch\n");
+}
+
static void sec_engine_sva_config(struct hisi_qm *qm)
{
u32 reg;
@@ -497,45 +536,7 @@ static void sec_engine_sva_config(struct hisi_qm *qm)
writel_relaxed(reg, qm->io_base +
SEC_INTERFACE_USER_CTRL1_REG);
}
-}
-
-static void sec_open_sva_prefetch(struct hisi_qm *qm)
-{
- u32 val;
- int ret;
-
- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
- return;
-
- /* Enable prefetch */
- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
- val &= SEC_PREFETCH_ENABLE;
- writel(val, qm->io_base + SEC_PREFETCH_CFG);
-
- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
- val, !(val & SEC_PREFETCH_DISABLE),
- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
- if (ret)
- pci_err(qm->pdev, "failed to open sva prefetch\n");
-}
-
-static void sec_close_sva_prefetch(struct hisi_qm *qm)
-{
- u32 val;
- int ret;
-
- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
- return;
-
- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
- val |= SEC_PREFETCH_DISABLE;
- writel(val, qm->io_base + SEC_PREFETCH_CFG);
-
- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS,
- val, !(val & SEC_SVA_DISABLE_READY),
- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
- if (ret)
- pci_err(qm->pdev, "failed to close sva prefetch\n");
+ sec_open_sva_prefetch(qm);
}
static void sec_enable_clock_gate(struct hisi_qm *qm)
@@ -1152,7 +1153,6 @@ static int sec_pf_probe_init(struct sec_dev *sec)
if (ret)
return ret;
- sec_open_sva_prefetch(qm);
hisi_qm_dev_err_init(qm);
sec_debug_regs_clear(qm);
ret = sec_show_last_regs_init(qm);
diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
index fb7b19927dd32..480fa590664a8 100644
--- a/drivers/crypto/hisilicon/zip/zip_main.c
+++ b/drivers/crypto/hisilicon/zip/zip_main.c
@@ -557,6 +557,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
writel(AXUSER_BASE, base + HZIP_DATA_WUSER_32_63);
writel(AXUSER_BASE, base + HZIP_SGL_RUSER_32_63);
}
+ hisi_zip_open_sva_prefetch(qm);
/* let's open all compression/decompression cores */
@@ -572,6 +573,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
CQC_CACHE_WB_ENABLE | FIELD_PREP(SQC_CACHE_WB_THRD, 1) |
FIELD_PREP(CQC_CACHE_WB_THRD, 1), base + QM_CACHE_CTL);
+ hisi_zip_set_high_perf(qm);
hisi_zip_enable_clock_gate(qm);
return hisi_dae_set_user_domain(qm);
@@ -1243,9 +1245,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
if (ret)
return ret;
- hisi_zip_set_high_perf(qm);
-
- hisi_zip_open_sva_prefetch(qm);
hisi_qm_dev_err_init(qm);
hisi_zip_debug_regs_clear(qm);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 294/563] crypto: hisilicon - check the sva module status while enabling or disabling address prefetch
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (292 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 293/563] crypto: hisilicon - re-enable address prefetch after device resuming Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 295/563] crypto: hisilicon/qm - check whether the input function and PF are on the same device Greg Kroah-Hartman
` (282 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weili Qian, Chenghai Huang,
Herbert Xu, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <qianweili@huawei.com>
[ Upstream commit 1f9128f121a872f27251be60ccccfd98c136d72e ]
After enabling address prefetch, check the sva module status. If all
previous prefetch requests from the sva module are not completed, then
disable the address prefetch to ensure normal execution of new task
operations. After disabling address prefetch, check if all requests
from the sva module have been completed.
Fixes: a5c164b195a8 ("crypto: hisilicon/qm - support address prefetching")
Signed-off-by: Weili Qian <qianweili@huawei.com>
Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/hisilicon/hpre/hpre_main.c | 63 ++++++++++++++----
drivers/crypto/hisilicon/sec2/sec_main.c | 48 +++++++++++++-
drivers/crypto/hisilicon/zip/zip_main.c | 79 +++++++++++++++++++----
3 files changed, 164 insertions(+), 26 deletions(-)
diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
index 34f84978180f0..7b60e89015bdf 100644
--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
+++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
@@ -78,6 +78,11 @@
#define HPRE_PREFETCH_ENABLE (~(BIT(0) | BIT(30)))
#define HPRE_PREFETCH_DISABLE BIT(30)
#define HPRE_SVA_DISABLE_READY (BIT(4) | BIT(8))
+#define HPRE_SVA_PREFTCH_DFX4 0x301144
+#define HPRE_WAIT_SVA_READY 500000
+#define HPRE_READ_SVA_STATUS_TIMES 3
+#define HPRE_WAIT_US_MIN 10
+#define HPRE_WAIT_US_MAX 20
/* clock gate */
#define HPRE_CLKGATE_CTL 0x301a10
@@ -466,6 +471,33 @@ struct hisi_qp *hpre_create_qp(u8 type)
return NULL;
}
+static int hpre_wait_sva_ready(struct hisi_qm *qm)
+{
+ u32 val, try_times = 0;
+ u8 count = 0;
+
+ /*
+ * Read the register value every 10-20us. If the value is 0 for three
+ * consecutive times, the SVA module is ready.
+ */
+ do {
+ val = readl(qm->io_base + HPRE_SVA_PREFTCH_DFX4);
+ if (val)
+ count = 0;
+ else if (++count == HPRE_READ_SVA_STATUS_TIMES)
+ break;
+
+ usleep_range(HPRE_WAIT_US_MIN, HPRE_WAIT_US_MAX);
+ } while (++try_times < HPRE_WAIT_SVA_READY);
+
+ if (try_times == HPRE_WAIT_SVA_READY) {
+ pci_err(qm->pdev, "failed to wait sva prefetch ready\n");
+ return -ETIMEDOUT;
+ }
+
+ return 0;
+}
+
static void hpre_config_pasid(struct hisi_qm *qm)
{
u32 val1, val2;
@@ -563,7 +595,7 @@ static void disable_flr_of_bme(struct hisi_qm *qm)
writel(PEH_AXUSER_CFG_ENABLE, qm->io_base + QM_PEH_AXUSER_CFG_ENABLE);
}
-static void hpre_open_sva_prefetch(struct hisi_qm *qm)
+static void hpre_close_sva_prefetch(struct hisi_qm *qm)
{
u32 val;
int ret;
@@ -571,20 +603,21 @@ static void hpre_open_sva_prefetch(struct hisi_qm *qm)
if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
return;
- /* Enable prefetch */
val = readl_relaxed(qm->io_base + HPRE_PREFETCH_CFG);
- val &= HPRE_PREFETCH_ENABLE;
+ val |= HPRE_PREFETCH_DISABLE;
writel(val, qm->io_base + HPRE_PREFETCH_CFG);
- ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_PREFETCH_CFG,
- val, !(val & HPRE_PREFETCH_DISABLE),
+ ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_SVA_PREFTCH_DFX,
+ val, !(val & HPRE_SVA_DISABLE_READY),
HPRE_REG_RD_INTVRL_US,
HPRE_REG_RD_TMOUT_US);
if (ret)
- pci_err(qm->pdev, "failed to open sva prefetch\n");
+ pci_err(qm->pdev, "failed to close sva prefetch\n");
+
+ (void)hpre_wait_sva_ready(qm);
}
-static void hpre_close_sva_prefetch(struct hisi_qm *qm)
+static void hpre_open_sva_prefetch(struct hisi_qm *qm)
{
u32 val;
int ret;
@@ -592,16 +625,24 @@ static void hpre_close_sva_prefetch(struct hisi_qm *qm)
if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
return;
+ /* Enable prefetch */
val = readl_relaxed(qm->io_base + HPRE_PREFETCH_CFG);
- val |= HPRE_PREFETCH_DISABLE;
+ val &= HPRE_PREFETCH_ENABLE;
writel(val, qm->io_base + HPRE_PREFETCH_CFG);
- ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_SVA_PREFTCH_DFX,
- val, !(val & HPRE_SVA_DISABLE_READY),
+ ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_PREFETCH_CFG,
+ val, !(val & HPRE_PREFETCH_DISABLE),
HPRE_REG_RD_INTVRL_US,
HPRE_REG_RD_TMOUT_US);
+ if (ret) {
+ pci_err(qm->pdev, "failed to open sva prefetch\n");
+ hpre_close_sva_prefetch(qm);
+ return;
+ }
+
+ ret = hpre_wait_sva_ready(qm);
if (ret)
- pci_err(qm->pdev, "failed to close sva prefetch\n");
+ hpre_close_sva_prefetch(qm);
}
static void hpre_enable_clock_gate(struct hisi_qm *qm)
diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
index ddb20f380b546..348f1f52956dc 100644
--- a/drivers/crypto/hisilicon/sec2/sec_main.c
+++ b/drivers/crypto/hisilicon/sec2/sec_main.c
@@ -93,6 +93,16 @@
#define SEC_PREFETCH_ENABLE (~(BIT(0) | BIT(1) | BIT(11)))
#define SEC_PREFETCH_DISABLE BIT(1)
#define SEC_SVA_DISABLE_READY (BIT(7) | BIT(11))
+#define SEC_SVA_PREFETCH_INFO 0x301ED4
+#define SEC_SVA_STALL_NUM GENMASK(23, 8)
+#define SEC_SVA_PREFETCH_NUM GENMASK(2, 0)
+#define SEC_WAIT_SVA_READY 500000
+#define SEC_READ_SVA_STATUS_TIMES 3
+#define SEC_WAIT_US_MIN 10
+#define SEC_WAIT_US_MAX 20
+#define SEC_WAIT_QP_US_MIN 1000
+#define SEC_WAIT_QP_US_MAX 2000
+#define SEC_MAX_WAIT_TIMES 2000
#define SEC_DELAY_10_US 10
#define SEC_POLL_TIMEOUT_US 1000
@@ -464,6 +474,33 @@ static void sec_set_endian(struct hisi_qm *qm)
writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG);
}
+static int sec_wait_sva_ready(struct hisi_qm *qm, __u32 offset, __u32 mask)
+{
+ u32 val, try_times = 0;
+ u8 count = 0;
+
+ /*
+ * Read the register value every 10-20us. If the value is 0 for three
+ * consecutive times, the SVA module is ready.
+ */
+ do {
+ val = readl(qm->io_base + offset);
+ if (val & mask)
+ count = 0;
+ else if (++count == SEC_READ_SVA_STATUS_TIMES)
+ break;
+
+ usleep_range(SEC_WAIT_US_MIN, SEC_WAIT_US_MAX);
+ } while (++try_times < SEC_WAIT_SVA_READY);
+
+ if (try_times == SEC_WAIT_SVA_READY) {
+ pci_err(qm->pdev, "failed to wait sva prefetch ready\n");
+ return -ETIMEDOUT;
+ }
+
+ return 0;
+}
+
static void sec_close_sva_prefetch(struct hisi_qm *qm)
{
u32 val;
@@ -481,6 +518,8 @@ static void sec_close_sva_prefetch(struct hisi_qm *qm)
SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
if (ret)
pci_err(qm->pdev, "failed to close sva prefetch\n");
+
+ (void)sec_wait_sva_ready(qm, SEC_SVA_PREFETCH_INFO, SEC_SVA_STALL_NUM);
}
static void sec_open_sva_prefetch(struct hisi_qm *qm)
@@ -499,8 +538,15 @@ static void sec_open_sva_prefetch(struct hisi_qm *qm)
ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
val, !(val & SEC_PREFETCH_DISABLE),
SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
- if (ret)
+ if (ret) {
pci_err(qm->pdev, "failed to open sva prefetch\n");
+ sec_close_sva_prefetch(qm);
+ return;
+ }
+
+ ret = sec_wait_sva_ready(qm, SEC_SVA_TRANS, SEC_SVA_PREFETCH_NUM);
+ if (ret)
+ sec_close_sva_prefetch(qm);
}
static void sec_engine_sva_config(struct hisi_qm *qm)
diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
index 480fa590664a8..341c4564e21aa 100644
--- a/drivers/crypto/hisilicon/zip/zip_main.c
+++ b/drivers/crypto/hisilicon/zip/zip_main.c
@@ -95,10 +95,16 @@
#define HZIP_PREFETCH_ENABLE (~(BIT(26) | BIT(17) | BIT(0)))
#define HZIP_SVA_PREFETCH_DISABLE BIT(26)
#define HZIP_SVA_DISABLE_READY (BIT(26) | BIT(30))
+#define HZIP_SVA_PREFETCH_NUM GENMASK(18, 16)
+#define HZIP_SVA_STALL_NUM GENMASK(15, 0)
#define HZIP_SHAPER_RATE_COMPRESS 750
#define HZIP_SHAPER_RATE_DECOMPRESS 140
-#define HZIP_DELAY_1_US 1
-#define HZIP_POLL_TIMEOUT_US 1000
+#define HZIP_DELAY_1_US 1
+#define HZIP_POLL_TIMEOUT_US 1000
+#define HZIP_WAIT_SVA_READY 500000
+#define HZIP_READ_SVA_STATUS_TIMES 3
+#define HZIP_WAIT_US_MIN 10
+#define HZIP_WAIT_US_MAX 20
/* clock gating */
#define HZIP_PEH_CFG_AUTO_GATE 0x3011A8
@@ -462,7 +468,34 @@ static void hisi_zip_set_high_perf(struct hisi_qm *qm)
writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET);
}
-static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
+static int hisi_zip_wait_sva_ready(struct hisi_qm *qm, __u32 offset, __u32 mask)
+{
+ u32 val, try_times = 0;
+ u8 count = 0;
+
+ /*
+ * Read the register value every 10-20us. If the value is 0 for three
+ * consecutive times, the SVA module is ready.
+ */
+ do {
+ val = readl(qm->io_base + offset);
+ if (val & mask)
+ count = 0;
+ else if (++count == HZIP_READ_SVA_STATUS_TIMES)
+ break;
+
+ usleep_range(HZIP_WAIT_US_MIN, HZIP_WAIT_US_MAX);
+ } while (++try_times < HZIP_WAIT_SVA_READY);
+
+ if (try_times == HZIP_WAIT_SVA_READY) {
+ pci_err(qm->pdev, "failed to wait sva prefetch ready\n");
+ return -ETIMEDOUT;
+ }
+
+ return 0;
+}
+
+static void hisi_zip_close_sva_prefetch(struct hisi_qm *qm)
{
u32 val;
int ret;
@@ -470,19 +503,20 @@ static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
return;
- /* Enable prefetch */
val = readl_relaxed(qm->io_base + HZIP_PREFETCH_CFG);
- val &= HZIP_PREFETCH_ENABLE;
+ val |= HZIP_SVA_PREFETCH_DISABLE;
writel(val, qm->io_base + HZIP_PREFETCH_CFG);
- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_PREFETCH_CFG,
- val, !(val & HZIP_SVA_PREFETCH_DISABLE),
+ ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_SVA_TRANS,
+ val, !(val & HZIP_SVA_DISABLE_READY),
HZIP_DELAY_1_US, HZIP_POLL_TIMEOUT_US);
if (ret)
- pci_err(qm->pdev, "failed to open sva prefetch\n");
+ pci_err(qm->pdev, "failed to close sva prefetch\n");
+
+ (void)hisi_zip_wait_sva_ready(qm, HZIP_SVA_TRANS, HZIP_SVA_STALL_NUM);
}
-static void hisi_zip_close_sva_prefetch(struct hisi_qm *qm)
+static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
{
u32 val;
int ret;
@@ -490,15 +524,23 @@ static void hisi_zip_close_sva_prefetch(struct hisi_qm *qm)
if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
return;
+ /* Enable prefetch */
val = readl_relaxed(qm->io_base + HZIP_PREFETCH_CFG);
- val |= HZIP_SVA_PREFETCH_DISABLE;
+ val &= HZIP_PREFETCH_ENABLE;
writel(val, qm->io_base + HZIP_PREFETCH_CFG);
- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_SVA_TRANS,
- val, !(val & HZIP_SVA_DISABLE_READY),
+ ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_PREFETCH_CFG,
+ val, !(val & HZIP_SVA_PREFETCH_DISABLE),
HZIP_DELAY_1_US, HZIP_POLL_TIMEOUT_US);
+ if (ret) {
+ pci_err(qm->pdev, "failed to open sva prefetch\n");
+ hisi_zip_close_sva_prefetch(qm);
+ return;
+ }
+
+ ret = hisi_zip_wait_sva_ready(qm, HZIP_SVA_TRANS, HZIP_SVA_PREFETCH_NUM);
if (ret)
- pci_err(qm->pdev, "failed to close sva prefetch\n");
+ hisi_zip_close_sva_prefetch(qm);
}
static void hisi_zip_enable_clock_gate(struct hisi_qm *qm)
@@ -522,6 +564,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
void __iomem *base = qm->io_base;
u32 dcomp_bm, comp_bm;
u32 zip_core_en;
+ int ret;
/* qm user domain */
writel(AXUSER_BASE, base + QM_ARUSER_M_CFG_1);
@@ -576,7 +619,15 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
hisi_zip_set_high_perf(qm);
hisi_zip_enable_clock_gate(qm);
- return hisi_dae_set_user_domain(qm);
+ ret = hisi_dae_set_user_domain(qm);
+ if (ret)
+ goto close_sva_prefetch;
+
+ return 0;
+
+close_sva_prefetch:
+ hisi_zip_close_sva_prefetch(qm);
+ return ret;
}
static void hisi_zip_master_ooo_ctrl(struct hisi_qm *qm, bool enable)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 295/563] crypto: hisilicon/qm - check whether the input function and PF are on the same device
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (293 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 294/563] crypto: hisilicon - check the sva module status while enabling or disabling address prefetch Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 296/563] crypto: hisilicon/qm - request reserved interrupt for virtual function Greg Kroah-Hartman
` (281 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhushuai Yin, Chenghai Huang,
Herbert Xu, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhushuai Yin <yinzhushuai@huawei.com>
[ Upstream commit 6a2c9164b52e6bc134127fd543461fdef95cc8ec ]
Function rate limiting is set through physical function driver.
Users configure by providing function information and rate limit values.
Before configuration, it is necessary to check whether the
provided function and PF belong to the same device.
Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check")
Signed-off-by: Zhushuai Yin <yinzhushuai@huawei.com>
Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/hisilicon/qm.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
index a5cc0ccd94f1f..2f96c673b60a5 100644
--- a/drivers/crypto/hisilicon/qm.c
+++ b/drivers/crypto/hisilicon/qm.c
@@ -3826,6 +3826,10 @@ static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf,
}
pdev = container_of(dev, struct pci_dev, dev);
+ if (pci_physfn(pdev) != qm->pdev) {
+ pci_err(qm->pdev, "the pdev input does not match the pf!\n");
+ return -EINVAL;
+ }
*fun_index = pdev->devfn;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 296/563] crypto: hisilicon/qm - request reserved interrupt for virtual function
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (294 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 295/563] crypto: hisilicon/qm - check whether the input function and PF are on the same device Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 297/563] inet: ping: check sock_net() in ping_get_port() and ping_lookup() Greg Kroah-Hartman
` (280 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weili Qian, Chenghai Huang,
Herbert Xu, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <qianweili@huawei.com>
[ Upstream commit 9228facb308157ac0bdd264b873187896f7a9c7a ]
The device interrupt vector 3 is an error interrupt for
physical function and a reserved interrupt for virtual function.
However, the driver has not registered the reserved interrupt for
virtual function. When allocating interrupts, the number of interrupts
is allocated based on powers of two, which includes this interrupt.
When the system enables GICv4 and the virtual function passthrough
to the virtual machine, releasing the interrupt in the driver
triggers a warning.
The WARNING report is:
WARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4
Therefore, register a reserved interrupt for VF and set the
IRQF_NO_AUTOEN flag to avoid that warning.
Fixes: 3536cc55cada ("crypto: hisilicon/qm - support get device irq information from hardware registers")
Signed-off-by: Weili Qian <qianweili@huawei.com>
Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/hisilicon/qm.c | 38 +++++++++++++++++++++++++++++------
1 file changed, 32 insertions(+), 6 deletions(-)
diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
index 2f96c673b60a5..102aff9ea19a0 100644
--- a/drivers/crypto/hisilicon/qm.c
+++ b/drivers/crypto/hisilicon/qm.c
@@ -4732,6 +4732,15 @@ void hisi_qm_reset_done(struct pci_dev *pdev)
}
EXPORT_SYMBOL_GPL(hisi_qm_reset_done);
+static irqreturn_t qm_rsvd_irq(int irq, void *data)
+{
+ struct hisi_qm *qm = data;
+
+ dev_info(&qm->pdev->dev, "Reserved interrupt, ignore!\n");
+
+ return IRQ_HANDLED;
+}
+
static irqreturn_t qm_abnormal_irq(int irq, void *data)
{
struct hisi_qm *qm = data;
@@ -5015,7 +5024,7 @@ static void qm_unregister_abnormal_irq(struct hisi_qm *qm)
struct pci_dev *pdev = qm->pdev;
u32 irq_vector, val;
- if (qm->fun_type == QM_HW_VF)
+ if (qm->fun_type == QM_HW_VF && qm->ver < QM_HW_V3)
return;
val = qm->cap_tables.qm_cap_table[QM_ABNORMAL_IRQ].cap_val;
@@ -5032,17 +5041,28 @@ static int qm_register_abnormal_irq(struct hisi_qm *qm)
u32 irq_vector, val;
int ret;
- if (qm->fun_type == QM_HW_VF)
- return 0;
-
val = qm->cap_tables.qm_cap_table[QM_ABNORMAL_IRQ].cap_val;
if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_ABN_IRQ_TYPE_MASK))
return 0;
-
irq_vector = val & QM_IRQ_VECTOR_MASK;
+
+ /* For VF, this is a reserved interrupt in V3 version. */
+ if (qm->fun_type == QM_HW_VF) {
+ if (qm->ver < QM_HW_V3)
+ return 0;
+
+ ret = request_irq(pci_irq_vector(pdev, irq_vector), qm_rsvd_irq,
+ IRQF_NO_AUTOEN, qm->dev_name, qm);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to request reserved irq, ret = %d!\n", ret);
+ return ret;
+ }
+ return 0;
+ }
+
ret = request_irq(pci_irq_vector(pdev, irq_vector), qm_abnormal_irq, 0, qm->dev_name, qm);
if (ret)
- dev_err(&qm->pdev->dev, "failed to request abnormal irq, ret = %d", ret);
+ dev_err(&qm->pdev->dev, "failed to request abnormal irq, ret = %d!\n", ret);
return ret;
}
@@ -5408,6 +5428,12 @@ static int hisi_qm_pci_init(struct hisi_qm *qm)
pci_set_master(pdev);
num_vec = qm_get_irq_num(qm);
+ if (!num_vec) {
+ dev_err(dev, "Device irq num is zero!\n");
+ ret = -EINVAL;
+ goto err_get_pci_res;
+ }
+ num_vec = roundup_pow_of_two(num_vec);
ret = pci_alloc_irq_vectors(pdev, num_vec, num_vec, PCI_IRQ_MSI);
if (ret < 0) {
dev_err(dev, "Failed to enable MSI vectors!\n");
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 297/563] inet: ping: check sock_net() in ping_get_port() and ping_lookup()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (295 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 296/563] crypto: hisilicon/qm - request reserved interrupt for virtual function Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 298/563] dmaengine: Fix dma_async_tx_descriptor->tx_submit documentation Greg Kroah-Hartman
` (279 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, David Ahern,
Yue Haibing, Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 59f26d86b2a16f1406f3b42025062b6d1fba5dd5 ]
We need to check socket netns before considering them in ping_get_port().
Otherwise, one malicious netns could 'consume' all ports.
Add corresponding check in ping_lookup().
Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Yue Haibing <yuehaibing@huawei.com>
Link: https://patch.msgid.link/20250829153054.474201-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/ping.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 031df4c19fcc5..d2c3480df8f77 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -77,6 +77,7 @@ static inline struct hlist_head *ping_hashslot(struct ping_table *table,
int ping_get_port(struct sock *sk, unsigned short ident)
{
+ struct net *net = sock_net(sk);
struct inet_sock *isk, *isk2;
struct hlist_head *hlist;
struct sock *sk2 = NULL;
@@ -90,9 +91,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
for (i = 0; i < (1L << 16); i++, result++) {
if (!result)
result++; /* avoid zero */
- hlist = ping_hashslot(&ping_table, sock_net(sk),
- result);
+ hlist = ping_hashslot(&ping_table, net, result);
sk_for_each(sk2, hlist) {
+ if (!net_eq(sock_net(sk2), net))
+ continue;
isk2 = inet_sk(sk2);
if (isk2->inet_num == result)
@@ -108,8 +110,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
if (i >= (1L << 16))
goto fail;
} else {
- hlist = ping_hashslot(&ping_table, sock_net(sk), ident);
+ hlist = ping_hashslot(&ping_table, net, ident);
sk_for_each(sk2, hlist) {
+ if (!net_eq(sock_net(sk2), net))
+ continue;
isk2 = inet_sk(sk2);
/* BUG? Why is this reuse and not reuseaddr? ping.c
@@ -129,7 +133,7 @@ int ping_get_port(struct sock *sk, unsigned short ident)
pr_debug("was not hashed\n");
sk_add_node_rcu(sk, hlist);
sock_set_flag(sk, SOCK_RCU_FREE);
- sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+ sock_prot_inuse_add(net, sk->sk_prot, 1);
}
spin_unlock(&ping_table.lock);
return 0;
@@ -188,6 +192,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
}
sk_for_each_rcu(sk, hslot) {
+ if (!net_eq(sock_net(sk), net))
+ continue;
isk = inet_sk(sk);
pr_debug("iterate\n");
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 298/563] dmaengine: Fix dma_async_tx_descriptor->tx_submit documentation
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (296 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 297/563] inet: ping: check sock_net() in ping_get_port() and ping_lookup() Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 299/563] coresight: trbe: Add ISB after TRBLIMITR write Greg Kroah-Hartman
` (278 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dave Jiang, Nathan Lynch, Vinod Koul,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <nathan.lynch@amd.com>
[ Upstream commit 7ea95d55e63176899eb96f7aaa34a5646f501b2c ]
Commit 790fb9956eea ("linux/dmaengine.h: fix a few kernel-doc
warnings") inserted new documentation for @desc_free in the middle of
@tx_submit's description.
Put @tx_submit's description back together, matching the indentation
style of the rest of the documentation for dma_async_tx_descriptor.
Fixes: 790fb9956eea ("linux/dmaengine.h: fix a few kernel-doc warnings")
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Nathan Lynch <nathan.lynch@amd.com>
Link: https://lore.kernel.org/r/20250826-dma_async_tx_desc-tx_submit-doc-fix-v1-1-18a4b51697db@amd.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/dmaengine.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index 6de7c05d6bd8c..99efe2b9b4ea9 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h
@@ -594,9 +594,9 @@ struct dma_descriptor_metadata_ops {
* @phys: physical address of the descriptor
* @chan: target channel for this operation
* @tx_submit: accept the descriptor, assign ordered cookie and mark the
+ * descriptor pending. To be pushed on .issue_pending() call
* @desc_free: driver's callback function to free a resusable descriptor
* after completion
- * descriptor pending. To be pushed on .issue_pending() call
* @callback: routine to call after this operation is complete
* @callback_result: error result from a DMA transaction
* @callback_param: general parameter to pass to the callback routine
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 299/563] coresight: trbe: Add ISB after TRBLIMITR write
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (297 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 298/563] dmaengine: Fix dma_async_tx_descriptor->tx_submit documentation Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 300/563] coresight: Fix missing include for FIELD_GET Greg Kroah-Hartman
` (277 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Clark, Yeoreum Yun,
Suzuki K Poulose, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <james.clark@linaro.org>
[ Upstream commit 52c0164b2526bce7013fca193e076f6d9eec9c95 ]
DEN0154 states that hardware will be allowed to ignore writes to TRB*
registers while the trace buffer is enabled. Add an ISB to ensure that
it's disabled before clearing the other registers.
This is purely defensive because it's expected that arm_trbe_disable()
would be called before teardown which has the required ISB.
Fixes: a2b579c41fe9 ("coresight: trbe: Remove redundant disable call")
Signed-off-by: James Clark <james.clark@linaro.org>
Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20250609-james-cs-trblimitr-isb-v1-1-3a2aa4ee6770@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-trbe.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
index 8f426f94e32a1..f78c9b9dc0087 100644
--- a/drivers/hwtracing/coresight/coresight-trbe.c
+++ b/drivers/hwtracing/coresight/coresight-trbe.c
@@ -258,6 +258,7 @@ static void trbe_drain_and_disable_local(struct trbe_cpudata *cpudata)
static void trbe_reset_local(struct trbe_cpudata *cpudata)
{
write_sysreg_s(0, SYS_TRBLIMITR_EL1);
+ isb();
trbe_drain_buffer();
write_sysreg_s(0, SYS_TRBPTR_EL1);
write_sysreg_s(0, SYS_TRBBASER_EL1);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 300/563] coresight: Fix missing include for FIELD_GET
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (298 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 299/563] coresight: trbe: Add ISB after TRBLIMITR write Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 301/563] coresight: Only register perf symlink for sinks with alloc_buffer Greg Kroah-Hartman
` (276 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linux Kernel Functional Testing,
James Clark, Suzuki K Poulose, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <james.clark@linaro.org>
[ Upstream commit 08d24e076d0fb9f90522ef69bf6cdae06e0919de ]
Include the header for FIELD_GET which is only sometimes transitively
included on some configs and kernel releases.
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
Closes: https://lists.linaro.org/archives/list/lkft-triage@lists.linaro.org/thread/6GKMK52PPRJVEYMEUHJP6BXF4CJAXOFL/
Fixes: a4e65842e114 ("coresight: Only check bottom two claim bits")
Signed-off-by: James Clark <james.clark@linaro.org>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20250707-james-coresight-bitfield-include-v1-1-aa0f4220ecfd@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-core.c | 1 +
drivers/hwtracing/coresight/coresight-etm4x-core.c | 1 +
drivers/hwtracing/coresight/coresight-etm4x-sysfs.c | 1 +
drivers/hwtracing/coresight/ultrasoc-smb.h | 1 +
4 files changed, 4 insertions(+)
diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
index fa758cc218275..c2db94f2ab237 100644
--- a/drivers/hwtracing/coresight/coresight-core.c
+++ b/drivers/hwtracing/coresight/coresight-core.c
@@ -3,6 +3,7 @@
* Copyright (c) 2012, The Linux Foundation. All rights reserved.
*/
+#include <linux/bitfield.h>
#include <linux/build_bug.h>
#include <linux/kernel.h>
#include <linux/init.h>
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index 42e5d37403add..cbea200489c8f 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -4,6 +4,7 @@
*/
#include <linux/acpi.h>
+#include <linux/bitfield.h>
#include <linux/bitops.h>
#include <linux/kernel.h>
#include <linux/kvm_host.h>
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
index ab251865b893d..e9eeea6240d55 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
@@ -4,6 +4,7 @@
* Author: Mathieu Poirier <mathieu.poirier@linaro.org>
*/
+#include <linux/bitfield.h>
#include <linux/coresight.h>
#include <linux/pid_namespace.h>
#include <linux/pm_runtime.h>
diff --git a/drivers/hwtracing/coresight/ultrasoc-smb.h b/drivers/hwtracing/coresight/ultrasoc-smb.h
index c4c111275627b..323f0ccb6878c 100644
--- a/drivers/hwtracing/coresight/ultrasoc-smb.h
+++ b/drivers/hwtracing/coresight/ultrasoc-smb.h
@@ -7,6 +7,7 @@
#ifndef _ULTRASOC_SMB_H
#define _ULTRASOC_SMB_H
+#include <linux/bitfield.h>
#include <linux/miscdevice.h>
#include <linux/spinlock.h>
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 301/563] coresight: Only register perf symlink for sinks with alloc_buffer
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (299 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 300/563] coresight: Fix missing include for FIELD_GET Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 302/563] drm/amdgpu: Power up UVD 3 for FW validation (v2) Greg Kroah-Hartman
` (275 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuanfang Zhang, Suzuki K Poulose,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanfang Zhang <quic_yuanfang@quicinc.com>
[ Upstream commit 12d9a9dd9d8a4f1968073e7f34515896d1e22b78 ]
Ensure that etm_perf_add_symlink_sink() is only called for devices
that implement the alloc_buffer operation. This prevents invalid
symlink creation for dummy sinks that do not implement alloc_buffer.
Without this check, perf may attempt to use a dummy sink that lacks
alloc_buffer operationsu to initialise perf's ring buffer, leading
to runtime failures.
Fixes: 9d3ba0b6c0569 ("Coresight: Add coresight dummy driver")
Signed-off-by: Yuanfang Zhang <quic_yuanfang@quicinc.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20250630-etm_perf_sink-v1-1-e4a7211f9ad7@quicinc.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-core.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
index c2db94f2ab237..1accd7cbd54bf 100644
--- a/drivers/hwtracing/coresight/coresight-core.c
+++ b/drivers/hwtracing/coresight/coresight-core.c
@@ -1375,8 +1375,9 @@ struct coresight_device *coresight_register(struct coresight_desc *desc)
goto out_unlock;
}
- if (csdev->type == CORESIGHT_DEV_TYPE_SINK ||
- csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) {
+ if ((csdev->type == CORESIGHT_DEV_TYPE_SINK ||
+ csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) &&
+ sink_ops(csdev)->alloc_buffer) {
ret = etm_perf_add_symlink_sink(csdev);
if (ret) {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 302/563] drm/amdgpu: Power up UVD 3 for FW validation (v2)
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (300 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 301/563] coresight: Only register perf symlink for sinks with alloc_buffer Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 303/563] drm/amd/pm: Disable ULV even if unsupported (v3) Greg Kroah-Hartman
` (274 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Timur Kristóf,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <timur.kristof@gmail.com>
[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ]
Unlike later versions, UVD 3 has firmware validation.
For this to work, the UVD should be powered up correctly.
When DPM is enabled and the display clock is off,
the SMU may choose a power state which doesn't power
the UVD, which can result in failure to initialize UVD.
v2:
Add code comments to explain about the UVD power state
and how UVD clock is turned on/off.
Fixes: b38f3e80ecec ("drm amdgpu: SI UVD v3_1 (v2)")
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++----
1 file changed, 25 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
index 5dbaebb592b30..2e79a3afc7748 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
@@ -623,7 +623,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev,
*
* @ip_block: Pointer to the amdgpu_ip_block for this hw instance.
*
- * Initialize the hardware, boot up the VCPU and do some testing
+ * Initialize the hardware, boot up the VCPU and do some testing.
+ *
+ * On SI, the UVD is meant to be used in a specific power state,
+ * or alternatively the driver can manually enable its clock.
+ * In amdgpu we use the dedicated UVD power state when DPM is enabled.
+ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state
+ * for the SMU and afterwards enables the UVD clock.
+ * This is automatically done by amdgpu_uvd_ring_begin_use when work
+ * is submitted to the UVD ring. Here, we have to call it manually
+ * in order to power up UVD before firmware validation.
+ *
+ * Note that we must not disable the UVD clock here, as that would
+ * cause the ring test to fail. However, UVD is powered off
+ * automatically after the ring test: amdgpu_uvd_ring_end_use calls
+ * the UVD idle work handler which will disable the UVD clock when
+ * all fences are signalled.
*/
static int uvd_v3_1_hw_init(struct amdgpu_ip_block *ip_block)
{
@@ -633,6 +648,15 @@ static int uvd_v3_1_hw_init(struct amdgpu_ip_block *ip_block)
int r;
uvd_v3_1_mc_resume(adev);
+ uvd_v3_1_enable_mgcg(adev, true);
+
+ /* Make sure UVD is powered during FW validation.
+ * It's going to be automatically powered off after the ring test.
+ */
+ if (adev->pm.dpm_enabled)
+ amdgpu_dpm_enable_uvd(adev, true);
+ else
+ amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
r = uvd_v3_1_fw_validate(adev);
if (r) {
@@ -640,9 +664,6 @@ static int uvd_v3_1_hw_init(struct amdgpu_ip_block *ip_block)
return r;
}
- uvd_v3_1_enable_mgcg(adev, true);
- amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
-
uvd_v3_1_start(adev);
r = amdgpu_ring_test_helper(ring);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 303/563] drm/amd/pm: Disable ULV even if unsupported (v3)
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (301 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 302/563] drm/amdgpu: Power up UVD 3 for FW validation (v2) Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 304/563] drm/amd/pm: Fix si_upload_smc_data (v3) Greg Kroah-Hartman
` (273 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Timur Kristóf,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <timur.kristof@gmail.com>
[ Upstream commit 3a0c3a4035f995e1f993dfaf4d63dc19e9b4bc1c ]
Always send PPSMC_MSG_DisableULV to the SMC, even if ULV mode
is unsupported, to make sure it is properly turned off.
v3:
Simplify si_disable_ulv further.
Always check the return value of amdgpu_si_send_msg_to_smc.
Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index 52e732be59e36..e71070a23b915 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -5637,14 +5637,10 @@ static int si_populate_smc_t(struct amdgpu_device *adev,
static int si_disable_ulv(struct amdgpu_device *adev)
{
- struct si_power_info *si_pi = si_get_pi(adev);
- struct si_ulv_param *ulv = &si_pi->ulv;
+ PPSMC_Result r;
- if (ulv->supported)
- return (amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV) == PPSMC_Result_OK) ?
- 0 : -EINVAL;
-
- return 0;
+ r = amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV);
+ return (r == PPSMC_Result_OK) ? 0 : -EINVAL;
}
static bool si_is_state_ulv_compatible(struct amdgpu_device *adev,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 304/563] drm/amd/pm: Fix si_upload_smc_data (v3)
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (302 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 303/563] drm/amd/pm: Disable ULV even if unsupported (v3) Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 305/563] drm/amd/pm: Adjust si_upload_smc_data register programming (v3) Greg Kroah-Hartman
` (272 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Timur Kristóf,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <timur.kristof@gmail.com>
[ Upstream commit a43b2cec04b02743338aa78f837ee0bdf066a6d5 ]
The si_upload_smc_data function uses si_write_smc_soft_register
to set some register values in the SMC, and expects the result
to be PPSMC_Result_OK which is 1.
The PPSMC_Result_OK / PPSMC_Result_Failed values are used for
checking the result of a command sent to the SMC.
However, the si_write_smc_soft_register actually doesn't send
any commands to the SMC and returns zero on success,
so this check was incorrect.
Fix that by not checking the return value, just like other
calls to si_write_smc_soft_register.
v3:
Additionally, when no display is plugged in, there is no need
to restrict MCLK switching, so program the registers to zero.
Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 43 ++++++++++++----------
1 file changed, 24 insertions(+), 19 deletions(-)
diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index e71070a23b915..6736c592dfdc6 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -5813,9 +5813,9 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
{
struct amdgpu_crtc *amdgpu_crtc = NULL;
int i;
-
- if (adev->pm.dpm.new_active_crtc_count == 0)
- return 0;
+ u32 crtc_index = 0;
+ u32 mclk_change_block_cp_min = 0;
+ u32 mclk_change_block_cp_max = 0;
for (i = 0; i < adev->mode_info.num_crtc; i++) {
if (adev->pm.dpm.new_active_crtcs & (1 << i)) {
@@ -5824,26 +5824,31 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
}
}
- if (amdgpu_crtc == NULL)
- return 0;
+ /* When a display is plugged in, program these so that the SMC
+ * performs MCLK switching when it doesn't cause flickering.
+ * When no display is plugged in, there is no need to restrict
+ * MCLK switching, so program them to zero.
+ */
+ if (adev->pm.dpm.new_active_crtc_count && amdgpu_crtc) {
+ crtc_index = amdgpu_crtc->crtc_id;
- if (amdgpu_crtc->line_time <= 0)
- return 0;
+ if (amdgpu_crtc->line_time) {
+ mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time;
+ mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time;
+ }
+ }
- if (si_write_smc_soft_register(adev,
- SI_SMC_SOFT_REGISTER_crtc_index,
- amdgpu_crtc->crtc_id) != PPSMC_Result_OK)
- return 0;
+ si_write_smc_soft_register(adev,
+ SI_SMC_SOFT_REGISTER_crtc_index,
+ crtc_index);
- if (si_write_smc_soft_register(adev,
- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min,
- amdgpu_crtc->wm_high / amdgpu_crtc->line_time) != PPSMC_Result_OK)
- return 0;
+ si_write_smc_soft_register(adev,
+ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min,
+ mclk_change_block_cp_min);
- if (si_write_smc_soft_register(adev,
- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max,
- amdgpu_crtc->wm_low / amdgpu_crtc->line_time) != PPSMC_Result_OK)
- return 0;
+ si_write_smc_soft_register(adev,
+ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max,
+ mclk_change_block_cp_max);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 305/563] drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (303 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 304/563] drm/amd/pm: Fix si_upload_smc_data (v3) Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 306/563] drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) Greg Kroah-Hartman
` (271 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Timur Kristóf,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <timur.kristof@gmail.com>
[ Upstream commit ce025130127437dc884c84c254170e27b2ce9309 ]
Based on some comments in dm_pp_display_configuration
above the crtc_index and line_time fields, these values
are programmed to the SMC to work around an SMC hang
when it switches MCLK.
According to Alex, the Windows driver programs them to:
mclk_change_block_cp_min = 200 / line_time
mclk_change_block_cp_max = 100 / line_time
Let's use the same for the sake of consistency.
Previously we used the watermark values, but it seemed buggy
as the code was mixing up low/high and A/B watermarks, and
was not saving a low watermark value on DCE 6, so
mclk_change_block_cp_max would be always zero previously.
Split this change off from the previous si_upload_smc_data
to make it easier to bisect, in case it causes any issues.
Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index 6736c592dfdc6..fb008c5980d67 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -5833,8 +5833,8 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
crtc_index = amdgpu_crtc->crtc_id;
if (amdgpu_crtc->line_time) {
- mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time;
- mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time;
+ mclk_change_block_cp_min = 200 / amdgpu_crtc->line_time;
+ mclk_change_block_cp_max = 100 / amdgpu_crtc->line_time;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 306/563] drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (304 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 305/563] drm/amd/pm: Adjust si_upload_smc_data register programming (v3) Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 307/563] drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) Greg Kroah-Hartman
` (270 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Timur Kristóf,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <timur.kristof@gmail.com>
[ Upstream commit 9003a0746864f39a0ef72bd45f8e1ad85d930d67 ]
Some parts of the code base expect that MCLK switching is turned
off when the vblank time is set to zero.
According to pp_pm_compute_clocks the non-DC code has issues
with MCLK switching with refresh rates over 120 Hz.
v3:
Add code comment to explain this better.
Add an if statement instead of changing the switch_limit.
Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index fb008c5980d67..c11c4cc111df5 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -3085,7 +3085,13 @@ static bool si_dpm_vblank_too_short(void *handle)
/* we never hit the non-gddr5 limit so disable it */
u32 switch_limit = adev->gmc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 0;
- if (vblank_time < switch_limit)
+ /* Consider zero vblank time too short and disable MCLK switching.
+ * Note that the vblank time is set to maximum when no displays are attached,
+ * so we'll still enable MCLK switching in that case.
+ */
+ if (vblank_time == 0)
+ return true;
+ else if (vblank_time < switch_limit)
return true;
else
return false;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 307/563] drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (305 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 306/563] drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 308/563] drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) Greg Kroah-Hartman
` (269 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Timur Kristóf,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <timur.kristof@gmail.com>
[ Upstream commit ed3803533c7bf7df88bc3fc9f70bd317e1228ea8 ]
According to pp_pm_compute_clocks the non-DC display code
has "issues with mclk switching with refresh rates over 120 hz".
The workaround is to disable MCLK switching in this case.
Do the same for legacy DPM.
Fixes: 6ddbd37f1074 ("drm/amd/pm: optimize the amdgpu_pm_compute_clocks() implementations")
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
index 42efe838fa85c..2d2d2d5e67634 100644
--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
+++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
@@ -66,6 +66,13 @@ u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev)
(amdgpu_crtc->v_border * 2));
vblank_time_us = vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock;
+
+ /* we have issues with mclk switching with
+ * refresh rates over 120 hz on the non-DC code.
+ */
+ if (drm_mode_vrefresh(&amdgpu_crtc->hw_mode) > 120)
+ vblank_time_us = 0;
+
break;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 308/563] drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (306 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 307/563] drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 309/563] wifi: mac80211: Make CONNECTION_MONITOR optional for MLO sta Greg Kroah-Hartman
` (268 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Timur Kristóf,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <timur.kristof@gmail.com>
[ Upstream commit 7009e3af0474aca5f64262b3c72fb6e23b232f9b ]
Port of commit 227545b9a08c ("drm/radeon/dpm: Disable sclk
switching on Oland when two 4K 60Hz monitors are connected")
This is an ad-hoc DPM fix, necessary because we don't have
proper bandwidth calculation for DCE 6.
We define "high pixelclock" for SI as higher than necessary
for 4K 30Hz. For example, 4K 60Hz and 1080p 144Hz fall into
this category.
When two high pixel clock displays are connected to Oland,
additionally disable shader clock switching, which results in
a higher voltage, thereby addressing some visible flickering.
v2:
Add more comments.
v3:
Split into two commits for easier review.
Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 31 ++++++++++++++++++++++
1 file changed, 31 insertions(+)
diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index c11c4cc111df5..4236700fc1ad1 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -3449,12 +3449,14 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
{
struct si_ps *ps = si_get_ps(rps);
struct amdgpu_clock_and_voltage_limits *max_limits;
+ struct amdgpu_connector *conn;
bool disable_mclk_switching = false;
bool disable_sclk_switching = false;
u32 mclk, sclk;
u16 vddc, vddci, min_vce_voltage = 0;
u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
u32 max_sclk = 0, max_mclk = 0;
+ u32 high_pixelclock_count = 0;
int i;
if (adev->asic_type == CHIP_HAINAN) {
@@ -3482,6 +3484,35 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
}
}
+ /* We define "high pixelclock" for SI as higher than necessary for 4K 30Hz.
+ * For example, 4K 60Hz and 1080p 144Hz fall into this category.
+ * Find number of such displays connected.
+ */
+ for (i = 0; i < adev->mode_info.num_crtc; i++) {
+ if (!(adev->pm.dpm.new_active_crtcs & (1 << i)) ||
+ !adev->mode_info.crtcs[i]->enabled)
+ continue;
+
+ conn = to_amdgpu_connector(adev->mode_info.crtcs[i]->connector);
+
+ if (conn->pixelclock_for_modeset > 297000)
+ high_pixelclock_count++;
+ }
+
+ /* These are some ad-hoc fixes to some issues observed with SI GPUs.
+ * They are necessary because we don't have something like dce_calcs
+ * for these GPUs to calculate bandwidth requirements.
+ */
+ if (high_pixelclock_count) {
+ /* On Oland, we observe some flickering when two 4K 60Hz
+ * displays are connected, possibly because voltage is too low.
+ * Raise the voltage by requiring a higher SCLK.
+ * (Voltage cannot be adjusted independently without also SCLK.)
+ */
+ if (high_pixelclock_count > 1 && adev->asic_type == CHIP_OLAND)
+ disable_sclk_switching = true;
+ }
+
if (rps->vce_active) {
rps->evclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].evclk;
rps->ecclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].ecclk;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 309/563] wifi: mac80211: Make CONNECTION_MONITOR optional for MLO sta
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (307 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 308/563] drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 310/563] wifi: mwifiex: send world regulatory domain to driver Greg Kroah-Hartman
` (267 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Bianconi, Johannes Berg,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit ac36daa83650c26fd55dee1a6ee5144769239911 ]
Since commit '1bc892d76a6f ("wifi: mac80211: extend connection
monitoring for MLO")' mac80211 supports connection monitor for MLO
client interfaces. Remove the CONNECTION_MONITOR requirement in
ieee80211_register_hw routine.
Fixes: 1bc892d76a6f ("wifi: mac80211: extend connection monitoring for MLO")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20250826-remove-conn-mon-check-ieee80211_register_hw-v2-1-5a1e2f038245@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/main.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 3ae6104e5cb20..78f862f79aa82 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1164,9 +1164,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
if (WARN_ON(!ieee80211_hw_check(hw, MFP_CAPABLE)))
return -EINVAL;
- if (WARN_ON(!ieee80211_hw_check(hw, CONNECTION_MONITOR)))
- return -EINVAL;
-
if (WARN_ON(ieee80211_hw_check(hw, NEED_DTIM_BEFORE_ASSOC)))
return -EINVAL;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 310/563] wifi: mwifiex: send world regulatory domain to driver
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (308 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 309/563] wifi: mac80211: Make CONNECTION_MONITOR optional for MLO sta Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 311/563] wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) Greg Kroah-Hartman
` (266 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Kerkmann, Jeff Chen,
Johannes Berg, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Kerkmann <s.kerkmann@pengutronix.de>
[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ]
The world regulatory domain is a restrictive subset of channel
configurations which allows legal operation of the adapter all over the
world. Changing to this domain should not be prevented.
Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed
Signed-off-by: Stefan Kerkmann <s.kerkmann@pengutronix.de>
Reviewed-by: Jeff Chen <jeff.chen_1@nxp.con>
Link: https://patch.msgid.link/20250804-fix-mwifiex-regulatory-domain-v1-1-e4715c770c4d@pengutronix.de
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index 4c8c7a5fdf23e..be23a29e7de09 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -686,10 +686,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy,
return;
}
- /* Don't send world or same regdom info to firmware */
- if (strncmp(request->alpha2, "00", 2) &&
- strncmp(request->alpha2, adapter->country_code,
- sizeof(request->alpha2))) {
+ /* Don't send same regdom info to firmware */
+ if (strncmp(request->alpha2, adapter->country_code,
+ sizeof(request->alpha2)) != 0) {
memcpy(adapter->country_code, request->alpha2,
sizeof(request->alpha2));
mwifiex_send_domain_info_cmd_fw(wiphy);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 311/563] wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (309 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 310/563] wifi: mwifiex: send world regulatory domain to driver Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 312/563] drm/msm: Do not validate SSPP when it is not ready Greg Kroah-Hartman
` (265 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gokul Sivakumar, Arend van Spriel,
Johannes Berg, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gokul Sivakumar <gokulkumar.sivakumar@infineon.com>
[ Upstream commit 74e2ef72bd4b25ce21c8f309d4f5b91b5df9ff5b ]
Cypress(Infineon) is not the vendor for this 43752 SDIO WLAN chip, and so
has not officially released any firmware binary for it. It is incorrect to
maintain this WLAN chip with firmware vendor ID as "CYW". So relabel the
chip's firmware Vendor ID as "WCC" as suggested by the maintainer.
Fixes: d2587c57ffd8 ("brcmfmac: add 43752 SDIO ids and initialization")
Fixes: f74f1ec22dc2 ("wifi: brcmfmac: add support for Cypress firmware api")
Signed-off-by: Gokul Sivakumar <gokulkumar.sivakumar@infineon.com>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Link: https://patch.msgid.link/20250724101136.6691-1-gokulkumar.sivakumar@infineon.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 2 +-
drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c | 4 ++--
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 8 ++++----
.../net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h | 1 -
include/linux/mmc/sdio_ids.h | 2 +-
5 files changed, 8 insertions(+), 9 deletions(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
index 8ab7d1e34a6e1..6a3f187320fc4 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
@@ -997,9 +997,9 @@ static const struct sdio_device_id brcmf_sdmmc_ids[] = {
BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4356, WCC),
BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4359, WCC),
BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43751, WCC),
+ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43752, WCC),
BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_CYPRESS_4373, CYW),
BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_CYPRESS_43012, CYW),
- BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_CYPRESS_43752, CYW),
BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_CYPRESS_89359, CYW),
CYW_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_CYPRESS_43439, CYW),
{ /* end: all zeroes */ }
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
index 9074ab49e8068..4239f2b21e542 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
@@ -738,8 +738,8 @@ static u32 brcmf_chip_tcm_rambase(struct brcmf_chip_priv *ci)
case BRCM_CC_4364_CHIP_ID:
case CY_CC_4373_CHIP_ID:
return 0x160000;
- case CY_CC_43752_CHIP_ID:
case BRCM_CC_43751_CHIP_ID:
+ case BRCM_CC_43752_CHIP_ID:
case BRCM_CC_4377_CHIP_ID:
return 0x170000;
case BRCM_CC_4378_CHIP_ID:
@@ -1452,7 +1452,7 @@ bool brcmf_chip_sr_capable(struct brcmf_chip *pub)
return (reg & CC_SR_CTL0_ENABLE_MASK) != 0;
case BRCM_CC_4359_CHIP_ID:
case BRCM_CC_43751_CHIP_ID:
- case CY_CC_43752_CHIP_ID:
+ case BRCM_CC_43752_CHIP_ID:
case CY_CC_43012_CHIP_ID:
addr = CORE_CC_REG(pmu->base, retention_ctl);
reg = chip->ops->read32(chip->ctx, addr);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index 8a0bad5119a0d..8cf9d7e7c3f70 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -655,10 +655,10 @@ static const struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = {
BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
BRCMF_FW_ENTRY(BRCM_CC_4359_CHIP_ID, 0xFFFFFFFF, 4359),
BRCMF_FW_ENTRY(BRCM_CC_43751_CHIP_ID, 0xFFFFFFFF, 43752),
+ BRCMF_FW_ENTRY(BRCM_CC_43752_CHIP_ID, 0xFFFFFFFF, 43752),
BRCMF_FW_ENTRY(CY_CC_4373_CHIP_ID, 0xFFFFFFFF, 4373),
BRCMF_FW_ENTRY(CY_CC_43012_CHIP_ID, 0xFFFFFFFF, 43012),
BRCMF_FW_ENTRY(CY_CC_43439_CHIP_ID, 0xFFFFFFFF, 43439),
- BRCMF_FW_ENTRY(CY_CC_43752_CHIP_ID, 0xFFFFFFFF, 43752)
};
#define TXCTL_CREDITS 2
@@ -3426,8 +3426,8 @@ static int brcmf_sdio_download_firmware(struct brcmf_sdio *bus,
static bool brcmf_sdio_aos_no_decode(struct brcmf_sdio *bus)
{
if (bus->ci->chip == BRCM_CC_43751_CHIP_ID ||
- bus->ci->chip == CY_CC_43012_CHIP_ID ||
- bus->ci->chip == CY_CC_43752_CHIP_ID)
+ bus->ci->chip == BRCM_CC_43752_CHIP_ID ||
+ bus->ci->chip == CY_CC_43012_CHIP_ID)
return true;
else
return false;
@@ -4278,8 +4278,8 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
switch (sdiod->func1->device) {
case SDIO_DEVICE_ID_BROADCOM_43751:
+ case SDIO_DEVICE_ID_BROADCOM_43752:
case SDIO_DEVICE_ID_BROADCOM_CYPRESS_4373:
- case SDIO_DEVICE_ID_BROADCOM_CYPRESS_43752:
brcmf_dbg(INFO, "set F2 watermark to 0x%x*4 bytes\n",
CY_4373_F2_WATERMARK);
brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
diff --git a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
index b39c5c1ee18b6..df3b67ba4db29 100644
--- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
+++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
@@ -60,7 +60,6 @@
#define CY_CC_4373_CHIP_ID 0x4373
#define CY_CC_43012_CHIP_ID 43012
#define CY_CC_43439_CHIP_ID 43439
-#define CY_CC_43752_CHIP_ID 43752
/* USB Device IDs */
#define BRCM_USB_43143_DEVICE_ID 0xbd1e
diff --git a/include/linux/mmc/sdio_ids.h b/include/linux/mmc/sdio_ids.h
index fe3d6d98f8da4..673cbdf434533 100644
--- a/include/linux/mmc/sdio_ids.h
+++ b/include/linux/mmc/sdio_ids.h
@@ -77,7 +77,7 @@
#define SDIO_DEVICE_ID_BROADCOM_43439 0xa9af
#define SDIO_DEVICE_ID_BROADCOM_43455 0xa9bf
#define SDIO_DEVICE_ID_BROADCOM_43751 0xaae7
-#define SDIO_DEVICE_ID_BROADCOM_CYPRESS_43752 0xaae8
+#define SDIO_DEVICE_ID_BROADCOM_43752 0xaae8
#define SDIO_VENDOR_ID_CYPRESS 0x04b4
#define SDIO_DEVICE_ID_BROADCOM_CYPRESS_43439 0xbd3d
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 312/563] drm/msm: Do not validate SSPP when it is not ready
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (310 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 311/563] wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 313/563] PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation Greg Kroah-Hartman
` (264 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jun Nie, Dmitry Baryshkov,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jun Nie <jun.nie@linaro.org>
[ Upstream commit 6fc616723bb5fd4289d7422fa013da062b44ae55 ]
Current code will validate current plane and previous plane to
confirm they can share a SSPP with multi-rect mode. The SSPP
is already allocated for previous plane, while current plane
is not associated with any SSPP yet. Null pointer is referenced
when validating the SSPP of current plane. Skip SSPP validation
for current plane.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=0000000888ac3000
[0000000000000020] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] SMP
Modules linked in:
CPU: 4 UID: 0 PID: 1891 Comm: modetest Tainted: G S 6.15.0-rc2-g3ee3f6e1202e #335 PREEMPT
Tainted: [S]=CPU_OUT_OF_SPEC
Hardware name: SM8650 EV1 rev1 4slam 2et (DT)
pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : dpu_plane_is_multirect_capable+0x68/0x90
lr : dpu_assign_plane_resources+0x288/0x410
sp : ffff800093dcb770
x29: ffff800093dcb770 x28: 0000000000002000 x27: ffff000817c6c000
x26: ffff000806b46368 x25: ffff0008013f6080 x24: ffff00080cbf4800
x23: ffff000810842680 x22: ffff0008013f1080 x21: ffff00080cc86080
x20: ffff000806b463b0 x19: ffff00080cbf5a00 x18: 00000000ffffffff
x17: 707a5f657a696c61 x16: 0000000000000003 x15: 0000000000002200
x14: 00000000ffffffff x13: 00aaaaaa00aaaaaa x12: 0000000000000000
x11: ffff000817c6e2b8 x10: 0000000000000000 x9 : ffff80008106a950
x8 : ffff00080cbf48f4 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000438 x3 : 0000000000000438
x2 : ffff800082e245e0 x1 : 0000000000000008 x0 : 0000000000000000
Call trace:
dpu_plane_is_multirect_capable+0x68/0x90 (P)
dpu_crtc_atomic_check+0x5bc/0x650
drm_atomic_helper_check_planes+0x13c/0x220
drm_atomic_helper_check+0x58/0xb8
msm_atomic_check+0xd8/0xf0
drm_atomic_check_only+0x4a8/0x968
drm_atomic_commit+0x50/0xd8
drm_atomic_helper_update_plane+0x140/0x188
__setplane_atomic+0xfc/0x148
drm_mode_setplane+0x164/0x378
drm_ioctl_kernel+0xc0/0x140
drm_ioctl+0x20c/0x500
__arm64_sys_ioctl+0xbc/0xf8
invoke_syscall+0x50/0x120
el0_svc_common.constprop.0+0x48/0xf8
do_el0_svc+0x28/0x40
el0_svc+0x30/0xd0
el0t_64_sync_handler+0x144/0x168
el0t_64_sync+0x198/0x1a0
Code: b9402021 370fffc1 f9401441 3707ff81 (f94010a1)
---[ end trace 0000000000000000 ]---
Fixes: 3ed12a3664b36 ("drm/msm/dpu: allow sharing SSPP between planes")
Signed-off-by: Jun Nie <jun.nie@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/669224/
Link: https://lore.kernel.org/r/20250819-v6-16-rc2-quad-pipe-upstream-v15-1-2c7a85089db8@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
index 6859e8ef6b055..f54cf0faa1c7c 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
@@ -922,6 +922,9 @@ static int dpu_plane_is_multirect_capable(struct dpu_hw_sspp *sspp,
if (MSM_FORMAT_IS_YUV(fmt))
return false;
+ if (!sspp)
+ return true;
+
if (!test_bit(DPU_SSPP_SMART_DMA_V1, &sspp->cap->features) &&
!test_bit(DPU_SSPP_SMART_DMA_V2, &sspp->cap->features))
return false;
@@ -1028,6 +1031,7 @@ static int dpu_plane_try_multirect_shared(struct dpu_plane_state *pstate,
prev_pipe->multirect_mode != DPU_SSPP_MULTIRECT_NONE)
return false;
+ /* Do not validate SSPP of current plane when it is not ready */
if (!dpu_plane_is_multirect_capable(pipe->sspp, pipe_cfg, fmt) ||
!dpu_plane_is_multirect_capable(prev_pipe->sspp, prev_pipe_cfg, prev_fmt))
return false;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 313/563] PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (311 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 312/563] drm/msm: Do not validate SSPP when it is not ready Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 314/563] wifi: mac80211: consider links for validating SCAN_FLAG_AP in scan request during MLO Greg Kroah-Hartman
` (263 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alok Tiwari, Manivannan Sadhasivam,
Bjorn Helgaas, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <alok.a.tiwari@oracle.com>
[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ]
Fix incorrect argument order in devm_kcalloc() when allocating port->phys.
The original call used sizeof(phy) as the number of elements and
port->lanes as the element size, which is reversed. While this happens to
produce the correct total allocation size with current pointer size and
lane counts, the argument order is wrong.
Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs")
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
[mani: added Fixes tag]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20250819150436.3105973-1-alok.a.tiwari@oracle.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pci-tegra.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
index 467ddc701adce..bb88767a37979 100644
--- a/drivers/pci/controller/pci-tegra.c
+++ b/drivers/pci/controller/pci-tegra.c
@@ -1344,7 +1344,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port)
unsigned int i;
int err;
- port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL);
+ port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL);
if (!port->phys)
return -ENOMEM;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 314/563] wifi: mac80211: consider links for validating SCAN_FLAG_AP in scan request during MLO
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (312 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 313/563] PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 315/563] PCI: qcom: Add equalization settings for 8.0 GT/s and 32.0 GT/s Greg Kroah-Hartman
` (262 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aditya Kumar Singh, Johannes Berg,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
[ Upstream commit 36b75dcb1e25739a3a0975699208c98f4b55d012 ]
Commit 78a7a126dc5b ("wifi: mac80211: validate SCAN_FLAG_AP in scan request
during MLO") introduced a check that rejects scan requests if any link is
already beaconing. This works fine when all links share the same radio, but
breaks down in multi-radio setups.
Consider a scenario where a 2.4 GHz link is beaconing and a scan is
requested on a 5 GHz link, each backed by a different physical radio. The
current logic still blocks the scan, even though it should be allowed. As a
result, interface bring-up fails unnecessarily in valid configurations.
Fix this by checking whether the scan is being requested on the same
underlying radio as the beaconing link. Only reject the scan if it targets
a link that is already beaconing and the NL80211_FEATURE_AP_SCAN is not
set. This ensures correct behavior in multi-radio environments and avoids
false rejections.
Fixes: 78a7a126dc5b ("wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO")
Signed-off-by: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
Link: https://patch.msgid.link/20250812-fix_scan_ap_flag_requirement_during_mlo-v4-3-383ffb6da213@oss.qualcomm.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/cfg.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 2ed07fa121ab7..7609c7c31df74 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -3001,6 +3001,9 @@ static int ieee80211_scan(struct wiphy *wiphy,
struct cfg80211_scan_request *req)
{
struct ieee80211_sub_if_data *sdata;
+ struct ieee80211_link_data *link;
+ struct ieee80211_channel *chan;
+ int radio_idx;
sdata = IEEE80211_WDEV_TO_SUB_IF(req->wdev);
@@ -3028,10 +3031,20 @@ static int ieee80211_scan(struct wiphy *wiphy,
* the frames sent while scanning on other channel will be
* lost)
*/
- if (ieee80211_num_beaconing_links(sdata) &&
- (!(wiphy->features & NL80211_FEATURE_AP_SCAN) ||
- !(req->flags & NL80211_SCAN_FLAG_AP)))
- return -EOPNOTSUPP;
+ for_each_link_data(sdata, link) {
+ /* if the link is not beaconing, ignore it */
+ if (!sdata_dereference(link->u.ap.beacon, sdata))
+ continue;
+
+ chan = link->conf->chanreq.oper.chan;
+ radio_idx = cfg80211_get_radio_idx_by_chan(wiphy, chan);
+
+ if (ieee80211_is_radio_idx_in_scan_req(wiphy, req,
+ radio_idx) &&
+ (!(wiphy->features & NL80211_FEATURE_AP_SCAN) ||
+ !(req->flags & NL80211_SCAN_FLAG_AP)))
+ return -EOPNOTSUPP;
+ }
break;
case NL80211_IFTYPE_NAN:
default:
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 315/563] PCI: qcom: Add equalization settings for 8.0 GT/s and 32.0 GT/s
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (313 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 314/563] wifi: mac80211: consider links for validating SCAN_FLAG_AP in scan request during MLO Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 316/563] tcp: fix __tcp_close() to only send RST when required Greg Kroah-Hartman
` (261 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qiang Yu, Ziyue Zhang,
Manivannan Sadhasivam, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyue Zhang <ziyue.zhang@oss.qualcomm.com>
[ Upstream commit 37bf0f4e39de9b53bc6f8d3702b021e2c6b5bae3 ]
Add lane equalization setting for 8.0 GT/s and 32.0 GT/s to enhance link
stability and avoid AER Correctable Errors reported on some platforms
(eg. SA8775P).
8.0 GT/s, 16.0 GT/s and 32.0 GT/s require the same equalization setting.
This setting is programmed into a group of shadow registers, which can be
switched to configure equalization for different speeds by writing 00b,
01b and 10b to `RATE_SHADOW_SEL`.
Hence, program equalization registers in a loop using link speed as index,
so that equalization setting can be programmed for 8.0 GT/s, 16.0 GT/s
and 32.0 GT/s.
Fixes: 489f14be0e0a ("arm64: dts: qcom: sa8775p: Add pcie0 and pcie1 nodes")
Co-developed-by: Qiang Yu <qiang.yu@oss.qualcomm.com>
Signed-off-by: Qiang Yu <qiang.yu@oss.qualcomm.com>
Signed-off-by: Ziyue Zhang <ziyue.zhang@oss.qualcomm.com>
[mani: wrapped the warning to fit 100 columns, used post-increment for loop]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20250904065225.1762793-2-ziyue.zhang@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-designware.h | 1 -
drivers/pci/controller/dwc/pcie-qcom-common.c | 58 +++++++++++--------
drivers/pci/controller/dwc/pcie-qcom-common.h | 2 +-
drivers/pci/controller/dwc/pcie-qcom-ep.c | 6 +-
drivers/pci/controller/dwc/pcie-qcom.c | 6 +-
5 files changed, 41 insertions(+), 32 deletions(-)
diff --git a/drivers/pci/controller/dwc/pcie-designware.h b/drivers/pci/controller/dwc/pcie-designware.h
index 00f52d472dcdd..cc71a2d90cd48 100644
--- a/drivers/pci/controller/dwc/pcie-designware.h
+++ b/drivers/pci/controller/dwc/pcie-designware.h
@@ -123,7 +123,6 @@
#define GEN3_RELATED_OFF_GEN3_EQ_DISABLE BIT(16)
#define GEN3_RELATED_OFF_RATE_SHADOW_SEL_SHIFT 24
#define GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK GENMASK(25, 24)
-#define GEN3_RELATED_OFF_RATE_SHADOW_SEL_16_0GT 0x1
#define GEN3_EQ_CONTROL_OFF 0x8A8
#define GEN3_EQ_CONTROL_OFF_FB_MODE GENMASK(3, 0)
diff --git a/drivers/pci/controller/dwc/pcie-qcom-common.c b/drivers/pci/controller/dwc/pcie-qcom-common.c
index 3aad19b56da8f..0c6f4514f922f 100644
--- a/drivers/pci/controller/dwc/pcie-qcom-common.c
+++ b/drivers/pci/controller/dwc/pcie-qcom-common.c
@@ -8,9 +8,11 @@
#include "pcie-designware.h"
#include "pcie-qcom-common.h"
-void qcom_pcie_common_set_16gt_equalization(struct dw_pcie *pci)
+void qcom_pcie_common_set_equalization(struct dw_pcie *pci)
{
+ struct device *dev = pci->dev;
u32 reg;
+ u16 speed;
/*
* GEN3_RELATED_OFF register is repurposed to apply equalization
@@ -19,32 +21,40 @@ void qcom_pcie_common_set_16gt_equalization(struct dw_pcie *pci)
* determines the data rate for which these equalization settings are
* applied.
*/
- reg = dw_pcie_readl_dbi(pci, GEN3_RELATED_OFF);
- reg &= ~GEN3_RELATED_OFF_GEN3_ZRXDC_NONCOMPL;
- reg &= ~GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK;
- reg |= FIELD_PREP(GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK,
- GEN3_RELATED_OFF_RATE_SHADOW_SEL_16_0GT);
- dw_pcie_writel_dbi(pci, GEN3_RELATED_OFF, reg);
- reg = dw_pcie_readl_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF);
- reg &= ~(GEN3_EQ_FMDC_T_MIN_PHASE23 |
- GEN3_EQ_FMDC_N_EVALS |
- GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA |
- GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA);
- reg |= FIELD_PREP(GEN3_EQ_FMDC_T_MIN_PHASE23, 0x1) |
- FIELD_PREP(GEN3_EQ_FMDC_N_EVALS, 0xd) |
- FIELD_PREP(GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA, 0x5) |
- FIELD_PREP(GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA, 0x5);
- dw_pcie_writel_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF, reg);
+ for (speed = PCIE_SPEED_8_0GT; speed <= pcie_link_speed[pci->max_link_speed]; speed++) {
+ if (speed > PCIE_SPEED_32_0GT) {
+ dev_warn(dev, "Skipped equalization settings for unsupported data rate\n");
+ break;
+ }
- reg = dw_pcie_readl_dbi(pci, GEN3_EQ_CONTROL_OFF);
- reg &= ~(GEN3_EQ_CONTROL_OFF_FB_MODE |
- GEN3_EQ_CONTROL_OFF_PHASE23_EXIT_MODE |
- GEN3_EQ_CONTROL_OFF_FOM_INC_INITIAL_EVAL |
- GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC);
- dw_pcie_writel_dbi(pci, GEN3_EQ_CONTROL_OFF, reg);
+ reg = dw_pcie_readl_dbi(pci, GEN3_RELATED_OFF);
+ reg &= ~GEN3_RELATED_OFF_GEN3_ZRXDC_NONCOMPL;
+ reg &= ~GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK;
+ reg |= FIELD_PREP(GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK,
+ speed - PCIE_SPEED_8_0GT);
+ dw_pcie_writel_dbi(pci, GEN3_RELATED_OFF, reg);
+
+ reg = dw_pcie_readl_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF);
+ reg &= ~(GEN3_EQ_FMDC_T_MIN_PHASE23 |
+ GEN3_EQ_FMDC_N_EVALS |
+ GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA |
+ GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA);
+ reg |= FIELD_PREP(GEN3_EQ_FMDC_T_MIN_PHASE23, 0x1) |
+ FIELD_PREP(GEN3_EQ_FMDC_N_EVALS, 0xd) |
+ FIELD_PREP(GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA, 0x5) |
+ FIELD_PREP(GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA, 0x5);
+ dw_pcie_writel_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF, reg);
+
+ reg = dw_pcie_readl_dbi(pci, GEN3_EQ_CONTROL_OFF);
+ reg &= ~(GEN3_EQ_CONTROL_OFF_FB_MODE |
+ GEN3_EQ_CONTROL_OFF_PHASE23_EXIT_MODE |
+ GEN3_EQ_CONTROL_OFF_FOM_INC_INITIAL_EVAL |
+ GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC);
+ dw_pcie_writel_dbi(pci, GEN3_EQ_CONTROL_OFF, reg);
+ }
}
-EXPORT_SYMBOL_GPL(qcom_pcie_common_set_16gt_equalization);
+EXPORT_SYMBOL_GPL(qcom_pcie_common_set_equalization);
void qcom_pcie_common_set_16gt_lane_margining(struct dw_pcie *pci)
{
diff --git a/drivers/pci/controller/dwc/pcie-qcom-common.h b/drivers/pci/controller/dwc/pcie-qcom-common.h
index 7d88d29e47661..7f5ca2fd9a72f 100644
--- a/drivers/pci/controller/dwc/pcie-qcom-common.h
+++ b/drivers/pci/controller/dwc/pcie-qcom-common.h
@@ -8,7 +8,7 @@
struct dw_pcie;
-void qcom_pcie_common_set_16gt_equalization(struct dw_pcie *pci);
+void qcom_pcie_common_set_equalization(struct dw_pcie *pci);
void qcom_pcie_common_set_16gt_lane_margining(struct dw_pcie *pci);
#endif
diff --git a/drivers/pci/controller/dwc/pcie-qcom-ep.c b/drivers/pci/controller/dwc/pcie-qcom-ep.c
index bf7c6ac0f3e39..aaf060bf39d40 100644
--- a/drivers/pci/controller/dwc/pcie-qcom-ep.c
+++ b/drivers/pci/controller/dwc/pcie-qcom-ep.c
@@ -511,10 +511,10 @@ static int qcom_pcie_perst_deassert(struct dw_pcie *pci)
goto err_disable_resources;
}
- if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT) {
- qcom_pcie_common_set_16gt_equalization(pci);
+ qcom_pcie_common_set_equalization(pci);
+
+ if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT)
qcom_pcie_common_set_16gt_lane_margining(pci);
- }
/*
* The physical address of the MMIO region which is exposed as the BAR
diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
index fbed7130d7475..a93740ae602f2 100644
--- a/drivers/pci/controller/dwc/pcie-qcom.c
+++ b/drivers/pci/controller/dwc/pcie-qcom.c
@@ -322,10 +322,10 @@ static int qcom_pcie_start_link(struct dw_pcie *pci)
{
struct qcom_pcie *pcie = to_qcom_pcie(pci);
- if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT) {
- qcom_pcie_common_set_16gt_equalization(pci);
+ qcom_pcie_common_set_equalization(pci);
+
+ if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT)
qcom_pcie_common_set_16gt_lane_margining(pci);
- }
/* Enable Link Training state machine */
if (pcie->cfg->ops->ltssm_enable)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 316/563] tcp: fix __tcp_close() to only send RST when required
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (314 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 315/563] PCI: qcom: Add equalization settings for 8.0 GT/s and 32.0 GT/s Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 317/563] fanotify: Validate the return value of mnt_ns_from_dentry() before dereferencing Greg Kroah-Hartman
` (260 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Neal Cardwell,
Kuniyuki Iwashima, Jason Xing, Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ]
If the receive queue contains payload that was already
received, __tcp_close() can send an unexpected RST.
Refine the code to take tp->copied_seq into account,
as we already do in tcp recvmsg().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Neal Cardwell <ncardwell@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Link: https://patch.msgid.link/20250903084720.1168904-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/tcp.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index ad76556800f2b..89040007c7b70 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3099,8 +3099,8 @@ bool tcp_check_oom(const struct sock *sk, int shift)
void __tcp_close(struct sock *sk, long timeout)
{
+ bool data_was_unread = false;
struct sk_buff *skb;
- int data_was_unread = 0;
int state;
WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);
@@ -3119,11 +3119,12 @@ void __tcp_close(struct sock *sk, long timeout)
* reader process may not have drained the data yet!
*/
while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
- u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq;
+ u32 end_seq = TCP_SKB_CB(skb)->end_seq;
if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
- len--;
- data_was_unread += len;
+ end_seq--;
+ if (after(end_seq, tcp_sk(sk)->copied_seq))
+ data_was_unread = true;
__kfree_skb(skb);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 317/563] fanotify: Validate the return value of mnt_ns_from_dentry() before dereferencing
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (315 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 316/563] tcp: fix __tcp_close() to only send RST when required Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:42 ` [PATCH 6.17 318/563] drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() Greg Kroah-Hartman
` (259 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anderson Nascimento,
Christian Brauner, Jan Kara, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anderson Nascimento <anderson@allelesecurity.com>
[ Upstream commit 62e59ffe8787b5550ccff70c30b6f6be6a3ac3dd ]
The function do_fanotify_mark() does not validate if
mnt_ns_from_dentry() returns NULL before dereferencing mntns->user_ns.
This causes a NULL pointer dereference in do_fanotify_mark() if the
path is not a mount namespace object.
Fix this by checking mnt_ns_from_dentry()'s return value before
dereferencing it.
Before the patch
$ gcc fanotify_nullptr.c -o fanotify_nullptr
$ mkdir A
$ ./fanotify_nullptr
Fanotify fd: 3
fanotify_mark: Operation not permitted
$ unshare -Urm
Fanotify fd: 3
Killed
int main(void){
int ffd;
ffd = fanotify_init(FAN_CLASS_NOTIF | FAN_REPORT_MNT, 0);
if(ffd < 0){
perror("fanotify_init");
exit(EXIT_FAILURE);
}
printf("Fanotify fd: %d\n",ffd);
if(fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MNTNS,
FAN_MNT_ATTACH, AT_FDCWD, "A") < 0){
perror("fanotify_mark");
exit(EXIT_FAILURE);
}
return 0;
}
After the patch
$ gcc fanotify_nullptr.c -o fanotify_nullptr
$ mkdir A
$ ./fanotify_nullptr
Fanotify fd: 3
fanotify_mark: Operation not permitted
$ unshare -Urm
Fanotify fd: 3
fanotify_mark: Invalid argument
[ 25.694973] BUG: kernel NULL pointer dereference, address: 0000000000000038
[ 25.695006] #PF: supervisor read access in kernel mode
[ 25.695012] #PF: error_code(0x0000) - not-present page
[ 25.695017] PGD 109a30067 P4D 109a30067 PUD 142b46067 PMD 0
[ 25.695025] Oops: Oops: 0000 [#1] SMP NOPTI
[ 25.695032] CPU: 4 UID: 1000 PID: 1478 Comm: fanotify_nullpt Not
tainted 6.17.0-rc4 #1 PREEMPT(lazy)
[ 25.695040] Hardware name: VMware, Inc. VMware Virtual
Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
[ 25.695049] RIP: 0010:do_fanotify_mark+0x817/0x950
[ 25.695066] Code: 04 00 00 e9 45 fd ff ff 48 8b 7c 24 48 4c 89 54
24 18 4c 89 5c 24 10 4c 89 0c 24 e8 b3 11 fc ff 4c 8b 54 24 18 4c 8b
5c 24 10 <48> 8b 78 38 4c 8b 0c 24 49 89 c4 e9 13 fd ff ff 8b 4c 24 28
85 c9
[ 25.695081] RSP: 0018:ffffd31c469e3c08 EFLAGS: 00010203
[ 25.695104] RAX: 0000000000000000 RBX: 0000000001000000 RCX: ffff8eb48aebd220
[ 25.695110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8eb4835e8180
[ 25.695115] RBP: 0000000000000111 R08: 0000000000000000 R09: 0000000000000000
[ 25.695142] R10: ffff8eb48a7d56c0 R11: ffff8eb482bede00 R12: 00000000004012a7
[ 25.695148] R13: 0000000000000110 R14: 0000000000000001 R15: ffff8eb48a7d56c0
[ 25.695154] FS: 00007f8733bda740(0000) GS:ffff8eb61ce5f000(0000)
knlGS:0000000000000000
[ 25.695162] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 25.695170] CR2: 0000000000000038 CR3: 0000000136994006 CR4: 00000000003706f0
[ 25.695201] Call Trace:
[ 25.695209] <TASK>
[ 25.695215] __x64_sys_fanotify_mark+0x1f/0x30
[ 25.695222] do_syscall_64+0x82/0x2c0
...
Fixes: 58f5fbeb367f ("fanotify: support watching filesystems and mounts inside userns")
Link: https://patch.msgid.link/CAPhRvkw4ONypNsJrCnxbKnJbYmLHTDEKFC4C_num_5sVBVa8jg@mail.gmail.com
Signed-off-by: Anderson Nascimento <anderson@allelesecurity.com>
Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/notify/fanotify/fanotify_user.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index b192ee068a7ac..561339b4cf752 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -1999,7 +1999,10 @@ static int do_fanotify_mark(int fanotify_fd, unsigned int flags, __u64 mask,
user_ns = path.mnt->mnt_sb->s_user_ns;
obj = path.mnt->mnt_sb;
} else if (obj_type == FSNOTIFY_OBJ_TYPE_MNTNS) {
+ ret = -EINVAL;
mntns = mnt_ns_from_dentry(path.dentry);
+ if (!mntns)
+ goto path_put_and_out;
user_ns = mntns->user_ns;
obj = mntns;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 318/563] drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (316 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 317/563] fanotify: Validate the return value of mnt_ns_from_dentry() before dereferencing Greg Kroah-Hartman
@ 2025-10-13 14:42 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 319/563] usb: phy: twl6030: Fix incorrect type for ret Greg Kroah-Hartman
` (258 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qianfeng Rong, Alex Deucher,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <rongqianfeng@vivo.com>
[ Upstream commit cbda64f3f58027f68211dda8ea94d52d7e493995 ]
Use negative error code -EINVAL instead of positive EINVAL in the default
case of svm_ioctl() to conform to Linux kernel error code conventions.
Fixes: 42de677f7999 ("drm/amdkfd: register svm range")
Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index a0f22ea6d15af..3d8b20828c068 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -4239,7 +4239,7 @@ svm_ioctl(struct kfd_process *p, enum kfd_ioctl_svm_op op, uint64_t start,
r = svm_range_get_attr(p, mm, start, size, nattrs, attrs);
break;
default:
- r = EINVAL;
+ r = -EINVAL;
break;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 319/563] usb: phy: twl6030: Fix incorrect type for ret
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (317 preceding siblings ...)
2025-10-13 14:42 ` [PATCH 6.17 318/563] drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 320/563] usb: gadget: configfs: Correctly set use_os_string at bind Greg Kroah-Hartman
` (257 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xichao Zhao, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xichao Zhao <zhao.xichao@vivo.com>
[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ]
In the twl6030_usb_probe(), the variable ret is declared as
a u32 type. However, since ret may receive -ENODEV when accepting
the return value of omap_usb2_set_comparator().Therefore, its type
should be changed to int.
Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2")
Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com>
Link: https://lore.kernel.org/r/20250822092224.30645-1-zhao.xichao@vivo.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/phy/phy-twl6030-usb.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
index 49d79c1257f3a..8c09db750bfd6 100644
--- a/drivers/usb/phy/phy-twl6030-usb.c
+++ b/drivers/usb/phy/phy-twl6030-usb.c
@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled)
static int twl6030_usb_probe(struct platform_device *pdev)
{
- u32 ret;
struct twl6030_usb *twl;
- int status, err;
+ int status, err, ret;
struct device_node *np = pdev->dev.of_node;
struct device *dev = &pdev->dev;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 320/563] usb: gadget: configfs: Correctly set use_os_string at bind
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (318 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 319/563] usb: phy: twl6030: Fix incorrect type for ret Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 321/563] tty: n_gsm: Dont block input queue by waiting MSC Greg Kroah-Hartman
` (256 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, William Wu, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Wu <william.wu@rock-chips.com>
[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ]
Once the use_os_string flag is set to true for some functions
(e.g. adb/mtp) which need to response the OS string, and then
if we re-bind the ConfigFS gadget to use the other functions
(e.g. hid) which should not to response the OS string, however,
because the use_os_string flag is still true, so the usb gadget
response the OS string descriptor incorrectly, this can cause
the USB device to be unrecognizable on the Windows system.
An example of this as follows:
echo 1 > os_desc/use
ln -s functions/ffs.adb configs/b.1/function0
start adbd
echo "<udc device>" > UDC #succeed
stop adbd
rm configs/b.1/function0
echo 0 > os_desc/use
ln -s functions/hid.gs0 configs/b.1/function0
echo "<udc device>" > UDC #fail to connect on Windows
This patch sets the use_os_string flag to false at bind if
the functions not support OS Descriptors.
Signed-off-by: William Wu <william.wu@rock-chips.com>
Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support")
Link: https://lore.kernel.org/r/1755833769-25434-1-git-send-email-william.wu@rock-chips.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/configfs.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index f94ea196ce547..6bcac85c55501 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1750,6 +1750,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget,
cdev->use_os_string = true;
cdev->b_vendor_code = gi->b_vendor_code;
memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN);
+ } else {
+ cdev->use_os_string = false;
}
if (gadget_is_otg(gadget) && !otg_desc[0]) {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 321/563] tty: n_gsm: Dont block input queue by waiting MSC
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (319 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 320/563] usb: gadget: configfs: Correctly set use_os_string at bind Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 322/563] misc: genwqe: Fix incorrect cmd field being reported in error Greg Kroah-Hartman
` (255 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Seppo Takalo, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seppo Takalo <seppo.takalo@nordicsemi.no>
[ Upstream commit 3cf0b3c243e56bc43be560617416c1d9f301f44c ]
Currently gsm_queue() processes incoming frames and when opening
a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update().
If basic mode is used it calls gsm_modem_upd_via_msc() and it
cannot block the input queue by waiting the response to come
into the same input queue.
Instead allow sending Modem Status Command without waiting for remote
end to respond. Define a new function gsm_modem_send_initial_msc()
for this purpose. As MSC is only valid for basic encoding, it does
not do anything for advanced or when convergence layer type 2 is used.
Fixes: 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open")
Signed-off-by: Seppo Takalo <seppo.takalo@nordicsemi.no>
Link: https://lore.kernel.org/r/20250827123221.1148666-1-seppo.takalo@nordicsemi.no
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/n_gsm.c | 25 ++++++++++++++++++++++++-
1 file changed, 24 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 7fc535452c0b3..553d8c70352b1 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -461,6 +461,7 @@ static int gsm_send_packet(struct gsm_mux *gsm, struct gsm_msg *msg);
static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr);
static void gsmld_write_trigger(struct gsm_mux *gsm);
static void gsmld_write_task(struct work_struct *work);
+static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci);
/**
* gsm_fcs_add - update FCS
@@ -2174,7 +2175,7 @@ static void gsm_dlci_open(struct gsm_dlci *dlci)
pr_debug("DLCI %d goes open.\n", dlci->addr);
/* Send current modem state */
if (dlci->addr) {
- gsm_modem_update(dlci, 0);
+ gsm_modem_send_initial_msc(dlci);
} else {
/* Start keep-alive control */
gsm->ka_num = 0;
@@ -4161,6 +4162,28 @@ static int gsm_modem_upd_via_msc(struct gsm_dlci *dlci, u8 brk)
return gsm_control_wait(dlci->gsm, ctrl);
}
+/**
+ * gsm_modem_send_initial_msc - Send initial modem status message
+ *
+ * @dlci channel
+ *
+ * Send an initial MSC message after DLCI open to set the initial
+ * modem status lines. This is only done for basic mode.
+ * Does not wait for a response as we cannot block the input queue
+ * processing.
+ */
+static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci)
+{
+ u8 modembits[2];
+
+ if (dlci->adaption != 1 || dlci->gsm->encoding != GSM_BASIC_OPT)
+ return 0;
+
+ modembits[0] = (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */
+ modembits[1] = (gsm_encode_modem(dlci) << 1) | EA;
+ return gsm_control_command(dlci->gsm, CMD_MSC, (const u8 *)&modembits, 2);
+}
+
/**
* gsm_modem_update - send modem status line state
* @dlci: channel
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 322/563] misc: genwqe: Fix incorrect cmd field being reported in error
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (320 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 321/563] tty: n_gsm: Dont block input queue by waiting MSC Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 323/563] pps: fix warning in pps_register_cdev when register device fail Greg Kroah-Hartman
` (254 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Colin Ian King, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <colin.i.king@gmail.com>
[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ]
There is a dev_err message that is reporting the value of
cmd->asiv_length when it should be reporting cmd->asv_length
instead. Fix this.
Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue")
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/genwqe/card_ddcb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c
index 500b1feaf1f6f..fd7d5cd50d396 100644
--- a/drivers/misc/genwqe/card_ddcb.c
+++ b/drivers/misc/genwqe/card_ddcb.c
@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd,
}
if (cmd->asv_length > DDCB_ASV_LENGTH) {
dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n",
- __func__, cmd->asiv_length);
+ __func__, cmd->asv_length);
return -EINVAL;
}
rc = __genwqe_enqueue_ddcb(cd, req, f_flags);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 323/563] pps: fix warning in pps_register_cdev when register device fail
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (321 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 322/563] misc: genwqe: Fix incorrect cmd field being reported in error Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 324/563] drm/msm: Fix obj leak in VM_BIND error path Greg Kroah-Hartman
` (253 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wang Liang, Calvin Owens,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Liang <wangliang74@huawei.com>
[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ]
Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error
handling in __video_register_device()"), the release hook should be set
before device_register(). Otherwise, when device_register() return error
and put_device() try to callback the release function, the below warning
may happen.
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567
Modules linked in:
CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE
RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567
Call Trace:
<TASK>
kobject_cleanup+0x136/0x410 lib/kobject.c:689
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0xe9/0x130 lib/kobject.c:737
put_device+0x24/0x30 drivers/base/core.c:3797
pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402
pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108
pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57
tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432
tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563
tiocsetd drivers/tty/tty_io.c:2429 [inline]
tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:598 [inline]
__se_sys_ioctl fs/ioctl.c:584 [inline]
__x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>
Before commit c79a39dc8d06 ("pps: Fix a use-after-free"),
pps_register_cdev() call device_create() to create pps->dev, which will
init dev->release to device_create_release(). Now the comment is outdated,
just remove it.
Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed
in pps_register_source() to avoid a double free in the failure case.
Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/
Fixes: c79a39dc8d06 ("pps: Fix a use-after-free")
Signed-off-by: Wang Liang <wangliang74@huawei.com>
Reviewed-By: Calvin Owens <calvin@wbinvd.org>
Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pps/kapi.c | 5 +----
drivers/pps/pps.c | 5 ++---
2 files changed, 3 insertions(+), 7 deletions(-)
diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
index 92d1b62ea239d..e9389876229ea 100644
--- a/drivers/pps/kapi.c
+++ b/drivers/pps/kapi.c
@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info,
if (err < 0) {
pr_err("%s: unable to create char device\n",
info->name);
- goto kfree_pps;
+ goto pps_register_source_exit;
}
dev_dbg(&pps->dev, "new PPS source %s\n", info->name);
return pps;
-kfree_pps:
- kfree(pps);
-
pps_register_source_exit:
pr_err("%s: unable to register source\n", info->name);
diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
index 9463232af8d2e..c6b8b64782761 100644
--- a/drivers/pps/pps.c
+++ b/drivers/pps/pps.c
@@ -374,6 +374,7 @@ int pps_register_cdev(struct pps_device *pps)
pps->info.name);
err = -EBUSY;
}
+ kfree(pps);
goto out_unlock;
}
pps->id = err;
@@ -383,13 +384,11 @@ int pps_register_cdev(struct pps_device *pps)
pps->dev.devt = MKDEV(pps_major, pps->id);
dev_set_drvdata(&pps->dev, pps);
dev_set_name(&pps->dev, "pps%d", pps->id);
+ pps->dev.release = pps_device_destruct;
err = device_register(&pps->dev);
if (err)
goto free_idr;
- /* Override the release function with our own */
- pps->dev.release = pps_device_destruct;
-
pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major,
pps->id);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 324/563] drm/msm: Fix obj leak in VM_BIND error path
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (322 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 323/563] pps: fix warning in pps_register_cdev when register device fail Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 325/563] drm/msm: Fix missing VM_BIND offset/range validation Greg Kroah-Hartman
` (252 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rob Clark, Connor Abbott,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <robin.clark@oss.qualcomm.com>
[ Upstream commit 278f8904434aa96055e793936b5977c010549e28 ]
If we fail a handle-lookup part way thru, we need to drop the already
obtained obj references.
Fixes: 2e6a8a1fe2b2 ("drm/msm: Add VM_BIND ioctl")
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Tested-by: Connor Abbott <cwabbott0@gmail.com>
Patchwork: https://patchwork.freedesktop.org/patch/669784/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/msm_gem_vma.c | 25 +++++++++++++++++++------
1 file changed, 19 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c b/drivers/gpu/drm/msm/msm_gem_vma.c
index 00d0f3b7ba327..209154be5efcc 100644
--- a/drivers/gpu/drm/msm/msm_gem_vma.c
+++ b/drivers/gpu/drm/msm/msm_gem_vma.c
@@ -1023,6 +1023,7 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, struct drm_msm_vm_bind *args
struct drm_device *dev = job->vm->drm;
int ret = 0;
int cnt = 0;
+ int i = -1;
if (args->nr_ops == 1) {
/* Single op case, the op is inlined: */
@@ -1056,11 +1057,12 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, struct drm_msm_vm_bind *args
spin_lock(&file->table_lock);
- for (unsigned i = 0; i < args->nr_ops; i++) {
+ for (i = 0; i < args->nr_ops; i++) {
+ struct msm_vm_bind_op *op = &job->ops[i];
struct drm_gem_object *obj;
- if (!job->ops[i].handle) {
- job->ops[i].obj = NULL;
+ if (!op->handle) {
+ op->obj = NULL;
continue;
}
@@ -1068,15 +1070,15 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, struct drm_msm_vm_bind *args
* normally use drm_gem_object_lookup(), but for bulk lookup
* all under single table_lock just hit object_idr directly:
*/
- obj = idr_find(&file->object_idr, job->ops[i].handle);
+ obj = idr_find(&file->object_idr, op->handle);
if (!obj) {
- ret = UERR(EINVAL, dev, "invalid handle %u at index %u\n", job->ops[i].handle, i);
+ ret = UERR(EINVAL, dev, "invalid handle %u at index %u\n", op->handle, i);
goto out_unlock;
}
drm_gem_object_get(obj);
- job->ops[i].obj = obj;
+ op->obj = obj;
cnt++;
}
@@ -1085,6 +1087,17 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, struct drm_msm_vm_bind *args
out_unlock:
spin_unlock(&file->table_lock);
+ if (ret) {
+ for (; i >= 0; i--) {
+ struct msm_vm_bind_op *op = &job->ops[i];
+
+ if (!op->obj)
+ continue;
+
+ drm_gem_object_put(op->obj);
+ op->obj = NULL;
+ }
+ }
out:
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 325/563] drm/msm: Fix missing VM_BIND offset/range validation
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (323 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 324/563] drm/msm: Fix obj leak in VM_BIND error path Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 326/563] wifi: iwlwifi: Remove redundant header files Greg Kroah-Hartman
` (251 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Connor Abbott, Rob Clark,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <robin.clark@oss.qualcomm.com>
[ Upstream commit 3a3bef68a6c15d079646a964ebc4dc8bb0aedb06 ]
We need to reject the MAP op if offset+range is larger than the BO size.
Reported-by: Connor Abbott <cwabbott0@gmail.com>
Fixes: 2e6a8a1fe2b2 ("drm/msm: Add VM_BIND ioctl")
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Tested-by: Connor Abbott <cwabbott0@gmail.com>
Patchwork: https://patchwork.freedesktop.org/patch/669781/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/msm_gem_vma.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c b/drivers/gpu/drm/msm/msm_gem_vma.c
index 209154be5efcc..381a0853c05ba 100644
--- a/drivers/gpu/drm/msm/msm_gem_vma.c
+++ b/drivers/gpu/drm/msm/msm_gem_vma.c
@@ -1080,6 +1080,12 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, struct drm_msm_vm_bind *args
op->obj = obj;
cnt++;
+
+ if ((op->range + op->obj_offset) > obj->size) {
+ ret = UERR(EINVAL, dev, "invalid range: %016llx + %016llx > %016zx\n",
+ op->range, op->obj_offset, obj->size);
+ goto out_unlock;
+ }
}
*nr_bos = cnt;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 326/563] wifi: iwlwifi: Remove redundant header files
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (324 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 325/563] drm/msm: Fix missing VM_BIND offset/range validation Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 327/563] drm/msm/mdp4: stop supporting no-IOMMU configuration Greg Kroah-Hartman
` (250 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liao Yuanhong, Miri Korenblit,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Yuanhong <liaoyuanhong@vivo.com>
[ Upstream commit b4b34ba66443696cc5f3e95493f9d7597259b728 ]
The header file "fw/img.h" is already included on line 9. Remove the
redundant include.
Fixes: 2594e4d9e1a2d ("wifi: iwlwifi: prepare for reading SAR tables from UEFI")
Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com>
Link: https://patch.msgid.link/20250819121201.608770-2-liaoyuanhong@vivo.com
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/fw/regulatory.h | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
index a07c512b6ed43..735482e7adf56 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
@@ -12,7 +12,6 @@
#include "fw/api/phy.h"
#include "fw/api/config.h"
#include "fw/api/nvm-reg.h"
-#include "fw/img.h"
#include "iwl-trans.h"
#define BIOS_SAR_MAX_PROFILE_NUM 4
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 327/563] drm/msm/mdp4: stop supporting no-IOMMU configuration
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (325 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 326/563] wifi: iwlwifi: Remove redundant header files Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 328/563] drm/msm: " Greg Kroah-Hartman
` (249 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Rob Clark,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
[ Upstream commit cc64568b522b64fb8f8c607da9eb4e2d9f72d0cf ]
With the switch to GPUVM the msm driver no longer supports the no-IOMMU
configurations (even without the actual GPU). Return an error in case we
face the lack of the IOMMU for an MDP4 device.
Fixes: 111fdd2198e6 ("drm/msm: drm_gpuvm conversion")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/672557/
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
index 0952c7f18abdc..4d1ea9b261917 100644
--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
+++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
@@ -463,9 +463,9 @@ static int mdp4_kms_init(struct drm_device *dev)
ret = PTR_ERR(mmu);
goto fail;
} else if (!mmu) {
- DRM_DEV_INFO(dev->dev, "no iommu, fallback to phys "
- "contig buffers for scanout\n");
- vm = NULL;
+ DRM_DEV_INFO(dev->dev, "no IOMMU, bailing out\n");
+ ret = -ENODEV;
+ goto fail;
} else {
vm = msm_gem_vm_create(dev, mmu, "mdp4",
0x1000, 0x100000000 - 0x1000,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 328/563] drm/msm: stop supporting no-IOMMU configuration
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (326 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 327/563] drm/msm/mdp4: stop supporting no-IOMMU configuration Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 329/563] idpf: fix Rx descriptor ready check barrier in splitq Greg Kroah-Hartman
` (248 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Rob Clark,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
[ Upstream commit c94fc6d35685587aa0cb9a8d7d7062c73ab04d89 ]
With the switch to GPUVM the msm driver no longer supports the no-IOMMU
configurations (even without the actual GPU). Return an error in case we
face the lack of the IOMMU.
Fixes: 111fdd2198e6 ("drm/msm: drm_gpuvm conversion")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/672559/
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/msm_kms.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/msm/msm_kms.c b/drivers/gpu/drm/msm/msm_kms.c
index 56828d218e88a..4c4dcb095c4df 100644
--- a/drivers/gpu/drm/msm/msm_kms.c
+++ b/drivers/gpu/drm/msm/msm_kms.c
@@ -195,14 +195,13 @@ struct drm_gpuvm *msm_kms_init_vm(struct drm_device *dev)
iommu_dev = mdp_dev;
else
iommu_dev = mdss_dev;
-
mmu = msm_iommu_disp_new(iommu_dev, 0);
if (IS_ERR(mmu))
return ERR_CAST(mmu);
if (!mmu) {
- drm_info(dev, "no IOMMU, fallback to phys contig buffers for scanout\n");
- return NULL;
+ drm_info(dev, "no IOMMU, bailing out\n");
+ return ERR_PTR(-ENODEV);
}
vm = msm_gem_vm_create(dev, mmu, "mdp_kms",
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 329/563] idpf: fix Rx descriptor ready check barrier in splitq
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (327 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 328/563] drm/msm: " Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 330/563] ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping Greg Kroah-Hartman
` (247 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej Fijalkowski,
Alexander Lobakin, Ramu R, Tony Nguyen, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Lobakin <aleksander.lobakin@intel.com>
[ Upstream commit c20edbacc0295fd36f5f634b3421647ce3e08fd7 ]
No idea what the current barrier position was meant for. At that point,
nothing is read from the descriptor, only the pointer to the actual one
is fetched.
The correct barrier usage here is after the generation check, so that
only the first qword is read if the descriptor is not yet ready and we
need to stop polling. Debatable on coherent DMA as the Rx descriptor
size is <= cacheline size, but anyway, the current barrier position
only makes the codegen worse.
Fixes: 3a8845af66ed ("idpf: add RX splitq napi poll support")
Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Signed-off-by: Alexander Lobakin <aleksander.lobakin@intel.com>
Tested-by: Ramu R <ramu.r@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/idpf/idpf_txrx.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
index eaad52a83b04c..50f90ed3107ec 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
@@ -3187,18 +3187,14 @@ static int idpf_rx_splitq_clean(struct idpf_rx_queue *rxq, int budget)
/* get the Rx desc from Rx queue based on 'next_to_clean' */
rx_desc = &rxq->rx[ntc].flex_adv_nic_3_wb;
- /* This memory barrier is needed to keep us from reading
- * any other fields out of the rx_desc
- */
- dma_rmb();
-
/* if the descriptor isn't done, no work yet to do */
gen_id = le16_get_bits(rx_desc->pktlen_gen_bufq_id,
VIRTCHNL2_RX_FLEX_DESC_ADV_GEN_M);
-
if (idpf_queue_has(GEN_CHK, rxq) != gen_id)
break;
+ dma_rmb();
+
rxdid = FIELD_GET(VIRTCHNL2_RX_FLEX_DESC_ADV_RXDID_M,
rx_desc->rxdid_ucast);
if (rxdid != VIRTCHNL2_RXDID_2_FLEX_SPLITQ) {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 330/563] ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (328 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 329/563] idpf: fix Rx descriptor ready check barrier in splitq Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 331/563] ASoC: Intel: bytcr_rt5640: " Greg Kroah-Hartman
` (246 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai, Mark Brown,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ]
When an invalid value is passed via quirk option, currently
bytcht_es8316 driver just ignores and leaves as is, which may lead to
unepxected results like OOB access.
This patch adds the sanity check and corrects the input mapping to the
certain default value if an invalid value is passed.
Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Message-ID: <20250902171826.27329-2-tiwai@suse.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++---
1 file changed, 17 insertions(+), 3 deletions(-)
diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
index 62594e7966ab0..b384d38654e65 100644
--- a/sound/soc/intel/boards/bytcht_es8316.c
+++ b/sound/soc/intel/boards/bytcht_es8316.c
@@ -47,7 +47,8 @@ enum {
BYT_CHT_ES8316_INTMIC_IN2_MAP,
};
-#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & GENMASK(3, 0))
+#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0)
+#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK)
#define BYT_CHT_ES8316_SSP0 BIT(16)
#define BYT_CHT_ES8316_MONO_SPEAKER BIT(17)
#define BYT_CHT_ES8316_JD_INVERTED BIT(18)
@@ -60,10 +61,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
static void log_quirks(struct device *dev)
{
- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP)
+ int map;
+
+ map = BYT_CHT_ES8316_MAP(quirk);
+ switch (map) {
+ case BYT_CHT_ES8316_INTMIC_IN1_MAP:
dev_info(dev, "quirk IN1_MAP enabled");
- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP)
+ break;
+ case BYT_CHT_ES8316_INTMIC_IN2_MAP:
dev_info(dev, "quirk IN2_MAP enabled");
+ break;
+ default:
+ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map);
+ quirk &= ~BYT_CHT_ES8316_MAP_MASK;
+ quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP;
+ break;
+ }
+
if (quirk & BYT_CHT_ES8316_SSP0)
dev_info(dev, "quirk SSP0 enabled");
if (quirk & BYT_CHT_ES8316_MONO_SPEAKER)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 331/563] ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (329 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 330/563] ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 332/563] ASoC: Intel: bytcr_rt5651: " Greg Kroah-Hartman
` (245 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai, Mark Brown,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ]
When an invalid value is passed via quirk option, currently
bytcr_rt5640 driver only shows an error message but leaves as is.
This may lead to unepxected results like OOB access.
This patch corrects the input mapping to the certain default value if
an invalid value is passed.
Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Message-ID: <20250902171826.27329-3-tiwai@suse.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
index 0f3b8f44e7011..bc846558480e4 100644
--- a/sound/soc/intel/boards/bytcr_rt5640.c
+++ b/sound/soc/intel/boards/bytcr_rt5640.c
@@ -68,7 +68,8 @@ enum {
BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13),
};
-#define BYT_RT5640_MAP(quirk) ((quirk) & GENMASK(3, 0))
+#define BYT_RT5640_MAP_MASK GENMASK(3, 0)
+#define BYT_RT5640_MAP(quirk) ((quirk) & BYT_RT5640_MAP_MASK)
#define BYT_RT5640_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4)
#define BYT_RT5640_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8)
#define BYT_RT5640_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13)
@@ -140,7 +141,9 @@ static void log_quirks(struct device *dev)
dev_info(dev, "quirk NO_INTERNAL_MIC_MAP enabled\n");
break;
default:
- dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map);
+ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map);
+ byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK;
+ byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP;
break;
}
if (byt_rt5640_quirk & BYT_RT5640_HSMIC2_ON_IN1)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 332/563] ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (330 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 331/563] ASoC: Intel: bytcr_rt5640: " Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 333/563] ipv6: snmp: do not use SNMP_MIB_SENTINEL anymore Greg Kroah-Hartman
` (244 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai, Mark Brown,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ]
When an invalid value is passed via quirk option, currently
bytcr_rt5640 driver just ignores and leaves as is, which may lead to
unepxected results like OOB access.
This patch adds the sanity check and corrects the input mapping to the
certain default value if an invalid value is passed.
Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Message-ID: <20250902171826.27329-4-tiwai@suse.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++-----
1 file changed, 21 insertions(+), 5 deletions(-)
diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
index 67c62844ca2a9..604a35d380e9a 100644
--- a/sound/soc/intel/boards/bytcr_rt5651.c
+++ b/sound/soc/intel/boards/bytcr_rt5651.c
@@ -58,7 +58,8 @@ enum {
BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13),
};
-#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0))
+#define BYT_RT5651_MAP_MASK GENMASK(3, 0)
+#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK)
#define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4)
#define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8)
#define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13)
@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
static void log_quirks(struct device *dev)
{
- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP)
+ int map;
+
+ map = BYT_RT5651_MAP(byt_rt5651_quirk);
+ switch (map) {
+ case BYT_RT5651_DMIC_MAP:
dev_info(dev, "quirk DMIC_MAP enabled");
- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP)
+ break;
+ case BYT_RT5651_IN1_MAP:
dev_info(dev, "quirk IN1_MAP enabled");
- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP)
+ break;
+ case BYT_RT5651_IN2_MAP:
dev_info(dev, "quirk IN2_MAP enabled");
- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP)
+ break;
+ case BYT_RT5651_IN1_IN2_MAP:
dev_info(dev, "quirk IN1_IN2_MAP enabled");
+ break;
+ default:
+ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map);
+ byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK;
+ byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP;
+ break;
+ }
+
if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) {
dev_info(dev, "quirk realtek,jack-detect-source %ld\n",
BYT_RT5651_JDSRC(byt_rt5651_quirk));
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 333/563] ipv6: snmp: do not use SNMP_MIB_SENTINEL anymore
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (331 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 332/563] ASoC: Intel: bytcr_rt5651: " Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 334/563] ipv6: snmp: do not track per idev ICMP6_MIB_RATELIMITHOST Greg Kroah-Hartman
` (243 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Sabrina Dubroca,
Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit ceac1fb2290d230eb83aff3761058c559440de13 ]
Use ARRAY_SIZE(), so that we know the limit at compile time.
Following patch needs this preliminary change.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/20250905165813.1470708-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 2fab94bcf313 ("ipv6: snmp: do not track per idev ICMP6_MIB_RATELIMITHOST")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/ip.h | 24 ++++++++++++++++++++++++
net/ipv6/proc.c | 43 ++++++++++++++++++++++++-------------------
2 files changed, 48 insertions(+), 19 deletions(-)
diff --git a/include/net/ip.h b/include/net/ip.h
index 6dbd2bf8fa9c9..a1624e8db1abd 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -338,6 +338,19 @@ static inline u64 snmp_fold_field64(void __percpu *mib, int offt, size_t syncp_o
} \
}
+#define snmp_get_cpu_field64_batch_cnt(buff64, stats_list, cnt, \
+ mib_statistic, offset) \
+{ \
+ int i, c; \
+ for_each_possible_cpu(c) { \
+ for (i = 0; i < cnt; i++) \
+ buff64[i] += snmp_get_cpu_field64( \
+ mib_statistic, \
+ c, stats_list[i].entry, \
+ offset); \
+ } \
+}
+
#define snmp_get_cpu_field_batch(buff, stats_list, mib_statistic) \
{ \
int i, c; \
@@ -349,6 +362,17 @@ static inline u64 snmp_fold_field64(void __percpu *mib, int offt, size_t syncp_o
} \
}
+#define snmp_get_cpu_field_batch_cnt(buff, stats_list, cnt, mib_statistic) \
+{ \
+ int i, c; \
+ for_each_possible_cpu(c) { \
+ for (i = 0; i < cnt; i++) \
+ buff[i] += snmp_get_cpu_field( \
+ mib_statistic, \
+ c, stats_list[i].entry); \
+ } \
+}
+
static inline void inet_get_local_port_range(const struct net *net, int *low, int *high)
{
u32 range = READ_ONCE(net->ipv4.ip_local_ports.range);
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index 752327b10dde7..1a20d088bb13c 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -85,7 +85,6 @@ static const struct snmp_mib snmp6_ipstats_list[] = {
SNMP_MIB_ITEM("Ip6InECT0Pkts", IPSTATS_MIB_ECT0PKTS),
SNMP_MIB_ITEM("Ip6InCEPkts", IPSTATS_MIB_CEPKTS),
SNMP_MIB_ITEM("Ip6OutTransmits", IPSTATS_MIB_OUTPKTS),
- SNMP_MIB_SENTINEL
};
static const struct snmp_mib snmp6_icmp6_list[] = {
@@ -96,7 +95,6 @@ static const struct snmp_mib snmp6_icmp6_list[] = {
SNMP_MIB_ITEM("Icmp6OutErrors", ICMP6_MIB_OUTERRORS),
SNMP_MIB_ITEM("Icmp6InCsumErrors", ICMP6_MIB_CSUMERRORS),
SNMP_MIB_ITEM("Icmp6OutRateLimitHost", ICMP6_MIB_RATELIMITHOST),
- SNMP_MIB_SENTINEL
};
/* RFC 4293 v6 ICMPMsgStatsTable; named items for RFC 2466 compatibility */
@@ -129,7 +127,6 @@ static const struct snmp_mib snmp6_udp6_list[] = {
SNMP_MIB_ITEM("Udp6InCsumErrors", UDP_MIB_CSUMERRORS),
SNMP_MIB_ITEM("Udp6IgnoredMulti", UDP_MIB_IGNOREDMULTI),
SNMP_MIB_ITEM("Udp6MemErrors", UDP_MIB_MEMERRORS),
- SNMP_MIB_SENTINEL
};
static const struct snmp_mib snmp6_udplite6_list[] = {
@@ -141,7 +138,6 @@ static const struct snmp_mib snmp6_udplite6_list[] = {
SNMP_MIB_ITEM("UdpLite6SndbufErrors", UDP_MIB_SNDBUFERRORS),
SNMP_MIB_ITEM("UdpLite6InCsumErrors", UDP_MIB_CSUMERRORS),
SNMP_MIB_ITEM("UdpLite6MemErrors", UDP_MIB_MEMERRORS),
- SNMP_MIB_SENTINEL
};
static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, atomic_long_t *smib)
@@ -182,35 +178,37 @@ static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, atomic_long_t *smib)
*/
static void snmp6_seq_show_item(struct seq_file *seq, void __percpu *pcpumib,
atomic_long_t *smib,
- const struct snmp_mib *itemlist)
+ const struct snmp_mib *itemlist,
+ int cnt)
{
unsigned long buff[SNMP_MIB_MAX];
int i;
if (pcpumib) {
- memset(buff, 0, sizeof(unsigned long) * SNMP_MIB_MAX);
+ memset(buff, 0, sizeof(unsigned long) * cnt);
- snmp_get_cpu_field_batch(buff, itemlist, pcpumib);
- for (i = 0; itemlist[i].name; i++)
+ snmp_get_cpu_field_batch_cnt(buff, itemlist, cnt, pcpumib);
+ for (i = 0; i < cnt; i++)
seq_printf(seq, "%-32s\t%lu\n",
itemlist[i].name, buff[i]);
} else {
- for (i = 0; itemlist[i].name; i++)
+ for (i = 0; i < cnt; i++)
seq_printf(seq, "%-32s\t%lu\n", itemlist[i].name,
atomic_long_read(smib + itemlist[i].entry));
}
}
static void snmp6_seq_show_item64(struct seq_file *seq, void __percpu *mib,
- const struct snmp_mib *itemlist, size_t syncpoff)
+ const struct snmp_mib *itemlist,
+ int cnt, size_t syncpoff)
{
u64 buff64[SNMP_MIB_MAX];
int i;
- memset(buff64, 0, sizeof(u64) * SNMP_MIB_MAX);
+ memset(buff64, 0, sizeof(u64) * cnt);
- snmp_get_cpu_field64_batch(buff64, itemlist, mib, syncpoff);
- for (i = 0; itemlist[i].name; i++)
+ snmp_get_cpu_field64_batch_cnt(buff64, itemlist, cnt, mib, syncpoff);
+ for (i = 0; i < cnt; i++)
seq_printf(seq, "%-32s\t%llu\n", itemlist[i].name, buff64[i]);
}
@@ -219,14 +217,19 @@ static int snmp6_seq_show(struct seq_file *seq, void *v)
struct net *net = (struct net *)seq->private;
snmp6_seq_show_item64(seq, net->mib.ipv6_statistics,
- snmp6_ipstats_list, offsetof(struct ipstats_mib, syncp));
+ snmp6_ipstats_list,
+ ARRAY_SIZE(snmp6_ipstats_list),
+ offsetof(struct ipstats_mib, syncp));
snmp6_seq_show_item(seq, net->mib.icmpv6_statistics,
- NULL, snmp6_icmp6_list);
+ NULL, snmp6_icmp6_list,
+ ARRAY_SIZE(snmp6_icmp6_list));
snmp6_seq_show_icmpv6msg(seq, net->mib.icmpv6msg_statistics->mibs);
snmp6_seq_show_item(seq, net->mib.udp_stats_in6,
- NULL, snmp6_udp6_list);
+ NULL, snmp6_udp6_list,
+ ARRAY_SIZE(snmp6_udp6_list));
snmp6_seq_show_item(seq, net->mib.udplite_stats_in6,
- NULL, snmp6_udplite6_list);
+ NULL, snmp6_udplite6_list,
+ ARRAY_SIZE(snmp6_udplite6_list));
return 0;
}
@@ -236,9 +239,11 @@ static int snmp6_dev_seq_show(struct seq_file *seq, void *v)
seq_printf(seq, "%-32s\t%u\n", "ifIndex", idev->dev->ifindex);
snmp6_seq_show_item64(seq, idev->stats.ipv6,
- snmp6_ipstats_list, offsetof(struct ipstats_mib, syncp));
+ snmp6_ipstats_list,
+ ARRAY_SIZE(snmp6_ipstats_list),
+ offsetof(struct ipstats_mib, syncp));
snmp6_seq_show_item(seq, NULL, idev->stats.icmpv6dev->mibs,
- snmp6_icmp6_list);
+ snmp6_icmp6_list, ARRAY_SIZE(snmp6_icmp6_list));
snmp6_seq_show_icmpv6msg(seq, idev->stats.icmpv6msgdev->mibs);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 334/563] ipv6: snmp: do not track per idev ICMP6_MIB_RATELIMITHOST
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (332 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 333/563] ipv6: snmp: do not use SNMP_MIB_SENTINEL anymore Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 335/563] drm/msm: Fix bootup splat with separate_gpu_drm modparam Greg Kroah-Hartman
` (242 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Jamie Bainbridge,
Abhishek Rawal, Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 2fab94bcf313480336b0a41eb45a24ffd5087490 ]
Blamed commit added a critical false sharing on a single
atomic_long_t under DOS, like receiving UDP packets
to closed ports.
Per netns ICMP6_MIB_RATELIMITHOST tracking uses per-cpu
storage and is enough, we do not need per-device and slow tracking.
Fixes: d0941130c9351 ("icmp: Add counters for rate limits")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jamie Bainbridge <jamie.bainbridge@gmail.com>
Cc: Abhishek Rawal <rawal.abhishek92@gmail.com>
Link: https://patch.msgid.link/20250905165813.1470708-4-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/icmp.c | 3 +--
net/ipv6/proc.c | 6 +++++-
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 95cdd4cacb004..56c974cf75d15 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -230,8 +230,7 @@ static bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
}
rcu_read_unlock();
if (!res)
- __ICMP6_INC_STATS(net, ip6_dst_idev(dst),
- ICMP6_MIB_RATELIMITHOST);
+ __ICMP6_INC_STATS(net, NULL, ICMP6_MIB_RATELIMITHOST);
else
icmp_global_consume(net);
dst_release(dst);
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index 1a20d088bb13c..eb268b0700258 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -94,6 +94,7 @@ static const struct snmp_mib snmp6_icmp6_list[] = {
SNMP_MIB_ITEM("Icmp6OutMsgs", ICMP6_MIB_OUTMSGS),
SNMP_MIB_ITEM("Icmp6OutErrors", ICMP6_MIB_OUTERRORS),
SNMP_MIB_ITEM("Icmp6InCsumErrors", ICMP6_MIB_CSUMERRORS),
+/* ICMP6_MIB_RATELIMITHOST needs to be last, see snmp6_dev_seq_show(). */
SNMP_MIB_ITEM("Icmp6OutRateLimitHost", ICMP6_MIB_RATELIMITHOST),
};
@@ -242,8 +243,11 @@ static int snmp6_dev_seq_show(struct seq_file *seq, void *v)
snmp6_ipstats_list,
ARRAY_SIZE(snmp6_ipstats_list),
offsetof(struct ipstats_mib, syncp));
+
+ /* Per idev icmp stats do not have ICMP6_MIB_RATELIMITHOST */
snmp6_seq_show_item(seq, NULL, idev->stats.icmpv6dev->mibs,
- snmp6_icmp6_list, ARRAY_SIZE(snmp6_icmp6_list));
+ snmp6_icmp6_list, ARRAY_SIZE(snmp6_icmp6_list) - 1);
+
snmp6_seq_show_icmpv6msg(seq, idev->stats.icmpv6msgdev->mibs);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 335/563] drm/msm: Fix bootup splat with separate_gpu_drm modparam
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (333 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 334/563] ipv6: snmp: do not track per idev ICMP6_MIB_RATELIMITHOST Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 336/563] drm/msm/dpu: fix incorrect type for ret Greg Kroah-Hartman
` (241 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Akhil P Oommen, Dmitry Baryshkov,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil P Oommen <akhilpo@oss.qualcomm.com>
[ Upstream commit f028bcafb6dfb4c2bb656cbff9e6a66222d3d3d7 ]
The drm_gem_for_each_gpuvm_bo() call from lookup_vma() accesses
drm_gem_obj.gpuva.list, which is not initialized when the drm driver
does not support DRIVER_GEM_GPUVA feature. Enable it for msm_kms
drm driver to fix the splat seen when msm.separate_gpu_drm=1 modparam
is set:
[ 9.506020] Unable to handle kernel paging request at virtual address fffffffffffffff0
[ 9.523160] Mem abort info:
[ 9.523161] ESR = 0x0000000096000006
[ 9.523163] EC = 0x25: DABT (current EL), IL = 32 bits
[ 9.523165] SET = 0, FnV = 0
[ 9.523166] EA = 0, S1PTW = 0
[ 9.523167] FSC = 0x06: level 2 translation fault
[ 9.523169] Data abort info:
[ 9.523170] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000
[ 9.523171] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 9.523172] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 9.523174] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000ad370f000
[ 9.523176] [fffffffffffffff0] pgd=0000000000000000, p4d=0000000ad4787403, pud=0000000ad4788403, pmd=0000000000000000
[ 9.523184] Internal error: Oops: 0000000096000006 [#1] SMP
[ 9.592968] CPU: 9 UID: 0 PID: 448 Comm: (udev-worker) Not tainted 6.17.0-rc4-assorted-fix-00005-g0e9bb53a2282-dirty #3 PREEMPT
[ 9.592970] Hardware name: Qualcomm CRD, BIOS 6.0.240718.BOOT.MXF.2.4-00515-HAMOA-1 07/18/2024
[ 9.592971] pstate: a1400005 (NzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
[ 9.592973] pc : lookup_vma+0x28/0xe0 [msm]
[ 9.592996] lr : get_vma_locked+0x2c/0x128 [msm]
[ 9.763632] sp : ffff800082dab460
[ 9.763666] Call trace:
[ 9.763668] lookup_vma+0x28/0xe0 [msm] (P)
[ 9.763688] get_vma_locked+0x2c/0x128 [msm]
[ 9.763706] msm_gem_get_and_pin_iova_range+0x68/0x11c [msm]
[ 9.763723] msm_gem_get_and_pin_iova+0x18/0x24 [msm]
[ 9.763740] msm_fbdev_driver_fbdev_probe+0xd0/0x258 [msm]
[ 9.763760] __drm_fb_helper_initial_config_and_unlock+0x288/0x528 [drm_kms_helper]
[ 9.763771] drm_fb_helper_initial_config+0x44/0x54 [drm_kms_helper]
[ 9.763779] drm_fbdev_client_hotplug+0x84/0xd4 [drm_client_lib]
[ 9.763782] drm_client_register+0x58/0x9c [drm]
[ 9.763806] drm_fbdev_client_setup+0xe8/0xcf0 [drm_client_lib]
[ 9.763809] drm_client_setup+0xb4/0xd8 [drm_client_lib]
[ 9.763811] msm_drm_kms_post_init+0x2c/0x3c [msm]
[ 9.763830] msm_drm_init+0x1a8/0x22c [msm]
[ 9.763848] msm_drm_bind+0x30/0x3c [msm]
[ 9.919273] try_to_bring_up_aggregate_device+0x168/0x1d4
[ 9.919283] __component_add+0xa4/0x170
[ 9.919286] component_add+0x14/0x20
[ 9.919288] msm_dp_display_probe_tail+0x4c/0xac [msm]
[ 9.919315] msm_dp_auxbus_done_probe+0x14/0x20 [msm]
[ 9.919335] dp_aux_ep_probe+0x4c/0xf0 [drm_dp_aux_bus]
[ 9.919341] really_probe+0xbc/0x298
[ 9.919345] __driver_probe_device+0x78/0x12c
[ 9.919348] driver_probe_device+0x40/0x160
[ 9.919350] __driver_attach+0x94/0x19c
[ 9.919353] bus_for_each_dev+0x74/0xd4
[ 9.919355] driver_attach+0x24/0x30
[ 9.919358] bus_add_driver+0xe4/0x208
[ 9.919360] driver_register+0x60/0x128
[ 9.919363] __dp_aux_dp_driver_register+0x24/0x30 [drm_dp_aux_bus]
[ 9.919365] atana33xc20_init+0x20/0x1000 [panel_samsung_atna33xc20]
[ 9.919370] do_one_initcall+0x6c/0x1b0
[ 9.919374] do_init_module+0x58/0x234
[ 9.919377] load_module+0x19cc/0x1bd4
[ 9.919380] init_module_from_file+0x84/0xc4
[ 9.919382] __arm64_sys_finit_module+0x1b8/0x2cc
[ 9.919384] invoke_syscall+0x48/0x110
[ 9.919389] el0_svc_common.constprop.0+0xc8/0xe8
[ 9.919393] do_el0_svc+0x20/0x2c
[ 9.919396] el0_svc+0x34/0xf0
[ 9.919401] el0t_64_sync_handler+0xa0/0xe4
[ 9.919403] el0t_64_sync+0x198/0x19c
[ 9.919407] Code: eb0000bf 54000480 d100a003 aa0303e2 (f8418c44)
[ 9.919410] ---[ end trace 0000000000000000 ]---
Fixes: 217ed15bd399 ("drm/msm: enable separate binding of GPU and display devices")
Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/672257/
Link: https://lore.kernel.org/r/20250902-assorted-sept-1-v1-1-f3ec9baed513@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/msm_drv.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 9dcc7a596a11d..7e977fec41007 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -826,6 +826,7 @@ static const struct file_operations fops = {
#define DRIVER_FEATURES_KMS ( \
DRIVER_GEM | \
+ DRIVER_GEM_GPUVA | \
DRIVER_ATOMIC | \
DRIVER_MODESET | \
0 )
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 336/563] drm/msm/dpu: fix incorrect type for ret
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (334 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 335/563] drm/msm: Fix bootup splat with separate_gpu_drm modparam Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 337/563] wifi: mac80211: fix reporting of all valid links in sta_set_sinfo() Greg Kroah-Hartman
` (240 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qianfeng Rong, Dmitry Baryshkov,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <rongqianfeng@vivo.com>
[ Upstream commit 88ec0e01a880e3326794e149efae39e3aa4dbbec ]
Change 'ret' from unsigned long to int, as storing negative error codes
in an unsigned long makes it never equal to -ETIMEDOUT, causing logical
errors.
Fixes: d7d0e73f7de3 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback")
Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/671100/
Link: https://lore.kernel.org/r/20250826092047.224341-1-rongqianfeng@vivo.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
index 56a5b596554db..46f348972a975 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
@@ -446,7 +446,7 @@ static void _dpu_encoder_phys_wb_handle_wbdone_timeout(
static int dpu_encoder_phys_wb_wait_for_commit_done(
struct dpu_encoder_phys *phys_enc)
{
- unsigned long ret;
+ int ret;
struct dpu_encoder_wait_info wait_info;
struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 337/563] wifi: mac80211: fix reporting of all valid links in sta_set_sinfo()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (335 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 336/563] drm/msm/dpu: fix incorrect type for ret Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 338/563] fs: ntfs3: Fix integer overflow in run_unpack() Greg Kroah-Hartman
` (239 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sarika Sharma, Johannes Berg,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarika Sharma <quic_sarishar@quicinc.com>
[ Upstream commit eebccbfea4184feb758c104783b870ec4ddb6aec ]
Currently, sta_set_sinfo() fails to populate link-level station info
when sinfo->valid_links is initially 0 and sta->sta.valid_links has
bits set for links other than link 0. This typically occurs when
association happens on a non-zero link or link 0 deleted dynamically.
In such cases, the for_each_valid_link(sinfo, link_id) loop only
executes for link 0 and terminates early, since sinfo->valid_links
remains 0. As a result, only MLD-level information is reported to
userspace.
Hence to fix, initialize sinfo->valid_links with sta->sta.valid_links
before entering the loop to ensure loop executes for each valid link.
During iteration, mask out invalid links from sinfo->valid_links if
any of sta->link[link_id], sdata->link[link_id], or sinfo->links[link_id]
are not present, to report only valid link information.
Fixes: 505991fba9ec ("wifi: mac80211: extend support to fill link level sinfo structure")
Signed-off-by: Sarika Sharma <quic_sarishar@quicinc.com>
Link: https://patch.msgid.link/20250904104054.790321-1-quic_sarishar@quicinc.com
[clarify comment]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/sta_info.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 8c550aab9bdce..ebcec5241a944 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -3206,16 +3206,20 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo,
struct link_sta_info *link_sta;
ether_addr_copy(sinfo->mld_addr, sta->addr);
+
+ /* assign valid links first for iteration */
+ sinfo->valid_links = sta->sta.valid_links;
+
for_each_valid_link(sinfo, link_id) {
link_sta = wiphy_dereference(sta->local->hw.wiphy,
sta->link[link_id]);
link = wiphy_dereference(sdata->local->hw.wiphy,
sdata->link[link_id]);
- if (!link_sta || !sinfo->links[link_id] || !link)
+ if (!link_sta || !sinfo->links[link_id] || !link) {
+ sinfo->valid_links &= ~BIT(link_id);
continue;
-
- sinfo->valid_links = sta->sta.valid_links;
+ }
sta_set_link_sinfo(sta, sinfo->links[link_id],
link, tidstats);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 338/563] fs: ntfs3: Fix integer overflow in run_unpack()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (336 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 337/563] wifi: mac80211: fix reporting of all valid links in sta_set_sinfo() Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 339/563] fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist Greg Kroah-Hartman
` (238 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vitaly Grigoryev, Konstantin Komarov,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Grigoryev <Vitaly.Grigoryev@kaspersky.com>
[ Upstream commit 736fc7bf5f68f6b74a0925b7e072c571838657d2 ]
The MFT record relative to the file being opened contains its runlist,
an array containing information about the file's location on the physical
disk. Analysis of all Call Stack paths showed that the values of the
runlist array, from which LCNs are calculated, are not validated before
run_unpack function.
The run_unpack function decodes the compressed runlist data format
from MFT attributes (for example, $DATA), converting them into a runs_tree
structure, which describes the mapping of virtual clusters (VCN) to
logical clusters (LCN). The NTFS3 subsystem also has a shortcut for
deleting files from MFT records - in this case, the RUN_DEALLOCATE
command is sent to the run_unpack input, and the function logic
provides that all data transferred to the runlist about file or
directory is deleted without creating a runs_tree structure.
Substituting the runlist in the $DATA attribute of the MFT record for an
arbitrary file can lead either to access to arbitrary data on the disk
bypassing access checks to them (since the inode access check
occurs above) or to destruction of arbitrary data on the disk.
Add overflow check for addition operation.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
Signed-off-by: Vitaly Grigoryev <Vitaly.Grigoryev@kaspersky.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/run.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c
index 6e86d66197ef2..88550085f7457 100644
--- a/fs/ntfs3/run.c
+++ b/fs/ntfs3/run.c
@@ -9,6 +9,7 @@
#include <linux/blkdev.h>
#include <linux/fs.h>
#include <linux/log2.h>
+#include <linux/overflow.h>
#include "debug.h"
#include "ntfs.h"
@@ -982,14 +983,18 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino,
if (!dlcn)
return -EINVAL;
- lcn = prev_lcn + dlcn;
+
+ if (check_add_overflow(prev_lcn, dlcn, &lcn))
+ return -EINVAL;
prev_lcn = lcn;
} else {
/* The size of 'dlcn' can't be > 8. */
return -EINVAL;
}
- next_vcn = vcn64 + len;
+ if (check_add_overflow(vcn64, len, &next_vcn))
+ return -EINVAL;
+
/* Check boundary. */
if (next_vcn > evcn + 1)
return -EINVAL;
@@ -1153,7 +1158,8 @@ int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn)
return -EINVAL;
run_buf += size_size + offset_size;
- vcn64 += len;
+ if (check_add_overflow(vcn64, len, &vcn64))
+ return -EINVAL;
#ifndef CONFIG_NTFS3_64BIT_CLUSTER
if (vcn64 > 0x100000000ull)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 339/563] fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (337 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 338/563] fs: ntfs3: Fix integer overflow in run_unpack() Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 340/563] iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() Greg Kroah-Hartman
` (237 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+b0373017f711c06ada64,
Moon Hee Lee, Konstantin Komarov, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moon Hee Lee <moonhee.lee.ca@gmail.com>
[ Upstream commit 0dc7117da8f92dd5fe077d712a756eccbe377d40 ]
Index allocation requires at least one bit in the $BITMAP attribute to
track usage of index entries. If the bitmap is empty while index blocks
are already present, this reflects on-disk corruption.
syzbot triggered this condition using a malformed NTFS image. During a
rename() operation involving a long filename (which spans multiple
index entries), the empty bitmap allowed the name to be added without
valid tracking. Subsequent deletion of the original entry failed with
-ENOENT, due to unexpected index state.
Reject such cases by verifying that the bitmap is not empty when index
blocks exist.
Reported-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b0373017f711c06ada64
Fixes: d99208b91933 ("fs/ntfs3: cancle set bad inode after removing name fails")
Tested-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com
Signed-off-by: Moon Hee Lee <moonhee.lee.ca@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/index.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index 1bf2a6593dec6..6d1bf890929d9 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1508,6 +1508,16 @@ static int indx_add_allocate(struct ntfs_index *indx, struct ntfs_inode *ni,
bmp_size = bmp_size_v = le32_to_cpu(bmp->res.data_size);
}
+ /*
+ * Index blocks exist, but $BITMAP has zero valid bits.
+ * This implies an on-disk corruption and must be rejected.
+ */
+ if (in->name == I30_NAME &&
+ unlikely(bmp_size_v == 0 && indx->alloc_run.count)) {
+ err = -EINVAL;
+ goto out1;
+ }
+
bit = bmp_size << 3;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 340/563] iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (338 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 339/563] fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 341/563] iio: consumers: Fix offset handling " Greg Kroah-Hartman
` (236 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matteo Martelli, Andy Shevchenko,
Hans de Goede, Jonathan Cameron, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hansg@kernel.org>
[ Upstream commit 0f85406bf830eb8747dd555ab53c9d97ee4af293 ]
There is an issue with the handling of negative channel scales
in iio_convert_raw_to_processed_unlocked() when the channel-scale
is of the IIO_VAL_INT_PLUS_[MICRO|NANO] type:
Things work for channel-scale values > -1.0 and < 0.0 because of
the use of signed values in:
*processed += div_s64(raw64 * (s64)scale_val2 * scale, 1000000LL);
Things will break however for scale values < -1.0. Lets for example say
that raw = 2, (caller-provided)scale = 10 and (channel)scale_val = -1.5.
The result should then be 2 * 10 * -1.5 = -30.
channel-scale = -1.5 means scale_val = -1 and scale_val2 = 500000,
now lets see what gets stored in processed:
1. *processed = raw64 * scale_val * scale;
2. *processed += raw64 * scale_val2 * scale / 1000000LL;
1. Sets processed to 2 * -1 * 10 = -20
2. Adds 2 * 500000 * 10 / 1000000 = 10 to processed
And the end result is processed = -20 + 10 = -10, which is not correct.
Fix this by always using the abs value of both scale_val and scale_val2
and if either is negative multiply the end-result by -1.
Note there seems to be an unwritten rule about negative
IIO_VAL_INT_PLUS_[MICRO|NANO] values that:
i. values > -1.0 and < 0.0 are written as val=0 val2=-xxx
ii. values <= -1.0 are written as val=-xxx val2=xxx
But iio_format_value() will also correctly display a third option:
iii. values <= -1.0 written as val=-xxx val2=-xxx
Since iio_format_value() uses abs(val) when val2 < 0.
This fix also makes iio_convert_raw_to_processed() properly handle
channel-scales using this third option.
Fixes: 48e44ce0f881 ("iio:inkern: Add function to read the processed value")
Cc: Matteo Martelli <matteomartelli3@gmail.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Link: https://patch.msgid.link/20250831104825.15097-2-hansg@kernel.org
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/inkern.c | 28 ++++++++++++++--------------
1 file changed, 14 insertions(+), 14 deletions(-)
diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
index c174ebb7d5e6d..d36a80a7b8a93 100644
--- a/drivers/iio/inkern.c
+++ b/drivers/iio/inkern.c
@@ -11,6 +11,7 @@
#include <linux/mutex.h>
#include <linux/property.h>
#include <linux/slab.h>
+#include <linux/units.h>
#include <linux/iio/iio.h>
#include <linux/iio/iio-opaque.h>
@@ -604,7 +605,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
{
int scale_type, scale_val, scale_val2;
int offset_type, offset_val, offset_val2;
- s64 raw64 = raw;
+ s64 denominator, raw64 = raw;
offset_type = iio_channel_read(chan, &offset_val, &offset_val2,
IIO_CHAN_INFO_OFFSET);
@@ -648,20 +649,19 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
*processed = raw64 * scale_val * scale;
break;
case IIO_VAL_INT_PLUS_MICRO:
- if (scale_val2 < 0)
- *processed = -raw64 * scale_val * scale;
- else
- *processed = raw64 * scale_val * scale;
- *processed += div_s64(raw64 * (s64)scale_val2 * scale,
- 1000000LL);
- break;
case IIO_VAL_INT_PLUS_NANO:
- if (scale_val2 < 0)
- *processed = -raw64 * scale_val * scale;
- else
- *processed = raw64 * scale_val * scale;
- *processed += div_s64(raw64 * (s64)scale_val2 * scale,
- 1000000000LL);
+ switch (scale_type) {
+ case IIO_VAL_INT_PLUS_MICRO:
+ denominator = MICRO;
+ break;
+ case IIO_VAL_INT_PLUS_NANO:
+ denominator = NANO;
+ break;
+ }
+ *processed = raw64 * scale * abs(scale_val);
+ *processed += div_s64(raw64 * scale * abs(scale_val2), denominator);
+ if (scale_val < 0 || scale_val2 < 0)
+ *processed *= -1;
break;
case IIO_VAL_FRACTIONAL:
*processed = div_s64(raw64 * (s64)scale_val * scale,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 341/563] iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (339 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 340/563] iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 342/563] mm/slub: Fix cmp_loc_by_count() to return 0 when counts are equal Greg Kroah-Hartman
` (235 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liam Beguin, Andy Shevchenko,
Hans de Goede, Jonathan Cameron, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hansg@kernel.org>
[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ]
Fix iio_convert_raw_to_processed() offset handling for channels without
a scale attribute.
The offset has been applied to the raw64 value not to the original raw
value. Use the raw64 value so that the offset is taken into account.
Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available")
Cc: Liam Beguin <liambeguin@gmail.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Link: https://patch.msgid.link/20250831104825.15097-3-hansg@kernel.org
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/inkern.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
index d36a80a7b8a93..642beb4b3360d 100644
--- a/drivers/iio/inkern.c
+++ b/drivers/iio/inkern.c
@@ -640,7 +640,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
* If no channel scaling is available apply consumer scale to
* raw value and return.
*/
- *processed = raw * scale;
+ *processed = raw64 * scale;
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 342/563] mm/slub: Fix cmp_loc_by_count() to return 0 when counts are equal
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (340 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 341/563] iio: consumers: Fix offset handling " Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 343/563] tools: ynl: fix undefined variable name Greg Kroah-Hartman
` (234 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joshua Hahn, Kuan-Wei Chiu,
Harry Yoo, Vlastimil Babka, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuan-Wei Chiu <visitorckw@gmail.com>
[ Upstream commit e1c4350327b39c9cad27b6c5779b3754384f26c8 ]
The comparison function cmp_loc_by_count() used for sorting stack trace
locations in debugfs currently returns -1 if a->count > b->count and 1
otherwise. This breaks the antisymmetry property required by sort(),
because when two counts are equal, both cmp(a, b) and cmp(b, a) return
1.
This can lead to undefined or incorrect ordering results. Fix it by
updating the comparison logic to explicitly handle the case when counts
are equal, and use cmp_int() to ensure the comparison function adheres
to the required mathematical properties of antisymmetry.
Fixes: 553c0369b3e1 ("mm/slub: sort debugfs output by frequency of stack traces")
Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/slub.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/mm/slub.c b/mm/slub.c
index d257141896c95..264fc76455d73 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -7731,10 +7731,7 @@ static int cmp_loc_by_count(const void *a, const void *b, const void *data)
struct location *loc1 = (struct location *)a;
struct location *loc2 = (struct location *)b;
- if (loc1->count > loc2->count)
- return -1;
- else
- return 1;
+ return cmp_int(loc2->count, loc1->count);
}
static void *slab_debugfs_start(struct seq_file *seq, loff_t *ppos)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 343/563] tools: ynl: fix undefined variable name
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (341 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 342/563] mm/slub: Fix cmp_loc_by_count() to return 0 when counts are equal Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 344/563] RDMA/mlx5: Fix page size bitmap calculation for KSM mode Greg Kroah-Hartman
` (233 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthieu Baerts (NGI0),
Donald Hunter, Asbjørn Sloth Tønnesen, Jakub Kicinski,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
[ Upstream commit 7a3aaaa9fce710938c3557e5708ba5b00dd38226 ]
This variable used in the error path was not defined according to Ruff.
msg_format.attr_set is used instead, presumably the one that was
supposed to be used originally.
This is linked to Ruff error F821 [1]:
An undefined name is likely to raise NameError at runtime.
Fixes: 1769e2be4baa ("tools/net/ynl: Add 'sub-message' attribute decoding to ynl")
Link: https://docs.astral.sh/ruff/rules/undefined-name/ [1]
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
Reviewed-by: Asbjørn Sloth Tønnesen <ast@fiberby.net>
Link: https://patch.msgid.link/20250909-net-next-ynl-ruff-v1-1-238c2bccdd99@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/net/ynl/pyynl/lib/ynl.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/net/ynl/pyynl/lib/ynl.py b/tools/net/ynl/pyynl/lib/ynl.py
index 8244a5f440b2b..15ddb0b1adb63 100644
--- a/tools/net/ynl/pyynl/lib/ynl.py
+++ b/tools/net/ynl/pyynl/lib/ynl.py
@@ -746,7 +746,7 @@ class YnlFamily(SpecFamily):
subdict = self._decode(NlAttrs(attr.raw, offset), msg_format.attr_set)
decoded.update(subdict)
else:
- raise Exception(f"Unknown attribute-set '{attr_space}' when decoding '{attr_spec.name}'")
+ raise Exception(f"Unknown attribute-set '{msg_format.attr_set}' when decoding '{attr_spec.name}'")
return decoded
def _decode(self, attrs, space, outer_attrs = None):
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 344/563] RDMA/mlx5: Fix page size bitmap calculation for KSM mode
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (342 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 343/563] tools: ynl: fix undefined variable name Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 345/563] netfilter: ipset: Remove unused htable_bits in macro ahash_region Greg Kroah-Hartman
` (232 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Edward Srouji, Michael Guralnik,
Leon Romanovsky, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Srouji <edwards@nvidia.com>
[ Upstream commit 372fdb5c75b61f038f4abf596abdcf01acbdb7af ]
When using KSM (Key Scatter-gather Memory) access mode, the HW requires
the IOVA to be aligned to the selected page size.
Without this alignment, the HW may not function correctly.
Currently, mlx5_umem_mkc_find_best_pgsz() does not filter out page sizes
that would result in misaligned IOVAs for KSM mode. This can lead to
selecting page sizes that are incompatible with the given IOVA.
Fix this by filtering the page size bitmap when in KSM mode, keeping
only page sizes to which the IOVA is aligned to.
Fixes: fcfb03597b7d ("RDMA/mlx5: Align mkc page size capability check to PRM")
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Link: https://patch.msgid.link/20250824144839.154717-1-edwards@nvidia.com
Reviewed-by: Michael Guralnik <michaelgur@nvidia.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/mlx5_ib.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index 8d21ecf8a996f..15e3962633dc3 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -1803,6 +1803,10 @@ mlx5_umem_mkc_find_best_pgsz(struct mlx5_ib_dev *dev, struct ib_umem *umem,
bitmap = GENMASK_ULL(max_log_entity_size_cap, min_log_entity_size_cap);
+ /* In KSM mode HW requires IOVA and mkey's page size to be aligned */
+ if (access_mode == MLX5_MKC_ACCESS_MODE_KSM && iova)
+ bitmap &= GENMASK_ULL(__ffs64(iova), 0);
+
return ib_umem_find_best_pgsz(umem, bitmap, iova);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 345/563] netfilter: ipset: Remove unused htable_bits in macro ahash_region
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (343 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 344/563] RDMA/mlx5: Fix page size bitmap calculation for KSM mode Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 346/563] ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable Greg Kroah-Hartman
` (231 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhen Ni, Phil Sutter,
Florian Westphal, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <zhen.ni@easystack.cn>
[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ]
Since the ahash_region() macro was redefined to calculate the region
index solely from HTABLE_REGION_BITS, the htable_bits parameter became
unused.
Remove the unused htable_bits argument and its call sites, simplifying
the code without changing semantics.
Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types")
Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
Reviewed-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index 5251524b96afa..5e4453e9ef8e7 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -63,7 +63,7 @@ struct hbucket {
: jhash_size((htable_bits) - HTABLE_REGION_BITS))
#define ahash_sizeof_regions(htable_bits) \
(ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region))
-#define ahash_region(n, htable_bits) \
+#define ahash_region(n) \
((n) / jhash_size(HTABLE_REGION_BITS))
#define ahash_bucket_start(h, htable_bits) \
((htable_bits) < HTABLE_REGION_BITS ? 0 \
@@ -702,7 +702,7 @@ mtype_resize(struct ip_set *set, bool retried)
#endif
key = HKEY(data, h->initval, htable_bits);
m = __ipset_dereference(hbucket(t, key));
- nr = ahash_region(key, htable_bits);
+ nr = ahash_region(key);
if (!m) {
m = kzalloc(sizeof(*m) +
AHASH_INIT_SIZE * dsize,
@@ -852,7 +852,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
rcu_read_lock_bh();
t = rcu_dereference_bh(h->table);
key = HKEY(value, h->initval, t->htable_bits);
- r = ahash_region(key, t->htable_bits);
+ r = ahash_region(key);
atomic_inc(&t->uref);
elements = t->hregion[r].elements;
maxelem = t->maxelem;
@@ -1050,7 +1050,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,
rcu_read_lock_bh();
t = rcu_dereference_bh(h->table);
key = HKEY(value, h->initval, t->htable_bits);
- r = ahash_region(key, t->htable_bits);
+ r = ahash_region(key);
atomic_inc(&t->uref);
rcu_read_unlock_bh();
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 346/563] ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (344 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 345/563] netfilter: ipset: Remove unused htable_bits in macro ahash_region Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 347/563] HID: steelseries: Fix STEELSERIES_SRWS1 handling in steelseries_remove() Greg Kroah-Hartman
` (230 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+1651b5234028c294c339,
Julian Anastasov, Zhang Tengfei, Florian Westphal, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Tengfei <zhtfdev@gmail.com>
[ Upstream commit 944b6b216c0387ac3050cd8b773819ae360bfb1c ]
KCSAN reported a data-race on the `ipvs->enable` flag, which is
written in the control path and read concurrently from many other
contexts.
Following a suggestion by Julian, this patch fixes the race by
converting all accesses to use `WRITE_ONCE()/READ_ONCE()`.
This lightweight approach ensures atomic access and acts as a
compiler barrier, preventing unsafe optimizations where the flag
is checked in loops (e.g., in ip_vs_est.c).
Additionally, the `enable` checks in the fast-path hooks
(`ip_vs_in_hook`, `ip_vs_out_hook`, `ip_vs_forward_icmp`) are
removed. These are unnecessary since commit 857ca89711de
("ipvs: register hooks only with services"). The `enable=0`
condition they check for can only occur in two rare and non-fatal
scenarios: 1) after hooks are registered but before the flag is set,
and 2) after hooks are unregistered on cleanup_net. In the worst
case, a single packet might be mishandled (e.g., dropped), which
does not lead to a system crash or data corruption. Adding a check
in the performance-critical fast-path to handle this harmless
condition is not a worthwhile trade-off.
Fixes: 857ca89711de ("ipvs: register hooks only with services")
Reported-by: syzbot+1651b5234028c294c339@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1651b5234028c294c339
Suggested-by: Julian Anastasov <ja@ssi.bg>
Link: https://lore.kernel.org/lvs-devel/2189fc62-e51e-78c9-d1de-d35b8e3657e3@ssi.bg/
Signed-off-by: Zhang Tengfei <zhtfdev@gmail.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/ipvs/ip_vs_conn.c | 4 ++--
net/netfilter/ipvs/ip_vs_core.c | 11 ++++-------
net/netfilter/ipvs/ip_vs_ctl.c | 6 +++---
net/netfilter/ipvs/ip_vs_est.c | 16 ++++++++--------
4 files changed, 17 insertions(+), 20 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 965f3c8e5089d..37ebb0cb62b8b 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -885,7 +885,7 @@ static void ip_vs_conn_expire(struct timer_list *t)
* conntrack cleanup for the net.
*/
smp_rmb();
- if (ipvs->enable)
+ if (READ_ONCE(ipvs->enable))
ip_vs_conn_drop_conntrack(cp);
}
@@ -1439,7 +1439,7 @@ void ip_vs_expire_nodest_conn_flush(struct netns_ipvs *ipvs)
cond_resched_rcu();
/* netns clean up started, abort delayed work */
- if (!ipvs->enable)
+ if (!READ_ONCE(ipvs->enable))
break;
}
rcu_read_unlock();
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index c7a8a08b73089..5ea7ab8bf4dcc 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1353,9 +1353,6 @@ ip_vs_out_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *stat
if (unlikely(!skb_dst(skb)))
return NF_ACCEPT;
- if (!ipvs->enable)
- return NF_ACCEPT;
-
ip_vs_fill_iph_skb(af, skb, false, &iph);
#ifdef CONFIG_IP_VS_IPV6
if (af == AF_INET6) {
@@ -1940,7 +1937,7 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state
return NF_ACCEPT;
}
/* ipvs enabled in this netns ? */
- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))
+ if (unlikely(sysctl_backup_only(ipvs)))
return NF_ACCEPT;
ip_vs_fill_iph_skb(af, skb, false, &iph);
@@ -2108,7 +2105,7 @@ ip_vs_forward_icmp(void *priv, struct sk_buff *skb,
int r;
/* ipvs enabled in this netns ? */
- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))
+ if (unlikely(sysctl_backup_only(ipvs)))
return NF_ACCEPT;
if (state->pf == NFPROTO_IPV4) {
@@ -2295,7 +2292,7 @@ static int __net_init __ip_vs_init(struct net *net)
return -ENOMEM;
/* Hold the beast until a service is registered */
- ipvs->enable = 0;
+ WRITE_ONCE(ipvs->enable, 0);
ipvs->net = net;
/* Counters used for creating unique names */
ipvs->gen = atomic_read(&ipvs_netns_cnt);
@@ -2367,7 +2364,7 @@ static void __net_exit __ip_vs_dev_cleanup_batch(struct list_head *net_list)
ipvs = net_ipvs(net);
ip_vs_unregister_hooks(ipvs, AF_INET);
ip_vs_unregister_hooks(ipvs, AF_INET6);
- ipvs->enable = 0; /* Disable packet reception */
+ WRITE_ONCE(ipvs->enable, 0); /* Disable packet reception */
smp_wmb();
ip_vs_sync_net_cleanup(ipvs);
}
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 6a6fc44785337..4c8fa22be88ad 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -256,7 +256,7 @@ static void est_reload_work_handler(struct work_struct *work)
struct ip_vs_est_kt_data *kd = ipvs->est_kt_arr[id];
/* netns clean up started, abort delayed work */
- if (!ipvs->enable)
+ if (!READ_ONCE(ipvs->enable))
goto unlock;
if (!kd)
continue;
@@ -1483,9 +1483,9 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
*svc_p = svc;
- if (!ipvs->enable) {
+ if (!READ_ONCE(ipvs->enable)) {
/* Now there is a service - full throttle */
- ipvs->enable = 1;
+ WRITE_ONCE(ipvs->enable, 1);
/* Start estimation for first time */
ip_vs_est_reload_start(ipvs);
diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c
index 15049b8267327..93a925f1ed9b8 100644
--- a/net/netfilter/ipvs/ip_vs_est.c
+++ b/net/netfilter/ipvs/ip_vs_est.c
@@ -231,7 +231,7 @@ static int ip_vs_estimation_kthread(void *data)
void ip_vs_est_reload_start(struct netns_ipvs *ipvs)
{
/* Ignore reloads before first service is added */
- if (!ipvs->enable)
+ if (!READ_ONCE(ipvs->enable))
return;
ip_vs_est_stopped_recalc(ipvs);
/* Bump the kthread configuration genid */
@@ -306,7 +306,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs)
int i;
if ((unsigned long)ipvs->est_kt_count >= ipvs->est_max_threads &&
- ipvs->enable && ipvs->est_max_threads)
+ READ_ONCE(ipvs->enable) && ipvs->est_max_threads)
return -EINVAL;
mutex_lock(&ipvs->est_mutex);
@@ -343,7 +343,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs)
}
/* Start kthread tasks only when services are present */
- if (ipvs->enable && !ip_vs_est_stopped(ipvs)) {
+ if (READ_ONCE(ipvs->enable) && !ip_vs_est_stopped(ipvs)) {
ret = ip_vs_est_kthread_start(ipvs, kd);
if (ret < 0)
goto out;
@@ -486,7 +486,7 @@ int ip_vs_start_estimator(struct netns_ipvs *ipvs, struct ip_vs_stats *stats)
struct ip_vs_estimator *est = &stats->est;
int ret;
- if (!ipvs->est_max_threads && ipvs->enable)
+ if (!ipvs->est_max_threads && READ_ONCE(ipvs->enable))
ipvs->est_max_threads = ip_vs_est_max_threads(ipvs);
est->ktid = -1;
@@ -663,7 +663,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max)
/* Wait for cpufreq frequency transition */
wait_event_idle_timeout(wq, kthread_should_stop(),
HZ / 50);
- if (!ipvs->enable || kthread_should_stop())
+ if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
goto stop;
}
@@ -681,7 +681,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max)
rcu_read_unlock();
local_bh_enable();
- if (!ipvs->enable || kthread_should_stop())
+ if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
goto stop;
cond_resched();
@@ -757,7 +757,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs)
mutex_lock(&ipvs->est_mutex);
for (id = 1; id < ipvs->est_kt_count; id++) {
/* netns clean up started, abort */
- if (!ipvs->enable)
+ if (!READ_ONCE(ipvs->enable))
goto unlock2;
kd = ipvs->est_kt_arr[id];
if (!kd)
@@ -787,7 +787,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs)
id = ipvs->est_kt_count;
next_kt:
- if (!ipvs->enable || kthread_should_stop())
+ if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
goto unlock;
id--;
if (id < 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 347/563] HID: steelseries: Fix STEELSERIES_SRWS1 handling in steelseries_remove()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (345 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 346/563] ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 348/563] watchdog: intel_oc_wdt: Do not try to write into const memory Greg Kroah-Hartman
` (229 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Jiri Kosina,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <jkosina@suse.com>
[ Upstream commit 2910913ef87dd9b9ce39e844c7295e1896b3b039 ]
srws1_remove label can be only reached only if LEDS subsystem is enabled. To
avoid putting horryfing ifdef second time around the label, just perform
the cleanup and exit immediately directly.
Fixes: a84eeacbf9325 ("HID: steelseries: refactor probe() and remove()")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202509090334.76D4qGtW-lkp@intel.com/
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-steelseries.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/hid/hid-steelseries.c b/drivers/hid/hid-steelseries.c
index 8af98d67959e0..f98435631aa18 100644
--- a/drivers/hid/hid-steelseries.c
+++ b/drivers/hid/hid-steelseries.c
@@ -582,7 +582,7 @@ static void steelseries_remove(struct hid_device *hdev)
if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1) {
#if IS_BUILTIN(CONFIG_LEDS_CLASS) || \
(IS_MODULE(CONFIG_LEDS_CLASS) && IS_MODULE(CONFIG_HID_STEELSERIES))
- goto srws1_remove;
+ hid_hw_stop(hdev);
#endif
return;
}
@@ -596,7 +596,6 @@ static void steelseries_remove(struct hid_device *hdev)
cancel_delayed_work_sync(&sd->battery_work);
hid_hw_close(hdev);
-srws1_remove:
hid_hw_stop(hdev);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 348/563] watchdog: intel_oc_wdt: Do not try to write into const memory
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (346 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 347/563] HID: steelseries: Fix STEELSERIES_SRWS1 handling in steelseries_remove() Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 349/563] watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog Greg Kroah-Hartman
` (228 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petar Kulić, Diogo Ivo,
Guenter Roeck, Wim Van Sebroeck, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <linux@roeck-us.net>
[ Upstream commit bdbb4a2d2aeae3d115bbdc402adac72aec071492 ]
The code tries to update the intel_oc_wdt_info data structure if the
watchdog is locked. That data structure is marked as const and can not
be written into. Copy it into struct intel_oc_wdt and modify it there
to fix the problem.
Reported-by: Petar Kulić <cooleech@gmail.com>
Cc: Diogo Ivo <diogo.ivo@siemens.com>
Fixes: 535d1784d8a9 ("watchdog: Add driver for Intel OC WDT")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Diogo Ivo <diogo.ivo@siemens.com>
Tested-by: Diogo Ivo <diogo.ivo@siemens.com>
Link: https://lore.kernel.org/linux-watchdog/20250818031838.3359-1-diogo.ivo@tecnico.ulisboa.pt/T/#t
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/intel_oc_wdt.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/watchdog/intel_oc_wdt.c b/drivers/watchdog/intel_oc_wdt.c
index 7c0551106981b..a39892c10770e 100644
--- a/drivers/watchdog/intel_oc_wdt.c
+++ b/drivers/watchdog/intel_oc_wdt.c
@@ -41,6 +41,7 @@
struct intel_oc_wdt {
struct watchdog_device wdd;
struct resource *ctrl_res;
+ struct watchdog_info info;
bool locked;
};
@@ -115,7 +116,6 @@ static const struct watchdog_ops intel_oc_wdt_ops = {
static int intel_oc_wdt_setup(struct intel_oc_wdt *oc_wdt)
{
- struct watchdog_info *info;
unsigned long val;
val = inl(INTEL_OC_WDT_CTRL_REG(oc_wdt));
@@ -134,7 +134,6 @@ static int intel_oc_wdt_setup(struct intel_oc_wdt *oc_wdt)
set_bit(WDOG_HW_RUNNING, &oc_wdt->wdd.status);
if (oc_wdt->locked) {
- info = (struct watchdog_info *)&intel_oc_wdt_info;
/*
* Set nowayout unconditionally as we cannot stop
* the watchdog.
@@ -145,7 +144,7 @@ static int intel_oc_wdt_setup(struct intel_oc_wdt *oc_wdt)
* and inform the core we can't change it.
*/
oc_wdt->wdd.timeout = (val & INTEL_OC_WDT_TOV) + 1;
- info->options &= ~WDIOF_SETTIMEOUT;
+ oc_wdt->info.options &= ~WDIOF_SETTIMEOUT;
dev_info(oc_wdt->wdd.parent,
"Register access locked, heartbeat fixed at: %u s\n",
@@ -193,7 +192,8 @@ static int intel_oc_wdt_probe(struct platform_device *pdev)
wdd->min_timeout = INTEL_OC_WDT_MIN_TOV;
wdd->max_timeout = INTEL_OC_WDT_MAX_TOV;
wdd->timeout = INTEL_OC_WDT_DEF_TOV;
- wdd->info = &intel_oc_wdt_info;
+ oc_wdt->info = intel_oc_wdt_info;
+ wdd->info = &oc_wdt->info;
wdd->ops = &intel_oc_wdt_ops;
wdd->parent = dev;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 349/563] watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (347 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 348/563] watchdog: intel_oc_wdt: Do not try to write into const memory Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 350/563] PCI: endpoint: pci-epf-test: Fix doorbell test support Greg Kroah-Hartman
` (227 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe Leroy, Guenter Roeck,
Wim Van Sebroeck, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <christophe.leroy@csgroup.eu>
[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ]
When the watchdog gets enabled with this driver, it leaves enough time
for the core watchdog subsystem to start pinging it. But when the
watchdog is already started by hardware or by the boot loader, little
time remains before it fires and it happens that the core watchdog
subsystem doesn't have time to start pinging it.
Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker
function") pinging was managed by the driver itself and the watchdog
was immediately pinged by setting the timer expiry to 0.
So restore similar behaviour by pinging it when enabling it so that
if it was already enabled the watchdog timer counter is reloaded.
Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/mpc8xxx_wdt.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c
index 867f9f3113797..a4b497ecfa205 100644
--- a/drivers/watchdog/mpc8xxx_wdt.c
+++ b/drivers/watchdog/mpc8xxx_wdt.c
@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w)
ddata->swtc = tmp >> 16;
set_bit(WDOG_HW_RUNNING, &ddata->wdd.status);
+ mpc8xxx_wdt_keepalive(ddata);
+
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 350/563] PCI: endpoint: pci-epf-test: Fix doorbell test support
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (348 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 349/563] watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 351/563] drivers/base/node: handle error properly in register_one_node() Greg Kroah-Hartman
` (226 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Cassel, Manivannan Sadhasivam,
Bjorn Helgaas, Frank Li, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit f272210b28d050df56ec7dfaecb9fa3bebca6419 ]
The doorbell feature temporarily overrides the inbound translation to point
to the address stored in epf_test->db_bar.phys_addr, i.e., it calls
set_bar() twice without ever calling clear_bar(), as calling clear_bar()
would clear the BAR's PCI address assigned by the host.
Thus, when disabling the doorbell, restore the inbound translation to point
to the memory allocated for the BAR.
Without this, running the PCI endpoint kselftest doorbell test case more
than once would fail.
Fixes: eff0c286aa91 ("PCI: endpoint: pci-epf-test: Add doorbell test support")
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20250908161942.534799-2-cassel@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/endpoint/functions/pci-epf-test.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
index e091193bd8a8a..2a85d3eda92f0 100644
--- a/drivers/pci/endpoint/functions/pci-epf-test.c
+++ b/drivers/pci/endpoint/functions/pci-epf-test.c
@@ -772,12 +772,24 @@ static void pci_epf_test_disable_doorbell(struct pci_epf_test *epf_test,
u32 status = le32_to_cpu(reg->status);
struct pci_epf *epf = epf_test->epf;
struct pci_epc *epc = epf->epc;
+ int ret;
if (bar < BAR_0)
goto set_status_err;
pci_epf_test_doorbell_cleanup(epf_test);
- pci_epc_clear_bar(epc, epf->func_no, epf->vfunc_no, &epf_test->db_bar);
+
+ /*
+ * The doorbell feature temporarily overrides the inbound translation
+ * to point to the address stored in epf_test->db_bar.phys_addr, i.e.,
+ * it calls set_bar() twice without ever calling clear_bar(), as
+ * calling clear_bar() would clear the BAR's PCI address assigned by
+ * the host. Thus, when disabling the doorbell, restore the inbound
+ * translation to point to the memory allocated for the BAR.
+ */
+ ret = pci_epc_set_bar(epc, epf->func_no, epf->vfunc_no, &epf->bar[bar]);
+ if (ret)
+ goto set_status_err;
status |= STATUS_DOORBELL_DISABLE_SUCCESS;
reg->status = cpu_to_le32(status);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 351/563] drivers/base/node: handle error properly in register_one_node()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (349 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 350/563] PCI: endpoint: pci-epf-test: Fix doorbell test support Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 352/563] RDMA/cm: Rate limit destroy CM ID timeout error message Greg Kroah-Hartman
` (225 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Donet Tom, David Hildenbrand,
Alison Schofield, Danilo Krummrich, Dave Jiang,
Hiroyouki Kamezawa, Joanthan Cameron, Oscar Salvador,
Ritesh Harjani (IBM), Yury Norov (NVIDIA), Zi Yan, Andrew Morton,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donet Tom <donettom@linux.ibm.com>
[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ]
If register_node() returns an error, it is not handled correctly.
The function will proceed further and try to register CPUs under the
node, which is not correct.
So, in this patch, if register_node() returns an error, we return
immediately from the function.
Link: https://lkml.kernel.org/r/20250822084845.19219-1-donettom@linux.ibm.com
Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct")
Signed-off-by: Donet Tom <donettom@linux.ibm.com>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: Alison Schofield <alison.schofield@intel.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: Donet Tom <donettom@linux.ibm.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
Cc: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/node.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/base/node.c b/drivers/base/node.c
index 3399594136b2a..45d512939c408 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -885,6 +885,11 @@ int register_one_node(int nid)
node_devices[nid] = node;
error = register_node(node_devices[nid], nid);
+ if (error) {
+ node_devices[nid] = NULL;
+ kfree(node);
+ return error;
+ }
/* link cpu under this node */
for_each_present_cpu(cpu) {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 352/563] RDMA/cm: Rate limit destroy CM ID timeout error message
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (350 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 351/563] drivers/base/node: handle error properly in register_one_node() Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 353/563] wifi: mt76: mt7996: Fix mt7996_mcu_sta_ba wcid configuration Greg Kroah-Hartman
` (224 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Håkon Bugge, Zhu Yanjun,
Leon Romanovsky, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Håkon Bugge <haakon.bugge@oracle.com>
[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ]
When the destroy CM ID timeout kicks in, you typically get a storm of
them which creates a log flooding. Hence, change pr_err() to
pr_err_ratelimited() in cm_destroy_id_wait_timeout().
Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait")
Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
Link: https://patch.msgid.link/20250912100525.531102-1-haakon.bugge@oracle.com
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/cm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index 92678e438ff4d..01bede8ba1055 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -1049,8 +1049,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id,
struct cm_id_private *cm_id_priv;
cm_id_priv = container_of(cm_id, struct cm_id_private, id);
- pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
- cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
+ pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
+ cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
}
static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 353/563] wifi: mt76: mt7996: Fix mt7996_mcu_sta_ba wcid configuration
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (351 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 352/563] RDMA/cm: Rate limit destroy CM ID timeout error message Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 354/563] wifi: mt76: mt7996: Fix mt7996_mcu_bss_mld_tlv routine Greg Kroah-Hartman
` (223 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Bianconi, Felix Fietkau,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit fe219a41adaf5354c59e75ebb642b8cb8a851d38 ]
Fix the wcid pointer used in mt7996_mcu_sta_ba routine to properly
support MLO scenario.
Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20250708-mt7996-mlo-fixes-v2-v1-2-f2682818a8a3@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/main.c | 6 ++++--
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 12 +++++++-----
drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 3 ++-
3 files changed, 13 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index 84f731b387d20..8a8a478391646 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -1327,11 +1327,13 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
case IEEE80211_AMPDU_RX_START:
mt76_rx_aggr_start(&dev->mt76, &msta_link->wcid, tid,
ssn, params->buf_size);
- ret = mt7996_mcu_add_rx_ba(dev, params, link, true);
+ ret = mt7996_mcu_add_rx_ba(dev, params, link,
+ msta_link, true);
break;
case IEEE80211_AMPDU_RX_STOP:
mt76_rx_aggr_stop(&dev->mt76, &msta_link->wcid, tid);
- ret = mt7996_mcu_add_rx_ba(dev, params, link, false);
+ ret = mt7996_mcu_add_rx_ba(dev, params, link,
+ msta_link, false);
break;
case IEEE80211_AMPDU_TX_OPERATIONAL:
mtxq->aggr = true;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index 0be03eb3cf461..e6db3e0b2ffda 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -1149,9 +1149,8 @@ int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif,
static int
mt7996_mcu_sta_ba(struct mt7996_dev *dev, struct mt76_vif_link *mvif,
struct ieee80211_ampdu_params *params,
- bool enable, bool tx)
+ struct mt76_wcid *wcid, bool enable, bool tx)
{
- struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv;
struct sta_rec_ba_uni *ba;
struct sk_buff *skb;
struct tlv *tlv;
@@ -1185,14 +1184,17 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
if (enable && !params->amsdu)
msta_link->wcid.amsdu = false;
- return mt7996_mcu_sta_ba(dev, &link->mt76, params, enable, true);
+ return mt7996_mcu_sta_ba(dev, &link->mt76, params, &msta_link->wcid,
+ enable, true);
}
int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
struct ieee80211_ampdu_params *params,
- struct mt7996_vif_link *link, bool enable)
+ struct mt7996_vif_link *link,
+ struct mt7996_sta_link *msta_link, bool enable)
{
- return mt7996_mcu_sta_ba(dev, &link->mt76, params, enable, false);
+ return mt7996_mcu_sta_ba(dev, &link->mt76, params, &msta_link->wcid,
+ enable, false);
}
static void
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
index 8509d508e1e19..bbd4679edc9d3 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
@@ -608,7 +608,8 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
struct mt7996_sta_link *msta_link, bool enable);
int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
struct ieee80211_ampdu_params *params,
- struct mt7996_vif_link *link, bool enable);
+ struct mt7996_vif_link *link,
+ struct mt7996_sta_link *msta_link, bool enable);
int mt7996_mcu_update_bss_color(struct mt7996_dev *dev,
struct mt76_vif_link *mlink,
struct cfg80211_he_bss_color *he_bss_color);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 354/563] wifi: mt76: mt7996: Fix mt7996_mcu_bss_mld_tlv routine
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (352 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 353/563] wifi: mt76: mt7996: Fix mt7996_mcu_sta_ba wcid configuration Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 355/563] wifi: mt76: fix potential memory leak in mt76_wmac_probe() Greg Kroah-Hartman
` (222 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Bianconi, Felix Fietkau,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit ed01c310eca96453c11b59db46c855aa593cffdd ]
Update mt7996_mcu_bss_mld_tlv routine to properly support MLO
configuring the BSS.
Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20250710-mt7996-mlo-fixes-v3-v1-1-e7595b089f2c@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/mediatek/mt76/mt7996/main.c | 46 ++++++++++++++++++-
.../net/wireless/mediatek/mt76/mt7996/mcu.c | 26 ++++++++---
.../net/wireless/mediatek/mt76/mt7996/mcu.h | 3 +-
.../wireless/mediatek/mt76/mt7996/mt7996.h | 8 ++++
4 files changed, 75 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index 8a8a478391646..3c34a4980afa0 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -138,6 +138,28 @@ static int get_omac_idx(enum nl80211_iftype type, u64 mask)
return -1;
}
+static int get_own_mld_idx(u64 mask, bool group_mld)
+{
+ u8 start = group_mld ? 0 : 16;
+ u8 end = group_mld ? 15 : 63;
+ int idx;
+
+ idx = get_free_idx(mask, start, end);
+ if (idx)
+ return idx - 1;
+
+ /* If the 16-63 range is not available, perform another lookup in the
+ * range 0-15
+ */
+ if (!group_mld) {
+ idx = get_free_idx(mask, 0, 15);
+ if (idx)
+ return idx - 1;
+ }
+
+ return -EINVAL;
+}
+
static void
mt7996_init_bitrate_mask(struct ieee80211_vif *vif, struct mt7996_vif_link *mlink)
{
@@ -279,7 +301,7 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,
struct mt7996_dev *dev = phy->dev;
u8 band_idx = phy->mt76->band_idx;
struct mt76_txq *mtxq;
- int idx, ret;
+ int mld_idx, idx, ret;
mlink->idx = __ffs64(~dev->mt76.vif_mask);
if (mlink->idx >= mt7996_max_interface_num(dev))
@@ -289,6 +311,17 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,
if (idx < 0)
return -ENOSPC;
+ if (!dev->mld_idx_mask) { /* first link in the group */
+ mvif->mld_group_idx = get_own_mld_idx(dev->mld_idx_mask, true);
+ mvif->mld_remap_idx = get_free_idx(dev->mld_remap_idx_mask,
+ 0, 15);
+ }
+
+ mld_idx = get_own_mld_idx(dev->mld_idx_mask, false);
+ if (mld_idx < 0)
+ return -ENOSPC;
+
+ link->mld_idx = mld_idx;
link->phy = phy;
mlink->omac_idx = idx;
mlink->band_idx = band_idx;
@@ -301,6 +334,11 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,
return ret;
dev->mt76.vif_mask |= BIT_ULL(mlink->idx);
+ if (!dev->mld_idx_mask) {
+ dev->mld_idx_mask |= BIT_ULL(mvif->mld_group_idx);
+ dev->mld_remap_idx_mask |= BIT_ULL(mvif->mld_remap_idx);
+ }
+ dev->mld_idx_mask |= BIT_ULL(link->mld_idx);
phy->omac_mask |= BIT_ULL(mlink->omac_idx);
idx = MT7996_WTBL_RESERVED - mlink->idx;
@@ -380,7 +418,13 @@ void mt7996_vif_link_remove(struct mt76_phy *mphy, struct ieee80211_vif *vif,
}
dev->mt76.vif_mask &= ~BIT_ULL(mlink->idx);
+ dev->mld_idx_mask &= ~BIT_ULL(link->mld_idx);
phy->omac_mask &= ~BIT_ULL(mlink->omac_idx);
+ if (!(dev->mld_idx_mask & ~BIT_ULL(mvif->mld_group_idx))) {
+ /* last link */
+ dev->mld_idx_mask &= ~BIT_ULL(mvif->mld_group_idx);
+ dev->mld_remap_idx_mask &= ~BIT_ULL(mvif->mld_remap_idx);
+ }
spin_lock_bh(&dev->mt76.sta_poll_lock);
if (!list_empty(&msta_link->wcid.poll_list))
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index e6db3e0b2ffda..aad58f7831c7b 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -899,17 +899,28 @@ mt7996_mcu_bss_txcmd_tlv(struct sk_buff *skb, bool en)
}
static void
-mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct mt76_vif_link *mlink)
+mt7996_mcu_bss_mld_tlv(struct sk_buff *skb,
+ struct ieee80211_bss_conf *link_conf,
+ struct mt7996_vif_link *link)
{
+ struct ieee80211_vif *vif = link_conf->vif;
+ struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
struct bss_mld_tlv *mld;
struct tlv *tlv;
tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_MLD, sizeof(*mld));
-
mld = (struct bss_mld_tlv *)tlv;
- mld->group_mld_id = 0xff;
- mld->own_mld_id = mlink->idx;
- mld->remap_idx = 0xff;
+ mld->own_mld_id = link->mld_idx;
+ mld->link_id = link_conf->link_id;
+
+ if (ieee80211_vif_is_mld(vif)) {
+ mld->group_mld_id = mvif->mld_group_idx;
+ mld->remap_idx = mvif->mld_remap_idx;
+ memcpy(mld->mac_addr, vif->addr, ETH_ALEN);
+ } else {
+ mld->group_mld_id = 0xff;
+ mld->remap_idx = 0xff;
+ }
}
static void
@@ -1108,6 +1119,8 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy, struct ieee80211_vif *vif,
goto out;
if (enable) {
+ struct mt7996_vif_link *link;
+
mt7996_mcu_bss_rfch_tlv(skb, phy);
mt7996_mcu_bss_bmc_tlv(skb, mlink, phy);
mt7996_mcu_bss_ra_tlv(skb, phy);
@@ -1118,7 +1131,8 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy, struct ieee80211_vif *vif,
mt7996_mcu_bss_he_tlv(skb, vif, link_conf, phy);
/* this tag is necessary no matter if the vif is MLD */
- mt7996_mcu_bss_mld_tlv(skb, mlink);
+ link = container_of(mlink, struct mt7996_vif_link, mt76);
+ mt7996_mcu_bss_mld_tlv(skb, link_conf, link);
}
mt7996_mcu_bss_mbssid_tlv(skb, link_conf, enable);
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
index 130ea95626d5b..7b21d6ae7e435 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
@@ -481,7 +481,8 @@ struct bss_mld_tlv {
u8 own_mld_id;
u8 mac_addr[ETH_ALEN];
u8 remap_idx;
- u8 __rsv[3];
+ u8 link_id;
+ u8 __rsv[2];
} __packed;
struct sta_rec_ht_uni {
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
index bbd4679edc9d3..b98cfe6e5be8c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
@@ -248,11 +248,16 @@ struct mt7996_vif_link {
struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS];
struct cfg80211_bitrate_mask bitrate_mask;
+
+ u8 mld_idx;
};
struct mt7996_vif {
struct mt7996_vif_link deflink; /* must be first */
struct mt76_vif_data mt76;
+
+ u8 mld_group_idx;
+ u8 mld_remap_idx;
};
/* crash-dump */
@@ -337,6 +342,9 @@ struct mt7996_dev {
u32 q_int_mask[MT7996_MAX_QUEUE];
u32 q_wfdma_mask;
+ u64 mld_idx_mask;
+ u64 mld_remap_idx_mask;
+
const struct mt76_bus_ops *bus_ops;
struct mt7996_phy phy;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 355/563] wifi: mt76: fix potential memory leak in mt76_wmac_probe()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (353 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 354/563] wifi: mt76: mt7996: Fix mt7996_mcu_bss_mld_tlv routine Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 356/563] wifi: mt76: mt7996: Use proper link_id in link_sta_rc_update callback Greg Kroah-Hartman
` (221 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Jiri Slaby,
Felix Fietkau, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <abdun.nihaal@gmail.com>
[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ]
In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory
is allocated for both struct ieee80211_hw and a workqueue. However, on
the error path, the workqueue is not freed. Fix that by calling
mt76_free_device() on the error path.
Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688")
Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
Link: https://patch.msgid.link/20250709145532.41246-1-abdun.nihaal@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
index 08590aa68356f..1dd3723720480 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev)
return 0;
error:
- ieee80211_free_hw(mt76_hw(dev));
+ mt76_free_device(mdev);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 356/563] wifi: mt76: mt7996: Use proper link_id in link_sta_rc_update callback
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (354 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 355/563] wifi: mt76: fix potential memory leak in mt76_wmac_probe() Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 357/563] wifi: mt76: mt7996: Check phy before init msta_link in mt7996_mac_sta_add_links() Greg Kroah-Hartman
` (220 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Bianconi, Felix Fietkau,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit afff4325548f0cf872e404df2856bf8bd9581c7e ]
Do not always use deflink_id in link_sta_rc_update mac80211
callback but use the proper link_id provided by mac80211.
Fixes: 0762bdd30279f ("wifi: mt76: mt7996: rework mt7996_mac_sta_rc_work to support MLO")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20250901-mt7996-fix-link_sta_rc_update-callback-v1-1-e24caf196222@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/mediatek/mt76/mt7996/main.c | 43 ++++++++++++-------
1 file changed, 28 insertions(+), 15 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index 3c34a4980afa0..81391db535866 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -1663,19 +1663,13 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
}
}
-static void mt7996_link_rate_ctrl_update(void *data, struct ieee80211_sta *sta)
+static void mt7996_link_rate_ctrl_update(void *data,
+ struct mt7996_sta_link *msta_link)
{
- struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ struct mt7996_sta *msta = msta_link->sta;
struct mt7996_dev *dev = msta->vif->deflink.phy->dev;
- struct mt7996_sta_link *msta_link;
u32 *changed = data;
- rcu_read_lock();
-
- msta_link = rcu_dereference(msta->link[msta->deflink_id]);
- if (!msta_link)
- goto out;
-
spin_lock_bh(&dev->mt76.sta_poll_lock);
msta_link->changed |= *changed;
@@ -1683,8 +1677,6 @@ static void mt7996_link_rate_ctrl_update(void *data, struct ieee80211_sta *sta)
list_add_tail(&msta_link->rc_list, &dev->sta_rc_list);
spin_unlock_bh(&dev->mt76.sta_poll_lock);
-out:
- rcu_read_unlock();
}
static void mt7996_link_sta_rc_update(struct ieee80211_hw *hw,
@@ -1692,11 +1684,32 @@ static void mt7996_link_sta_rc_update(struct ieee80211_hw *hw,
struct ieee80211_link_sta *link_sta,
u32 changed)
{
- struct mt7996_dev *dev = mt7996_hw_dev(hw);
struct ieee80211_sta *sta = link_sta->sta;
+ struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ struct mt7996_sta_link *msta_link;
- mt7996_link_rate_ctrl_update(&changed, sta);
- ieee80211_queue_work(hw, &dev->rc_work);
+ rcu_read_lock();
+
+ msta_link = rcu_dereference(msta->link[link_sta->link_id]);
+ if (msta_link) {
+ struct mt7996_dev *dev = mt7996_hw_dev(hw);
+
+ mt7996_link_rate_ctrl_update(&changed, msta_link);
+ ieee80211_queue_work(hw, &dev->rc_work);
+ }
+
+ rcu_read_unlock();
+}
+
+static void mt7996_sta_rate_ctrl_update(void *data, struct ieee80211_sta *sta)
+{
+ struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ struct mt7996_sta_link *msta_link;
+ u32 *changed = data;
+
+ msta_link = rcu_dereference(msta->link[msta->deflink_id]);
+ if (msta_link)
+ mt7996_link_rate_ctrl_update(&changed, msta_link);
}
static int
@@ -1717,7 +1730,7 @@ mt7996_set_bitrate_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
* - multiple rates: if it's not in range format i.e 0-{7,8,9} for VHT
* then multiple MCS setting (MCS 4,5,6) is not supported.
*/
- ieee80211_iterate_stations_atomic(hw, mt7996_link_rate_ctrl_update,
+ ieee80211_iterate_stations_atomic(hw, mt7996_sta_rate_ctrl_update,
&changed);
ieee80211_queue_work(hw, &dev->rc_work);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 357/563] wifi: mt76: mt7996: Check phy before init msta_link in mt7996_mac_sta_add_links()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (355 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 356/563] wifi: mt76: mt7996: Use proper link_id in link_sta_rc_update callback Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 358/563] wifi: mt76: mt7996: Fix tx-queues initialization for second phy on mt7996 Greg Kroah-Hartman
` (219 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Bianconi, Felix Fietkau,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit fe5fffadc6c77c56f122cf1042dc830f59e904bf ]
In order to avoid a possible NULL pointer dereference in
mt7996_mac_sta_init_link routine, move the phy pointer check before
running mt7996_mac_sta_init_link() in mt7996_mac_sta_add_links routine.
Fixes: dd82a9e02c054 ("wifi: mt76: mt7996: Rely on mt7996_sta_link in sta_add/sta_remove callbacks")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20250830-mt7996_mac_sta_add_links-fix-v1-1-4219fb8755ee@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/main.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index 81391db535866..d01b5778da20e 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -1080,16 +1080,17 @@ mt7996_mac_sta_add_links(struct mt7996_dev *dev, struct ieee80211_vif *vif,
goto error_unlink;
}
- err = mt7996_mac_sta_init_link(dev, link_conf, link_sta, link,
- link_id);
- if (err)
- goto error_unlink;
-
mphy = mt76_vif_link_phy(&link->mt76);
if (!mphy) {
err = -EINVAL;
goto error_unlink;
}
+
+ err = mt7996_mac_sta_init_link(dev, link_conf, link_sta, link,
+ link_id);
+ if (err)
+ goto error_unlink;
+
mphy->num_sta++;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 358/563] wifi: mt76: mt7996: Fix tx-queues initialization for second phy on mt7996
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (356 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 357/563] wifi: mt76: mt7996: Check phy before init msta_link in mt7996_mac_sta_add_links() Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 359/563] wifi: mt76: mt7996: Fix RX packets configuration for primary WED device Greg Kroah-Hartman
` (218 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sujuan Chen, Benjamin Lin, Rex Lu,
Lorenzo Bianconi, Felix Fietkau, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit 77ff8caf3b17626ad91568cef63d75e288aa4052 ]
Fix the second phy tx queue initialization if hif device is not
available for MT7990 chipset.
Fixes: 83eafc9251d6d ("wifi: mt76: mt7996: add wed tx support")
Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
Co-developed-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
Co-developed-by: Rex Lu <rex.lu@mediatek.com>
Signed-off-by: Rex Lu <rex.lu@mediatek.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-8-7d66f6eb7795@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/mediatek/mt76/mt7996/init.c | 21 ++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
index a9599c286328e..be729db5b75c1 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
@@ -671,13 +671,20 @@ static int mt7996_register_phy(struct mt7996_dev *dev, enum mt76_band_id band)
/* init wiphy according to mphy and phy */
mt7996_init_wiphy_band(mphy->hw, phy);
- ret = mt7996_init_tx_queues(mphy->priv,
- MT_TXQ_ID(band),
- MT7996_TX_RING_SIZE,
- MT_TXQ_RING_BASE(band) + hif1_ofs,
- wed);
- if (ret)
- goto error;
+
+ if (is_mt7996(&dev->mt76) && !dev->hif2 && band == MT_BAND1) {
+ int i;
+
+ for (i = 0; i <= MT_TXQ_PSD; i++)
+ mphy->q_tx[i] = dev->mt76.phys[MT_BAND0]->q_tx[0];
+ } else {
+ ret = mt7996_init_tx_queues(mphy->priv, MT_TXQ_ID(band),
+ MT7996_TX_RING_SIZE,
+ MT_TXQ_RING_BASE(band) + hif1_ofs,
+ wed);
+ if (ret)
+ goto error;
+ }
ret = mt76_register_phy(mphy, true, mt76_rates,
ARRAY_SIZE(mt76_rates));
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 359/563] wifi: mt76: mt7996: Fix RX packets configuration for primary WED device
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (357 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 358/563] wifi: mt76: mt7996: Fix tx-queues initialization for second phy on mt7996 Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 360/563] wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE Greg Kroah-Hartman
` (217 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Bianconi, Felix Fietkau,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit cffed52dbf0ddd0db11f9df63f9976fe58ac9628 ]
In order to properly set the number of rx packets for primary WED device
if hif device is available, move hif pointer initialization before
running mt7996_mmio_wed_init routine.
Fixes: 83eafc9251d6d ("wifi: mt76: mt7996: add wed tx support")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-9-7d66f6eb7795@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
index 19e99bc1c6c41..f5ce50056ee94 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
@@ -137,6 +137,7 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
mdev = &dev->mt76;
mt7996_wfsys_reset(dev);
hif2 = mt7996_pci_init_hif2(pdev);
+ dev->hif2 = hif2;
ret = mt7996_mmio_wed_init(dev, pdev, false, &irq);
if (ret < 0)
@@ -161,7 +162,6 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
if (hif2) {
hif2_dev = container_of(hif2->dev, struct pci_dev, dev);
- dev->hif2 = hif2;
ret = mt7996_mmio_wed_init(dev, hif2_dev, true, &hif2_irq);
if (ret < 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 360/563] wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (358 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 359/563] wifi: mt76: mt7996: Fix RX packets configuration for primary WED device Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 361/563] wifi: mt76: mt7915: fix mt7981 pre-calibration Greg Kroah-Hartman
` (216 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Bianconi, Felix Fietkau,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit 809054a60d613ccca6e7f243bc68966b58044163 ]
Do not use bitmask in mt7996_wed_rro_addr DMA descriptor in order to not
break endianness
Fixes: 950d0abb5cd94 ("wifi: mt76: mt7996: add wed rx support")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-11-7d66f6eb7795@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/init.c | 8 +++++---
drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 11 +++++------
2 files changed, 10 insertions(+), 9 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
index be729db5b75c1..84015ab24af62 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
@@ -734,6 +734,7 @@ void mt7996_wfsys_reset(struct mt7996_dev *dev)
static int mt7996_wed_rro_init(struct mt7996_dev *dev)
{
#ifdef CONFIG_NET_MEDIATEK_SOC_WED
+ u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 0xff);
struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
u32 reg = MT_RRO_ADDR_ELEM_SEG_ADDR0;
struct mt7996_wed_rro_addr *addr;
@@ -773,7 +774,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev)
addr = dev->wed_rro.addr_elem[i].ptr;
for (j = 0; j < MT7996_RRO_WINDOW_MAX_SIZE; j++) {
- addr->signature = 0xff;
+ addr->data = cpu_to_le32(val);
addr++;
}
@@ -791,7 +792,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev)
dev->wed_rro.session.ptr = ptr;
addr = dev->wed_rro.session.ptr;
for (i = 0; i < MT7996_RRO_WINDOW_MAX_LEN; i++) {
- addr->signature = 0xff;
+ addr->data = cpu_to_le32(val);
addr++;
}
@@ -891,6 +892,7 @@ static void mt7996_wed_rro_free(struct mt7996_dev *dev)
static void mt7996_wed_rro_work(struct work_struct *work)
{
#ifdef CONFIG_NET_MEDIATEK_SOC_WED
+ u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 0xff);
struct mt7996_dev *dev;
LIST_HEAD(list);
@@ -927,7 +929,7 @@ static void mt7996_wed_rro_work(struct work_struct *work)
MT7996_RRO_WINDOW_MAX_LEN;
reset:
elem = ptr + elem_id * sizeof(*elem);
- elem->signature = 0xff;
+ elem->data |= cpu_to_le32(val);
}
mt7996_mcu_wed_rro_reset_sessions(dev, e->id);
out:
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
index b98cfe6e5be8c..048d9a9898c6e 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
@@ -277,13 +277,12 @@ struct mt7996_hif {
int irq;
};
+#define WED_RRO_ADDR_SIGNATURE_MASK GENMASK(31, 24)
+#define WED_RRO_ADDR_COUNT_MASK GENMASK(14, 4)
+#define WED_RRO_ADDR_HEAD_HIGH_MASK GENMASK(3, 0)
struct mt7996_wed_rro_addr {
- u32 head_low;
- u32 head_high : 4;
- u32 count: 11;
- u32 oor: 1;
- u32 rsv : 8;
- u32 signature : 8;
+ __le32 head_low;
+ __le32 data;
};
struct mt7996_wed_rro_session_id {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 361/563] wifi: mt76: mt7915: fix mt7981 pre-calibration
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (359 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 360/563] wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 362/563] wifi: mt76: mt7996: remove redundant per-phy mac80211 calls during restart Greg Kroah-Hartman
` (215 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhi-Jun You, Felix Fietkau,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhi-Jun You <hujy652@gmail.com>
[ Upstream commit 2b660ee10a0c25b209d7fda3c41b821b75dd85d9 ]
In vendor driver, size of group cal and dpd cal for mt7981 includes 6G
although the chip doesn't support it.
mt76 doesn't take this into account which results in reading from the
incorrect offset.
For devices with precal, this would lead to lower bitrate.
Fix this by aligning groupcal size with vendor driver and switch to
freq_list_v2 in mt7915_dpd_freq_idx in order to get the correct offset.
Below are iwinfo of the test device with two clients connected
(iPhone 16, Intel AX210).
Before :
Mode: Master Channel: 36 (5.180 GHz) HT Mode: HE80
Center Channel 1: 42 2: unknown
Tx-Power: 23 dBm Link Quality: 43/70
Signal: -67 dBm Noise: -92 dBm
Bit Rate: 612.4 MBit/s
Encryption: WPA3 SAE (CCMP)
Type: nl80211 HW Mode(s): 802.11ac/ax/n
Hardware: embedded [MediaTek MT7981]
After:
Mode: Master Channel: 36 (5.180 GHz) HT Mode: HE80
Center Channel 1: 42 2: unknown
Tx-Power: 23 dBm Link Quality: 43/70
Signal: -67 dBm Noise: -92 dBm
Bit Rate: 900.6 MBit/s
Encryption: WPA3 SAE (CCMP)
Type: nl80211 HW Mode(s): 802.11ac/ax/n
Hardware: embedded [MediaTek MT7981]
Tested-on: mt7981 20240823
Fixes: 19a954edec63 ("wifi: mt76: mt7915: add mt7986, mt7916 and mt7981 pre-calibration")
Signed-off-by: Zhi-Jun You <hujy652@gmail.com>
Link: https://patch.msgid.link/20250909064824.16847-1-hujy652@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../wireless/mediatek/mt76/mt7915/eeprom.h | 6 ++--
.../net/wireless/mediatek/mt76/mt7915/mcu.c | 29 +++++--------------
2 files changed, 10 insertions(+), 25 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
index 31aec0f40232a..73611c9d26e15 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
@@ -50,9 +50,9 @@ enum mt7915_eeprom_field {
#define MT_EE_CAL_GROUP_SIZE_7975 (54 * MT_EE_CAL_UNIT + 16)
#define MT_EE_CAL_GROUP_SIZE_7976 (94 * MT_EE_CAL_UNIT + 16)
#define MT_EE_CAL_GROUP_SIZE_7916_6G (94 * MT_EE_CAL_UNIT + 16)
+#define MT_EE_CAL_GROUP_SIZE_7981 (144 * MT_EE_CAL_UNIT + 16)
#define MT_EE_CAL_DPD_SIZE_V1 (54 * MT_EE_CAL_UNIT)
#define MT_EE_CAL_DPD_SIZE_V2 (300 * MT_EE_CAL_UNIT)
-#define MT_EE_CAL_DPD_SIZE_V2_7981 (102 * MT_EE_CAL_UNIT) /* no 6g dpd data */
#define MT_EE_WIFI_CONF0_TX_PATH GENMASK(2, 0)
#define MT_EE_WIFI_CONF0_RX_PATH GENMASK(5, 3)
@@ -180,6 +180,8 @@ mt7915_get_cal_group_size(struct mt7915_dev *dev)
val = FIELD_GET(MT_EE_WIFI_CONF0_BAND_SEL, val);
return (val == MT_EE_V2_BAND_SEL_6GHZ) ? MT_EE_CAL_GROUP_SIZE_7916_6G :
MT_EE_CAL_GROUP_SIZE_7916;
+ } else if (is_mt7981(&dev->mt76)) {
+ return MT_EE_CAL_GROUP_SIZE_7981;
} else if (mt7915_check_adie(dev, false)) {
return MT_EE_CAL_GROUP_SIZE_7976;
} else {
@@ -192,8 +194,6 @@ mt7915_get_cal_dpd_size(struct mt7915_dev *dev)
{
if (is_mt7915(&dev->mt76))
return MT_EE_CAL_DPD_SIZE_V1;
- else if (is_mt7981(&dev->mt76))
- return MT_EE_CAL_DPD_SIZE_V2_7981;
else
return MT_EE_CAL_DPD_SIZE_V2;
}
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
index 2928e75b23976..c1fdd3c4f1ba6 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -3052,30 +3052,15 @@ static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
/* 5G BW160 */
5250, 5570, 5815
};
- static const u16 freq_list_v2_7981[] = {
- /* 5G BW20 */
- 5180, 5200, 5220, 5240,
- 5260, 5280, 5300, 5320,
- 5500, 5520, 5540, 5560,
- 5580, 5600, 5620, 5640,
- 5660, 5680, 5700, 5720,
- 5745, 5765, 5785, 5805,
- 5825, 5845, 5865, 5885,
- /* 5G BW160 */
- 5250, 5570, 5815
- };
- const u16 *freq_list = freq_list_v1;
- int n_freqs = ARRAY_SIZE(freq_list_v1);
- int idx;
+ const u16 *freq_list;
+ int idx, n_freqs;
if (!is_mt7915(&dev->mt76)) {
- if (is_mt7981(&dev->mt76)) {
- freq_list = freq_list_v2_7981;
- n_freqs = ARRAY_SIZE(freq_list_v2_7981);
- } else {
- freq_list = freq_list_v2;
- n_freqs = ARRAY_SIZE(freq_list_v2);
- }
+ freq_list = freq_list_v2;
+ n_freqs = ARRAY_SIZE(freq_list_v2);
+ } else {
+ freq_list = freq_list_v1;
+ n_freqs = ARRAY_SIZE(freq_list_v1);
}
if (freq < 4000) {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 362/563] wifi: mt76: mt7996: remove redundant per-phy mac80211 calls during restart
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (360 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 361/563] wifi: mt76: mt7915: fix mt7981 pre-calibration Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 363/563] ASoC: Intel: hda-sdw-bpt: set persistent_buffer false Greg Kroah-Hartman
` (214 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit 0a5df0ec47f7edc04957925a9644101682041d27 ]
There is only one wiphy, so extra calls must be removed.
For calls that need to remain per-wiphy, use mt7996_for_each_phy
Fixes: 69d54ce7491d ("wifi: mt76: mt7996: switch to single multi-radio wiphy")
Link: https://patch.msgid.link/20250915075910.47558-1-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/mediatek/mt76/mt7996/mac.c | 137 +++++-------------
1 file changed, 35 insertions(+), 102 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
index b3fcca9bbb958..28477702c18b3 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
@@ -1766,13 +1766,10 @@ void mt7996_tx_token_put(struct mt7996_dev *dev)
static int
mt7996_mac_restart(struct mt7996_dev *dev)
{
- struct mt7996_phy *phy2, *phy3;
struct mt76_dev *mdev = &dev->mt76;
+ struct mt7996_phy *phy;
int i, ret;
- phy2 = mt7996_phy2(dev);
- phy3 = mt7996_phy3(dev);
-
if (dev->hif2) {
mt76_wr(dev, MT_INT1_MASK_CSR, 0x0);
mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0);
@@ -1784,20 +1781,14 @@ mt7996_mac_restart(struct mt7996_dev *dev)
mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0x0);
}
- set_bit(MT76_RESET, &dev->mphy.state);
set_bit(MT76_MCU_RESET, &dev->mphy.state);
+ mt7996_for_each_phy(dev, phy)
+ set_bit(MT76_RESET, &phy->mt76->state);
wake_up(&dev->mt76.mcu.wait);
- if (phy2)
- set_bit(MT76_RESET, &phy2->mt76->state);
- if (phy3)
- set_bit(MT76_RESET, &phy3->mt76->state);
/* lock/unlock all queues to ensure that no tx is pending */
- mt76_txq_schedule_all(&dev->mphy);
- if (phy2)
- mt76_txq_schedule_all(phy2->mt76);
- if (phy3)
- mt76_txq_schedule_all(phy3->mt76);
+ mt7996_for_each_phy(dev, phy)
+ mt76_txq_schedule_all(phy->mt76);
/* disable all tx/rx napi */
mt76_worker_disable(&dev->mt76.tx_worker);
@@ -1855,36 +1846,25 @@ mt7996_mac_restart(struct mt7996_dev *dev)
goto out;
mt7996_mac_init(dev);
- mt7996_init_txpower(&dev->phy);
- mt7996_init_txpower(phy2);
- mt7996_init_txpower(phy3);
+ mt7996_for_each_phy(dev, phy)
+ mt7996_init_txpower(phy);
ret = mt7996_txbf_init(dev);
+ if (ret)
+ goto out;
- if (test_bit(MT76_STATE_RUNNING, &dev->mphy.state)) {
- ret = mt7996_run(&dev->phy);
- if (ret)
- goto out;
- }
-
- if (phy2 && test_bit(MT76_STATE_RUNNING, &phy2->mt76->state)) {
- ret = mt7996_run(phy2);
- if (ret)
- goto out;
- }
+ mt7996_for_each_phy(dev, phy) {
+ if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
+ continue;
- if (phy3 && test_bit(MT76_STATE_RUNNING, &phy3->mt76->state)) {
- ret = mt7996_run(phy3);
+ ret = mt7996_run(&dev->phy);
if (ret)
goto out;
}
out:
/* reset done */
- clear_bit(MT76_RESET, &dev->mphy.state);
- if (phy2)
- clear_bit(MT76_RESET, &phy2->mt76->state);
- if (phy3)
- clear_bit(MT76_RESET, &phy3->mt76->state);
+ mt7996_for_each_phy(dev, phy)
+ clear_bit(MT76_RESET, &phy->mt76->state);
napi_enable(&dev->mt76.tx_napi);
local_bh_disable();
@@ -1898,26 +1878,18 @@ mt7996_mac_restart(struct mt7996_dev *dev)
static void
mt7996_mac_full_reset(struct mt7996_dev *dev)
{
- struct mt7996_phy *phy2, *phy3;
+ struct ieee80211_hw *hw = mt76_hw(dev);
+ struct mt7996_phy *phy;
int i;
- phy2 = mt7996_phy2(dev);
- phy3 = mt7996_phy3(dev);
dev->recovery.hw_full_reset = true;
wake_up(&dev->mt76.mcu.wait);
- ieee80211_stop_queues(mt76_hw(dev));
- if (phy2)
- ieee80211_stop_queues(phy2->mt76->hw);
- if (phy3)
- ieee80211_stop_queues(phy3->mt76->hw);
+ ieee80211_stop_queues(hw);
cancel_work_sync(&dev->wed_rro.work);
- cancel_delayed_work_sync(&dev->mphy.mac_work);
- if (phy2)
- cancel_delayed_work_sync(&phy2->mt76->mac_work);
- if (phy3)
- cancel_delayed_work_sync(&phy3->mt76->mac_work);
+ mt7996_for_each_phy(dev, phy)
+ cancel_delayed_work_sync(&phy->mt76->mac_work);
mutex_lock(&dev->mt76.mutex);
for (i = 0; i < 10; i++) {
@@ -1930,40 +1902,23 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
dev_err(dev->mt76.dev, "chip full reset failed\n");
ieee80211_restart_hw(mt76_hw(dev));
- if (phy2)
- ieee80211_restart_hw(phy2->mt76->hw);
- if (phy3)
- ieee80211_restart_hw(phy3->mt76->hw);
-
ieee80211_wake_queues(mt76_hw(dev));
- if (phy2)
- ieee80211_wake_queues(phy2->mt76->hw);
- if (phy3)
- ieee80211_wake_queues(phy3->mt76->hw);
dev->recovery.hw_full_reset = false;
- ieee80211_queue_delayed_work(mt76_hw(dev),
- &dev->mphy.mac_work,
- MT7996_WATCHDOG_TIME);
- if (phy2)
- ieee80211_queue_delayed_work(phy2->mt76->hw,
- &phy2->mt76->mac_work,
- MT7996_WATCHDOG_TIME);
- if (phy3)
- ieee80211_queue_delayed_work(phy3->mt76->hw,
- &phy3->mt76->mac_work,
+ mt7996_for_each_phy(dev, phy)
+ ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
MT7996_WATCHDOG_TIME);
}
void mt7996_mac_reset_work(struct work_struct *work)
{
- struct mt7996_phy *phy2, *phy3;
+ struct ieee80211_hw *hw;
struct mt7996_dev *dev;
+ struct mt7996_phy *phy;
int i;
dev = container_of(work, struct mt7996_dev, reset_work);
- phy2 = mt7996_phy2(dev);
- phy3 = mt7996_phy3(dev);
+ hw = mt76_hw(dev);
/* chip full reset */
if (dev->recovery.restart) {
@@ -1994,7 +1949,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
return;
dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.",
- wiphy_name(dev->mt76.hw->wiphy));
+ wiphy_name(hw->wiphy));
if (mtk_wed_device_active(&dev->mt76.mmio.wed_hif2))
mtk_wed_device_stop(&dev->mt76.mmio.wed_hif2);
@@ -2003,25 +1958,17 @@ void mt7996_mac_reset_work(struct work_struct *work)
mtk_wed_device_stop(&dev->mt76.mmio.wed);
ieee80211_stop_queues(mt76_hw(dev));
- if (phy2)
- ieee80211_stop_queues(phy2->mt76->hw);
- if (phy3)
- ieee80211_stop_queues(phy3->mt76->hw);
set_bit(MT76_RESET, &dev->mphy.state);
set_bit(MT76_MCU_RESET, &dev->mphy.state);
wake_up(&dev->mt76.mcu.wait);
cancel_work_sync(&dev->wed_rro.work);
- cancel_delayed_work_sync(&dev->mphy.mac_work);
- if (phy2) {
- set_bit(MT76_RESET, &phy2->mt76->state);
- cancel_delayed_work_sync(&phy2->mt76->mac_work);
- }
- if (phy3) {
- set_bit(MT76_RESET, &phy3->mt76->state);
- cancel_delayed_work_sync(&phy3->mt76->mac_work);
+ mt7996_for_each_phy(dev, phy) {
+ set_bit(MT76_RESET, &phy->mt76->state);
+ cancel_delayed_work_sync(&phy->mt76->mac_work);
}
+
mt76_worker_disable(&dev->mt76.tx_worker);
mt76_for_each_q_rx(&dev->mt76, i) {
if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
@@ -2074,11 +2021,8 @@ void mt7996_mac_reset_work(struct work_struct *work)
}
clear_bit(MT76_MCU_RESET, &dev->mphy.state);
- clear_bit(MT76_RESET, &dev->mphy.state);
- if (phy2)
- clear_bit(MT76_RESET, &phy2->mt76->state);
- if (phy3)
- clear_bit(MT76_RESET, &phy3->mt76->state);
+ mt7996_for_each_phy(dev, phy)
+ clear_bit(MT76_RESET, &phy->mt76->state);
mt76_for_each_q_rx(&dev->mt76, i) {
if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
@@ -2100,25 +2044,14 @@ void mt7996_mac_reset_work(struct work_struct *work)
napi_schedule(&dev->mt76.tx_napi);
local_bh_enable();
- ieee80211_wake_queues(mt76_hw(dev));
- if (phy2)
- ieee80211_wake_queues(phy2->mt76->hw);
- if (phy3)
- ieee80211_wake_queues(phy3->mt76->hw);
+ ieee80211_wake_queues(hw);
mutex_unlock(&dev->mt76.mutex);
mt7996_update_beacons(dev);
- ieee80211_queue_delayed_work(mt76_hw(dev), &dev->mphy.mac_work,
- MT7996_WATCHDOG_TIME);
- if (phy2)
- ieee80211_queue_delayed_work(phy2->mt76->hw,
- &phy2->mt76->mac_work,
- MT7996_WATCHDOG_TIME);
- if (phy3)
- ieee80211_queue_delayed_work(phy3->mt76->hw,
- &phy3->mt76->mac_work,
+ mt7996_for_each_phy(dev, phy)
+ ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
MT7996_WATCHDOG_TIME);
dev_info(dev->mt76.dev,"\n%s L1 SER recovery completed.",
wiphy_name(dev->mt76.hw->wiphy));
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 363/563] ASoC: Intel: hda-sdw-bpt: set persistent_buffer false
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (361 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 362/563] wifi: mt76: mt7996: remove redundant per-phy mac80211 calls during restart Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 364/563] srcu/tiny: Remove preempt_disable/enable() in srcu_gp_start_if_needed() Greg Kroah-Hartman
` (213 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bard Liao, Péter Ujfalusi,
Pierre-Louis Bossart, Mark Brown, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bard Liao <yung-chuan.liao@linux.intel.com>
[ Upstream commit 8b184c34806e5da4d4847fabd3faeff38b47e70a ]
The persistent_buffer agreement is false when hda_cl_prepare() is
called. We should use the same value when hda_cl_cleanup() is called.
Fixes: 5d5cb86fb46ea ("ASoC: SOF: Intel: hda-sdw-bpt: add helpers for SoundWire BPT DMA")
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
Link: https://patch.msgid.link/20250915024853.1153518-1-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sof/intel/hda-sdw-bpt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/sof/intel/hda-sdw-bpt.c b/sound/soc/sof/intel/hda-sdw-bpt.c
index 1327f1cad0bcd..ff5abccf0d88b 100644
--- a/sound/soc/sof/intel/hda-sdw-bpt.c
+++ b/sound/soc/sof/intel/hda-sdw-bpt.c
@@ -150,7 +150,7 @@ static int hda_sdw_bpt_dma_deprepare(struct device *dev, struct hdac_ext_stream
u32 mask;
int ret;
- ret = hda_cl_cleanup(sdev->dev, dmab_bdl, true, sdw_bpt_stream);
+ ret = hda_cl_cleanup(sdev->dev, dmab_bdl, false, sdw_bpt_stream);
if (ret < 0) {
dev_err(sdev->dev, "%s: SDW BPT DMA cleanup failed\n",
__func__);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 364/563] srcu/tiny: Remove preempt_disable/enable() in srcu_gp_start_if_needed()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (362 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 363/563] ASoC: Intel: hda-sdw-bpt: set persistent_buffer false Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 365/563] drm/amdgpu: Fix allocating extra dwords for rings (v2) Greg Kroah-Hartman
` (212 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zqiang, Paul E. McKenney,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zqiang <qiang.zhang@linux.dev>
[ Upstream commit e6a43aeb71852a39432332dcc3a6d11bb464b075 ]
Currently, the srcu_gp_start_if_needed() is always be invoked in
preempt disable's critical section, this commit therefore remove
redundant preempt_disable/enable() in srcu_gp_start_if_needed()
and adds a call to lockdep_assert_preemption_disabled() in order
to enable lockdep to diagnose mistaken invocations of this function
from preempts-enabled code.
Fixes: 65b4a59557f6 ("srcu: Make Tiny SRCU explicitly disable preemption")
Signed-off-by: Zqiang <qiang.zhang@linux.dev>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/rcu/srcutiny.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/kernel/rcu/srcutiny.c b/kernel/rcu/srcutiny.c
index 6e9fe2ce1075d..e3b64a5e0ec7e 100644
--- a/kernel/rcu/srcutiny.c
+++ b/kernel/rcu/srcutiny.c
@@ -176,10 +176,9 @@ static void srcu_gp_start_if_needed(struct srcu_struct *ssp)
{
unsigned long cookie;
- preempt_disable(); // Needed for PREEMPT_LAZY
+ lockdep_assert_preemption_disabled(); // Needed for PREEMPT_LAZY
cookie = get_state_synchronize_srcu(ssp);
if (ULONG_CMP_GE(READ_ONCE(ssp->srcu_idx_max), cookie)) {
- preempt_enable();
return;
}
WRITE_ONCE(ssp->srcu_idx_max, cookie);
@@ -189,7 +188,6 @@ static void srcu_gp_start_if_needed(struct srcu_struct *ssp)
else if (list_empty(&ssp->srcu_work.entry))
list_add(&ssp->srcu_work.entry, &srcu_boot_list);
}
- preempt_enable();
}
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 365/563] drm/amdgpu: Fix allocating extra dwords for rings (v2)
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (363 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 364/563] srcu/tiny: Remove preempt_disable/enable() in srcu_gp_start_if_needed() Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 366/563] f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() Greg Kroah-Hartman
` (211 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Timur Kristóf,
Christian König, Alex Deucher, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <timur.kristof@gmail.com>
[ Upstream commit ae5c2bee1680436d9bf8bfaca7416496adff0ee0 ]
Rename extra_dw to extra_bytes and document what it's for.
The value is already used as if it were bytes in vcn_v4_0.c
and in amdgpu_ring_init. Just adjust the dword count in
jpeg_v1_0.c so that it becomes a byte count.
v2:
Rename extra_dw to extra_bytes as discussed during review.
Fixes: c8c1a1d2ef04 ("drm/amdgpu: define and add extra dword for jpeg ring")
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 3 ++-
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 13 ++++++++++++-
drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c | 2 +-
drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 2 +-
4 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
index 486c3646710cc..8f6ce948c6841 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
@@ -364,7 +364,8 @@ int amdgpu_ring_init(struct amdgpu_device *adev, struct amdgpu_ring *ring,
/* Allocate ring buffer */
if (ring->ring_obj == NULL) {
- r = amdgpu_bo_create_kernel(adev, ring->ring_size + ring->funcs->extra_dw, PAGE_SIZE,
+ r = amdgpu_bo_create_kernel(adev, ring->ring_size + ring->funcs->extra_bytes,
+ PAGE_SIZE,
AMDGPU_GEM_DOMAIN_GTT,
&ring->ring_obj,
&ring->gpu_addr,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
index 7670f5d82b9e4..12783ea3ba0f1 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
@@ -211,7 +211,18 @@ struct amdgpu_ring_funcs {
bool support_64bit_ptrs;
bool no_user_fence;
bool secure_submission_supported;
- unsigned extra_dw;
+
+ /**
+ * @extra_bytes:
+ *
+ * Optional extra space in bytes that is added to the ring size
+ * when allocating the BO that holds the contents of the ring.
+ * This space isn't used for command submission to the ring,
+ * but is just there to satisfy some hardware requirements or
+ * implement workarounds. It's up to the implementation of each
+ * specific ring to initialize this space.
+ */
+ unsigned extra_bytes;
/* ring read/write ptr handling */
u64 (*get_rptr)(struct amdgpu_ring *ring);
diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c
index 9e428e669ada6..b5bb7f4d607c1 100644
--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c
@@ -557,7 +557,7 @@ static const struct amdgpu_ring_funcs jpeg_v1_0_decode_ring_vm_funcs = {
.nop = PACKET0(0x81ff, 0),
.support_64bit_ptrs = false,
.no_user_fence = true,
- .extra_dw = 64,
+ .extra_bytes = 256,
.get_rptr = jpeg_v1_0_decode_ring_get_rptr,
.get_wptr = jpeg_v1_0_decode_ring_get_wptr,
.set_wptr = jpeg_v1_0_decode_ring_set_wptr,
diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
index 706f3b2f484f7..ac55549e20be6 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
@@ -1984,7 +1984,7 @@ static struct amdgpu_ring_funcs vcn_v4_0_unified_ring_vm_funcs = {
.type = AMDGPU_RING_TYPE_VCN_ENC,
.align_mask = 0x3f,
.nop = VCN_ENC_CMD_NO_OP,
- .extra_dw = sizeof(struct amdgpu_vcn_rb_metadata),
+ .extra_bytes = sizeof(struct amdgpu_vcn_rb_metadata),
.get_rptr = vcn_v4_0_unified_ring_get_rptr,
.get_wptr = vcn_v4_0_unified_ring_get_wptr,
.set_wptr = vcn_v4_0_unified_ring_set_wptr,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 366/563] f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (364 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 365/563] drm/amdgpu: Fix allocating extra dwords for rings (v2) Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 367/563] f2fs: fix to truncate first page in error path of f2fs_truncate() Greg Kroah-Hartman
` (210 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chao Yu, Jaegeuk Kim, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit 869833f54e8306326b85ca3ed08979b7ad412a4a ]
Script to reproduce:
mkfs.f2fs -O extra_attr,compression /dev/vdb -f
mount /dev/vdb /mnt/f2fs -o mode=lfs,noextent_cache
cd /mnt/f2fs
f2fs_io write 1 0 1024 rand dsync testfile
xfs_io testfile -c "fsync"
f2fs_io write 1 0 512 rand dsync testfile
xfs_io testfile -c "fsync"
cd /
umount /mnt/f2fs
mount /dev/vdb /mnt/f2fs
f2fs_io precache_extents /mnt/f2fs/testfile
umount /mnt/f2fs
Tracepoint output:
f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 0, len = 512, blkaddr = 1055744, c_len = 0
f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 513, len = 351, blkaddr = 17921, c_len = 0
f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 864, len = 160, blkaddr = 18272, c_len = 0
During precache_extents, there is off-by-one issue, we should update
map->m_next_extent to pgofs rather than pgofs + 1, if last blkaddr is
valid and not contiguous to previous extent.
Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/data.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 7961e0ddfca3a..838eae39d3b19 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -1783,7 +1783,7 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag)
map->m_len - ofs);
}
if (map->m_next_extent)
- *map->m_next_extent = pgofs + 1;
+ *map->m_next_extent = is_hole ? pgofs + 1 : pgofs;
}
f2fs_put_dnode(&dn);
unlock_out:
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 367/563] f2fs: fix to truncate first page in error path of f2fs_truncate()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (365 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 366/563] f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 368/563] f2fs: fix to avoid migrating empty section Greg Kroah-Hartman
` (209 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+90266696fe5daacebd35, Chao Yu,
Jaegeuk Kim, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit 9251a9e6e871cb03c4714a18efa8f5d4a8818450 ]
syzbot reports a bug as below:
loop0: detected capacity change from 0 to 40427
F2FS-fs (loop0): Wrong SSA boundary, start(3584) end(4096) blocks(3072)
F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
F2FS-fs (loop0): invalid crc value
F2FS-fs (loop0): f2fs_convert_inline_folio: corrupted inline inode ino=3, i_addr[0]:0x1601, run fsck to fix.
------------[ cut here ]------------
kernel BUG at fs/inode.c:753!
RIP: 0010:clear_inode+0x169/0x190 fs/inode.c:753
Call Trace:
<TASK>
evict+0x504/0x9c0 fs/inode.c:810
f2fs_fill_super+0x5612/0x6fa0 fs/f2fs/super.c:5047
get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1692
vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
do_new_mount+0x2a2/0x9e0 fs/namespace.c:3808
do_mount fs/namespace.c:4136 [inline]
__do_sys_mount fs/namespace.c:4347 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4324
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
During f2fs_evict_inode(), clear_inode() detects that we missed to truncate
all page cache before destorying inode, that is because in below path, we
will create page #0 in cache, but missed to drop it in error path, let's fix
it.
- evict
- f2fs_evict_inode
- f2fs_truncate
- f2fs_convert_inline_inode
- f2fs_grab_cache_folio
: create page #0 in cache
- f2fs_convert_inline_folio
: sanity check failed, return -EFSCORRUPTED
- clear_inode detects that inode->i_data.nrpages is not zero
Fixes: 92dffd01790a ("f2fs: convert inline_data when i_size becomes large")
Reported-by: syzbot+90266696fe5daacebd35@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-f2fs-devel/68c09802.050a0220.3c6139.000e.GAE@google.com
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/file.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 42faaed6a02da..1aae4361d0a89 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -904,8 +904,16 @@ int f2fs_truncate(struct inode *inode)
/* we should check inline_data size */
if (!f2fs_may_inline_data(inode)) {
err = f2fs_convert_inline_inode(inode);
- if (err)
+ if (err) {
+ /*
+ * Always truncate page #0 to avoid page cache
+ * leak in evict() path.
+ */
+ truncate_inode_pages_range(inode->i_mapping,
+ F2FS_BLK_TO_BYTES(0),
+ F2FS_BLK_END_BYTES(0));
return err;
+ }
}
err = f2fs_truncate_blocks(inode, i_size_read(inode), true);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 368/563] f2fs: fix to avoid migrating empty section
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (366 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 367/563] f2fs: fix to truncate first page in error path of f2fs_truncate() Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 369/563] f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() Greg Kroah-Hartman
` (208 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daeho Jeong, Chao Yu, Jaegeuk Kim,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit d625a2b08c089397d3a03bff13fa8645e4ec7a01 ]
It reports a bug from device w/ zufs:
F2FS-fs (dm-64): Inconsistent segment (173822) type [1, 0] in SSA and SIT
F2FS-fs (dm-64): Stopped filesystem due to reason: 4
Thread A Thread B
- f2fs_expand_inode_data
- f2fs_allocate_pinning_section
- f2fs_gc_range
- do_garbage_collect w/ segno #x
- writepage
- f2fs_allocate_data_block
- new_curseg
- allocate segno #x
The root cause is: fallocate on pinning file may race w/ block allocation
as above, result in do_garbage_collect() from fallocate() may migrate
segment which is just allocated by a log, the log will update segment type
in its in-memory structure, however GC will get segment type from on-disk
SSA block, once segment type changes by log, we can detect such
inconsistency, then shutdown filesystem.
In this case, on-disk SSA shows type of segno #173822 is 1 (SUM_TYPE_NODE),
however segno #173822 was just allocated as data type segment, so in-memory
SIT shows type of segno #173822 is 0 (SUM_TYPE_DATA).
Change as below to fix this issue:
- check whether current section is empty before gc
- add sanity checks on do_garbage_collect() to avoid any race case, result
in migrating segment used by log.
- btw, it fixes misc issue in printed logs: "SSA and SIT" -> "SIT and SSA".
Fixes: 9703d69d9d15 ("f2fs: support file pinning for zoned devices")
Cc: Daeho Jeong <daehojeong@google.com>
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/gc.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
index c0f209f746882..5734e03864685 100644
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -1794,6 +1794,13 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi,
struct folio *sum_folio = filemap_get_folio(META_MAPPING(sbi),
GET_SUM_BLOCK(sbi, segno));
+ if (is_cursec(sbi, GET_SEC_FROM_SEG(sbi, segno))) {
+ f2fs_err(sbi, "%s: segment %u is used by log",
+ __func__, segno);
+ f2fs_bug_on(sbi, 1);
+ goto skip;
+ }
+
if (get_valid_blocks(sbi, segno, false) == 0)
goto freed;
if (gc_type == BG_GC && __is_large_section(sbi) &&
@@ -1805,7 +1812,7 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi,
sum = folio_address(sum_folio);
if (type != GET_SUM_TYPE((&sum->footer))) {
- f2fs_err(sbi, "Inconsistent segment (%u) type [%d, %d] in SSA and SIT",
+ f2fs_err(sbi, "Inconsistent segment (%u) type [%d, %d] in SIT and SSA",
segno, type, GET_SUM_TYPE((&sum->footer)));
f2fs_stop_checkpoint(sbi, false,
STOP_CP_REASON_CORRUPTED_SUMMARY);
@@ -2068,6 +2075,13 @@ int f2fs_gc_range(struct f2fs_sb_info *sbi,
.iroot = RADIX_TREE_INIT(gc_list.iroot, GFP_NOFS),
};
+ /*
+ * avoid migrating empty section, as it can be allocated by
+ * log in parallel.
+ */
+ if (!get_valid_blocks(sbi, segno, true))
+ continue;
+
if (is_cursec(sbi, GET_SEC_FROM_SEG(sbi, segno)))
continue;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 369/563] f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (367 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 368/563] f2fs: fix to avoid migrating empty section Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 370/563] RISC-V: KVM: Write hgatp register with valid mode bits Greg Kroah-Hartman
` (207 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chao Yu, Jaegeuk Kim, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit c2f7c32b254006ad48f8e4efb2e7e7bf71739f17 ]
f2fs_zero_post_eof_page() may cuase more overhead due to invalidate_lock
and page lookup, change as below to mitigate its overhead:
- check new_size before grabbing invalidate_lock
- lookup and invalidate pages only in range of [old_size, new_size]
Fixes: ba8dac350faf ("f2fs: fix to zero post-eof page")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/file.c | 39 +++++++++++++++++++--------------------
1 file changed, 19 insertions(+), 20 deletions(-)
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 1aae4361d0a89..ffa045b39c01d 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -35,15 +35,23 @@
#include <trace/events/f2fs.h>
#include <uapi/linux/f2fs.h>
-static void f2fs_zero_post_eof_page(struct inode *inode, loff_t new_size)
+static void f2fs_zero_post_eof_page(struct inode *inode,
+ loff_t new_size, bool lock)
{
loff_t old_size = i_size_read(inode);
if (old_size >= new_size)
return;
+ if (mapping_empty(inode->i_mapping))
+ return;
+
+ if (lock)
+ filemap_invalidate_lock(inode->i_mapping);
/* zero or drop pages only in range of [old_size, new_size] */
- truncate_pagecache(inode, old_size);
+ truncate_inode_pages_range(inode->i_mapping, old_size, new_size);
+ if (lock)
+ filemap_invalidate_unlock(inode->i_mapping);
}
static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf)
@@ -114,9 +122,7 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
f2fs_bug_on(sbi, f2fs_has_inline_data(inode));
- filemap_invalidate_lock(inode->i_mapping);
- f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT);
- filemap_invalidate_unlock(inode->i_mapping);
+ f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT, true);
file_update_time(vmf->vma->vm_file);
filemap_invalidate_lock_shared(inode->i_mapping);
@@ -1149,7 +1155,7 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
filemap_invalidate_lock(inode->i_mapping);
if (attr->ia_size > old_size)
- f2fs_zero_post_eof_page(inode, attr->ia_size);
+ f2fs_zero_post_eof_page(inode, attr->ia_size, false);
truncate_setsize(inode, attr->ia_size);
if (attr->ia_size <= old_size)
@@ -1268,9 +1274,7 @@ static int f2fs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
if (ret)
return ret;
- filemap_invalidate_lock(inode->i_mapping);
- f2fs_zero_post_eof_page(inode, offset + len);
- filemap_invalidate_unlock(inode->i_mapping);
+ f2fs_zero_post_eof_page(inode, offset + len, true);
pg_start = ((unsigned long long) offset) >> PAGE_SHIFT;
pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT;
@@ -1555,7 +1559,7 @@ static int f2fs_do_collapse(struct inode *inode, loff_t offset, loff_t len)
f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
filemap_invalidate_lock(inode->i_mapping);
- f2fs_zero_post_eof_page(inode, offset + len);
+ f2fs_zero_post_eof_page(inode, offset + len, false);
f2fs_lock_op(sbi);
f2fs_drop_extent_tree(inode);
@@ -1678,9 +1682,7 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len,
if (ret)
return ret;
- filemap_invalidate_lock(mapping);
- f2fs_zero_post_eof_page(inode, offset + len);
- filemap_invalidate_unlock(mapping);
+ f2fs_zero_post_eof_page(inode, offset + len, true);
pg_start = ((unsigned long long) offset) >> PAGE_SHIFT;
pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT;
@@ -1814,7 +1816,7 @@ static int f2fs_insert_range(struct inode *inode, loff_t offset, loff_t len)
f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
filemap_invalidate_lock(mapping);
- f2fs_zero_post_eof_page(inode, offset + len);
+ f2fs_zero_post_eof_page(inode, offset + len, false);
truncate_pagecache(inode, offset);
while (!ret && idx > pg_start) {
@@ -1872,9 +1874,7 @@ static int f2fs_expand_inode_data(struct inode *inode, loff_t offset,
if (err)
return err;
- filemap_invalidate_lock(inode->i_mapping);
- f2fs_zero_post_eof_page(inode, offset + len);
- filemap_invalidate_unlock(inode->i_mapping);
+ f2fs_zero_post_eof_page(inode, offset + len, true);
f2fs_balance_fs(sbi, true);
@@ -4922,9 +4922,8 @@ static ssize_t f2fs_write_checks(struct kiocb *iocb, struct iov_iter *from)
if (err)
return err;
- filemap_invalidate_lock(inode->i_mapping);
- f2fs_zero_post_eof_page(inode, iocb->ki_pos + iov_iter_count(from));
- filemap_invalidate_unlock(inode->i_mapping);
+ f2fs_zero_post_eof_page(inode,
+ iocb->ki_pos + iov_iter_count(from), true);
return count;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 370/563] RISC-V: KVM: Write hgatp register with valid mode bits
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (368 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 369/563] f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 371/563] ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT Greg Kroah-Hartman
` (206 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nutty Liu, Troy Mitchell,
Guo Ren (Alibaba DAMO Academy), Fangyu Yu, Anup Patel,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fangyu Yu <fangyu.yu@linux.alibaba.com>
[ Upstream commit 2b351e3d04be9e1533f26c3464f1e44a5beace30 ]
According to the RISC-V Privileged Architecture Spec, when MODE=Bare
is selected,software must write zero to the remaining fields of hgatp.
We have detected the valid mode supported by the HW before, So using a
valid mode to detect how many vmid bits are supported.
Fixes: fd7bb4a251df ("RISC-V: KVM: Implement VMID allocator")
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Reviewed-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
Reviewed-by: Guo Ren (Alibaba DAMO Academy) <guoren@kernel.org>
Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
Signed-off-by: Guo Ren (Alibaba DAMO Academy) <guoren@kernel.org>
Link: https://lore.kernel.org/r/20250821142542.2472079-2-guoren@kernel.org
Signed-off-by: Anup Patel <anup@brainfault.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/kvm/vmid.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/riscv/kvm/vmid.c b/arch/riscv/kvm/vmid.c
index 3b426c800480c..5f33625f40706 100644
--- a/arch/riscv/kvm/vmid.c
+++ b/arch/riscv/kvm/vmid.c
@@ -14,6 +14,7 @@
#include <linux/smp.h>
#include <linux/kvm_host.h>
#include <asm/csr.h>
+#include <asm/kvm_mmu.h>
#include <asm/kvm_tlb.h>
#include <asm/kvm_vmid.h>
@@ -28,7 +29,7 @@ void __init kvm_riscv_gstage_vmid_detect(void)
/* Figure-out number of VMID bits in HW */
old = csr_read(CSR_HGATP);
- csr_write(CSR_HGATP, old | HGATP_VMID);
+ csr_write(CSR_HGATP, (kvm_riscv_gstage_mode << HGATP_MODE_SHIFT) | HGATP_VMID);
vmid_bits = csr_read(CSR_HGATP);
vmid_bits = (vmid_bits & HGATP_VMID) >> HGATP_VMID_SHIFT;
vmid_bits = fls_long(vmid_bits);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 371/563] ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (369 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 370/563] RISC-V: KVM: Write hgatp register with valid mode bits Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 372/563] ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message Greg Kroah-Hartman
` (205 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+10b4363fb0f46527f3f3,
Sebastian Andrzej Siewior, Takashi Iwai, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ Upstream commit 9fc4a3da9a0259a0500848b5d8657918efde176b ]
snd_pcm_group_lock_irq() acquires a spinlock_t and disables interrupts
via spin_lock_irq(). This also implicitly disables the handling of
softirqs such as TIMER_SOFTIRQ.
On PREEMPT_RT softirqs are preemptible and spin_lock_irq() does not
disable them. That means a timer can be invoked during spin_lock_irq()
on the same CPU. Due to synchronisations reasons local_bh_disable() has
a per-CPU lock named softirq_ctrl.lock which synchronizes individual
softirq against each other.
syz-bot managed to trigger a lockdep report where softirq_ctrl.lock is
acquired in hrtimer_cancel() in addition to hrtimer_run_softirq(). This
is a possible deadlock.
The softirq_ctrl.lock can not be made part of spin_lock_irq() as this
would lead to too much synchronisation against individual threads on the
system. To avoid the possible deadlock, softirqs must be manually
disabled before the lock is acquired.
Disable softirqs before the lock is acquired on PREEMPT_RT.
Reported-by: syzbot+10b4363fb0f46527f3f3@syzkaller.appspotmail.com
Fixes: d2d6422f8bd1 ("x86: Allow to enable PREEMPT_RT.")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/pcm_native.c | 25 +++++++++++++++----------
1 file changed, 15 insertions(+), 10 deletions(-)
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 1eab940fa2e5a..68bee40c9adaf 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -84,19 +84,24 @@ void snd_pcm_group_init(struct snd_pcm_group *group)
}
/* define group lock helpers */
-#define DEFINE_PCM_GROUP_LOCK(action, mutex_action) \
+#define DEFINE_PCM_GROUP_LOCK(action, bh_lock, bh_unlock, mutex_action) \
static void snd_pcm_group_ ## action(struct snd_pcm_group *group, bool nonatomic) \
{ \
- if (nonatomic) \
+ if (nonatomic) { \
mutex_ ## mutex_action(&group->mutex); \
- else \
- spin_ ## action(&group->lock); \
-}
-
-DEFINE_PCM_GROUP_LOCK(lock, lock);
-DEFINE_PCM_GROUP_LOCK(unlock, unlock);
-DEFINE_PCM_GROUP_LOCK(lock_irq, lock);
-DEFINE_PCM_GROUP_LOCK(unlock_irq, unlock);
+ } else { \
+ if (IS_ENABLED(CONFIG_PREEMPT_RT) && bh_lock) \
+ local_bh_disable(); \
+ spin_ ## action(&group->lock); \
+ if (IS_ENABLED(CONFIG_PREEMPT_RT) && bh_unlock) \
+ local_bh_enable(); \
+ } \
+}
+
+DEFINE_PCM_GROUP_LOCK(lock, false, false, lock);
+DEFINE_PCM_GROUP_LOCK(unlock, false, false, unlock);
+DEFINE_PCM_GROUP_LOCK(lock_irq, true, false, lock);
+DEFINE_PCM_GROUP_LOCK(unlock_irq, false, true, unlock);
/**
* snd_pcm_stream_lock - Lock the PCM stream
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 372/563] ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (370 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 371/563] ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 373/563] scsi: qla2xxx: edif: Fix incorrect sign of error code Greg Kroah-Hartman
` (204 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Colin Ian King, Ira Weiny,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <colin.i.king@gmail.com>
[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ]
There appears to be a cut-n-paste error with the incorrect field
ndr_desc->numa_node being reported for the target node. Fix this by
using ndr_desc->target_node instead.
Fixes: f060db99374e ("ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect")
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/nfit/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index ae035b93da087..3eb56b77cb6d9 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -2637,7 +2637,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc,
if (ndr_desc->target_node == NUMA_NO_NODE) {
ndr_desc->target_node = phys_to_target_node(spa->address);
dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]",
- NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end);
+ NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end);
}
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 373/563] scsi: qla2xxx: edif: Fix incorrect sign of error code
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (371 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 372/563] ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 374/563] scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() Greg Kroah-Hartman
` (203 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qianfeng Rong, Martin K. Petersen,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <rongqianfeng@vivo.com>
[ Upstream commit 066b8f3fa85c1be7fb7dbae202231e131d38f7bc ]
Change the error code EAGAIN to -EAGAIN in qla24xx_sadb_update() and
qla_edif_process_els() to align with qla2x00_start_sp() returning
negative error codes or QLA_SUCCESS, preventing logical errors.
Fixes: 0b3f3143d473 ("scsi: qla2xxx: edif: Add retry for ELS passthrough")
Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Message-ID: <20250905075446.381139-2-rongqianfeng@vivo.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_edif.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c
index 91bbd3b75bff9..ccd4485087a10 100644
--- a/drivers/scsi/qla2xxx/qla_edif.c
+++ b/drivers/scsi/qla2xxx/qla_edif.c
@@ -1798,7 +1798,7 @@ qla24xx_sadb_update(struct bsg_job *bsg_job)
switch (rval) {
case QLA_SUCCESS:
break;
- case EAGAIN:
+ case -EAGAIN:
msleep(EDIF_MSLEEP_INTERVAL);
cnt++;
if (cnt < EDIF_RETRY_COUNT)
@@ -3649,7 +3649,7 @@ int qla_edif_process_els(scsi_qla_host_t *vha, struct bsg_job *bsg_job)
p->e.extra_rx_xchg_address, p->e.extra_control_flags,
sp->handle, sp->remap.req.len, bsg_job);
break;
- case EAGAIN:
+ case -EAGAIN:
msleep(EDIF_MSLEEP_INTERVAL);
cnt++;
if (cnt < EDIF_RETRY_COUNT)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 374/563] scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (372 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 373/563] scsi: qla2xxx: edif: Fix incorrect sign of error code Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 375/563] scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() Greg Kroah-Hartman
` (202 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qianfeng Rong, Martin K. Petersen,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <rongqianfeng@vivo.com>
[ Upstream commit 1f037e3acda79639a78f096355f2c308a3d45492 ]
Change the error code EAGAIN to -EAGAIN in START_SP_W_RETRIES() to align
with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS,
preventing logical errors. Additionally, the '_rval' variable should
store negative error codes to conform to Linux kernel error code
conventions.
Fixes: 9803fb5d2759 ("scsi: qla2xxx: Fix task management cmd failure")
Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Message-ID: <20250905075446.381139-3-rongqianfeng@vivo.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_init.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index be211ff22acbd..6a2e1c7fd1251 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -2059,11 +2059,11 @@ static void qla_marker_sp_done(srb_t *sp, int res)
int cnt = 5; \
do { \
if (_chip_gen != sp->vha->hw->chip_reset || _login_gen != sp->fcport->login_gen) {\
- _rval = EINVAL; \
+ _rval = -EINVAL; \
break; \
} \
_rval = qla2x00_start_sp(_sp); \
- if (_rval == EAGAIN) \
+ if (_rval == -EAGAIN) \
msleep(1); \
else \
break; \
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 375/563] scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (373 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 374/563] scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 376/563] HID: hidraw: tighten ioctl command parsing Greg Kroah-Hartman
` (201 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qianfeng Rong, Martin K. Petersen,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <rongqianfeng@vivo.com>
[ Upstream commit 9877c004e9f4d10e7786ac80a50321705d76e036 ]
Change the error code EAGAIN to -EAGAIN in qla_nvme_xmt_ls_rsp() to
align with qla2x00_start_sp() returning negative error codes or
QLA_SUCCESS, preventing logical errors.
Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe")
Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Message-ID: <20250905075446.381139-4-rongqianfeng@vivo.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_nvme.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
index 8ee2e337c9e1b..316594aa40cc5 100644
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -419,7 +419,7 @@ static int qla_nvme_xmt_ls_rsp(struct nvme_fc_local_port *lport,
switch (rval) {
case QLA_SUCCESS:
break;
- case EAGAIN:
+ case -EAGAIN:
msleep(PURLS_MSLEEP_INTERVAL);
cnt++;
if (cnt < PURLS_RETRY_COUNT)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 376/563] HID: hidraw: tighten ioctl command parsing
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (374 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 375/563] scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 377/563] f2fs: fix zero-sized extent for precache extents Greg Kroah-Hartman
` (200 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Benjamin Tissoires,
Jiri Kosina, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <bentiss@kernel.org>
[ Upstream commit 75d5546f60b36900051d75ee623fceccbeb6750c ]
The handling for variable-length ioctl commands in hidraw_ioctl() is
rather complex and the check for the data direction is incomplete.
Simplify this code by factoring out the various ioctls grouped by dir
and size, and using a switch() statement with the size masked out, to
ensure the rest of the command is correctly matched.
Fixes: 9188e79ec3fd ("HID: add phys and name ioctls to hidraw")
Reported-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hidraw.c | 224 ++++++++++++++++++++----------------
include/uapi/linux/hidraw.h | 2 +
2 files changed, 124 insertions(+), 102 deletions(-)
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index c887f48756f4b..bbd6f23bce789 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -394,27 +394,15 @@ static int hidraw_revoke(struct hidraw_list *list)
return 0;
}
-static long hidraw_ioctl(struct file *file, unsigned int cmd,
- unsigned long arg)
+static long hidraw_fixed_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd,
+ void __user *arg)
{
- struct inode *inode = file_inode(file);
- unsigned int minor = iminor(inode);
- long ret = 0;
- struct hidraw *dev;
- struct hidraw_list *list = file->private_data;
- void __user *user_arg = (void __user*) arg;
-
- down_read(&minors_rwsem);
- dev = hidraw_table[minor];
- if (!dev || !dev->exist || hidraw_is_revoked(list)) {
- ret = -ENODEV;
- goto out;
- }
+ struct hid_device *hid = dev->hid;
switch (cmd) {
case HIDIOCGRDESCSIZE:
- if (put_user(dev->hid->rsize, (int __user *)arg))
- ret = -EFAULT;
+ if (put_user(hid->rsize, (int __user *)arg))
+ return -EFAULT;
break;
case HIDIOCGRDESC:
@@ -422,113 +410,145 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
__u32 len;
if (get_user(len, (int __user *)arg))
- ret = -EFAULT;
- else if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
- ret = -EINVAL;
- else if (copy_to_user(user_arg + offsetof(
- struct hidraw_report_descriptor,
- value[0]),
- dev->hid->rdesc,
- min(dev->hid->rsize, len)))
- ret = -EFAULT;
+ return -EFAULT;
+
+ if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
+ return -EINVAL;
+
+ if (copy_to_user(arg + offsetof(
+ struct hidraw_report_descriptor,
+ value[0]),
+ hid->rdesc,
+ min(hid->rsize, len)))
+ return -EFAULT;
+
break;
}
case HIDIOCGRAWINFO:
{
struct hidraw_devinfo dinfo;
- dinfo.bustype = dev->hid->bus;
- dinfo.vendor = dev->hid->vendor;
- dinfo.product = dev->hid->product;
- if (copy_to_user(user_arg, &dinfo, sizeof(dinfo)))
- ret = -EFAULT;
+ dinfo.bustype = hid->bus;
+ dinfo.vendor = hid->vendor;
+ dinfo.product = hid->product;
+ if (copy_to_user(arg, &dinfo, sizeof(dinfo)))
+ return -EFAULT;
break;
}
case HIDIOCREVOKE:
{
- if (user_arg)
- ret = -EINVAL;
- else
- ret = hidraw_revoke(list);
- break;
+ struct hidraw_list *list = file->private_data;
+
+ if (arg)
+ return -EINVAL;
+
+ return hidraw_revoke(list);
}
default:
- {
- struct hid_device *hid = dev->hid;
- if (_IOC_TYPE(cmd) != 'H') {
- ret = -EINVAL;
- break;
- }
+ /*
+ * None of the above ioctls can return -EAGAIN, so
+ * use it as a marker that we need to check variable
+ * length ioctls.
+ */
+ return -EAGAIN;
+ }
- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSFEATURE(0))) {
- int len = _IOC_SIZE(cmd);
- ret = hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT);
- break;
- }
- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGFEATURE(0))) {
- int len = _IOC_SIZE(cmd);
- ret = hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT);
- break;
- }
+ return 0;
+}
- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSINPUT(0))) {
- int len = _IOC_SIZE(cmd);
- ret = hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT);
- break;
- }
- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGINPUT(0))) {
- int len = _IOC_SIZE(cmd);
- ret = hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT);
- break;
- }
+static long hidraw_rw_variable_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd,
+ void __user *user_arg)
+{
+ int len = _IOC_SIZE(cmd);
+
+ switch (cmd & ~IOCSIZE_MASK) {
+ case HIDIOCSFEATURE(0):
+ return hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT);
+ case HIDIOCGFEATURE(0):
+ return hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT);
+ case HIDIOCSINPUT(0):
+ return hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT);
+ case HIDIOCGINPUT(0):
+ return hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT);
+ case HIDIOCSOUTPUT(0):
+ return hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT);
+ case HIDIOCGOUTPUT(0):
+ return hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT);
+ }
- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSOUTPUT(0))) {
- int len = _IOC_SIZE(cmd);
- ret = hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT);
- break;
- }
- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGOUTPUT(0))) {
- int len = _IOC_SIZE(cmd);
- ret = hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT);
- break;
- }
+ return -EINVAL;
+}
- /* Begin Read-only ioctls. */
- if (_IOC_DIR(cmd) != _IOC_READ) {
- ret = -EINVAL;
- break;
- }
+static long hidraw_ro_variable_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd,
+ void __user *user_arg)
+{
+ struct hid_device *hid = dev->hid;
+ int len = _IOC_SIZE(cmd);
+ int field_len;
+
+ switch (cmd & ~IOCSIZE_MASK) {
+ case HIDIOCGRAWNAME(0):
+ field_len = strlen(hid->name) + 1;
+ if (len > field_len)
+ len = field_len;
+ return copy_to_user(user_arg, hid->name, len) ? -EFAULT : len;
+ case HIDIOCGRAWPHYS(0):
+ field_len = strlen(hid->phys) + 1;
+ if (len > field_len)
+ len = field_len;
+ return copy_to_user(user_arg, hid->phys, len) ? -EFAULT : len;
+ case HIDIOCGRAWUNIQ(0):
+ field_len = strlen(hid->uniq) + 1;
+ if (len > field_len)
+ len = field_len;
+ return copy_to_user(user_arg, hid->uniq, len) ? -EFAULT : len;
+ }
- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWNAME(0))) {
- int len = strlen(hid->name) + 1;
- if (len > _IOC_SIZE(cmd))
- len = _IOC_SIZE(cmd);
- ret = copy_to_user(user_arg, hid->name, len) ?
- -EFAULT : len;
- break;
- }
+ return -EINVAL;
+}
- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWPHYS(0))) {
- int len = strlen(hid->phys) + 1;
- if (len > _IOC_SIZE(cmd))
- len = _IOC_SIZE(cmd);
- ret = copy_to_user(user_arg, hid->phys, len) ?
- -EFAULT : len;
- break;
- }
+static long hidraw_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+ struct inode *inode = file_inode(file);
+ unsigned int minor = iminor(inode);
+ struct hidraw *dev;
+ struct hidraw_list *list = file->private_data;
+ void __user *user_arg = (void __user *)arg;
+ int ret;
- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWUNIQ(0))) {
- int len = strlen(hid->uniq) + 1;
- if (len > _IOC_SIZE(cmd))
- len = _IOC_SIZE(cmd);
- ret = copy_to_user(user_arg, hid->uniq, len) ?
- -EFAULT : len;
- break;
- }
- }
+ down_read(&minors_rwsem);
+ dev = hidraw_table[minor];
+ if (!dev || !dev->exist || hidraw_is_revoked(list)) {
+ ret = -ENODEV;
+ goto out;
+ }
+
+ if (_IOC_TYPE(cmd) != 'H') {
+ ret = -EINVAL;
+ goto out;
+ }
+ if (_IOC_NR(cmd) > HIDIOCTL_LAST || _IOC_NR(cmd) == 0) {
ret = -ENOTTY;
+ goto out;
}
+
+ ret = hidraw_fixed_size_ioctl(file, dev, cmd, user_arg);
+ if (ret != -EAGAIN)
+ goto out;
+
+ switch (_IOC_DIR(cmd)) {
+ case (_IOC_READ | _IOC_WRITE):
+ ret = hidraw_rw_variable_size_ioctl(file, dev, cmd, user_arg);
+ break;
+ case _IOC_READ:
+ ret = hidraw_ro_variable_size_ioctl(file, dev, cmd, user_arg);
+ break;
+ default:
+ /* Any other IOC_DIR is wrong */
+ ret = -EINVAL;
+ }
+
out:
up_read(&minors_rwsem);
return ret;
diff --git a/include/uapi/linux/hidraw.h b/include/uapi/linux/hidraw.h
index d5ee269864e07..ebd701b3c18d9 100644
--- a/include/uapi/linux/hidraw.h
+++ b/include/uapi/linux/hidraw.h
@@ -48,6 +48,8 @@ struct hidraw_devinfo {
#define HIDIOCGOUTPUT(len) _IOC(_IOC_WRITE|_IOC_READ, 'H', 0x0C, len)
#define HIDIOCREVOKE _IOW('H', 0x0D, int) /* Revoke device access */
+#define HIDIOCTL_LAST _IOC_NR(HIDIOCREVOKE)
+
#define HIDRAW_FIRST_MINOR 0
#define HIDRAW_MAX_DEVICES 64
/* number of reports to buffer */
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 377/563] f2fs: fix zero-sized extent for precache extents
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (375 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 376/563] HID: hidraw: tighten ioctl command parsing Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:43 ` [PATCH 6.17 378/563] smc: Fix use-after-free in __pnet_find_base_ndev() Greg Kroah-Hartman
` (199 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, wangzijie, Chao Yu, Jaegeuk Kim,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: wangzijie <wangzijie1@honor.com>
[ Upstream commit 8175c864391753b210f3dcfae1aeed686a226ebb ]
Script to reproduce:
f2fs_io write 1 0 1881 rand dsync testfile
f2fs_io fallocate 0 7708672 4096 testfile
f2fs_io write 1 1881 1 rand buffered testfile
fsync testfile
umount
mount
f2fs_io precache_extents testfile
When the data layout is something like this:
dnode1: dnode2:
[0] A [0] NEW_ADDR
[1] A+1 [1] 0x0
...
[1016] A+1016
[1017] B (B!=A+1017) [1017] 0x0
During precache_extents, we map the last block(valid blkaddr) in dnode1:
map->m_flags |= F2FS_MAP_MAPPED;
map->m_pblk = blkaddr(valid blkaddr);
map->m_len = 1;
then we goto next_dnode, meet the first block in dnode2(hole), goto sync_out:
map->m_flags & F2FS_MAP_MAPPED == true, and we make zero-sized extent:
map->m_len = 1
ofs = start_pgofs - map->m_lblk = 1882 - 1881 = 1
ei.fofs = start_pgofs = 1882
ei.len = map->m_len - ofs = 1 - 1 = 0
Rebased on patch[1], this patch can cover these cases to avoid zero-sized extent:
A,B,C is valid blkaddr
case1:
dnode1: dnode2:
[0] A [0] NEW_ADDR
[1] A+1 [1] 0x0
... ....
[1016] A+1016
[1017] B (B!=A+1017) [1017] 0x0
case2:
dnode1: dnode2:
[0] A [0] C (C!=B+1)
[1] A+1 [1] C+1
... ....
[1016] A+1016
[1017] B (B!=A+1017) [1017] 0x0
case3:
dnode1: dnode2:
[0] A [0] C (C!=B+2)
[1] A+1 [1] C+1
... ....
[1015] A+1015
[1016] B (B!=A+1016)
[1017] B+1 [1017] 0x0
[1] https://lore.kernel.org/linux-f2fs-devel/20250912081250.44383-1-chao@kernel.org/
Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS")
Signed-off-by: wangzijie <wangzijie1@honor.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/data.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 838eae39d3b19..6e39a15a942a9 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -1778,9 +1778,10 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag)
if (map->m_flags & F2FS_MAP_MAPPED) {
unsigned int ofs = start_pgofs - map->m_lblk;
- f2fs_update_read_extent_cache_range(&dn,
- start_pgofs, map->m_pblk + ofs,
- map->m_len - ofs);
+ if (map->m_len > ofs)
+ f2fs_update_read_extent_cache_range(&dn,
+ start_pgofs, map->m_pblk + ofs,
+ map->m_len - ofs);
}
if (map->m_next_extent)
*map->m_next_extent = is_hole ? pgofs + 1 : pgofs;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 378/563] smc: Fix use-after-free in __pnet_find_base_ndev().
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (376 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 377/563] f2fs: fix zero-sized extent for precache extents Greg Kroah-Hartman
@ 2025-10-13 14:43 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 379/563] smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() Greg Kroah-Hartman
` (198 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+ea28e9d85be2f327b6c6,
Kuniyuki Iwashima, Eric Dumazet, Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 3d3466878afd8d43ec0ca2facfbc7f03e40d0f79 ]
syzbot reported use-after-free of net_device in __pnet_find_base_ndev(),
which was called during connect(). [0]
smc_pnet_find_ism_resource() fetches sk_dst_get(sk)->dev and passes
down to pnet_find_base_ndev(), where RTNL is held. Then, UAF happened
at __pnet_find_base_ndev() when the dev is first used.
This means dev had already been freed before acquiring RTNL in
pnet_find_base_ndev().
While dev is going away, dst->dev could be swapped with blackhole_netdev,
and the dev's refcnt by dst will be released.
We must hold dev's refcnt before calling smc_pnet_find_ism_resource().
Also, smc_pnet_find_roce_resource() has the same problem.
Let's use __sk_dst_get() and dst_dev_rcu() in the two functions.
[0]:
BUG: KASAN: use-after-free in __pnet_find_base_ndev+0x1b1/0x1c0 net/smc/smc_pnet.c:926
Read of size 1 at addr ffff888036bac33a by task syz.0.3632/18609
CPU: 1 UID: 0 PID: 18609 Comm: syz.0.3632 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
__pnet_find_base_ndev+0x1b1/0x1c0 net/smc/smc_pnet.c:926
pnet_find_base_ndev net/smc/smc_pnet.c:946 [inline]
smc_pnet_find_ism_by_pnetid net/smc/smc_pnet.c:1103 [inline]
smc_pnet_find_ism_resource+0xef/0x390 net/smc/smc_pnet.c:1154
smc_find_ism_device net/smc/af_smc.c:1030 [inline]
smc_find_proposal_devices net/smc/af_smc.c:1115 [inline]
__smc_connect+0x372/0x1890 net/smc/af_smc.c:1545
smc_connect+0x877/0xd90 net/smc/af_smc.c:1715
__sys_connect_file net/socket.c:2086 [inline]
__sys_connect+0x313/0x440 net/socket.c:2105
__do_sys_connect net/socket.c:2111 [inline]
__se_sys_connect net/socket.c:2108 [inline]
__x64_sys_connect+0x7a/0x90 net/socket.c:2108
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f47cbf8eba9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f47ccdb1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 00007f47cc1d5fa0 RCX: 00007f47cbf8eba9
RDX: 0000000000000010 RSI: 0000200000000280 RDI: 000000000000000b
RBP: 00007f47cc011e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f47cc1d6038 R14: 00007f47cc1d5fa0 R15: 00007ffc512f8aa8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888036bacd00 pfn:0x36bac
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea0001243d08 ffff8880b863fdc0 0000000000000000
raw: ffff888036bacd00 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x446dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 16741, tgid 16741 (syz-executor), ts 343313197788, free_ts 380670750466
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851
prep_new_page mm/page_alloc.c:1859 [inline]
get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5148
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416
___kmalloc_large_node+0x5f/0x1b0 mm/slub.c:4317
__kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:4348
__do_kmalloc_node mm/slub.c:4364 [inline]
__kvmalloc_node_noprof+0x6d/0x5f0 mm/slub.c:5067
alloc_netdev_mqs+0xa3/0x11b0 net/core/dev.c:11812
tun_set_iff+0x532/0xef0 drivers/net/tun.c:2775
__tun_chr_ioctl+0x788/0x1df0 drivers/net/tun.c:3085
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:598 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:584
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 18610 tgid 18608 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1395 [inline]
__free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2895
free_large_kmalloc+0x13a/0x1f0 mm/slub.c:4820
device_release+0x99/0x1c0 drivers/base/core.c:-1
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x22b/0x480 lib/kobject.c:737
netdev_run_todo+0xd2e/0xea0 net/core/dev.c:11513
rtnl_unlock net/core/rtnetlink.c:157 [inline]
rtnl_net_unlock include/linux/rtnetlink.h:135 [inline]
rtnl_dellink+0x537/0x710 net/core/rtnetlink.c:3563
rtnetlink_rcv_msg+0x7cc/0xb70 net/core/rtnetlink.c:6946
netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896
sock_sendmsg_nosec net/socket.c:714 [inline]
__sock_sendmsg+0x219/0x270 net/socket.c:729
____sys_sendmsg+0x505/0x830 net/socket.c:2614
___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668
__sys_sendmsg net/socket.c:2700 [inline]
__do_sys_sendmsg net/socket.c:2705 [inline]
__se_sys_sendmsg net/socket.c:2703 [inline]
__x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888036bac200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888036bac280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888036bac300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888036bac380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888036bac400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
Fixes: 0afff91c6f5e ("net/smc: add pnetid support")
Fixes: 1619f770589a ("net/smc: add pnetid support for SMC-D and ISM")
Reported-by: syzbot+ea28e9d85be2f327b6c6@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/68c237c7.050a0220.3c6139.0036.GAE@google.com/
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250916214758.650211-2-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/smc/smc_pnet.c | 43 ++++++++++++++++++++++---------------------
1 file changed, 22 insertions(+), 21 deletions(-)
diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c
index 76ad29e31d605..db3043b1e3fdb 100644
--- a/net/smc/smc_pnet.c
+++ b/net/smc/smc_pnet.c
@@ -1126,37 +1126,38 @@ static void smc_pnet_find_ism_by_pnetid(struct net_device *ndev,
*/
void smc_pnet_find_roce_resource(struct sock *sk, struct smc_init_info *ini)
{
- struct dst_entry *dst = sk_dst_get(sk);
-
- if (!dst)
- goto out;
- if (!dst->dev)
- goto out_rel;
+ struct net_device *dev;
+ struct dst_entry *dst;
- smc_pnet_find_roce_by_pnetid(dst->dev, ini);
+ rcu_read_lock();
+ dst = __sk_dst_get(sk);
+ dev = dst ? dst_dev_rcu(dst) : NULL;
+ dev_hold(dev);
+ rcu_read_unlock();
-out_rel:
- dst_release(dst);
-out:
- return;
+ if (dev) {
+ smc_pnet_find_roce_by_pnetid(dev, ini);
+ dev_put(dev);
+ }
}
void smc_pnet_find_ism_resource(struct sock *sk, struct smc_init_info *ini)
{
- struct dst_entry *dst = sk_dst_get(sk);
+ struct net_device *dev;
+ struct dst_entry *dst;
ini->ism_dev[0] = NULL;
- if (!dst)
- goto out;
- if (!dst->dev)
- goto out_rel;
- smc_pnet_find_ism_by_pnetid(dst->dev, ini);
+ rcu_read_lock();
+ dst = __sk_dst_get(sk);
+ dev = dst ? dst_dev_rcu(dst) : NULL;
+ dev_hold(dev);
+ rcu_read_unlock();
-out_rel:
- dst_release(dst);
-out:
- return;
+ if (dev) {
+ smc_pnet_find_ism_by_pnetid(dev, ini);
+ dev_put(dev);
+ }
}
/* Lookup and apply a pnet table entry to the given ib device.
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 379/563] smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (377 preceding siblings ...)
2025-10-13 14:43 ` [PATCH 6.17 378/563] smc: Fix use-after-free in __pnet_find_base_ndev() Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 380/563] smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() Greg Kroah-Hartman
` (197 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Eric Dumazet,
Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 935d783e5de9b64587f3adb25641dd8385e64ddb ]
smc_clc_prfx_set() is called during connect() and not under RCU
nor RTNL.
Using sk_dst_get(sk)->dev could trigger UAF.
Let's use __sk_dst_get() and dev_dst_rcu() under rcu_read_lock()
after kernel_getsockname().
Note that the returned value of smc_clc_prfx_set() is not used
in the caller.
While at it, we change the 1st arg of smc_clc_prfx_set[46]_rcu()
not to touch dst there.
Fixes: a046d57da19f ("smc: CLC handshake (incl. preparation steps)")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250916214758.650211-3-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/smc/smc_clc.c | 41 ++++++++++++++++++++++-------------------
1 file changed, 22 insertions(+), 19 deletions(-)
diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
index 08be56dfb3f24..976b2102bdfcd 100644
--- a/net/smc/smc_clc.c
+++ b/net/smc/smc_clc.c
@@ -509,10 +509,10 @@ static bool smc_clc_msg_hdr_valid(struct smc_clc_msg_hdr *clcm, bool check_trl)
}
/* find ipv4 addr on device and get the prefix len, fill CLC proposal msg */
-static int smc_clc_prfx_set4_rcu(struct dst_entry *dst, __be32 ipv4,
+static int smc_clc_prfx_set4_rcu(struct net_device *dev, __be32 ipv4,
struct smc_clc_msg_proposal_prefix *prop)
{
- struct in_device *in_dev = __in_dev_get_rcu(dst->dev);
+ struct in_device *in_dev = __in_dev_get_rcu(dev);
const struct in_ifaddr *ifa;
if (!in_dev)
@@ -530,12 +530,12 @@ static int smc_clc_prfx_set4_rcu(struct dst_entry *dst, __be32 ipv4,
}
/* fill CLC proposal msg with ipv6 prefixes from device */
-static int smc_clc_prfx_set6_rcu(struct dst_entry *dst,
+static int smc_clc_prfx_set6_rcu(struct net_device *dev,
struct smc_clc_msg_proposal_prefix *prop,
struct smc_clc_ipv6_prefix *ipv6_prfx)
{
#if IS_ENABLED(CONFIG_IPV6)
- struct inet6_dev *in6_dev = __in6_dev_get(dst->dev);
+ struct inet6_dev *in6_dev = __in6_dev_get(dev);
struct inet6_ifaddr *ifa;
int cnt = 0;
@@ -564,41 +564,44 @@ static int smc_clc_prfx_set(struct socket *clcsock,
struct smc_clc_msg_proposal_prefix *prop,
struct smc_clc_ipv6_prefix *ipv6_prfx)
{
- struct dst_entry *dst = sk_dst_get(clcsock->sk);
struct sockaddr_storage addrs;
struct sockaddr_in6 *addr6;
struct sockaddr_in *addr;
+ struct net_device *dev;
+ struct dst_entry *dst;
int rc = -ENOENT;
- if (!dst) {
- rc = -ENOTCONN;
- goto out;
- }
- if (!dst->dev) {
- rc = -ENODEV;
- goto out_rel;
- }
/* get address to which the internal TCP socket is bound */
if (kernel_getsockname(clcsock, (struct sockaddr *)&addrs) < 0)
- goto out_rel;
+ goto out;
+
/* analyze IP specific data of net_device belonging to TCP socket */
addr6 = (struct sockaddr_in6 *)&addrs;
+
rcu_read_lock();
+
+ dst = __sk_dst_get(clcsock->sk);
+ dev = dst ? dst_dev_rcu(dst) : NULL;
+ if (!dev) {
+ rc = -ENODEV;
+ goto out_unlock;
+ }
+
if (addrs.ss_family == PF_INET) {
/* IPv4 */
addr = (struct sockaddr_in *)&addrs;
- rc = smc_clc_prfx_set4_rcu(dst, addr->sin_addr.s_addr, prop);
+ rc = smc_clc_prfx_set4_rcu(dev, addr->sin_addr.s_addr, prop);
} else if (ipv6_addr_v4mapped(&addr6->sin6_addr)) {
/* mapped IPv4 address - peer is IPv4 only */
- rc = smc_clc_prfx_set4_rcu(dst, addr6->sin6_addr.s6_addr32[3],
+ rc = smc_clc_prfx_set4_rcu(dev, addr6->sin6_addr.s6_addr32[3],
prop);
} else {
/* IPv6 */
- rc = smc_clc_prfx_set6_rcu(dst, prop, ipv6_prfx);
+ rc = smc_clc_prfx_set6_rcu(dev, prop, ipv6_prfx);
}
+
+out_unlock:
rcu_read_unlock();
-out_rel:
- dst_release(dst);
out:
return rc;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 380/563] smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (378 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 379/563] smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 381/563] smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk() Greg Kroah-Hartman
` (196 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Eric Dumazet,
Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 235f81045c008169cc4e1955b4a64e118eebe61b ]
smc_clc_prfx_match() is called from smc_listen_work() and
not under RCU nor RTNL.
Using sk_dst_get(sk)->dev could trigger UAF.
Let's use __sk_dst_get() and dst_dev_rcu().
Note that the returned value of smc_clc_prfx_match() is not
used in the caller.
Fixes: a046d57da19f ("smc: CLC handshake (incl. preparation steps)")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250916214758.650211-4-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/smc/smc_clc.c | 26 +++++++++++++-------------
1 file changed, 13 insertions(+), 13 deletions(-)
diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
index 976b2102bdfcd..09745baa10170 100644
--- a/net/smc/smc_clc.c
+++ b/net/smc/smc_clc.c
@@ -657,26 +657,26 @@ static int smc_clc_prfx_match6_rcu(struct net_device *dev,
int smc_clc_prfx_match(struct socket *clcsock,
struct smc_clc_msg_proposal_prefix *prop)
{
- struct dst_entry *dst = sk_dst_get(clcsock->sk);
+ struct net_device *dev;
+ struct dst_entry *dst;
int rc;
- if (!dst) {
- rc = -ENOTCONN;
- goto out;
- }
- if (!dst->dev) {
+ rcu_read_lock();
+
+ dst = __sk_dst_get(clcsock->sk);
+ dev = dst ? dst_dev_rcu(dst) : NULL;
+ if (!dev) {
rc = -ENODEV;
- goto out_rel;
+ goto out;
}
- rcu_read_lock();
+
if (!prop->ipv6_prefixes_cnt)
- rc = smc_clc_prfx_match4_rcu(dst->dev, prop);
+ rc = smc_clc_prfx_match4_rcu(dev, prop);
else
- rc = smc_clc_prfx_match6_rcu(dst->dev, prop);
- rcu_read_unlock();
-out_rel:
- dst_release(dst);
+ rc = smc_clc_prfx_match6_rcu(dev, prop);
out:
+ rcu_read_unlock();
+
return rc;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 381/563] smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk().
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (379 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 380/563] smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 382/563] tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() Greg Kroah-Hartman
` (195 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Eric Dumazet,
Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 0b0e4d51c6554e5ecc3f8cc73c2eaf12da21249a ]
smc_vlan_by_tcpsk() fetches sk_dst_get(sk)->dev before RTNL and
passes it to netdev_walk_all_lower_dev(), which is illegal.
Also, smc_vlan_by_tcpsk_walk() does not require RTNL at all.
Let's use __sk_dst_get(), dst_dev_rcu(), and
netdev_walk_all_lower_dev_rcu().
Note that the returned value of smc_vlan_by_tcpsk() is not used
in the caller.
Fixes: 0cfdd8f92cac ("smc: connection and link group creation")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250916214758.650211-5-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/smc/smc_core.c | 27 ++++++++++++---------------
1 file changed, 12 insertions(+), 15 deletions(-)
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index 262746e304dda..2a559a98541c7 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -1883,35 +1883,32 @@ static int smc_vlan_by_tcpsk_walk(struct net_device *lower_dev,
/* Determine vlan of internal TCP socket. */
int smc_vlan_by_tcpsk(struct socket *clcsock, struct smc_init_info *ini)
{
- struct dst_entry *dst = sk_dst_get(clcsock->sk);
struct netdev_nested_priv priv;
struct net_device *ndev;
+ struct dst_entry *dst;
int rc = 0;
ini->vlan_id = 0;
- if (!dst) {
- rc = -ENOTCONN;
- goto out;
- }
- if (!dst->dev) {
+
+ rcu_read_lock();
+
+ dst = __sk_dst_get(clcsock->sk);
+ ndev = dst ? dst_dev_rcu(dst) : NULL;
+ if (!ndev) {
rc = -ENODEV;
- goto out_rel;
+ goto out;
}
- ndev = dst->dev;
if (is_vlan_dev(ndev)) {
ini->vlan_id = vlan_dev_vlan_id(ndev);
- goto out_rel;
+ goto out;
}
priv.data = (void *)&ini->vlan_id;
- rtnl_lock();
- netdev_walk_all_lower_dev(ndev, smc_vlan_by_tcpsk_walk, &priv);
- rtnl_unlock();
-
-out_rel:
- dst_release(dst);
+ netdev_walk_all_lower_dev_rcu(ndev, smc_vlan_by_tcpsk_walk, &priv);
out:
+ rcu_read_unlock();
+
return rc;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 382/563] tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (380 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 381/563] smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk() Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 383/563] mptcp: Call dst_release() in mptcp_active_enable() Greg Kroah-Hartman
` (194 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Eric Dumazet,
Sabrina Dubroca, Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit c65f27b9c3be2269918e1cbad6d8884741f835c5 ]
get_netdev_for_sock() is called during setsockopt(),
so not under RCU.
Using sk_dst_get(sk)->dev could trigger UAF.
Let's use __sk_dst_get() and dst_dev_rcu().
Note that the only ->ndo_sk_get_lower_dev() user is
bond_sk_get_lower_dev(), which uses RCU.
Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/20250916214758.650211-6-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tls/tls_device.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
index f672a62a9a52f..a82fdcf199690 100644
--- a/net/tls/tls_device.c
+++ b/net/tls/tls_device.c
@@ -123,17 +123,19 @@ static void tls_device_queue_ctx_destruction(struct tls_context *ctx)
/* We assume that the socket is already connected */
static struct net_device *get_netdev_for_sock(struct sock *sk)
{
- struct dst_entry *dst = sk_dst_get(sk);
- struct net_device *netdev = NULL;
+ struct net_device *dev, *lowest_dev = NULL;
+ struct dst_entry *dst;
- if (likely(dst)) {
- netdev = netdev_sk_get_lowest_dev(dst->dev, sk);
- dev_hold(netdev);
+ rcu_read_lock();
+ dst = __sk_dst_get(sk);
+ dev = dst ? dst_dev_rcu(dst) : NULL;
+ if (likely(dev)) {
+ lowest_dev = netdev_sk_get_lowest_dev(dev, sk);
+ dev_hold(lowest_dev);
}
+ rcu_read_unlock();
- dst_release(dst);
-
- return netdev;
+ return lowest_dev;
}
static void destroy_record(struct tls_record_info *record)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 383/563] mptcp: Call dst_release() in mptcp_active_enable().
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (381 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 382/563] tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 384/563] mptcp: Use __sk_dst_get() and dst_dev_rcu() " Greg Kroah-Hartman
` (193 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima,
Matthieu Baerts (NGI0), Eric Dumazet, Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 108a86c71c93ff28087994e6107bc99ebe336629 ]
mptcp_active_enable() calls sk_dst_get(), which returns dst with its
refcount bumped, but forgot dst_release().
Let's add missing dst_release().
Cc: stable@vger.kernel.org
Fixes: 27069e7cb3d1 ("mptcp: disable active MPTCP in case of blackhole")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250916214758.650211-7-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 893c49a78d9f ("mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/ctrl.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c
index fed40dae5583a..c0e516872b4b5 100644
--- a/net/mptcp/ctrl.c
+++ b/net/mptcp/ctrl.c
@@ -505,6 +505,8 @@ void mptcp_active_enable(struct sock *sk)
if (dst && dst->dev && (dst->dev->flags & IFF_LOOPBACK))
atomic_set(&pernet->active_disable_times, 0);
+
+ dst_release(dst);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 384/563] mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (382 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 383/563] mptcp: Call dst_release() in mptcp_active_enable() Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 385/563] Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" Greg Kroah-Hartman
` (192 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima,
Matthieu Baerts (NGI0), Eric Dumazet, Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 893c49a78d9f85e4b8081b908fb7c407d018106a ]
mptcp_active_enable() is called from subflow_finish_connect(),
which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always
under RCU.
Using sk_dst_get(sk)->dev could trigger UAF.
Let's use __sk_dst_get() and dst_dev_rcu().
Fixes: 27069e7cb3d1 ("mptcp: disable active MPTCP in case of blackhole")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250916214758.650211-8-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/ctrl.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c
index c0e516872b4b5..e8ffa62ec183f 100644
--- a/net/mptcp/ctrl.c
+++ b/net/mptcp/ctrl.c
@@ -501,12 +501,15 @@ void mptcp_active_enable(struct sock *sk)
struct mptcp_pernet *pernet = mptcp_get_pernet(sock_net(sk));
if (atomic_read(&pernet->active_disable_times)) {
- struct dst_entry *dst = sk_dst_get(sk);
+ struct net_device *dev;
+ struct dst_entry *dst;
- if (dst && dst->dev && (dst->dev->flags & IFF_LOOPBACK))
+ rcu_read_lock();
+ dst = __sk_dst_get(sk);
+ dev = dst ? dst_dev_rcu(dst) : NULL;
+ if (dev && (dev->flags & IFF_LOOPBACK))
atomic_set(&pernet->active_disable_times, 0);
-
- dst_release(dst);
+ rcu_read_unlock();
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 385/563] Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running"
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (383 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 384/563] mptcp: Use __sk_dst_get() and dst_dev_rcu() " Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 386/563] RDMA/core: Resolve MAC of next-hop device without ARP support Greg Kroah-Hartman
` (191 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michal Pecio, Mathias Nyman,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Pecio <michal.pecio@gmail.com>
[ Upstream commit 08fa726e66039dfa80226dfa112931f60ad4c898 ]
This reverts commit 28a76fcc4c85dd39633fb96edb643c91820133e3.
No actual HW bugs are known where Endpoint Context shows Running state
but Stop Endpoint fails repeatedly with Context State Error and leaves
the endpoint state unchanged. Stop Endpoint retries on Running EPs have
been performed since early 2021 with no such issues reported so far.
Trying to handle this hypothetical case brings a more realistic danger:
if Stop Endpoint fails on an endpoint which hasn't yet started after a
doorbell ring and enough latency occurs before this completion event is
handled, the driver may time out and begin removing cancelled TDs from
a running endpoint, even though one more retry would stop it reliably.
Such high latency is rare but not impossible, and removing TDs from a
running endpoint can cause more damage than not giving back a cancelled
URB (which wasn't happening anyway). So err on the side of caution and
revert to the old policy of always retrying if the EP appears running.
[Remove stable tag as we are dealing with theoretical cases -Mathias]
Fixes: 28a76fcc4c85d ("usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running")
Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20250917210726.97100-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-ring.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 4f8f5aab109d0..6309200e93dc3 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1262,19 +1262,16 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
* Stopped state, but it will soon change to Running.
*
* Assume this bug on unexpected Stop Endpoint failures.
- * Keep retrying until the EP starts and stops again.
+ * Keep retrying until the EP starts and stops again, on
+ * chips where this is known to help. Wait for 100ms.
*/
+ if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
+ break;
fallthrough;
case EP_STATE_RUNNING:
/* Race, HW handled stop ep cmd before ep was running */
xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n",
GET_EP_CTX_STATE(ep_ctx));
- /*
- * Don't retry forever if we guessed wrong or a defective HC never starts
- * the EP or says 'Running' but fails the command. We must give back TDs.
- */
- if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
- break;
command = xhci_alloc_command(xhci, false, GFP_ATOMIC);
if (!command) {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 386/563] RDMA/core: Resolve MAC of next-hop device without ARP support
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (384 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 385/563] Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 387/563] IB/sa: Fix sa_local_svc_timeout_ms read race Greg Kroah-Hartman
` (190 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Parav Pandit, Vlad Dumitrescu,
Edward Srouji, Leon Romanovsky, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Parav Pandit <parav@nvidia.com>
[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ]
Currently, if the next-hop netdevice does not support ARP resolution,
the destination MAC address is silently set to zero without reporting
an error. This leads to incorrect behavior and may result in packet
transmission failures.
Fix this by deferring MAC resolution to the IP stack via neighbour
lookup, allowing proper resolution or error reporting as appropriate.
Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)")
Signed-off-by: Parav Pandit <parav@nvidia.com>
Reviewed-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Link: https://patch.msgid.link/20250916111103.84069-3-edwards@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/addr.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index be0743dac3fff..929e89841c12a 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -454,14 +454,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst,
{
int ret = 0;
- if (ndev_flags & IFF_LOOPBACK) {
+ if (ndev_flags & IFF_LOOPBACK)
memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN);
- } else {
- if (!(ndev_flags & IFF_NOARP)) {
- /* If the device doesn't do ARP internally */
- ret = fetch_ha(dst, addr, dst_in, seq);
- }
- }
+ else
+ ret = fetch_ha(dst, addr, dst_in, seq);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 387/563] IB/sa: Fix sa_local_svc_timeout_ms read race
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (385 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 386/563] RDMA/core: Resolve MAC of next-hop device without ARP support Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 388/563] Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram Greg Kroah-Hartman
` (189 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vlad Dumitrescu, Mark Zhang,
Edward Srouji, Leon Romanovsky, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlad Dumitrescu <vdumitrescu@nvidia.com>
[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ]
When computing the delta, the sa_local_svc_timeout_ms is read without
ib_nl_request_lock held. Though unlikely in practice, this can cause
a race condition if multiple local service threads are managing the
timeout.
Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink")
Signed-off-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
Reviewed-by: Mark Zhang <markzhang@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Link: https://patch.msgid.link/20250916163112.98414-1-edwards@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/sa_query.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 53571e6b3162c..66df5bed6a562 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -1013,6 +1013,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX)
timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX;
+ spin_lock_irqsave(&ib_nl_request_lock, flags);
+
delta = timeout - sa_local_svc_timeout_ms;
if (delta < 0)
abs_delta = -delta;
@@ -1020,7 +1022,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
abs_delta = delta;
if (delta != 0) {
- spin_lock_irqsave(&ib_nl_request_lock, flags);
sa_local_svc_timeout_ms = timeout;
list_for_each_entry(query, &ib_nl_request_list, list) {
if (delta < 0 && abs_delta > query->timeout)
@@ -1038,9 +1039,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
if (delay)
mod_delayed_work(ib_nl_wq, &ib_nl_timed_work,
(unsigned long)delay);
- spin_unlock_irqrestore(&ib_nl_request_lock, flags);
}
+ spin_unlock_irqrestore(&ib_nl_request_lock, flags);
+
settimeout_out:
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 388/563] Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (386 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 387/563] IB/sa: Fix sa_local_svc_timeout_ms read race Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 389/563] ASoC: SOF: ipc4-pcm: Fix incorrect comparison with number of tdm_slots Greg Kroah-Hartman
` (188 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tom Zanussi,
Masami Hiramatsu (Google), Bagas Sanjaya, Steven Rostedt (Google),
Jonathan Corbet, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bagas Sanjaya <bagasdotme@gmail.com>
[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ]
Section heading for sched_waking histogram is shown as normal paragraph
instead due to codeblock marker for the following diagram being in the
same line as the section underline. Separate them.
Fixes: daceabf1b494 ("tracing/doc: Fix ascii-art in histogram-design.rst")
Reviewed-by: Tom Zanussi <zanussi@kernel.org>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20250916054202.582074-5-bagasdotme@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/trace/histogram-design.rst | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst
index 5765eb3e9efa7..a30f4bed11b4e 100644
--- a/Documentation/trace/histogram-design.rst
+++ b/Documentation/trace/histogram-design.rst
@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking
trigger above.
sched_waking histogram
-----------------------::
+----------------------
+
+.. code-block::
+------------------+
| hist_data |<-------------------------------------------------------+
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 389/563] ASoC: SOF: ipc4-pcm: Fix incorrect comparison with number of tdm_slots
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (387 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 388/563] Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 390/563] wifi: ath12k: initialize eirp_power before use Greg Kroah-Hartman
` (187 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Fitzgerald, Mark Brown,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <rf@opensource.cirrus.com>
[ Upstream commit 62a7b3bbb6b873fdcc85a37efbd0102d66c8a73e ]
In ipc4_ssp_dai_config_pcm_params_match() when comparing params_channels()
against hw_config->tdm_slots the comparison should be a <= not a ==.
The number of TDM slots must be enough for the number of required channels.
But it can be greater. There are various reason why a I2S/TDM link has more
TDM slots than a particular audio stream needs.
The original comparison would fail on systems that had more TDM slots.
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Fixes: 8a07944a77e9 ("ASoC: SOF: ipc4-pcm: Look for best matching hw_config for SSP")
Link: https://patch.msgid.link/20250819160525.423416-1-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sof/ipc4-pcm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/soc/sof/ipc4-pcm.c b/sound/soc/sof/ipc4-pcm.c
index 374dc10d10fd5..86f7377fb92fa 100644
--- a/sound/soc/sof/ipc4-pcm.c
+++ b/sound/soc/sof/ipc4-pcm.c
@@ -639,14 +639,14 @@ static int ipc4_ssp_dai_config_pcm_params_match(struct snd_sof_dev *sdev,
if (params_rate(params) == le32_to_cpu(hw_config->fsync_rate) &&
params_width(params) == le32_to_cpu(hw_config->tdm_slot_width) &&
- params_channels(params) == le32_to_cpu(hw_config->tdm_slots)) {
+ params_channels(params) <= le32_to_cpu(hw_config->tdm_slots)) {
current_config = le32_to_cpu(hw_config->id);
partial_match = false;
/* best match found */
break;
} else if (current_config < 0 &&
params_rate(params) == le32_to_cpu(hw_config->fsync_rate) &&
- params_channels(params) == le32_to_cpu(hw_config->tdm_slots)) {
+ params_channels(params) <= le32_to_cpu(hw_config->tdm_slots)) {
current_config = le32_to_cpu(hw_config->id);
partial_match = true;
/* keep looking for better match */
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 390/563] wifi: ath12k: initialize eirp_power before use
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (388 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 389/563] ASoC: SOF: ipc4-pcm: Fix incorrect comparison with number of tdm_slots Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 391/563] wifi: ath12k: fix overflow warning on num_pwr_levels Greg Kroah-Hartman
` (186 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Dan Carpenter,
Baochen Qiang, Vasanthakumar Thiagarajan, Jeff Johnson,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
[ Upstream commit bba2f9faf41ee9607c78fcd669527b7654543cfe ]
Currently, at the end of ath12k_mac_fill_reg_tpc_info(), the
reg_tpc_info struct is populated, including the following:
reg_tpc_info->is_psd_power = is_psd_power;
reg_tpc_info->eirp_power = eirp_power;
Kernel test robot complains on uninitialized symbol:
drivers/net/wireless/ath/ath12k/mac.c:10069
ath12k_mac_fill_reg_tpc_info() error: uninitialized symbol 'eirp_power'
This is because there are some code paths that never set eirp_power, so
the assignment of reg_tpc_info->eirp_power can come from an
uninitialized variable. Functionally this is OK since the eirp_power
only has meaning when is_psd_power is true, and all code paths which set
is_psd_power to true also set eirp_power. However, to keep the robot
happy, always initialize eirp_power before use.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1
Fixes: aeda163bb0c7 ("wifi: ath12k: fill parameters for vdev set TPC power WMI command")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202505180927.tbNWr3vE-lkp@intel.com/
Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20250804-ath12k-fix-smatch-warning-on-6g-vlp-v1-1-56f1e54152ab@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/mac.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index 3a3965b79942d..93a9c2bc3c596 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -11240,8 +11240,8 @@ void ath12k_mac_fill_reg_tpc_info(struct ath12k *ar,
struct ieee80211_channel *chan, *temp_chan;
u8 pwr_lvl_idx, num_pwr_levels, pwr_reduction;
bool is_psd_power = false, is_tpe_present = false;
- s8 max_tx_power[ATH12K_NUM_PWR_LEVELS],
- psd_power, tx_power, eirp_power;
+ s8 max_tx_power[ATH12K_NUM_PWR_LEVELS], psd_power, tx_power;
+ s8 eirp_power = 0;
struct ath12k_vif *ahvif = arvif->ahvif;
u16 start_freq, center_freq;
u8 reg_6ghz_power_mode;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 391/563] wifi: ath12k: fix overflow warning on num_pwr_levels
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (389 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 390/563] wifi: ath12k: initialize eirp_power before use Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 392/563] wifi: ath12k: fix signal in radiotap for WCN7850 Greg Kroah-Hartman
` (185 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Dan Carpenter,
Baochen Qiang, Vasanthakumar Thiagarajan, Jeff Johnson,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <quic_bqiang@quicinc.com>
[ Upstream commit ea2b0af4c9e3f7187b5be4b7fc1511ea239046c0 ]
In ath12k_mac_parse_tx_pwr_env(), for the non-PSD case num_pwr_levels is
limited by ATH12K_NUM_PWR_LEVELS which is 16:
if (tpc_info->num_pwr_levels > ATH12K_NUM_PWR_LEVELS)
tpc_info->num_pwr_levels = ATH12K_NUM_PWR_LEVELS;
Then it is used to iterate entries in local_non_psd->power[] and
reg_non_psd->power[]:
for (i = 0; i < tpc_info->num_pwr_levels; i++) {
tpc_info->tpe[i] = min(local_non_psd->power[i],
reg_non_psd->power[i]) / 2;
Since the two array are of size 5, Smatch warns:
drivers/net/wireless/ath/ath12k/mac.c:9812
ath12k_mac_parse_tx_pwr_env() error: buffer overflow 'local_non_psd->power' 5 <= 15
drivers/net/wireless/ath/ath12k/mac.c:9812
ath12k_mac_parse_tx_pwr_env() error: buffer overflow 'reg_non_psd->power' 5 <= 15
This is a false positive as there is already implicit limitation:
tpc_info->num_pwr_levels = max(local_non_psd->count,
reg_non_psd->count);
meaning it won't exceed 5.
However, to make robot happy, add explicit limit there.
Also add the same to the PSD case, although no warning due to
ATH12K_NUM_PWR_LEVELS equals IEEE80211_TPE_PSD_ENTRIES_320MHZ.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1
Fixes: cccbb9d0dd6a ("wifi: ath12k: add parse of transmit power envelope element")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202505180703.Kr9OfQRP-lkp@intel.com/
Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20250804-ath12k-fix-smatch-warning-on-6g-vlp-v1-2-56f1e54152ab@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/mac.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index 93a9c2bc3c596..2644b5d4b0bc8 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -11447,8 +11447,10 @@ static void ath12k_mac_parse_tx_pwr_env(struct ath12k *ar,
tpc_info->num_pwr_levels = max(local_psd->count,
reg_psd->count);
- if (tpc_info->num_pwr_levels > ATH12K_NUM_PWR_LEVELS)
- tpc_info->num_pwr_levels = ATH12K_NUM_PWR_LEVELS;
+ tpc_info->num_pwr_levels =
+ min3(tpc_info->num_pwr_levels,
+ IEEE80211_TPE_PSD_ENTRIES_320MHZ,
+ ATH12K_NUM_PWR_LEVELS);
for (i = 0; i < tpc_info->num_pwr_levels; i++) {
tpc_info->tpe[i] = min(local_psd->power[i],
@@ -11463,8 +11465,10 @@ static void ath12k_mac_parse_tx_pwr_env(struct ath12k *ar,
tpc_info->num_pwr_levels = max(local_non_psd->count,
reg_non_psd->count);
- if (tpc_info->num_pwr_levels > ATH12K_NUM_PWR_LEVELS)
- tpc_info->num_pwr_levels = ATH12K_NUM_PWR_LEVELS;
+ tpc_info->num_pwr_levels =
+ min3(tpc_info->num_pwr_levels,
+ IEEE80211_TPE_EIRP_ENTRIES_320MHZ,
+ ATH12K_NUM_PWR_LEVELS);
for (i = 0; i < tpc_info->num_pwr_levels; i++) {
tpc_info->tpe[i] = min(local_non_psd->power[i],
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 392/563] wifi: ath12k: fix signal in radiotap for WCN7850
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (390 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 391/563] wifi: ath12k: fix overflow warning on num_pwr_levels Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 393/563] wifi: ath12k: fix HAL_PHYRX_COMMON_USER_INFO handling in monitor mode Greg Kroah-Hartman
` (184 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kang Yang, Baochen Qiang,
Vasanthakumar Thiagarajan, Jeff Johnson, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kang Yang <kang.yang@oss.qualcomm.com>
[ Upstream commit cf412ae7b7124e2b3bfe472616ec24b117b6008a ]
Currently host will add ATH12K_DEFAULT_NOISE_FLOOR to rssi_comb to
convert RSSI from dB to dBm.
For WCN7850, this conversion is unnecessary because the RSSI value is
already reported in dBm units.
No longer convert for those firmware that already support dBM conversion.
This patch won't affect QCN chips.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: Kang Yang <kang.yang@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20250722095934.67-2-kang.yang@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/dp_mon.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c
index 8189e52ed0071..ec1587d0b917c 100644
--- a/drivers/net/wireless/ath/ath12k/dp_mon.c
+++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
@@ -2154,8 +2154,12 @@ static void ath12k_dp_mon_update_radiotap(struct ath12k *ar,
spin_unlock_bh(&ar->data_lock);
rxs->flag |= RX_FLAG_MACTIME_START;
- rxs->signal = ppduinfo->rssi_comb + noise_floor;
rxs->nss = ppduinfo->nss + 1;
+ if (test_bit(WMI_TLV_SERVICE_HW_DB2DBM_CONVERSION_SUPPORT,
+ ar->ab->wmi_ab.svc_map))
+ rxs->signal = ppduinfo->rssi_comb;
+ else
+ rxs->signal = ppduinfo->rssi_comb + noise_floor;
if (ppduinfo->userstats[ppduinfo->userid].ampdu_present) {
rxs->flag |= RX_FLAG_AMPDU_DETAILS;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 393/563] wifi: ath12k: fix HAL_PHYRX_COMMON_USER_INFO handling in monitor mode
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (391 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 392/563] wifi: ath12k: fix signal in radiotap for WCN7850 Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 394/563] wifi: ath12k: fix the fetching of combined rssi Greg Kroah-Hartman
` (183 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kang Yang, Baochen Qiang,
Vasanthakumar Thiagarajan, Jeff Johnson, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kang Yang <kang.yang@oss.qualcomm.com>
[ Upstream commit 6b46e85129185ec076f9c3bd2813dfd2f968522b ]
Current monitor mode will parse TLV HAL_PHYRX_OTHER_RECEIVE_INFO with
struct hal_phyrx_common_user_info.
Obviously, they do not match. The original intention here was to parse
HAL_PHYRX_COMMON_USER_INFO. So fix it by correctly parsing
HAL_PHYRX_COMMON_USER_INFO instead.
Also add LTF parsing and report to radiotap along with GI.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Fixes: d939919a36f4 ("wifi: ath12k: Add HAL_PHYRX_OTHER_RECEIVE_INFO TLV parsing support")
Signed-off-by: Kang Yang <kang.yang@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20250722095934.67-3-kang.yang@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/dp_mon.c | 35 ++++++++++++++++++++----
drivers/net/wireless/ath/ath12k/hal_rx.h | 3 +-
2 files changed, 32 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c
index ec1587d0b917c..e93ede5e6197c 100644
--- a/drivers/net/wireless/ath/ath12k/dp_mon.c
+++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
@@ -1440,6 +1440,34 @@ static void ath12k_dp_mon_parse_rx_msdu_end_err(u32 info, u32 *errmap)
*errmap |= HAL_RX_MPDU_ERR_MPDU_LEN;
}
+static void
+ath12k_parse_cmn_usr_info(const struct hal_phyrx_common_user_info *cmn_usr_info,
+ struct hal_rx_mon_ppdu_info *ppdu_info)
+{
+ struct hal_rx_radiotap_eht *eht = &ppdu_info->eht_info.eht;
+ u32 known, data, cp_setting, ltf_size;
+
+ known = __le32_to_cpu(eht->known);
+ known |= IEEE80211_RADIOTAP_EHT_KNOWN_GI |
+ IEEE80211_RADIOTAP_EHT_KNOWN_EHT_LTF;
+ eht->known = cpu_to_le32(known);
+
+ cp_setting = le32_get_bits(cmn_usr_info->info0,
+ HAL_RX_CMN_USR_INFO0_CP_SETTING);
+ ltf_size = le32_get_bits(cmn_usr_info->info0,
+ HAL_RX_CMN_USR_INFO0_LTF_SIZE);
+
+ data = __le32_to_cpu(eht->data[0]);
+ data |= u32_encode_bits(cp_setting, IEEE80211_RADIOTAP_EHT_DATA0_GI);
+ data |= u32_encode_bits(ltf_size, IEEE80211_RADIOTAP_EHT_DATA0_LTF);
+ eht->data[0] = cpu_to_le32(data);
+
+ if (!ppdu_info->ltf_size)
+ ppdu_info->ltf_size = ltf_size;
+ if (!ppdu_info->gi)
+ ppdu_info->gi = cp_setting;
+}
+
static void
ath12k_dp_mon_parse_status_msdu_end(struct ath12k_mon_data *pmon,
const struct hal_rx_msdu_end *msdu_end)
@@ -1641,11 +1669,8 @@ ath12k_dp_mon_rx_parse_status_tlv(struct ath12k *ar,
HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RX_BW);
break;
}
- case HAL_PHYRX_OTHER_RECEIVE_INFO: {
- const struct hal_phyrx_common_user_info *cmn_usr_info = tlv_data;
-
- ppdu_info->gi = le32_get_bits(cmn_usr_info->info0,
- HAL_RX_PHY_CMN_USER_INFO0_GI);
+ case HAL_PHYRX_COMMON_USER_INFO: {
+ ath12k_parse_cmn_usr_info(tlv_data, ppdu_info);
break;
}
case HAL_RX_PPDU_START_USER_INFO:
diff --git a/drivers/net/wireless/ath/ath12k/hal_rx.h b/drivers/net/wireless/ath/ath12k/hal_rx.h
index a3ab588aae19d..801a5f6d3458b 100644
--- a/drivers/net/wireless/ath/ath12k/hal_rx.h
+++ b/drivers/net/wireless/ath/ath12k/hal_rx.h
@@ -695,7 +695,8 @@ struct hal_rx_resp_req_info {
#define HAL_RX_MPDU_ERR_MPDU_LEN BIT(6)
#define HAL_RX_MPDU_ERR_UNENCRYPTED_FRAME BIT(7)
-#define HAL_RX_PHY_CMN_USER_INFO0_GI GENMASK(17, 16)
+#define HAL_RX_CMN_USR_INFO0_CP_SETTING GENMASK(17, 16)
+#define HAL_RX_CMN_USR_INFO0_LTF_SIZE GENMASK(19, 18)
struct hal_phyrx_common_user_info {
__le32 rsvd[2];
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 394/563] wifi: ath12k: fix the fetching of combined rssi
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (392 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 393/563] wifi: ath12k: fix HAL_PHYRX_COMMON_USER_INFO handling in monitor mode Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 395/563] wifi: ath12k: Add fallback for invalid channel number in PHY metadata Greg Kroah-Hartman
` (182 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kang Yang, Baochen Qiang,
Vasanthakumar Thiagarajan, Jeff Johnson, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kang Yang <kang.yang@oss.qualcomm.com>
[ Upstream commit 7695fa71c1d50a375e54426421acbc8d457bc5a3 ]
Currently, host fetches combined rssi from rssi_comb in struct
hal_rx_phyrx_rssi_legacy_info.
rssi_comb is 8th to 15th bits of the second to last variable.
rssi_comb_ppdu is the 0th to 7th of the last variable.
When bandwidth = 20MHz, rssi_comb = rssi_comb_ppdu. But when bandwidth >
20MHz, rssi_comb < rssi_comb_ppdu because rssi_comb only includes power
of primary 20 MHz while rssi_comb_ppdu includes power of active
RUs/subchannels. So should fetch combined rssi from rssi_comb_ppdu.
Also related macro definitions are too long, rename them.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: Kang Yang <kang.yang@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20250722095934.67-4-kang.yang@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/dp_mon.c | 8 ++++----
drivers/net/wireless/ath/ath12k/hal_rx.h | 9 +++++----
2 files changed, 9 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c
index e93ede5e6197c..abd611ac37f06 100644
--- a/drivers/net/wireless/ath/ath12k/dp_mon.c
+++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
@@ -1655,18 +1655,18 @@ ath12k_dp_mon_rx_parse_status_tlv(struct ath12k *ar,
const struct hal_rx_phyrx_rssi_legacy_info *rssi = tlv_data;
info[0] = __le32_to_cpu(rssi->info0);
- info[1] = __le32_to_cpu(rssi->info1);
+ info[2] = __le32_to_cpu(rssi->info2);
/* TODO: Please note that the combined rssi will not be accurate
* in MU case. Rssi in MU needs to be retrieved from
* PHYRX_OTHER_RECEIVE_INFO TLV.
*/
ppdu_info->rssi_comb =
- u32_get_bits(info[1],
- HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB);
+ u32_get_bits(info[2],
+ HAL_RX_RSSI_LEGACY_INFO_INFO2_RSSI_COMB_PPDU);
ppdu_info->bw = u32_get_bits(info[0],
- HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RX_BW);
+ HAL_RX_RSSI_LEGACY_INFO_INFO0_RX_BW);
break;
}
case HAL_PHYRX_COMMON_USER_INFO: {
diff --git a/drivers/net/wireless/ath/ath12k/hal_rx.h b/drivers/net/wireless/ath/ath12k/hal_rx.h
index 801a5f6d3458b..d1ad7747b82c4 100644
--- a/drivers/net/wireless/ath/ath12k/hal_rx.h
+++ b/drivers/net/wireless/ath/ath12k/hal_rx.h
@@ -483,15 +483,16 @@ enum hal_rx_ul_reception_type {
HAL_RECEPTION_TYPE_FRAMELESS
};
-#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RECEPTION GENMASK(3, 0)
-#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RX_BW GENMASK(7, 5)
-#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB GENMASK(15, 8)
+#define HAL_RX_RSSI_LEGACY_INFO_INFO0_RECEPTION GENMASK(3, 0)
+#define HAL_RX_RSSI_LEGACY_INFO_INFO0_RX_BW GENMASK(7, 5)
+#define HAL_RX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB GENMASK(15, 8)
+#define HAL_RX_RSSI_LEGACY_INFO_INFO2_RSSI_COMB_PPDU GENMASK(7, 0)
struct hal_rx_phyrx_rssi_legacy_info {
__le32 info0;
__le32 rsvd0[39];
__le32 info1;
- __le32 rsvd1;
+ __le32 info2;
} __packed;
#define HAL_RX_MPDU_START_INFO0_PPDU_ID GENMASK(31, 16)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 395/563] wifi: ath12k: Add fallback for invalid channel number in PHY metadata
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (393 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 394/563] wifi: ath12k: fix the fetching of combined rssi Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 396/563] wifi: ath12k: fix wrong logging ID used for CE Greg Kroah-Hartman
` (181 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sriram R, Vinith Kumar R,
Aishwarya R, Baochen Qiang, Vasanthakumar Thiagarajan,
Jeff Johnson, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sriram R <quic_srirrama@quicinc.com>
[ Upstream commit 26f8fc0b24fd1a9dba1000bc9b5f2b199b7775a0 ]
Currently, ath12k_dp_rx_h_ppdu() determines the band and frequency
based on the channel number and center frequency from the RX descriptor's
PHY metadata. However, in rare cases, it is observed that frequency
retrieved from the metadata may be invalid or unexpected especially for
6 GHz frames.
This can result in a NULL sband, which prevents proper frequency assignment
in rx_status and potentially leading to incorrect RX packet classification.
To fix this potential issue, add a fallback mechanism that uses
ar->rx_channel to populate the band and frequency when the derived
sband is invalid or missing.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
Co-developed-by: Vinith Kumar R <quic_vinithku@quicinc.com>
Signed-off-by: Vinith Kumar R <quic_vinithku@quicinc.com>
Signed-off-by: Aishwarya R <aishwarya.r@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20250723190651.699828-1-aishwarya.r@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/dp_rx.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c
index 8ab91273592c8..adb0cfe109e67 100644
--- a/drivers/net/wireless/ath/ath12k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
@@ -2533,6 +2533,8 @@ void ath12k_dp_rx_h_ppdu(struct ath12k *ar, struct ath12k_dp_rx_info *rx_info)
channel_num = meta_data;
center_freq = meta_data >> 16;
+ rx_status->band = NUM_NL80211_BANDS;
+
if (center_freq >= ATH12K_MIN_6GHZ_FREQ &&
center_freq <= ATH12K_MAX_6GHZ_FREQ) {
rx_status->band = NL80211_BAND_6GHZ;
@@ -2541,21 +2543,33 @@ void ath12k_dp_rx_h_ppdu(struct ath12k *ar, struct ath12k_dp_rx_info *rx_info)
rx_status->band = NL80211_BAND_2GHZ;
} else if (channel_num >= 36 && channel_num <= 173) {
rx_status->band = NL80211_BAND_5GHZ;
- } else {
+ }
+
+ if (unlikely(rx_status->band == NUM_NL80211_BANDS ||
+ !ath12k_ar_to_hw(ar)->wiphy->bands[rx_status->band])) {
+ ath12k_warn(ar->ab, "sband is NULL for status band %d channel_num %d center_freq %d pdev_id %d\n",
+ rx_status->band, channel_num, center_freq, ar->pdev_idx);
+
spin_lock_bh(&ar->data_lock);
channel = ar->rx_channel;
if (channel) {
rx_status->band = channel->band;
channel_num =
ieee80211_frequency_to_channel(channel->center_freq);
+ rx_status->freq = ieee80211_channel_to_frequency(channel_num,
+ rx_status->band);
+ } else {
+ ath12k_err(ar->ab, "unable to determine channel, band for rx packet");
}
spin_unlock_bh(&ar->data_lock);
+ goto h_rate;
}
if (rx_status->band != NL80211_BAND_6GHZ)
rx_status->freq = ieee80211_channel_to_frequency(channel_num,
rx_status->band);
+h_rate:
ath12k_dp_rx_h_rate(ar, rx_info);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 396/563] wifi: ath12k: fix wrong logging ID used for CE
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (394 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 395/563] wifi: ath12k: Add fallback for invalid channel number in PHY metadata Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 397/563] wifi: ath10k: avoid unnecessary wait for service ready message Greg Kroah-Hartman
` (180 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baochen Qiang,
Vasanthakumar Thiagarajan, Jeff Johnson, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
[ Upstream commit 43746f13fec67f6f223d64cfe96c095c9b468e70 ]
ATH12K_DBG_AHB is used for CE logging which is not proper. Add
ATH12K_DBG_CE and replace ATH12K_DBG_AHB with it.
Compile tested only.
Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20250815-ath-dont-warn-on-ce-enqueue-fail-v1-2-f955ddc3ba7a@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/ce.c | 2 +-
drivers/net/wireless/ath/ath12k/debug.h | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath12k/ce.c b/drivers/net/wireless/ath/ath12k/ce.c
index f93a419abf65e..c5aadbc6367ce 100644
--- a/drivers/net/wireless/ath/ath12k/ce.c
+++ b/drivers/net/wireless/ath/ath12k/ce.c
@@ -478,7 +478,7 @@ static void ath12k_ce_recv_process_cb(struct ath12k_ce_pipe *pipe)
}
while ((skb = __skb_dequeue(&list))) {
- ath12k_dbg(ab, ATH12K_DBG_AHB, "rx ce pipe %d len %d\n",
+ ath12k_dbg(ab, ATH12K_DBG_CE, "rx ce pipe %d len %d\n",
pipe->pipe_num, skb->len);
pipe->recv_cb(ab, skb);
}
diff --git a/drivers/net/wireless/ath/ath12k/debug.h b/drivers/net/wireless/ath/ath12k/debug.h
index 48916e4e1f601..bf254e43a68d0 100644
--- a/drivers/net/wireless/ath/ath12k/debug.h
+++ b/drivers/net/wireless/ath/ath12k/debug.h
@@ -26,6 +26,7 @@ enum ath12k_debug_mask {
ATH12K_DBG_DP_TX = 0x00002000,
ATH12K_DBG_DP_RX = 0x00004000,
ATH12K_DBG_WOW = 0x00008000,
+ ATH12K_DBG_CE = 0x00010000,
ATH12K_DBG_ANY = 0xffffffff,
};
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 397/563] wifi: ath10k: avoid unnecessary wait for service ready message
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (395 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 396/563] wifi: ath12k: fix wrong logging ID used for CE Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 398/563] iommu/vt-d: debugfs: Fix legacy mode page table dump logic Greg Kroah-Hartman
` (179 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Menzel, Baochen Qiang,
Vasanthakumar Thiagarajan, Jeff Johnson, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ]
Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before
failing") works around the failure in waiting for the service ready
message by active polling. Note the polling is triggered after initial
wait timeout, which means that the wait-till-timeout can not be avoided
even the message is ready.
A possible fix is to do polling once before wait as well, however this
can not handle the race that the message arrives right after polling.
So the solution is to do periodic polling until timeout.
Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1
Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing")
Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
Closes: https://lore.kernel.org/all/97a15967-5518-4731-a8ff-d43ff7f437b0@molgen.mpg.de
Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20250811-ath10k-avoid-unnecessary-wait-v1-1-db2deb87c39b@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++--------------
1 file changed, 19 insertions(+), 20 deletions(-)
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index cb8ae751eb312..e595b0979a56d 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -1764,33 +1764,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch,
int ath10k_wmi_wait_for_service_ready(struct ath10k *ar)
{
+ unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ;
unsigned long time_left, i;
- time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
- WMI_SERVICE_READY_TIMEOUT_HZ);
- if (!time_left) {
- /* Sometimes the PCI HIF doesn't receive interrupt
- * for the service ready message even if the buffer
- * was completed. PCIe sniffer shows that it's
- * because the corresponding CE ring doesn't fires
- * it. Workaround here by polling CE rings once.
- */
- ath10k_warn(ar, "failed to receive service ready completion, polling..\n");
-
+ /* Sometimes the PCI HIF doesn't receive interrupt
+ * for the service ready message even if the buffer
+ * was completed. PCIe sniffer shows that it's
+ * because the corresponding CE ring doesn't fires
+ * it. Workaround here by polling CE rings. Since
+ * the message could arrive at any time, continue
+ * polling until timeout.
+ */
+ do {
for (i = 0; i < CE_COUNT; i++)
ath10k_hif_send_complete_check(ar, i, 1);
+ /* The 100 ms granularity is a tradeoff considering scheduler
+ * overhead and response latency
+ */
time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
- WMI_SERVICE_READY_TIMEOUT_HZ);
- if (!time_left) {
- ath10k_warn(ar, "polling timed out\n");
- return -ETIMEDOUT;
- }
-
- ath10k_warn(ar, "service ready completion received, continuing normally\n");
- }
+ msecs_to_jiffies(100));
+ if (time_left)
+ return 0;
+ } while (time_before(jiffies, timeout));
- return 0;
+ ath10k_warn(ar, "failed to receive service ready completion\n");
+ return -ETIMEDOUT;
}
int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 398/563] iommu/vt-d: debugfs: Fix legacy mode page table dump logic
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (396 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 397/563] wifi: ath10k: avoid unnecessary wait for service ready message Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 399/563] wifi: mac80211: fix Rx packet handling when pubsta information is not available Greg Kroah-Hartman
` (178 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vineeth Pillai (Google), Kevin Tian,
Lu Baolu, Joerg Roedel, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineeth Pillai (Google) <vineeth@bitbyteword.org>
[ Upstream commit fbe6070c73badca726e4ff7877320e6c62339917 ]
In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR
maybe uninitialized or zero in that case and may cause oops like:
Oops: general protection fault, probably for non-canonical address
0xf00087d3f000f000: 0000 [#1] SMP NOPTI
CPU: 2 UID: 0 PID: 786 Comm: cat Not tainted 6.16.0 #191 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014
RIP: 0010:pgtable_walk_level+0x98/0x150
RSP: 0018:ffffc90000f279c0 EFLAGS: 00010206
RAX: 0000000040000000 RBX: ffffc90000f27ab0 RCX: 000000000000001e
RDX: 0000000000000003 RSI: f00087d3f000f000 RDI: f00087d3f0010000
RBP: ffffc90000f27a00 R08: ffffc90000f27a98 R09: 0000000000000002
R10: 0000000000000000 R11: 0000000000000000 R12: f00087d3f000f000
R13: 0000000000000000 R14: 0000000040000000 R15: ffffc90000f27a98
FS: 0000764566dcb740(0000) GS:ffff8881f812c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000764566d44000 CR3: 0000000109d81003 CR4: 0000000000772ef0
PKRU: 55555554
Call Trace:
<TASK>
pgtable_walk_level+0x88/0x150
domain_translation_struct_show.isra.0+0x2d9/0x300
dev_domain_translation_struct_show+0x20/0x40
seq_read_iter+0x12d/0x490
...
Avoid walking the page table if TT is not 00b or 01b.
Fixes: 2b437e804566 ("iommu/vt-d: debugfs: Support dumping a specified page table")
Signed-off-by: Vineeth Pillai (Google) <vineeth@bitbyteword.org>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/20250814163153.634680-1-vineeth@bitbyteword.org
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/intel/debugfs.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c
index affbf4a1558de..5aa7f46a420b5 100644
--- a/drivers/iommu/intel/debugfs.c
+++ b/drivers/iommu/intel/debugfs.c
@@ -435,8 +435,21 @@ static int domain_translation_struct_show(struct seq_file *m,
}
pgd &= VTD_PAGE_MASK;
} else { /* legacy mode */
- pgd = context->lo & VTD_PAGE_MASK;
- agaw = context->hi & 7;
+ u8 tt = (u8)(context->lo & GENMASK_ULL(3, 2)) >> 2;
+
+ /*
+ * According to Translation Type(TT),
+ * get the page table pointer(SSPTPTR).
+ */
+ switch (tt) {
+ case CONTEXT_TT_MULTI_LEVEL:
+ case CONTEXT_TT_DEV_IOTLB:
+ pgd = context->lo & VTD_PAGE_MASK;
+ agaw = context->hi & 7;
+ break;
+ default:
+ goto iommu_unlock;
+ }
}
seq_printf(m, "Device %04x:%02x:%02x.%x ",
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 399/563] wifi: mac80211: fix Rx packet handling when pubsta information is not available
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (397 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 398/563] iommu/vt-d: debugfs: Fix legacy mode page table dump logic Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 400/563] ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback Greg Kroah-Hartman
` (177 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vasanthakumar Thiagarajan,
Aditya Kumar Singh, Johannes Berg, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
[ Upstream commit 32d340ae675800672e1219444a17940a8efe5cca ]
In ieee80211_rx_handle_packet(), if the caller does not provide pubsta
information, an attempt is made to find the station using the address 2
(source address) field in the header. Since pubsta is missing, link
information such as link_valid and link_id is also unavailable. Now if such
a situation comes, and if a matching ML station entry is found based on
the source address, currently the packet is dropped due to missing link ID
in the status field which is not correct.
Hence, to fix this issue, if link_valid is not set and the station is an
ML station, make an attempt to find a link station entry using the source
address. If a valid link station is found, derive the link ID and proceed
with packet processing. Otherwise, drop the packet as per the existing
flow.
Fixes: ea9d807b5642 ("wifi: mac80211: add link information in ieee80211_rx_status")
Suggested-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Signed-off-by: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
Link: https://patch.msgid.link/20250917-fix_data_packet_rx_with_mlo_and_no_pubsta-v1-1-8cf971a958ac@oss.qualcomm.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/rx.c | 28 ++++++++++++++++++++++------
1 file changed, 22 insertions(+), 6 deletions(-)
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 4d4ff4d4917a2..59baca24aa6b9 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -5230,12 +5230,20 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
}
rx.sdata = prev_sta->sdata;
+ if (!status->link_valid && prev_sta->sta.mlo) {
+ struct link_sta_info *link_sta;
+
+ link_sta = link_sta_info_get_bss(rx.sdata,
+ hdr->addr2);
+ if (!link_sta)
+ continue;
+
+ link_id = link_sta->link_id;
+ }
+
if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
goto out;
- if (!status->link_valid && prev_sta->sta.mlo)
- continue;
-
ieee80211_prepare_and_rx_handle(&rx, skb, false);
prev_sta = sta;
@@ -5243,10 +5251,18 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
if (prev_sta) {
rx.sdata = prev_sta->sdata;
- if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
- goto out;
+ if (!status->link_valid && prev_sta->sta.mlo) {
+ struct link_sta_info *link_sta;
- if (!status->link_valid && prev_sta->sta.mlo)
+ link_sta = link_sta_info_get_bss(rx.sdata,
+ hdr->addr2);
+ if (!link_sta)
+ goto out;
+
+ link_id = link_sta->link_id;
+ }
+
+ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
goto out;
if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 400/563] ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (398 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 399/563] wifi: mac80211: fix Rx packet handling when pubsta information is not available Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 401/563] sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC Greg Kroah-Hartman
` (176 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Fitzgerald, Mark Brown,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <rf@opensource.cirrus.com>
[ Upstream commit 87cab86925b7fa4c1c977bc191ac549a3b23f0ea ]
In create_sdw_dailink() check that sof_end->codec_info->add_sidecar
is not NULL before calling it.
The original code assumed that if include_sidecar is true, the codec
on that link has an add_sidecar callback. But there could be other
codecs on the same link that do not have an add_sidecar callback.
Fixes: da5244180281 ("ASoC: Intel: sof_sdw: Add callbacks to register sidecar devices")
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://patch.msgid.link/20250919140235.1071941-1-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/boards/sof_sdw.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
index 28f03a5f29f74..c013e31d098e7 100644
--- a/sound/soc/intel/boards/sof_sdw.c
+++ b/sound/soc/intel/boards/sof_sdw.c
@@ -841,7 +841,7 @@ static int create_sdw_dailink(struct snd_soc_card *card,
(*codec_conf)++;
}
- if (sof_end->include_sidecar) {
+ if (sof_end->include_sidecar && sof_end->codec_info->add_sidecar) {
ret = sof_end->codec_info->add_sidecar(card, dai_links, codec_conf);
if (ret)
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 401/563] sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (399 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 400/563] ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 402/563] sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III Greg Kroah-Hartman
` (175 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Karcher, Andreas Larsson,
Sasha Levin, John Paul Adrian Glaubitz, René Rebe,
Jonathan 'theJPster' Pallant
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ]
The referenced commit introduced exception handlers on user-space memory
references in copy_from_user and copy_to_user. These handlers return from
the respective function and calculate the remaining bytes left to copy
using the current register contents. This commit fixes a couple of bad
calculations. This will fix the return value of copy_from_user and
copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.")
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on QEMU 10.0.3
Tested-by: René Rebe <rene@exactcode.com> # on Ultra 5 UltraSparc IIi
Tested-by: Jonathan 'theJPster' Pallant <kernel@thejpster.org.uk> # on Sun Netra T1
Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
Reviewed-by: Andreas Larsson <andreas@gaisler.com>
Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-1-1ca72dda195b@mkarcher.dialup.fu-berlin.de
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sparc/lib/U1memcpy.S | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S
index 635398ec7540e..154fbd35400ca 100644
--- a/arch/sparc/lib/U1memcpy.S
+++ b/arch/sparc/lib/U1memcpy.S
@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp)
retl
add %o0, %o2, %o0
ENDPROC(U1_gs_40_fp)
-ENTRY(U1_g3_0_fp)
- VISExitHalf
- retl
- add %g3, %o2, %o0
-ENDPROC(U1_g3_0_fp)
ENTRY(U1_g3_8_fp)
VISExitHalf
add %g3, 8, %g3
retl
add %g3, %o2, %o0
ENDPROC(U1_g3_8_fp)
+ENTRY(U1_g3_16_fp)
+ VISExitHalf
+ add %g3, 16, %g3
+ retl
+ add %g3, %o2, %o0
+ENDPROC(U1_g3_16_fp)
ENTRY(U1_o2_0_fp)
VISExitHalf
retl
@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
62: FINISH_VISCHUNK(o0, f44, f46)
63: UNEVEN_VISCHUNK_LAST(o0, f46, f0)
-93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp)
+93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp)
add %o1, 8, %o1
subcc %g3, 8, %g3
faligndata %f0, %f2, %f8
- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
+ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
bl,pn %xcc, 95f
add %o0, 8, %o0
- EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp)
+ EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp)
add %o1, 8, %o1
subcc %g3, 8, %g3
faligndata %f2, %f0, %f8
- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
+ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
bge,pt %xcc, 93b
add %o0, 8, %o0
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 402/563] sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (400 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 401/563] sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 403/563] sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara Greg Kroah-Hartman
` (174 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anthony Yznaga, Michael Karcher,
Andreas Larsson, Sasha Levin, John Paul Adrian Glaubitz,
René Rebe
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ]
Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios
enabled resulted from copy_from_user() returning impossibly large values
greater than the size to be copied. This lead to __copy_from_iter()
returning impossible values instead of the actual number of bytes it was
able to copy.
The BUG_ON has been reported in
https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de
The referenced commit introduced exception handlers on user-space memory
references in copy_from_user and copy_to_user. These handlers return from
the respective function and calculate the remaining bytes left to copy
using the current register contents. The exception handlers expect that
%o2 has already been masked during the bulk copy loop, but the masking was
performed after that loop. This will fix the return value of copy_from_user
and copy_to_user in the faulting case. The behaviour of memcpy stays
unchanged.
Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.")
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Sun Netra 240
Reviewed-by: Anthony Yznaga <anthony.yznaga@oracle.com>
Tested-by: René Rebe <rene@exactcode.com> # on UltraSparc III+ and UltraSparc IIIi
Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
Reviewed-by: Andreas Larsson <andreas@gaisler.com>
Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-2-1ca72dda195b@mkarcher.dialup.fu-berlin.de
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sparc/lib/U3memcpy.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S
index 9248d59c734ce..bace3a18f836f 100644
--- a/arch/sparc/lib/U3memcpy.S
+++ b/arch/sparc/lib/U3memcpy.S
@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
faligndata %f10, %f12, %f26
EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2)
+ and %o2, 0x3f, %o2
subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE
add %o1, 0x40, %o1
bgu,pt %XCC, 1f
@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
* Also notice how this code is careful not to perform a
* load past the end of the src buffer.
*/
- and %o2, 0x3f, %o2
andcc %o2, 0x38, %g2
be,pn %XCC, 2f
subcc %g2, 0x8, %g2
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 403/563] sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (401 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 402/563] sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 404/563] sparc: fix accurate exception reporting in copy_to_user for Niagara 4 Greg Kroah-Hartman
` (173 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Karcher, Andreas Larsson,
Sasha Levin, John Paul Adrian Glaubitz, Magnus Lindholm,
Ethan Hawke, Ken Link
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ]
The referenced commit introduced exception handlers on user-space memory
references in copy_from_user and copy_to_user. These handlers return from
the respective function and calculate the remaining bytes left to copy
using the current register contents. This commit fixes a couple of bad
calculations and a broken epilogue in the exception handlers. This will
prevent crashes and ensure correct return values of copy_from_user and
copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.")
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on SPARC T4 with modified kernel to use Niagara 1 code
Tested-by: Magnus Lindholm <linmag7@gmail.com> # on Sun Fire T2000
Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
Tested-by: Ethan Hawke <ehawk@ember.systems> # on Sun Fire T2000
Tested-by: Ken Link <iissmart@numberzero.org> # on Sun Fire T1000
Reviewed-by: Andreas Larsson <andreas@gaisler.com>
Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-3-1ca72dda195b@mkarcher.dialup.fu-berlin.de
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++-----------
1 file changed, 18 insertions(+), 11 deletions(-)
diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S
index ee51c12306894..bbd3ea0a64822 100644
--- a/arch/sparc/lib/NGmemcpy.S
+++ b/arch/sparc/lib/NGmemcpy.S
@@ -79,8 +79,8 @@
#ifndef EX_RETVAL
#define EX_RETVAL(x) x
__restore_asi:
- ret
wr %g0, ASI_AIUS, %asi
+ ret
restore
ENTRY(NG_ret_i2_plus_i4_plus_1)
ba,pt %xcc, __restore_asi
@@ -125,15 +125,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56)
ba,pt %xcc, __restore_asi
add %i2, %g1, %i0
ENDPROC(NG_ret_i2_plus_g1_minus_56)
-ENTRY(NG_ret_i2_plus_i4)
+ENTRY(NG_ret_i2_plus_i4_plus_16)
+ add %i4, 16, %i4
ba,pt %xcc, __restore_asi
add %i2, %i4, %i0
-ENDPROC(NG_ret_i2_plus_i4)
-ENTRY(NG_ret_i2_plus_i4_minus_8)
- sub %i4, 8, %i4
+ENDPROC(NG_ret_i2_plus_i4_plus_16)
+ENTRY(NG_ret_i2_plus_i4_plus_8)
+ add %i4, 8, %i4
ba,pt %xcc, __restore_asi
add %i2, %i4, %i0
-ENDPROC(NG_ret_i2_plus_i4_minus_8)
+ENDPROC(NG_ret_i2_plus_i4_plus_8)
ENTRY(NG_ret_i2_plus_8)
ba,pt %xcc, __restore_asi
add %i2, 8, %i0
@@ -160,6 +161,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4)
ba,pt %xcc, __restore_asi
add %i2, %i4, %i0
ENDPROC(NG_ret_i2_and_7_plus_i4)
+ENTRY(NG_ret_i2_and_7_plus_i4_plus_8)
+ and %i2, 7, %i2
+ add %i4, 8, %i4
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+ENDPROC(NG_ret_i2_and_7_plus_i4)
#endif
.align 64
@@ -405,13 +412,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */
andn %i2, 0xf, %i4
and %i2, 0xf, %i2
1: subcc %i4, 0x10, %i4
- EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4)
+ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16)
add %i1, 0x08, %i1
- EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4)
+ EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16)
sub %i1, 0x08, %i1
- EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4)
+ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16)
add %i1, 0x8, %i1
- EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8)
+ EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8)
bgu,pt %XCC, 1b
add %i1, 0x8, %i1
73: andcc %i2, 0x8, %g0
@@ -468,7 +475,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */
subcc %i4, 0x8, %i4
srlx %g3, %i3, %i5
or %i5, %g2, %i5
- EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4)
+ EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8)
add %o0, 0x8, %o0
bgu,pt %icc, 1b
sllx %g3, %g1, %g2
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 404/563] sparc: fix accurate exception reporting in copy_to_user for Niagara 4
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (402 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 403/563] sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 405/563] sparc: fix accurate exception reporting in copy_{from,to}_user for M7 Greg Kroah-Hartman
` (172 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Karcher, Andreas Larsson,
Sasha Levin, John Paul Adrian Glaubitz
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ]
The referenced commit introduced exception handlers on user-space memory
references in copy_from_user and copy_to_user. These handlers return from
the respective function and calculate the remaining bytes left to copy
using the current register contents. This commit fixes a bad calculation.
This will fix the return value of copy_to_user in a specific faulting case.
The behaviour of memcpy stays unchanged.
Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.")
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Oracle SPARC T4-1
Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
Reviewed-by: Andreas Larsson <andreas@gaisler.com>
Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-4-1ca72dda195b@mkarcher.dialup.fu-berlin.de
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sparc/lib/NG4memcpy.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
index 7ad58ebe0d009..df0ec1bd19489 100644
--- a/arch/sparc/lib/NG4memcpy.S
+++ b/arch/sparc/lib/NG4memcpy.S
@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
subcc %o5, 0x20, %o5
EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
+ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
bne,pt %icc, 1b
add %o0, 0x20, %o0
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 405/563] sparc: fix accurate exception reporting in copy_{from,to}_user for M7
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (403 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 404/563] sparc: fix accurate exception reporting in copy_to_user for Niagara 4 Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 406/563] vfio/pds: replace bitmap_free with vfree Greg Kroah-Hartman
` (171 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Karcher, Andreas Larsson,
Sasha Levin, John Paul Adrian Glaubitz, Tony Rodriguez
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ]
The referenced commit introduced exception handlers on user-space memory
references in copy_from_user and copy_to_user. These handlers return from
the respective function and calculate the remaining bytes left to copy
using the current register contents. This commit fixes a couple of bad
calculations. This will fix the return value of copy_from_user and
copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy")
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Oracle SPARC S7
Tested-by: Tony Rodriguez <unixpro1970@gmail.com> # S7, see https://lore.kernel.org/r/98564e2e68df2dda0e00c67a75c7f7dfedb33c7e.camel@physik.fu-berlin.de
Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
Reviewed-by: Andreas Larsson <andreas@gaisler.com>
Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-5-1ca72dda195b@mkarcher.dialup.fu-berlin.de
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sparc/lib/M7memcpy.S | 20 ++++++++++----------
arch/sparc/lib/Memcpy_utils.S | 9 +++++++++
2 files changed, 19 insertions(+), 10 deletions(-)
diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S
index cbd42ea7c3f7c..99357bfa8e82a 100644
--- a/arch/sparc/lib/M7memcpy.S
+++ b/arch/sparc/lib/M7memcpy.S
@@ -696,16 +696,16 @@ FUNC_NAME:
EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40)
faligndata %f24, %f26, %f10
EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40)
- EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40)
+ EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32)
faligndata %f26, %f28, %f12
- EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40)
+ EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32)
add %o4, 64, %o4
- EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40)
+ EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24)
faligndata %f28, %f30, %f14
- EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40)
- EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40)
+ EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24)
+ EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16)
add %o0, 64, %o0
- EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40)
+ EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8)
fsrc2 %f30, %f14
bgu,pt %xcc, .Lunalign_sloop
prefetch [%o4 + (8 * BLOCK_SIZE)], 20
@@ -728,7 +728,7 @@ FUNC_NAME:
add %o4, 8, %o4
faligndata %f0, %f2, %f16
subcc %o5, 8, %o5
- EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5)
+ EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8)
fsrc2 %f2, %f0
bgu,pt %xcc, .Lunalign_by8
add %o0, 8, %o0
@@ -772,7 +772,7 @@ FUNC_NAME:
subcc %o5, 0x20, %o5
EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
- EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
+ EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
bne,pt %xcc, 1b
add %o0, 0x20, %o0
@@ -804,12 +804,12 @@ FUNC_NAME:
brz,pt %o3, 2f
sub %o2, %o3, %o2
-1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1)
+1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3)
add %o1, 1, %o1
subcc %o3, 1, %o3
add %o0, 1, %o0
bne,pt %xcc, 1b
- EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1)
+ EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1)
2:
and %o1, 0x7, %o3
brz,pn %o3, .Lmedium_noprefetch_cp
diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S
index 64fbac28b3db1..207343367bb2d 100644
--- a/arch/sparc/lib/Memcpy_utils.S
+++ b/arch/sparc/lib/Memcpy_utils.S
@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8)
ba,pt %xcc, __restore_asi
add %o2, 8, %o0
ENDPROC(memcpy_retl_o2_plus_63_8)
+ENTRY(memcpy_retl_o2_plus_o3)
+ ba,pt %xcc, __restore_asi
+ add %o2, %o3, %o0
+ENDPROC(memcpy_retl_o2_plus_o3)
+ENTRY(memcpy_retl_o2_plus_o3_plus_1)
+ add %o3, 1, %o3
+ ba,pt %xcc, __restore_asi
+ add %o2, %o3, %o0
+ENDPROC(memcpy_retl_o2_plus_o3_plus_1)
ENTRY(memcpy_retl_o2_plus_o5)
ba,pt %xcc, __restore_asi
add %o2, %o5, %o0
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 406/563] vfio/pds: replace bitmap_free with vfree
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (404 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 405/563] sparc: fix accurate exception reporting in copy_{from,to}_user for M7 Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 407/563] crypto: comp - Use same definition of context alloc and free ops Greg Kroah-Hartman
` (170 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zilin Guan, Brett Creeley,
Alex Williamson, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <zilin@seu.edu.cn>
[ Upstream commit acb59a4bb8ed34e738a4c3463127bf3f6b5e11a9 ]
host_seq_bmp is allocated with vzalloc but is currently freed with
bitmap_free, which uses kfree internally. This mismach prevents the
resource from being released properly and may result in memory leaks
or other issues.
Fix this by freeing host_seq_bmp with vfree to match the vzalloc
allocation.
Fixes: f232836a9152 ("vfio/pds: Add support for dirty page tracking")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Reviewed-by: Brett Creeley <brett.creeley@amd.com>
Link: https://lore.kernel.org/r/20250913153154.1028835-1-zilin@seu.edu.cn
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vfio/pci/pds/dirty.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vfio/pci/pds/dirty.c b/drivers/vfio/pci/pds/dirty.c
index c51f5e4c3dd6d..481992142f790 100644
--- a/drivers/vfio/pci/pds/dirty.c
+++ b/drivers/vfio/pci/pds/dirty.c
@@ -82,7 +82,7 @@ static int pds_vfio_dirty_alloc_bitmaps(struct pds_vfio_region *region,
host_ack_bmp = vzalloc(bytes);
if (!host_ack_bmp) {
- bitmap_free(host_seq_bmp);
+ vfree(host_seq_bmp);
return -ENOMEM;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 407/563] crypto: comp - Use same definition of context alloc and free ops
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (405 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 406/563] vfio/pds: replace bitmap_free with vfree Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 408/563] crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs Greg Kroah-Hartman
` (169 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dan Moulding, Herbert Xu,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Moulding <dan@danm.net>
[ Upstream commit f75f66683ded09f7135aef2e763c245a07c8271a ]
In commit 42d9f6c77479 ("crypto: acomp - Move scomp stream allocation
code into acomp"), the crypto_acomp_streams struct was made to rely on
having the alloc_ctx and free_ctx operations defined in the same order
as the scomp_alg struct. But in that same commit, the alloc_ctx and
free_ctx members of scomp_alg may be randomized by structure layout
randomization, since they are contained in a pure ops structure
(containing only function pointers). If the pointers within scomp_alg
are randomized, but those in crypto_acomp_streams are not, then
the order may no longer match. This fixes the problem by removing the
union from scomp_alg so that both crypto_acomp_streams and scomp_alg
will share the same definition of alloc_ctx and free_ctx, ensuring
they will always have the same layout.
Signed-off-by: Dan Moulding <dan@danm.net>
Suggested-by: Herbert Xu <herbert@gondor.apana.org.au>
Fixes: 42d9f6c77479 ("crypto: acomp - Move scomp stream allocation code into acomp")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/842.c | 6 ++++--
crypto/lz4.c | 6 ++++--
crypto/lz4hc.c | 6 ++++--
crypto/lzo-rle.c | 6 ++++--
crypto/lzo.c | 6 ++++--
drivers/crypto/nx/nx-common-powernv.c | 6 ++++--
drivers/crypto/nx/nx-common-pseries.c | 6 ++++--
include/crypto/internal/scompress.h | 11 +----------
8 files changed, 29 insertions(+), 24 deletions(-)
diff --git a/crypto/842.c b/crypto/842.c
index 8c257c40e2b90..4007e87bed806 100644
--- a/crypto/842.c
+++ b/crypto/842.c
@@ -54,8 +54,10 @@ static int crypto842_sdecompress(struct crypto_scomp *tfm,
}
static struct scomp_alg scomp = {
- .alloc_ctx = crypto842_alloc_ctx,
- .free_ctx = crypto842_free_ctx,
+ .streams = {
+ .alloc_ctx = crypto842_alloc_ctx,
+ .free_ctx = crypto842_free_ctx,
+ },
.compress = crypto842_scompress,
.decompress = crypto842_sdecompress,
.base = {
diff --git a/crypto/lz4.c b/crypto/lz4.c
index 7a984ae5ae52e..57b713516aefa 100644
--- a/crypto/lz4.c
+++ b/crypto/lz4.c
@@ -68,8 +68,10 @@ static int lz4_sdecompress(struct crypto_scomp *tfm, const u8 *src,
}
static struct scomp_alg scomp = {
- .alloc_ctx = lz4_alloc_ctx,
- .free_ctx = lz4_free_ctx,
+ .streams = {
+ .alloc_ctx = lz4_alloc_ctx,
+ .free_ctx = lz4_free_ctx,
+ },
.compress = lz4_scompress,
.decompress = lz4_sdecompress,
.base = {
diff --git a/crypto/lz4hc.c b/crypto/lz4hc.c
index 9c61d05b62142..bb84f8a68cb58 100644
--- a/crypto/lz4hc.c
+++ b/crypto/lz4hc.c
@@ -66,8 +66,10 @@ static int lz4hc_sdecompress(struct crypto_scomp *tfm, const u8 *src,
}
static struct scomp_alg scomp = {
- .alloc_ctx = lz4hc_alloc_ctx,
- .free_ctx = lz4hc_free_ctx,
+ .streams = {
+ .alloc_ctx = lz4hc_alloc_ctx,
+ .free_ctx = lz4hc_free_ctx,
+ },
.compress = lz4hc_scompress,
.decompress = lz4hc_sdecompress,
.base = {
diff --git a/crypto/lzo-rle.c b/crypto/lzo-rle.c
index ba013f2d5090d..794e7ec49536b 100644
--- a/crypto/lzo-rle.c
+++ b/crypto/lzo-rle.c
@@ -70,8 +70,10 @@ static int lzorle_sdecompress(struct crypto_scomp *tfm, const u8 *src,
}
static struct scomp_alg scomp = {
- .alloc_ctx = lzorle_alloc_ctx,
- .free_ctx = lzorle_free_ctx,
+ .streams = {
+ .alloc_ctx = lzorle_alloc_ctx,
+ .free_ctx = lzorle_free_ctx,
+ },
.compress = lzorle_scompress,
.decompress = lzorle_sdecompress,
.base = {
diff --git a/crypto/lzo.c b/crypto/lzo.c
index 7867e2c67c4ed..d43242b24b4e8 100644
--- a/crypto/lzo.c
+++ b/crypto/lzo.c
@@ -70,8 +70,10 @@ static int lzo_sdecompress(struct crypto_scomp *tfm, const u8 *src,
}
static struct scomp_alg scomp = {
- .alloc_ctx = lzo_alloc_ctx,
- .free_ctx = lzo_free_ctx,
+ .streams = {
+ .alloc_ctx = lzo_alloc_ctx,
+ .free_ctx = lzo_free_ctx,
+ },
.compress = lzo_scompress,
.decompress = lzo_sdecompress,
.base = {
diff --git a/drivers/crypto/nx/nx-common-powernv.c b/drivers/crypto/nx/nx-common-powernv.c
index fd0a98b2fb1b2..0493041ea0885 100644
--- a/drivers/crypto/nx/nx-common-powernv.c
+++ b/drivers/crypto/nx/nx-common-powernv.c
@@ -1043,8 +1043,10 @@ static struct scomp_alg nx842_powernv_alg = {
.base.cra_priority = 300,
.base.cra_module = THIS_MODULE,
- .alloc_ctx = nx842_powernv_crypto_alloc_ctx,
- .free_ctx = nx842_crypto_free_ctx,
+ .streams = {
+ .alloc_ctx = nx842_powernv_crypto_alloc_ctx,
+ .free_ctx = nx842_crypto_free_ctx,
+ },
.compress = nx842_crypto_compress,
.decompress = nx842_crypto_decompress,
};
diff --git a/drivers/crypto/nx/nx-common-pseries.c b/drivers/crypto/nx/nx-common-pseries.c
index f528e072494a2..fc0222ebe8072 100644
--- a/drivers/crypto/nx/nx-common-pseries.c
+++ b/drivers/crypto/nx/nx-common-pseries.c
@@ -1020,8 +1020,10 @@ static struct scomp_alg nx842_pseries_alg = {
.base.cra_priority = 300,
.base.cra_module = THIS_MODULE,
- .alloc_ctx = nx842_pseries_crypto_alloc_ctx,
- .free_ctx = nx842_crypto_free_ctx,
+ .streams = {
+ .alloc_ctx = nx842_pseries_crypto_alloc_ctx,
+ .free_ctx = nx842_crypto_free_ctx,
+ },
.compress = nx842_crypto_compress,
.decompress = nx842_crypto_decompress,
};
diff --git a/include/crypto/internal/scompress.h b/include/crypto/internal/scompress.h
index 533d6c16a4914..6a2c5f2e90f95 100644
--- a/include/crypto/internal/scompress.h
+++ b/include/crypto/internal/scompress.h
@@ -18,11 +18,8 @@ struct crypto_scomp {
/**
* struct scomp_alg - synchronous compression algorithm
*
- * @alloc_ctx: Function allocates algorithm specific context
- * @free_ctx: Function frees context allocated with alloc_ctx
* @compress: Function performs a compress operation
* @decompress: Function performs a de-compress operation
- * @base: Common crypto API algorithm data structure
* @streams: Per-cpu memory for algorithm
* @calg: Cmonn algorithm data structure shared with acomp
*/
@@ -34,13 +31,7 @@ struct scomp_alg {
unsigned int slen, u8 *dst, unsigned int *dlen,
void *ctx);
- union {
- struct {
- void *(*alloc_ctx)(void);
- void (*free_ctx)(void *ctx);
- };
- struct crypto_acomp_streams streams;
- };
+ struct crypto_acomp_streams streams;
union {
struct COMP_ALG_COMMON;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 408/563] crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (406 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 407/563] crypto: comp - Use same definition of context alloc and free ops Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 409/563] wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu() Greg Kroah-Hartman
` (168 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chenghai Huang, Herbert Xu,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenghai Huang <huangchenghai2@huawei.com>
[ Upstream commit f0cafb02de883b3b413d34eb079c9680782a9cc1 ]
When the initialization of qm->debug.acc_diff_reg fails,
the probe process does not exit. However, after qm->debug.qm_diff_regs is
freed, it is not set to NULL. This can lead to a double free when the
remove process attempts to free it again. Therefore, qm->debug.qm_diff_regs
should be set to NULL after it is freed.
Fixes: 8be091338971 ("crypto: hisilicon/debugfs - Fix debugfs uninit process issue")
Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/hisilicon/debugfs.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/crypto/hisilicon/debugfs.c b/drivers/crypto/hisilicon/debugfs.c
index 45e130b901eb5..17eb236e9ee4d 100644
--- a/drivers/crypto/hisilicon/debugfs.c
+++ b/drivers/crypto/hisilicon/debugfs.c
@@ -888,6 +888,7 @@ static int qm_diff_regs_init(struct hisi_qm *qm,
dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
ret = PTR_ERR(qm->debug.acc_diff_regs);
qm->debug.acc_diff_regs = NULL;
+ qm->debug.qm_diff_regs = NULL;
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 409/563] wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (407 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 408/563] crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 410/563] rpmsg: qcom_smd: Fix fallback to qcom,ipc parse Greg Kroah-Hartman
` (167 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hari Chandrakanthan, Aishwarya R,
Baochen Qiang, Vasanthakumar Thiagarajan, Jeff Johnson,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hari Chandrakanthan <quic_haric@quicinc.com>
[ Upstream commit 7ca61ed8b3f3fc9a7decd68039cb1d7d1238c566 ]
In ath12k_dp_mon_rx_deliver_msdu(), peer lookup fails because
rxcb->peer_id is not updated with a valid value. This is expected
in monitor mode, where RX frames bypass the regular RX
descriptor path that typically sets rxcb->peer_id.
As a result, the peer is NULL, and link_id and link_valid fields
in the RX status are not populated. This leads to a WARN_ON in
mac80211 when it receives data frame from an associated station
with invalid link_id.
Fix this potential issue by using ppduinfo->peer_id, which holds
the correct peer id for the received frame. This ensures that the
peer is correctly found and the associated link metadata is updated
accordingly.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Fixes: bd00cc7e8a4c ("wifi: ath12k: replace the usage of rx desc with rx_info")
Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
Signed-off-by: Aishwarya R <aishwarya.r@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20250724040552.1170642-1-aishwarya.r@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/dp_mon.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c
index abd611ac37f06..009c495021489 100644
--- a/drivers/net/wireless/ath/ath12k/dp_mon.c
+++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
@@ -2273,6 +2273,7 @@ static void ath12k_dp_mon_update_radiotap(struct ath12k *ar,
static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct *napi,
struct sk_buff *msdu,
+ const struct hal_rx_mon_ppdu_info *ppduinfo,
struct ieee80211_rx_status *status,
u8 decap)
{
@@ -2286,7 +2287,6 @@ static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct
struct ieee80211_sta *pubsta = NULL;
struct ath12k_peer *peer;
struct ath12k_skb_rxcb *rxcb = ATH12K_SKB_RXCB(msdu);
- struct ath12k_dp_rx_info rx_info;
bool is_mcbc = rxcb->is_mcbc;
bool is_eapol_tkip = rxcb->is_eapol;
@@ -2300,8 +2300,7 @@ static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct
}
spin_lock_bh(&ar->ab->base_lock);
- rx_info.addr2_present = false;
- peer = ath12k_dp_rx_h_find_peer(ar->ab, msdu, &rx_info);
+ peer = ath12k_peer_find_by_id(ar->ab, ppduinfo->peer_id);
if (peer && peer->sta) {
pubsta = peer->sta;
if (pubsta->valid_links) {
@@ -2394,7 +2393,7 @@ static int ath12k_dp_mon_rx_deliver(struct ath12k *ar,
decap = mon_mpdu->decap_format;
ath12k_dp_mon_update_radiotap(ar, ppduinfo, mon_skb, rxs);
- ath12k_dp_mon_rx_deliver_msdu(ar, napi, mon_skb, rxs, decap);
+ ath12k_dp_mon_rx_deliver_msdu(ar, napi, mon_skb, ppduinfo, rxs, decap);
mon_skb = skb_next;
} while (mon_skb);
rxs->flag = 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 410/563] rpmsg: qcom_smd: Fix fallback to qcom,ipc parse
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (408 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 409/563] wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu() Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 411/563] remoteproc: qcom_q6v5_mss: support loading MBN file on msm8974 Greg Kroah-Hartman
` (166 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Stephan Gerhold,
Barnabás Czémán, Bjorn Andersson, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Barnabás Czémán <barnabas.czeman@mainlining.org>
[ Upstream commit 09390ed9af37ed612dd0967ff2b0d639872b8776 ]
mbox_request_channel() returning value was changed in case of error.
It uses returning value of of_parse_phandle_with_args().
It is returning with -ENOENT instead of -ENODEV when no mboxes property
exists.
Fixes: 24fdd5074b20 ("mailbox: use error ret code of of_parse_phandle_with_args()")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Tested-by: Stephan Gerhold <stephan.gerhold@linaro.org> # msm8939
Signed-off-by: Barnabás Czémán <barnabas.czeman@mainlining.org>
Link: https://lore.kernel.org/r/20250725-fix-qcom-smd-v2-1-e4e43613f874@mainlining.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rpmsg/qcom_smd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
index 87c944d4b4f31..1cbe457b4e96f 100644
--- a/drivers/rpmsg/qcom_smd.c
+++ b/drivers/rpmsg/qcom_smd.c
@@ -1368,7 +1368,7 @@ static int qcom_smd_parse_edge(struct device *dev,
edge->mbox_client.knows_txdone = true;
edge->mbox_chan = mbox_request_channel(&edge->mbox_client, 0);
if (IS_ERR(edge->mbox_chan)) {
- if (PTR_ERR(edge->mbox_chan) != -ENODEV) {
+ if (PTR_ERR(edge->mbox_chan) != -ENOENT) {
ret = dev_err_probe(dev, PTR_ERR(edge->mbox_chan),
"failed to acquire IPC mailbox\n");
goto put_node;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 411/563] remoteproc: qcom_q6v5_mss: support loading MBN file on msm8974
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (409 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 410/563] rpmsg: qcom_smd: Fix fallback to qcom,ipc parse Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 412/563] RDMA/rxe: Fix race in do_task() when draining Greg Kroah-Hartman
` (165 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Dmitry Baryshkov,
Bjorn Andersson, Sasha Levin, Luca Weiss
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 581e3dea0ece4b59cf714c9dfe195a178d3ae13b ]
On MSM8974 / APQ8074, MSM8226 and MSM8926 the MSS requires loading raw
MBA image instead of the ELF file. Skip the ELF headers if mba.mbn was
specified as the firmware image.
Fixes: a5a4e02d083d ("remoteproc: qcom: Add support for parsing fw dt bindings")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Tested-by: Luca Weiss <luca@lucaweiss.eu> # msm8974pro-fairphone-fp2
Link: https://lore.kernel.org/r/20250706-msm8974-fix-mss-v4-1-630907dbd898@oss.qualcomm.com
[bjorn: Unwrapped the long memcpy line, to taste]
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/qcom_q6v5_mss.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c
index 0c0199fb0e68d..3087d895b87f4 100644
--- a/drivers/remoteproc/qcom_q6v5_mss.c
+++ b/drivers/remoteproc/qcom_q6v5_mss.c
@@ -498,6 +498,8 @@ static void q6v5_debug_policy_load(struct q6v5 *qproc, void *mba_region)
release_firmware(dp_fw);
}
+#define MSM8974_B00_OFFSET 0x1000
+
static int q6v5_load(struct rproc *rproc, const struct firmware *fw)
{
struct q6v5 *qproc = rproc->priv;
@@ -516,7 +518,14 @@ static int q6v5_load(struct rproc *rproc, const struct firmware *fw)
return -EBUSY;
}
- memcpy(mba_region, fw->data, fw->size);
+ if ((qproc->version == MSS_MSM8974 ||
+ qproc->version == MSS_MSM8226 ||
+ qproc->version == MSS_MSM8926) &&
+ fw->size > MSM8974_B00_OFFSET &&
+ !memcmp(fw->data, ELFMAG, SELFMAG))
+ memcpy(mba_region, fw->data + MSM8974_B00_OFFSET, fw->size - MSM8974_B00_OFFSET);
+ else
+ memcpy(mba_region, fw->data, fw->size);
q6v5_debug_policy_load(qproc, mba_region);
memunmap(mba_region);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 412/563] RDMA/rxe: Fix race in do_task() when draining
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (410 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 411/563] remoteproc: qcom_q6v5_mss: support loading MBN file on msm8974 Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 413/563] selftests/mm: fix va_high_addr_switch.sh failure on x86_64 Greg Kroah-Hartman
` (164 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhu Yanjun, Gui-Dong Han,
Leon Romanovsky, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <hanguidong02@gmail.com>
[ Upstream commit 8ca7eada62fcfabf6ec1dc7468941e791c1d8729 ]
When do_task() exhausts its iteration budget (!ret), it sets the state
to TASK_STATE_IDLE to reschedule, without a secondary check on the
current task->state. This can overwrite the TASK_STATE_DRAINING state
set by a concurrent call to rxe_cleanup_task() or rxe_disable_task().
While state changes are protected by a spinlock, both rxe_cleanup_task()
and rxe_disable_task() release the lock while waiting for the task to
finish draining in the while(!is_done(task)) loop. The race occurs if
do_task() hits its iteration limit and acquires the lock in this window.
The cleanup logic may then proceed while the task incorrectly
reschedules itself, leading to a potential use-after-free.
This bug was introduced during the migration from tasklets to workqueues,
where the special handling for the draining case was lost.
Fix this by restoring the original pre-migration behavior. If the state is
TASK_STATE_DRAINING when iterations are exhausted, set cont to 1 to
force a new loop iteration. This allows the task to finish its work, so
that a subsequent iteration can reach the switch statement and correctly
transition the state to TASK_STATE_DRAINED, stopping the task as intended.
Fixes: 9b4b7c1f9f54 ("RDMA/rxe: Add workqueue support for rxe tasks")
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
Link: https://patch.msgid.link/20250919025212.1682087-1-hanguidong02@gmail.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/rxe/rxe_task.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c
index 6f8f353e95838..f522820b950c7 100644
--- a/drivers/infiniband/sw/rxe/rxe_task.c
+++ b/drivers/infiniband/sw/rxe/rxe_task.c
@@ -132,8 +132,12 @@ static void do_task(struct rxe_task *task)
* yield the cpu and reschedule the task
*/
if (!ret) {
- task->state = TASK_STATE_IDLE;
- resched = 1;
+ if (task->state != TASK_STATE_DRAINING) {
+ task->state = TASK_STATE_IDLE;
+ resched = 1;
+ } else {
+ cont = 1;
+ }
goto exit;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 413/563] selftests/mm: fix va_high_addr_switch.sh failure on x86_64
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (411 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 412/563] RDMA/rxe: Fix race in do_task() when draining Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 414/563] wifi: rtw89: fix leak in rtw89_core_send_nullfunc() Greg Kroah-Hartman
` (163 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chunyu Hu, David Hildenbrand,
Andrew Morton, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chunyu Hu <chuhu@redhat.com>
[ Upstream commit c56325259abc026205c98964616dcc0df5648912 ]
The test will fail as below on x86_64 with cpu la57 support (will skip if
no la57 support). Note, the test requries nr_hugepages to be set first.
# running bash ./va_high_addr_switch.sh
# -------------------------------------
# mmap(addr_switch_hint - pagesize, pagesize): 0x7f55b60fa000 - OK
# mmap(addr_switch_hint - pagesize, (2 * pagesize)): 0x7f55b60f9000 - OK
# mmap(addr_switch_hint, pagesize): 0x800000000000 - OK
# mmap(addr_switch_hint, 2 * pagesize, MAP_FIXED): 0x800000000000 - OK
# mmap(NULL): 0x7f55b60f9000 - OK
# mmap(low_addr): 0x40000000 - OK
# mmap(high_addr): 0x1000000000000 - OK
# mmap(high_addr) again: 0xffff55b6136000 - OK
# mmap(high_addr, MAP_FIXED): 0x1000000000000 - OK
# mmap(-1): 0xffff55b6134000 - OK
# mmap(-1) again: 0xffff55b6132000 - OK
# mmap(addr_switch_hint - pagesize, pagesize): 0x7f55b60fa000 - OK
# mmap(addr_switch_hint - pagesize, 2 * pagesize): 0x7f55b60f9000 - OK
# mmap(addr_switch_hint - pagesize/2 , 2 * pagesize): 0x7f55b60f7000 - OK
# mmap(addr_switch_hint, pagesize): 0x800000000000 - OK
# mmap(addr_switch_hint, 2 * pagesize, MAP_FIXED): 0x800000000000 - OK
# mmap(NULL, MAP_HUGETLB): 0x7f55b5c00000 - OK
# mmap(low_addr, MAP_HUGETLB): 0x40000000 - OK
# mmap(high_addr, MAP_HUGETLB): 0x1000000000000 - OK
# mmap(high_addr, MAP_HUGETLB) again: 0xffff55b5e00000 - OK
# mmap(high_addr, MAP_FIXED | MAP_HUGETLB): 0x1000000000000 - OK
# mmap(-1, MAP_HUGETLB): 0x7f55b5c00000 - OK
# mmap(-1, MAP_HUGETLB) again: 0x7f55b5a00000 - OK
# mmap(addr_switch_hint - pagesize, 2*hugepagesize, MAP_HUGETLB): 0x800000000000 - FAILED
# mmap(addr_switch_hint , 2*hugepagesize, MAP_FIXED | MAP_HUGETLB): 0x800000000000 - OK
# [FAIL]
addr_switch_hint is defined as DFEFAULT_MAP_WINDOW in the failed test (for
x86_64, DFEFAULT_MAP_WINDOW is defined as (1UL<<47) - pagesize) in 64 bit.
Before commit cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*}
functions"), for x86_64 hugetlb_get_unmapped_area() is handled in arch
code arch/x86/mm/hugetlbpage.c and addr is checked with
map_address_hint_valid() after align with 'addr &= huge_page_mask(h)'
which is a round down way, and it will fail the check because the addr is
within the DEFAULT_MAP_WINDOW but (addr + len) is above the
DFEFAULT_MAP_WINDOW. So it wil go through the
hugetlb_get_unmmaped_area_top_down() to find an area within the
DFEFAULT_MAP_WINDOW.
After commit cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*}
functions"). The addr hint for hugetlb_get_unmmaped_area() will be
rounded up and aligned to hugepage size with ALIGN() for all arches. And
after the align, the addr will be above the default MAP_DEFAULT_WINDOW,
and the map_addresshint_valid() check will pass because both aligned addr
(addr0) and (addr + len) are above the DEFAULT_MAP_WINDOW, and the aligned
hint address (0x800000000000) is returned as an suitable gap is found
there, in arch_get_unmapped_area_topdown().
To still cover the case that addr is within the DEFAULT_MAP_WINDOW, and
addr + len is above the DFEFAULT_MAP_WINDOW, change to choose the last
hugepage aligned address within the DEFAULT_MAP_WINDOW as the hint addr,
and the addr + len (2 hugepages) will be one hugepage above the
DEFAULT_MAP_WINDOW. An aligned address won't be affected by the page
round up or round down from kernel, so it's determistic.
Link: https://lkml.kernel.org/r/20250912013711.3002969-4-chuhu@redhat.com
Fixes: cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*} functions")
Signed-off-by: Chunyu Hu <chuhu@redhat.com>
Suggested-by: David Hildenbrand <david@redhat.com>
Acked-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/mm/va_high_addr_switch.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/mm/va_high_addr_switch.c b/tools/testing/selftests/mm/va_high_addr_switch.c
index 896b3f73fc53b..306eba8251077 100644
--- a/tools/testing/selftests/mm/va_high_addr_switch.c
+++ b/tools/testing/selftests/mm/va_high_addr_switch.c
@@ -230,10 +230,10 @@ void testcases_init(void)
.msg = "mmap(-1, MAP_HUGETLB) again",
},
{
- .addr = (void *)(addr_switch_hint - pagesize),
+ .addr = (void *)(addr_switch_hint - hugepagesize),
.size = 2 * hugepagesize,
.flags = MAP_HUGETLB | MAP_PRIVATE | MAP_ANONYMOUS,
- .msg = "mmap(addr_switch_hint - pagesize, 2*hugepagesize, MAP_HUGETLB)",
+ .msg = "mmap(addr_switch_hint - hugepagesize, 2*hugepagesize, MAP_HUGETLB)",
.low_addr_required = 1,
.keep_mapped = 1,
},
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 414/563] wifi: rtw89: fix leak in rtw89_core_send_nullfunc()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (412 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 413/563] selftests/mm: fix va_high_addr_switch.sh failure on x86_64 Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 415/563] wifi: rtw89: avoid circular locking dependency in ser_state_run() Greg Kroah-Hartman
` (162 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fedor Pchelkin, Ping-Ke Shih,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <pchelkin@ispras.ru>
[ Upstream commit a9f0064f4716b0fd97085015ea1dd398bdfdc946 ]
If there is no rtwsta_link found in rtw89_core_send_nullfunc(), allocated
skb is leaked. Free it on the error handling path.
Found by Linux Verification Center (linuxtesting.org).
Fixes: a8ba4acab7db ("wifi: rtw89: send nullfunc based on the given link")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250919210852.823912-4-pchelkin@ispras.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index b9c2224dde4a3..1837f17239ab6 100644
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -3456,6 +3456,7 @@ int rtw89_core_send_nullfunc(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rt
rtwsta_link = rtwsta->links[rtwvif_link->link_id];
if (unlikely(!rtwsta_link)) {
ret = -ENOLINK;
+ dev_kfree_skb_any(skb);
goto out;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 415/563] wifi: rtw89: avoid circular locking dependency in ser_state_run()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (413 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 414/563] wifi: rtw89: fix leak in rtw89_core_send_nullfunc() Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 416/563] PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() Greg Kroah-Hartman
` (161 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fedor Pchelkin, Ping-Ke Shih,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <pchelkin@ispras.ru>
[ Upstream commit 570f94511766f9236d3462dfb8a3c719c2b54c23 ]
Lockdep gives a splat [1] when ser_hdl_work item is executed. It is
scheduled at mac80211 workqueue via ieee80211_queue_work() and takes a
wiphy lock inside. However, this workqueue can be flushed when e.g.
closing the interface and wiphy lock is already taken in that case.
Choosing wiphy_work_queue() for SER is likely not suitable. Back on to
the global workqueue.
[1]:
WARNING: possible circular locking dependency detected
6.17.0-rc2 #17 Not tainted
------------------------------------------------------
kworker/u32:1/61 is trying to acquire lock:
ffff88811bc00768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ser_state_run+0x5e/0x180 [rtw89_core]
but task is already holding lock:
ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}:
process_one_work+0x7c6/0x1450
worker_thread+0x49e/0xd00
kthread+0x313/0x640
ret_from_fork+0x221/0x300
ret_from_fork_asm+0x1a/0x30
-> #1 ((wq_completion)phy0){+.+.}-{0:0}:
touch_wq_lockdep_map+0x8e/0x180
__flush_workqueue+0x129/0x10d0
ieee80211_stop_device+0xa8/0x110
ieee80211_do_stop+0x14ce/0x2880
ieee80211_stop+0x13a/0x2c0
__dev_close_many+0x18f/0x510
__dev_change_flags+0x25f/0x670
netif_change_flags+0x7b/0x160
do_setlink.isra.0+0x1640/0x35d0
rtnl_newlink+0xd8c/0x1d30
rtnetlink_rcv_msg+0x700/0xb80
netlink_rcv_skb+0x11d/0x350
netlink_unicast+0x49a/0x7a0
netlink_sendmsg+0x759/0xc20
____sys_sendmsg+0x812/0xa00
___sys_sendmsg+0xf7/0x180
__sys_sendmsg+0x11f/0x1b0
do_syscall_64+0xbb/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&rdev->wiphy.mtx){+.+.}-{4:4}:
__lock_acquire+0x124c/0x1d20
lock_acquire+0x154/0x2e0
__mutex_lock+0x17b/0x12f0
ser_state_run+0x5e/0x180 [rtw89_core]
rtw89_ser_hdl_work+0x119/0x220 [rtw89_core]
process_one_work+0x82d/0x1450
worker_thread+0x49e/0xd00
kthread+0x313/0x640
ret_from_fork+0x221/0x300
ret_from_fork_asm+0x1a/0x30
other info that might help us debug this:
Chain exists of:
&rdev->wiphy.mtx --> (wq_completion)phy0 --> (work_completion)(&ser->ser_hdl_work)
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock((work_completion)(&ser->ser_hdl_work));
lock((wq_completion)phy0);
lock((work_completion)(&ser->ser_hdl_work));
lock(&rdev->wiphy.mtx);
*** DEADLOCK ***
2 locks held by kworker/u32:1/61:
#0: ffff888103835148 ((wq_completion)phy0){+.+.}-{0:0}, at: process_one_work+0xefa/0x1450
#1: ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450
stack backtrace:
CPU: 0 UID: 0 PID: 61 Comm: kworker/u32:1 Not tainted 6.17.0-rc2 #17 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025
Workqueue: phy0 rtw89_ser_hdl_work [rtw89_core]
Call Trace:
<TASK>
dump_stack_lvl+0x5d/0x80
print_circular_bug.cold+0x178/0x1be
check_noncircular+0x14c/0x170
__lock_acquire+0x124c/0x1d20
lock_acquire+0x154/0x2e0
__mutex_lock+0x17b/0x12f0
ser_state_run+0x5e/0x180 [rtw89_core]
rtw89_ser_hdl_work+0x119/0x220 [rtw89_core]
process_one_work+0x82d/0x1450
worker_thread+0x49e/0xd00
kthread+0x313/0x640
ret_from_fork+0x221/0x300
ret_from_fork_asm+0x1a/0x30
</TASK>
Found by Linux Verification Center (linuxtesting.org).
Fixes: ebfc9199df05 ("wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250919210852.823912-5-pchelkin@ispras.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/ser.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c
index fe7beff8c4246..f99e179f7ff9f 100644
--- a/drivers/net/wireless/realtek/rtw89/ser.c
+++ b/drivers/net/wireless/realtek/rtw89/ser.c
@@ -205,7 +205,6 @@ static void rtw89_ser_hdl_work(struct work_struct *work)
static int ser_send_msg(struct rtw89_ser *ser, u8 event)
{
- struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
struct ser_msg *msg = NULL;
if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags))
@@ -221,7 +220,7 @@ static int ser_send_msg(struct rtw89_ser *ser, u8 event)
list_add(&msg->list, &ser->msg_q);
spin_unlock_irq(&ser->msg_q_lock);
- ieee80211_queue_work(rtwdev->hw, &ser->ser_hdl_work);
+ schedule_work(&ser->ser_hdl_work);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 416/563] PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (414 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 415/563] wifi: rtw89: avoid circular locking dependency in ser_state_run() Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 417/563] remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice Greg Kroah-Hartman
` (160 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nagarjuna Kristam, Niklas Cassel,
Manivannan Sadhasivam, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nagarjuna Kristam <nkristam@nvidia.com>
[ Upstream commit 4f152338e384a3a47dd61909e1457539fa93f5a4 ]
During PERST# assertion tegra_pcie_bpmp_set_pll_state() is currently
called twice.
pex_ep_event_pex_rst_assert() should do the opposite of
pex_ep_event_pex_rst_deassert(), so it is obvious that the duplicate
tegra_pcie_bpmp_set_pll_state() is a mistake, and that the duplicate
tegra_pcie_bpmp_set_pll_state() call should instead be a call to
tegra_pcie_bpmp_set_ctrl_state().
With this, the uninitialization sequence also matches that of
tegra_pcie_unconfig_controller().
Fixes: a54e19073718 ("PCI: tegra194: Add Tegra234 PCIe support")
Signed-off-by: Nagarjuna Kristam <nkristam@nvidia.com>
[cassel: improve commit log]
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Link: https://patch.msgid.link/20250911093021.1454385-2-cassel@kernel.org
[mani: added Fixes tag]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c
index 4f26086f25daf..0c0734aa14b68 100644
--- a/drivers/pci/controller/dwc/pcie-tegra194.c
+++ b/drivers/pci/controller/dwc/pcie-tegra194.c
@@ -1722,9 +1722,9 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie)
ret);
}
- ret = tegra_pcie_bpmp_set_pll_state(pcie, false);
+ ret = tegra_pcie_bpmp_set_ctrl_state(pcie, false);
if (ret)
- dev_err(pcie->dev, "Failed to turn off UPHY: %d\n", ret);
+ dev_err(pcie->dev, "Failed to disable controller: %d\n", ret);
pcie->ep_state = EP_STATE_DISABLED;
dev_dbg(pcie->dev, "Uninitialization of endpoint is completed\n");
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 417/563] remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (415 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 416/563] PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 418/563] remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E Greg Kroah-Hartman
` (159 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Stephan Gerhold,
Bjorn Andersson, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan.gerhold@linaro.org>
[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ]
enable_irq() and disable_irq() are reference counted, so we must make sure
that each enable_irq() is always paired with a single disable_irq(). If we
call disable_irq() twice followed by just a single enable_irq(), the IRQ
will remain disabled forever.
For the error handling path in qcom_q6v5_wait_for_start(), disable_irq()
will end up being called twice, because disable_irq() also happens in
qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare().
Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since
qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more
sense to have the rollback handled always by qcom_q6v5_unprepare().
Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-1-910b1a3aff71@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/qcom_q6v5.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
index 4ee5e67a9f03f..769c6d6d6a731 100644
--- a/drivers/remoteproc/qcom_q6v5.c
+++ b/drivers/remoteproc/qcom_q6v5.c
@@ -156,9 +156,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout)
int ret;
ret = wait_for_completion_timeout(&q6v5->start_done, timeout);
- if (!ret)
- disable_irq(q6v5->handover_irq);
-
return !ret ? -ETIMEDOUT : 0;
}
EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 418/563] remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (416 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 417/563] remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 419/563] wifi: ath12k: Refactor RX TID deletion handling into helper function Greg Kroah-Hartman
` (158 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Stephan Gerhold,
Bjorn Andersson, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan.gerhold@linaro.org>
[ Upstream commit 142964960c7c35de5c5f7bdd61c32699de693630 ]
The ADSP firmware on X1E has separate firmware binaries for the main
firmware and the DTB. The same applies for the "lite" firmware loaded by
the boot firmware.
When preparing to load the new ADSP firmware we shutdown the lite_pas_id
for the main firmware, but we don't shutdown the corresponding lite pas_id
for the DTB. The fact that we're leaving it "running" forever becomes
obvious if you try to reuse (or just access) the memory region used by the
"lite" firmware: The &adsp_boot_mem is accessible, but accessing the
&adsp_boot_dtb_mem results in a crash.
We don't support reusing the memory regions currently, but nevertheless we
should not keep part of the lite firmware running. Fix this by adding the
lite_dtb_pas_id and shutting it down as well.
We don't have a way to detect if the lite firmware is actually running yet,
so ignore the return status of qcom_scm_pas_shutdown() for now. This was
already the case before, the assignment to "ret" is not used anywhere.
Fixes: 62210f7509e1 ("remoteproc: qcom_q6v5_pas: Unload lite firmware on ADSP")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-3-910b1a3aff71@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/qcom_q6v5_pas.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c
index 02e29171cbbee..f3ec5b06261e8 100644
--- a/drivers/remoteproc/qcom_q6v5_pas.c
+++ b/drivers/remoteproc/qcom_q6v5_pas.c
@@ -42,6 +42,7 @@ struct qcom_pas_data {
int pas_id;
int dtb_pas_id;
int lite_pas_id;
+ int lite_dtb_pas_id;
unsigned int minidump_id;
bool auto_boot;
bool decrypt_shutdown;
@@ -80,6 +81,7 @@ struct qcom_pas {
int pas_id;
int dtb_pas_id;
int lite_pas_id;
+ int lite_dtb_pas_id;
unsigned int minidump_id;
int crash_reason_smem;
unsigned int smem_host_id;
@@ -226,6 +228,8 @@ static int qcom_pas_load(struct rproc *rproc, const struct firmware *fw)
if (pas->lite_pas_id)
ret = qcom_scm_pas_shutdown(pas->lite_pas_id);
+ if (pas->lite_dtb_pas_id)
+ qcom_scm_pas_shutdown(pas->lite_dtb_pas_id);
if (pas->dtb_pas_id) {
ret = request_firmware(&pas->dtb_firmware, pas->dtb_firmware_name, pas->dev);
@@ -722,6 +726,7 @@ static int qcom_pas_probe(struct platform_device *pdev)
pas->minidump_id = desc->minidump_id;
pas->pas_id = desc->pas_id;
pas->lite_pas_id = desc->lite_pas_id;
+ pas->lite_dtb_pas_id = desc->lite_dtb_pas_id;
pas->info_name = desc->sysmon_name;
pas->smem_host_id = desc->smem_host_id;
pas->decrypt_shutdown = desc->decrypt_shutdown;
@@ -1085,6 +1090,7 @@ static const struct qcom_pas_data x1e80100_adsp_resource = {
.pas_id = 1,
.dtb_pas_id = 0x24,
.lite_pas_id = 0x1f,
+ .lite_dtb_pas_id = 0x29,
.minidump_id = 5,
.auto_boot = true,
.proxy_pd_names = (char*[]){
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 419/563] wifi: ath12k: Refactor RX TID deletion handling into helper function
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (417 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 418/563] remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 420/563] wifi: ath12k: Fix flush cache failure during RX queue update Greg Kroah-Hartman
` (157 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nithyanantham Paramasivam,
Baochen Qiang, Vasanthakumar Thiagarajan, Jeff Johnson,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nithyanantham Paramasivam <nithyanantham.paramasivam@oss.qualcomm.com>
[ Upstream commit 7c32476253f11210ac24c7818ca07e19bc032521 ]
Refactor RX TID deletion handling by moving the REO command
setup and send sequence into a new helper function:
ath12k_dp_rx_tid_delete_handler().
This improves code readability and modularity, and prepares
the codebase for potential reuse of the REO command logic in
other contexts where RX TID deletion is required.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
Signed-off-by: Nithyanantham Paramasivam <nithyanantham.paramasivam@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20250806111750.3214584-3-nithyanantham.paramasivam@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Stable-dep-of: 5e32edc69425 ("wifi: ath12k: Fix flush cache failure during RX queue update")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/dp_rx.c | 27 +++++++++++++++++--------
1 file changed, 19 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c
index adb0cfe109e67..8c61c7f3bbdc9 100644
--- a/drivers/net/wireless/ath/ath12k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
@@ -21,6 +21,9 @@
#define ATH12K_DP_RX_FRAGMENT_TIMEOUT_MS (2 * HZ)
+static int ath12k_dp_rx_tid_delete_handler(struct ath12k_base *ab,
+ struct ath12k_dp_rx_tid *rx_tid);
+
static enum hal_encrypt_type ath12k_dp_rx_h_enctype(struct ath12k_base *ab,
struct hal_rx_desc *desc)
{
@@ -769,6 +772,21 @@ static void ath12k_dp_rx_tid_del_func(struct ath12k_dp *dp, void *ctx,
rx_tid->qbuf.vaddr = NULL;
}
+static int ath12k_dp_rx_tid_delete_handler(struct ath12k_base *ab,
+ struct ath12k_dp_rx_tid *rx_tid)
+{
+ struct ath12k_hal_reo_cmd cmd = {};
+
+ cmd.flag = HAL_REO_CMD_FLG_NEED_STATUS;
+ cmd.addr_lo = lower_32_bits(rx_tid->qbuf.paddr_aligned);
+ cmd.addr_hi = upper_32_bits(rx_tid->qbuf.paddr_aligned);
+ cmd.upd0 |= HAL_REO_CMD_UPD0_VLD;
+
+ return ath12k_dp_reo_cmd_send(ab, rx_tid,
+ HAL_REO_CMD_UPDATE_RX_QUEUE, &cmd,
+ ath12k_dp_rx_tid_del_func);
+}
+
static void ath12k_peer_rx_tid_qref_setup(struct ath12k_base *ab, u16 peer_id, u16 tid,
dma_addr_t paddr)
{
@@ -828,20 +846,13 @@ static void ath12k_peer_rx_tid_qref_reset(struct ath12k_base *ab, u16 peer_id, u
void ath12k_dp_rx_peer_tid_delete(struct ath12k *ar,
struct ath12k_peer *peer, u8 tid)
{
- struct ath12k_hal_reo_cmd cmd = {};
struct ath12k_dp_rx_tid *rx_tid = &peer->rx_tid[tid];
int ret;
if (!rx_tid->active)
return;
- cmd.flag = HAL_REO_CMD_FLG_NEED_STATUS;
- cmd.addr_lo = lower_32_bits(rx_tid->qbuf.paddr_aligned);
- cmd.addr_hi = upper_32_bits(rx_tid->qbuf.paddr_aligned);
- cmd.upd0 = HAL_REO_CMD_UPD0_VLD;
- ret = ath12k_dp_reo_cmd_send(ar->ab, rx_tid,
- HAL_REO_CMD_UPDATE_RX_QUEUE, &cmd,
- ath12k_dp_rx_tid_del_func);
+ ret = ath12k_dp_rx_tid_delete_handler(ar->ab, rx_tid);
if (ret) {
ath12k_err(ar->ab, "failed to send HAL_REO_CMD_UPDATE_RX_QUEUE cmd, tid %d (%d)\n",
tid, ret);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 420/563] wifi: ath12k: Fix flush cache failure during RX queue update
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (418 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 419/563] wifi: ath12k: Refactor RX TID deletion handling into helper function Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 421/563] wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() Greg Kroah-Hartman
` (156 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nithyanantham Paramasivam,
Baochen Qiang, Vasanthakumar Thiagarajan, Jeff Johnson,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nithyanantham Paramasivam <nithyanantham.paramasivam@oss.qualcomm.com>
[ Upstream commit 5e32edc6942570429d9c64d0641fc2addbf92be1 ]
Flush cache failures were observed after RX queue update for TID
delete. This occurred because the queue was invalid during flush.
Set the VLD bit in the RX queue update command for TID delete.
This ensures the queue remains valid during the flush cache process.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: Nithyanantham Paramasivam <nithyanantham.paramasivam@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20250806111750.3214584-7-nithyanantham.paramasivam@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/dp_rx.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c
index 8c61c7f3bbdc9..9048818984f19 100644
--- a/drivers/net/wireless/ath/ath12k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
@@ -781,6 +781,8 @@ static int ath12k_dp_rx_tid_delete_handler(struct ath12k_base *ab,
cmd.addr_lo = lower_32_bits(rx_tid->qbuf.paddr_aligned);
cmd.addr_hi = upper_32_bits(rx_tid->qbuf.paddr_aligned);
cmd.upd0 |= HAL_REO_CMD_UPD0_VLD;
+ /* Observed flush cache failure, to avoid that set vld bit during delete */
+ cmd.upd1 |= HAL_REO_CMD_UPD1_VLD;
return ath12k_dp_reo_cmd_send(ab, rx_tid,
HAL_REO_CMD_UPDATE_RX_QUEUE, &cmd,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 421/563] wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (419 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 420/563] wifi: ath12k: Fix flush cache failure during RX queue update Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 422/563] dm vdo: return error on corrupted metadata in start_restoring_volume functions Greg Kroah-Hartman
` (155 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ryder Lee, Johannes Berg,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryder Lee <ryder.lee@mediatek.com>
[ Upstream commit 17f34ab55a8518ecbd5dcacec48e6ee903f7c1d0 ]
The original code used nl80211_chan_width_to_mhz(), which returns the width in MHz.
However, the expected unit is KHz.
Fixes: 510dba80ed66 ("wifi: cfg80211: add helper for checking if a chandef is valid on a radio")
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
Link: https://patch.msgid.link/df54294e6c4ed0f3ceff6e818b710478ddfc62c0.1758579480.git.Ryder%20Lee%20ryder.lee@mediatek.com/
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/util.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 240c68baa3d1f..341dbf642181b 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -2992,7 +2992,7 @@ bool cfg80211_radio_chandef_valid(const struct wiphy_radio *radio,
u32 freq, width;
freq = ieee80211_chandef_to_khz(chandef);
- width = cfg80211_chandef_get_width(chandef);
+ width = MHZ_TO_KHZ(cfg80211_chandef_get_width(chandef));
if (!ieee80211_radio_freq_range_valid(radio, freq, width))
return false;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 422/563] dm vdo: return error on corrupted metadata in start_restoring_volume functions
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (420 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 421/563] wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 423/563] coresight: fix indentation error in cscfg_remove_owned_csdev_configs() Greg Kroah-Hartman
` (154 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ivan Abramov, Matthew Sakai,
Mikulas Patocka, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Abramov <i.abramov@mt-integration.ru>
[ Upstream commit 9ddf6d3fcbe0b96e318da364cf7e6b59cd4cb5a2 ]
The return values of VDO_ASSERT calls that validate metadata are not acted
upon.
Return UDS_CORRUPT_DATA in case of an error.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: a4eb7e255517 ("dm vdo: implement the volume index")
Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru>
Reviewed-by: Matthew Sakai <msakai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-vdo/indexer/volume-index.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/md/dm-vdo/indexer/volume-index.c b/drivers/md/dm-vdo/indexer/volume-index.c
index 12f954a0c5325..afb062e1f1fb4 100644
--- a/drivers/md/dm-vdo/indexer/volume-index.c
+++ b/drivers/md/dm-vdo/indexer/volume-index.c
@@ -836,7 +836,7 @@ static int start_restoring_volume_sub_index(struct volume_sub_index *sub_index,
"%zu bytes decoded of %zu expected", offset,
sizeof(buffer));
if (result != VDO_SUCCESS)
- result = UDS_CORRUPT_DATA;
+ return UDS_CORRUPT_DATA;
if (memcmp(header.magic, MAGIC_START_5, MAGIC_SIZE) != 0) {
return vdo_log_warning_strerror(UDS_CORRUPT_DATA,
@@ -928,7 +928,7 @@ static int start_restoring_volume_index(struct volume_index *volume_index,
"%zu bytes decoded of %zu expected", offset,
sizeof(buffer));
if (result != VDO_SUCCESS)
- result = UDS_CORRUPT_DATA;
+ return UDS_CORRUPT_DATA;
if (memcmp(header.magic, MAGIC_START_6, MAGIC_SIZE) != 0)
return vdo_log_warning_strerror(UDS_CORRUPT_DATA,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 423/563] coresight: fix indentation error in cscfg_remove_owned_csdev_configs()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (421 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 422/563] dm vdo: return error on corrupted metadata in start_restoring_volume functions Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 424/563] coresight-etm4x: Conditionally access register TRCEXTINSELR Greg Kroah-Hartman
` (153 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Yeoreum Yun,
Leo Yan, Suzuki K Poulose, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yeoreum Yun <yeoreum.yun@arm.com>
[ Upstream commit 21dd3f8bc24b6adc57f09fff5430b0039dd00492 ]
Fix wrong indentation in cscfg_remove_owned_csdev_configs()
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202506102238.XQfScl5x-lkp@intel.com/
Fixes: 53b9e2659719 ("coresight: holding cscfg_csdev_lock while removing cscfg from csdev")
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Reviewed-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20250611103025.939020-1-yeoreum.yun@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-syscfg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
index 83dad24e0116d..6836b05986e80 100644
--- a/drivers/hwtracing/coresight/coresight-syscfg.c
+++ b/drivers/hwtracing/coresight/coresight-syscfg.c
@@ -395,7 +395,7 @@ static void cscfg_remove_owned_csdev_configs(struct coresight_device *csdev, voi
if (list_empty(&csdev->config_csdev_list))
return;
- guard(raw_spinlock_irqsave)(&csdev->cscfg_csdev_lock);
+ guard(raw_spinlock_irqsave)(&csdev->cscfg_csdev_lock);
list_for_each_entry_safe(config_csdev, tmp, &csdev->config_csdev_list, node) {
if (config_csdev->config_desc->load_owner == load_owner)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 424/563] coresight-etm4x: Conditionally access register TRCEXTINSELR
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (422 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 423/563] coresight: fix indentation error in cscfg_remove_owned_csdev_configs() Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 425/563] coresight: tmc: Support atclk Greg Kroah-Hartman
` (152 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuanfang Zhang, James Clark,
Mike Leach, Suzuki K Poulose, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanfang Zhang <yuanfang.zhang@oss.qualcomm.com>
[ Upstream commit dcdc42f5dcf9b9197c51246c62966e2d54a033d8 ]
The TRCEXTINSELR is only implemented if TRCIDR5.NUMEXTINSEL > 0.
To avoid invalid accesses, introduce a check on numextinsel
(derived from TRCIDR5[11:9]) before reading or writing to this register.
Fixes: f5bd523690d2 ("coresight: etm4x: Convert all register accesses")
Signed-off-by: Yuanfang Zhang <yuanfang.zhang@oss.qualcomm.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Reviewed-by: Mike Leach <mike.leach@linaro.org>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20250812-trcextinselr_issue-v2-1-e6eb121dfcf4@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-etm4x-core.c | 11 ++++++++---
drivers/hwtracing/coresight/coresight-etm4x.h | 2 ++
2 files changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index cbea200489c8f..b4f1834a1af1e 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -529,7 +529,8 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata)
etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR);
etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR);
}
- etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
+ if (drvdata->numextinsel)
+ etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
for (i = 0; i < drvdata->nr_cntr; i++) {
etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i));
etm4x_relaxed_write32(csa, config->cntr_ctrl[i], TRCCNTCTLRn(i));
@@ -1424,6 +1425,7 @@ static void etm4_init_arch_data(void *info)
etmidr5 = etm4x_relaxed_read32(csa, TRCIDR5);
/* NUMEXTIN, bits[8:0] number of external inputs implemented */
drvdata->nr_ext_inp = FIELD_GET(TRCIDR5_NUMEXTIN_MASK, etmidr5);
+ drvdata->numextinsel = FIELD_GET(TRCIDR5_NUMEXTINSEL_MASK, etmidr5);
/* TRACEIDSIZE, bits[21:16] indicates the trace ID width */
drvdata->trcid_size = FIELD_GET(TRCIDR5_TRACEIDSIZE_MASK, etmidr5);
/* ATBTRIG, bit[22] implementation can support ATB triggers? */
@@ -1853,7 +1855,9 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata)
state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR);
state->trcseqstr = etm4x_read32(csa, TRCSEQSTR);
}
- state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
+
+ if (drvdata->numextinsel)
+ state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
for (i = 0; i < drvdata->nr_cntr; i++) {
state->trccntrldvr[i] = etm4x_read32(csa, TRCCNTRLDVRn(i));
@@ -1985,7 +1989,8 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata)
etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR);
etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR);
}
- etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
+ if (drvdata->numextinsel)
+ etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
for (i = 0; i < drvdata->nr_cntr; i++) {
etm4x_relaxed_write32(csa, state->trccntrldvr[i], TRCCNTRLDVRn(i));
diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
index ac649515054d9..823914fefa90a 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x.h
+++ b/drivers/hwtracing/coresight/coresight-etm4x.h
@@ -162,6 +162,7 @@
#define TRCIDR4_NUMVMIDC_MASK GENMASK(31, 28)
#define TRCIDR5_NUMEXTIN_MASK GENMASK(8, 0)
+#define TRCIDR5_NUMEXTINSEL_MASK GENMASK(11, 9)
#define TRCIDR5_TRACEIDSIZE_MASK GENMASK(21, 16)
#define TRCIDR5_ATBTRIG BIT(22)
#define TRCIDR5_LPOVERRIDE BIT(23)
@@ -999,6 +1000,7 @@ struct etmv4_drvdata {
u8 nr_cntr;
u8 nr_ext_inp;
u8 numcidc;
+ u8 numextinsel;
u8 numvmidc;
u8 nrseqstate;
u8 nr_event;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 425/563] coresight: tmc: Support atclk
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (423 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 424/563] coresight-etm4x: Conditionally access register TRCEXTINSELR Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 426/563] coresight: catu: " Greg Kroah-Hartman
` (151 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anshuman Khandual, Yeoreum Yun,
James Clark, Leo Yan, Suzuki K Poulose, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit 8a79026926b329d4ab0c6d0921373a80ec8aab6e ]
The atclk is an optional clock for the CoreSight TMC, but the driver
misses to initialize it. In most cases, TMC shares the atclk clock with
other CoreSight components. Since these components enable the clock
before the TMC device is initialized, the TMC continues properly,
which is why we don’t observe any lockup issues.
This change enables atclk in probe of the TMC driver. Given the clock
is optional, it is possible to return NULL if the clock does not exist.
IS_ERR() is tolerant for this case.
Dynamically disable and enable atclk during suspend and resume. The
clock pointers will never be error values if the driver has successfully
probed, and the case of a NULL pointer case will be handled by the clock
core layer. The driver data is always valid after probe. Therefore,
remove the related checks. Also in the resume flow adds error handling.
Fixes: bc4bf7fe98da ("coresight-tmc: add CoreSight TMC driver")
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
Tested-by: James Clark <james.clark@linaro.org>
Signed-off-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-1-1dfe10bb3f6f@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../hwtracing/coresight/coresight-tmc-core.c | 22 ++++++++++++++-----
drivers/hwtracing/coresight/coresight-tmc.h | 2 ++
2 files changed, 19 insertions(+), 5 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-tmc-core.c b/drivers/hwtracing/coresight/coresight-tmc-core.c
index 88afb16bb6bec..0b5e7635a084d 100644
--- a/drivers/hwtracing/coresight/coresight-tmc-core.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-core.c
@@ -789,6 +789,10 @@ static int __tmc_probe(struct device *dev, struct resource *res)
struct coresight_desc desc = { 0 };
struct coresight_dev_list *dev_list = NULL;
+ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
+ if (IS_ERR(drvdata->atclk))
+ return PTR_ERR(drvdata->atclk);
+
ret = -ENOMEM;
/* Validity for the resource is already checked by the AMBA core */
@@ -1020,18 +1024,26 @@ static int tmc_runtime_suspend(struct device *dev)
{
struct tmc_drvdata *drvdata = dev_get_drvdata(dev);
- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
- clk_disable_unprepare(drvdata->pclk);
+ clk_disable_unprepare(drvdata->atclk);
+ clk_disable_unprepare(drvdata->pclk);
+
return 0;
}
static int tmc_runtime_resume(struct device *dev)
{
struct tmc_drvdata *drvdata = dev_get_drvdata(dev);
+ int ret;
- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
- clk_prepare_enable(drvdata->pclk);
- return 0;
+ ret = clk_prepare_enable(drvdata->pclk);
+ if (ret)
+ return ret;
+
+ ret = clk_prepare_enable(drvdata->atclk);
+ if (ret)
+ clk_disable_unprepare(drvdata->pclk);
+
+ return ret;
}
#endif
diff --git a/drivers/hwtracing/coresight/coresight-tmc.h b/drivers/hwtracing/coresight/coresight-tmc.h
index 6541a27a018e6..cbb4ba4391585 100644
--- a/drivers/hwtracing/coresight/coresight-tmc.h
+++ b/drivers/hwtracing/coresight/coresight-tmc.h
@@ -210,6 +210,7 @@ struct tmc_resrv_buf {
/**
* struct tmc_drvdata - specifics associated to an TMC component
+ * @atclk: optional clock for the core parts of the TMC.
* @pclk: APB clock if present, otherwise NULL
* @base: memory mapped base address for this component.
* @csdev: component vitals needed by the framework.
@@ -244,6 +245,7 @@ struct tmc_resrv_buf {
* Used by ETR/ETF.
*/
struct tmc_drvdata {
+ struct clk *atclk;
struct clk *pclk;
void __iomem *base;
struct coresight_device *csdev;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 426/563] coresight: catu: Support atclk
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (424 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 425/563] coresight: tmc: Support atclk Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 427/563] coresight: etm4x: " Greg Kroah-Hartman
` (150 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anshuman Khandual, Yeoreum Yun,
James Clark, Leo Yan, Suzuki K Poulose, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit 5483624effea2e893dc0df6248253a6a2a085451 ]
The atclk is an optional clock for the CoreSight CATU, but the driver
misses to initialize it.
This change enables atclk in probe of the CATU driver, and dynamically
control the clock during suspend and resume.
The checks for driver data and clocks in suspend and resume are not
needed, remove them. Add error handling in the resume function.
Fixes: fcacb5c154ba ("coresight: Introduce support for Coresight Address Translation Unit")
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
Tested-by: James Clark <james.clark@linaro.org>
Signed-off-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-2-1dfe10bb3f6f@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-catu.c | 22 +++++++++++++++-----
drivers/hwtracing/coresight/coresight-catu.h | 1 +
2 files changed, 18 insertions(+), 5 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c
index 5058432233da1..af2a55f0c907c 100644
--- a/drivers/hwtracing/coresight/coresight-catu.c
+++ b/drivers/hwtracing/coresight/coresight-catu.c
@@ -520,6 +520,10 @@ static int __catu_probe(struct device *dev, struct resource *res)
struct coresight_platform_data *pdata = NULL;
void __iomem *base;
+ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
+ if (IS_ERR(drvdata->atclk))
+ return PTR_ERR(drvdata->atclk);
+
catu_desc.name = coresight_alloc_device_name(&catu_devs, dev);
if (!catu_desc.name)
return -ENOMEM;
@@ -668,18 +672,26 @@ static int catu_runtime_suspend(struct device *dev)
{
struct catu_drvdata *drvdata = dev_get_drvdata(dev);
- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
- clk_disable_unprepare(drvdata->pclk);
+ clk_disable_unprepare(drvdata->atclk);
+ clk_disable_unprepare(drvdata->pclk);
+
return 0;
}
static int catu_runtime_resume(struct device *dev)
{
struct catu_drvdata *drvdata = dev_get_drvdata(dev);
+ int ret;
- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
- clk_prepare_enable(drvdata->pclk);
- return 0;
+ ret = clk_prepare_enable(drvdata->pclk);
+ if (ret)
+ return ret;
+
+ ret = clk_prepare_enable(drvdata->atclk);
+ if (ret)
+ clk_disable_unprepare(drvdata->pclk);
+
+ return ret;
}
#endif
diff --git a/drivers/hwtracing/coresight/coresight-catu.h b/drivers/hwtracing/coresight/coresight-catu.h
index 755776cd19c5b..6e6b7aac206dc 100644
--- a/drivers/hwtracing/coresight/coresight-catu.h
+++ b/drivers/hwtracing/coresight/coresight-catu.h
@@ -62,6 +62,7 @@
struct catu_drvdata {
struct clk *pclk;
+ struct clk *atclk;
void __iomem *base;
struct coresight_device *csdev;
int irq;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 427/563] coresight: etm4x: Support atclk
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (425 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 426/563] coresight: catu: " Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 428/563] coresight: Appropriately disable programming clocks Greg Kroah-Hartman
` (149 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anshuman Khandual, Yeoreum Yun,
James Clark, Leo Yan, Suzuki K Poulose, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit 40c0cdc9cbbebae9f43bef1cab9ce152318d0cce ]
The atclk is an optional clock for the CoreSight ETMv4, but the driver
misses to initialize it.
This change enables atclk in probe of the ETMv4 driver, and dynamically
control the clock during suspend and resume.
No need to check the driver data and clock pointer in the runtime
suspend and resume, so remove checks. And add error handling in the
resume function.
Add a minor fix to the comment format when adding the atclk field.
Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver")
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
Tested-by: James Clark <james.clark@linaro.org>
Signed-off-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-3-1dfe10bb3f6f@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../coresight/coresight-etm4x-core.c | 20 ++++++++++++++-----
drivers/hwtracing/coresight/coresight-etm4x.h | 4 +++-
2 files changed, 18 insertions(+), 6 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index b4f1834a1af1e..81f20a167e001 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -2221,6 +2221,10 @@ static int etm4_probe(struct device *dev)
if (WARN_ON(!drvdata))
return -ENOMEM;
+ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
+ if (IS_ERR(drvdata->atclk))
+ return PTR_ERR(drvdata->atclk);
+
if (pm_save_enable == PARAM_PM_SAVE_FIRMWARE)
pm_save_enable = coresight_loses_context_with_cpu(dev) ?
PARAM_PM_SAVE_SELF_HOSTED : PARAM_PM_SAVE_NEVER;
@@ -2469,8 +2473,8 @@ static int etm4_runtime_suspend(struct device *dev)
{
struct etmv4_drvdata *drvdata = dev_get_drvdata(dev);
- if (drvdata->pclk && !IS_ERR(drvdata->pclk))
- clk_disable_unprepare(drvdata->pclk);
+ clk_disable_unprepare(drvdata->atclk);
+ clk_disable_unprepare(drvdata->pclk);
return 0;
}
@@ -2478,11 +2482,17 @@ static int etm4_runtime_suspend(struct device *dev)
static int etm4_runtime_resume(struct device *dev)
{
struct etmv4_drvdata *drvdata = dev_get_drvdata(dev);
+ int ret;
+
+ ret = clk_prepare_enable(drvdata->pclk);
+ if (ret)
+ return ret;
- if (drvdata->pclk && !IS_ERR(drvdata->pclk))
- clk_prepare_enable(drvdata->pclk);
+ ret = clk_prepare_enable(drvdata->atclk);
+ if (ret)
+ clk_disable_unprepare(drvdata->pclk);
- return 0;
+ return ret;
}
#endif
diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
index 823914fefa90a..13ec9ecef46f5 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x.h
+++ b/drivers/hwtracing/coresight/coresight-etm4x.h
@@ -920,7 +920,8 @@ struct etmv4_save_state {
/**
* struct etm4_drvdata - specifics associated to an ETM component
- * @pclk APB clock if present, otherwise NULL
+ * @pclk: APB clock if present, otherwise NULL
+ * @atclk: Optional clock for the core parts of the ETMv4.
* @base: Memory mapped base address for this component.
* @csdev: Component vitals needed by the framework.
* @spinlock: Only one at a time pls.
@@ -989,6 +990,7 @@ struct etmv4_save_state {
*/
struct etmv4_drvdata {
struct clk *pclk;
+ struct clk *atclk;
void __iomem *base;
struct coresight_device *csdev;
raw_spinlock_t spinlock;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 428/563] coresight: Appropriately disable programming clocks
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (426 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 427/563] coresight: etm4x: " Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 429/563] coresight: Appropriately disable trace bus clocks Greg Kroah-Hartman
` (148 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yeoreum Yun, James Clark, Leo Yan,
Suzuki K Poulose, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit 1abc1b212effe920f4729353880c8e03f1d76b4b ]
Some CoreSight components have programming clocks (pclk) and are enabled
using clk_get() and clk_prepare_enable(). However, in many cases, these
clocks are not disabled when modules exit and only released by clk_put().
To fix the issue, this commit refactors programming clock by replacing
clk_get() and clk_prepare_enable() with devm_clk_get_optional_enabled()
for enabling APB clock. If the "apb_pclk" clock is not found, a NULL
pointer is returned, and the function proceeds to attempt enabling the
"apb" clock.
Since ACPI platforms rely on firmware to manage clocks, returning a NULL
pointer in this case leaves clock management to the firmware rather than
the driver. This effectively avoids a clock imbalance issue during
module removal - where the clock could be disabled twice: once during
the ACPI runtime suspend and again during the devm resource release.
Callers are updated to reuse the returned error value.
With the change, programming clocks are managed as resources in driver
model layer, allowing clock cleanup to be handled automatically. As a
result, manual cleanup operations are no longer needed and are removed
from the Coresight drivers.
Fixes: 73d779a03a76 ("coresight: etm4x: Change etm4_platform_driver driver for MMIO devices")
Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
Tested-by: James Clark <james.clark@linaro.org>
Signed-off-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-4-1dfe10bb3f6f@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-catu.c | 9 ++------
.../hwtracing/coresight/coresight-cpu-debug.c | 6 +----
.../hwtracing/coresight/coresight-ctcu-core.c | 10 ++-------
.../coresight/coresight-etm4x-core.c | 9 ++------
.../hwtracing/coresight/coresight-funnel.c | 6 +----
.../coresight/coresight-replicator.c | 6 +----
drivers/hwtracing/coresight/coresight-stm.c | 4 +---
.../hwtracing/coresight/coresight-tmc-core.c | 4 +---
drivers/hwtracing/coresight/coresight-tpiu.c | 4 +---
include/linux/coresight.h | 22 ++++++++-----------
10 files changed, 21 insertions(+), 59 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c
index af2a55f0c907c..4c345ff2cff14 100644
--- a/drivers/hwtracing/coresight/coresight-catu.c
+++ b/drivers/hwtracing/coresight/coresight-catu.c
@@ -636,7 +636,7 @@ static int catu_platform_probe(struct platform_device *pdev)
drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev);
if (IS_ERR(drvdata->pclk))
- return -ENODEV;
+ return PTR_ERR(drvdata->pclk);
pm_runtime_get_noresume(&pdev->dev);
pm_runtime_set_active(&pdev->dev);
@@ -645,11 +645,8 @@ static int catu_platform_probe(struct platform_device *pdev)
dev_set_drvdata(&pdev->dev, drvdata);
ret = __catu_probe(&pdev->dev, res);
pm_runtime_put(&pdev->dev);
- if (ret) {
+ if (ret)
pm_runtime_disable(&pdev->dev);
- if (!IS_ERR_OR_NULL(drvdata->pclk))
- clk_put(drvdata->pclk);
- }
return ret;
}
@@ -663,8 +660,6 @@ static void catu_platform_remove(struct platform_device *pdev)
__catu_remove(&pdev->dev);
pm_runtime_disable(&pdev->dev);
- if (!IS_ERR_OR_NULL(drvdata->pclk))
- clk_put(drvdata->pclk);
}
#ifdef CONFIG_PM
diff --git a/drivers/hwtracing/coresight/coresight-cpu-debug.c b/drivers/hwtracing/coresight/coresight-cpu-debug.c
index a871d997330b0..e39dfb886688e 100644
--- a/drivers/hwtracing/coresight/coresight-cpu-debug.c
+++ b/drivers/hwtracing/coresight/coresight-cpu-debug.c
@@ -699,7 +699,7 @@ static int debug_platform_probe(struct platform_device *pdev)
drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev);
if (IS_ERR(drvdata->pclk))
- return -ENODEV;
+ return PTR_ERR(drvdata->pclk);
dev_set_drvdata(&pdev->dev, drvdata);
pm_runtime_get_noresume(&pdev->dev);
@@ -710,8 +710,6 @@ static int debug_platform_probe(struct platform_device *pdev)
if (ret) {
pm_runtime_put_noidle(&pdev->dev);
pm_runtime_disable(&pdev->dev);
- if (!IS_ERR_OR_NULL(drvdata->pclk))
- clk_put(drvdata->pclk);
}
return ret;
}
@@ -725,8 +723,6 @@ static void debug_platform_remove(struct platform_device *pdev)
__debug_remove(&pdev->dev);
pm_runtime_disable(&pdev->dev);
- if (!IS_ERR_OR_NULL(drvdata->pclk))
- clk_put(drvdata->pclk);
}
#ifdef CONFIG_ACPI
diff --git a/drivers/hwtracing/coresight/coresight-ctcu-core.c b/drivers/hwtracing/coresight/coresight-ctcu-core.c
index c6bafc96db963..de279efe34058 100644
--- a/drivers/hwtracing/coresight/coresight-ctcu-core.c
+++ b/drivers/hwtracing/coresight/coresight-ctcu-core.c
@@ -209,7 +209,7 @@ static int ctcu_probe(struct platform_device *pdev)
drvdata->apb_clk = coresight_get_enable_apb_pclk(dev);
if (IS_ERR(drvdata->apb_clk))
- return -ENODEV;
+ return PTR_ERR(drvdata->apb_clk);
cfgs = of_device_get_match_data(dev);
if (cfgs) {
@@ -233,12 +233,8 @@ static int ctcu_probe(struct platform_device *pdev)
desc.access = CSDEV_ACCESS_IOMEM(base);
drvdata->csdev = coresight_register(&desc);
- if (IS_ERR(drvdata->csdev)) {
- if (!IS_ERR_OR_NULL(drvdata->apb_clk))
- clk_put(drvdata->apb_clk);
-
+ if (IS_ERR(drvdata->csdev))
return PTR_ERR(drvdata->csdev);
- }
return 0;
}
@@ -275,8 +271,6 @@ static void ctcu_platform_remove(struct platform_device *pdev)
ctcu_remove(pdev);
pm_runtime_disable(&pdev->dev);
- if (!IS_ERR_OR_NULL(drvdata->apb_clk))
- clk_put(drvdata->apb_clk);
}
#ifdef CONFIG_PM
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index 81f20a167e001..4b98a7bf4cb73 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -2309,14 +2309,12 @@ static int etm4_probe_platform_dev(struct platform_device *pdev)
drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev);
if (IS_ERR(drvdata->pclk))
- return -ENODEV;
+ return PTR_ERR(drvdata->pclk);
if (res) {
drvdata->base = devm_ioremap_resource(&pdev->dev, res);
- if (IS_ERR(drvdata->base)) {
- clk_put(drvdata->pclk);
+ if (IS_ERR(drvdata->base))
return PTR_ERR(drvdata->base);
- }
}
dev_set_drvdata(&pdev->dev, drvdata);
@@ -2423,9 +2421,6 @@ static void etm4_remove_platform_dev(struct platform_device *pdev)
if (drvdata)
etm4_remove_dev(drvdata);
pm_runtime_disable(&pdev->dev);
-
- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
- clk_put(drvdata->pclk);
}
static const struct amba_id etm4_ids[] = {
diff --git a/drivers/hwtracing/coresight/coresight-funnel.c b/drivers/hwtracing/coresight/coresight-funnel.c
index b1922dbe9292b..36fc4e991458c 100644
--- a/drivers/hwtracing/coresight/coresight-funnel.c
+++ b/drivers/hwtracing/coresight/coresight-funnel.c
@@ -240,7 +240,7 @@ static int funnel_probe(struct device *dev, struct resource *res)
drvdata->pclk = coresight_get_enable_apb_pclk(dev);
if (IS_ERR(drvdata->pclk))
- return -ENODEV;
+ return PTR_ERR(drvdata->pclk);
/*
* Map the device base for dynamic-funnel, which has been
@@ -284,8 +284,6 @@ static int funnel_probe(struct device *dev, struct resource *res)
out_disable_clk:
if (ret && !IS_ERR_OR_NULL(drvdata->atclk))
clk_disable_unprepare(drvdata->atclk);
- if (ret && !IS_ERR_OR_NULL(drvdata->pclk))
- clk_disable_unprepare(drvdata->pclk);
return ret;
}
@@ -355,8 +353,6 @@ static void funnel_platform_remove(struct platform_device *pdev)
funnel_remove(&pdev->dev);
pm_runtime_disable(&pdev->dev);
- if (!IS_ERR_OR_NULL(drvdata->pclk))
- clk_put(drvdata->pclk);
}
static const struct of_device_id funnel_match[] = {
diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c
index 06efd2b01a0f7..6dd24eb10a94b 100644
--- a/drivers/hwtracing/coresight/coresight-replicator.c
+++ b/drivers/hwtracing/coresight/coresight-replicator.c
@@ -247,7 +247,7 @@ static int replicator_probe(struct device *dev, struct resource *res)
drvdata->pclk = coresight_get_enable_apb_pclk(dev);
if (IS_ERR(drvdata->pclk))
- return -ENODEV;
+ return PTR_ERR(drvdata->pclk);
/*
* Map the device base for dynamic-replicator, which has been
@@ -296,8 +296,6 @@ static int replicator_probe(struct device *dev, struct resource *res)
out_disable_clk:
if (ret && !IS_ERR_OR_NULL(drvdata->atclk))
clk_disable_unprepare(drvdata->atclk);
- if (ret && !IS_ERR_OR_NULL(drvdata->pclk))
- clk_disable_unprepare(drvdata->pclk);
return ret;
}
@@ -335,8 +333,6 @@ static void replicator_platform_remove(struct platform_device *pdev)
replicator_remove(&pdev->dev);
pm_runtime_disable(&pdev->dev);
- if (!IS_ERR_OR_NULL(drvdata->pclk))
- clk_put(drvdata->pclk);
}
#ifdef CONFIG_PM
diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c
index e45c6c7204b44..88ee453b28154 100644
--- a/drivers/hwtracing/coresight/coresight-stm.c
+++ b/drivers/hwtracing/coresight/coresight-stm.c
@@ -851,7 +851,7 @@ static int __stm_probe(struct device *dev, struct resource *res)
drvdata->pclk = coresight_get_enable_apb_pclk(dev);
if (IS_ERR(drvdata->pclk))
- return -ENODEV;
+ return PTR_ERR(drvdata->pclk);
dev_set_drvdata(dev, drvdata);
base = devm_ioremap_resource(dev, res);
@@ -1033,8 +1033,6 @@ static void stm_platform_remove(struct platform_device *pdev)
__stm_remove(&pdev->dev);
pm_runtime_disable(&pdev->dev);
- if (!IS_ERR_OR_NULL(drvdata->pclk))
- clk_put(drvdata->pclk);
}
#ifdef CONFIG_ACPI
diff --git a/drivers/hwtracing/coresight/coresight-tmc-core.c b/drivers/hwtracing/coresight/coresight-tmc-core.c
index 0b5e7635a084d..e867198b03e82 100644
--- a/drivers/hwtracing/coresight/coresight-tmc-core.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-core.c
@@ -991,7 +991,7 @@ static int tmc_platform_probe(struct platform_device *pdev)
drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev);
if (IS_ERR(drvdata->pclk))
- return -ENODEV;
+ return PTR_ERR(drvdata->pclk);
dev_set_drvdata(&pdev->dev, drvdata);
pm_runtime_get_noresume(&pdev->dev);
@@ -1015,8 +1015,6 @@ static void tmc_platform_remove(struct platform_device *pdev)
__tmc_remove(&pdev->dev);
pm_runtime_disable(&pdev->dev);
- if (!IS_ERR_OR_NULL(drvdata->pclk))
- clk_put(drvdata->pclk);
}
#ifdef CONFIG_PM
diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c
index 3e01592884280..b2559c6fac6d2 100644
--- a/drivers/hwtracing/coresight/coresight-tpiu.c
+++ b/drivers/hwtracing/coresight/coresight-tpiu.c
@@ -153,7 +153,7 @@ static int __tpiu_probe(struct device *dev, struct resource *res)
drvdata->pclk = coresight_get_enable_apb_pclk(dev);
if (IS_ERR(drvdata->pclk))
- return -ENODEV;
+ return PTR_ERR(drvdata->pclk);
dev_set_drvdata(dev, drvdata);
/* Validity for the resource is already checked by the AMBA core */
@@ -293,8 +293,6 @@ static void tpiu_platform_remove(struct platform_device *pdev)
__tpiu_remove(&pdev->dev);
pm_runtime_disable(&pdev->dev);
- if (!IS_ERR_OR_NULL(drvdata->pclk))
- clk_put(drvdata->pclk);
}
#ifdef CONFIG_ACPI
diff --git a/include/linux/coresight.h b/include/linux/coresight.h
index 4ac65c68bbf44..1e652e1578419 100644
--- a/include/linux/coresight.h
+++ b/include/linux/coresight.h
@@ -6,6 +6,7 @@
#ifndef _LINUX_CORESIGHT_H
#define _LINUX_CORESIGHT_H
+#include <linux/acpi.h>
#include <linux/amba/bus.h>
#include <linux/clk.h>
#include <linux/device.h>
@@ -480,26 +481,21 @@ static inline bool is_coresight_device(void __iomem *base)
* Returns:
*
* clk - Clock is found and enabled
- * NULL - clock is not found
+ * NULL - Clock is controlled by firmware (ACPI device only)
* ERROR - Clock is found but failed to enable
*/
static inline struct clk *coresight_get_enable_apb_pclk(struct device *dev)
{
struct clk *pclk;
- int ret;
- pclk = clk_get(dev, "apb_pclk");
- if (IS_ERR(pclk)) {
- pclk = clk_get(dev, "apb");
- if (IS_ERR(pclk))
- return NULL;
- }
+ /* Firmware controls clocks for an ACPI device. */
+ if (has_acpi_companion(dev))
+ return NULL;
+
+ pclk = devm_clk_get_optional_enabled(dev, "apb_pclk");
+ if (!pclk)
+ pclk = devm_clk_get_optional_enabled(dev, "apb");
- ret = clk_prepare_enable(pclk);
- if (ret) {
- clk_put(pclk);
- return ERR_PTR(ret);
- }
return pclk;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 429/563] coresight: Appropriately disable trace bus clocks
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (427 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 428/563] coresight: Appropriately disable programming clocks Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 430/563] coresight: Avoid enable programming clock duplicately Greg Kroah-Hartman
` (147 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anshuman Khandual, Yeoreum Yun,
James Clark, Leo Yan, Suzuki K Poulose, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit a8f2d480f19d912f15dbac7038cd578d6b8b4d74 ]
Some CoreSight components have trace bus clocks 'atclk' and are enabled
using clk_prepare_enable(). These clocks are not disabled when modules
exit.
As atclk is optional, use devm_clk_get_optional_enabled() to manage it.
The benefit is the driver model layer can automatically disable and
release clocks.
Check the returned value with IS_ERR() to detect errors but leave the
NULL pointer case if the clock is not found. And remove the error
handling codes which are no longer needed.
Fixes: d1839e687773 ("coresight: etm: retrieve and handle atclk")
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
Tested-by: James Clark <james.clark@linaro.org>
Signed-off-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-5-1dfe10bb3f6f@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-etb10.c | 10 +++---
.../coresight/coresight-etm3x-core.c | 9 ++---
.../hwtracing/coresight/coresight-funnel.c | 36 ++++++-------------
.../coresight/coresight-replicator.c | 34 ++++++------------
drivers/hwtracing/coresight/coresight-stm.c | 9 ++---
drivers/hwtracing/coresight/coresight-tpiu.c | 10 ++----
6 files changed, 34 insertions(+), 74 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-etb10.c b/drivers/hwtracing/coresight/coresight-etb10.c
index d5efb085b30d3..8e81b41eb2226 100644
--- a/drivers/hwtracing/coresight/coresight-etb10.c
+++ b/drivers/hwtracing/coresight/coresight-etb10.c
@@ -730,12 +730,10 @@ static int etb_probe(struct amba_device *adev, const struct amba_id *id)
if (!drvdata)
return -ENOMEM;
- drvdata->atclk = devm_clk_get(&adev->dev, "atclk"); /* optional */
- if (!IS_ERR(drvdata->atclk)) {
- ret = clk_prepare_enable(drvdata->atclk);
- if (ret)
- return ret;
- }
+ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
+ if (IS_ERR(drvdata->atclk))
+ return PTR_ERR(drvdata->atclk);
+
dev_set_drvdata(dev, drvdata);
/* validity for the resource is already checked by the AMBA core */
diff --git a/drivers/hwtracing/coresight/coresight-etm3x-core.c b/drivers/hwtracing/coresight/coresight-etm3x-core.c
index 1c6204e144221..baba2245b1dfb 100644
--- a/drivers/hwtracing/coresight/coresight-etm3x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm3x-core.c
@@ -832,12 +832,9 @@ static int etm_probe(struct amba_device *adev, const struct amba_id *id)
spin_lock_init(&drvdata->spinlock);
- drvdata->atclk = devm_clk_get(&adev->dev, "atclk"); /* optional */
- if (!IS_ERR(drvdata->atclk)) {
- ret = clk_prepare_enable(drvdata->atclk);
- if (ret)
- return ret;
- }
+ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
+ if (IS_ERR(drvdata->atclk))
+ return PTR_ERR(drvdata->atclk);
drvdata->cpu = coresight_get_cpu(dev);
if (drvdata->cpu < 0)
diff --git a/drivers/hwtracing/coresight/coresight-funnel.c b/drivers/hwtracing/coresight/coresight-funnel.c
index 36fc4e991458c..b044a4125310b 100644
--- a/drivers/hwtracing/coresight/coresight-funnel.c
+++ b/drivers/hwtracing/coresight/coresight-funnel.c
@@ -213,7 +213,6 @@ ATTRIBUTE_GROUPS(coresight_funnel);
static int funnel_probe(struct device *dev, struct resource *res)
{
- int ret;
void __iomem *base;
struct coresight_platform_data *pdata = NULL;
struct funnel_drvdata *drvdata;
@@ -231,12 +230,9 @@ static int funnel_probe(struct device *dev, struct resource *res)
if (!drvdata)
return -ENOMEM;
- drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */
- if (!IS_ERR(drvdata->atclk)) {
- ret = clk_prepare_enable(drvdata->atclk);
- if (ret)
- return ret;
- }
+ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
+ if (IS_ERR(drvdata->atclk))
+ return PTR_ERR(drvdata->atclk);
drvdata->pclk = coresight_get_enable_apb_pclk(dev);
if (IS_ERR(drvdata->pclk))
@@ -248,10 +244,8 @@ static int funnel_probe(struct device *dev, struct resource *res)
*/
if (res) {
base = devm_ioremap_resource(dev, res);
- if (IS_ERR(base)) {
- ret = PTR_ERR(base);
- goto out_disable_clk;
- }
+ if (IS_ERR(base))
+ return PTR_ERR(base);
drvdata->base = base;
desc.groups = coresight_funnel_groups;
desc.access = CSDEV_ACCESS_IOMEM(base);
@@ -261,10 +255,9 @@ static int funnel_probe(struct device *dev, struct resource *res)
dev_set_drvdata(dev, drvdata);
pdata = coresight_get_platform_data(dev);
- if (IS_ERR(pdata)) {
- ret = PTR_ERR(pdata);
- goto out_disable_clk;
- }
+ if (IS_ERR(pdata))
+ return PTR_ERR(pdata);
+
dev->platform_data = pdata;
raw_spin_lock_init(&drvdata->spinlock);
@@ -274,17 +267,10 @@ static int funnel_probe(struct device *dev, struct resource *res)
desc.pdata = pdata;
desc.dev = dev;
drvdata->csdev = coresight_register(&desc);
- if (IS_ERR(drvdata->csdev)) {
- ret = PTR_ERR(drvdata->csdev);
- goto out_disable_clk;
- }
+ if (IS_ERR(drvdata->csdev))
+ return PTR_ERR(drvdata->csdev);
- ret = 0;
-
-out_disable_clk:
- if (ret && !IS_ERR_OR_NULL(drvdata->atclk))
- clk_disable_unprepare(drvdata->atclk);
- return ret;
+ return 0;
}
static int funnel_remove(struct device *dev)
diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c
index 6dd24eb10a94b..9e8bd36e7a9a2 100644
--- a/drivers/hwtracing/coresight/coresight-replicator.c
+++ b/drivers/hwtracing/coresight/coresight-replicator.c
@@ -219,7 +219,6 @@ static const struct attribute_group *replicator_groups[] = {
static int replicator_probe(struct device *dev, struct resource *res)
{
- int ret = 0;
struct coresight_platform_data *pdata = NULL;
struct replicator_drvdata *drvdata;
struct coresight_desc desc = { 0 };
@@ -238,12 +237,9 @@ static int replicator_probe(struct device *dev, struct resource *res)
if (!drvdata)
return -ENOMEM;
- drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */
- if (!IS_ERR(drvdata->atclk)) {
- ret = clk_prepare_enable(drvdata->atclk);
- if (ret)
- return ret;
- }
+ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
+ if (IS_ERR(drvdata->atclk))
+ return PTR_ERR(drvdata->atclk);
drvdata->pclk = coresight_get_enable_apb_pclk(dev);
if (IS_ERR(drvdata->pclk))
@@ -255,10 +251,8 @@ static int replicator_probe(struct device *dev, struct resource *res)
*/
if (res) {
base = devm_ioremap_resource(dev, res);
- if (IS_ERR(base)) {
- ret = PTR_ERR(base);
- goto out_disable_clk;
- }
+ if (IS_ERR(base))
+ return PTR_ERR(base);
drvdata->base = base;
desc.groups = replicator_groups;
desc.access = CSDEV_ACCESS_IOMEM(base);
@@ -272,10 +266,8 @@ static int replicator_probe(struct device *dev, struct resource *res)
dev_set_drvdata(dev, drvdata);
pdata = coresight_get_platform_data(dev);
- if (IS_ERR(pdata)) {
- ret = PTR_ERR(pdata);
- goto out_disable_clk;
- }
+ if (IS_ERR(pdata))
+ return PTR_ERR(pdata);
dev->platform_data = pdata;
raw_spin_lock_init(&drvdata->spinlock);
@@ -286,17 +278,11 @@ static int replicator_probe(struct device *dev, struct resource *res)
desc.dev = dev;
drvdata->csdev = coresight_register(&desc);
- if (IS_ERR(drvdata->csdev)) {
- ret = PTR_ERR(drvdata->csdev);
- goto out_disable_clk;
- }
+ if (IS_ERR(drvdata->csdev))
+ return PTR_ERR(drvdata->csdev);
replicator_reset(drvdata);
-
-out_disable_clk:
- if (ret && !IS_ERR_OR_NULL(drvdata->atclk))
- clk_disable_unprepare(drvdata->atclk);
- return ret;
+ return 0;
}
static int replicator_remove(struct device *dev)
diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c
index 88ee453b28154..57fbe3ad0fb20 100644
--- a/drivers/hwtracing/coresight/coresight-stm.c
+++ b/drivers/hwtracing/coresight/coresight-stm.c
@@ -842,12 +842,9 @@ static int __stm_probe(struct device *dev, struct resource *res)
if (!drvdata)
return -ENOMEM;
- drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */
- if (!IS_ERR(drvdata->atclk)) {
- ret = clk_prepare_enable(drvdata->atclk);
- if (ret)
- return ret;
- }
+ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
+ if (IS_ERR(drvdata->atclk))
+ return PTR_ERR(drvdata->atclk);
drvdata->pclk = coresight_get_enable_apb_pclk(dev);
if (IS_ERR(drvdata->pclk))
diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c
index b2559c6fac6d2..8d6179c83e5d3 100644
--- a/drivers/hwtracing/coresight/coresight-tpiu.c
+++ b/drivers/hwtracing/coresight/coresight-tpiu.c
@@ -128,7 +128,6 @@ static const struct coresight_ops tpiu_cs_ops = {
static int __tpiu_probe(struct device *dev, struct resource *res)
{
- int ret;
void __iomem *base;
struct coresight_platform_data *pdata = NULL;
struct tpiu_drvdata *drvdata;
@@ -144,12 +143,9 @@ static int __tpiu_probe(struct device *dev, struct resource *res)
spin_lock_init(&drvdata->spinlock);
- drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */
- if (!IS_ERR(drvdata->atclk)) {
- ret = clk_prepare_enable(drvdata->atclk);
- if (ret)
- return ret;
- }
+ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
+ if (IS_ERR(drvdata->atclk))
+ return PTR_ERR(drvdata->atclk);
drvdata->pclk = coresight_get_enable_apb_pclk(dev);
if (IS_ERR(drvdata->pclk))
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 430/563] coresight: Avoid enable programming clock duplicately
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (428 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 429/563] coresight: Appropriately disable trace bus clocks Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 431/563] coresight: trbe: Return NULL pointer for allocation failures Greg Kroah-Hartman
` (146 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anshuman Khandual, Yeoreum Yun,
James Clark, Leo Yan, Suzuki K Poulose, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit d091c6312561821f216ced63a7ad17c946b6d335 ]
The programming clock is enabled by AMBA bus driver before a dynamic
probe. As a result, a CoreSight driver may redundantly enable the same
clock.
To avoid this, add a check for device type and skip enabling the
programming clock for AMBA devices. The returned NULL pointer will be
tolerated by the drivers.
Fixes: 73d779a03a76 ("coresight: etm4x: Change etm4_platform_driver driver for MMIO devices")
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
Tested-by: James Clark <james.clark@linaro.org>
Signed-off-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-6-1dfe10bb3f6f@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/coresight.h | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/include/linux/coresight.h b/include/linux/coresight.h
index 1e652e1578419..bb49080ec8f96 100644
--- a/include/linux/coresight.h
+++ b/include/linux/coresight.h
@@ -481,20 +481,23 @@ static inline bool is_coresight_device(void __iomem *base)
* Returns:
*
* clk - Clock is found and enabled
- * NULL - Clock is controlled by firmware (ACPI device only)
+ * NULL - Clock is controlled by firmware (ACPI device only) or when managed
+ * by the AMBA bus driver instead
* ERROR - Clock is found but failed to enable
*/
static inline struct clk *coresight_get_enable_apb_pclk(struct device *dev)
{
- struct clk *pclk;
+ struct clk *pclk = NULL;
/* Firmware controls clocks for an ACPI device. */
if (has_acpi_companion(dev))
return NULL;
- pclk = devm_clk_get_optional_enabled(dev, "apb_pclk");
- if (!pclk)
- pclk = devm_clk_get_optional_enabled(dev, "apb");
+ if (!dev_is_amba(dev)) {
+ pclk = devm_clk_get_optional_enabled(dev, "apb_pclk");
+ if (!pclk)
+ pclk = devm_clk_get_optional_enabled(dev, "apb");
+ }
return pclk;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 431/563] coresight: trbe: Return NULL pointer for allocation failures
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (429 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 430/563] coresight: Avoid enable programming clock duplicately Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 432/563] coresight: tpda: fix the logic to setup the element size Greg Kroah-Hartman
` (145 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tamas Zsoldos, Leo Yan, James Clark,
Suzuki K Poulose, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit 8a55c161f7f9c1aa1c70611b39830d51c83ef36d ]
When the TRBE driver fails to allocate a buffer, it currently returns
the error code "-ENOMEM". However, the caller etm_setup_aux() only
checks for a NULL pointer, so it misses the error. As a result, the
driver continues and eventually causes a kernel panic.
Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on
allocation failures. This allows that the callers can properly handle
the failure.
Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
Reported-by: Tamas Zsoldos <tamas.zsoldos@arm.com>
Signed-off-by: Leo Yan <leo.yan@arm.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20250904-cs_etm_auxsetup_fix_error_handling-v2-1-a502d0bafb95@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-trbe.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
index f78c9b9dc0087..3dd2e1b4809dc 100644
--- a/drivers/hwtracing/coresight/coresight-trbe.c
+++ b/drivers/hwtracing/coresight/coresight-trbe.c
@@ -749,12 +749,12 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
buf = kzalloc_node(sizeof(*buf), GFP_KERNEL, trbe_alloc_node(event));
if (!buf)
- return ERR_PTR(-ENOMEM);
+ return NULL;
pglist = kcalloc(nr_pages, sizeof(*pglist), GFP_KERNEL);
if (!pglist) {
kfree(buf);
- return ERR_PTR(-ENOMEM);
+ return NULL;
}
for (i = 0; i < nr_pages; i++)
@@ -764,7 +764,7 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
if (!buf->trbe_base) {
kfree(pglist);
kfree(buf);
- return ERR_PTR(-ENOMEM);
+ return NULL;
}
buf->trbe_limit = buf->trbe_base + nr_pages * PAGE_SIZE;
buf->trbe_write = buf->trbe_base;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 432/563] coresight: tpda: fix the logic to setup the element size
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (430 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 431/563] coresight: trbe: Return NULL pointer for allocation failures Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 433/563] coresight: Fix incorrect handling for return value of devm_kzalloc Greg Kroah-Hartman
` (144 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Clark, Jie Gan,
Suzuki K Poulose, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Gan <jie.gan@oss.qualcomm.com>
[ Upstream commit 43e0a92c04de7c822f6104abc73caa4a857b4a02 ]
Some TPDM devices support both CMB and DSB datasets, requiring
the system to enable the port with both corresponding element sizes.
Currently, the logic treats tpdm_read_element_size as successful if
the CMB element size is retrieved correctly, regardless of whether
the DSB element size is obtained. This behavior causes issues
when parsing data from TPDM devices that depend on both element sizes.
To address this, the function should explicitly fail if the DSB
element size cannot be read correctly.
Fixes: e6d7f5252f73 ("coresight-tpda: Add support to configure CMB element")
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Jie Gan <jie.gan@oss.qualcomm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20250906-fix_element_size_issue-v2-1-dbb0ac2541a9@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-tpda.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/hwtracing/coresight/coresight-tpda.c b/drivers/hwtracing/coresight/coresight-tpda.c
index 0633f04beb240..333b3cb236859 100644
--- a/drivers/hwtracing/coresight/coresight-tpda.c
+++ b/drivers/hwtracing/coresight/coresight-tpda.c
@@ -71,6 +71,8 @@ static int tpdm_read_element_size(struct tpda_drvdata *drvdata,
if (tpdm_data->dsb) {
rc = fwnode_property_read_u32(dev_fwnode(csdev->dev.parent),
"qcom,dsb-element-bits", &drvdata->dsb_esize);
+ if (rc)
+ goto out;
}
if (tpdm_data->cmb) {
@@ -78,6 +80,7 @@ static int tpdm_read_element_size(struct tpda_drvdata *drvdata,
"qcom,cmb-element-bits", &drvdata->cmb_esize);
}
+out:
if (rc)
dev_warn_once(&csdev->dev,
"Failed to read TPDM Element size: %d\n", rc);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 433/563] coresight: Fix incorrect handling for return value of devm_kzalloc
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (431 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 432/563] coresight: tpda: fix the logic to setup the element size Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 434/563] NFSv4.1: fix backchannel max_resp_sz verification check Greg Kroah-Hartman
` (143 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lin Yujun, James Clark,
Suzuki K Poulose, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Yujun <linyujun809@h-partners.com>
[ Upstream commit 70714eb7243eaf333d23501d4c7bdd9daf011c01 ]
The return value of devm_kzalloc could be an null pointer,
use "!desc.pdata" to fix incorrect handling return value
of devm_kzalloc.
Fixes: 4277f035d227 ("coresight: trbe: Add a representative coresight_platform_data for TRBE")
Signed-off-by: Lin Yujun <linyujun809@h-partners.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20250908122022.1315399-1-linyujun809@h-partners.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-trbe.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
index 3dd2e1b4809dc..43643d2c5bdd0 100644
--- a/drivers/hwtracing/coresight/coresight-trbe.c
+++ b/drivers/hwtracing/coresight/coresight-trbe.c
@@ -1281,7 +1281,7 @@ static void arm_trbe_register_coresight_cpu(struct trbe_drvdata *drvdata, int cp
* into the device for that purpose.
*/
desc.pdata = devm_kzalloc(dev, sizeof(*desc.pdata), GFP_KERNEL);
- if (IS_ERR(desc.pdata))
+ if (!desc.pdata)
goto cpu_clear;
desc.type = CORESIGHT_DEV_TYPE_SINK;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 434/563] NFSv4.1: fix backchannel max_resp_sz verification check
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (432 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 433/563] coresight: Fix incorrect handling for return value of devm_kzalloc Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 435/563] net: ethtool: tsconfig: set command must provide a reply Greg Kroah-Hartman
` (142 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anthony Iliopoulos,
Benjamin Coddington, Anna Schumaker, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Iliopoulos <ailiop@suse.com>
[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ]
When the client max_resp_sz is larger than what the server encodes in
its reply, the nfs4_verify_back_channel_attrs() check fails and this
causes nfs4_proc_create_session() to fail, in cases where the client
page size is larger than that of the server and the server does not want
to negotiate upwards.
While this is not a problem with the linux nfs server that will reflect
the proposed value in its reply irrespective of the local page size,
other nfs server implementations may insist on their own max_resp_sz
value, which could be smaller.
Fix this by accepting smaller max_resp_sz values from the server, as
this does not violate the protocol. The server is allowed to decrease
but not increase proposed the size, and as such values smaller than the
client-proposed ones are valid.
Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks")
Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs4proc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index ce61253efd45b..611e6283c194f 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -9442,7 +9442,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args
goto out;
if (rcvd->max_rqst_sz > sent->max_rqst_sz)
return -EINVAL;
- if (rcvd->max_resp_sz < sent->max_resp_sz)
+ if (rcvd->max_resp_sz > sent->max_resp_sz)
return -EINVAL;
if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached)
return -EINVAL;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 435/563] net: ethtool: tsconfig: set command must provide a reply
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (433 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 434/563] NFSv4.1: fix backchannel max_resp_sz verification check Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 436/563] ipvs: Defer ip_vs_ftp unregister during netns cleanup Greg Kroah-Hartman
` (141 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vadim Fedorenko, Kory Maincent,
Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vadim Fedorenko <vadfed@meta.com>
[ Upstream commit e8ab231782e92bc26e5eb605263525636a2f7ae7 ]
Timestamping configuration through ethtool has inconsistent behavior of
skipping the reply for set command if configuration was not changed. Fix
it be providing reply in any case.
Fixes: 6e9e2eed4f39d ("net: ethtool: Add support for tsconfig command to get/set hwtstamp config")
Signed-off-by: Vadim Fedorenko <vadfed@meta.com>
Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
Link: https://patch.msgid.link/20250922231924.2769571-1-vadfed@meta.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ethtool/tsconfig.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/net/ethtool/tsconfig.c b/net/ethtool/tsconfig.c
index 2be356bdfe873..169b413b31fc5 100644
--- a/net/ethtool/tsconfig.c
+++ b/net/ethtool/tsconfig.c
@@ -423,13 +423,11 @@ static int ethnl_set_tsconfig(struct ethnl_req_info *req_base,
return ret;
}
- if (hwprov_mod || config_mod) {
- ret = tsconfig_send_reply(dev, info);
- if (ret && ret != -EOPNOTSUPP) {
- NL_SET_ERR_MSG(info->extack,
- "error while reading the new configuration set");
- return ret;
- }
+ ret = tsconfig_send_reply(dev, info);
+ if (ret && ret != -EOPNOTSUPP) {
+ NL_SET_ERR_MSG(info->extack,
+ "error while reading the new configuration set");
+ return ret;
}
/* tsconfig has no notification */
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 436/563] ipvs: Defer ip_vs_ftp unregister during netns cleanup
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (434 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 435/563] net: ethtool: tsconfig: set command must provide a reply Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 437/563] netfilter: nfnetlink: reset nlh pointer during batch replay Greg Kroah-Hartman
` (140 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Julian Anastasov, Slavin Liu,
Florian Westphal, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Slavin Liu <slavin452@gmail.com>
[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ]
On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp
before connections with valid cp->app pointers are flushed, leading to a
use-after-free.
Fix this by introducing a global `exiting_module` flag, set to true in
ip_vs_ftp_exit() before unregistering the pernet subsystem. In
__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns
cleanup (when exiting_module is false) and defer it to
__ip_vs_cleanup_batch(), which unregisters all apps after all connections
are flushed. If called during module exit, unregister ip_vs_ftp
immediately.
Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.")
Suggested-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Slavin Liu <slavin452@gmail.com>
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/ipvs/ip_vs_ftp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index d8a284999544b..206c6700e2006 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -53,6 +53,7 @@ enum {
IP_VS_FTP_EPSV,
};
+static bool exiting_module;
/*
* List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper
* First port is set to the default port.
@@ -605,7 +606,7 @@ static void __ip_vs_ftp_exit(struct net *net)
{
struct netns_ipvs *ipvs = net_ipvs(net);
- if (!ipvs)
+ if (!ipvs || !exiting_module)
return;
unregister_ip_vs_app(ipvs, &ip_vs_ftp);
@@ -627,6 +628,7 @@ static int __init ip_vs_ftp_init(void)
*/
static void __exit ip_vs_ftp_exit(void)
{
+ exiting_module = true;
unregister_pernet_subsys(&ip_vs_ftp_ops);
/* rcu_barrier() is called by netns */
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 437/563] netfilter: nfnetlink: reset nlh pointer during batch replay
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (435 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 436/563] ipvs: Defer ip_vs_ftp unregister during netns cleanup Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:44 ` [PATCH 6.17 438/563] netfilter: nf_conntrack: do not skip entries in /proc/net/nf_conntrack Greg Kroah-Hartman
` (139 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fernando Fernandez Mancera,
Florian Westphal, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit 09efbac953f6f076a07735f9ba885148d4796235 ]
During a batch replay, the nlh pointer is not reset until the parsing of
the commands. Since commit bf2ac490d28c ("netfilter: nfnetlink: Handle
ACK flags for batch messages") that is problematic as the condition to
add an ACK for batch begin will evaluate to true even if NLM_F_ACK
wasn't used for batch begin message.
If there is an error during the command processing, netlink is sending
an ACK despite that. This misleads userspace tools which think that the
return code was 0. Reset the nlh pointer to the original one when a
replay is triggered.
Fixes: bf2ac490d28c ("netfilter: nfnetlink: Handle ACK flags for batch messages")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nfnetlink.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index e598a2a252b0a..811d02b4c4f7c 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -376,6 +376,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
const struct nfnetlink_subsystem *ss;
const struct nfnl_callback *nc;
struct netlink_ext_ack extack;
+ struct nlmsghdr *onlh = nlh;
LIST_HEAD(err_list);
u32 status;
int err;
@@ -386,6 +387,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
status = 0;
replay_abort:
skb = netlink_skb_clone(oskb, GFP_KERNEL);
+ nlh = onlh;
if (!skb)
return netlink_ack(oskb, nlh, -ENOMEM, NULL);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 438/563] netfilter: nf_conntrack: do not skip entries in /proc/net/nf_conntrack
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (436 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 437/563] netfilter: nfnetlink: reset nlh pointer during batch replay Greg Kroah-Hartman
@ 2025-10-13 14:44 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 439/563] scsi: ufs: core: Fix data race in CPU latency PM QoS request handling Greg Kroah-Hartman
` (138 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Florian Westphal,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit c5ba345b2d358b07cc4f07253ba1ada73e77d586 ]
ct_seq_show() has an opportunistic garbage collector :
if (nf_ct_should_gc(ct)) {
nf_ct_kill(ct);
goto release;
}
So if one nf_conn is killed there, next time ct_get_next() runs,
we skip the following item in the bucket, even if it should have
been displayed if gc did not take place.
We can decrement st->skip_elems to tell ct_get_next() one of the items
was removed from the chain.
Fixes: 58e207e4983d ("netfilter: evict stale entries when user reads /proc/net/nf_conntrack")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_standalone.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 1f14ef0436c65..708b79380f047 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -317,6 +317,9 @@ static int ct_seq_show(struct seq_file *s, void *v)
smp_acquire__after_ctrl_dep();
if (nf_ct_should_gc(ct)) {
+ struct ct_iter_state *st = s->private;
+
+ st->skip_elems--;
nf_ct_kill(ct);
goto release;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 439/563] scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (437 preceding siblings ...)
2025-10-13 14:44 ` [PATCH 6.17 438/563] netfilter: nf_conntrack: do not skip entries in /proc/net/nf_conntrack Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 440/563] scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() Greg Kroah-Hartman
` (137 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhongqiu Han, Bart Van Assche,
Huan Tang, Martin K. Petersen, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
[ Upstream commit 79dde5f7dc7c038eec903745dc1550cd4139980e ]
The cpu_latency_qos_add/remove/update_request interfaces lack internal
synchronization by design, requiring the caller to ensure thread safety.
The current implementation relies on the 'pm_qos_enabled' flag, which is
insufficient to prevent concurrent access and cannot serve as a proper
synchronization mechanism. This has led to data races and list
corruption issues.
A typical race condition call trace is:
[Thread A]
ufshcd_pm_qos_exit()
--> cpu_latency_qos_remove_request()
--> cpu_latency_qos_apply();
--> pm_qos_update_target()
--> plist_del <--(1) delete plist node
--> memset(req, 0, sizeof(*req));
--> hba->pm_qos_enabled = false;
[Thread B]
ufshcd_devfreq_target
--> ufshcd_devfreq_scale
--> ufshcd_scale_clks
--> ufshcd_pm_qos_update <--(2) pm_qos_enabled is true
--> cpu_latency_qos_update_request
--> pm_qos_update_target
--> plist_del <--(3) plist node use-after-free
Introduces a dedicated mutex to serialize PM QoS operations, preventing
data races and ensuring safe access to PM QoS resources, including sysfs
interface reads.
Fixes: 2777e73fc154 ("scsi: ufs: core: Add CPU latency QoS support for UFS driver")
Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Tested-by: Huan Tang <tanghuan@vivo.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/core/ufs-sysfs.c | 2 ++
drivers/ufs/core/ufshcd.c | 9 +++++++++
include/ufs/ufshcd.h | 3 +++
3 files changed, 14 insertions(+)
diff --git a/drivers/ufs/core/ufs-sysfs.c b/drivers/ufs/core/ufs-sysfs.c
index 4bd7d491e3c5a..0086816b27cd9 100644
--- a/drivers/ufs/core/ufs-sysfs.c
+++ b/drivers/ufs/core/ufs-sysfs.c
@@ -512,6 +512,8 @@ static ssize_t pm_qos_enable_show(struct device *dev,
{
struct ufs_hba *hba = dev_get_drvdata(dev);
+ guard(mutex)(&hba->pm_qos_mutex);
+
return sysfs_emit(buf, "%d\n", hba->pm_qos_enabled);
}
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index 9a43102b2b21e..f2b6d1e94f76b 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -1045,6 +1045,7 @@ EXPORT_SYMBOL_GPL(ufshcd_is_hba_active);
*/
void ufshcd_pm_qos_init(struct ufs_hba *hba)
{
+ guard(mutex)(&hba->pm_qos_mutex);
if (hba->pm_qos_enabled)
return;
@@ -1061,6 +1062,8 @@ void ufshcd_pm_qos_init(struct ufs_hba *hba)
*/
void ufshcd_pm_qos_exit(struct ufs_hba *hba)
{
+ guard(mutex)(&hba->pm_qos_mutex);
+
if (!hba->pm_qos_enabled)
return;
@@ -1075,6 +1078,8 @@ void ufshcd_pm_qos_exit(struct ufs_hba *hba)
*/
static void ufshcd_pm_qos_update(struct ufs_hba *hba, bool on)
{
+ guard(mutex)(&hba->pm_qos_mutex);
+
if (!hba->pm_qos_enabled)
return;
@@ -10756,6 +10761,10 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq)
mutex_init(&hba->ee_ctrl_mutex);
mutex_init(&hba->wb_mutex);
+
+ /* Initialize mutex for PM QoS request synchronization */
+ mutex_init(&hba->pm_qos_mutex);
+
init_rwsem(&hba->clk_scaling_lock);
ufshcd_init_clk_gating(hba);
diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h
index 1d39437775842..a3fa98540d184 100644
--- a/include/ufs/ufshcd.h
+++ b/include/ufs/ufshcd.h
@@ -963,6 +963,7 @@ enum ufshcd_mcq_opr {
* @ufs_rtc_update_work: A work for UFS RTC periodic update
* @pm_qos_req: PM QoS request handle
* @pm_qos_enabled: flag to check if pm qos is enabled
+ * @pm_qos_mutex: synchronizes PM QoS request and status updates
* @critical_health_count: count of critical health exceptions
* @dev_lvl_exception_count: count of device level exceptions since last reset
* @dev_lvl_exception_id: vendor specific information about the
@@ -1136,6 +1137,8 @@ struct ufs_hba {
struct delayed_work ufs_rtc_update_work;
struct pm_qos_request pm_qos_req;
bool pm_qos_enabled;
+ /* synchronizes PM QoS request and status updates */
+ struct mutex pm_qos_mutex;
int critical_health_count;
atomic_t dev_lvl_exception_count;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 440/563] scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (438 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 439/563] scsi: ufs: core: Fix data race in CPU latency PM QoS request handling Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 441/563] usb: vhci-hcd: Prevent suspending virtually attached devices Greg Kroah-Hartman
` (136 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ranjan Kumar, Martin K. Petersen,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranjan Kumar <ranjan.kumar@broadcom.com>
[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ]
During mpt3sas_transport_port_remove(), messages were logged with
dev_printk() against &mpt3sas_port->port->dev. At this point the SAS
transport device may already be partially unregistered or freed, leading
to a crash when accessing its struct device.
Using ioc_info(), which logs via the PCI device (ioc->pdev->dev),
guaranteed to remain valid until driver removal.
[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI
[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary)
[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024
[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70
[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff
[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206
[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32
[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845
[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8
[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000
[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30
[83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000
[83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0
[83428.295844] PKRU: 55555554
[83428.295846] Call Trace:
[83428.295848] <TASK>
[83428.295850] _dev_printk+0x5c/0x80
[83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5
[83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas]
[83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas]
[83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas]
[83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5
[83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas]
[83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas]
[83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas]
[83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas]
[83428.295957] pci_device_remove+0x3b/0xb0
[83428.295962] device_release_driver_internal+0x193/0x200
[83428.295968] driver_detach+0x44/0x90
[83428.295971] bus_remove_driver+0x69/0xf0
[83428.295975] pci_unregister_driver+0x2a/0xb0
[83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas]
[83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310
[83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5
[83428.296000] ? __x64_sys_getdents64+0x9a/0x110
[83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5
[83428.296009] ? syscall_trace_enter+0xf6/0x1b0
[83428.296014] do_syscall_64+0x7b/0x2c0
[83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5
[83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e
Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
index dc74ebc6405ac..66fd301f03b0d 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
@@ -987,11 +987,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,
list_for_each_entry_safe(mpt3sas_phy, next_phy,
&mpt3sas_port->phy_list, port_siblings) {
if ((ioc->logging_level & MPT_DEBUG_TRANSPORT))
- dev_printk(KERN_INFO, &mpt3sas_port->port->dev,
- "remove: sas_addr(0x%016llx), phy(%d)\n",
- (unsigned long long)
- mpt3sas_port->remote_identify.sas_address,
- mpt3sas_phy->phy_id);
+ ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n",
+ (unsigned long long) mpt3sas_port->remote_identify.sas_address,
+ mpt3sas_phy->phy_id);
mpt3sas_phy->phy_belongs_to_port = 0;
if (!ioc->remove_host)
sas_port_delete_phy(mpt3sas_port->port,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 441/563] usb: vhci-hcd: Prevent suspending virtually attached devices
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (439 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 440/563] scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 442/563] PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion Greg Kroah-Hartman
` (135 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cristian Ciocaltea, Shuah Khan,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ]
The VHCI platform driver aims to forbid entering system suspend when at
least one of the virtual USB ports are bound to an active USB/IP
connection.
However, in some cases, the detection logic doesn't work reliably, i.e.
when all devices attached to the virtual root hub have been already
suspended, leading to a broken suspend state, with unrecoverable resume.
Ensure the virtually attached devices do not enter suspend by setting
the syscore PM flag. Note this is currently limited to the client side
only, since the server side doesn't implement system suspend prevention.
Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver")
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Acked-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/20250902-vhci-hcd-suspend-fix-v3-1-864e4e833559@collabora.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index e70fba9f55d6a..0d6c10a8490c0 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -765,6 +765,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
ctrlreq->wValue, vdev->rhport);
vdev->udev = usb_get_dev(urb->dev);
+ /*
+ * NOTE: A similar operation has been done via
+ * USB_REQ_GET_DESCRIPTOR handler below, which is
+ * supposed to always precede USB_REQ_SET_ADDRESS.
+ *
+ * It's not entirely clear if operating on a different
+ * usb_device instance here is a real possibility,
+ * otherwise this call and vdev->udev assignment above
+ * should be dropped.
+ */
+ dev_pm_syscore_device(&vdev->udev->dev, true);
usb_put_dev(old);
spin_lock(&vdev->ud.lock);
@@ -785,6 +796,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
"Not yet?:Get_Descriptor to device 0 (get max pipe size)\n");
vdev->udev = usb_get_dev(urb->dev);
+ /*
+ * Set syscore PM flag for the virtually attached
+ * devices to ensure they will not enter suspend on
+ * the client side.
+ *
+ * Note this doesn't have any impact on the physical
+ * devices attached to the host system on the server
+ * side, hence there is no need to undo the operation
+ * on disconnect.
+ */
+ dev_pm_syscore_device(&vdev->udev->dev, true);
usb_put_dev(old);
goto out;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 442/563] PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (440 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 441/563] usb: vhci-hcd: Prevent suspending virtually attached devices Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 443/563] PCI: rcar-gen4: Assure reset occurs before DBI access Greg Kroah-Hartman
` (134 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Marek Vasut,
Manivannan Sadhasivam, Bjorn Helgaas, Geert Uytterhoeven,
Krzysztof Wilczyński, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marek.vasut+renesas@mailbox.org>
[ Upstream commit 8795b70581770657cd5ead3c965348f05242580f ]
R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 585
Figure 9.3.2 Software Reset flow (B) indicates that for peripherals in HSC
domain, after reset has been asserted by writing a matching reset bit into
register SRCR, it is mandatory to wait 1ms.
Because it is the controller driver which can determine whether or not the
controller is in HSC domain based on its compatible string, add the missing
delay in the controller driver.
This 1ms delay is documented on R-Car V4H and V4M; it is currently unclear
whether S4 is affected as well. This patch does apply the extra delay on
R-Car S4 as well.
Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode")
Suggested-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
[mani: added the missing r-b tag from Krzysztof]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Link: https://patch.msgid.link/20250919134644.208098-1-marek.vasut+renesas@mailbox.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-rcar-gen4.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
index 18055807a4f5f..d9a42fa51520a 100644
--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
@@ -182,8 +182,17 @@ static int rcar_gen4_pcie_common_init(struct rcar_gen4_pcie *rcar)
return ret;
}
- if (!reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc))
+ if (!reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc)) {
reset_control_assert(dw->core_rsts[DW_PCIE_PWR_RST].rstc);
+ /*
+ * R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr.
+ * 21, 2025 page 585 Figure 9.3.2 Software Reset flow (B)
+ * indicates that for peripherals in HSC domain, after
+ * reset has been asserted by writing a matching reset bit
+ * into register SRCR, it is mandatory to wait 1ms.
+ */
+ fsleep(1000);
+ }
val = readl(rcar->base + PCIEMSR0);
if (rcar->drvdata->mode == DW_PCIE_RC_TYPE) {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 443/563] PCI: rcar-gen4: Assure reset occurs before DBI access
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (441 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 442/563] PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 444/563] PCI: rcar-gen4: Fix inverted break condition in PHY initialization Greg Kroah-Hartman
` (133 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Manivannan Sadhasivam,
Bjorn Helgaas, Geert Uytterhoeven, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marek.vasut+renesas@mailbox.org>
[ Upstream commit 0056d29f8c1b13d7e60d60cdb159767ac8f6a883 ]
Assure the reset is latched and the core is ready for DBI access. On R-Car
V4H, the PCIe reset is asynchronous and does not take effect immediately,
but needs a short time to complete. In case DBI access happens in that
short time, that access generates an SError. Make sure that condition can
never happen, read back the state of the reset, which should turn the
asynchronous reset into a synchronous one, and wait a little over 1ms to
add additional safety margin.
Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20250924005610.96484-1-marek.vasut+renesas@mailbox.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-rcar-gen4.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
index d9a42fa51520a..9ac3f0f11adad 100644
--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
@@ -213,6 +213,19 @@ static int rcar_gen4_pcie_common_init(struct rcar_gen4_pcie *rcar)
if (ret)
goto err_unprepare;
+ /*
+ * Assure the reset is latched and the core is ready for DBI access.
+ * On R-Car V4H, the PCIe reset is asynchronous and does not take
+ * effect immediately, but needs a short time to complete. In case
+ * DBI access happens in that short time, that access generates an
+ * SError. To make sure that condition can never happen, read back the
+ * state of the reset, which should turn the asynchronous reset into
+ * synchronous one, and wait a little over 1ms to add additional
+ * safety margin.
+ */
+ reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc);
+ fsleep(1000);
+
if (rcar->drvdata->additional_common_init)
rcar->drvdata->additional_common_init(rcar);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 444/563] PCI: rcar-gen4: Fix inverted break condition in PHY initialization
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (442 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 443/563] PCI: rcar-gen4: Assure reset occurs before DBI access Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 445/563] ASoC: qcom: sc8280xp: use sa8775p/ subdir for QCS9100 / QCS9075 Greg Kroah-Hartman
` (132 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Manivannan Sadhasivam,
Bjorn Helgaas, Geert Uytterhoeven, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marek.vasut+renesas@mailbox.org>
[ Upstream commit 2bdf1d428f48e1077791bb7f88fd00262118256d ]
R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 4581
Figure 104.3b Initial Setting of PCIEC(example), third quarter of the
figure indicates that register 0xf8 should be polled until bit 18 becomes
set to 1.
Register 0xf8, bit 18 is 0 immediately after write to PCIERSTCTRL1 and is
set to 1 in less than 1 ms afterward. The current readl_poll_timeout()
break condition is inverted and returns when register 0xf8, bit 18 is set
to 0, which in most cases means immediately. In case
CONFIG_DEBUG_LOCK_ALLOC=y, the timing changes just enough for the first
readl_poll_timeout() poll to already read register 0xf8, bit 18 as 1 and
afterward never read register 0xf8, bit 18 as 0, which leads to timeout
and failure to start the PCIe controller.
Fix this by inverting the poll condition to match the reference manual
initialization sequence.
Fixes: faf5a975ee3b ("PCI: rcar-gen4: Add support for R-Car V4H")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20250915235910.47768-1-marek.vasut+renesas@mailbox.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-rcar-gen4.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
index 9ac3f0f11adad..c16c4c2be4993 100644
--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
@@ -733,7 +733,7 @@ static int rcar_gen4_pcie_ltssm_control(struct rcar_gen4_pcie *rcar, bool enable
val &= ~APP_HOLD_PHY_RST;
writel(val, rcar->base + PCIERSTCTRL1);
- ret = readl_poll_timeout(rcar->phy_base + 0x0f8, val, !(val & BIT(18)), 100, 10000);
+ ret = readl_poll_timeout(rcar->phy_base + 0x0f8, val, val & BIT(18), 100, 10000);
if (ret < 0)
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 445/563] ASoC: qcom: sc8280xp: use sa8775p/ subdir for QCS9100 / QCS9075
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (443 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 444/563] PCI: rcar-gen4: Fix inverted break condition in PHY initialization Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 446/563] iommu/vt-d: Disallow dirty tracking if incoherent page walk Greg Kroah-Hartman
` (131 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov,
Srinivas Kandagatla, Mark Brown, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
[ Upstream commit ba0c67d3c4b0ce5ec5e6de35e6433b22eecb1f6a ]
All firmware for the Lemans platform aka QCS9100 aka QCS9075 is for
historical reasons located in the qcom/sa8775p/ subdir inside
linux-firmware. The only exceptions to this rule are audio topology
files. While it's not too late, change the subdir to point to the
sa8775p/ subdir, so that all firmware for that platform is present at
the same location.
Fixes: 5b5bf5922f4c ("ASoC: qcom: sc8280xp: Add sound card support for QCS9100 and QCS9075")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20250924-lemans-evk-topo-v2-1-7d44909a5758@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/qcom/sc8280xp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/soc/qcom/sc8280xp.c b/sound/soc/qcom/sc8280xp.c
index 288ccd7f8866a..6847ae4acbd18 100644
--- a/sound/soc/qcom/sc8280xp.c
+++ b/sound/soc/qcom/sc8280xp.c
@@ -191,8 +191,8 @@ static const struct of_device_id snd_sc8280xp_dt_match[] = {
{.compatible = "qcom,qcm6490-idp-sndcard", "qcm6490"},
{.compatible = "qcom,qcs6490-rb3gen2-sndcard", "qcs6490"},
{.compatible = "qcom,qcs8275-sndcard", "qcs8300"},
- {.compatible = "qcom,qcs9075-sndcard", "qcs9075"},
- {.compatible = "qcom,qcs9100-sndcard", "qcs9100"},
+ {.compatible = "qcom,qcs9075-sndcard", "sa8775p"},
+ {.compatible = "qcom,qcs9100-sndcard", "sa8775p"},
{.compatible = "qcom,sc8280xp-sndcard", "sc8280xp"},
{.compatible = "qcom,sm8450-sndcard", "sm8450"},
{.compatible = "qcom,sm8550-sndcard", "sm8550"},
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 446/563] iommu/vt-d: Disallow dirty tracking if incoherent page walk
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (444 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 445/563] ASoC: qcom: sc8280xp: use sa8775p/ subdir for QCS9100 / QCS9075 Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 447/563] iommu/selftest: prevent use of uninitialized variable Greg Kroah-Hartman
` (130 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lu Baolu, Jason Gunthorpe,
Joerg Roedel, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <baolu.lu@linux.intel.com>
[ Upstream commit 57f55048e564dedd8a4546d018e29d6bbfff0a7e ]
Dirty page tracking relies on the IOMMU atomically updating the dirty bit
in the paging-structure entry. For this operation to succeed, the paging-
structure memory must be coherent between the IOMMU and the CPU. In
another word, if the iommu page walk is incoherent, dirty page tracking
doesn't work.
The Intel VT-d specification, Section 3.10 "Snoop Behavior" states:
"Remapping hardware encountering the need to atomically update A/EA/D bits
in a paging-structure entry that is not snooped will result in a non-
recoverable fault."
To prevent an IOMMU from being incorrectly configured for dirty page
tracking when it is operating in an incoherent mode, mark SSADS as
supported only when both ecap_slads and ecap_smpwc are supported.
Fixes: f35f22cc760e ("iommu/vt-d: Access/Dirty bit support for SS domains")
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/20250924083447.123224-1-baolu.lu@linux.intel.com
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/intel/iommu.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h
index d09b928716592..2c261c069001c 100644
--- a/drivers/iommu/intel/iommu.h
+++ b/drivers/iommu/intel/iommu.h
@@ -541,7 +541,8 @@ enum {
#define pasid_supported(iommu) (sm_supported(iommu) && \
ecap_pasid((iommu)->ecap))
#define ssads_supported(iommu) (sm_supported(iommu) && \
- ecap_slads((iommu)->ecap))
+ ecap_slads((iommu)->ecap) && \
+ ecap_smpwc(iommu->ecap))
#define nested_supported(iommu) (sm_supported(iommu) && \
ecap_nest((iommu)->ecap))
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 447/563] iommu/selftest: prevent use of uninitialized variable
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (445 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 446/563] iommu/vt-d: Disallow dirty tracking if incoherent page walk Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 448/563] RDMA/siw: Always report immediate post SQ errors Greg Kroah-Hartman
` (129 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alessandro Zanni, Jason Gunthorpe,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alessandro Zanni <alessandro.zanni87@gmail.com>
[ Upstream commit 1d235d8494259b588bc3b7d29bc73ce34bf885bc ]
Fix to avoid the usage of the `res` variable uninitialized in the
following macro expansions.
It solves the following warning:
In function ‘iommufd_viommu_vdevice_alloc’,
inlined from ‘wrapper_iommufd_viommu_vdevice_alloc’ at iommufd.c:2889:1:
../kselftest_harness.h:760:12: warning: ‘ret’ may be used uninitialized [-Wmaybe-uninitialized]
760 | if (!(__exp _t __seen)) { \
| ^
../kselftest_harness.h:513:9: note: in expansion of macro ‘__EXPECT’
513 | __EXPECT(expected, #expected, seen, #seen, ==, 1)
| ^~~~~~~~
iommufd_utils.h:1057:9: note: in expansion of macro ‘ASSERT_EQ’
1057 | ASSERT_EQ(0, _test_cmd_trigger_vevents(self->fd, dev_id, nvevents))
| ^~~~~~~~~
iommufd.c:2924:17: note: in expansion of macro ‘test_cmd_trigger_vevents’
2924 | test_cmd_trigger_vevents(dev_id, 3);
| ^~~~~~~~~~~~~~~~~~~~~~~~
The issue can be reproduced, building the tests, with the command: make -C
tools/testing/selftests TARGETS=iommu
Link: https://patch.msgid.link/r/20250924171629.50266-1-alessandro.zanni87@gmail.com
Fixes: 97717a1f283f ("iommufd/selftest: Add IOMMU_VEVENTQ_ALLOC test coverage")
Signed-off-by: Alessandro Zanni <alessandro.zanni87@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/iommu/iommufd_utils.h | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/tools/testing/selftests/iommu/iommufd_utils.h b/tools/testing/selftests/iommu/iommufd_utils.h
index 3c3e08b8c90eb..772ca1db6e597 100644
--- a/tools/testing/selftests/iommu/iommufd_utils.h
+++ b/tools/testing/selftests/iommu/iommufd_utils.h
@@ -1042,15 +1042,13 @@ static int _test_cmd_trigger_vevents(int fd, __u32 dev_id, __u32 nvevents)
.dev_id = dev_id,
},
};
- int ret;
while (nvevents--) {
- ret = ioctl(fd, _IOMMU_TEST_CMD(IOMMU_TEST_OP_TRIGGER_VEVENT),
- &trigger_vevent_cmd);
- if (ret < 0)
+ if (!ioctl(fd, _IOMMU_TEST_CMD(IOMMU_TEST_OP_TRIGGER_VEVENT),
+ &trigger_vevent_cmd))
return -1;
}
- return ret;
+ return 0;
}
#define test_cmd_trigger_vevents(dev_id, nvevents) \
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 448/563] RDMA/siw: Always report immediate post SQ errors
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (446 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 447/563] iommu/selftest: prevent use of uninitialized variable Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 449/563] net: enetc: Fix probing error message typo for the ENETCv4 PF driver Greg Kroah-Hartman
` (128 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Metzmacher, Bernard Metzler,
Jason Gunthorpe, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bernard Metzler <bernard.metzler@linux.dev>
[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ]
In siw_post_send(), any immediate error encountered during processing of
the work request list must be reported to the caller, even if previous
work requests in that list were just accepted and added to the send queue.
Not reporting those errors confuses the caller, which would wait
indefinitely for the failing and potentially subsequently aborted work
requests completion.
This fixes a case where immediate errors were overwritten by subsequent
code in siw_post_send().
Fixes: 303ae1cdfdf7 ("rdma/siw: application interface")
Link: https://patch.msgid.link/r/20250923144536.103825-1-bernard.metzler@linux.dev
Suggested-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Bernard Metzler <bernard.metzler@linux.dev>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++-----------
1 file changed, 14 insertions(+), 11 deletions(-)
diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c
index 35c3bde0d00af..efa2f097b5828 100644
--- a/drivers/infiniband/sw/siw/siw_verbs.c
+++ b/drivers/infiniband/sw/siw/siw_verbs.c
@@ -769,7 +769,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
struct siw_wqe *wqe = tx_wqe(qp);
unsigned long flags;
- int rv = 0;
+ int rv = 0, imm_err = 0;
if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) {
siw_dbg_qp(qp, "wr must be empty for user mapped sq\n");
@@ -955,9 +955,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
* Send directly if SQ processing is not in progress.
* Eventual immediate errors (rv < 0) do not affect the involved
* RI resources (Verbs, 8.3.1) and thus do not prevent from SQ
- * processing, if new work is already pending. But rv must be passed
- * to caller.
+ * processing, if new work is already pending. But rv and pointer
+ * to failed work request must be passed to caller.
*/
+ if (unlikely(rv < 0)) {
+ /*
+ * Immediate error
+ */
+ siw_dbg_qp(qp, "Immediate error %d\n", rv);
+ imm_err = rv;
+ *bad_wr = wr;
+ }
if (wqe->wr_status != SIW_WR_IDLE) {
spin_unlock_irqrestore(&qp->sq_lock, flags);
goto skip_direct_sending;
@@ -982,15 +990,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
up_read(&qp->state_lock);
- if (rv >= 0)
- return 0;
- /*
- * Immediate error
- */
- siw_dbg_qp(qp, "error %d\n", rv);
+ if (unlikely(imm_err))
+ return imm_err;
- *bad_wr = wr;
- return rv;
+ return (rv >= 0) ? 0 : rv;
}
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 449/563] net: enetc: Fix probing error message typo for the ENETCv4 PF driver
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (447 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 448/563] RDMA/siw: Always report immediate post SQ errors Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 450/563] net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast Greg Kroah-Hartman
` (127 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Manoil, Wei Fang,
Simon Horman, Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Manoil <claudiu.manoil@nxp.com>
[ Upstream commit c35cf24a69b00b7f54f2f19838f2b82d54480b0f ]
Blamed commit wrongly indicates VF error in case of PF probing error.
Fixes: 99100d0d9922 ("net: enetc: add preliminary support for i.MX95 ENETC PF")
Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250924082755.1984798-1-wei.fang@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/freescale/enetc/enetc4_pf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
index b3dc1afeefd1d..a5c1f1cef3b0c 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
@@ -1030,7 +1030,7 @@ static int enetc4_pf_probe(struct pci_dev *pdev,
err = enetc_get_driver_data(si);
if (err)
return dev_err_probe(dev, err,
- "Could not get VF driver data\n");
+ "Could not get PF driver data\n");
err = enetc4_pf_struct_init(si);
if (err)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 450/563] net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (448 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 449/563] net: enetc: Fix probing error message typo for the ENETCv4 PF driver Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 451/563] ptp: Add a upper bound on max_vclocks Greg Kroah-Hartman
` (126 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michal Pecio, I Viswanath,
Jakub Kicinski, Sasha Levin, syzbot+78cae3f37c62ad092caa
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: I Viswanath <viswanathiyyappan@gmail.com>
[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ]
syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb.
This is the sequence of events that leads to the warning:
rtl8150_start_xmit() {
netif_stop_queue();
usb_submit_urb(dev->tx_urb);
}
rtl8150_set_multicast() {
netif_stop_queue();
netif_wake_queue(); <-- wakes up TX queue before URB is done
}
rtl8150_start_xmit() {
netif_stop_queue();
usb_submit_urb(dev->tx_urb); <-- double submission
}
rtl8150_set_multicast being the ndo_set_rx_mode callback should not be
calling netif_stop_queue and notif_start_queue as these handle
TX queue synchronization.
The net core function dev_set_rx_mode handles the synchronization
for rtl8150_set_multicast making it safe to remove these locks.
Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Tested-by: Michal Pecio <michal.pecio@gmail.com>
Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/rtl8150.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index ddff6f19ff98e..92add3daadbb1 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
rtl8150_t *dev = netdev_priv(netdev);
u16 rx_creg = 0x9e;
- netif_stop_queue(netdev);
if (netdev->flags & IFF_PROMISC) {
rx_creg |= 0x0001;
dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name);
@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
rx_creg &= 0x00fc;
}
async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg);
- netif_wake_queue(netdev);
}
static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 451/563] ptp: Add a upper bound on max_vclocks
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (449 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 450/563] net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 452/563] vhost: vringh: Fix copy_to_iter return value check Greg Kroah-Hartman
` (125 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+94d20db923b9f51be0df,
I Viswanath, Richard Cochran, Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: I Viswanath <viswanathiyyappan@gmail.com>
[ Upstream commit e9f35294e18da82162004a2f35976e7031aaf7f9 ]
syzbot reported WARNING in max_vclocks_store.
This occurs when the argument max is too large for kcalloc to handle.
Extend the guard to guard against values that are too large for
kcalloc
Reported-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=94d20db923b9f51be0df
Tested-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com
Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion")
Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Link: https://patch.msgid.link/20250925155908.5034-1-viswanathiyyappan@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ptp/ptp_private.h | 1 +
drivers/ptp/ptp_sysfs.c | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h
index b352df4cd3f97..f329263f33aa1 100644
--- a/drivers/ptp/ptp_private.h
+++ b/drivers/ptp/ptp_private.h
@@ -22,6 +22,7 @@
#define PTP_MAX_TIMESTAMPS 128
#define PTP_BUF_TIMESTAMPS 30
#define PTP_DEFAULT_MAX_VCLOCKS 20
+#define PTP_MAX_VCLOCKS_LIMIT (KMALLOC_MAX_SIZE/(sizeof(int)))
#define PTP_MAX_CHANNELS 2048
enum {
diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c
index 6b1b8f57cd951..200eaf5006968 100644
--- a/drivers/ptp/ptp_sysfs.c
+++ b/drivers/ptp/ptp_sysfs.c
@@ -284,7 +284,7 @@ static ssize_t max_vclocks_store(struct device *dev,
size_t size;
u32 max;
- if (kstrtou32(buf, 0, &max) || max == 0)
+ if (kstrtou32(buf, 0, &max) || max == 0 || max > PTP_MAX_VCLOCKS_LIMIT)
return -EINVAL;
if (max == ptp->max_vclocks)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 452/563] vhost: vringh: Fix copy_to_iter return value check
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (450 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 451/563] ptp: Add a upper bound on max_vclocks Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 453/563] net: macb: remove illusion about TBQPH/RBQPH being per-queue Greg Kroah-Hartman
` (124 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, zhang jiao, Michael S. Tsirkin,
Simon Horman, Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <mst@redhat.com>
[ Upstream commit 439263376c2c4e126cac0d07e4987568de4eaba5 ]
The return value of copy_to_iter can't be negative, check whether the
copied length is equal to the requested length instead of checking for
negative values.
Cc: zhang jiao <zhangjiao2@cmss.chinamobile.com>
Link: https://lore.kernel.org/all/20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
Link: https://patch.msgid.link/cd637504a6e3967954a9e80fc1b75e8c0978087b.1758723310.git.mst@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vhost/vringh.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index 9f27c3f6091b8..1778eff7ab006 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -1161,6 +1161,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
struct iov_iter iter;
u64 translated;
int ret;
+ size_t size;
ret = iotlb_translate(vrh, (u64)(uintptr_t)dst,
len - total_translated, &translated,
@@ -1178,9 +1179,9 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
translated);
}
- ret = copy_to_iter(src, translated, &iter);
- if (ret < 0)
- return ret;
+ size = copy_to_iter(src, translated, &iter);
+ if (size != translated)
+ return -EFAULT;
src += translated;
dst += translated;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 453/563] net: macb: remove illusion about TBQPH/RBQPH being per-queue
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (451 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 452/563] vhost: vringh: Fix copy_to_iter return value check Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 454/563] net: macb: move ring size computation to functions Greg Kroah-Hartman
` (123 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Anderson, Nicolas Ferre,
Théo Lebrun, Simon Horman, Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Théo Lebrun <theo.lebrun@bootlin.com>
[ Upstream commit fca3dc859b200ca4dcdd2124beaf3bb2ab80b0f7 ]
The MACB driver acts as if TBQPH/RBQPH are configurable on a per queue
basis; this is a lie. A single register configures the upper 32 bits of
each DMA descriptor buffers for all queues.
Concrete actions:
- Drop GEM_TBQPH/GEM_RBQPH macros which have a queue index argument.
Only use MACB_TBQPH/MACB_RBQPH constants.
- Drop struct macb_queue->TBQPH/RBQPH fields.
- In macb_init_buffers(): do a single write to TBQPH and RBQPH for all
queues instead of a write per queue.
- In macb_tx_error_task(): drop the write to TBQPH.
- In macb_alloc_consistent(): if allocations give different upper
32-bits, fail. Previously, it would have lead to silent memory
corruption as queues would have used the upper 32 bits of the alloc
from queue 0 and their own low 32 bits.
- In macb_suspend(): if we use the tie off descriptor for suspend, do
the write once for all queues instead of once per queue.
Fixes: fff8019a08b6 ("net: macb: Add 64 bit addressing support for GEM")
Fixes: ae1f2a56d273 ("net: macb: Added support for many RX queues")
Reviewed-by: Sean Anderson <sean.anderson@linux.dev>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250923-macb-fixes-v6-2-772d655cdeb6@bootlin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cadence/macb.h | 4 --
drivers/net/ethernet/cadence/macb_main.c | 57 ++++++++++--------------
2 files changed, 24 insertions(+), 37 deletions(-)
diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
index c9a5c8beb2fa8..a7e845fee4b3a 100644
--- a/drivers/net/ethernet/cadence/macb.h
+++ b/drivers/net/ethernet/cadence/macb.h
@@ -213,10 +213,8 @@
#define GEM_ISR(hw_q) (0x0400 + ((hw_q) << 2))
#define GEM_TBQP(hw_q) (0x0440 + ((hw_q) << 2))
-#define GEM_TBQPH(hw_q) (0x04C8)
#define GEM_RBQP(hw_q) (0x0480 + ((hw_q) << 2))
#define GEM_RBQS(hw_q) (0x04A0 + ((hw_q) << 2))
-#define GEM_RBQPH(hw_q) (0x04D4)
#define GEM_IER(hw_q) (0x0600 + ((hw_q) << 2))
#define GEM_IDR(hw_q) (0x0620 + ((hw_q) << 2))
#define GEM_IMR(hw_q) (0x0640 + ((hw_q) << 2))
@@ -1214,10 +1212,8 @@ struct macb_queue {
unsigned int IDR;
unsigned int IMR;
unsigned int TBQP;
- unsigned int TBQPH;
unsigned int RBQS;
unsigned int RBQP;
- unsigned int RBQPH;
/* Lock to protect tx_head and tx_tail */
spinlock_t tx_ptr_lock;
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index c769b7dbd3baf..3e634049dadf1 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -495,19 +495,19 @@ static void macb_init_buffers(struct macb *bp)
struct macb_queue *queue;
unsigned int q;
- for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
- queue_writel(queue, RBQP, lower_32_bits(queue->rx_ring_dma));
#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
- if (bp->hw_dma_cap & HW_DMA_CAP_64B)
- queue_writel(queue, RBQPH,
- upper_32_bits(queue->rx_ring_dma));
+ /* Single register for all queues' high 32 bits. */
+ if (bp->hw_dma_cap & HW_DMA_CAP_64B) {
+ macb_writel(bp, RBQPH,
+ upper_32_bits(bp->queues[0].rx_ring_dma));
+ macb_writel(bp, TBQPH,
+ upper_32_bits(bp->queues[0].tx_ring_dma));
+ }
#endif
+
+ for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
+ queue_writel(queue, RBQP, lower_32_bits(queue->rx_ring_dma));
queue_writel(queue, TBQP, lower_32_bits(queue->tx_ring_dma));
-#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
- if (bp->hw_dma_cap & HW_DMA_CAP_64B)
- queue_writel(queue, TBQPH,
- upper_32_bits(queue->tx_ring_dma));
-#endif
}
}
@@ -1166,10 +1166,6 @@ static void macb_tx_error_task(struct work_struct *work)
/* Reinitialize the TX desc queue */
queue_writel(queue, TBQP, lower_32_bits(queue->tx_ring_dma));
-#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
- if (bp->hw_dma_cap & HW_DMA_CAP_64B)
- queue_writel(queue, TBQPH, upper_32_bits(queue->tx_ring_dma));
-#endif
/* Make TX ring reflect state of hardware */
queue->tx_head = 0;
queue->tx_tail = 0;
@@ -2546,6 +2542,7 @@ static int macb_alloc_consistent(struct macb *bp)
{
struct macb_queue *queue;
unsigned int q;
+ u32 upper;
int size;
for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
@@ -2553,7 +2550,9 @@ static int macb_alloc_consistent(struct macb *bp)
queue->tx_ring = dma_alloc_coherent(&bp->pdev->dev, size,
&queue->tx_ring_dma,
GFP_KERNEL);
- if (!queue->tx_ring)
+ upper = upper_32_bits(queue->tx_ring_dma);
+ if (!queue->tx_ring ||
+ upper != upper_32_bits(bp->queues[0].tx_ring_dma))
goto out_err;
netdev_dbg(bp->dev,
"Allocated TX ring for queue %u of %d bytes at %08lx (mapped %p)\n",
@@ -2567,8 +2566,11 @@ static int macb_alloc_consistent(struct macb *bp)
size = RX_RING_BYTES(bp) + bp->rx_bd_rd_prefetch;
queue->rx_ring = dma_alloc_coherent(&bp->pdev->dev, size,
- &queue->rx_ring_dma, GFP_KERNEL);
- if (!queue->rx_ring)
+ &queue->rx_ring_dma,
+ GFP_KERNEL);
+ upper = upper_32_bits(queue->rx_ring_dma);
+ if (!queue->rx_ring ||
+ upper != upper_32_bits(bp->queues[0].rx_ring_dma))
goto out_err;
netdev_dbg(bp->dev,
"Allocated RX ring of %d bytes at %08lx (mapped %p)\n",
@@ -4309,12 +4311,6 @@ static int macb_init(struct platform_device *pdev)
queue->TBQP = GEM_TBQP(hw_q - 1);
queue->RBQP = GEM_RBQP(hw_q - 1);
queue->RBQS = GEM_RBQS(hw_q - 1);
-#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
- if (bp->hw_dma_cap & HW_DMA_CAP_64B) {
- queue->TBQPH = GEM_TBQPH(hw_q - 1);
- queue->RBQPH = GEM_RBQPH(hw_q - 1);
- }
-#endif
} else {
/* queue0 uses legacy registers */
queue->ISR = MACB_ISR;
@@ -4323,12 +4319,6 @@ static int macb_init(struct platform_device *pdev)
queue->IMR = MACB_IMR;
queue->TBQP = MACB_TBQP;
queue->RBQP = MACB_RBQP;
-#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
- if (bp->hw_dma_cap & HW_DMA_CAP_64B) {
- queue->TBQPH = MACB_TBQPH;
- queue->RBQPH = MACB_RBQPH;
- }
-#endif
}
/* get irq: here we use the linux queue index, not the hardware
@@ -5452,6 +5442,11 @@ static int __maybe_unused macb_suspend(struct device *dev)
*/
tmp = macb_readl(bp, NCR);
macb_writel(bp, NCR, tmp & ~(MACB_BIT(TE) | MACB_BIT(RE)));
+#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+ if (!(bp->caps & MACB_CAPS_QUEUE_DISABLE))
+ macb_writel(bp, RBQPH,
+ upper_32_bits(bp->rx_ring_tieoff_dma));
+#endif
for (q = 0, queue = bp->queues; q < bp->num_queues;
++q, ++queue) {
/* Disable RX queues */
@@ -5461,10 +5456,6 @@ static int __maybe_unused macb_suspend(struct device *dev)
/* Tie off RX queues */
queue_writel(queue, RBQP,
lower_32_bits(bp->rx_ring_tieoff_dma));
-#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
- queue_writel(queue, RBQPH,
- upper_32_bits(bp->rx_ring_tieoff_dma));
-#endif
}
/* Disable all interrupts */
queue_writel(queue, IDR, -1);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 454/563] net: macb: move ring size computation to functions
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (452 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 453/563] net: macb: remove illusion about TBQPH/RBQPH being per-queue Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 455/563] net: macb: single dma_alloc_coherent() for DMA descriptors Greg Kroah-Hartman
` (122 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Ferre, Théo Lebrun,
Simon Horman, Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Théo Lebrun <theo.lebrun@bootlin.com>
[ Upstream commit 92d4256fafd8d0a14d3aaa10452ac771bf9b597c ]
The tx/rx ring size calculation is somewhat complex and partially hidden
behind a macro. Move that out of the {RX,TX}_RING_BYTES() macros and
macb_{alloc,free}_consistent() functions into neat separate functions.
In macb_free_consistent(), we drop the size variable and directly call
the size helpers in the arguments list. In macb_alloc_consistent(), we
keep the size variable that is used by netdev_dbg() calls.
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250923-macb-fixes-v6-3-772d655cdeb6@bootlin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 78d901897b3c ("net: macb: single dma_alloc_coherent() for DMA descriptors")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cadence/macb_main.c | 27 ++++++++++++++----------
1 file changed, 16 insertions(+), 11 deletions(-)
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index 3e634049dadf1..73840808ea801 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -51,14 +51,10 @@ struct sifive_fu540_macb_mgmt {
#define DEFAULT_RX_RING_SIZE 512 /* must be power of 2 */
#define MIN_RX_RING_SIZE 64
#define MAX_RX_RING_SIZE 8192
-#define RX_RING_BYTES(bp) (macb_dma_desc_get_size(bp) \
- * (bp)->rx_ring_size)
#define DEFAULT_TX_RING_SIZE 512 /* must be power of 2 */
#define MIN_TX_RING_SIZE 64
#define MAX_TX_RING_SIZE 4096
-#define TX_RING_BYTES(bp) (macb_dma_desc_get_size(bp) \
- * (bp)->tx_ring_size)
/* level of occupied TX descriptors under which we wake up TX process */
#define MACB_TX_WAKEUP_THRESH(bp) (3 * (bp)->tx_ring_size / 4)
@@ -2470,11 +2466,20 @@ static void macb_free_rx_buffers(struct macb *bp)
}
}
+static unsigned int macb_tx_ring_size_per_queue(struct macb *bp)
+{
+ return macb_dma_desc_get_size(bp) * bp->tx_ring_size + bp->tx_bd_rd_prefetch;
+}
+
+static unsigned int macb_rx_ring_size_per_queue(struct macb *bp)
+{
+ return macb_dma_desc_get_size(bp) * bp->rx_ring_size + bp->rx_bd_rd_prefetch;
+}
+
static void macb_free_consistent(struct macb *bp)
{
struct macb_queue *queue;
unsigned int q;
- int size;
if (bp->rx_ring_tieoff) {
dma_free_coherent(&bp->pdev->dev, macb_dma_desc_get_size(bp),
@@ -2488,14 +2493,14 @@ static void macb_free_consistent(struct macb *bp)
kfree(queue->tx_skb);
queue->tx_skb = NULL;
if (queue->tx_ring) {
- size = TX_RING_BYTES(bp) + bp->tx_bd_rd_prefetch;
- dma_free_coherent(&bp->pdev->dev, size,
+ dma_free_coherent(&bp->pdev->dev,
+ macb_tx_ring_size_per_queue(bp),
queue->tx_ring, queue->tx_ring_dma);
queue->tx_ring = NULL;
}
if (queue->rx_ring) {
- size = RX_RING_BYTES(bp) + bp->rx_bd_rd_prefetch;
- dma_free_coherent(&bp->pdev->dev, size,
+ dma_free_coherent(&bp->pdev->dev,
+ macb_rx_ring_size_per_queue(bp),
queue->rx_ring, queue->rx_ring_dma);
queue->rx_ring = NULL;
}
@@ -2546,7 +2551,7 @@ static int macb_alloc_consistent(struct macb *bp)
int size;
for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
- size = TX_RING_BYTES(bp) + bp->tx_bd_rd_prefetch;
+ size = macb_tx_ring_size_per_queue(bp);
queue->tx_ring = dma_alloc_coherent(&bp->pdev->dev, size,
&queue->tx_ring_dma,
GFP_KERNEL);
@@ -2564,7 +2569,7 @@ static int macb_alloc_consistent(struct macb *bp)
if (!queue->tx_skb)
goto out_err;
- size = RX_RING_BYTES(bp) + bp->rx_bd_rd_prefetch;
+ size = macb_rx_ring_size_per_queue(bp);
queue->rx_ring = dma_alloc_coherent(&bp->pdev->dev, size,
&queue->rx_ring_dma,
GFP_KERNEL);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 455/563] net: macb: single dma_alloc_coherent() for DMA descriptors
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (453 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 454/563] net: macb: move ring size computation to functions Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 456/563] Bluetooth: btintel_pcie: Refactor Device Coredump Greg Kroah-Hartman
` (121 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Anderson, Nicolas Ferre,
Théo Lebrun, Simon Horman, Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Théo Lebrun <theo.lebrun@bootlin.com>
[ Upstream commit 78d901897b3cae06b38f54e48a2378cf9da21175 ]
Move from 2*NUM_QUEUES dma_alloc_coherent() for DMA descriptor rings to
2 calls overall.
Issue is with how all queues share the same register for configuring the
upper 32-bits of Tx/Rx descriptor rings. Taking Tx, notice how TBQPH
does *not* depend on the queue index:
#define GEM_TBQP(hw_q) (0x0440 + ((hw_q) << 2))
#define GEM_TBQPH(hw_q) (0x04C8)
queue_writel(queue, TBQP, lower_32_bits(queue->tx_ring_dma));
#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
if (bp->hw_dma_cap & HW_DMA_CAP_64B)
queue_writel(queue, TBQPH, upper_32_bits(queue->tx_ring_dma));
#endif
To maximise our chances of getting valid DMA addresses, we do a single
dma_alloc_coherent() across queues. This improves the odds because
alloc_pages() guarantees natural alignment. Other codepaths (IOMMU or
dev/arch dma_map_ops) don't give high enough guarantees
(even page-aligned isn't enough).
Two consideration:
- dma_alloc_coherent() gives us page alignment. Here we remove this
constraint meaning each queue's ring won't be page-aligned anymore.
- This can save some tiny amounts of memory. Fewer allocations means
(1) less overhead (constant cost per alloc) and (2) less wasted bytes
due to alignment constraints.
Example for (2): 4 queues, default ring size (512), 64-bit DMA
descriptors, 16K pages:
- Before: 8 allocs of 8K, each rounded to 16K => 64K wasted.
- After: 2 allocs of 32K => 0K wasted.
Fixes: 02c958dd3446 ("net/macb: add TX multiqueue support for gem")
Reviewed-by: Sean Anderson <sean.anderson@linux.dev>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Tested-by: Nicolas Ferre <nicolas.ferre@microchip.com> # on sam9x75
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250923-macb-fixes-v6-4-772d655cdeb6@bootlin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cadence/macb_main.c | 80 ++++++++++++------------
1 file changed, 41 insertions(+), 39 deletions(-)
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index 73840808ea801..fc082a7a5a313 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -2478,32 +2478,30 @@ static unsigned int macb_rx_ring_size_per_queue(struct macb *bp)
static void macb_free_consistent(struct macb *bp)
{
+ struct device *dev = &bp->pdev->dev;
struct macb_queue *queue;
unsigned int q;
+ size_t size;
if (bp->rx_ring_tieoff) {
- dma_free_coherent(&bp->pdev->dev, macb_dma_desc_get_size(bp),
+ dma_free_coherent(dev, macb_dma_desc_get_size(bp),
bp->rx_ring_tieoff, bp->rx_ring_tieoff_dma);
bp->rx_ring_tieoff = NULL;
}
bp->macbgem_ops.mog_free_rx_buffers(bp);
+ size = bp->num_queues * macb_tx_ring_size_per_queue(bp);
+ dma_free_coherent(dev, size, bp->queues[0].tx_ring, bp->queues[0].tx_ring_dma);
+
+ size = bp->num_queues * macb_rx_ring_size_per_queue(bp);
+ dma_free_coherent(dev, size, bp->queues[0].rx_ring, bp->queues[0].rx_ring_dma);
+
for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
kfree(queue->tx_skb);
queue->tx_skb = NULL;
- if (queue->tx_ring) {
- dma_free_coherent(&bp->pdev->dev,
- macb_tx_ring_size_per_queue(bp),
- queue->tx_ring, queue->tx_ring_dma);
- queue->tx_ring = NULL;
- }
- if (queue->rx_ring) {
- dma_free_coherent(&bp->pdev->dev,
- macb_rx_ring_size_per_queue(bp),
- queue->rx_ring, queue->rx_ring_dma);
- queue->rx_ring = NULL;
- }
+ queue->tx_ring = NULL;
+ queue->rx_ring = NULL;
}
}
@@ -2545,41 +2543,45 @@ static int macb_alloc_rx_buffers(struct macb *bp)
static int macb_alloc_consistent(struct macb *bp)
{
+ struct device *dev = &bp->pdev->dev;
+ dma_addr_t tx_dma, rx_dma;
struct macb_queue *queue;
unsigned int q;
- u32 upper;
- int size;
+ void *tx, *rx;
+ size_t size;
+
+ /*
+ * Upper 32-bits of Tx/Rx DMA descriptor for each queues much match!
+ * We cannot enforce this guarantee, the best we can do is do a single
+ * allocation and hope it will land into alloc_pages() that guarantees
+ * natural alignment of physical addresses.
+ */
+
+ size = bp->num_queues * macb_tx_ring_size_per_queue(bp);
+ tx = dma_alloc_coherent(dev, size, &tx_dma, GFP_KERNEL);
+ if (!tx || upper_32_bits(tx_dma) != upper_32_bits(tx_dma + size - 1))
+ goto out_err;
+ netdev_dbg(bp->dev, "Allocated %zu bytes for %u TX rings at %08lx (mapped %p)\n",
+ size, bp->num_queues, (unsigned long)tx_dma, tx);
+
+ size = bp->num_queues * macb_rx_ring_size_per_queue(bp);
+ rx = dma_alloc_coherent(dev, size, &rx_dma, GFP_KERNEL);
+ if (!rx || upper_32_bits(rx_dma) != upper_32_bits(rx_dma + size - 1))
+ goto out_err;
+ netdev_dbg(bp->dev, "Allocated %zu bytes for %u RX rings at %08lx (mapped %p)\n",
+ size, bp->num_queues, (unsigned long)rx_dma, rx);
for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
- size = macb_tx_ring_size_per_queue(bp);
- queue->tx_ring = dma_alloc_coherent(&bp->pdev->dev, size,
- &queue->tx_ring_dma,
- GFP_KERNEL);
- upper = upper_32_bits(queue->tx_ring_dma);
- if (!queue->tx_ring ||
- upper != upper_32_bits(bp->queues[0].tx_ring_dma))
- goto out_err;
- netdev_dbg(bp->dev,
- "Allocated TX ring for queue %u of %d bytes at %08lx (mapped %p)\n",
- q, size, (unsigned long)queue->tx_ring_dma,
- queue->tx_ring);
+ queue->tx_ring = tx + macb_tx_ring_size_per_queue(bp) * q;
+ queue->tx_ring_dma = tx_dma + macb_tx_ring_size_per_queue(bp) * q;
+
+ queue->rx_ring = rx + macb_rx_ring_size_per_queue(bp) * q;
+ queue->rx_ring_dma = rx_dma + macb_rx_ring_size_per_queue(bp) * q;
size = bp->tx_ring_size * sizeof(struct macb_tx_skb);
queue->tx_skb = kmalloc(size, GFP_KERNEL);
if (!queue->tx_skb)
goto out_err;
-
- size = macb_rx_ring_size_per_queue(bp);
- queue->rx_ring = dma_alloc_coherent(&bp->pdev->dev, size,
- &queue->rx_ring_dma,
- GFP_KERNEL);
- upper = upper_32_bits(queue->rx_ring_dma);
- if (!queue->rx_ring ||
- upper != upper_32_bits(bp->queues[0].rx_ring_dma))
- goto out_err;
- netdev_dbg(bp->dev,
- "Allocated RX ring of %d bytes at %08lx (mapped %p)\n",
- size, (unsigned long)queue->rx_ring_dma, queue->rx_ring);
}
if (bp->macbgem_ops.mog_alloc_rx_buffers(bp))
goto out_err;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 456/563] Bluetooth: btintel_pcie: Refactor Device Coredump
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (454 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 455/563] net: macb: single dma_alloc_coherent() for DMA descriptors Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 457/563] Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO Greg Kroah-Hartman
` (120 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kiran K, Luiz Augusto von Dentz,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiran K <kiran.k@intel.com>
[ Upstream commit 58fddb364dd5c4e9bf223a2113a42538d9c040de ]
As device coredumps are not HCI traces, maintain the device coredump at
the driver level and eliminate the dependency on hdev_devcd*()
Signed-off-by: Kiran K <kiran.k@intel.com>
Fixes: 07e6bddb54b4 ("Bluetooth: btintel_pcie: Add support for device coredump")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btintel_pcie.c | 220 +++++++++++--------------------
drivers/bluetooth/btintel_pcie.h | 2 +
2 files changed, 77 insertions(+), 145 deletions(-)
diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 6e7bbbd35279f..585de143ab255 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -15,6 +15,7 @@
#include <linux/interrupt.h>
#include <linux/unaligned.h>
+#include <linux/devcoredump.h>
#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>
@@ -554,25 +555,6 @@ static void btintel_pcie_mac_init(struct btintel_pcie_data *data)
btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG, reg);
}
-static int btintel_pcie_add_dmp_data(struct hci_dev *hdev, const void *data, int size)
-{
- struct sk_buff *skb;
- int err;
-
- skb = alloc_skb(size, GFP_ATOMIC);
- if (!skb)
- return -ENOMEM;
-
- skb_put_data(skb, data, size);
- err = hci_devcd_append(hdev, skb);
- if (err) {
- bt_dev_err(hdev, "Failed to append data in the coredump");
- return err;
- }
-
- return 0;
-}
-
static int btintel_pcie_get_mac_access(struct btintel_pcie_data *data)
{
u32 reg;
@@ -617,30 +599,35 @@ static void btintel_pcie_release_mac_access(struct btintel_pcie_data *data)
btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG, reg);
}
-static void btintel_pcie_copy_tlv(struct sk_buff *skb, enum btintel_pcie_tlv_type type,
- void *data, int size)
+static void *btintel_pcie_copy_tlv(void *dest, enum btintel_pcie_tlv_type type,
+ void *data, size_t size)
{
struct intel_tlv *tlv;
- tlv = skb_put(skb, sizeof(*tlv) + size);
+ tlv = dest;
tlv->type = type;
tlv->len = size;
memcpy(tlv->val, data, tlv->len);
+ return dest + sizeof(*tlv) + size;
}
static int btintel_pcie_read_dram_buffers(struct btintel_pcie_data *data)
{
- u32 offset, prev_size, wr_ptr_status, dump_size, i;
+ u32 offset, prev_size, wr_ptr_status, dump_size, data_len;
struct btintel_pcie_dbgc *dbgc = &data->dbgc;
- u8 buf_idx, dump_time_len, fw_build;
struct hci_dev *hdev = data->hdev;
+ u8 *pdata, *p, buf_idx;
struct intel_tlv *tlv;
struct timespec64 now;
- struct sk_buff *skb;
struct tm tm_now;
- char buf[256];
- u16 hdr_len;
- int ret;
+ char fw_build[128];
+ char ts[128];
+ char vendor[64];
+ char driver[64];
+
+ if (!IS_ENABLED(CONFIG_DEV_COREDUMP))
+ return -EOPNOTSUPP;
+
wr_ptr_status = btintel_pcie_rd_dev_mem(data, BTINTEL_PCIE_DBGC_CUR_DBGBUFF_STATUS);
offset = wr_ptr_status & BTINTEL_PCIE_DBG_OFFSET_BIT_MASK;
@@ -657,88 +644,84 @@ static int btintel_pcie_read_dram_buffers(struct btintel_pcie_data *data)
else
return -EINVAL;
+ snprintf(vendor, sizeof(vendor), "Vendor: Intel\n");
+ snprintf(driver, sizeof(driver), "Driver: %s\n",
+ data->dmp_hdr.driver_name);
+
ktime_get_real_ts64(&now);
time64_to_tm(now.tv_sec, 0, &tm_now);
- dump_time_len = snprintf(buf, sizeof(buf), "Dump Time: %02d-%02d-%04ld %02d:%02d:%02d",
+ snprintf(ts, sizeof(ts), "Dump Time: %02d-%02d-%04ld %02d:%02d:%02d",
tm_now.tm_mday, tm_now.tm_mon + 1, tm_now.tm_year + 1900,
tm_now.tm_hour, tm_now.tm_min, tm_now.tm_sec);
- fw_build = snprintf(buf + dump_time_len, sizeof(buf) - dump_time_len,
+ snprintf(fw_build, sizeof(fw_build),
"Firmware Timestamp: Year %u WW %02u buildtype %u build %u",
2000 + (data->dmp_hdr.fw_timestamp >> 8),
data->dmp_hdr.fw_timestamp & 0xff, data->dmp_hdr.fw_build_type,
data->dmp_hdr.fw_build_num);
- hdr_len = sizeof(*tlv) + sizeof(data->dmp_hdr.cnvi_bt) +
- sizeof(*tlv) + sizeof(data->dmp_hdr.write_ptr) +
- sizeof(*tlv) + sizeof(data->dmp_hdr.wrap_ctr) +
- sizeof(*tlv) + sizeof(data->dmp_hdr.trigger_reason) +
- sizeof(*tlv) + sizeof(data->dmp_hdr.fw_git_sha1) +
- sizeof(*tlv) + sizeof(data->dmp_hdr.cnvr_top) +
- sizeof(*tlv) + sizeof(data->dmp_hdr.cnvi_top) +
- sizeof(*tlv) + dump_time_len +
- sizeof(*tlv) + fw_build;
+ data_len = sizeof(*tlv) + sizeof(data->dmp_hdr.cnvi_bt) +
+ sizeof(*tlv) + sizeof(data->dmp_hdr.write_ptr) +
+ sizeof(*tlv) + sizeof(data->dmp_hdr.wrap_ctr) +
+ sizeof(*tlv) + sizeof(data->dmp_hdr.trigger_reason) +
+ sizeof(*tlv) + sizeof(data->dmp_hdr.fw_git_sha1) +
+ sizeof(*tlv) + sizeof(data->dmp_hdr.cnvr_top) +
+ sizeof(*tlv) + sizeof(data->dmp_hdr.cnvi_top) +
+ sizeof(*tlv) + strlen(ts) +
+ sizeof(*tlv) + strlen(fw_build) +
+ sizeof(*tlv) + strlen(vendor) +
+ sizeof(*tlv) + strlen(driver);
- dump_size = hdr_len + sizeof(hdr_len);
+ /*
+ * sizeof(u32) - signature
+ * sizeof(data_len) - to store tlv data size
+ * data_len - TLV data
+ */
+ dump_size = sizeof(u32) + sizeof(data_len) + data_len;
- skb = alloc_skb(dump_size, GFP_KERNEL);
- if (!skb)
- return -ENOMEM;
/* Add debug buffers data length to dump size */
dump_size += BTINTEL_PCIE_DBGC_BUFFER_SIZE * dbgc->count;
- ret = hci_devcd_init(hdev, dump_size);
- if (ret) {
- bt_dev_err(hdev, "Failed to init devcoredump, err %d", ret);
- kfree_skb(skb);
- return ret;
- }
+ pdata = vmalloc(dump_size);
+ if (!pdata)
+ return -ENOMEM;
+ p = pdata;
+
+ *(u32 *)p = BTINTEL_PCIE_MAGIC_NUM;
+ p += sizeof(u32);
- skb_put_data(skb, &hdr_len, sizeof(hdr_len));
+ *(u32 *)p = data_len;
+ p += sizeof(u32);
- btintel_pcie_copy_tlv(skb, BTINTEL_CNVI_BT, &data->dmp_hdr.cnvi_bt,
- sizeof(data->dmp_hdr.cnvi_bt));
- btintel_pcie_copy_tlv(skb, BTINTEL_WRITE_PTR, &data->dmp_hdr.write_ptr,
- sizeof(data->dmp_hdr.write_ptr));
+ p = btintel_pcie_copy_tlv(p, BTINTEL_VENDOR, vendor, strlen(vendor));
+ p = btintel_pcie_copy_tlv(p, BTINTEL_DRIVER, driver, strlen(driver));
+ p = btintel_pcie_copy_tlv(p, BTINTEL_DUMP_TIME, ts, strlen(ts));
+ p = btintel_pcie_copy_tlv(p, BTINTEL_FW_BUILD, fw_build,
+ strlen(fw_build));
+ p = btintel_pcie_copy_tlv(p, BTINTEL_CNVI_BT, &data->dmp_hdr.cnvi_bt,
+ sizeof(data->dmp_hdr.cnvi_bt));
+ p = btintel_pcie_copy_tlv(p, BTINTEL_WRITE_PTR, &data->dmp_hdr.write_ptr,
+ sizeof(data->dmp_hdr.write_ptr));
+ p = btintel_pcie_copy_tlv(p, BTINTEL_WRAP_CTR, &data->dmp_hdr.wrap_ctr,
+ sizeof(data->dmp_hdr.wrap_ctr));
data->dmp_hdr.wrap_ctr = btintel_pcie_rd_dev_mem(data,
BTINTEL_PCIE_DBGC_DBGBUFF_WRAP_ARND);
- btintel_pcie_copy_tlv(skb, BTINTEL_WRAP_CTR, &data->dmp_hdr.wrap_ctr,
- sizeof(data->dmp_hdr.wrap_ctr));
-
- btintel_pcie_copy_tlv(skb, BTINTEL_TRIGGER_REASON, &data->dmp_hdr.trigger_reason,
- sizeof(data->dmp_hdr.trigger_reason));
-
- btintel_pcie_copy_tlv(skb, BTINTEL_FW_SHA, &data->dmp_hdr.fw_git_sha1,
- sizeof(data->dmp_hdr.fw_git_sha1));
-
- btintel_pcie_copy_tlv(skb, BTINTEL_CNVR_TOP, &data->dmp_hdr.cnvr_top,
- sizeof(data->dmp_hdr.cnvr_top));
-
- btintel_pcie_copy_tlv(skb, BTINTEL_CNVI_TOP, &data->dmp_hdr.cnvi_top,
- sizeof(data->dmp_hdr.cnvi_top));
-
- btintel_pcie_copy_tlv(skb, BTINTEL_DUMP_TIME, buf, dump_time_len);
-
- btintel_pcie_copy_tlv(skb, BTINTEL_FW_BUILD, buf + dump_time_len, fw_build);
-
- ret = hci_devcd_append(hdev, skb);
- if (ret)
- goto exit_err;
-
- for (i = 0; i < dbgc->count; i++) {
- ret = btintel_pcie_add_dmp_data(hdev, dbgc->bufs[i].data,
- BTINTEL_PCIE_DBGC_BUFFER_SIZE);
- if (ret)
- break;
- }
-
-exit_err:
- hci_devcd_complete(hdev);
- return ret;
+ p = btintel_pcie_copy_tlv(p, BTINTEL_TRIGGER_REASON, &data->dmp_hdr.trigger_reason,
+ sizeof(data->dmp_hdr.trigger_reason));
+ p = btintel_pcie_copy_tlv(p, BTINTEL_FW_SHA, &data->dmp_hdr.fw_git_sha1,
+ sizeof(data->dmp_hdr.fw_git_sha1));
+ p = btintel_pcie_copy_tlv(p, BTINTEL_CNVR_TOP, &data->dmp_hdr.cnvr_top,
+ sizeof(data->dmp_hdr.cnvr_top));
+ p = btintel_pcie_copy_tlv(p, BTINTEL_CNVI_TOP, &data->dmp_hdr.cnvi_top,
+ sizeof(data->dmp_hdr.cnvi_top));
+
+ memcpy(p, dbgc->bufs[0].data, dbgc->count * BTINTEL_PCIE_DBGC_BUFFER_SIZE);
+ dev_coredumpv(&hdev->dev, pdata, dump_size, GFP_KERNEL);
+ return 0;
}
static void btintel_pcie_dump_traces(struct hci_dev *hdev)
@@ -760,51 +743,6 @@ static void btintel_pcie_dump_traces(struct hci_dev *hdev)
bt_dev_err(hdev, "Failed to dump traces: (%d)", ret);
}
-static void btintel_pcie_dump_hdr(struct hci_dev *hdev, struct sk_buff *skb)
-{
- struct btintel_pcie_data *data = hci_get_drvdata(hdev);
- u16 len = skb->len;
- u16 *hdrlen_ptr;
- char buf[80];
-
- hdrlen_ptr = skb_put_zero(skb, sizeof(len));
-
- snprintf(buf, sizeof(buf), "Controller Name: 0x%X\n",
- INTEL_HW_VARIANT(data->dmp_hdr.cnvi_bt));
- skb_put_data(skb, buf, strlen(buf));
-
- snprintf(buf, sizeof(buf), "Firmware Build Number: %u\n",
- data->dmp_hdr.fw_build_num);
- skb_put_data(skb, buf, strlen(buf));
-
- snprintf(buf, sizeof(buf), "Driver: %s\n", data->dmp_hdr.driver_name);
- skb_put_data(skb, buf, strlen(buf));
-
- snprintf(buf, sizeof(buf), "Vendor: Intel\n");
- skb_put_data(skb, buf, strlen(buf));
-
- *hdrlen_ptr = skb->len - len;
-}
-
-static void btintel_pcie_dump_notify(struct hci_dev *hdev, int state)
-{
- struct btintel_pcie_data *data = hci_get_drvdata(hdev);
-
- switch (state) {
- case HCI_DEVCOREDUMP_IDLE:
- data->dmp_hdr.state = HCI_DEVCOREDUMP_IDLE;
- break;
- case HCI_DEVCOREDUMP_ACTIVE:
- data->dmp_hdr.state = HCI_DEVCOREDUMP_ACTIVE;
- break;
- case HCI_DEVCOREDUMP_TIMEOUT:
- case HCI_DEVCOREDUMP_ABORT:
- case HCI_DEVCOREDUMP_DONE:
- data->dmp_hdr.state = HCI_DEVCOREDUMP_IDLE;
- break;
- }
-}
-
/* This function enables BT function by setting BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_INIT bit in
* BTINTEL_PCIE_CSR_FUNC_CTRL_REG register and wait for MSI-X with
* BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP0.
@@ -1378,6 +1316,11 @@ static void btintel_pcie_rx_work(struct work_struct *work)
struct btintel_pcie_data, rx_work);
struct sk_buff *skb;
+ if (test_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags)) {
+ btintel_pcie_dump_traces(data->hdev);
+ clear_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags);
+ }
+
if (test_bit(BTINTEL_PCIE_HWEXP_INPROGRESS, &data->flags)) {
/* Unlike usb products, controller will not send hardware
* exception event on exception. Instead controller writes the
@@ -1390,11 +1333,6 @@ static void btintel_pcie_rx_work(struct work_struct *work)
clear_bit(BTINTEL_PCIE_HWEXP_INPROGRESS, &data->flags);
}
- if (test_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags)) {
- btintel_pcie_dump_traces(data->hdev);
- clear_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags);
- }
-
/* Process the sk_buf in queue and send to the HCI layer */
while ((skb = skb_dequeue(&data->rx_skb_q))) {
btintel_pcie_recv_frame(data, skb);
@@ -2184,13 +2122,6 @@ static int btintel_pcie_setup_internal(struct hci_dev *hdev)
if (ver_tlv.img_type == 0x02 || ver_tlv.img_type == 0x03)
data->dmp_hdr.fw_git_sha1 = ver_tlv.git_sha1;
- err = hci_devcd_register(hdev, btintel_pcie_dump_traces, btintel_pcie_dump_hdr,
- btintel_pcie_dump_notify);
- if (err) {
- bt_dev_err(hdev, "Failed to register coredump (%d)", err);
- goto exit_error;
- }
-
btintel_print_fseq_info(hdev);
exit_error:
kfree_skb(skb);
@@ -2319,7 +2250,6 @@ static void btintel_pcie_removal_work(struct work_struct *wk)
btintel_pcie_synchronize_irqs(data);
flush_work(&data->rx_work);
- flush_work(&data->hdev->dump.dump_rx);
bt_dev_dbg(data->hdev, "Release bluetooth interface");
btintel_pcie_release_hdev(data);
diff --git a/drivers/bluetooth/btintel_pcie.h b/drivers/bluetooth/btintel_pcie.h
index 0fa876c5b954a..04b21f968ad30 100644
--- a/drivers/bluetooth/btintel_pcie.h
+++ b/drivers/bluetooth/btintel_pcie.h
@@ -132,6 +132,8 @@ enum btintel_pcie_tlv_type {
BTINTEL_CNVI_TOP,
BTINTEL_DUMP_TIME,
BTINTEL_FW_BUILD,
+ BTINTEL_VENDOR,
+ BTINTEL_DRIVER
};
/* causes for the MBOX interrupts */
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 457/563] Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (455 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 456/563] Bluetooth: btintel_pcie: Refactor Device Coredump Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 458/563] Bluetooth: ISO: Fix possible UAF on iso_conn_free Greg Kroah-Hartman
` (119 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ]
The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO
was not called with a specific index which breaks the likes of
bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an
adapter is plugged, so instead of depending hdev not to be set just
enable the UUID on any index like it was done with iso_sock_uuid.
Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/mgmt.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 225140fcb3d6c..a3d16eece0d23 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -4542,13 +4542,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
return -ENOMEM;
#ifdef CONFIG_BT_FEATURE_DEBUG
- if (!hdev) {
- flags = bt_dbg_get() ? BIT(0) : 0;
+ flags = bt_dbg_get() ? BIT(0) : 0;
- memcpy(rp->features[idx].uuid, debug_uuid, 16);
- rp->features[idx].flags = cpu_to_le32(flags);
- idx++;
- }
+ memcpy(rp->features[idx].uuid, debug_uuid, 16);
+ rp->features[idx].flags = cpu_to_le32(flags);
+ idx++;
#endif
if (hdev && hci_dev_le_state_simultaneous(hdev)) {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 458/563] Bluetooth: ISO: Fix possible UAF on iso_conn_free
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (456 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 457/563] Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 459/563] Bluetooth: ISO: free rx_skb if not consumed Greg Kroah-Hartman
` (118 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8 ]
This attempt to fix similar issue to sco_conn_free where if the
conn->sk is not set to NULL may lead to UAF on iso_conn_free.
Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/iso.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 5ce823ca3aaf4..c047a15e3fa39 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -750,6 +750,13 @@ static void iso_sock_kill(struct sock *sk)
BT_DBG("sk %p state %d", sk, sk->sk_state);
+ /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
+ if (iso_pi(sk)->conn) {
+ iso_conn_lock(iso_pi(sk)->conn);
+ iso_pi(sk)->conn->sk = NULL;
+ iso_conn_unlock(iso_pi(sk)->conn);
+ }
+
/* Kill poor orphan */
bt_sock_unlink(&iso_sk_list, sk);
sock_set_flag(sk, SOCK_DEAD);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 459/563] Bluetooth: ISO: free rx_skb if not consumed
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (457 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 458/563] Bluetooth: ISO: Fix possible UAF on iso_conn_free Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 460/563] Bluetooth: ISO: dont leak skb in ISO_CONT RX Greg Kroah-Hartman
` (117 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pauli Virtanen,
Luiz Augusto von Dentz, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <pav@iki.fi>
[ Upstream commit 6ba85da5804efffe15c89b03742ea868f20b4172 ]
If iso_conn is freed when RX is incomplete, free any leftover skb piece.
Fixes: dc26097bdb86 ("Bluetooth: ISO: Use kref to track lifetime of iso_conn")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/iso.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index c047a15e3fa39..9170c46eb47c6 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -111,6 +111,8 @@ static void iso_conn_free(struct kref *ref)
/* Ensure no more work items will run since hci_conn has been dropped */
disable_delayed_work_sync(&conn->timeout_work);
+ kfree_skb(conn->rx_skb);
+
kfree(conn);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 460/563] Bluetooth: ISO: dont leak skb in ISO_CONT RX
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (458 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 459/563] Bluetooth: ISO: free rx_skb if not consumed Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 461/563] Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements Greg Kroah-Hartman
` (116 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pauli Virtanen,
Luiz Augusto von Dentz, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <pav@iki.fi>
[ Upstream commit 5bf863f4c5da055c1eb08887ae4f26d99dbc4aac ]
For ISO_CONT RX, the data from skb is copied to conn->rx_skb, but the
skb is leaked.
Free skb after copying its data.
Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/iso.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 9170c46eb47c6..88602f19decac 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -2416,7 +2416,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
skb->len);
conn->rx_len -= skb->len;
- return;
+ break;
case ISO_END:
skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 461/563] Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (459 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 460/563] Bluetooth: ISO: dont leak skb in ISO_CONT RX Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 462/563] KEYS: X.509: Fix Basic Constraints CA flag parsing Greg Kroah-Hartman
` (115 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz, Paul Menzel,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit 03ddb4ac251463ec5b7b069395d9ab89163dd56c ]
When creating an advertisement for BIG the address shall not be
non-resolvable since in case of acting as BASS/Broadcast Assistant the
address must be the same as the connection in order to use the PAST
method and even when PAST/BASS are not in the picture a Periodic
Advertisement can still be synchronized thus the same argument as to
connectable advertisements still stand.
Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_sync.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 7a7d498908584..eefdb6134ca53 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -1325,7 +1325,7 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
{
struct hci_cp_le_set_ext_adv_params cp;
struct hci_rp_le_set_ext_adv_params rp;
- bool connectable;
+ bool connectable, require_privacy;
u32 flags;
bdaddr_t random_addr;
u8 own_addr_type;
@@ -1363,10 +1363,12 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
return -EPERM;
/* Set require_privacy to true only when non-connectable
- * advertising is used. In that case it is fine to use a
- * non-resolvable private address.
+ * advertising is used and it is not periodic.
+ * In that case it is fine to use a non-resolvable private address.
*/
- err = hci_get_random_address(hdev, !connectable,
+ require_privacy = !connectable && !(adv && adv->periodic);
+
+ err = hci_get_random_address(hdev, require_privacy,
adv_use_rpa(hdev, flags), adv,
&own_addr_type, &random_addr);
if (err < 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 462/563] KEYS: X.509: Fix Basic Constraints CA flag parsing
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (460 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 461/563] Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 463/563] hwrng: ks-sa - fix division by zero in ks_sa_rng_init Greg Kroah-Hartman
` (114 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fan Wu, Lukas Wunner, Herbert Xu,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <wufan@kernel.org>
[ Upstream commit 5851afffe2ab323a53e184ba5a35fddf268f096b ]
Fix the X.509 Basic Constraints CA flag parsing to correctly handle
the ASN.1 DER encoded structure. The parser was incorrectly treating
the length field as the boolean value.
Per RFC 5280 section 4.1, X.509 certificates must use ASN.1 DER encoding.
According to ITU-T X.690, a DER-encoded BOOLEAN is represented as:
Tag (0x01), Length (0x01), Value (0x00 for FALSE, 0xFF for TRUE)
The basicConstraints extension with CA:TRUE is encoded as:
SEQUENCE (0x30) | Length | BOOLEAN (0x01) | Length (0x01) | Value (0xFF)
^-- v[2] ^-- v[3] ^-- v[4]
The parser was checking v[3] (the length field, always 0x01) instead
of v[4] (the actual boolean value, 0xFF for TRUE in DER encoding).
Also handle the case where the extension is an empty SEQUENCE (30 00),
which is valid for CA:FALSE when the default value is omitted as
required by DER encoding rules (X.690 section 11.5).
Per ITU-T X.690-0207:
- Section 11.5: Default values must be omitted in DER
- Section 11.1: DER requires TRUE to be encoded as 0xFF
Link: https://datatracker.ietf.org/doc/html/rfc5280
Link: https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
Fixes: 30eae2b037af ("KEYS: X.509: Parse Basic Constraints for CA")
Signed-off-by: Fan Wu <wufan@kernel.org>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/asymmetric_keys/x509_cert_parser.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
index 2ffe4ae90bea0..8df3fa60a44f8 100644
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -610,11 +610,14 @@ int x509_process_extension(void *context, size_t hdrlen,
/*
* Get hold of the basicConstraints
* v[1] is the encoding size
- * (Expect 0x2 or greater, making it 1 or more bytes)
+ * (Expect 0x00 for empty SEQUENCE with CA:FALSE, or
+ * 0x03 or greater for non-empty SEQUENCE)
* v[2] is the encoding type
* (Expect an ASN1_BOOL for the CA)
- * v[3] is the contents of the ASN1_BOOL
- * (Expect 1 if the CA is TRUE)
+ * v[3] is the length of the ASN1_BOOL
+ * (Expect 1 for a single byte boolean)
+ * v[4] is the contents of the ASN1_BOOL
+ * (Expect 0xFF if the CA is TRUE)
* vlen should match the entire extension size
*/
if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ))
@@ -623,8 +626,13 @@ int x509_process_extension(void *context, size_t hdrlen,
return -EBADMSG;
if (v[1] != vlen - 2)
return -EBADMSG;
- if (vlen >= 4 && v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1)
+ /* Empty SEQUENCE means CA:FALSE (default value omitted per DER) */
+ if (v[1] == 0)
+ return 0;
+ if (vlen >= 5 && v[2] == ASN1_BOOL && v[3] == 1 && v[4] == 0xFF)
ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_CA;
+ else
+ return -EBADMSG;
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 463/563] hwrng: ks-sa - fix division by zero in ks_sa_rng_init
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (461 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 462/563] KEYS: X.509: Fix Basic Constraints CA flag parsing Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 464/563] cramfs: fix incorrect physical page address calculation Greg Kroah-Hartman
` (113 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nishanth Menon, Alexander Sverdlin,
Herbert Xu, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Menon <nm@ti.com>
[ Upstream commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 ]
Fix division by zero in ks_sa_rng_init caused by missing clock
pointer initialization. The clk_get_rate() call is performed on
an uninitialized clk pointer, resulting in division by zero when
calculating delay values.
Add clock initialization code before using the clock.
Fixes: 6d01d8511dce ("hwrng: ks-sa - Add minimum sleep time before ready-polling")
Signed-off-by: Nishanth Menon <nm@ti.com>
drivers/char/hw_random/ks-sa-rng.c | 7 +++++++
1 file changed, 7 insertions(+)
Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/hw_random/ks-sa-rng.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c
index d8fd8a3544828..9e408144a10c1 100644
--- a/drivers/char/hw_random/ks-sa-rng.c
+++ b/drivers/char/hw_random/ks-sa-rng.c
@@ -231,6 +231,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev)
if (IS_ERR(ks_sa_rng->regmap_cfg))
return dev_err_probe(dev, -EINVAL, "syscon_node_to_regmap failed\n");
+ ks_sa_rng->clk = devm_clk_get_enabled(dev, NULL);
+ if (IS_ERR(ks_sa_rng->clk))
+ return dev_err_probe(dev, PTR_ERR(ks_sa_rng->clk), "Failed to get clock\n");
+
pm_runtime_enable(dev);
ret = pm_runtime_resume_and_get(dev);
if (ret < 0) {
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 464/563] cramfs: fix incorrect physical page address calculation
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (462 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 463/563] hwrng: ks-sa - fix division by zero in ks_sa_rng_init Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 465/563] ocfs2: fix double free in user_cluster_connect() Greg Kroah-Hartman
` (112 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alistair Popple, Dev Jain,
David Hildenbrand, Haiyue Wang, Nicolas Pitre, Andrew Morton,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alistair Popple <apopple@nvidia.com>
[ Upstream commit 20a8e0454d833d80d0c0cae304841a50a2a126bd ]
Commit 21aa65bf82a7 ("mm: remove callers of pfn_t functionality")
incorrectly replaced the pfn with the physical address when calling
vmf_insert_mixed(). Instead the phys_to_pfn_t() call should have been
replaced with PHYS_PFN().
Found by inspection after a similar issue was noted in fuse virtio_fs.
Link: https://lkml.kernel.org/r/20250923005333.3165032-1-apopple@nvidia.com
Fixes: 21aa65bf82a7 ("mm: remove callers of pfn_t functionality")
Signed-off-by: Alistair Popple <apopple@nvidia.com>
Reviewed-by: Dev Jain <dev.jain@arm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: Haiyue Wang <haiyuewa@163.com>
Cc: Nicolas Pitre <nico@fluxnic.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/cramfs/inode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c
index b002e9b734f99..56c8005b24a34 100644
--- a/fs/cramfs/inode.c
+++ b/fs/cramfs/inode.c
@@ -412,7 +412,7 @@ static int cramfs_physmem_mmap(struct file *file, struct vm_area_struct *vma)
vm_fault_t vmf;
unsigned long off = i * PAGE_SIZE;
vmf = vmf_insert_mixed(vma, vma->vm_start + off,
- address + off);
+ PHYS_PFN(address + off));
if (vmf & VM_FAULT_ERROR)
ret = vm_fault_to_errno(vmf, 0);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 465/563] ocfs2: fix double free in user_cluster_connect()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (463 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 464/563] cramfs: fix incorrect physical page address calculation Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 466/563] drivers/base/node: fix double free in register_one_node() Greg Kroah-Hartman
` (111 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Joseph Qi,
Goldwyn Rodrigues, Mark Fasheh, Joel Becker, Junxiao Bi,
Changwei Ge, Jun Piao, Andrew Morton, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ]
user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then
the error handling frees "lc" a second time. Set "lc" to NULL on this
path to avoid a double free.
Link: https://lkml.kernel.org/r/aNKDz_7JF7aycZ0k@stanley.mountain
Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Reviewed-by: Goldwyn Rodrigues <rgoldwyn@suse.de>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/stack_user.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
index 0f045e45fa0c3..439742cec3c26 100644
--- a/fs/ocfs2/stack_user.c
+++ b/fs/ocfs2/stack_user.c
@@ -1011,6 +1011,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn)
printk(KERN_ERR "ocfs2: Could not determine"
" locking version\n");
user_cluster_disconnect(conn);
+ lc = NULL;
goto out;
}
wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0));
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 466/563] drivers/base/node: fix double free in register_one_node()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (464 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 465/563] ocfs2: fix double free in user_cluster_connect() Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 467/563] f2fs: fix UAF issue in f2fs_merge_page_bio() Greg Kroah-Hartman
` (110 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Donet Tom, David Hildenbrand,
Oscar Salvador, Alison Schofield, Chris Mason, Danilo Krummrich,
Dave Jiang, Hiroyouki Kamezawa, Joanthan Cameron,
Ritesh Harjani (IBM), Yury Norov (NVIDIA), Zi Yan, Andrew Morton,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donet Tom <donettom@linux.ibm.com>
[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ]
When device_register() fails in register_node(), it calls
put_device(&node->dev). This triggers node_device_release(), which calls
kfree(to_node(dev)), thereby freeing the entire node structure.
As a result, when register_node() returns an error, the node memory has
already been freed. Calling kfree(node) again in register_one_node()
leads to a double free.
This patch removes the redundant kfree(node) from register_one_node() to
prevent the double free.
Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com
Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()")
Signed-off-by: Donet Tom <donettom@linux.ibm.com>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: Oscar Salvador <osalvador@suse.de>
Cc: Alison Schofield <alison.schofield@intel.com>
Cc: Chris Mason <clm@meta.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
Cc: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/node.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/base/node.c b/drivers/base/node.c
index 45d512939c408..67b01d5797377 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -887,7 +887,6 @@ int register_one_node(int nid)
error = register_node(node_devices[nid], nid);
if (error) {
node_devices[nid] = NULL;
- kfree(node);
return error;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 467/563] f2fs: fix UAF issue in f2fs_merge_page_bio()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (465 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 466/563] drivers/base/node: fix double free in register_one_node() Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 468/563] mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands Greg Kroah-Hartman
` (109 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, JY, Chao Yu, Jaegeuk Kim,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit edf7e9040fc52c922db947f9c6c36f07377c52ea ]
As JY reported in bugzilla [1],
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
pc : [0xffffffe51d249484] f2fs_is_cp_guaranteed+0x70/0x98
lr : [0xffffffe51d24adbc] f2fs_merge_page_bio+0x520/0x6d4
CPU: 3 UID: 0 PID: 6790 Comm: kworker/u16:3 Tainted: P B W OE 6.12.30-android16-5-maybe-dirty-4k #1 5f7701c9cbf727d1eebe77c89bbbeb3371e895e5
Tainted: [P]=PROPRIETARY_MODULE, [B]=BAD_PAGE, [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
Workqueue: writeback wb_workfn (flush-254:49)
Call trace:
f2fs_is_cp_guaranteed+0x70/0x98
f2fs_inplace_write_data+0x174/0x2f4
f2fs_do_write_data_page+0x214/0x81c
f2fs_write_single_data_page+0x28c/0x764
f2fs_write_data_pages+0x78c/0xce4
do_writepages+0xe8/0x2fc
__writeback_single_inode+0x4c/0x4b4
writeback_sb_inodes+0x314/0x540
__writeback_inodes_wb+0xa4/0xf4
wb_writeback+0x160/0x448
wb_workfn+0x2f0/0x5dc
process_scheduled_works+0x1c8/0x458
worker_thread+0x334/0x3f0
kthread+0x118/0x1ac
ret_from_fork+0x10/0x20
[1] https://bugzilla.kernel.org/show_bug.cgi?id=220575
The panic was caused by UAF issue w/ below race condition:
kworker
- writepages
- f2fs_write_cache_pages
- f2fs_write_single_data_page
- f2fs_do_write_data_page
- f2fs_inplace_write_data
- f2fs_merge_page_bio
- add_inu_page
: cache page #1 into bio & cache bio in
io->bio_list
- f2fs_write_single_data_page
- f2fs_do_write_data_page
- f2fs_inplace_write_data
- f2fs_merge_page_bio
- add_inu_page
: cache page #2 into bio which is linked
in io->bio_list
write
- f2fs_write_begin
: write page #1
- f2fs_folio_wait_writeback
- f2fs_submit_merged_ipu_write
- f2fs_submit_write_bio
: submit bio which inclues page #1 and #2
software IRQ
- f2fs_write_end_io
- fscrypt_free_bounce_page
: freed bounced page which belongs to page #2
- inc_page_count( , WB_DATA_TYPE(data_folio), false)
: data_folio points to fio->encrypted_page
the bounced page can be freed before
accessing it in f2fs_is_cp_guarantee()
It can reproduce w/ below testcase:
Run below script in shell #1:
for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \
-c "pwrite 0 32k" -c "fdatasync"
Run below script in shell #2:
for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \
-c "pwrite 0 32k" -c "fdatasync"
So, in f2fs_merge_page_bio(), let's avoid using fio->encrypted_page after
commit page into internal ipu cache.
Fixes: 0b20fcec8651 ("f2fs: cache global IPU bio")
Reported-by: JY <JY.Ho@mediatek.com>
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/data.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 6e39a15a942a9..50c90bd039235 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -911,7 +911,7 @@ int f2fs_merge_page_bio(struct f2fs_io_info *fio)
if (fio->io_wbc)
wbc_account_cgroup_owner(fio->io_wbc, folio, folio_size(folio));
- inc_page_count(fio->sbi, WB_DATA_TYPE(data_folio, false));
+ inc_page_count(fio->sbi, WB_DATA_TYPE(folio, false));
*fio->last_block = fio->new_blkaddr;
*fio->bio = bio;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 468/563] mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (466 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 467/563] f2fs: fix UAF issue in f2fs_merge_page_bio() Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 469/563] PCI: j721e: Fix incorrect error message in probe() Greg Kroah-Hartman
` (108 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Erick Karanja, Miquel Raynal,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erick Karanja <karanja99erick@gmail.com>
[ Upstream commit 8ed4728eb9f10b57c3eb02e0f6933a89ffcb8a91 ]
In case of a jump to the err label due to atmel_nand_create() or
atmel_nand_controller_add_nand() failure, the reference to nand_np
need to be released
Use for_each_child_of_node_scoped() to fix the issue.
Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")
Signed-off-by: Erick Karanja <karanja99erick@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/atmel/nand-controller.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
index db94d14a3807f..49e00458eebeb 100644
--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
+++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
@@ -1858,7 +1858,7 @@ atmel_nand_controller_legacy_add_nands(struct atmel_nand_controller *nc)
static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
{
- struct device_node *np, *nand_np;
+ struct device_node *np;
struct device *dev = nc->dev;
int ret, reg_cells;
u32 val;
@@ -1885,7 +1885,7 @@ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
reg_cells += val;
- for_each_child_of_node(np, nand_np) {
+ for_each_child_of_node_scoped(np, nand_np) {
struct atmel_nand *nand;
nand = atmel_nand_create(nc, nand_np, reg_cells);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 469/563] PCI: j721e: Fix incorrect error message in probe()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (467 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 468/563] mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 470/563] idpf: fix mismatched free function for dma_alloc_coherent Greg Kroah-Hartman
` (107 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alok Tiwari, Manivannan Sadhasivam,
Siddharth Vadapalli, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <alok.a.tiwari@oracle.com>
[ Upstream commit cfcd6cab2f33c24a68517f9e3131480b4000c2be ]
The probe() function prints "pm_runtime_get_sync failed" when
j721e_pcie_ctrl_init() returns an error. This is misleading since
the failure is not from pm_runtime, but from the controller init
routine. Update the error message to correctly reflect the source.
No functional changes.
Fixes: f3e25911a430 ("PCI: j721e: Add TI J721E PCIe driver")
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com>
Link: https://patch.msgid.link/20250905211436.3048282-1-alok.a.tiwari@oracle.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/cadence/pci-j721e.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c
index 6c93f39d02888..5e445a7bda332 100644
--- a/drivers/pci/controller/cadence/pci-j721e.c
+++ b/drivers/pci/controller/cadence/pci-j721e.c
@@ -549,7 +549,7 @@ static int j721e_pcie_probe(struct platform_device *pdev)
ret = j721e_pcie_ctrl_init(pcie);
if (ret < 0) {
- dev_err_probe(dev, ret, "pm_runtime_get_sync failed\n");
+ dev_err_probe(dev, ret, "j721e_pcie_ctrl_init failed\n");
goto err_get_sync;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 470/563] idpf: fix mismatched free function for dma_alloc_coherent
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (468 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 469/563] PCI: j721e: Fix incorrect error message in probe() Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 471/563] tcp: use skb->len instead of skb->truesize in tcp_can_ingest() Greg Kroah-Hartman
` (106 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alok Tiwari, Simon Horman,
Aleksandr Loktionov, Jacob Keller, Madhu Chittim, Jakub Kicinski,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <alok.a.tiwari@oracle.com>
[ Upstream commit b9bd25f47eb79c9eb275e3d9ac3983dc88577dd4 ]
The mailbox receive path allocates coherent DMA memory with
dma_alloc_coherent(), but frees it with dmam_free_coherent().
This is incorrect since dmam_free_coherent() is only valid for
buffers allocated with dmam_alloc_coherent().
Fix the mismatch by using dma_free_coherent() instead of
dmam_free_coherent
Fixes: e54232da1238 ("idpf: refactor idpf_recv_mb_msg")
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Madhu Chittim <madhu.chittim@intel.com>
Link: https://patch.msgid.link/20250925180212.415093-1-alok.a.tiwari@oracle.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
index 6330d4a0ae075..c1f34381333d1 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
@@ -702,9 +702,9 @@ int idpf_recv_mb_msg(struct idpf_adapter *adapter)
/* If post failed clear the only buffer we supplied */
if (post_err) {
if (dma_mem)
- dmam_free_coherent(&adapter->pdev->dev,
- dma_mem->size, dma_mem->va,
- dma_mem->pa);
+ dma_free_coherent(&adapter->pdev->dev,
+ dma_mem->size, dma_mem->va,
+ dma_mem->pa);
break;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 471/563] tcp: use skb->len instead of skb->truesize in tcp_can_ingest()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (469 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 470/563] idpf: fix mismatched free function for dma_alloc_coherent Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 472/563] nfp: fix RSS hash key size when RSS is not supported Greg Kroah-Hartman
` (105 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Jakub Kicinski,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit f017c1f768b670bced4464476655b27dfb937e67 ]
Some applications are stuck to the 20th century and still use
small SO_RCVBUF values.
After the blamed commit, we can drop packets especially
when using LRO/hw-gro enabled NIC and small MSS (1500) values.
LRO/hw-gro NIC pack multiple segments into pages, allowing
tp->scaling_ratio to be set to a high value.
Whenever the receive queue gets full, we can receive a small packet
filling RWIN, but with a high skb->truesize, because most NIC use 4K page
plus sk_buff metadata even when receiving less than 1500 bytes of payload.
Even if we refine how tp->scaling_ratio is estimated,
we could have an issue at the start of the flow, because
the first round of packets (IW10) will be sent based on
the initial tp->scaling_ratio (1/2)
Relax tcp_can_ingest() to use skb->len instead of skb->truesize,
allowing the peer to use final RWIN, assuming a 'perfect'
scaling_ratio of 1.
Fixes: 1d2fbaad7cd8 ("tcp: stronger sk_rcvbuf checks")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250927092827.2707901-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/tcp_input.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 71b76e98371a6..64f93668a8452 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4890,12 +4890,23 @@ static int tcp_prune_queue(struct sock *sk, const struct sk_buff *in_skb);
/* Check if this incoming skb can be added to socket receive queues
* while satisfying sk->sk_rcvbuf limit.
+ *
+ * In theory we should use skb->truesize, but this can cause problems
+ * when applications use too small SO_RCVBUF values.
+ * When LRO / hw gro is used, the socket might have a high tp->scaling_ratio,
+ * allowing RWIN to be close to available space.
+ * Whenever the receive queue gets full, we can receive a small packet
+ * filling RWIN, but with a high skb->truesize, because most NIC use 4K page
+ * plus sk_buff metadata even when receiving less than 1500 bytes of payload.
+ *
+ * Note that we use skb->len to decide to accept or drop this packet,
+ * but sk->sk_rmem_alloc is the sum of all skb->truesize.
*/
static bool tcp_can_ingest(const struct sock *sk, const struct sk_buff *skb)
{
- unsigned int new_mem = atomic_read(&sk->sk_rmem_alloc) + skb->truesize;
+ unsigned int rmem = atomic_read(&sk->sk_rmem_alloc);
- return new_mem <= sk->sk_rcvbuf;
+ return rmem + skb->len <= sk->sk_rcvbuf;
}
static int tcp_try_rmem_schedule(struct sock *sk, const struct sk_buff *skb,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 472/563] nfp: fix RSS hash key size when RSS is not supported
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (470 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 471/563] tcp: use skb->len instead of skb->truesize in tcp_can_ingest() Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 473/563] net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable Greg Kroah-Hartman
` (104 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kohei Enju, Jakub Kicinski,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <enjuk@amazon.com>
[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ]
The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when
devices don't support RSS, and callers treat the negative value as a
large positive value since the return type is u32.
Return 0 when devices don't support RSS, aligning with the ethtool
interface .get_rxfh_key_size() that requires returning 0 in such cases.
Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function")
Signed-off-by: Kohei Enju <enjuk@amazon.com>
Link: https://patch.msgid.link/20250929054230.68120-1-enjuk@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
index a36215195923c..16c828dd5c1a3 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
@@ -1788,7 +1788,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev)
struct nfp_net *nn = netdev_priv(netdev);
if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY))
- return -EOPNOTSUPP;
+ return 0;
return nfp_net_rss_key_sz(nn);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 473/563] net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (471 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 472/563] nfp: fix RSS hash key size when RSS is not supported Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 474/563] net: dlink: handle copy_thresh allocation failure Greg Kroah-Hartman
` (103 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kohei Enju, Jakub Kicinski,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <enjuk@amazon.com>
[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ]
In EC2 instances where the RSS hash key is not configurable, ethtool
shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally
returns ENA_HASH_KEY_SIZE.
Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not
supported") added proper handling for devices that don't support RSS
hash key configuration, but ena_get_rxfh_key_size() has been unchanged.
When the RSS hash key is not configurable, return 0 instead of
ENA_HASH_KEY_SIZE to clarify getting the value is not supported.
Tested on m5 instance families.
Without patch:
# ethtool -x ens5 | grep -A 1 "RSS hash key"
RSS hash key:
00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
With patch:
# ethtool -x ens5 | grep -A 1 "RSS hash key"
RSS hash key:
Operation not supported
Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported")
Signed-off-by: Kohei Enju <enjuk@amazon.com>
Link: https://patch.msgid.link/20250929050247.51680-1-enjuk@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
index a81d3a7a3bb9a..fe3479b84a1f3 100644
--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
@@ -865,7 +865,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev)
static u32 ena_get_rxfh_key_size(struct net_device *netdev)
{
- return ENA_HASH_KEY_SIZE;
+ struct ena_adapter *adapter = netdev_priv(netdev);
+ struct ena_rss *rss = &adapter->ena_dev->rss;
+
+ return rss->hash_key ? ENA_HASH_KEY_SIZE : 0;
}
static int ena_indirection_table_set(struct ena_adapter *adapter,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 474/563] net: dlink: handle copy_thresh allocation failure
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (472 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 473/563] net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 475/563] net/mlx5: Stop polling for command response if interface goes down Greg Kroah-Hartman
` (102 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, Yeounsu Moon,
Andrew Lunn, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yeounsu Moon <yyyynoom@gmail.com>
[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ]
The driver did not handle failure of `netdev_alloc_skb_ip_align()`.
If the allocation failed, dereferencing `skb->protocol` could lead to
a NULL pointer dereference.
This patch tries to allocate `skb`. If the allocation fails, it falls
back to the normal path.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Tested-on: D-Link DGE-550T Rev-A3
Signed-off-by: Yeounsu Moon <yyyynoom@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/dlink/dl2k.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
index 6bbf6e5584e54..1996d2e4e3e2c 100644
--- a/drivers/net/ethernet/dlink/dl2k.c
+++ b/drivers/net/ethernet/dlink/dl2k.c
@@ -964,15 +964,18 @@ receive_packet (struct net_device *dev)
} else {
struct sk_buff *skb;
+ skb = NULL;
/* Small skbuffs for short packets */
- if (pkt_len > copy_thresh) {
+ if (pkt_len <= copy_thresh)
+ skb = netdev_alloc_skb_ip_align(dev, pkt_len);
+ if (!skb) {
dma_unmap_single(&np->pdev->dev,
desc_to_dma(desc),
np->rx_buf_sz,
DMA_FROM_DEVICE);
skb_put (skb = np->rx_skbuff[entry], pkt_len);
np->rx_skbuff[entry] = NULL;
- } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) {
+ } else {
dma_sync_single_for_cpu(&np->pdev->dev,
desc_to_dma(desc),
np->rx_buf_sz,
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 475/563] net/mlx5: Stop polling for command response if interface goes down
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (473 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 474/563] net: dlink: handle copy_thresh allocation failure Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 476/563] net/mlx5: pagealloc: Fix reclaim race during command interface teardown Greg Kroah-Hartman
` (101 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Moshe Shemesh, Shay Drori,
Tariq Toukan, Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moshe Shemesh <moshe@nvidia.com>
[ Upstream commit b1f0349bd6d320c382df2e7f6fc2ac95c85f2b18 ]
Stop polling on firmware response to command in polling mode if the
command interface got down. This situation can occur, for example, if a
firmware fatal error is detected during polling.
This change halts the polling process when the command interface goes
down, preventing unnecessary waits.
Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible")
Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
Reviewed-by: Shay Drori <shayd@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index e395ef5f356eb..722282cebce9a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -294,6 +294,10 @@ static void poll_timeout(struct mlx5_cmd_work_ent *ent)
return;
}
cond_resched();
+ if (mlx5_cmd_is_down(dev)) {
+ ent->ret = -ENXIO;
+ return;
+ }
} while (time_before(jiffies, poll_end));
ent->ret = -ETIMEDOUT;
@@ -1070,7 +1074,7 @@ static void cmd_work_handler(struct work_struct *work)
poll_timeout(ent);
/* make sure we read the descriptor after ownership is SW */
rmb();
- mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, (ent->ret == -ETIMEDOUT));
+ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, !!ent->ret);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 476/563] net/mlx5: pagealloc: Fix reclaim race during command interface teardown
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (474 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 475/563] net/mlx5: Stop polling for command response if interface goes down Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 477/563] net/mlx5: fw reset, add reset timeout work Greg Kroah-Hartman
` (100 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shay Drory, Moshe Shemesh,
Tariq Toukan, Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shay Drory <shayd@nvidia.com>
[ Upstream commit 79a0e32b32ac4e4f9e4bb22be97f371c8c116c88 ]
The reclaim_pages_cmd() function sends a command to the firmware to
reclaim pages if the command interface is active.
A race condition can occur if the command interface goes down (e.g., due
to a PCI error) while the mlx5_cmd_do() call is in flight. In this
case, mlx5_cmd_do() will return an error. The original code would
propagate this error immediately, bypassing the software-based page
reclamation logic that is supposed to run when the command interface is
down.
Fix this by checking whether mlx5_cmd_do() returns -ENXIO, which mark
that command interface is down. If this is the case, fall through to
the software reclamation path. If the command failed for any another
reason, or finished successfully, return as before.
Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
index 9bc9bd83c2324..cd68c4b2c0bf9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
@@ -489,9 +489,12 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev,
u32 func_id;
u32 npages;
u32 i = 0;
+ int err;
- if (!mlx5_cmd_is_down(dev))
- return mlx5_cmd_do(dev, in, in_size, out, out_size);
+ err = mlx5_cmd_do(dev, in, in_size, out, out_size);
+ /* If FW is gone (-ENXIO), proceed to forceful reclaim */
+ if (err != -ENXIO)
+ return err;
/* No hard feelings, we want our pages back! */
npages = MLX5_GET(manage_pages_in, in, input_num_entries);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 477/563] net/mlx5: fw reset, add reset timeout work
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (475 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 476/563] net/mlx5: pagealloc: Fix reclaim race during command interface teardown Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 478/563] smb: client: fix crypto buffers in non-linear memory Greg Kroah-Hartman
` (99 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Moshe Shemesh, Shay Drori,
Tariq Toukan, Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moshe Shemesh <moshe@nvidia.com>
[ Upstream commit 5cfbe7ebfa42fd3c517a701dab5bd73524da9088 ]
Add sync reset timeout to stop poll_sync_reset in case there was no
reset done or abort event within timeout. Otherwise poll sync reset will
just continue and in case of fw fatal error no health reporting will be
done.
Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event")
Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
Reviewed-by: Shay Drori <shayd@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/mellanox/mlx5/core/fw_reset.c | 24 +++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
index 22995131824a0..89e399606877b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
@@ -27,6 +27,7 @@ struct mlx5_fw_reset {
struct work_struct reset_reload_work;
struct work_struct reset_now_work;
struct work_struct reset_abort_work;
+ struct delayed_work reset_timeout_work;
unsigned long reset_flags;
u8 reset_method;
struct timer_list timer;
@@ -259,6 +260,8 @@ static int mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *dev, bool
return -EALREADY;
}
+ if (current_work() != &fw_reset->reset_timeout_work.work)
+ cancel_delayed_work(&fw_reset->reset_timeout_work);
mlx5_stop_sync_reset_poll(dev);
if (poll_health)
mlx5_start_health_poll(dev);
@@ -330,6 +333,11 @@ static int mlx5_sync_reset_set_reset_requested(struct mlx5_core_dev *dev)
}
mlx5_stop_health_poll(dev, true);
mlx5_start_sync_reset_poll(dev);
+
+ if (!test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS,
+ &fw_reset->reset_flags))
+ schedule_delayed_work(&fw_reset->reset_timeout_work,
+ msecs_to_jiffies(mlx5_tout_ms(dev, PCI_SYNC_UPDATE)));
return 0;
}
@@ -739,6 +747,19 @@ static void mlx5_sync_reset_events_handle(struct mlx5_fw_reset *fw_reset, struct
}
}
+static void mlx5_sync_reset_timeout_work(struct work_struct *work)
+{
+ struct delayed_work *dwork = container_of(work, struct delayed_work,
+ work);
+ struct mlx5_fw_reset *fw_reset =
+ container_of(dwork, struct mlx5_fw_reset, reset_timeout_work);
+ struct mlx5_core_dev *dev = fw_reset->dev;
+
+ if (mlx5_sync_reset_clear_reset_requested(dev, true))
+ return;
+ mlx5_core_warn(dev, "PCI Sync FW Update Reset Timeout.\n");
+}
+
static int fw_reset_event_notifier(struct notifier_block *nb, unsigned long action, void *data)
{
struct mlx5_fw_reset *fw_reset = mlx5_nb_cof(nb, struct mlx5_fw_reset, nb);
@@ -822,6 +843,7 @@ void mlx5_drain_fw_reset(struct mlx5_core_dev *dev)
cancel_work_sync(&fw_reset->reset_reload_work);
cancel_work_sync(&fw_reset->reset_now_work);
cancel_work_sync(&fw_reset->reset_abort_work);
+ cancel_delayed_work(&fw_reset->reset_timeout_work);
}
static const struct devlink_param mlx5_fw_reset_devlink_params[] = {
@@ -865,6 +887,8 @@ int mlx5_fw_reset_init(struct mlx5_core_dev *dev)
INIT_WORK(&fw_reset->reset_reload_work, mlx5_sync_reset_reload_work);
INIT_WORK(&fw_reset->reset_now_work, mlx5_sync_reset_now_event);
INIT_WORK(&fw_reset->reset_abort_work, mlx5_sync_reset_abort_event);
+ INIT_DELAYED_WORK(&fw_reset->reset_timeout_work,
+ mlx5_sync_reset_timeout_work);
init_completion(&fw_reset->done);
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 478/563] smb: client: fix crypto buffers in non-linear memory
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (476 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 477/563] net/mlx5: fw reset, add reset timeout work Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 479/563] bonding: fix xfrm offload feature setup on active-backup mode Greg Kroah-Hartman
` (98 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Enzo Matsumiya, Steve French,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Enzo Matsumiya <ematsumiya@suse.de>
[ Upstream commit 998a67b954680f26f3734040aeeed08642d49721 ]
The crypto API, through the scatterlist API, expects input buffers to be
in linear memory. We handle this with the cifs_sg_set_buf() helper
that converts vmalloc'd memory to their corresponding pages.
However, when we allocate our aead_request buffer (@creq in
smb2ops.c::crypt_message()), we do so with kvzalloc(), which possibly
puts aead_request->__ctx in vmalloc area.
AEAD algorithm then uses ->__ctx for its private/internal data and
operations, and uses sg_set_buf() for such data on a few places.
This works fine as long as @creq falls into kmalloc zone (small
requests) or vmalloc'd memory is still within linear range.
Tasks' stacks are vmalloc'd by default (CONFIG_VMAP_STACK=y), so too
many tasks will increment the base stacks' addresses to a point where
virt_addr_valid(buf) will fail (BUG() in sg_set_buf()) when that
happens.
In practice: too many parallel reads and writes on an encrypted mount
will trigger this bug.
To fix this, always alloc @creq with kmalloc() instead.
Also drop the @sensitive_size variable/arguments since
kfree_sensitive() doesn't need it.
Backtrace:
[ 945.272081] ------------[ cut here ]------------
[ 945.272774] kernel BUG at include/linux/scatterlist.h:209!
[ 945.273520] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI
[ 945.274412] CPU: 7 UID: 0 PID: 56 Comm: kworker/u33:0 Kdump: loaded Not tainted 6.15.0-lku-11779-g8e9d6efccdd7-dirty #1 PREEMPT(voluntary)
[ 945.275736] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014
[ 945.276877] Workqueue: writeback wb_workfn (flush-cifs-2)
[ 945.277457] RIP: 0010:crypto_gcm_init_common+0x1f9/0x220
[ 945.278018] Code: b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00 80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0f 0b 48 c7 04 24 01 00 00 00 48 8b
[ 945.279992] RSP: 0018:ffffc90000a27360 EFLAGS: 00010246
[ 945.280578] RAX: 0000000000000000 RBX: ffffc90001d85060 RCX: 0000000000000030
[ 945.281376] RDX: 0000000000080000 RSI: 0000000000000000 RDI: ffffc90081d85070
[ 945.282145] RBP: ffffc90001d85010 R08: ffffc90001d85000 R09: 0000000000000000
[ 945.282898] R10: ffffc90001d85090 R11: 0000000000001000 R12: ffffc90001d85070
[ 945.283656] R13: ffff888113522948 R14: ffffc90001d85060 R15: ffffc90001d85010
[ 945.284407] FS: 0000000000000000(0000) GS:ffff8882e66cf000(0000) knlGS:0000000000000000
[ 945.285262] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 945.285884] CR2: 00007fa7ffdd31f4 CR3: 000000010540d000 CR4: 0000000000350ef0
[ 945.286683] Call Trace:
[ 945.286952] <TASK>
[ 945.287184] ? crypt_message+0x33f/0xad0 [cifs]
[ 945.287719] crypto_gcm_encrypt+0x36/0xe0
[ 945.288152] crypt_message+0x54a/0xad0 [cifs]
[ 945.288724] smb3_init_transform_rq+0x277/0x300 [cifs]
[ 945.289300] smb_send_rqst+0xa3/0x160 [cifs]
[ 945.289944] cifs_call_async+0x178/0x340 [cifs]
[ 945.290514] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs]
[ 945.291177] smb2_async_writev+0x3e3/0x670 [cifs]
[ 945.291759] ? find_held_lock+0x32/0x90
[ 945.292212] ? netfs_advance_write+0xf2/0x310
[ 945.292723] netfs_advance_write+0xf2/0x310
[ 945.293210] netfs_write_folio+0x346/0xcc0
[ 945.293689] ? __pfx__raw_spin_unlock_irq+0x10/0x10
[ 945.294250] netfs_writepages+0x117/0x460
[ 945.294724] do_writepages+0xbe/0x170
[ 945.295152] ? find_held_lock+0x32/0x90
[ 945.295600] ? kvm_sched_clock_read+0x11/0x20
[ 945.296103] __writeback_single_inode+0x56/0x4b0
[ 945.296643] writeback_sb_inodes+0x229/0x550
[ 945.297140] __writeback_inodes_wb+0x4c/0xe0
[ 945.297642] wb_writeback+0x2f1/0x3f0
[ 945.298069] wb_workfn+0x300/0x490
[ 945.298472] process_one_work+0x1fe/0x590
[ 945.298949] worker_thread+0x1ce/0x3c0
[ 945.299397] ? __pfx_worker_thread+0x10/0x10
[ 945.299900] kthread+0x119/0x210
[ 945.300285] ? __pfx_kthread+0x10/0x10
[ 945.300729] ret_from_fork+0x119/0x1b0
[ 945.301163] ? __pfx_kthread+0x10/0x10
[ 945.301601] ret_from_fork_asm+0x1a/0x30
[ 945.302055] </TASK>
Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list")
Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smb2ops.c | 17 ++++++-----------
1 file changed, 6 insertions(+), 11 deletions(-)
diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index e586f3f4b5c93..68286673afc99 100644
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -4219,7 +4219,7 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len,
static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst *rqst,
int num_rqst, const u8 *sig, u8 **iv,
struct aead_request **req, struct sg_table *sgt,
- unsigned int *num_sgs, size_t *sensitive_size)
+ unsigned int *num_sgs)
{
unsigned int req_size = sizeof(**req) + crypto_aead_reqsize(tfm);
unsigned int iv_size = crypto_aead_ivsize(tfm);
@@ -4236,9 +4236,8 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst
len += req_size;
len = ALIGN(len, __alignof__(struct scatterlist));
len += array_size(*num_sgs, sizeof(struct scatterlist));
- *sensitive_size = len;
- p = kvzalloc(len, GFP_NOFS);
+ p = kzalloc(len, GFP_NOFS);
if (!p)
return ERR_PTR(-ENOMEM);
@@ -4252,16 +4251,14 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst
static void *smb2_get_aead_req(struct crypto_aead *tfm, struct smb_rqst *rqst,
int num_rqst, const u8 *sig, u8 **iv,
- struct aead_request **req, struct scatterlist **sgl,
- size_t *sensitive_size)
+ struct aead_request **req, struct scatterlist **sgl)
{
struct sg_table sgtable = {};
unsigned int skip, num_sgs, i, j;
ssize_t rc;
void *p;
- p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable,
- &num_sgs, sensitive_size);
+ p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, &num_sgs);
if (IS_ERR(p))
return ERR_CAST(p);
@@ -4350,7 +4347,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
DECLARE_CRYPTO_WAIT(wait);
unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize);
void *creq;
- size_t sensitive_size;
rc = smb2_get_enc_key(server, le64_to_cpu(tr_hdr->SessionId), enc, key);
if (rc) {
@@ -4376,8 +4372,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
return rc;
}
- creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg,
- &sensitive_size);
+ creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg);
if (IS_ERR(creq))
return PTR_ERR(creq);
@@ -4407,7 +4402,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
if (!rc && enc)
memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
- kvfree_sensitive(creq, sensitive_size);
+ kfree_sensitive(creq);
return rc;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 479/563] bonding: fix xfrm offload feature setup on active-backup mode
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (477 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 478/563] smb: client: fix crypto buffers in non-linear memory Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 480/563] net: enetc: initialize SW PIR and CIR based HW PIR and CIR values Greg Kroah-Hartman
` (97 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hangbin Liu, Paolo Abeni,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <liuhangbin@gmail.com>
[ Upstream commit 5b66169f6be4847008c0aea50885ff0632151479 ]
The active-backup bonding mode supports XFRM ESP offload. However, when
a bond is added using command like `ip link add bond0 type bond mode 1
miimon 100`, the `ethtool -k` command shows that the XFRM ESP offload is
disabled. This occurs because, in bond_newlink(), we change bond link
first and register bond device later. So the XFRM feature update in
bond_option_mode_set() is not called as the bond device is not yet
registered, leading to the offload feature not being set successfully.
To resolve this issue, we can modify the code order in bond_newlink() to
ensure that the bond device is registered first before changing the bond
link parameters. This change will allow the XFRM ESP offload feature to be
correctly enabled.
Fixes: 007ab5345545 ("bonding: fix feature flag setting at init time")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://patch.msgid.link/20250925023304.472186-1-liuhangbin@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/bonding/bond_main.c | 2 +-
drivers/net/bonding/bond_netlink.c | 16 +++++++++-------
include/net/bonding.h | 1 +
3 files changed, 11 insertions(+), 8 deletions(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 57be04f6cb11a..f4f0feddd9fa0 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4411,7 +4411,7 @@ void bond_work_init_all(struct bonding *bond)
INIT_DELAYED_WORK(&bond->slave_arr_work, bond_slave_arr_handler);
}
-static void bond_work_cancel_all(struct bonding *bond)
+void bond_work_cancel_all(struct bonding *bond)
{
cancel_delayed_work_sync(&bond->mii_work);
cancel_delayed_work_sync(&bond->arp_work);
diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
index 57fff2421f1b5..7a9d73ec8e91c 100644
--- a/drivers/net/bonding/bond_netlink.c
+++ b/drivers/net/bonding/bond_netlink.c
@@ -579,20 +579,22 @@ static int bond_newlink(struct net_device *bond_dev,
struct rtnl_newlink_params *params,
struct netlink_ext_ack *extack)
{
+ struct bonding *bond = netdev_priv(bond_dev);
struct nlattr **data = params->data;
struct nlattr **tb = params->tb;
int err;
- err = bond_changelink(bond_dev, tb, data, extack);
- if (err < 0)
+ err = register_netdevice(bond_dev);
+ if (err)
return err;
- err = register_netdevice(bond_dev);
- if (!err) {
- struct bonding *bond = netdev_priv(bond_dev);
+ netif_carrier_off(bond_dev);
+ bond_work_init_all(bond);
- netif_carrier_off(bond_dev);
- bond_work_init_all(bond);
+ err = bond_changelink(bond_dev, tb, data, extack);
+ if (err) {
+ bond_work_cancel_all(bond);
+ unregister_netdevice(bond_dev);
}
return err;
diff --git a/include/net/bonding.h b/include/net/bonding.h
index e06f0d63b2c17..bd56ad976cfb0 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -711,6 +711,7 @@ struct bond_vlan_tag *bond_verify_device_path(struct net_device *start_dev,
int bond_update_slave_arr(struct bonding *bond, struct slave *skipslave);
void bond_slave_arr_work_rearm(struct bonding *bond, unsigned long delay);
void bond_work_init_all(struct bonding *bond);
+void bond_work_cancel_all(struct bonding *bond);
#ifdef CONFIG_PROC_FS
void bond_create_proc_entry(struct bonding *bond);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 480/563] net: enetc: initialize SW PIR and CIR based HW PIR and CIR values
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (478 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 479/563] bonding: fix xfrm offload feature setup on active-backup mode Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 481/563] iommufd: Register iommufd mock devices with fwspec Greg Kroah-Hartman
` (96 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wei Fang, Paolo Abeni, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <wei.fang@nxp.com>
[ Upstream commit 2aff4420efc2910e905ee5b000e04e87422aebc4 ]
Software can only initialize the PIR and CIR of the command BD ring after
a FLR, and these two registers can only be set to 0. But the reset values
of these two registers are 0, so software does not need to update them.
If there is no a FLR and PIR and CIR are not 0, resetting them to 0 or
other values by software will cause the command BD ring to work
abnormally. This is because of an internal context in the ring prefetch
logic that will retain the state from the first incarnation of the ring
and continue prefetching from the stale location when the ring is
reinitialized. The internal context can only be reset by the FLR.
In addition, there is a logic error in the implementation, next_to_clean
indicates the software CIR and next_to_use indicates the software PIR.
But the current driver uses next_to_clean to set PIR and use next_to_use
to set CIR. This does not cause a problem in actual use, because the
current command BD ring is only initialized after FLR, and the initial
values of next_to_use and next_to_clean are both 0.
Therefore, this patch removes the initialization of PIR and CIR. Instead,
next_to_use and next_to_clean are initialized by reading the values of
PIR and CIR.
Fixes: 4701073c3deb ("net: enetc: add initial netc-lib driver to support NTMP")
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Link: https://patch.msgid.link/20250926013954.2003456-1-wei.fang@nxp.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/freescale/enetc/ntmp.c | 15 +++++----------
1 file changed, 5 insertions(+), 10 deletions(-)
diff --git a/drivers/net/ethernet/freescale/enetc/ntmp.c b/drivers/net/ethernet/freescale/enetc/ntmp.c
index ba32c1bbd9e18..0c1d343253bfb 100644
--- a/drivers/net/ethernet/freescale/enetc/ntmp.c
+++ b/drivers/net/ethernet/freescale/enetc/ntmp.c
@@ -52,24 +52,19 @@ int ntmp_init_cbdr(struct netc_cbdr *cbdr, struct device *dev,
cbdr->addr_base_align = PTR_ALIGN(cbdr->addr_base,
NTMP_BASE_ADDR_ALIGN);
- cbdr->next_to_clean = 0;
- cbdr->next_to_use = 0;
spin_lock_init(&cbdr->ring_lock);
+ cbdr->next_to_use = netc_read(cbdr->regs.pir);
+ cbdr->next_to_clean = netc_read(cbdr->regs.cir);
+
/* Step 1: Configure the base address of the Control BD Ring */
netc_write(cbdr->regs.bar0, lower_32_bits(cbdr->dma_base_align));
netc_write(cbdr->regs.bar1, upper_32_bits(cbdr->dma_base_align));
- /* Step 2: Configure the producer index register */
- netc_write(cbdr->regs.pir, cbdr->next_to_clean);
-
- /* Step 3: Configure the consumer index register */
- netc_write(cbdr->regs.cir, cbdr->next_to_use);
-
- /* Step4: Configure the number of BDs of the Control BD Ring */
+ /* Step 2: Configure the number of BDs of the Control BD Ring */
netc_write(cbdr->regs.lenr, cbdr->bd_num);
- /* Step 5: Enable the Control BD Ring */
+ /* Step 3: Enable the Control BD Ring */
netc_write(cbdr->regs.mr, NETC_CBDR_MR_EN);
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 481/563] iommufd: Register iommufd mock devices with fwspec
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (479 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 480/563] net: enetc: initialize SW PIR and CIR based HW PIR and CIR values Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 482/563] Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" Greg Kroah-Hartman
` (95 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guixin Liu, Lu Baolu, Qinyun Tan,
Jason Gunthorpe, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixin Liu <kanie@linux.alibaba.com>
[ Upstream commit 2a918911ed3d0841923525ed0fe707762ee78844 ]
Since the bus ops were retired the iommu subsystem changed to using fwspec
to match the iommu driver to the iommu device. If a device has a NULL
fwspec then it is matched to the first iommu driver with a NULL fwspec,
effectively disabling support for systems with more than one non-fwspec
iommu driver.
Thus, if the iommufd selfest are run in an x86 system that registers a
non-fwspec iommu driver they fail to bind their mock devices to the mock
iommu driver.
Fix this by allocating a software fwnode for mock iommu driver's
iommu_device, and set it to the device which mock iommu driver created.
This is done by adding a new helper iommu_mock_device_add() which abuses
the internals of the fwspec system to establish a fwspec before the device
is added and is careful not to leak it. A matching dummy fwspec is
automatically added to the mock iommu driver.
Test by "make -C toosl/testing/selftests TARGETS=iommu run_tests":
PASSED: 229 / 229 tests passed.
In addition, this issue is also can be found on amd platform, and
also tested on a amd machine.
Link: https://patch.msgid.link/r/20250925054730.3877-1-kanie@linux.alibaba.com
Fixes: 17de3f5fdd35 ("iommu: Retire bus ops")
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Tested-by: Qinyun Tan <qinyuntan@linux.alibaba.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/iommu-priv.h | 2 ++
drivers/iommu/iommu.c | 26 ++++++++++++++++++++++++++
drivers/iommu/iommufd/selftest.c | 2 +-
3 files changed, 29 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/iommu-priv.h b/drivers/iommu/iommu-priv.h
index e236b932e7668..c95394cd03a77 100644
--- a/drivers/iommu/iommu-priv.h
+++ b/drivers/iommu/iommu-priv.h
@@ -37,6 +37,8 @@ void iommu_device_unregister_bus(struct iommu_device *iommu,
const struct bus_type *bus,
struct notifier_block *nb);
+int iommu_mock_device_add(struct device *dev, struct iommu_device *iommu);
+
struct iommu_attach_handle *iommu_attach_handle_get(struct iommu_group *group,
ioasid_t pasid,
unsigned int type);
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index 060ebe330ee16..59244c744eabd 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -304,6 +304,7 @@ void iommu_device_unregister_bus(struct iommu_device *iommu,
struct notifier_block *nb)
{
bus_unregister_notifier(bus, nb);
+ fwnode_remove_software_node(iommu->fwnode);
iommu_device_unregister(iommu);
}
EXPORT_SYMBOL_GPL(iommu_device_unregister_bus);
@@ -326,6 +327,12 @@ int iommu_device_register_bus(struct iommu_device *iommu,
if (err)
return err;
+ iommu->fwnode = fwnode_create_software_node(NULL, NULL);
+ if (IS_ERR(iommu->fwnode)) {
+ bus_unregister_notifier(bus, nb);
+ return PTR_ERR(iommu->fwnode);
+ }
+
spin_lock(&iommu_device_lock);
list_add_tail(&iommu->list, &iommu_device_list);
spin_unlock(&iommu_device_lock);
@@ -335,9 +342,28 @@ int iommu_device_register_bus(struct iommu_device *iommu,
iommu_device_unregister_bus(iommu, bus, nb);
return err;
}
+ WRITE_ONCE(iommu->ready, true);
return 0;
}
EXPORT_SYMBOL_GPL(iommu_device_register_bus);
+
+int iommu_mock_device_add(struct device *dev, struct iommu_device *iommu)
+{
+ int rc;
+
+ mutex_lock(&iommu_probe_device_lock);
+ rc = iommu_fwspec_init(dev, iommu->fwnode);
+ mutex_unlock(&iommu_probe_device_lock);
+
+ if (rc)
+ return rc;
+
+ rc = device_add(dev);
+ if (rc)
+ iommu_fwspec_free(dev);
+ return rc;
+}
+EXPORT_SYMBOL_GPL(iommu_mock_device_add);
#endif
static struct dev_iommu *dev_iommu_get(struct device *dev)
diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c
index 61686603c7693..de178827a078a 100644
--- a/drivers/iommu/iommufd/selftest.c
+++ b/drivers/iommu/iommufd/selftest.c
@@ -1126,7 +1126,7 @@ static struct mock_dev *mock_dev_create(unsigned long dev_flags)
goto err_put;
}
- rc = device_add(&mdev->dev);
+ rc = iommu_mock_device_add(&mdev->dev, &mock_iommu.iommu_dev);
if (rc)
goto err_put;
return mdev;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 482/563] Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (480 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 481/563] iommufd: Register iommufd mock devices with fwspec Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 483/563] NFSD: filecache: add STATX_DIOALIGN and STATX_DIO_READ_ALIGN support Greg Kroah-Hartman
` (94 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, Tariq Toukan,
Paolo Abeni, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ]
This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb.
Commit in question breaks the mapping of PGs to pools for some SKUs.
Specifically multi-host NICs seem to be shipped with a custom buffer
configuration which maps the lossy PG to pool 4. But the bad commit
overrides this with pool 0 which does not have sufficient buffer space
reserved. Resulting in ~40% packet loss. The commit also breaks BMC /
OOB connection completely (100% packet loss).
Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and
set Xon/Xoff upon port speed set""). The breakage is exactly the same,
the only difference is that quoted commit would break the NIC immediately
on boot, and the currently reverted commit only when MTU is changed.
Note: "good" kernels do not restore the configuration, so downgrade isn't
enough to recover machines. A NIC power cycle seems to be necessary to
return to a healthy state (or overriding the relevant registers using
a custom patch).
Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20250929181529.1848157-1-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../mellanox/mlx5/core/en/port_buffer.h | 12 ------------
.../net/ethernet/mellanox/mlx5/core/en_main.c | 17 +----------------
2 files changed, 1 insertion(+), 28 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
index 66d276a1be836..f4a19ffbb641c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
@@ -66,23 +66,11 @@ struct mlx5e_port_buffer {
struct mlx5e_bufferx_reg buffer[MLX5E_MAX_NETWORK_BUFFER];
};
-#ifdef CONFIG_MLX5_CORE_EN_DCB
int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
u32 change, unsigned int mtu,
struct ieee_pfc *pfc,
u32 *buffer_size,
u8 *prio2buffer);
-#else
-static inline int
-mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
- u32 change, unsigned int mtu,
- void *pfc,
- u32 *buffer_size,
- u8 *prio2buffer)
-{
- return 0;
-}
-#endif
int mlx5e_port_query_buffer(struct mlx5e_priv *priv,
struct mlx5e_port_buffer *port_buffer);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 15eded36b872a..21bb88c5d3dce 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -49,7 +49,6 @@
#include "en.h"
#include "en/dim.h"
#include "en/txrx.h"
-#include "en/port_buffer.h"
#include "en_tc.h"
#include "en_rep.h"
#include "en_accel/ipsec.h"
@@ -3041,11 +3040,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
struct mlx5e_params *params = &priv->channels.params;
struct net_device *netdev = priv->netdev;
struct mlx5_core_dev *mdev = priv->mdev;
- u16 mtu, prev_mtu;
+ u16 mtu;
int err;
- mlx5e_query_mtu(mdev, params, &prev_mtu);
-
err = mlx5e_set_mtu(mdev, params, params->sw_mtu);
if (err)
return err;
@@ -3055,18 +3052,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n",
__func__, mtu, params->sw_mtu);
- if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) {
- err = mlx5e_port_manual_buffer_config(priv, 0, mtu,
- NULL, NULL, NULL);
- if (err) {
- netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n",
- __func__, mtu, err, prev_mtu);
-
- mlx5e_set_mtu(mdev, params, prev_mtu);
- return err;
- }
- }
-
params->sw_mtu = mtu;
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 483/563] NFSD: filecache: add STATX_DIOALIGN and STATX_DIO_READ_ALIGN support
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (481 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 482/563] Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 484/563] nfs/localio: avoid issuing misaligned IO using O_DIRECT Greg Kroah-Hartman
` (93 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Snitzer, Jeff Layton, NeilBrown,
Chuck Lever, Anna Schumaker, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@kernel.org>
[ Upstream commit d11f6cd1bb4a416b4515702d020a7480ac667f0f ]
Use STATX_DIOALIGN and STATX_DIO_READ_ALIGN to get DIO alignment
attributes from the underlying filesystem and store them in the
associated nfsd_file. This is done when the nfsd_file is first
opened for each regular file.
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: NeilBrown <neil@brown.name>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Acked-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Stable-dep-of: 25ba2b84c38f ("nfs/localio: avoid issuing misaligned IO using O_DIRECT")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/filecache.c | 34 ++++++++++++++++++++++++++++++++++
fs/nfsd/filecache.h | 4 ++++
fs/nfsd/trace.h | 27 +++++++++++++++++++++++++++
fs/nfsd/vfs.h | 4 ++++
include/trace/misc/fs.h | 22 ++++++++++++++++++++++
5 files changed, 91 insertions(+)
diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c
index 732abf6b92a56..7ca1dedf4e04a 100644
--- a/fs/nfsd/filecache.c
+++ b/fs/nfsd/filecache.c
@@ -231,6 +231,9 @@ nfsd_file_alloc(struct net *net, struct inode *inode, unsigned char need,
refcount_set(&nf->nf_ref, 1);
nf->nf_may = need;
nf->nf_mark = NULL;
+ nf->nf_dio_mem_align = 0;
+ nf->nf_dio_offset_align = 0;
+ nf->nf_dio_read_offset_align = 0;
return nf;
}
@@ -1069,6 +1072,35 @@ nfsd_file_is_cached(struct inode *inode)
return ret;
}
+static __be32
+nfsd_file_get_dio_attrs(const struct svc_fh *fhp, struct nfsd_file *nf)
+{
+ struct inode *inode = file_inode(nf->nf_file);
+ struct kstat stat;
+ __be32 status;
+
+ /* Currently only need to get DIO alignment info for regular files */
+ if (!S_ISREG(inode->i_mode))
+ return nfs_ok;
+
+ status = fh_getattr(fhp, &stat);
+ if (status != nfs_ok)
+ return status;
+
+ trace_nfsd_file_get_dio_attrs(inode, &stat);
+
+ if (stat.result_mask & STATX_DIOALIGN) {
+ nf->nf_dio_mem_align = stat.dio_mem_align;
+ nf->nf_dio_offset_align = stat.dio_offset_align;
+ }
+ if (stat.result_mask & STATX_DIO_READ_ALIGN)
+ nf->nf_dio_read_offset_align = stat.dio_read_offset_align;
+ else
+ nf->nf_dio_read_offset_align = nf->nf_dio_offset_align;
+
+ return nfs_ok;
+}
+
static __be32
nfsd_file_do_acquire(struct svc_rqst *rqstp, struct net *net,
struct svc_cred *cred,
@@ -1187,6 +1219,8 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct net *net,
}
status = nfserrno(ret);
trace_nfsd_file_open(nf, status);
+ if (status == nfs_ok)
+ status = nfsd_file_get_dio_attrs(fhp, nf);
}
} else
status = nfserr_jukebox;
diff --git a/fs/nfsd/filecache.h b/fs/nfsd/filecache.h
index 722b26c71e454..237a05c74211b 100644
--- a/fs/nfsd/filecache.h
+++ b/fs/nfsd/filecache.h
@@ -54,6 +54,10 @@ struct nfsd_file {
struct list_head nf_gc;
struct rcu_head nf_rcu;
ktime_t nf_birthtime;
+
+ u32 nf_dio_mem_align;
+ u32 nf_dio_offset_align;
+ u32 nf_dio_read_offset_align;
};
int nfsd_file_cache_init(void);
diff --git a/fs/nfsd/trace.h b/fs/nfsd/trace.h
index a664fdf1161e9..6e2c8e2aab10a 100644
--- a/fs/nfsd/trace.h
+++ b/fs/nfsd/trace.h
@@ -1133,6 +1133,33 @@ TRACE_EVENT(nfsd_file_alloc,
)
);
+TRACE_EVENT(nfsd_file_get_dio_attrs,
+ TP_PROTO(
+ const struct inode *inode,
+ const struct kstat *stat
+ ),
+ TP_ARGS(inode, stat),
+ TP_STRUCT__entry(
+ __field(const void *, inode)
+ __field(unsigned long, mask)
+ __field(u32, mem_align)
+ __field(u32, offset_align)
+ __field(u32, read_offset_align)
+ ),
+ TP_fast_assign(
+ __entry->inode = inode;
+ __entry->mask = stat->result_mask;
+ __entry->mem_align = stat->dio_mem_align;
+ __entry->offset_align = stat->dio_offset_align;
+ __entry->read_offset_align = stat->dio_read_offset_align;
+ ),
+ TP_printk("inode=%p flags=%s mem_align=%u offset_align=%u read_offset_align=%u",
+ __entry->inode, show_statx_mask(__entry->mask),
+ __entry->mem_align, __entry->offset_align,
+ __entry->read_offset_align
+ )
+);
+
TRACE_EVENT(nfsd_file_acquire,
TP_PROTO(
const struct svc_rqst *rqstp,
diff --git a/fs/nfsd/vfs.h b/fs/nfsd/vfs.h
index eff04959606fe..fde3e0c11dbaf 100644
--- a/fs/nfsd/vfs.h
+++ b/fs/nfsd/vfs.h
@@ -185,6 +185,10 @@ static inline __be32 fh_getattr(const struct svc_fh *fh, struct kstat *stat)
u32 request_mask = STATX_BASIC_STATS;
struct path p = {.mnt = fh->fh_export->ex_path.mnt,
.dentry = fh->fh_dentry};
+ struct inode *inode = d_inode(p.dentry);
+
+ if (S_ISREG(inode->i_mode))
+ request_mask |= (STATX_DIOALIGN | STATX_DIO_READ_ALIGN);
if (fh->fh_maxsize == NFS4_FHSIZE)
request_mask |= (STATX_BTIME | STATX_CHANGE_COOKIE);
diff --git a/include/trace/misc/fs.h b/include/trace/misc/fs.h
index 0406ebe2a80a4..7ead1c61f0cb1 100644
--- a/include/trace/misc/fs.h
+++ b/include/trace/misc/fs.h
@@ -141,3 +141,25 @@
{ ATTR_TIMES_SET, "TIMES_SET" }, \
{ ATTR_TOUCH, "TOUCH"}, \
{ ATTR_DELEG, "DELEG"})
+
+#define show_statx_mask(flags) \
+ __print_flags(flags, "|", \
+ { STATX_TYPE, "TYPE" }, \
+ { STATX_MODE, "MODE" }, \
+ { STATX_NLINK, "NLINK" }, \
+ { STATX_UID, "UID" }, \
+ { STATX_GID, "GID" }, \
+ { STATX_ATIME, "ATIME" }, \
+ { STATX_MTIME, "MTIME" }, \
+ { STATX_CTIME, "CTIME" }, \
+ { STATX_INO, "INO" }, \
+ { STATX_SIZE, "SIZE" }, \
+ { STATX_BLOCKS, "BLOCKS" }, \
+ { STATX_BASIC_STATS, "BASIC_STATS" }, \
+ { STATX_BTIME, "BTIME" }, \
+ { STATX_MNT_ID, "MNT_ID" }, \
+ { STATX_DIOALIGN, "DIOALIGN" }, \
+ { STATX_MNT_ID_UNIQUE, "MNT_ID_UNIQUE" }, \
+ { STATX_SUBVOL, "SUBVOL" }, \
+ { STATX_WRITE_ATOMIC, "WRITE_ATOMIC" }, \
+ { STATX_DIO_READ_ALIGN, "DIO_READ_ALIGN" })
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 484/563] nfs/localio: avoid issuing misaligned IO using O_DIRECT
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (482 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 483/563] NFSD: filecache: add STATX_DIOALIGN and STATX_DIO_READ_ALIGN support Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 485/563] octeontx2-vf: fix bitmap leak Greg Kroah-Hartman
` (92 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Snitzer, Jeff Layton,
Anna Schumaker, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@kernel.org>
[ Upstream commit 25ba2b84c38f624151a3ba36e56d41c39b9223ad ]
Add nfsd_file_dio_alignment and use it to avoid issuing misaligned IO
using O_DIRECT. Any misaligned DIO falls back to using buffered IO.
Because misaligned DIO is now handled safely, remove the nfs modparam
'localio_O_DIRECT_semantics' that was added to require users opt-in to
the requirement that all O_DIRECT be properly DIO-aligned.
Also, introduce nfs_iov_iter_aligned_bvec() which is a variant of
iov_iter_aligned_bvec() that also verifies the offset associated with
an iov_iter is DIO-aligned. NOTE: in a parallel effort,
iov_iter_aligned_bvec() is being removed along with
iov_iter_is_aligned().
Lastly, add pr_info_ratelimited if underlying filesystem returns
-EINVAL because it was made to try O_DIRECT for IO that is not
DIO-aligned (shouldn't happen, so its best to be louder if it does).
Fixes: 3feec68563d ("nfs/localio: add direct IO enablement with sync and async IO support")
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/localio.c | 65 ++++++++++++++++++++++++++++++++------
fs/nfsd/localio.c | 11 +++++++
include/linux/nfslocalio.h | 2 ++
3 files changed, 68 insertions(+), 10 deletions(-)
diff --git a/fs/nfs/localio.c b/fs/nfs/localio.c
index 97abf62f109d2..31ce210f032ac 100644
--- a/fs/nfs/localio.c
+++ b/fs/nfs/localio.c
@@ -49,11 +49,6 @@ struct nfs_local_fsync_ctx {
static bool localio_enabled __read_mostly = true;
module_param(localio_enabled, bool, 0644);
-static bool localio_O_DIRECT_semantics __read_mostly = false;
-module_param(localio_O_DIRECT_semantics, bool, 0644);
-MODULE_PARM_DESC(localio_O_DIRECT_semantics,
- "LOCALIO will use O_DIRECT semantics to filesystem.");
-
static inline bool nfs_client_is_local(const struct nfs_client *clp)
{
return !!rcu_access_pointer(clp->cl_uuid.net);
@@ -321,12 +316,9 @@ nfs_local_iocb_alloc(struct nfs_pgio_header *hdr,
return NULL;
}
- if (localio_O_DIRECT_semantics &&
- test_bit(NFS_IOHDR_ODIRECT, &hdr->flags)) {
- iocb->kiocb.ki_filp = file;
+ init_sync_kiocb(&iocb->kiocb, file);
+ if (test_bit(NFS_IOHDR_ODIRECT, &hdr->flags))
iocb->kiocb.ki_flags = IOCB_DIRECT;
- } else
- init_sync_kiocb(&iocb->kiocb, file);
iocb->kiocb.ki_pos = hdr->args.offset;
iocb->hdr = hdr;
@@ -336,6 +328,30 @@ nfs_local_iocb_alloc(struct nfs_pgio_header *hdr,
return iocb;
}
+static bool nfs_iov_iter_aligned_bvec(const struct iov_iter *i,
+ loff_t offset, unsigned int addr_mask, unsigned int len_mask)
+{
+ const struct bio_vec *bvec = i->bvec;
+ size_t skip = i->iov_offset;
+ size_t size = i->count;
+
+ if ((offset | size) & len_mask)
+ return false;
+ do {
+ size_t len = bvec->bv_len;
+
+ if (len > size)
+ len = size;
+ if ((unsigned long)(bvec->bv_offset + skip) & addr_mask)
+ return false;
+ bvec++;
+ size -= len;
+ skip = 0;
+ } while (size);
+
+ return true;
+}
+
static void
nfs_local_iter_init(struct iov_iter *i, struct nfs_local_kiocb *iocb, int dir)
{
@@ -345,6 +361,25 @@ nfs_local_iter_init(struct iov_iter *i, struct nfs_local_kiocb *iocb, int dir)
hdr->args.count + hdr->args.pgbase);
if (hdr->args.pgbase != 0)
iov_iter_advance(i, hdr->args.pgbase);
+
+ if (iocb->kiocb.ki_flags & IOCB_DIRECT) {
+ u32 nf_dio_mem_align, nf_dio_offset_align, nf_dio_read_offset_align;
+ /* Verify the IO is DIO-aligned as required */
+ nfs_to->nfsd_file_dio_alignment(iocb->localio, &nf_dio_mem_align,
+ &nf_dio_offset_align,
+ &nf_dio_read_offset_align);
+ if (dir == READ)
+ nf_dio_offset_align = nf_dio_read_offset_align;
+
+ if (nf_dio_mem_align && nf_dio_offset_align &&
+ nfs_iov_iter_aligned_bvec(i, hdr->args.offset,
+ nf_dio_mem_align - 1,
+ nf_dio_offset_align - 1))
+ return; /* is DIO-aligned */
+
+ /* Fallback to using buffered for this misaligned IO */
+ iocb->kiocb.ki_flags &= ~IOCB_DIRECT;
+ }
}
static void
@@ -405,6 +440,11 @@ nfs_local_read_done(struct nfs_local_kiocb *iocb, long status)
struct nfs_pgio_header *hdr = iocb->hdr;
struct file *filp = iocb->kiocb.ki_filp;
+ if ((iocb->kiocb.ki_flags & IOCB_DIRECT) && status == -EINVAL) {
+ /* Underlying FS will return -EINVAL if misaligned DIO is attempted. */
+ pr_info_ratelimited("nfs: Unexpected direct I/O read alignment failure\n");
+ }
+
nfs_local_pgio_done(hdr, status);
/*
@@ -597,6 +637,11 @@ nfs_local_write_done(struct nfs_local_kiocb *iocb, long status)
dprintk("%s: wrote %ld bytes.\n", __func__, status > 0 ? status : 0);
+ if ((iocb->kiocb.ki_flags & IOCB_DIRECT) && status == -EINVAL) {
+ /* Underlying FS will return -EINVAL if misaligned DIO is attempted. */
+ pr_info_ratelimited("nfs: Unexpected direct I/O write alignment failure\n");
+ }
+
/* Handle short writes as if they are ENOSPC */
if (status > 0 && status < hdr->args.count) {
hdr->mds_offset += status;
diff --git a/fs/nfsd/localio.c b/fs/nfsd/localio.c
index cb237f1b902a7..9e0a37cd29d8a 100644
--- a/fs/nfsd/localio.c
+++ b/fs/nfsd/localio.c
@@ -117,6 +117,16 @@ nfsd_open_local_fh(struct net *net, struct auth_domain *dom,
return localio;
}
+static void nfsd_file_dio_alignment(struct nfsd_file *nf,
+ u32 *nf_dio_mem_align,
+ u32 *nf_dio_offset_align,
+ u32 *nf_dio_read_offset_align)
+{
+ *nf_dio_mem_align = nf->nf_dio_mem_align;
+ *nf_dio_offset_align = nf->nf_dio_offset_align;
+ *nf_dio_read_offset_align = nf->nf_dio_read_offset_align;
+}
+
static const struct nfsd_localio_operations nfsd_localio_ops = {
.nfsd_net_try_get = nfsd_net_try_get,
.nfsd_net_put = nfsd_net_put,
@@ -124,6 +134,7 @@ static const struct nfsd_localio_operations nfsd_localio_ops = {
.nfsd_file_put_local = nfsd_file_put_local,
.nfsd_file_get_local = nfsd_file_get_local,
.nfsd_file_file = nfsd_file_file,
+ .nfsd_file_dio_alignment = nfsd_file_dio_alignment,
};
void nfsd_localio_ops_init(void)
diff --git a/include/linux/nfslocalio.h b/include/linux/nfslocalio.h
index 5c7c92659e736..7ca2715edccca 100644
--- a/include/linux/nfslocalio.h
+++ b/include/linux/nfslocalio.h
@@ -65,6 +65,8 @@ struct nfsd_localio_operations {
struct net *(*nfsd_file_put_local)(struct nfsd_file __rcu **);
struct nfsd_file *(*nfsd_file_get_local)(struct nfsd_file *);
struct file *(*nfsd_file_file)(struct nfsd_file *);
+ void (*nfsd_file_dio_alignment)(struct nfsd_file *,
+ u32 *, u32 *, u32 *);
} ____cacheline_aligned;
extern void nfsd_localio_ops_init(void);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 485/563] octeontx2-vf: fix bitmap leak
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (483 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 484/563] nfs/localio: avoid issuing misaligned IO using O_DIRECT Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 486/563] octeontx2-pf: " Greg Kroah-Hartman
` (91 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bo Sun, Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bo Sun <bo@mboxify.com>
[ Upstream commit cd9ea7da41a449ff1950230a35990155457b9879 ]
The bitmap allocated with bitmap_zalloc() in otx2vf_probe() was not
released in otx2vf_remove(). Unbinding and rebinding the driver therefore
triggers a kmemleak warning:
unreferenced object (size 8):
backtrace:
bitmap_zalloc
otx2vf_probe
Call bitmap_free() in the remove path to fix the leak.
Fixes: efabce290151 ("octeontx2-pf: AF_XDP zero copy receive support")
Signed-off-by: Bo Sun <bo@mboxify.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
index 7ebb6e656884a..25381f079b97d 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
@@ -854,6 +854,7 @@ static void otx2vf_remove(struct pci_dev *pdev)
qmem_free(vf->dev, vf->dync_lmt);
otx2vf_vfaf_mbox_destroy(vf);
pci_free_irq_vectors(vf->pdev);
+ bitmap_free(vf->af_xdp_zc_qidx);
pci_set_drvdata(pdev, NULL);
free_netdev(netdev);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 486/563] octeontx2-pf: fix bitmap leak
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (484 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 485/563] octeontx2-vf: fix bitmap leak Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 487/563] vhost: vringh: Modify the return value check Greg Kroah-Hartman
` (90 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bo Sun, Jakub Kicinski, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bo Sun <bo@mboxify.com>
[ Upstream commit 92e9f4faffca70c82126e59552f6e8ff8f95cc65 ]
The bitmap allocated with bitmap_zalloc() in otx2_probe() was not
released in otx2_remove(). Unbinding and rebinding the driver therefore
triggers a kmemleak warning:
unreferenced object (size 8):
backtrace:
bitmap_zalloc
otx2_probe
Call bitmap_free() in the remove path to fix the leak.
Fixes: efabce290151 ("octeontx2-pf: AF_XDP zero copy receive support")
Signed-off-by: Bo Sun <bo@mboxify.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
index 5027fae0aa77a..e808995703cfd 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
@@ -3542,6 +3542,7 @@ static void otx2_remove(struct pci_dev *pdev)
otx2_disable_mbox_intr(pf);
otx2_pfaf_mbox_destroy(pf);
pci_free_irq_vectors(pf->pdev);
+ bitmap_free(pf->af_xdp_zc_qidx);
pci_set_drvdata(pdev, NULL);
free_netdev(netdev);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 487/563] vhost: vringh: Modify the return value check
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (485 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 486/563] octeontx2-pf: " Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 488/563] selftests/bpf: Fix typos and grammar in test sources Greg Kroah-Hartman
` (89 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefano Garzarella, zhang jiao,
Michael S. Tsirkin, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhang jiao <zhangjiao2@cmss.chinamobile.com>
[ Upstream commit 82a8d0fda55b35361ee7f35b54fa2b66d7847d2b ]
The return value of copy_from_iter and copy_to_iter can't be negative,
check whether the copied lengths are equal.
Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
Cc: "Stefano Garzarella" <sgarzare@redhat.com>
Signed-off-by: zhang jiao <zhangjiao2@cmss.chinamobile.com>
Message-Id: <20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vhost/vringh.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index 1778eff7ab006..925858cc60964 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -1115,6 +1115,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
struct iov_iter iter;
u64 translated;
int ret;
+ size_t size;
ret = iotlb_translate(vrh, (u64)(uintptr_t)src,
len - total_translated, &translated,
@@ -1132,9 +1133,9 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
translated);
}
- ret = copy_from_iter(dst, translated, &iter);
- if (ret < 0)
- return ret;
+ size = copy_from_iter(dst, translated, &iter);
+ if (size != translated)
+ return -EFAULT;
src += translated;
dst += translated;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 488/563] selftests/bpf: Fix typos and grammar in test sources
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (486 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 487/563] vhost: vringh: Modify the return value check Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 489/563] selftests/bpf: move get_ksyms and get_addrs to trace_helpers.c Greg Kroah-Hartman
` (88 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shubham Sharma, Andrii Nakryiko,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shubham Sharma <slopixelz@gmail.com>
[ Upstream commit d3abefe897408718799ae3bd06295b89b870a38e ]
Fix spelling typos and grammar errors in BPF selftests source code.
Signed-off-by: Shubham Sharma <slopixelz@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20250826125746.17983-1-slopixelz@gmail.com
Stable-dep-of: 0c342bfc9949 ("selftests/bpf: Fix realloc size in bpf_get_addrs")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/Makefile | 2 +-
tools/testing/selftests/bpf/bench.c | 2 +-
tools/testing/selftests/bpf/prog_tests/btf_dump.c | 2 +-
tools/testing/selftests/bpf/prog_tests/fd_array.c | 2 +-
.../testing/selftests/bpf/prog_tests/kprobe_multi_test.c | 2 +-
tools/testing/selftests/bpf/prog_tests/module_attach.c | 2 +-
tools/testing/selftests/bpf/prog_tests/reg_bounds.c | 4 ++--
.../selftests/bpf/prog_tests/stacktrace_build_id.c | 2 +-
.../selftests/bpf/prog_tests/stacktrace_build_id_nmi.c | 2 +-
tools/testing/selftests/bpf/prog_tests/stacktrace_map.c | 2 +-
.../selftests/bpf/prog_tests/stacktrace_map_raw_tp.c | 2 +-
.../selftests/bpf/prog_tests/stacktrace_map_skip.c | 2 +-
tools/testing/selftests/bpf/progs/bpf_cc_cubic.c | 2 +-
tools/testing/selftests/bpf/progs/bpf_dctcp.c | 2 +-
.../selftests/bpf/progs/freplace_connect_v4_prog.c | 2 +-
tools/testing/selftests/bpf/progs/iters_state_safety.c | 2 +-
tools/testing/selftests/bpf/progs/rbtree_search.c | 2 +-
.../testing/selftests/bpf/progs/struct_ops_kptr_return.c | 2 +-
tools/testing/selftests/bpf/progs/struct_ops_refcounted.c | 2 +-
tools/testing/selftests/bpf/progs/test_cls_redirect.c | 2 +-
.../selftests/bpf/progs/test_cls_redirect_dynptr.c | 2 +-
tools/testing/selftests/bpf/progs/uretprobe_stack.c | 4 ++--
tools/testing/selftests/bpf/progs/verifier_scalar_ids.c | 2 +-
tools/testing/selftests/bpf/progs/verifier_var_off.c | 6 +++---
tools/testing/selftests/bpf/test_sockmap.c | 2 +-
tools/testing/selftests/bpf/verifier/calls.c | 8 ++++----
tools/testing/selftests/bpf/xdping.c | 2 +-
tools/testing/selftests/bpf/xsk.h | 4 ++--
28 files changed, 36 insertions(+), 36 deletions(-)
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 77794efc020ea..fd6b370c81698 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -398,7 +398,7 @@ $(HOST_BPFOBJ): $(wildcard $(BPFDIR)/*.[ch] $(BPFDIR)/Makefile) \
DESTDIR=$(HOST_SCRATCH_DIR)/ prefix= all install_headers
endif
-# vmlinux.h is first dumped to a temprorary file and then compared to
+# vmlinux.h is first dumped to a temporary file and then compared to
# the previous version. This helps to avoid unnecessary re-builds of
# $(TRUNNER_BPF_OBJS)
$(INCLUDE_DIR)/vmlinux.h: $(VMLINUX_BTF) $(BPFTOOL) | $(INCLUDE_DIR)
diff --git a/tools/testing/selftests/bpf/bench.c b/tools/testing/selftests/bpf/bench.c
index ddd73d06a1eb2..3ecc226ea7b25 100644
--- a/tools/testing/selftests/bpf/bench.c
+++ b/tools/testing/selftests/bpf/bench.c
@@ -499,7 +499,7 @@ extern const struct bench bench_rename_rawtp;
extern const struct bench bench_rename_fentry;
extern const struct bench bench_rename_fexit;
-/* pure counting benchmarks to establish theoretical lmits */
+/* pure counting benchmarks to establish theoretical limits */
extern const struct bench bench_trig_usermode_count;
extern const struct bench bench_trig_syscall_count;
extern const struct bench bench_trig_kernel_count;
diff --git a/tools/testing/selftests/bpf/prog_tests/btf_dump.c b/tools/testing/selftests/bpf/prog_tests/btf_dump.c
index 82903585c8700..10cba526d3e63 100644
--- a/tools/testing/selftests/bpf/prog_tests/btf_dump.c
+++ b/tools/testing/selftests/bpf/prog_tests/btf_dump.c
@@ -63,7 +63,7 @@ static int test_btf_dump_case(int n, struct btf_dump_test_case *t)
/* tests with t->known_ptr_sz have no "long" or "unsigned long" type,
* so it's impossible to determine correct pointer size; but if they
- * do, it should be 8 regardless of host architecture, becaues BPF
+ * do, it should be 8 regardless of host architecture, because BPF
* target is always 64-bit
*/
if (!t->known_ptr_sz) {
diff --git a/tools/testing/selftests/bpf/prog_tests/fd_array.c b/tools/testing/selftests/bpf/prog_tests/fd_array.c
index 241b2c8c6e0f1..c534b4d5f9da8 100644
--- a/tools/testing/selftests/bpf/prog_tests/fd_array.c
+++ b/tools/testing/selftests/bpf/prog_tests/fd_array.c
@@ -293,7 +293,7 @@ static int get_btf_id_by_fd(int btf_fd, __u32 *id)
* 1) Create a new btf, it's referenced only by a file descriptor, so refcnt=1
* 2) Load a BPF prog with fd_array[0] = btf_fd; now btf's refcnt=2
* 3) Close the btf_fd, now refcnt=1
- * Wait and check that BTF stil exists.
+ * Wait and check that BTF still exists.
*/
static void check_fd_array_cnt__referenced_btfs(void)
{
diff --git a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
index e19ef509ebf85..f377bea0b82d4 100644
--- a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
+++ b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
@@ -463,7 +463,7 @@ static bool skip_entry(char *name)
return false;
}
-/* Do comparision by ignoring '.llvm.<hash>' suffixes. */
+/* Do comparison by ignoring '.llvm.<hash>' suffixes. */
static int compare_name(const char *name1, const char *name2)
{
const char *res1, *res2;
diff --git a/tools/testing/selftests/bpf/prog_tests/module_attach.c b/tools/testing/selftests/bpf/prog_tests/module_attach.c
index 6d391d95f96e0..70fa7ae93173b 100644
--- a/tools/testing/selftests/bpf/prog_tests/module_attach.c
+++ b/tools/testing/selftests/bpf/prog_tests/module_attach.c
@@ -90,7 +90,7 @@ void test_module_attach(void)
test_module_attach__detach(skel);
- /* attach fentry/fexit and make sure it get's module reference */
+ /* attach fentry/fexit and make sure it gets module reference */
link = bpf_program__attach(skel->progs.handle_fentry);
if (!ASSERT_OK_PTR(link, "attach_fentry"))
goto cleanup;
diff --git a/tools/testing/selftests/bpf/prog_tests/reg_bounds.c b/tools/testing/selftests/bpf/prog_tests/reg_bounds.c
index e261b0e872dbb..d93a0c7b1786f 100644
--- a/tools/testing/selftests/bpf/prog_tests/reg_bounds.c
+++ b/tools/testing/selftests/bpf/prog_tests/reg_bounds.c
@@ -623,7 +623,7 @@ static void range_cond(enum num_t t, struct range x, struct range y,
*newx = range(t, x.a, x.b);
*newy = range(t, y.a + 1, y.b);
} else if (x.a == x.b && x.b == y.b) {
- /* X is a constant matching rigth side of Y */
+ /* X is a constant matching right side of Y */
*newx = range(t, x.a, x.b);
*newy = range(t, y.a, y.b - 1);
} else if (y.a == y.b && x.a == y.a) {
@@ -631,7 +631,7 @@ static void range_cond(enum num_t t, struct range x, struct range y,
*newx = range(t, x.a + 1, x.b);
*newy = range(t, y.a, y.b);
} else if (y.a == y.b && x.b == y.b) {
- /* Y is a constant matching rigth side of X */
+ /* Y is a constant matching right side of X */
*newx = range(t, x.a, x.b - 1);
*newy = range(t, y.a, y.b);
} else {
diff --git a/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id.c b/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id.c
index b7ba5cd47d96f..271b5cc9fc015 100644
--- a/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id.c
+++ b/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id.c
@@ -39,7 +39,7 @@ void test_stacktrace_build_id(void)
bpf_map_update_elem(control_map_fd, &key, &val, 0);
/* for every element in stackid_hmap, we can find a corresponding one
- * in stackmap, and vise versa.
+ * in stackmap, and vice versa.
*/
err = compare_map_keys(stackid_hmap_fd, stackmap_fd);
if (CHECK(err, "compare_map_keys stackid_hmap vs. stackmap",
diff --git a/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c b/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c
index 0832fd7874575..b277dddd5af7f 100644
--- a/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c
+++ b/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c
@@ -66,7 +66,7 @@ void test_stacktrace_build_id_nmi(void)
bpf_map_update_elem(control_map_fd, &key, &val, 0);
/* for every element in stackid_hmap, we can find a corresponding one
- * in stackmap, and vise versa.
+ * in stackmap, and vice versa.
*/
err = compare_map_keys(stackid_hmap_fd, stackmap_fd);
if (CHECK(err, "compare_map_keys stackid_hmap vs. stackmap",
diff --git a/tools/testing/selftests/bpf/prog_tests/stacktrace_map.c b/tools/testing/selftests/bpf/prog_tests/stacktrace_map.c
index df59e4ae29510..84a7e405e9129 100644
--- a/tools/testing/selftests/bpf/prog_tests/stacktrace_map.c
+++ b/tools/testing/selftests/bpf/prog_tests/stacktrace_map.c
@@ -50,7 +50,7 @@ void test_stacktrace_map(void)
bpf_map_update_elem(control_map_fd, &key, &val, 0);
/* for every element in stackid_hmap, we can find a corresponding one
- * in stackmap, and vise versa.
+ * in stackmap, and vice versa.
*/
err = compare_map_keys(stackid_hmap_fd, stackmap_fd);
if (CHECK(err, "compare_map_keys stackid_hmap vs. stackmap",
diff --git a/tools/testing/selftests/bpf/prog_tests/stacktrace_map_raw_tp.c b/tools/testing/selftests/bpf/prog_tests/stacktrace_map_raw_tp.c
index c6ef06f55cdb4..e0cb4697b4b3c 100644
--- a/tools/testing/selftests/bpf/prog_tests/stacktrace_map_raw_tp.c
+++ b/tools/testing/selftests/bpf/prog_tests/stacktrace_map_raw_tp.c
@@ -46,7 +46,7 @@ void test_stacktrace_map_raw_tp(void)
bpf_map_update_elem(control_map_fd, &key, &val, 0);
/* for every element in stackid_hmap, we can find a corresponding one
- * in stackmap, and vise versa.
+ * in stackmap, and vice versa.
*/
err = compare_map_keys(stackid_hmap_fd, stackmap_fd);
if (CHECK(err, "compare_map_keys stackid_hmap vs. stackmap",
diff --git a/tools/testing/selftests/bpf/prog_tests/stacktrace_map_skip.c b/tools/testing/selftests/bpf/prog_tests/stacktrace_map_skip.c
index 1932b1e0685cf..dc2ccf6a14d13 100644
--- a/tools/testing/selftests/bpf/prog_tests/stacktrace_map_skip.c
+++ b/tools/testing/selftests/bpf/prog_tests/stacktrace_map_skip.c
@@ -40,7 +40,7 @@ void test_stacktrace_map_skip(void)
skel->bss->control = 1;
/* for every element in stackid_hmap, we can find a corresponding one
- * in stackmap, and vise versa.
+ * in stackmap, and vice versa.
*/
err = compare_map_keys(stackid_hmap_fd, stackmap_fd);
if (!ASSERT_OK(err, "compare_map_keys stackid_hmap vs. stackmap"))
diff --git a/tools/testing/selftests/bpf/progs/bpf_cc_cubic.c b/tools/testing/selftests/bpf/progs/bpf_cc_cubic.c
index 1654a530aa3dc..4e51785e7606e 100644
--- a/tools/testing/selftests/bpf/progs/bpf_cc_cubic.c
+++ b/tools/testing/selftests/bpf/progs/bpf_cc_cubic.c
@@ -101,7 +101,7 @@ static void tcp_cwnd_reduction(struct sock *sk, int newly_acked_sacked,
tp->snd_cwnd = pkts_in_flight + sndcnt;
}
-/* Decide wheather to run the increase function of congestion control. */
+/* Decide whether to run the increase function of congestion control. */
static bool tcp_may_raise_cwnd(const struct sock *sk, const int flag)
{
if (tcp_sk(sk)->reordering > TCP_REORDERING)
diff --git a/tools/testing/selftests/bpf/progs/bpf_dctcp.c b/tools/testing/selftests/bpf/progs/bpf_dctcp.c
index 7cd73e75f52a2..32c511bcd60b3 100644
--- a/tools/testing/selftests/bpf/progs/bpf_dctcp.c
+++ b/tools/testing/selftests/bpf/progs/bpf_dctcp.c
@@ -1,7 +1,7 @@
// SPDX-License-Identifier: GPL-2.0
/* Copyright (c) 2019 Facebook */
-/* WARNING: This implemenation is not necessarily the same
+/* WARNING: This implementation is not necessarily the same
* as the tcp_dctcp.c. The purpose is mainly for testing
* the kernel BPF logic.
*/
diff --git a/tools/testing/selftests/bpf/progs/freplace_connect_v4_prog.c b/tools/testing/selftests/bpf/progs/freplace_connect_v4_prog.c
index 544e5ac904610..d09bbd8ae8a85 100644
--- a/tools/testing/selftests/bpf/progs/freplace_connect_v4_prog.c
+++ b/tools/testing/selftests/bpf/progs/freplace_connect_v4_prog.c
@@ -12,7 +12,7 @@
SEC("freplace/connect_v4_prog")
int new_connect_v4_prog(struct bpf_sock_addr *ctx)
{
- // return value thats in invalid range
+ // return value that's in invalid range
return 255;
}
diff --git a/tools/testing/selftests/bpf/progs/iters_state_safety.c b/tools/testing/selftests/bpf/progs/iters_state_safety.c
index f41257eadbb25..b381ac0c736cf 100644
--- a/tools/testing/selftests/bpf/progs/iters_state_safety.c
+++ b/tools/testing/selftests/bpf/progs/iters_state_safety.c
@@ -345,7 +345,7 @@ int __naked read_from_iter_slot_fail(void)
"r3 = 1000;"
"call %[bpf_iter_num_new];"
- /* attemp to leak bpf_iter_num state */
+ /* attempt to leak bpf_iter_num state */
"r7 = *(u64 *)(r6 + 0);"
"r8 = *(u64 *)(r6 + 8);"
diff --git a/tools/testing/selftests/bpf/progs/rbtree_search.c b/tools/testing/selftests/bpf/progs/rbtree_search.c
index 098ef970fac16..b05565d1db0d4 100644
--- a/tools/testing/selftests/bpf/progs/rbtree_search.c
+++ b/tools/testing/selftests/bpf/progs/rbtree_search.c
@@ -183,7 +183,7 @@ long test_##op##_spinlock_##dolock(void *ctx) \
}
/*
- * Use a spearate MSG macro instead of passing to TEST_XXX(..., MSG)
+ * Use a separate MSG macro instead of passing to TEST_XXX(..., MSG)
* to ensure the message itself is not in the bpf prog lineinfo
* which the verifier includes in its log.
* Otherwise, the test_loader will incorrectly match the prog lineinfo
diff --git a/tools/testing/selftests/bpf/progs/struct_ops_kptr_return.c b/tools/testing/selftests/bpf/progs/struct_ops_kptr_return.c
index 36386b3c23a1f..2b98b7710816d 100644
--- a/tools/testing/selftests/bpf/progs/struct_ops_kptr_return.c
+++ b/tools/testing/selftests/bpf/progs/struct_ops_kptr_return.c
@@ -9,7 +9,7 @@ void bpf_task_release(struct task_struct *p) __ksym;
/* This test struct_ops BPF programs returning referenced kptr. The verifier should
* allow a referenced kptr or a NULL pointer to be returned. A referenced kptr to task
- * here is acquried automatically as the task argument is tagged with "__ref".
+ * here is acquired automatically as the task argument is tagged with "__ref".
*/
SEC("struct_ops/test_return_ref_kptr")
struct task_struct *BPF_PROG(kptr_return, int dummy,
diff --git a/tools/testing/selftests/bpf/progs/struct_ops_refcounted.c b/tools/testing/selftests/bpf/progs/struct_ops_refcounted.c
index 76dcb6089d7f8..9c0a65466356c 100644
--- a/tools/testing/selftests/bpf/progs/struct_ops_refcounted.c
+++ b/tools/testing/selftests/bpf/progs/struct_ops_refcounted.c
@@ -9,7 +9,7 @@ __attribute__((nomerge)) extern void bpf_task_release(struct task_struct *p) __k
/* This is a test BPF program that uses struct_ops to access a referenced
* kptr argument. This is a test for the verifier to ensure that it
- * 1) recongnizes the task as a referenced object (i.e., ref_obj_id > 0), and
+ * 1) recognizes the task as a referenced object (i.e., ref_obj_id > 0), and
* 2) the same reference can be acquired from multiple paths as long as it
* has not been released.
*/
diff --git a/tools/testing/selftests/bpf/progs/test_cls_redirect.c b/tools/testing/selftests/bpf/progs/test_cls_redirect.c
index f344c6835e84e..823169fb6e4c7 100644
--- a/tools/testing/selftests/bpf/progs/test_cls_redirect.c
+++ b/tools/testing/selftests/bpf/progs/test_cls_redirect.c
@@ -129,7 +129,7 @@ typedef uint8_t *net_ptr __attribute__((align_value(8)));
typedef struct buf {
struct __sk_buff *skb;
net_ptr head;
- /* NB: tail musn't have alignment other than 1, otherwise
+ /* NB: tail mustn't have alignment other than 1, otherwise
* LLVM will go and eliminate code, e.g. when checking packet lengths.
*/
uint8_t *const tail;
diff --git a/tools/testing/selftests/bpf/progs/test_cls_redirect_dynptr.c b/tools/testing/selftests/bpf/progs/test_cls_redirect_dynptr.c
index d0f7670351e58..dfd4a2710391d 100644
--- a/tools/testing/selftests/bpf/progs/test_cls_redirect_dynptr.c
+++ b/tools/testing/selftests/bpf/progs/test_cls_redirect_dynptr.c
@@ -494,7 +494,7 @@ static ret_t get_next_hop(struct bpf_dynptr *dynptr, __u64 *offset, encap_header
*offset += sizeof(*next_hop);
- /* Skip the remainig next hops (may be zero). */
+ /* Skip the remaining next hops (may be zero). */
return skip_next_hops(offset, encap->unigue.hop_count - encap->unigue.next_hop - 1);
}
diff --git a/tools/testing/selftests/bpf/progs/uretprobe_stack.c b/tools/testing/selftests/bpf/progs/uretprobe_stack.c
index 9fdcf396b8f46..a2951e2f1711b 100644
--- a/tools/testing/selftests/bpf/progs/uretprobe_stack.c
+++ b/tools/testing/selftests/bpf/progs/uretprobe_stack.c
@@ -26,8 +26,8 @@ int usdt_len;
SEC("uprobe//proc/self/exe:target_1")
int BPF_UPROBE(uprobe_1)
{
- /* target_1 is recursive wit depth of 2, so we capture two separate
- * stack traces, depending on which occurence it is
+ /* target_1 is recursive with depth of 2, so we capture two separate
+ * stack traces, depending on which occurrence it is
*/
static bool recur = false;
diff --git a/tools/testing/selftests/bpf/progs/verifier_scalar_ids.c b/tools/testing/selftests/bpf/progs/verifier_scalar_ids.c
index 7c5e5e6d10ebc..dba3ca728f6e6 100644
--- a/tools/testing/selftests/bpf/progs/verifier_scalar_ids.c
+++ b/tools/testing/selftests/bpf/progs/verifier_scalar_ids.c
@@ -349,7 +349,7 @@ __naked void precision_two_ids(void)
SEC("socket")
__success __log_level(2)
__flag(BPF_F_TEST_STATE_FREQ)
-/* check thar r0 and r6 have different IDs after 'if',
+/* check that r0 and r6 have different IDs after 'if',
* collect_linked_regs() can't tie more than 6 registers for a single insn.
*/
__msg("8: (25) if r0 > 0x7 goto pc+0 ; R0=scalar(id=1")
diff --git a/tools/testing/selftests/bpf/progs/verifier_var_off.c b/tools/testing/selftests/bpf/progs/verifier_var_off.c
index 1d36d01b746e7..f345466bca686 100644
--- a/tools/testing/selftests/bpf/progs/verifier_var_off.c
+++ b/tools/testing/selftests/bpf/progs/verifier_var_off.c
@@ -114,8 +114,8 @@ __naked void stack_write_priv_vs_unpriv(void)
}
/* Similar to the previous test, but this time also perform a read from the
- * address written to with a variable offset. The read is allowed, showing that,
- * after a variable-offset write, a priviledged program can read the slots that
+ * address written to with a variable offet. The read is allowed, showing that,
+ * after a variable-offset write, a privileged program can read the slots that
* were in the range of that write (even if the verifier doesn't actually know if
* the slot being read was really written to or not.
*
@@ -157,7 +157,7 @@ __naked void stack_write_followed_by_read(void)
SEC("socket")
__description("variable-offset stack write clobbers spilled regs")
__failure
-/* In the priviledged case, dereferencing a spilled-and-then-filled
+/* In the privileged case, dereferencing a spilled-and-then-filled
* register is rejected because the previous variable offset stack
* write might have overwritten the spilled pointer (i.e. we lose track
* of the spilled register when we analyze the write).
diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
index fd2da2234cc9b..76568db7a6642 100644
--- a/tools/testing/selftests/bpf/test_sockmap.c
+++ b/tools/testing/selftests/bpf/test_sockmap.c
@@ -1372,7 +1372,7 @@ static int run_options(struct sockmap_options *options, int cg_fd, int test)
} else
fprintf(stderr, "unknown test\n");
out:
- /* Detatch and zero all the maps */
+ /* Detach and zero all the maps */
bpf_prog_detach2(bpf_program__fd(progs[3]), cg_fd, BPF_CGROUP_SOCK_OPS);
for (i = 0; i < ARRAY_SIZE(links); i++) {
diff --git a/tools/testing/selftests/bpf/verifier/calls.c b/tools/testing/selftests/bpf/verifier/calls.c
index f3492efc88346..c8d640802cce4 100644
--- a/tools/testing/selftests/bpf/verifier/calls.c
+++ b/tools/testing/selftests/bpf/verifier/calls.c
@@ -1375,7 +1375,7 @@
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
/* write into map value */
BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
- /* fetch secound map_value_ptr from the stack */
+ /* fetch second map_value_ptr from the stack */
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
/* write into map value */
@@ -1439,7 +1439,7 @@
/* second time with fp-16 */
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
- /* fetch secound map_value_ptr from the stack */
+ /* fetch second map_value_ptr from the stack */
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
/* write into map value */
BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
@@ -1493,7 +1493,7 @@
/* second time with fp-16 */
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
- /* fetch secound map_value_ptr from the stack */
+ /* fetch second map_value_ptr from the stack */
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
/* write into map value */
BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
@@ -2380,7 +2380,7 @@
*/
BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 1),
BPF_MOV64_REG(BPF_REG_9, BPF_REG_8),
- /* r9 = *r9 ; verifier get's to this point via two paths:
+ /* r9 = *r9 ; verifier gets to this point via two paths:
* ; (I) one including r9 = r8, verified first;
* ; (II) one excluding r9 = r8, verified next.
* ; After load of *r9 to r9 the frame[0].fp[-24].id == r9.id.
diff --git a/tools/testing/selftests/bpf/xdping.c b/tools/testing/selftests/bpf/xdping.c
index 1503a1d2faa09..9ed8c796645d0 100644
--- a/tools/testing/selftests/bpf/xdping.c
+++ b/tools/testing/selftests/bpf/xdping.c
@@ -155,7 +155,7 @@ int main(int argc, char **argv)
}
if (!server) {
- /* Only supports IPv4; see hints initiailization above. */
+ /* Only supports IPv4; see hints initialization above. */
if (getaddrinfo(argv[optind], NULL, &hints, &a) || !a) {
fprintf(stderr, "Could not resolve %s\n", argv[optind]);
return 1;
diff --git a/tools/testing/selftests/bpf/xsk.h b/tools/testing/selftests/bpf/xsk.h
index 93c2cc413cfcd..48729da142c24 100644
--- a/tools/testing/selftests/bpf/xsk.h
+++ b/tools/testing/selftests/bpf/xsk.h
@@ -93,8 +93,8 @@ static inline __u32 xsk_prod_nb_free(struct xsk_ring_prod *r, __u32 nb)
/* Refresh the local tail pointer.
* cached_cons is r->size bigger than the real consumer pointer so
* that this addition can be avoided in the more frequently
- * executed code that computs free_entries in the beginning of
- * this function. Without this optimization it whould have been
+ * executed code that computes free_entries in the beginning of
+ * this function. Without this optimization it would have been
* free_entries = r->cached_prod - r->cached_cons + r->size.
*/
r->cached_cons = __atomic_load_n(r->consumer, __ATOMIC_ACQUIRE);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 489/563] selftests/bpf: move get_ksyms and get_addrs to trace_helpers.c
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (487 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 488/563] selftests/bpf: Fix typos and grammar in test sources Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 490/563] selftests/bpf: Fix realloc size in bpf_get_addrs Greg Kroah-Hartman
` (87 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Menglong Dong, Alexei Starovoitov,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Menglong Dong <menglong8.dong@gmail.com>
[ Upstream commit 8bad31edf5490a38dc26163502cd7005a033ee05 ]
We need to get all the kernel function that can be traced sometimes, so we
move the get_syms() and get_addrs() in kprobe_multi_test.c to
trace_helpers.c and rename it to bpf_get_ksyms() and bpf_get_addrs().
Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn>
Link: https://lore.kernel.org/r/20250904021011.14069-2-dongml2@chinatelecom.cn
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Stable-dep-of: 0c342bfc9949 ("selftests/bpf: Fix realloc size in bpf_get_addrs")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../bpf/prog_tests/kprobe_multi_test.c | 220 +-----------------
tools/testing/selftests/bpf/trace_helpers.c | 214 +++++++++++++++++
tools/testing/selftests/bpf/trace_helpers.h | 3 +
3 files changed, 220 insertions(+), 217 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
index f377bea0b82d4..171706e78da88 100644
--- a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
+++ b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
@@ -422,220 +422,6 @@ static void test_unique_match(void)
kprobe_multi__destroy(skel);
}
-static size_t symbol_hash(long key, void *ctx __maybe_unused)
-{
- return str_hash((const char *) key);
-}
-
-static bool symbol_equal(long key1, long key2, void *ctx __maybe_unused)
-{
- return strcmp((const char *) key1, (const char *) key2) == 0;
-}
-
-static bool is_invalid_entry(char *buf, bool kernel)
-{
- if (kernel && strchr(buf, '['))
- return true;
- if (!kernel && !strchr(buf, '['))
- return true;
- return false;
-}
-
-static bool skip_entry(char *name)
-{
- /*
- * We attach to almost all kernel functions and some of them
- * will cause 'suspicious RCU usage' when fprobe is attached
- * to them. Filter out the current culprits - arch_cpu_idle
- * default_idle and rcu_* functions.
- */
- if (!strcmp(name, "arch_cpu_idle"))
- return true;
- if (!strcmp(name, "default_idle"))
- return true;
- if (!strncmp(name, "rcu_", 4))
- return true;
- if (!strcmp(name, "bpf_dispatcher_xdp_func"))
- return true;
- if (!strncmp(name, "__ftrace_invalid_address__",
- sizeof("__ftrace_invalid_address__") - 1))
- return true;
- return false;
-}
-
-/* Do comparison by ignoring '.llvm.<hash>' suffixes. */
-static int compare_name(const char *name1, const char *name2)
-{
- const char *res1, *res2;
- int len1, len2;
-
- res1 = strstr(name1, ".llvm.");
- res2 = strstr(name2, ".llvm.");
- len1 = res1 ? res1 - name1 : strlen(name1);
- len2 = res2 ? res2 - name2 : strlen(name2);
-
- if (len1 == len2)
- return strncmp(name1, name2, len1);
- if (len1 < len2)
- return strncmp(name1, name2, len1) <= 0 ? -1 : 1;
- return strncmp(name1, name2, len2) >= 0 ? 1 : -1;
-}
-
-static int load_kallsyms_compare(const void *p1, const void *p2)
-{
- return compare_name(((const struct ksym *)p1)->name, ((const struct ksym *)p2)->name);
-}
-
-static int search_kallsyms_compare(const void *p1, const struct ksym *p2)
-{
- return compare_name(p1, p2->name);
-}
-
-static int get_syms(char ***symsp, size_t *cntp, bool kernel)
-{
- size_t cap = 0, cnt = 0;
- char *name = NULL, *ksym_name, **syms = NULL;
- struct hashmap *map;
- struct ksyms *ksyms;
- struct ksym *ks;
- char buf[256];
- FILE *f;
- int err = 0;
-
- ksyms = load_kallsyms_custom_local(load_kallsyms_compare);
- if (!ASSERT_OK_PTR(ksyms, "load_kallsyms_custom_local"))
- return -EINVAL;
-
- /*
- * The available_filter_functions contains many duplicates,
- * but other than that all symbols are usable in kprobe multi
- * interface.
- * Filtering out duplicates by using hashmap__add, which won't
- * add existing entry.
- */
-
- if (access("/sys/kernel/tracing/trace", F_OK) == 0)
- f = fopen("/sys/kernel/tracing/available_filter_functions", "r");
- else
- f = fopen("/sys/kernel/debug/tracing/available_filter_functions", "r");
-
- if (!f)
- return -EINVAL;
-
- map = hashmap__new(symbol_hash, symbol_equal, NULL);
- if (IS_ERR(map)) {
- err = libbpf_get_error(map);
- goto error;
- }
-
- while (fgets(buf, sizeof(buf), f)) {
- if (is_invalid_entry(buf, kernel))
- continue;
-
- free(name);
- if (sscanf(buf, "%ms$*[^\n]\n", &name) != 1)
- continue;
- if (skip_entry(name))
- continue;
-
- ks = search_kallsyms_custom_local(ksyms, name, search_kallsyms_compare);
- if (!ks) {
- err = -EINVAL;
- goto error;
- }
-
- ksym_name = ks->name;
- err = hashmap__add(map, ksym_name, 0);
- if (err == -EEXIST) {
- err = 0;
- continue;
- }
- if (err)
- goto error;
-
- err = libbpf_ensure_mem((void **) &syms, &cap,
- sizeof(*syms), cnt + 1);
- if (err)
- goto error;
-
- syms[cnt++] = ksym_name;
- }
-
- *symsp = syms;
- *cntp = cnt;
-
-error:
- free(name);
- fclose(f);
- hashmap__free(map);
- if (err)
- free(syms);
- return err;
-}
-
-static int get_addrs(unsigned long **addrsp, size_t *cntp, bool kernel)
-{
- unsigned long *addr, *addrs, *tmp_addrs;
- int err = 0, max_cnt, inc_cnt;
- char *name = NULL;
- size_t cnt = 0;
- char buf[256];
- FILE *f;
-
- if (access("/sys/kernel/tracing/trace", F_OK) == 0)
- f = fopen("/sys/kernel/tracing/available_filter_functions_addrs", "r");
- else
- f = fopen("/sys/kernel/debug/tracing/available_filter_functions_addrs", "r");
-
- if (!f)
- return -ENOENT;
-
- /* In my local setup, the number of entries is 50k+ so Let us initially
- * allocate space to hold 64k entries. If 64k is not enough, incrementally
- * increase 1k each time.
- */
- max_cnt = 65536;
- inc_cnt = 1024;
- addrs = malloc(max_cnt * sizeof(long));
- if (addrs == NULL) {
- err = -ENOMEM;
- goto error;
- }
-
- while (fgets(buf, sizeof(buf), f)) {
- if (is_invalid_entry(buf, kernel))
- continue;
-
- free(name);
- if (sscanf(buf, "%p %ms$*[^\n]\n", &addr, &name) != 2)
- continue;
- if (skip_entry(name))
- continue;
-
- if (cnt == max_cnt) {
- max_cnt += inc_cnt;
- tmp_addrs = realloc(addrs, max_cnt);
- if (!tmp_addrs) {
- err = -ENOMEM;
- goto error;
- }
- addrs = tmp_addrs;
- }
-
- addrs[cnt++] = (unsigned long)addr;
- }
-
- *addrsp = addrs;
- *cntp = cnt;
-
-error:
- free(name);
- fclose(f);
- if (err)
- free(addrs);
- return err;
-}
-
static void do_bench_test(struct kprobe_multi_empty *skel, struct bpf_kprobe_multi_opts *opts)
{
long attach_start_ns, attach_end_ns;
@@ -670,7 +456,7 @@ static void test_kprobe_multi_bench_attach(bool kernel)
char **syms = NULL;
size_t cnt = 0;
- if (!ASSERT_OK(get_syms(&syms, &cnt, kernel), "get_syms"))
+ if (!ASSERT_OK(bpf_get_ksyms(&syms, &cnt, kernel), "bpf_get_ksyms"))
return;
skel = kprobe_multi_empty__open_and_load();
@@ -696,13 +482,13 @@ static void test_kprobe_multi_bench_attach_addr(bool kernel)
size_t cnt = 0;
int err;
- err = get_addrs(&addrs, &cnt, kernel);
+ err = bpf_get_addrs(&addrs, &cnt, kernel);
if (err == -ENOENT) {
test__skip();
return;
}
- if (!ASSERT_OK(err, "get_addrs"))
+ if (!ASSERT_OK(err, "bpf_get_addrs"))
return;
skel = kprobe_multi_empty__open_and_load();
diff --git a/tools/testing/selftests/bpf/trace_helpers.c b/tools/testing/selftests/bpf/trace_helpers.c
index 81943c6254e6b..d24baf244d1f3 100644
--- a/tools/testing/selftests/bpf/trace_helpers.c
+++ b/tools/testing/selftests/bpf/trace_helpers.c
@@ -17,6 +17,7 @@
#include <linux/limits.h>
#include <libelf.h>
#include <gelf.h>
+#include "bpf/hashmap.h"
#include "bpf/libbpf_internal.h"
#define TRACEFS_PIPE "/sys/kernel/tracing/trace_pipe"
@@ -519,3 +520,216 @@ void read_trace_pipe(void)
{
read_trace_pipe_iter(trace_pipe_cb, NULL, 0);
}
+
+static size_t symbol_hash(long key, void *ctx __maybe_unused)
+{
+ return str_hash((const char *) key);
+}
+
+static bool symbol_equal(long key1, long key2, void *ctx __maybe_unused)
+{
+ return strcmp((const char *) key1, (const char *) key2) == 0;
+}
+
+static bool is_invalid_entry(char *buf, bool kernel)
+{
+ if (kernel && strchr(buf, '['))
+ return true;
+ if (!kernel && !strchr(buf, '['))
+ return true;
+ return false;
+}
+
+static bool skip_entry(char *name)
+{
+ /*
+ * We attach to almost all kernel functions and some of them
+ * will cause 'suspicious RCU usage' when fprobe is attached
+ * to them. Filter out the current culprits - arch_cpu_idle
+ * default_idle and rcu_* functions.
+ */
+ if (!strcmp(name, "arch_cpu_idle"))
+ return true;
+ if (!strcmp(name, "default_idle"))
+ return true;
+ if (!strncmp(name, "rcu_", 4))
+ return true;
+ if (!strcmp(name, "bpf_dispatcher_xdp_func"))
+ return true;
+ if (!strncmp(name, "__ftrace_invalid_address__",
+ sizeof("__ftrace_invalid_address__") - 1))
+ return true;
+ return false;
+}
+
+/* Do comparison by ignoring '.llvm.<hash>' suffixes. */
+static int compare_name(const char *name1, const char *name2)
+{
+ const char *res1, *res2;
+ int len1, len2;
+
+ res1 = strstr(name1, ".llvm.");
+ res2 = strstr(name2, ".llvm.");
+ len1 = res1 ? res1 - name1 : strlen(name1);
+ len2 = res2 ? res2 - name2 : strlen(name2);
+
+ if (len1 == len2)
+ return strncmp(name1, name2, len1);
+ if (len1 < len2)
+ return strncmp(name1, name2, len1) <= 0 ? -1 : 1;
+ return strncmp(name1, name2, len2) >= 0 ? 1 : -1;
+}
+
+static int load_kallsyms_compare(const void *p1, const void *p2)
+{
+ return compare_name(((const struct ksym *)p1)->name, ((const struct ksym *)p2)->name);
+}
+
+static int search_kallsyms_compare(const void *p1, const struct ksym *p2)
+{
+ return compare_name(p1, p2->name);
+}
+
+int bpf_get_ksyms(char ***symsp, size_t *cntp, bool kernel)
+{
+ size_t cap = 0, cnt = 0;
+ char *name = NULL, *ksym_name, **syms = NULL;
+ struct hashmap *map;
+ struct ksyms *ksyms;
+ struct ksym *ks;
+ char buf[256];
+ FILE *f;
+ int err = 0;
+
+ ksyms = load_kallsyms_custom_local(load_kallsyms_compare);
+ if (!ksyms)
+ return -EINVAL;
+
+ /*
+ * The available_filter_functions contains many duplicates,
+ * but other than that all symbols are usable to trace.
+ * Filtering out duplicates by using hashmap__add, which won't
+ * add existing entry.
+ */
+
+ if (access("/sys/kernel/tracing/trace", F_OK) == 0)
+ f = fopen("/sys/kernel/tracing/available_filter_functions", "r");
+ else
+ f = fopen("/sys/kernel/debug/tracing/available_filter_functions", "r");
+
+ if (!f)
+ return -EINVAL;
+
+ map = hashmap__new(symbol_hash, symbol_equal, NULL);
+ if (IS_ERR(map)) {
+ err = libbpf_get_error(map);
+ goto error;
+ }
+
+ while (fgets(buf, sizeof(buf), f)) {
+ if (is_invalid_entry(buf, kernel))
+ continue;
+
+ free(name);
+ if (sscanf(buf, "%ms$*[^\n]\n", &name) != 1)
+ continue;
+ if (skip_entry(name))
+ continue;
+
+ ks = search_kallsyms_custom_local(ksyms, name, search_kallsyms_compare);
+ if (!ks) {
+ err = -EINVAL;
+ goto error;
+ }
+
+ ksym_name = ks->name;
+ err = hashmap__add(map, ksym_name, 0);
+ if (err == -EEXIST) {
+ err = 0;
+ continue;
+ }
+ if (err)
+ goto error;
+
+ err = libbpf_ensure_mem((void **) &syms, &cap,
+ sizeof(*syms), cnt + 1);
+ if (err)
+ goto error;
+
+ syms[cnt++] = ksym_name;
+ }
+
+ *symsp = syms;
+ *cntp = cnt;
+
+error:
+ free(name);
+ fclose(f);
+ hashmap__free(map);
+ if (err)
+ free(syms);
+ return err;
+}
+
+int bpf_get_addrs(unsigned long **addrsp, size_t *cntp, bool kernel)
+{
+ unsigned long *addr, *addrs, *tmp_addrs;
+ int err = 0, max_cnt, inc_cnt;
+ char *name = NULL;
+ size_t cnt = 0;
+ char buf[256];
+ FILE *f;
+
+ if (access("/sys/kernel/tracing/trace", F_OK) == 0)
+ f = fopen("/sys/kernel/tracing/available_filter_functions_addrs", "r");
+ else
+ f = fopen("/sys/kernel/debug/tracing/available_filter_functions_addrs", "r");
+
+ if (!f)
+ return -ENOENT;
+
+ /* In my local setup, the number of entries is 50k+ so Let us initially
+ * allocate space to hold 64k entries. If 64k is not enough, incrementally
+ * increase 1k each time.
+ */
+ max_cnt = 65536;
+ inc_cnt = 1024;
+ addrs = malloc(max_cnt * sizeof(long));
+ if (addrs == NULL) {
+ err = -ENOMEM;
+ goto error;
+ }
+
+ while (fgets(buf, sizeof(buf), f)) {
+ if (is_invalid_entry(buf, kernel))
+ continue;
+
+ free(name);
+ if (sscanf(buf, "%p %ms$*[^\n]\n", &addr, &name) != 2)
+ continue;
+ if (skip_entry(name))
+ continue;
+
+ if (cnt == max_cnt) {
+ max_cnt += inc_cnt;
+ tmp_addrs = realloc(addrs, max_cnt);
+ if (!tmp_addrs) {
+ err = -ENOMEM;
+ goto error;
+ }
+ addrs = tmp_addrs;
+ }
+
+ addrs[cnt++] = (unsigned long)addr;
+ }
+
+ *addrsp = addrs;
+ *cntp = cnt;
+
+error:
+ free(name);
+ fclose(f);
+ if (err)
+ free(addrs);
+ return err;
+}
diff --git a/tools/testing/selftests/bpf/trace_helpers.h b/tools/testing/selftests/bpf/trace_helpers.h
index 2ce873c9f9aad..9437bdd4afa50 100644
--- a/tools/testing/selftests/bpf/trace_helpers.h
+++ b/tools/testing/selftests/bpf/trace_helpers.h
@@ -41,4 +41,7 @@ ssize_t get_rel_offset(uintptr_t addr);
int read_build_id(const char *path, char *build_id, size_t size);
+int bpf_get_ksyms(char ***symsp, size_t *cntp, bool kernel);
+int bpf_get_addrs(unsigned long **addrsp, size_t *cntp, bool kernel);
+
#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 490/563] selftests/bpf: Fix realloc size in bpf_get_addrs
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (488 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 489/563] selftests/bpf: move get_ksyms and get_addrs to trace_helpers.c Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 491/563] bpf: Skip scalar adjustment for BPF_NEG if dst is a pointer Greg Kroah-Hartman
` (86 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiri Olsa, Alexei Starovoitov,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <jolsa@kernel.org>
[ Upstream commit 0c342bfc9949dffeaa83ebdde3b4b0ce59009348 ]
We will segfault once we call realloc in bpf_get_addrs due to
wrong size argument.
Fixes: 6302bdeb91df ("selftests/bpf: Add a kprobe_multi subtest to use addrs instead of syms")
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/trace_helpers.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/trace_helpers.c b/tools/testing/selftests/bpf/trace_helpers.c
index d24baf244d1f3..03f223333aa4a 100644
--- a/tools/testing/selftests/bpf/trace_helpers.c
+++ b/tools/testing/selftests/bpf/trace_helpers.c
@@ -712,7 +712,7 @@ int bpf_get_addrs(unsigned long **addrsp, size_t *cntp, bool kernel)
if (cnt == max_cnt) {
max_cnt += inc_cnt;
- tmp_addrs = realloc(addrs, max_cnt);
+ tmp_addrs = realloc(addrs, max_cnt * sizeof(long));
if (!tmp_addrs) {
err = -ENOMEM;
goto error;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 491/563] bpf: Skip scalar adjustment for BPF_NEG if dst is a pointer
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (489 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 490/563] selftests/bpf: Fix realloc size in bpf_get_addrs Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 492/563] bpf: Reject negative offsets for ALU ops Greg Kroah-Hartman
` (85 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+d36d5ae81e1b0a53ef58,
KaFai Wan, Eduard Zingerman, Brahmajit Das, Alexei Starovoitov,
Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brahmajit Das <listout@listout.xyz>
[ Upstream commit 34904582b502a86fdb4d7984b12cacd2faabbe0d ]
In check_alu_op(), the verifier currently calls check_reg_arg() and
adjust_scalar_min_max_vals() unconditionally for BPF_NEG operations.
However, if the destination register holds a pointer, these scalar
adjustments are unnecessary and potentially incorrect.
This patch adds a check to skip the adjustment logic when the destination
register contains a pointer.
Reported-by: syzbot+d36d5ae81e1b0a53ef58@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d36d5ae81e1b0a53ef58
Fixes: aced132599b3 ("bpf: Add range tracking for BPF_NEG")
Suggested-by: KaFai Wan <kafai.wan@linux.dev>
Suggested-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Brahmajit Das <listout@listout.xyz>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20251001191739.2323644-2-listout@listout.xyz
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 6ad0dc226183a..299e43dac873e 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -15592,7 +15592,8 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
}
/* check dest operand */
- if (opcode == BPF_NEG) {
+ if (opcode == BPF_NEG &&
+ regs[insn->dst_reg].type == SCALAR_VALUE) {
err = check_reg_arg(env, insn->dst_reg, DST_OP_NO_MARK);
err = err ?: adjust_scalar_min_max_vals(env, insn,
®s[insn->dst_reg],
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 492/563] bpf: Reject negative offsets for ALU ops
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (490 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 491/563] bpf: Skip scalar adjustment for BPF_NEG if dst is a pointer Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 493/563] tpm: Disable TPM2_TCG_HMAC by default Greg Kroah-Hartman
` (84 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shenghao Yuan, Tianci Cao,
Yazhou Tang, Yonghong Song, Alexei Starovoitov, Sasha Levin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yazhou Tang <tangyazhou518@outlook.com>
[ Upstream commit 55c0ced59fe17dee34e9dfd5f7be63cbab207758 ]
When verifying BPF programs, the check_alu_op() function validates
instructions with ALU operations. The 'offset' field in these
instructions is a signed 16-bit integer.
The existing check 'insn->off > 1' was intended to ensure the offset is
either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is
signed, this check incorrectly accepts all negative values (e.g., -1).
This commit tightens the validation by changing the condition to
'(insn->off != 0 && insn->off != 1)'. This ensures that any value
other than the explicitly permitted 0 and 1 is rejected, hardening the
verifier against malformed BPF programs.
Co-developed-by: Shenghao Yuan <shenghaoyuan0928@163.com>
Signed-off-by: Shenghao Yuan <shenghaoyuan0928@163.com>
Co-developed-by: Tianci Cao <ziye@zju.edu.cn>
Signed-off-by: Tianci Cao <ziye@zju.edu.cn>
Signed-off-by: Yazhou Tang <tangyazhou518@outlook.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Fixes: ec0e2da95f72 ("bpf: Support new signed div/mod instructions.")
Link: https://lore.kernel.org/r/tencent_70D024BAE70A0A309A4781694C7B764B0608@qq.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 299e43dac873e..ed1457c273409 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -15755,7 +15755,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
} else { /* all other ALU ops: and, sub, xor, add, ... */
if (BPF_SRC(insn->code) == BPF_X) {
- if (insn->imm != 0 || insn->off > 1 ||
+ if (insn->imm != 0 || (insn->off != 0 && insn->off != 1) ||
(insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) {
verbose(env, "BPF_ALU uses reserved fields\n");
return -EINVAL;
@@ -15765,7 +15765,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
if (err)
return err;
} else {
- if (insn->src_reg != BPF_REG_0 || insn->off > 1 ||
+ if (insn->src_reg != BPF_REG_0 || (insn->off != 0 && insn->off != 1) ||
(insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) {
verbose(env, "BPF_ALU uses reserved fields\n");
return -EINVAL;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 493/563] tpm: Disable TPM2_TCG_HMAC by default
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (491 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 492/563] bpf: Reject negative offsets for ALU ops Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 494/563] ALSA: hda/hdmi: Add pin fix for HP ProDesk model Greg Kroah-Hartman
` (83 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Fenner, Jarkko Sakkinen,
stable
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Sakkinen <jarkko@kernel.org>
commit 4bddf4587c131d7b8ce8952cd32b284dcda0dd1f upstream.
After reading all the feedback, right now disabling the TPM2_TCG_HMAC
is the right call.
Other views discussed:
A. Having a kernel command-line parameter or refining the feature
otherwise. This goes to the area of improvements. E.g., one
example is my own idea where the null key specific code would be
replaced with a persistent handle parameter (which can be
*unambigously* defined as part of attestation process when
done correctly).
B. Removing the code. I don't buy this because that is same as saying
that HMAC encryption cannot work at all (if really nitpicking) in
any form. Also I disagree on the view that the feature could not
be refined to something more reasoable.
Also, both A and B are worst options in terms of backporting.
Thuss, this is the best possible choice.
Cc: stable@vger.kernel.or # v6.10+
Fixes: d2add27cf2b8 ("tpm: Add NULL primary creation")
Suggested-by: Chris Fenner <cfenn@google.com>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -29,7 +29,7 @@ if TCG_TPM
config TCG_TPM2_HMAC
bool "Use HMAC and encrypted transactions on the TPM bus"
- default X86_64
+ default n
select CRYPTO_ECDH
select CRYPTO_LIB_AESCFB
select CRYPTO_LIB_SHA256
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 494/563] ALSA: hda/hdmi: Add pin fix for HP ProDesk model
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (492 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 493/563] tpm: Disable TPM2_TCG_HMAC by default Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 495/563] ALSA: hda/realtek: Add quirk for HP Spectre 14t-ea100 Greg Kroah-Hartman
` (82 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Steven Steve Kendall, Takashi Iwai
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven 'Steve' Kendall <skend@chromium.org>
commit 74662f9f92b67c0ca55139c5aa392da0f0a26c08 upstream.
The HP ProDesk 400 (SSID 103c:83f3) also needs a quirk for
enabling HDMI outputs. This patch adds the required quirk
entry.
Signed-off-by: Steven 'Steve' Kendall <skend@chromium.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/hda/codecs/hdmi/hdmi.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/hda/codecs/hdmi/hdmi.c
+++ b/sound/hda/codecs/hdmi/hdmi.c
@@ -1583,6 +1583,7 @@ static const struct snd_pci_quirk force_
SND_PCI_QUIRK(0x103c, 0x83e2, "HP EliteDesk 800 G4", 1),
SND_PCI_QUIRK(0x103c, 0x83ef, "HP MP9 G4 Retail System AMS", 1),
SND_PCI_QUIRK(0x103c, 0x845a, "HP EliteDesk 800 G4 DM 65W", 1),
+ SND_PCI_QUIRK(0x103c, 0x83f3, "HP ProDesk 400", 1),
SND_PCI_QUIRK(0x103c, 0x870f, "HP", 1),
SND_PCI_QUIRK(0x103c, 0x871a, "HP", 1),
SND_PCI_QUIRK(0x103c, 0x8711, "HP", 1),
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 495/563] ALSA: hda/realtek: Add quirk for HP Spectre 14t-ea100
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (493 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 494/563] ALSA: hda/hdmi: Add pin fix for HP ProDesk model Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 496/563] Squashfs: fix uninit-value in squashfs_get_parent Greg Kroah-Hartman
` (81 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kaden Berger, Takashi Iwai
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 50a098e3e9b1bb30cefc43cdfba3c7b9b32e14a7 upstream.
HP-Spectre 14t-ea100 model has no speaker output unless booting
previously from Windows on dual boot, a reboot while on Linux will
stop the speakers working. Applying the existing quirk for HP Spectre
X360 EU0xxx seems fixing this speaker problem.
Reported-by: Kaden Berger <kadenb816@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/aMxdGAmfOQ6VPNU8@archlinux
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/hda/codecs/realtek/alc269.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -6487,6 +6487,7 @@ static const struct hda_quirk alc269_fix
SND_PCI_QUIRK(0x103c, 0x89c6, "Zbook Fury 17 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
SND_PCI_QUIRK(0x103c, 0x89ca, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
SND_PCI_QUIRK(0x103c, 0x89d3, "HP EliteBook 645 G9 (MB 89D2)", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
+ SND_PCI_QUIRK(0x103c, 0x89da, "HP Spectre x360 14t-ea100", ALC245_FIXUP_HP_SPECTRE_X360_EU0XXX),
SND_PCI_QUIRK(0x103c, 0x89e7, "HP Elite x2 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
SND_PCI_QUIRK(0x103c, 0x8a0f, "HP Pavilion 14-ec1xxx", ALC287_FIXUP_HP_GPIO_LED),
SND_PCI_QUIRK(0x103c, 0x8a20, "HP Laptop 15s-fq5xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 496/563] Squashfs: fix uninit-value in squashfs_get_parent
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (494 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 495/563] ALSA: hda/realtek: Add quirk for HP Spectre 14t-ea100 Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 497/563] uio_hv_generic: Let userspace take care of interrupt mask Greg Kroah-Hartman
` (80 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Phillip Lougher,
syzbot+157bdef5cf596ad0da2c, Andrew Morton
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phillip Lougher <phillip@squashfs.org.uk>
commit 74058c0a9fc8b2b4d5f4a0ef7ee2cfa66a9e49cf upstream.
Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug.
This is caused by open_by_handle_at() being called with a file handle
containing an invalid parent inode number. In particular the inode number
is that of a symbolic link, rather than a directory.
Squashfs_get_parent() gets called with that symbolic link inode, and
accesses the parent member field.
unsigned int parent_ino = squashfs_i(inode)->parent;
Because non-directory inodes in Squashfs do not have a parent value, this
is uninitialised, and this causes an uninitialised value access.
The fix is to initialise parent with the invalid inode 0, which will cause
an EINVAL error to be returned.
Regular inodes used to share the parent field with the block_list_start
field. This is removed in this commit to enable the parent field to
contain the invalid inode number 0.
Link: https://lkml.kernel.org/r/20250918233308.293861-1-phillip@squashfs.org.uk
Fixes: 122601408d20 ("Squashfs: export operations")
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Reported-by: syzbot+157bdef5cf596ad0da2c@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68cc2431.050a0220.139b6.0001.GAE@google.com/
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/squashfs/inode.c | 7 +++++++
fs/squashfs/squashfs_fs_i.h | 2 +-
2 files changed, 8 insertions(+), 1 deletion(-)
--- a/fs/squashfs/inode.c
+++ b/fs/squashfs/inode.c
@@ -165,6 +165,7 @@ int squashfs_read_inode(struct inode *in
squashfs_i(inode)->start = le32_to_cpu(sqsh_ino->start_block);
squashfs_i(inode)->block_list_start = block;
squashfs_i(inode)->offset = offset;
+ squashfs_i(inode)->parent = 0;
inode->i_data.a_ops = &squashfs_aops;
TRACE("File inode %x:%x, start_block %llx, block_list_start "
@@ -212,6 +213,7 @@ int squashfs_read_inode(struct inode *in
squashfs_i(inode)->start = le64_to_cpu(sqsh_ino->start_block);
squashfs_i(inode)->block_list_start = block;
squashfs_i(inode)->offset = offset;
+ squashfs_i(inode)->parent = 0;
inode->i_data.a_ops = &squashfs_aops;
TRACE("File inode %x:%x, start_block %llx, block_list_start "
@@ -292,6 +294,7 @@ int squashfs_read_inode(struct inode *in
inode->i_mode |= S_IFLNK;
squashfs_i(inode)->start = block;
squashfs_i(inode)->offset = offset;
+ squashfs_i(inode)->parent = 0;
if (type == SQUASHFS_LSYMLINK_TYPE) {
__le32 xattr;
@@ -329,6 +332,7 @@ int squashfs_read_inode(struct inode *in
set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
rdev = le32_to_cpu(sqsh_ino->rdev);
init_special_inode(inode, inode->i_mode, new_decode_dev(rdev));
+ squashfs_i(inode)->parent = 0;
TRACE("Device inode %x:%x, rdev %x\n",
SQUASHFS_INODE_BLK(ino), offset, rdev);
@@ -353,6 +357,7 @@ int squashfs_read_inode(struct inode *in
set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
rdev = le32_to_cpu(sqsh_ino->rdev);
init_special_inode(inode, inode->i_mode, new_decode_dev(rdev));
+ squashfs_i(inode)->parent = 0;
TRACE("Device inode %x:%x, rdev %x\n",
SQUASHFS_INODE_BLK(ino), offset, rdev);
@@ -373,6 +378,7 @@ int squashfs_read_inode(struct inode *in
inode->i_mode |= S_IFSOCK;
set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
init_special_inode(inode, inode->i_mode, 0);
+ squashfs_i(inode)->parent = 0;
break;
}
case SQUASHFS_LFIFO_TYPE:
@@ -392,6 +398,7 @@ int squashfs_read_inode(struct inode *in
inode->i_op = &squashfs_inode_ops;
set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
init_special_inode(inode, inode->i_mode, 0);
+ squashfs_i(inode)->parent = 0;
break;
}
default:
--- a/fs/squashfs/squashfs_fs_i.h
+++ b/fs/squashfs/squashfs_fs_i.h
@@ -16,6 +16,7 @@ struct squashfs_inode_info {
u64 xattr;
unsigned int xattr_size;
int xattr_count;
+ int parent;
union {
struct {
u64 fragment_block;
@@ -27,7 +28,6 @@ struct squashfs_inode_info {
u64 dir_idx_start;
int dir_idx_offset;
int dir_idx_cnt;
- int parent;
};
};
struct inode vfs_inode;
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 497/563] uio_hv_generic: Let userspace take care of interrupt mask
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (495 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 496/563] Squashfs: fix uninit-value in squashfs_get_parent Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:45 ` [PATCH 6.17 498/563] hisi_acc_vfio_pci: Fix reference leak in hisi_acc_vfio_debug_init Greg Kroah-Hartman
` (79 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Starks, Naman Jain,
Michael Kelley, Long Li, Tianyu Lan
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naman Jain <namjain@linux.microsoft.com>
commit b15b7d2a1b09ef5428a8db260251897405a19496 upstream.
Remove the logic to set interrupt mask by default in uio_hv_generic
driver as the interrupt mask value is supposed to be controlled
completely by the user space. If the mask bit gets changed
by the driver, concurrently with user mode operating on the ring,
the mask bit may be set when it is supposed to be clear, and the
user-mode driver will miss an interrupt which will cause a hang.
For eg- when the driver sets inbound ring buffer interrupt mask to 1,
the host does not interrupt the guest on the UIO VMBus channel.
However, setting the mask does not prevent the host from putting a
message in the inbound ring buffer. So let’s assume that happens,
the host puts a message into the ring buffer but does not interrupt.
Subsequently, the user space code in the guest sets the inbound ring
buffer interrupt mask to 0, saying “Hey, I’m ready for interrupts”.
User space code then calls pread() to wait for an interrupt.
Then one of two things happens:
* The host never sends another message. So the pread() waits forever.
* The host does send another message. But because there’s already a
message in the ring buffer, it doesn’t generate an interrupt.
This is the correct behavior, because the host should only send an
interrupt when the inbound ring buffer transitions from empty to
not-empty. Adding an additional message to a ring buffer that is not
empty is not supposed to generate an interrupt on the guest.
Since the guest is waiting in pread() and not removing messages from
the ring buffer, the pread() waits forever.
This could be easily reproduced in hv_fcopy_uio_daemon if we delay
setting interrupt mask to 0.
Similarly if hv_uio_channel_cb() sets the interrupt_mask to 1,
there’s a race condition. Once user space empties the inbound ring
buffer, but before user space sets interrupt_mask to 0, the host could
put another message in the ring buffer but it wouldn’t interrupt.
Then the next pread() would hang.
Fix these by removing all instances where interrupt_mask is changed,
while keeping the one in set_event() unchanged to enable userspace
control the interrupt mask by writing 0/1 to /dev/uioX.
Fixes: 95096f2fbd10 ("uio-hv-generic: new userspace i/o driver for VMBus")
Suggested-by: John Starks <jostarks@microsoft.com>
Signed-off-by: Naman Jain <namjain@linux.microsoft.com>
Cc: stable@vger.kernel.org
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Long Li <longli@microsoft.com>
Reviewed-by: Tianyu Lan <tiala@microsoft.com>
Tested-by: Tianyu Lan <tiala@microsoft.com>
Link: https://lore.kernel.org/r/20250828044200.492030-1-namjain@linux.microsoft.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/uio/uio_hv_generic.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
--- a/drivers/uio/uio_hv_generic.c
+++ b/drivers/uio/uio_hv_generic.c
@@ -111,7 +111,6 @@ static void hv_uio_channel_cb(void *cont
struct hv_device *hv_dev;
struct hv_uio_private_data *pdata;
- chan->inbound.ring_buffer->interrupt_mask = 1;
virt_mb();
/*
@@ -183,8 +182,6 @@ hv_uio_new_channel(struct vmbus_channel
return;
}
- /* Disable interrupts on sub channel */
- new_sc->inbound.ring_buffer->interrupt_mask = 1;
set_channel_read_mode(new_sc, HV_CALL_ISR);
ret = hv_create_ring_sysfs(new_sc, hv_uio_ring_mmap);
if (ret) {
@@ -227,9 +224,7 @@ hv_uio_open(struct uio_info *info, struc
ret = vmbus_connect_ring(dev->channel,
hv_uio_channel_cb, dev->channel);
- if (ret == 0)
- dev->channel->inbound.ring_buffer->interrupt_mask = 1;
- else
+ if (ret)
atomic_dec(&pdata->refcnt);
return ret;
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 498/563] hisi_acc_vfio_pci: Fix reference leak in hisi_acc_vfio_debug_init
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (496 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 497/563] uio_hv_generic: Let userspace take care of interrupt mask Greg Kroah-Hartman
@ 2025-10-13 14:45 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 499/563] io_uring/waitid: always prune wait queue entry in io_waitid_wait() Greg Kroah-Hartman
` (78 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miaoqian Lin, Longfang Liu,
Alex Williamson
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <linmq006@gmail.com>
commit eaba58355ecd124b4a8c91df7335970ad9fe2624 upstream.
The debugfs_lookup() function returns a dentry with an increased reference
count that must be released by calling dput().
Fixes: b398f91779b8 ("hisi_acc_vfio_pci: register debugfs for hisilicon migration driver")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Reviewed-by: Longfang Liu <liulongfang@huawei.com>
Link: https://lore.kernel.org/r/20250901081809.2286649-1-linmq006@gmail.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
@@ -1612,8 +1612,10 @@ static void hisi_acc_vfio_debug_init(str
}
migf = kzalloc(sizeof(*migf), GFP_KERNEL);
- if (!migf)
+ if (!migf) {
+ dput(vfio_dev_migration);
return;
+ }
hisi_acc_vdev->debug_migf = migf;
vfio_hisi_acc = debugfs_create_dir("hisi_acc", vfio_dev_migration);
@@ -1623,6 +1625,8 @@ static void hisi_acc_vfio_debug_init(str
hisi_acc_vf_migf_read);
debugfs_create_devm_seqfile(dev, "cmd_state", vfio_hisi_acc,
hisi_acc_vf_debug_cmd);
+
+ dput(vfio_dev_migration);
}
static void hisi_acc_vf_debugfs_exit(struct hisi_acc_vf_core_device *hisi_acc_vdev)
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 499/563] io_uring/waitid: always prune wait queue entry in io_waitid_wait()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (497 preceding siblings ...)
2025-10-13 14:45 ` [PATCH 6.17 498/563] hisi_acc_vfio_pci: Fix reference leak in hisi_acc_vfio_debug_init Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 500/563] io_uring/zcrx: fix overshooting recv limit Greg Kroah-Hartman
` (77 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, syzbot+b9e83021d9c642a33d8c,
Jens Axboe
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <axboe@kernel.dk>
commit 2f8229d53d984c6a05b71ac9e9583d4354e3b91f upstream.
For a successful return, always remove our entry from the wait queue
entry list. Previously this was skipped if a cancelation was in
progress, but this can race with another invocation of the wait queue
entry callback.
Cc: stable@vger.kernel.org
Fixes: f31ecf671ddc ("io_uring: add IORING_OP_WAITID support")
Reported-by: syzbot+b9e83021d9c642a33d8c@syzkaller.appspotmail.com
Tested-by: syzbot+b9e83021d9c642a33d8c@syzkaller.appspotmail.com
Link: https://lore.kernel.org/io-uring/68e5195e.050a0220.256323.001f.GAE@google.com/
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/waitid.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/io_uring/waitid.c
+++ b/io_uring/waitid.c
@@ -232,13 +232,14 @@ static int io_waitid_wait(struct wait_qu
if (!pid_child_should_wake(wo, p))
return 0;
+ list_del_init(&wait->entry);
+
/* cancel is in progress */
if (atomic_fetch_inc(&iw->refs) & IO_WAITID_REF_MASK)
return 1;
req->io_task_work.func = io_waitid_cb;
io_req_task_work_add(req);
- list_del_init(&wait->entry);
return 1;
}
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 500/563] io_uring/zcrx: fix overshooting recv limit
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (498 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 499/563] io_uring/waitid: always prune wait queue entry in io_waitid_wait() Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 501/563] ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() Greg Kroah-Hartman
` (76 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pavel Begunkov, Jens Axboe,
Matthias Jasny
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <asml.silence@gmail.com>
commit 09cfd3c52ea76f43b3cb15e570aeddf633d65e80 upstream.
It's reported that sometimes a zcrx request can receive more than was
requested. It's caused by io_zcrx_recv_skb() adjusting desc->count for
all received buffers including frag lists, but then doing recursive
calls to process frag list skbs, which leads to desc->count double
accounting and underflow.
Reported-and-tested-by: Matthias Jasny <matthiasjasny@gmail.com>
Fixes: 6699ec9a23f85 ("io_uring/zcrx: add a read limit to recvzc requests")
Cc: stable@vger.kernel.org
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/zcrx.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -1154,12 +1154,16 @@ io_zcrx_recv_skb(read_descriptor_t *desc
end = start + frag_iter->len;
if (offset < end) {
+ size_t count;
+
copy = end - offset;
if (copy > len)
copy = len;
off = offset - start;
+ count = desc->count;
ret = io_zcrx_recv_skb(desc, frag_iter, off, copy);
+ desc->count = count;
if (ret < 0)
goto out;
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 501/563] ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (499 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 500/563] io_uring/zcrx: fix overshooting recv limit Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 502/563] ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down Greg Kroah-Hartman
` (75 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ma Ke, Dmitry Baryshkov, Mark Brown
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make24@iscas.ac.cn>
commit 4e65bda8273c938039403144730923e77916a3d7 upstream.
wcd934x_codec_parse_data() contains a device reference count leak in
of_slim_get_device() where device_find_child() increases the reference
count of the device but this reference is not properly decreased in
the success path. Add put_device() in wcd934x_codec_parse_data() and
add devm_add_action_or_reset() in the probe function, which ensures
that the reference count of the device is correctly managed.
Memory leak in regmap_init_slimbus() as the allocated regmap is not
released when the device is removed. Using devm_regmap_init_slimbus()
instead of regmap_init_slimbus() to ensure automatic regmap cleanup on
device removal.
Calling path: of_slim_get_device() -> of_find_slim_device() ->
device_find_child(). As comment of device_find_child() says, 'NOTE:
you will need to drop the reference with put_device() after use.'.
Found by code review.
Cc: stable@vger.kernel.org
Fixes: a61f3b4f476e ("ASoC: wcd934x: add support to wcd9340/wcd9341 codec")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://patch.msgid.link/20250923065212.26660-1-make24@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/wcd934x.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
--- a/sound/soc/codecs/wcd934x.c
+++ b/sound/soc/codecs/wcd934x.c
@@ -5831,6 +5831,13 @@ static const struct snd_soc_component_dr
.endianness = 1,
};
+static void wcd934x_put_device_action(void *data)
+{
+ struct device *dev = data;
+
+ put_device(dev);
+}
+
static int wcd934x_codec_parse_data(struct wcd934x_codec *wcd)
{
struct device *dev = &wcd->sdev->dev;
@@ -5847,11 +5854,13 @@ static int wcd934x_codec_parse_data(stru
return dev_err_probe(dev, -EINVAL, "Unable to get SLIM Interface device\n");
slim_get_logical_addr(wcd->sidev);
- wcd->if_regmap = regmap_init_slimbus(wcd->sidev,
+ wcd->if_regmap = devm_regmap_init_slimbus(wcd->sidev,
&wcd934x_ifc_regmap_config);
- if (IS_ERR(wcd->if_regmap))
+ if (IS_ERR(wcd->if_regmap)) {
+ put_device(&wcd->sidev->dev);
return dev_err_probe(dev, PTR_ERR(wcd->if_regmap),
"Failed to allocate ifc register map\n");
+ }
of_property_read_u32(dev->parent->of_node, "qcom,dmic-sample-rate",
&wcd->dmic_sample_rate);
@@ -5893,6 +5902,10 @@ static int wcd934x_codec_probe(struct pl
if (ret)
return ret;
+ ret = devm_add_action_or_reset(dev, wcd934x_put_device_action, &wcd->sidev->dev);
+ if (ret)
+ return ret;
+
/* set default rate 9P6MHz */
regmap_update_bits(wcd->regmap, WCD934X_CODEC_RPM_CLK_MCLK_CFG,
WCD934X_CODEC_RPM_CLK_MCLK_CFG_MCLK_MASK,
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 502/563] ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (500 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 501/563] ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 503/563] ASoC: codecs: wcd937x: set the comp soundwire port correctly Greg Kroah-Hartman
` (74 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ranjani Sridharan,
Péter Ujfalusi, Kai Vehmanen, Mark Brown
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
commit 59abe7bc7e7c70e9066b3e46874d1b7e6a13de14 upstream.
In the case of static pipelines, freeing the widgets in the pipelines
that were not suspended after freeing the scheduler widgets results in
errors because the secondary cores are powered off when the scheduler
widgets are freed. Fix this by tearing down the leftover pipelines before
powering off the secondary cores.
Cc: stable@vger.kernel.org
Fixes: d7332c4a4f1a ("ASoC: SOF: ipc3-topology: Fix pipeline tear down logic")
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20251002073125.32471-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/sof/ipc3-topology.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/sound/soc/sof/ipc3-topology.c
+++ b/sound/soc/sof/ipc3-topology.c
@@ -2473,11 +2473,6 @@ static int sof_ipc3_tear_down_all_pipeli
if (ret < 0)
return ret;
- /* free all the scheduler widgets now */
- ret = sof_ipc3_free_widgets_in_list(sdev, true, &dyn_widgets, verify);
- if (ret < 0)
- return ret;
-
/*
* Tear down all pipelines associated with PCMs that did not get suspended
* and unset the prepare flag so that they can be set up again during resume.
@@ -2493,6 +2488,11 @@ static int sof_ipc3_tear_down_all_pipeli
}
}
+ /* free all the scheduler widgets now. This will also power down the secondary cores */
+ ret = sof_ipc3_free_widgets_in_list(sdev, true, &dyn_widgets, verify);
+ if (ret < 0)
+ return ret;
+
list_for_each_entry(sroute, &sdev->route_list, list)
sroute->setup = false;
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 503/563] ASoC: codecs: wcd937x: set the comp soundwire port correctly
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (501 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 502/563] ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 504/563] ASoC: codecs: wcd937x: make stub functions inline Greg Kroah-Hartman
` (73 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stable, Srinivas Kandagatla,
Alexey Klimov, Mark Brown
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
commit 66a940b1bf48a7095162688332d725ba160154eb upstream.
For some reason we endup with setting soundwire port for
HPHL_COMP and HPHR_COMP as zero, this can potentially result
in a memory corruption due to accessing and setting -1 th element of
port_map array.
Fixes: 82be8c62a38c ("ASoC: codecs: wcd937x: add basic controls")
Cc: Stable@vger.kernel.org
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Reviewed-by: Alexey Klimov <alexey.klimov@linaro.org>
Link: https://patch.msgid.link/20250909121954.225833-2-srinivas.kandagatla@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/wcd937x.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/soc/codecs/wcd937x.c
+++ b/sound/soc/codecs/wcd937x.c
@@ -2046,9 +2046,9 @@ static const struct snd_kcontrol_new wcd
SOC_ENUM_EXT("RX HPH Mode", rx_hph_mode_mux_enum,
wcd937x_rx_hph_mode_get, wcd937x_rx_hph_mode_put),
- SOC_SINGLE_EXT("HPHL_COMP Switch", SND_SOC_NOPM, 0, 1, 0,
+ SOC_SINGLE_EXT("HPHL_COMP Switch", WCD937X_COMP_L, 0, 1, 0,
wcd937x_get_compander, wcd937x_set_compander),
- SOC_SINGLE_EXT("HPHR_COMP Switch", SND_SOC_NOPM, 1, 1, 0,
+ SOC_SINGLE_EXT("HPHR_COMP Switch", WCD937X_COMP_R, 1, 1, 0,
wcd937x_get_compander, wcd937x_set_compander),
SOC_SINGLE_TLV("HPHL Volume", WCD937X_HPH_L_EN, 0, 20, 1, line_gain),
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 504/563] ASoC: codecs: wcd937x: make stub functions inline
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (502 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 503/563] ASoC: codecs: wcd937x: set the comp soundwire port correctly Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 505/563] ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples Greg Kroah-Hartman
` (72 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Stable, Srinivas Kandagatla,
Mark Brown
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
commit c4bb62eb594418a6bd05ff03bb9072ee1fef29c2 upstream.
For some reason we ended up with stub functions that are not inline,
this can result in build error if its included multiple places, as we will
be redefining the same function
Fixes: c99a515ff153 ("ASoC: codecs: wcd937x-sdw: add SoundWire driver")
Cc: Stable@vger.kernel.org
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20250909121954.225833-3-srinivas.kandagatla@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/wcd937x.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/sound/soc/codecs/wcd937x.h
+++ b/sound/soc/codecs/wcd937x.h
@@ -552,21 +552,21 @@ int wcd937x_sdw_hw_params(struct wcd937x
struct device *wcd937x_sdw_device_get(struct device_node *np);
#else
-int wcd937x_sdw_free(struct wcd937x_sdw_priv *wcd,
+static inline int wcd937x_sdw_free(struct wcd937x_sdw_priv *wcd,
struct snd_pcm_substream *substream,
struct snd_soc_dai *dai)
{
return -EOPNOTSUPP;
}
-int wcd937x_sdw_set_sdw_stream(struct wcd937x_sdw_priv *wcd,
+static inline int wcd937x_sdw_set_sdw_stream(struct wcd937x_sdw_priv *wcd,
struct snd_soc_dai *dai,
void *stream, int direction)
{
return -EOPNOTSUPP;
}
-int wcd937x_sdw_hw_params(struct wcd937x_sdw_priv *wcd,
+static inline int wcd937x_sdw_hw_params(struct wcd937x_sdw_priv *wcd,
struct snd_pcm_substream *substream,
struct snd_pcm_hw_params *params,
struct snd_soc_dai *dai)
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 505/563] ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (503 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 504/563] ASoC: codecs: wcd937x: make stub functions inline Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 506/563] ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA Greg Kroah-Hartman
` (71 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kai Vehmanen, Péter Ujfalusi,
Bard Liao, Mark Brown
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
commit bcd1383516bb5a6f72b2d1e7f7ad42c4a14837d1 upstream.
When the sampling rates going in (host) and out (dai) from the DSP
are different, the IPC4 delay reporting does not work correctly.
Add support for this case by scaling the all raw position values to
a common timebase before calculating real-time delay for the PCM.
Cc: stable@vger.kernel.org
Fixes: 0ea06680dfcb ("ASoC: SOF: ipc4-pcm: Correct the delay calculation")
Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20251002074719.2084-2-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/sof/ipc4-pcm.c | 83 +++++++++++++++++++++++++++++++++++------------
1 file changed, 62 insertions(+), 21 deletions(-)
--- a/sound/soc/sof/ipc4-pcm.c
+++ b/sound/soc/sof/ipc4-pcm.c
@@ -19,12 +19,14 @@
* struct sof_ipc4_timestamp_info - IPC4 timestamp info
* @host_copier: the host copier of the pcm stream
* @dai_copier: the dai copier of the pcm stream
- * @stream_start_offset: reported by fw in memory window (converted to frames)
- * @stream_end_offset: reported by fw in memory window (converted to frames)
+ * @stream_start_offset: reported by fw in memory window (converted to
+ * frames at host_copier sampling rate)
+ * @stream_end_offset: reported by fw in memory window (converted to
+ * frames at host_copier sampling rate)
* @llp_offset: llp offset in memory window
- * @boundary: wrap boundary should be used for the LLP frame counter
* @delay: Calculated and stored in pointer callback. The stored value is
- * returned in the delay callback.
+ * returned in the delay callback. Expressed in frames at host copier
+ * sampling rate.
*/
struct sof_ipc4_timestamp_info {
struct sof_ipc4_copier *host_copier;
@@ -33,7 +35,6 @@ struct sof_ipc4_timestamp_info {
u64 stream_end_offset;
u32 llp_offset;
- u64 boundary;
snd_pcm_sframes_t delay;
};
@@ -48,6 +49,16 @@ struct sof_ipc4_pcm_stream_priv {
bool chain_dma_allocated;
};
+/*
+ * Modulus to use to compare host and link position counters. The sampling
+ * rates may be different, so the raw hardware counters will wrap
+ * around at different times. To calculate differences, use
+ * DELAY_BOUNDARY as a common modulus. This value must be smaller than
+ * the wrap-around point of any hardware counter, and larger than any
+ * valid delay measurement.
+ */
+#define DELAY_BOUNDARY U32_MAX
+
static inline struct sof_ipc4_timestamp_info *
sof_ipc4_sps_to_time_info(struct snd_sof_pcm_stream *sps)
{
@@ -993,6 +1004,35 @@ static int sof_ipc4_pcm_hw_params(struct
return 0;
}
+static u64 sof_ipc4_frames_dai_to_host(struct sof_ipc4_timestamp_info *time_info, u64 value)
+{
+ u64 dai_rate, host_rate;
+
+ if (!time_info->dai_copier || !time_info->host_copier)
+ return value;
+
+ /*
+ * copiers do not change sampling rate, so we can use the
+ * out_format independently of stream direction
+ */
+ dai_rate = time_info->dai_copier->data.out_format.sampling_frequency;
+ host_rate = time_info->host_copier->data.out_format.sampling_frequency;
+
+ if (!dai_rate || !host_rate || dai_rate == host_rate)
+ return value;
+
+ /* take care not to overflow u64, rates can be up to 768000 */
+ if (value > U32_MAX) {
+ value = div64_u64(value, dai_rate);
+ value *= host_rate;
+ } else {
+ value *= host_rate;
+ value = div64_u64(value, dai_rate);
+ }
+
+ return value;
+}
+
static int sof_ipc4_get_stream_start_offset(struct snd_sof_dev *sdev,
struct snd_pcm_substream *substream,
struct snd_sof_pcm_stream *sps,
@@ -1043,14 +1083,13 @@ static int sof_ipc4_get_stream_start_off
time_info->stream_end_offset = ppl_reg.stream_end_offset;
do_div(time_info->stream_end_offset, dai_sample_size);
+ /* convert to host frame time */
+ time_info->stream_start_offset =
+ sof_ipc4_frames_dai_to_host(time_info, time_info->stream_start_offset);
+ time_info->stream_end_offset =
+ sof_ipc4_frames_dai_to_host(time_info, time_info->stream_end_offset);
+
out:
- /*
- * Calculate the wrap boundary need to be used for delay calculation
- * The host counter is in bytes, it will wrap earlier than the frames
- * based link counter.
- */
- time_info->boundary = div64_u64(~((u64)0),
- frames_to_bytes(substream->runtime, 1));
/* Initialize the delay value to 0 (no delay) */
time_info->delay = 0;
@@ -1093,6 +1132,8 @@ static int sof_ipc4_pcm_pointer(struct s
/* For delay calculation we need the host counter */
host_cnt = snd_sof_pcm_get_host_byte_counter(sdev, component, substream);
+
+ /* Store the original value to host_ptr */
host_ptr = host_cnt;
/* convert the host_cnt to frames */
@@ -1111,6 +1152,8 @@ static int sof_ipc4_pcm_pointer(struct s
sof_mailbox_read(sdev, time_info->llp_offset, &llp, sizeof(llp));
dai_cnt = ((u64)llp.reading.llp_u << 32) | llp.reading.llp_l;
}
+
+ dai_cnt = sof_ipc4_frames_dai_to_host(time_info, dai_cnt);
dai_cnt += time_info->stream_end_offset;
/* In two cases dai dma counter is not accurate
@@ -1144,8 +1187,9 @@ static int sof_ipc4_pcm_pointer(struct s
dai_cnt -= time_info->stream_start_offset;
}
- /* Wrap the dai counter at the boundary where the host counter wraps */
- div64_u64_rem(dai_cnt, time_info->boundary, &dai_cnt);
+ /* Convert to a common base before comparisons */
+ dai_cnt &= DELAY_BOUNDARY;
+ host_cnt &= DELAY_BOUNDARY;
if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
head_cnt = host_cnt;
@@ -1155,14 +1199,11 @@ static int sof_ipc4_pcm_pointer(struct s
tail_cnt = host_cnt;
}
- if (head_cnt < tail_cnt) {
- time_info->delay = time_info->boundary - tail_cnt + head_cnt;
- goto out;
- }
-
- time_info->delay = head_cnt - tail_cnt;
+ if (unlikely(head_cnt < tail_cnt))
+ time_info->delay = DELAY_BOUNDARY - tail_cnt + head_cnt;
+ else
+ time_info->delay = head_cnt - tail_cnt;
-out:
/*
* Convert the host byte counter to PCM pointer which wraps in buffer
* and it is in frames
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 506/563] ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (504 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 505/563] ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 507/563] fs: udf: fix OOB read in lengthAllocDescs handling Greg Kroah-Hartman
` (70 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kai Vehmanen, Péter Ujfalusi,
Bard Liao, Mark Brown
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
commit bace10b59624e6bd8d68bc9304357f292f1b3dcf upstream.
Assumption that chain DMA module starts the link DMA when 1ms of
data is available from host is not correct. Instead the firmware
chain DMA module fills the link DMA with initial buffer of zeroes
and the host and link DMAs are started at the same time.
This results in a small error in delay calculation. This can become a
more severe problem if host DMA has delays that exceed 1ms. This results
in negative delay to be calculated and bogus values reported to
applications. This can confuse some applications like
alsa_conformance_test.
Fix the issue by correctly calculating the firmware chain DMA
preamble size and initializing the start offset to this value.
Cc: stable@vger.kernel.org
Fixes: a1d203d390e0 ("ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams")
Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20251002074719.2084-3-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/sof/ipc4-pcm.c | 14 ++++++++++----
sound/soc/sof/ipc4-topology.c | 1 -
sound/soc/sof/ipc4-topology.h | 2 ++
3 files changed, 12 insertions(+), 5 deletions(-)
--- a/sound/soc/sof/ipc4-pcm.c
+++ b/sound/soc/sof/ipc4-pcm.c
@@ -1052,7 +1052,7 @@ static int sof_ipc4_get_stream_start_off
return -EINVAL;
} else if (host_copier->data.gtw_cfg.node_id == SOF_IPC4_CHAIN_DMA_NODE_ID) {
/*
- * While the firmware does not supports time_info reporting for
+ * While the firmware does not support time_info reporting for
* streams using ChainDMA, it is granted that ChainDMA can only
* be used on Host+Link pairs where the link position is
* accessible from the host side.
@@ -1060,10 +1060,16 @@ static int sof_ipc4_get_stream_start_off
* Enable delay calculation in case of ChainDMA via host
* accessible registers.
*
- * The ChainDMA uses 2x 1ms ping-pong buffer, dai side starts
- * when 1ms data is available
+ * The ChainDMA prefills the link DMA with a preamble
+ * of zero samples. Set the stream start offset based
+ * on size of the preamble (driver provided fifo size
+ * multiplied by 2.5). We add 1ms of margin as the FW
+ * will align the buffer size to DMA hardware
+ * alignment that is not known to host.
*/
- time_info->stream_start_offset = substream->runtime->rate / MSEC_PER_SEC;
+ int pre_ms = SOF_IPC4_CHAIN_DMA_BUF_SIZE_MS * 5 / 2 + 1;
+
+ time_info->stream_start_offset = pre_ms * substream->runtime->rate / MSEC_PER_SEC;
goto out;
}
--- a/sound/soc/sof/ipc4-topology.c
+++ b/sound/soc/sof/ipc4-topology.c
@@ -33,7 +33,6 @@ MODULE_PARM_DESC(ipc4_ignore_cpc,
#define SOF_IPC4_GAIN_PARAM_ID 0
#define SOF_IPC4_TPLG_ABI_SIZE 6
-#define SOF_IPC4_CHAIN_DMA_BUF_SIZE_MS 2
static DEFINE_IDA(alh_group_ida);
static DEFINE_IDA(pipeline_ida);
--- a/sound/soc/sof/ipc4-topology.h
+++ b/sound/soc/sof/ipc4-topology.h
@@ -247,6 +247,8 @@ struct sof_ipc4_dma_stream_ch_map {
#define SOF_IPC4_DMA_METHOD_HDA 1
#define SOF_IPC4_DMA_METHOD_GPDMA 2 /* defined for consistency but not used */
+#define SOF_IPC4_CHAIN_DMA_BUF_SIZE_MS 2
+
/**
* struct sof_ipc4_dma_config: DMA configuration
* @dma_method: HDAudio or GPDMA
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 507/563] fs: udf: fix OOB read in lengthAllocDescs handling
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (505 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 506/563] ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 508/563] net: nfc: nci: Add parameter validation for packet data Greg Kroah-Hartman
` (69 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+8743fca924afed42f93e,
Larshin Sergey, Jan Kara
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larshin Sergey <Sergey.Larshin@kaspersky.com>
commit 3bd5e45c2ce30e239d596becd5db720f7eb83c99 upstream.
When parsing Allocation Extent Descriptor, lengthAllocDescs comes from
on-disk data and must be validated against the block size. Crafted or
corrupted images may set lengthAllocDescs so that the total descriptor
length (sizeof(allocExtDesc) + lengthAllocDescs) exceeds the buffer,
leading udf_update_tag() to call crc_itu_t() on out-of-bounds memory and
trigger a KASAN use-after-free read.
BUG: KASAN: use-after-free in crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60
Read of size 1 at addr ffff888041e7d000 by task syz-executor317/5309
CPU: 0 UID: 0 PID: 5309 Comm: syz-executor317 Not tainted 6.12.0-rc4-syzkaller-00261-g850925a8133c #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60
udf_update_tag+0x70/0x6a0 fs/udf/misc.c:261
udf_write_aext+0x4d8/0x7b0 fs/udf/inode.c:2179
extent_trunc+0x2f7/0x4a0 fs/udf/truncate.c:46
udf_truncate_tail_extent+0x527/0x7e0 fs/udf/truncate.c:106
udf_release_file+0xc1/0x120 fs/udf/file.c:185
__fput+0x23f/0x880 fs/file_table.c:431
task_work_run+0x24f/0x310 kernel/task_work.c:239
exit_task_work include/linux/task_work.h:43 [inline]
do_exit+0xa2f/0x28e0 kernel/exit.c:939
do_group_exit+0x207/0x2c0 kernel/exit.c:1088
__do_sys_exit_group kernel/exit.c:1099 [inline]
__se_sys_exit_group kernel/exit.c:1097 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1097
x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Validate the computed total length against epos->bh->b_size.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Reported-by: syzbot+8743fca924afed42f93e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8743fca924afed42f93e
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Larshin Sergey <Sergey.Larshin@kaspersky.com>
Link: https://patch.msgid.link/20250922131358.745579-1-Sergey.Larshin@kaspersky.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/inode.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -2272,6 +2272,9 @@ int udf_current_aext(struct inode *inode
if (check_add_overflow(sizeof(struct allocExtDesc),
le32_to_cpu(header->lengthAllocDescs), &alen))
return -1;
+
+ if (alen > epos->bh->b_size)
+ return -1;
}
switch (iinfo->i_alloc_type) {
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 508/563] net: nfc: nci: Add parameter validation for packet data
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (506 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 507/563] fs: udf: fix OOB read in lengthAllocDescs handling Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 509/563] mfd: rz-mtu3: Fix MTU5 NFCR register offset Greg Kroah-Hartman
` (68 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+740e04c2a93467a0f8c8,
Deepak Sharma, Vadim Fedorenko, Paolo Abeni
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepak Sharma <deepak.sharma.472935@gmail.com>
commit 9c328f54741bd5465ca1dc717c84c04242fac2e1 upstream.
Syzbot reported an uninitialized value bug in nci_init_req, which was
introduced by commit 5aca7966d2a7 ("Merge tag
'perf-tools-fixes-for-v6.17-2025-09-16' of
git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools").
This bug arises due to very limited and poor input validation
that was done at nic_valid_size(). This validation only
validates the skb->len (directly reflects size provided at the
userspace interface) with the length provided in the buffer
itself (interpreted as NCI_HEADER). This leads to the processing
of memory content at the address assuming the correct layout
per what opcode requires there. This leads to the accesses to
buffer of `skb_buff->data` which is not assigned anything yet.
Following the same silent drop of packets of invalid sizes at
`nic_valid_size()`, add validation of the data in the respective
handlers and return error values in case of failure. Release
the skb if error values are returned from handlers in
`nci_nft_packet` and effectively do a silent drop
Possible TODO: because we silently drop the packets, the
call to `nci_request` will be waiting for completion of request
and will face timeouts. These timeouts can get excessively logged
in the dmesg. A proper handling of them may require to export
`nci_request_cancel` (or propagate error handling from the
nft packets handlers).
Reported-by: syzbot+740e04c2a93467a0f8c8@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=740e04c2a93467a0f8c8
Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation")
Tested-by: syzbot+740e04c2a93467a0f8c8@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Deepak Sharma <deepak.sharma.472935@gmail.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Link: https://patch.msgid.link/20250925132846.213425-1-deepak.sharma.472935@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/nfc/nci/ntf.c | 135 +++++++++++++++++++++++++++++++++++++++---------------
1 file changed, 99 insertions(+), 36 deletions(-)
--- a/net/nfc/nci/ntf.c
+++ b/net/nfc/nci/ntf.c
@@ -27,11 +27,16 @@
/* Handle NCI Notification packets */
-static void nci_core_reset_ntf_packet(struct nci_dev *ndev,
- const struct sk_buff *skb)
+static int nci_core_reset_ntf_packet(struct nci_dev *ndev,
+ const struct sk_buff *skb)
{
/* Handle NCI 2.x core reset notification */
- const struct nci_core_reset_ntf *ntf = (void *)skb->data;
+ const struct nci_core_reset_ntf *ntf;
+
+ if (skb->len < sizeof(struct nci_core_reset_ntf))
+ return -EINVAL;
+
+ ntf = (struct nci_core_reset_ntf *)skb->data;
ndev->nci_ver = ntf->nci_ver;
pr_debug("nci_ver 0x%x, config_status 0x%x\n",
@@ -42,15 +47,22 @@ static void nci_core_reset_ntf_packet(st
__le32_to_cpu(ntf->manufact_specific_info);
nci_req_complete(ndev, NCI_STATUS_OK);
+
+ return 0;
}
-static void nci_core_conn_credits_ntf_packet(struct nci_dev *ndev,
- struct sk_buff *skb)
+static int nci_core_conn_credits_ntf_packet(struct nci_dev *ndev,
+ struct sk_buff *skb)
{
- struct nci_core_conn_credit_ntf *ntf = (void *) skb->data;
+ struct nci_core_conn_credit_ntf *ntf;
struct nci_conn_info *conn_info;
int i;
+ if (skb->len < sizeof(struct nci_core_conn_credit_ntf))
+ return -EINVAL;
+
+ ntf = (struct nci_core_conn_credit_ntf *)skb->data;
+
pr_debug("num_entries %d\n", ntf->num_entries);
if (ntf->num_entries > NCI_MAX_NUM_CONN)
@@ -68,7 +80,7 @@ static void nci_core_conn_credits_ntf_pa
conn_info = nci_get_conn_info_by_conn_id(ndev,
ntf->conn_entries[i].conn_id);
if (!conn_info)
- return;
+ return 0;
atomic_add(ntf->conn_entries[i].credits,
&conn_info->credits_cnt);
@@ -77,12 +89,19 @@ static void nci_core_conn_credits_ntf_pa
/* trigger the next tx */
if (!skb_queue_empty(&ndev->tx_q))
queue_work(ndev->tx_wq, &ndev->tx_work);
+
+ return 0;
}
-static void nci_core_generic_error_ntf_packet(struct nci_dev *ndev,
- const struct sk_buff *skb)
+static int nci_core_generic_error_ntf_packet(struct nci_dev *ndev,
+ const struct sk_buff *skb)
{
- __u8 status = skb->data[0];
+ __u8 status;
+
+ if (skb->len < 1)
+ return -EINVAL;
+
+ status = skb->data[0];
pr_debug("status 0x%x\n", status);
@@ -91,12 +110,19 @@ static void nci_core_generic_error_ntf_p
(the state remains the same) */
nci_req_complete(ndev, status);
}
+
+ return 0;
}
-static void nci_core_conn_intf_error_ntf_packet(struct nci_dev *ndev,
- struct sk_buff *skb)
+static int nci_core_conn_intf_error_ntf_packet(struct nci_dev *ndev,
+ struct sk_buff *skb)
{
- struct nci_core_intf_error_ntf *ntf = (void *) skb->data;
+ struct nci_core_intf_error_ntf *ntf;
+
+ if (skb->len < sizeof(struct nci_core_intf_error_ntf))
+ return -EINVAL;
+
+ ntf = (struct nci_core_intf_error_ntf *)skb->data;
ntf->conn_id = nci_conn_id(&ntf->conn_id);
@@ -105,6 +131,8 @@ static void nci_core_conn_intf_error_ntf
/* complete the data exchange transaction, if exists */
if (test_bit(NCI_DATA_EXCHANGE, &ndev->flags))
nci_data_exchange_complete(ndev, NULL, ntf->conn_id, -EIO);
+
+ return 0;
}
static const __u8 *
@@ -329,13 +357,18 @@ void nci_clear_target_list(struct nci_de
ndev->n_targets = 0;
}
-static void nci_rf_discover_ntf_packet(struct nci_dev *ndev,
- const struct sk_buff *skb)
+static int nci_rf_discover_ntf_packet(struct nci_dev *ndev,
+ const struct sk_buff *skb)
{
struct nci_rf_discover_ntf ntf;
- const __u8 *data = skb->data;
+ const __u8 *data;
bool add_target = true;
+ if (skb->len < sizeof(struct nci_rf_discover_ntf))
+ return -EINVAL;
+
+ data = skb->data;
+
ntf.rf_discovery_id = *data++;
ntf.rf_protocol = *data++;
ntf.rf_tech_and_mode = *data++;
@@ -390,6 +423,8 @@ static void nci_rf_discover_ntf_packet(s
nfc_targets_found(ndev->nfc_dev, ndev->targets,
ndev->n_targets);
}
+
+ return 0;
}
static int nci_extract_activation_params_iso_dep(struct nci_dev *ndev,
@@ -553,14 +588,19 @@ static int nci_store_ats_nfc_iso_dep(str
return NCI_STATUS_OK;
}
-static void nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
- const struct sk_buff *skb)
+static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
+ const struct sk_buff *skb)
{
struct nci_conn_info *conn_info;
struct nci_rf_intf_activated_ntf ntf;
- const __u8 *data = skb->data;
+ const __u8 *data;
int err = NCI_STATUS_OK;
+ if (skb->len < sizeof(struct nci_rf_intf_activated_ntf))
+ return -EINVAL;
+
+ data = skb->data;
+
ntf.rf_discovery_id = *data++;
ntf.rf_interface = *data++;
ntf.rf_protocol = *data++;
@@ -667,7 +707,7 @@ exit:
if (err == NCI_STATUS_OK) {
conn_info = ndev->rf_conn_info;
if (!conn_info)
- return;
+ return 0;
conn_info->max_pkt_payload_len = ntf.max_data_pkt_payload_size;
conn_info->initial_num_credits = ntf.initial_num_credits;
@@ -721,19 +761,26 @@ listen:
pr_err("error when signaling tm activation\n");
}
}
+
+ return 0;
}
-static void nci_rf_deactivate_ntf_packet(struct nci_dev *ndev,
- const struct sk_buff *skb)
+static int nci_rf_deactivate_ntf_packet(struct nci_dev *ndev,
+ const struct sk_buff *skb)
{
const struct nci_conn_info *conn_info;
- const struct nci_rf_deactivate_ntf *ntf = (void *)skb->data;
+ const struct nci_rf_deactivate_ntf *ntf;
+
+ if (skb->len < sizeof(struct nci_rf_deactivate_ntf))
+ return -EINVAL;
+
+ ntf = (struct nci_rf_deactivate_ntf *)skb->data;
pr_debug("entry, type 0x%x, reason 0x%x\n", ntf->type, ntf->reason);
conn_info = ndev->rf_conn_info;
if (!conn_info)
- return;
+ return 0;
/* drop tx data queue */
skb_queue_purge(&ndev->tx_q);
@@ -765,14 +812,20 @@ static void nci_rf_deactivate_ntf_packet
}
nci_req_complete(ndev, NCI_STATUS_OK);
+
+ return 0;
}
-static void nci_nfcee_discover_ntf_packet(struct nci_dev *ndev,
- const struct sk_buff *skb)
+static int nci_nfcee_discover_ntf_packet(struct nci_dev *ndev,
+ const struct sk_buff *skb)
{
u8 status = NCI_STATUS_OK;
- const struct nci_nfcee_discover_ntf *nfcee_ntf =
- (struct nci_nfcee_discover_ntf *)skb->data;
+ const struct nci_nfcee_discover_ntf *nfcee_ntf;
+
+ if (skb->len < sizeof(struct nci_nfcee_discover_ntf))
+ return -EINVAL;
+
+ nfcee_ntf = (struct nci_nfcee_discover_ntf *)skb->data;
/* NFCForum NCI 9.2.1 HCI Network Specific Handling
* If the NFCC supports the HCI Network, it SHALL return one,
@@ -783,6 +836,8 @@ static void nci_nfcee_discover_ntf_packe
ndev->cur_params.id = nfcee_ntf->nfcee_id;
nci_req_complete(ndev, status);
+
+ return 0;
}
void nci_ntf_packet(struct nci_dev *ndev, struct sk_buff *skb)
@@ -809,35 +864,43 @@ void nci_ntf_packet(struct nci_dev *ndev
switch (ntf_opcode) {
case NCI_OP_CORE_RESET_NTF:
- nci_core_reset_ntf_packet(ndev, skb);
+ if (nci_core_reset_ntf_packet(ndev, skb))
+ goto end;
break;
case NCI_OP_CORE_CONN_CREDITS_NTF:
- nci_core_conn_credits_ntf_packet(ndev, skb);
+ if (nci_core_conn_credits_ntf_packet(ndev, skb))
+ goto end;
break;
case NCI_OP_CORE_GENERIC_ERROR_NTF:
- nci_core_generic_error_ntf_packet(ndev, skb);
+ if (nci_core_generic_error_ntf_packet(ndev, skb))
+ goto end;
break;
case NCI_OP_CORE_INTF_ERROR_NTF:
- nci_core_conn_intf_error_ntf_packet(ndev, skb);
+ if (nci_core_conn_intf_error_ntf_packet(ndev, skb))
+ goto end;
break;
case NCI_OP_RF_DISCOVER_NTF:
- nci_rf_discover_ntf_packet(ndev, skb);
+ if (nci_rf_discover_ntf_packet(ndev, skb))
+ goto end;
break;
case NCI_OP_RF_INTF_ACTIVATED_NTF:
- nci_rf_intf_activated_ntf_packet(ndev, skb);
+ if (nci_rf_intf_activated_ntf_packet(ndev, skb))
+ goto end;
break;
case NCI_OP_RF_DEACTIVATE_NTF:
- nci_rf_deactivate_ntf_packet(ndev, skb);
+ if (nci_rf_deactivate_ntf_packet(ndev, skb))
+ goto end;
break;
case NCI_OP_NFCEE_DISCOVER_NTF:
- nci_nfcee_discover_ntf_packet(ndev, skb);
+ if (nci_nfcee_discover_ntf_packet(ndev, skb))
+ goto end;
break;
case NCI_OP_RF_NFCEE_ACTION_NTF:
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 509/563] mfd: rz-mtu3: Fix MTU5 NFCR register offset
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (507 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 508/563] net: nfc: nci: Add parameter validation for packet data Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 510/563] mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag Greg Kroah-Hartman
` (67 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cosmin Tanislav, Biju Das, Lee Jones
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
commit da32b0e82c523b76265ba1ad25d7ea74f0ece402 upstream.
The NFCR register for MTU5 is at 0x1a95 offset according to Datasheet
Page 725, Table 16.4. The address of all registers is offset by 0x1200,
making the proper address of MTU5 NFCR register be 0x895.
Cc: stable@vger.kernel.org
Fixes: 654c293e1687 ("mfd: Add Renesas RZ/G2L MTU3a core driver")
Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://lore.kernel.org/r/20250910175914.12956-1-cosmin-gabriel.tanislav.xa@renesas.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/rz-mtu3.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mfd/rz-mtu3.c
+++ b/drivers/mfd/rz-mtu3.c
@@ -32,7 +32,7 @@ static const unsigned long rz_mtu3_8bit_
[RZ_MTU3_CHAN_2] = MTU_8BIT_CH_1_2(0x204, 0x092, 0x205, 0x200, 0x20c, 0x201, 0x202),
[RZ_MTU3_CHAN_3] = MTU_8BIT_CH_3_4_6_7(0x008, 0x093, 0x02c, 0x000, 0x04c, 0x002, 0x004, 0x005, 0x038),
[RZ_MTU3_CHAN_4] = MTU_8BIT_CH_3_4_6_7(0x009, 0x094, 0x02d, 0x001, 0x04d, 0x003, 0x006, 0x007, 0x039),
- [RZ_MTU3_CHAN_5] = MTU_8BIT_CH_5(0xab2, 0x1eb, 0xab4, 0xab6, 0xa84, 0xa85, 0xa86, 0xa94, 0xa95, 0xa96, 0xaa4, 0xaa5, 0xaa6),
+ [RZ_MTU3_CHAN_5] = MTU_8BIT_CH_5(0xab2, 0x895, 0xab4, 0xab6, 0xa84, 0xa85, 0xa86, 0xa94, 0xa95, 0xa96, 0xaa4, 0xaa5, 0xaa6),
[RZ_MTU3_CHAN_6] = MTU_8BIT_CH_3_4_6_7(0x808, 0x893, 0x82c, 0x800, 0x84c, 0x802, 0x804, 0x805, 0x838),
[RZ_MTU3_CHAN_7] = MTU_8BIT_CH_3_4_6_7(0x809, 0x894, 0x82d, 0x801, 0x84d, 0x803, 0x806, 0x807, 0x839),
[RZ_MTU3_CHAN_8] = MTU_8BIT_CH_8(0x404, 0x098, 0x400, 0x406, 0x401, 0x402, 0x403)
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 510/563] mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (508 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 509/563] mfd: rz-mtu3: Fix MTU5 NFCR register offset Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 511/563] mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() Greg Kroah-Hartman
` (66 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Hans de Goede,
Lee Jones
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hansg@kernel.org>
commit 64e0d839c589f4f2ecd2e3e5bdb5cee6ba6bade9 upstream.
Testing has shown that reading multiple registers at once (for 10-bit
ADC values) does not work. Set the use_single_read regmap_config flag
to make regmap split these for us.
This should fix temperature opregion accesses done by
drivers/acpi/pmic/intel_pmic_chtdc_ti.c and is also necessary for
the upcoming drivers for the ADC and battery MFD cells.
Fixes: 6bac0606fdba ("mfd: Add support for Cherry Trail Dollar Cove TI PMIC")
Cc: stable@vger.kernel.org
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Link: https://lore.kernel.org/r/20250804133240.312383-1-hansg@kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/intel_soc_pmic_chtdc_ti.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/mfd/intel_soc_pmic_chtdc_ti.c
+++ b/drivers/mfd/intel_soc_pmic_chtdc_ti.c
@@ -82,6 +82,8 @@ static const struct regmap_config chtdc_
.reg_bits = 8,
.val_bits = 8,
.max_register = 0xff,
+ /* The hardware does not support reading multiple registers at once */
+ .use_single_read = true,
};
static const struct regmap_irq chtdc_ti_irqs[] = {
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 511/563] mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (509 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 510/563] mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 512/563] tracing: Fix lock imbalance in s_start() memory allocation failure path Greg Kroah-Hartman
` (65 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bartosz Golaszewski, Linus Walleij,
Lee Jones
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
commit 1efbee6852f1ff698a9981bd731308dd027189fb upstream.
Commit 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells")
removed the return value check from the call to gpiochip_add_data() (or
rather gpiochip_add() back then and later converted to devres) with no
explanation. This function however can still fail, so check the return
value and bail-out if it does.
Cc: stable@vger.kernel.org
Fixes: 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20250811-gpio-mmio-mfd-conv-v1-1-68c5c958cf80@linaro.org
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/vexpress-sysreg.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/mfd/vexpress-sysreg.c
+++ b/drivers/mfd/vexpress-sysreg.c
@@ -99,6 +99,7 @@ static int vexpress_sysreg_probe(struct
struct resource *mem;
void __iomem *base;
struct gpio_chip *mmc_gpio_chip;
+ int ret;
mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
if (!mem)
@@ -119,7 +120,10 @@ static int vexpress_sysreg_probe(struct
bgpio_init(mmc_gpio_chip, &pdev->dev, 0x4, base + SYS_MCI,
NULL, NULL, NULL, NULL, 0);
mmc_gpio_chip->ngpio = 2;
- devm_gpiochip_add_data(&pdev->dev, mmc_gpio_chip, NULL);
+
+ ret = devm_gpiochip_add_data(&pdev->dev, mmc_gpio_chip, NULL);
+ if (ret)
+ return ret;
return devm_mfd_add_devices(&pdev->dev, PLATFORM_DEVID_AUTO,
vexpress_sysreg_cells,
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 512/563] tracing: Fix lock imbalance in s_start() memory allocation failure path
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (510 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 511/563] mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 513/563] tracing: Fix race condition in kprobe initialization causing NULL pointer dereference Greg Kroah-Hartman
` (64 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin, Steven Rostedt (Google)
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sasha Levin <sashal@kernel.org>
commit 61e19cd2e5c5235326a13a68df1a2f8ec4eeed7b upstream.
When s_start() fails to allocate memory for set_event_iter, it returns NULL
before acquiring event_mutex. However, the corresponding s_stop() function
always tries to unlock the mutex, causing a lock imbalance warning:
WARNING: bad unlock balance detected!
6.17.0-rc7-00175-g2b2e0c04f78c #7 Not tainted
-------------------------------------
syz.0.85611/376514 is trying to release lock (event_mutex) at:
[<ffffffff8dafc7a4>] traverse.part.0.constprop.0+0x2c4/0x650 fs/seq_file.c:131
but there are no more locks to release!
The issue was introduced by commit b355247df104 ("tracing: Cache ':mod:'
events for modules not loaded yet") which added the kzalloc() allocation before
the mutex lock, creating a path where s_start() could return without locking
the mutex while s_stop() would still try to unlock it.
Fix this by unconditionally acquiring the mutex immediately after allocation,
regardless of whether the allocation succeeded.
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/20250929113238.3722055-1-sashal@kernel.org
Fixes: b355247df104 ("tracing: Cache ":mod:" events for modules not loaded yet")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_events.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 9f3e9537417d..e00da4182deb 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -1629,11 +1629,10 @@ static void *s_start(struct seq_file *m, loff_t *pos)
loff_t l;
iter = kzalloc(sizeof(*iter), GFP_KERNEL);
+ mutex_lock(&event_mutex);
if (!iter)
return NULL;
- mutex_lock(&event_mutex);
-
iter->type = SET_EVENT_FILE;
iter->file = list_entry(&tr->events, struct trace_event_file, list);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 513/563] tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (511 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 512/563] tracing: Fix lock imbalance in s_start() memory allocation failure path Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 514/563] tracing: Fix wakeup tracers on failure of acquiring calltime Greg Kroah-Hartman
` (63 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuan Chen, Masami Hiramatsu (Google)
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Chen <chenyuan@kylinos.cn>
commit 9cf9aa7b0acfde7545c1a1d912576e9bab28dc6f upstream.
There is a critical race condition in kprobe initialization that can lead to
NULL pointer dereference and kernel crash.
[1135630.084782] Unable to handle kernel paging request at virtual address 0000710a04630000
...
[1135630.260314] pstate: 404003c9 (nZcv DAIF +PAN -UAO)
[1135630.269239] pc : kprobe_perf_func+0x30/0x260
[1135630.277643] lr : kprobe_dispatcher+0x44/0x60
[1135630.286041] sp : ffffaeff4977fa40
[1135630.293441] x29: ffffaeff4977fa40 x28: ffffaf015340e400
[1135630.302837] x27: 0000000000000000 x26: 0000000000000000
[1135630.312257] x25: ffffaf029ed108a8 x24: ffffaf015340e528
[1135630.321705] x23: ffffaeff4977fc50 x22: ffffaeff4977fc50
[1135630.331154] x21: 0000000000000000 x20: ffffaeff4977fc50
[1135630.340586] x19: ffffaf015340e400 x18: 0000000000000000
[1135630.349985] x17: 0000000000000000 x16: 0000000000000000
[1135630.359285] x15: 0000000000000000 x14: 0000000000000000
[1135630.368445] x13: 0000000000000000 x12: 0000000000000000
[1135630.377473] x11: 0000000000000000 x10: 0000000000000000
[1135630.386411] x9 : 0000000000000000 x8 : 0000000000000000
[1135630.395252] x7 : 0000000000000000 x6 : 0000000000000000
[1135630.403963] x5 : 0000000000000000 x4 : 0000000000000000
[1135630.412545] x3 : 0000710a04630000 x2 : 0000000000000006
[1135630.421021] x1 : ffffaeff4977fc50 x0 : 0000710a04630000
[1135630.429410] Call trace:
[1135630.434828] kprobe_perf_func+0x30/0x260
[1135630.441661] kprobe_dispatcher+0x44/0x60
[1135630.448396] aggr_pre_handler+0x70/0xc8
[1135630.454959] kprobe_breakpoint_handler+0x140/0x1e0
[1135630.462435] brk_handler+0xbc/0xd8
[1135630.468437] do_debug_exception+0x84/0x138
[1135630.475074] el1_dbg+0x18/0x8c
[1135630.480582] security_file_permission+0x0/0xd0
[1135630.487426] vfs_write+0x70/0x1c0
[1135630.493059] ksys_write+0x5c/0xc8
[1135630.498638] __arm64_sys_write+0x24/0x30
[1135630.504821] el0_svc_common+0x78/0x130
[1135630.510838] el0_svc_handler+0x38/0x78
[1135630.516834] el0_svc+0x8/0x1b0
kernel/trace/trace_kprobe.c: 1308
0xffff3df8995039ec <kprobe_perf_func+0x2c>: ldr x21, [x24,#120]
include/linux/compiler.h: 294
0xffff3df8995039f0 <kprobe_perf_func+0x30>: ldr x1, [x21,x0]
kernel/trace/trace_kprobe.c
1308: head = this_cpu_ptr(call->perf_events);
1309: if (hlist_empty(head))
1310: return 0;
crash> struct trace_event_call -o
struct trace_event_call {
...
[120] struct hlist_head *perf_events; //(call->perf_event)
...
}
crash> struct trace_event_call ffffaf015340e528
struct trace_event_call {
...
perf_events = 0xffff0ad5fa89f088, //this value is correct, but x21 = 0
...
}
Race Condition Analysis:
The race occurs between kprobe activation and perf_events initialization:
CPU0 CPU1
==== ====
perf_kprobe_init
perf_trace_event_init
tp_event->perf_events = list;(1)
tp_event->class->reg (2)← KPROBE ACTIVE
Debug exception triggers
...
kprobe_dispatcher
kprobe_perf_func (tk->tp.flags & TP_FLAG_PROFILE)
head = this_cpu_ptr(call->perf_events)(3)
(perf_events is still NULL)
Problem:
1. CPU0 executes (1) assigning tp_event->perf_events = list
2. CPU0 executes (2) enabling kprobe functionality via class->reg()
3. CPU1 triggers and reaches kprobe_dispatcher
4. CPU1 checks TP_FLAG_PROFILE - condition passes (step 2 completed)
5. CPU1 calls kprobe_perf_func() and crashes at (3) because
call->perf_events is still NULL
CPU1 sees that kprobe functionality is enabled but does not see that
perf_events has been assigned.
Add pairing read and write memory barriers to guarantee that if CPU1
sees that kprobe functionality is enabled, it must also see that
perf_events has been assigned.
Link: https://lore.kernel.org/all/20251001022025.44626-1-chenyuan_fl@163.com/
Fixes: 50d780560785 ("tracing/kprobes: Add probe handler dispatcher to support perf and ftrace concurrent use")
Cc: stable@vger.kernel.org
Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_fprobe.c | 10 ++++++----
kernel/trace/trace_kprobe.c | 11 +++++++----
kernel/trace/trace_probe.h | 9 +++++++--
kernel/trace/trace_uprobe.c | 12 ++++++++----
4 files changed, 28 insertions(+), 14 deletions(-)
--- a/kernel/trace/trace_fprobe.c
+++ b/kernel/trace/trace_fprobe.c
@@ -522,13 +522,14 @@ static int fentry_dispatcher(struct fpro
void *entry_data)
{
struct trace_fprobe *tf = container_of(fp, struct trace_fprobe, fp);
+ unsigned int flags = trace_probe_load_flag(&tf->tp);
int ret = 0;
- if (trace_probe_test_flag(&tf->tp, TP_FLAG_TRACE))
+ if (flags & TP_FLAG_TRACE)
fentry_trace_func(tf, entry_ip, fregs);
#ifdef CONFIG_PERF_EVENTS
- if (trace_probe_test_flag(&tf->tp, TP_FLAG_PROFILE))
+ if (flags & TP_FLAG_PROFILE)
ret = fentry_perf_func(tf, entry_ip, fregs);
#endif
return ret;
@@ -540,11 +541,12 @@ static void fexit_dispatcher(struct fpro
void *entry_data)
{
struct trace_fprobe *tf = container_of(fp, struct trace_fprobe, fp);
+ unsigned int flags = trace_probe_load_flag(&tf->tp);
- if (trace_probe_test_flag(&tf->tp, TP_FLAG_TRACE))
+ if (flags & TP_FLAG_TRACE)
fexit_trace_func(tf, entry_ip, ret_ip, fregs, entry_data);
#ifdef CONFIG_PERF_EVENTS
- if (trace_probe_test_flag(&tf->tp, TP_FLAG_PROFILE))
+ if (flags & TP_FLAG_PROFILE)
fexit_perf_func(tf, entry_ip, ret_ip, fregs, entry_data);
#endif
}
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -1815,14 +1815,15 @@ static int kprobe_register(struct trace_
static int kprobe_dispatcher(struct kprobe *kp, struct pt_regs *regs)
{
struct trace_kprobe *tk = container_of(kp, struct trace_kprobe, rp.kp);
+ unsigned int flags = trace_probe_load_flag(&tk->tp);
int ret = 0;
raw_cpu_inc(*tk->nhit);
- if (trace_probe_test_flag(&tk->tp, TP_FLAG_TRACE))
+ if (flags & TP_FLAG_TRACE)
kprobe_trace_func(tk, regs);
#ifdef CONFIG_PERF_EVENTS
- if (trace_probe_test_flag(&tk->tp, TP_FLAG_PROFILE))
+ if (flags & TP_FLAG_PROFILE)
ret = kprobe_perf_func(tk, regs);
#endif
return ret;
@@ -1834,6 +1835,7 @@ kretprobe_dispatcher(struct kretprobe_in
{
struct kretprobe *rp = get_kretprobe(ri);
struct trace_kprobe *tk;
+ unsigned int flags;
/*
* There is a small chance that get_kretprobe(ri) returns NULL when
@@ -1846,10 +1848,11 @@ kretprobe_dispatcher(struct kretprobe_in
tk = container_of(rp, struct trace_kprobe, rp);
raw_cpu_inc(*tk->nhit);
- if (trace_probe_test_flag(&tk->tp, TP_FLAG_TRACE))
+ flags = trace_probe_load_flag(&tk->tp);
+ if (flags & TP_FLAG_TRACE)
kretprobe_trace_func(tk, ri, regs);
#ifdef CONFIG_PERF_EVENTS
- if (trace_probe_test_flag(&tk->tp, TP_FLAG_PROFILE))
+ if (flags & TP_FLAG_PROFILE)
kretprobe_perf_func(tk, ri, regs);
#endif
return 0; /* We don't tweak kernel, so just return 0 */
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -271,16 +271,21 @@ struct event_file_link {
struct list_head list;
};
+static inline unsigned int trace_probe_load_flag(struct trace_probe *tp)
+{
+ return smp_load_acquire(&tp->event->flags);
+}
+
static inline bool trace_probe_test_flag(struct trace_probe *tp,
unsigned int flag)
{
- return !!(tp->event->flags & flag);
+ return !!(trace_probe_load_flag(tp) & flag);
}
static inline void trace_probe_set_flag(struct trace_probe *tp,
unsigned int flag)
{
- tp->event->flags |= flag;
+ smp_store_release(&tp->event->flags, tp->event->flags | flag);
}
static inline void trace_probe_clear_flag(struct trace_probe *tp,
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -1547,6 +1547,7 @@ static int uprobe_dispatcher(struct upro
struct trace_uprobe *tu;
struct uprobe_dispatch_data udd;
struct uprobe_cpu_buffer *ucb = NULL;
+ unsigned int flags;
int ret = 0;
tu = container_of(con, struct trace_uprobe, consumer);
@@ -1561,11 +1562,12 @@ static int uprobe_dispatcher(struct upro
if (WARN_ON_ONCE(!uprobe_cpu_buffer))
return 0;
- if (trace_probe_test_flag(&tu->tp, TP_FLAG_TRACE))
+ flags = trace_probe_load_flag(&tu->tp);
+ if (flags & TP_FLAG_TRACE)
ret |= uprobe_trace_func(tu, regs, &ucb);
#ifdef CONFIG_PERF_EVENTS
- if (trace_probe_test_flag(&tu->tp, TP_FLAG_PROFILE))
+ if (flags & TP_FLAG_PROFILE)
ret |= uprobe_perf_func(tu, regs, &ucb);
#endif
uprobe_buffer_put(ucb);
@@ -1579,6 +1581,7 @@ static int uretprobe_dispatcher(struct u
struct trace_uprobe *tu;
struct uprobe_dispatch_data udd;
struct uprobe_cpu_buffer *ucb = NULL;
+ unsigned int flags;
tu = container_of(con, struct trace_uprobe, consumer);
@@ -1590,11 +1593,12 @@ static int uretprobe_dispatcher(struct u
if (WARN_ON_ONCE(!uprobe_cpu_buffer))
return 0;
- if (trace_probe_test_flag(&tu->tp, TP_FLAG_TRACE))
+ flags = trace_probe_load_flag(&tu->tp);
+ if (flags & TP_FLAG_TRACE)
uretprobe_trace_func(tu, func, regs, &ucb);
#ifdef CONFIG_PERF_EVENTS
- if (trace_probe_test_flag(&tu->tp, TP_FLAG_PROFILE))
+ if (flags & TP_FLAG_PROFILE)
uretprobe_perf_func(tu, func, regs, &ucb);
#endif
uprobe_buffer_put(ucb);
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 514/563] tracing: Fix wakeup tracers on failure of acquiring calltime
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (512 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 513/563] tracing: Fix race condition in kprobe initialization causing NULL pointer dereference Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 515/563] tracing: Fix irqoff " Greg Kroah-Hartman
` (62 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu, Mathieu Desnoyers,
Sasha Levin, Steven Rostedt (Google)
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <rostedt@goodmis.org>
commit 4f7bf54b07e5acf79edd58dafede4096854776cd upstream.
The functions wakeup_graph_entry() and wakeup_graph_return() both call
func_prolog_preempt_disable() that will test if the data->disable is
already set and if not, increment it and disable preemption. If it was
set, it returns false and the caller exits.
The caller of this function must decrement the disable counter, but misses
doing so if the calltime fails to be acquired.
Instead of exiting out when calltime is NULL, change the logic to do the
work if it is not NULL and still do the clean up at the end of the
function if it is NULL.
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Link: https://lore.kernel.org/20251008114835.027b878a@gandalf.local.home
Fixes: a485ea9e3ef3 ("tracing: Fix irqsoff and wakeup latency tracers when using function graph")
Reported-by: Sasha Levin <sashal@kernel.org>
Closes: https://lore.kernel.org/linux-trace-kernel/20251006175848.1906912-1-sashal@kernel.org/
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_sched_wakeup.c | 16 ++++++----------
1 file changed, 6 insertions(+), 10 deletions(-)
--- a/kernel/trace/trace_sched_wakeup.c
+++ b/kernel/trace/trace_sched_wakeup.c
@@ -138,12 +138,10 @@ static int wakeup_graph_entry(struct ftr
return 0;
calltime = fgraph_reserve_data(gops->idx, sizeof(*calltime));
- if (!calltime)
- return 0;
-
- *calltime = trace_clock_local();
-
- ret = __trace_graph_entry(tr, trace, trace_ctx);
+ if (calltime) {
+ *calltime = trace_clock_local();
+ ret = __trace_graph_entry(tr, trace, trace_ctx);
+ }
local_dec(&data->disabled);
preempt_enable_notrace();
@@ -169,12 +167,10 @@ static void wakeup_graph_return(struct f
rettime = trace_clock_local();
calltime = fgraph_retrieve_data(gops->idx, &size);
- if (!calltime)
- return;
+ if (calltime)
+ __trace_graph_return(tr, trace, trace_ctx, *calltime, rettime);
- __trace_graph_return(tr, trace, trace_ctx, *calltime, rettime);
local_dec(&data->disabled);
-
preempt_enable_notrace();
return;
}
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 515/563] tracing: Fix irqoff tracers on failure of acquiring calltime
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (513 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 514/563] tracing: Fix wakeup tracers on failure of acquiring calltime Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 516/563] tracing: Have trace_marker use per-cpu data to read user space Greg Kroah-Hartman
` (61 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu, Mathieu Desnoyers,
Sasha Levin, Steven Rostedt (Google)
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <rostedt@goodmis.org>
commit c834a97962c708ff5bb8582ca76b0e1225feb675 upstream.
The functions irqsoff_graph_entry() and irqsoff_graph_return() both call
func_prolog_dec() that will test if the data->disable is already set and
if not, increment it and return. If it was set, it returns false and the
caller exits.
The caller of this function must decrement the disable counter, but misses
doing so if the calltime fails to be acquired.
Instead of exiting out when calltime is NULL, change the logic to do the
work if it is not NULL and still do the clean up at the end of the
function if it is NULL.
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Link: https://lore.kernel.org/20251008114943.6f60f30f@gandalf.local.home
Fixes: a485ea9e3ef3 ("tracing: Fix irqsoff and wakeup latency tracers when using function graph")
Reported-by: Sasha Levin <sashal@kernel.org>
Closes: https://lore.kernel.org/linux-trace-kernel/20251006175848.1906912-2-sashal@kernel.org/
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_irqsoff.c | 23 ++++++++++-------------
1 file changed, 10 insertions(+), 13 deletions(-)
diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c
index 5496758b6c76..4c45c49b06c8 100644
--- a/kernel/trace/trace_irqsoff.c
+++ b/kernel/trace/trace_irqsoff.c
@@ -184,7 +184,7 @@ static int irqsoff_graph_entry(struct ftrace_graph_ent *trace,
unsigned long flags;
unsigned int trace_ctx;
u64 *calltime;
- int ret;
+ int ret = 0;
if (ftrace_graph_ignore_func(gops, trace))
return 0;
@@ -202,13 +202,11 @@ static int irqsoff_graph_entry(struct ftrace_graph_ent *trace,
return 0;
calltime = fgraph_reserve_data(gops->idx, sizeof(*calltime));
- if (!calltime)
- return 0;
-
- *calltime = trace_clock_local();
-
- trace_ctx = tracing_gen_ctx_flags(flags);
- ret = __trace_graph_entry(tr, trace, trace_ctx);
+ if (calltime) {
+ *calltime = trace_clock_local();
+ trace_ctx = tracing_gen_ctx_flags(flags);
+ ret = __trace_graph_entry(tr, trace, trace_ctx);
+ }
local_dec(&data->disabled);
return ret;
@@ -233,11 +231,10 @@ static void irqsoff_graph_return(struct ftrace_graph_ret *trace,
rettime = trace_clock_local();
calltime = fgraph_retrieve_data(gops->idx, &size);
- if (!calltime)
- return;
-
- trace_ctx = tracing_gen_ctx_flags(flags);
- __trace_graph_return(tr, trace, trace_ctx, *calltime, rettime);
+ if (calltime) {
+ trace_ctx = tracing_gen_ctx_flags(flags);
+ __trace_graph_return(tr, trace, trace_ctx, *calltime, rettime);
+ }
local_dec(&data->disabled);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 516/563] tracing: Have trace_marker use per-cpu data to read user space
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (514 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 515/563] tracing: Fix irqoff " Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 517/563] tracing: Fix tracing_mark_raw_write() to use buf and not ubuf Greg Kroah-Hartman
` (60 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu, Mathieu Desnoyers,
Luo Gengkun, Wattson CI, Linus Torvalds, Runping Lai,
Steven Rostedt (Google)
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <rostedt@goodmis.org>
commit 64cf7d058a005c5c31eb8a0b741f35dc12915d18 upstream.
It was reported that using __copy_from_user_inatomic() can actually
schedule. Which is bad when preemption is disabled. Even though there's
logic to check in_atomic() is set, but this is a nop when the kernel is
configured with PREEMPT_NONE. This is due to page faulting and the code
could schedule with preemption disabled.
Link: https://lore.kernel.org/all/20250819105152.2766363-1-luogengkun@huaweicloud.com/
The solution was to change the __copy_from_user_inatomic() to
copy_from_user_nofault(). But then it was reported that this caused a
regression in Android. There's several applications writing into
trace_marker() in Android, but now instead of showing the expected data,
it is showing:
tracing_mark_write: <faulted>
After reverting the conversion to copy_from_user_nofault(), Android was
able to get the data again.
Writes to the trace_marker is a way to efficiently and quickly enter data
into the Linux tracing buffer. It takes no locks and was designed to be as
non-intrusive as possible. This means it cannot allocate memory, and must
use pre-allocated data.
A method that is actively being worked on to have faultable system call
tracepoints read user space data is to allocate per CPU buffers, and use
them in the callback. The method uses a technique similar to seqcount.
That is something like this:
preempt_disable();
cpu = smp_processor_id();
buffer = this_cpu_ptr(&pre_allocated_cpu_buffers, cpu);
do {
cnt = nr_context_switches_cpu(cpu);
migrate_disable();
preempt_enable();
ret = copy_from_user(buffer, ptr, size);
preempt_disable();
migrate_enable();
} while (!ret && cnt != nr_context_switches_cpu(cpu));
if (!ret)
ring_buffer_write(buffer);
preempt_enable();
It's a little more involved than that, but the above is the basic logic.
The idea is to acquire the current CPU buffer, disable migration, and then
enable preemption. At this moment, it can safely use copy_from_user().
After reading the data from user space, it disables preemption again. It
then checks to see if there was any new scheduling on this CPU. If there
was, it must assume that the buffer was corrupted by another task. If
there wasn't, then the buffer is still valid as only tasks in preemptable
context can write to this buffer and only those that are running on the
CPU.
By using this method, where trace_marker open allocates the per CPU
buffers, trace_marker writes can access user space and even fault it in,
without having to allocate or take any locks of its own.
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Luo Gengkun <luogengkun@huaweicloud.com>
Cc: Wattson CI <wattson-external@google.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Link: https://lore.kernel.org/20251008124510.6dba541a@gandalf.local.home
Fixes: 3d62ab32df065 ("tracing: Fix tracing_marker may trigger page fault during preempt_disable")
Reported-by: Runping Lai <runpinglai@google.com>
Tested-by: Runping Lai <runpinglai@google.com>
Closes: https://lore.kernel.org/linux-trace-kernel/20251007003417.3470979-2-runpinglai@google.com/
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace.c | 268 +++++++++++++++++++++++++++++++++++++++++----------
1 file changed, 220 insertions(+), 48 deletions(-)
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -4791,12 +4791,6 @@ int tracing_single_release_file_tr(struc
return single_release(inode, filp);
}
-static int tracing_mark_open(struct inode *inode, struct file *filp)
-{
- stream_open(inode, filp);
- return tracing_open_generic_tr(inode, filp);
-}
-
static int tracing_release(struct inode *inode, struct file *file)
{
struct trace_array *tr = inode->i_private;
@@ -7163,7 +7157,7 @@ tracing_free_buffer_release(struct inode
#define TRACE_MARKER_MAX_SIZE 4096
-static ssize_t write_marker_to_buffer(struct trace_array *tr, const char __user *ubuf,
+static ssize_t write_marker_to_buffer(struct trace_array *tr, const char *buf,
size_t cnt, unsigned long ip)
{
struct ring_buffer_event *event;
@@ -7173,20 +7167,11 @@ static ssize_t write_marker_to_buffer(st
int meta_size;
ssize_t written;
size_t size;
- int len;
-
-/* Used in tracing_mark_raw_write() as well */
-#define FAULTED_STR "<faulted>"
-#define FAULTED_SIZE (sizeof(FAULTED_STR) - 1) /* '\0' is already accounted for */
meta_size = sizeof(*entry) + 2; /* add '\0' and possible '\n' */
again:
size = cnt + meta_size;
- /* If less than "<faulted>", then make sure we can still add that */
- if (cnt < FAULTED_SIZE)
- size += FAULTED_SIZE - cnt;
-
buffer = tr->array_buffer.buffer;
event = __trace_buffer_lock_reserve(buffer, TRACE_PRINT, size,
tracing_gen_ctx());
@@ -7196,9 +7181,6 @@ static ssize_t write_marker_to_buffer(st
* make it smaller and try again.
*/
if (size > ring_buffer_max_event_size(buffer)) {
- /* cnt < FAULTED size should never be bigger than max */
- if (WARN_ON_ONCE(cnt < FAULTED_SIZE))
- return -EBADF;
cnt = ring_buffer_max_event_size(buffer) - meta_size;
/* The above should only happen once */
if (WARN_ON_ONCE(cnt + meta_size == size))
@@ -7212,14 +7194,8 @@ static ssize_t write_marker_to_buffer(st
entry = ring_buffer_event_data(event);
entry->ip = ip;
-
- len = copy_from_user_nofault(&entry->buf, ubuf, cnt);
- if (len) {
- memcpy(&entry->buf, FAULTED_STR, FAULTED_SIZE);
- cnt = FAULTED_SIZE;
- written = -EFAULT;
- } else
- written = cnt;
+ memcpy(&entry->buf, buf, cnt);
+ written = cnt;
if (tr->trace_marker_file && !list_empty(&tr->trace_marker_file->triggers)) {
/* do not add \n before testing triggers, but add \0 */
@@ -7243,6 +7219,169 @@ static ssize_t write_marker_to_buffer(st
return written;
}
+struct trace_user_buf {
+ char *buf;
+};
+
+struct trace_user_buf_info {
+ struct trace_user_buf __percpu *tbuf;
+ int ref;
+};
+
+
+static DEFINE_MUTEX(trace_user_buffer_mutex);
+static struct trace_user_buf_info *trace_user_buffer;
+
+static void trace_user_fault_buffer_free(struct trace_user_buf_info *tinfo)
+{
+ char *buf;
+ int cpu;
+
+ for_each_possible_cpu(cpu) {
+ buf = per_cpu_ptr(tinfo->tbuf, cpu)->buf;
+ kfree(buf);
+ }
+ free_percpu(tinfo->tbuf);
+ kfree(tinfo);
+}
+
+static int trace_user_fault_buffer_enable(void)
+{
+ struct trace_user_buf_info *tinfo;
+ char *buf;
+ int cpu;
+
+ guard(mutex)(&trace_user_buffer_mutex);
+
+ if (trace_user_buffer) {
+ trace_user_buffer->ref++;
+ return 0;
+ }
+
+ tinfo = kmalloc(sizeof(*tinfo), GFP_KERNEL);
+ if (!tinfo)
+ return -ENOMEM;
+
+ tinfo->tbuf = alloc_percpu(struct trace_user_buf);
+ if (!tinfo->tbuf) {
+ kfree(tinfo);
+ return -ENOMEM;
+ }
+
+ tinfo->ref = 1;
+
+ /* Clear each buffer in case of error */
+ for_each_possible_cpu(cpu) {
+ per_cpu_ptr(tinfo->tbuf, cpu)->buf = NULL;
+ }
+
+ for_each_possible_cpu(cpu) {
+ buf = kmalloc_node(TRACE_MARKER_MAX_SIZE, GFP_KERNEL,
+ cpu_to_node(cpu));
+ if (!buf) {
+ trace_user_fault_buffer_free(tinfo);
+ return -ENOMEM;
+ }
+ per_cpu_ptr(tinfo->tbuf, cpu)->buf = buf;
+ }
+
+ trace_user_buffer = tinfo;
+
+ return 0;
+}
+
+static void trace_user_fault_buffer_disable(void)
+{
+ struct trace_user_buf_info *tinfo;
+
+ guard(mutex)(&trace_user_buffer_mutex);
+
+ tinfo = trace_user_buffer;
+
+ if (WARN_ON_ONCE(!tinfo))
+ return;
+
+ if (--tinfo->ref)
+ return;
+
+ trace_user_fault_buffer_free(tinfo);
+ trace_user_buffer = NULL;
+}
+
+/* Must be called with preemption disabled */
+static char *trace_user_fault_read(struct trace_user_buf_info *tinfo,
+ const char __user *ptr, size_t size,
+ size_t *read_size)
+{
+ int cpu = smp_processor_id();
+ char *buffer = per_cpu_ptr(tinfo->tbuf, cpu)->buf;
+ unsigned int cnt;
+ int trys = 0;
+ int ret;
+
+ if (size > TRACE_MARKER_MAX_SIZE)
+ size = TRACE_MARKER_MAX_SIZE;
+ *read_size = 0;
+
+ /*
+ * This acts similar to a seqcount. The per CPU context switches are
+ * recorded, migration is disabled and preemption is enabled. The
+ * read of the user space memory is copied into the per CPU buffer.
+ * Preemption is disabled again, and if the per CPU context switches count
+ * is still the same, it means the buffer has not been corrupted.
+ * If the count is different, it is assumed the buffer is corrupted
+ * and reading must be tried again.
+ */
+
+ do {
+ /*
+ * If for some reason, copy_from_user() always causes a context
+ * switch, this would then cause an infinite loop.
+ * If this task is preempted by another user space task, it
+ * will cause this task to try again. But just in case something
+ * changes where the copying from user space causes another task
+ * to run, prevent this from going into an infinite loop.
+ * 100 tries should be plenty.
+ */
+ if (WARN_ONCE(trys++ > 100, "Error: Too many tries to read user space"))
+ return NULL;
+
+ /* Read the current CPU context switch counter */
+ cnt = nr_context_switches_cpu(cpu);
+
+ /*
+ * Preemption is going to be enabled, but this task must
+ * remain on this CPU.
+ */
+ migrate_disable();
+
+ /*
+ * Now preemption is being enabed and another task can come in
+ * and use the same buffer and corrupt our data.
+ */
+ preempt_enable_notrace();
+
+ ret = __copy_from_user(buffer, ptr, size);
+
+ preempt_disable_notrace();
+ migrate_enable();
+
+ /* if it faulted, no need to test if the buffer was corrupted */
+ if (ret)
+ return NULL;
+
+ /*
+ * Preemption is disabled again, now check the per CPU context
+ * switch counter. If it doesn't match, then another user space
+ * process may have schedule in and corrupted our buffer. In that
+ * case the copying must be retried.
+ */
+ } while (nr_context_switches_cpu(cpu) != cnt);
+
+ *read_size = size;
+ return buffer;
+}
+
static ssize_t
tracing_mark_write(struct file *filp, const char __user *ubuf,
size_t cnt, loff_t *fpos)
@@ -7250,6 +7389,8 @@ tracing_mark_write(struct file *filp, co
struct trace_array *tr = filp->private_data;
ssize_t written = -ENODEV;
unsigned long ip;
+ size_t size;
+ char *buf;
if (tracing_disabled)
return -EINVAL;
@@ -7263,6 +7404,16 @@ tracing_mark_write(struct file *filp, co
if (cnt > TRACE_MARKER_MAX_SIZE)
cnt = TRACE_MARKER_MAX_SIZE;
+ /* Must have preemption disabled while having access to the buffer */
+ guard(preempt_notrace)();
+
+ buf = trace_user_fault_read(trace_user_buffer, ubuf, cnt, &size);
+ if (!buf)
+ return -EFAULT;
+
+ if (cnt > size)
+ cnt = size;
+
/* The selftests expect this function to be the IP address */
ip = _THIS_IP_;
@@ -7270,32 +7421,27 @@ tracing_mark_write(struct file *filp, co
if (tr == &global_trace) {
guard(rcu)();
list_for_each_entry_rcu(tr, &marker_copies, marker_list) {
- written = write_marker_to_buffer(tr, ubuf, cnt, ip);
+ written = write_marker_to_buffer(tr, buf, cnt, ip);
if (written < 0)
break;
}
} else {
- written = write_marker_to_buffer(tr, ubuf, cnt, ip);
+ written = write_marker_to_buffer(tr, buf, cnt, ip);
}
return written;
}
static ssize_t write_raw_marker_to_buffer(struct trace_array *tr,
- const char __user *ubuf, size_t cnt)
+ const char *buf, size_t cnt)
{
struct ring_buffer_event *event;
struct trace_buffer *buffer;
struct raw_data_entry *entry;
ssize_t written;
- int size;
- int len;
-
-#define FAULT_SIZE_ID (FAULTED_SIZE + sizeof(int))
+ size_t size;
size = sizeof(*entry) + cnt;
- if (cnt < FAULT_SIZE_ID)
- size += FAULT_SIZE_ID - cnt;
buffer = tr->array_buffer.buffer;
@@ -7309,14 +7455,8 @@ static ssize_t write_raw_marker_to_buffe
return -EBADF;
entry = ring_buffer_event_data(event);
-
- len = copy_from_user_nofault(&entry->id, ubuf, cnt);
- if (len) {
- entry->id = -1;
- memcpy(&entry->buf, FAULTED_STR, FAULTED_SIZE);
- written = -EFAULT;
- } else
- written = cnt;
+ memcpy(&entry->id, buf, cnt);
+ written = cnt;
__buffer_unlock_commit(buffer, event);
@@ -7329,8 +7469,8 @@ tracing_mark_raw_write(struct file *filp
{
struct trace_array *tr = filp->private_data;
ssize_t written = -ENODEV;
-
-#define FAULT_SIZE_ID (FAULTED_SIZE + sizeof(int))
+ size_t size;
+ char *buf;
if (tracing_disabled)
return -EINVAL;
@@ -7342,6 +7482,17 @@ tracing_mark_raw_write(struct file *filp
if (cnt < sizeof(unsigned int))
return -EINVAL;
+ /* Must have preemption disabled while having access to the buffer */
+ guard(preempt_notrace)();
+
+ buf = trace_user_fault_read(trace_user_buffer, ubuf, cnt, &size);
+ if (!buf)
+ return -EFAULT;
+
+ /* raw write is all or nothing */
+ if (cnt > size)
+ return -EINVAL;
+
/* The global trace_marker_raw can go to multiple instances */
if (tr == &global_trace) {
guard(rcu)();
@@ -7357,6 +7508,27 @@ tracing_mark_raw_write(struct file *filp
return written;
}
+static int tracing_mark_open(struct inode *inode, struct file *filp)
+{
+ int ret;
+
+ ret = trace_user_fault_buffer_enable();
+ if (ret < 0)
+ return ret;
+
+ stream_open(inode, filp);
+ ret = tracing_open_generic_tr(inode, filp);
+ if (ret < 0)
+ trace_user_fault_buffer_disable();
+ return ret;
+}
+
+static int tracing_mark_release(struct inode *inode, struct file *file)
+{
+ trace_user_fault_buffer_disable();
+ return tracing_release_generic_tr(inode, file);
+}
+
static int tracing_clock_show(struct seq_file *m, void *v)
{
struct trace_array *tr = m->private;
@@ -7764,13 +7936,13 @@ static const struct file_operations trac
static const struct file_operations tracing_mark_fops = {
.open = tracing_mark_open,
.write = tracing_mark_write,
- .release = tracing_release_generic_tr,
+ .release = tracing_mark_release,
};
static const struct file_operations tracing_mark_raw_fops = {
.open = tracing_mark_open,
.write = tracing_mark_raw_write,
- .release = tracing_release_generic_tr,
+ .release = tracing_mark_release,
};
static const struct file_operations trace_clock_fops = {
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 517/563] tracing: Fix tracing_mark_raw_write() to use buf and not ubuf
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (515 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 516/563] tracing: Have trace_marker use per-cpu data to read user space Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 518/563] tracing: Stop fortify-string from warning in tracing_mark_raw_write() Greg Kroah-Hartman
` (59 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu, Mark Rutland,
Mathieu Desnoyers, Andrew Morton, syzbot+9a2ede1643175f350105,
Steven Rostedt (Google)
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <rostedt@goodmis.org>
commit bda745ee8fbb63330d8f2f2ea4157229a5df959e upstream.
The fix to use a per CPU buffer to read user space tested only the writes
to trace_marker. But it appears that the selftests are missing tests to
the trace_maker_raw file. The trace_maker_raw file is used by applications
that writes data structures and not strings into the file, and the tools
read the raw ring buffer to process the structures it writes.
The fix that reads the per CPU buffers passes the new per CPU buffer to
the trace_marker file writes, but the update to the trace_marker_raw write
read the data from user space into the per CPU buffer, but then still used
then passed the user space address to the function that records the data.
Pass in the per CPU buffer and not the user space address.
TODO: Add a test to better test trace_marker_raw.
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Link: https://lore.kernel.org/20251011035243.386098147@kernel.org
Fixes: 64cf7d058a00 ("tracing: Have trace_marker use per-cpu data to read user space")
Reported-by: syzbot+9a2ede1643175f350105@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68e973f5.050a0220.1186a4.0010.GAE@google.com/
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -7497,12 +7497,12 @@ tracing_mark_raw_write(struct file *filp
if (tr == &global_trace) {
guard(rcu)();
list_for_each_entry_rcu(tr, &marker_copies, marker_list) {
- written = write_raw_marker_to_buffer(tr, ubuf, cnt);
+ written = write_raw_marker_to_buffer(tr, buf, cnt);
if (written < 0)
break;
}
} else {
- written = write_raw_marker_to_buffer(tr, ubuf, cnt);
+ written = write_raw_marker_to_buffer(tr, buf, cnt);
}
return written;
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 518/563] tracing: Stop fortify-string from warning in tracing_mark_raw_write()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (516 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 517/563] tracing: Fix tracing_mark_raw_write() to use buf and not ubuf Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 519/563] dm: fix queue start/stop imbalance under suspend/load/resume races Greg Kroah-Hartman
` (58 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu, Mathieu Desnoyers,
Andrew Morton, syzbot+9a2ede1643175f350105,
Steven Rostedt (Google)
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <rostedt@goodmis.org>
commit 54b91e54b113d4f15ab023a44f508251db6e22e7 upstream.
The way tracing_mark_raw_write() records its data is that it has the
following structure:
struct {
struct trace_entry;
int id;
char buf[];
};
But memcpy(&entry->id, buf, size) triggers the following warning when the
size is greater than the id:
------------[ cut here ]------------
memcpy: detected field-spanning write (size 6) of single field "&entry->id" at kernel/trace/trace.c:7458 (size 4)
WARNING: CPU: 7 PID: 995 at kernel/trace/trace.c:7458 write_raw_marker_to_buffer.isra.0+0x1f9/0x2e0
Modules linked in:
CPU: 7 UID: 0 PID: 995 Comm: bash Not tainted 6.17.0-test-00007-g60b82183e78a-dirty #211 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
RIP: 0010:write_raw_marker_to_buffer.isra.0+0x1f9/0x2e0
Code: 04 00 75 a7 b9 04 00 00 00 48 89 de 48 89 04 24 48 c7 c2 e0 b1 d1 b2 48 c7 c7 40 b2 d1 b2 c6 05 2d 88 6a 04 01 e8 f7 e8 bd ff <0f> 0b 48 8b 04 24 e9 76 ff ff ff 49 8d 7c 24 04 49 8d 5c 24 08 48
RSP: 0018:ffff888104c3fc78 EFLAGS: 00010292
RAX: 0000000000000000 RBX: 0000000000000006 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 1ffffffff6b363b4 RDI: 0000000000000001
RBP: ffff888100058a00 R08: ffffffffb041d459 R09: ffffed1020987f40
R10: 0000000000000007 R11: 0000000000000001 R12: ffff888100bb9010
R13: 0000000000000000 R14: 00000000000003e3 R15: ffff888134800000
FS: 00007fa61d286740(0000) GS:ffff888286cad000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000560d28d509f1 CR3: 00000001047a4006 CR4: 0000000000172ef0
Call Trace:
<TASK>
tracing_mark_raw_write+0x1fe/0x290
? __pfx_tracing_mark_raw_write+0x10/0x10
? security_file_permission+0x50/0xf0
? rw_verify_area+0x6f/0x4b0
vfs_write+0x1d8/0xdd0
? __pfx_vfs_write+0x10/0x10
? __pfx_css_rstat_updated+0x10/0x10
? count_memcg_events+0xd9/0x410
? fdget_pos+0x53/0x5e0
ksys_write+0x182/0x200
? __pfx_ksys_write+0x10/0x10
? do_user_addr_fault+0x4af/0xa30
do_syscall_64+0x63/0x350
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fa61d318687
Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffd87fe0120 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fa61d286740 RCX: 00007fa61d318687
RDX: 0000000000000006 RSI: 0000560d28d509f0 RDI: 0000000000000001
RBP: 0000560d28d509f0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000006
R13: 00007fa61d4715c0 R14: 00007fa61d46ee80 R15: 0000000000000000
</TASK>
---[ end trace 0000000000000000 ]---
This is because fortify string sees that the size of entry->id is only 4
bytes, but it is writing more than that. But this is OK as the
dynamic_array is allocated to handle that copy.
The size allocated on the ring buffer was actually a bit too big:
size = sizeof(*entry) + cnt;
But cnt includes the 'id' and the buffer data, so adding cnt to the size
of *entry actually allocates too much on the ring buffer.
Change the allocation to:
size = struct_size(entry, buf, cnt - sizeof(entry->id));
and the memcpy() to unsafe_memcpy() with an added justification.
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Link: https://lore.kernel.org/20251011112032.77be18e4@gandalf.local.home
Fixes: 64cf7d058a00 ("tracing: Have trace_marker use per-cpu data to read user space")
Reported-by: syzbot+9a2ede1643175f350105@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68e973f5.050a0220.1186a4.0010.GAE@google.com/
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -7441,7 +7441,8 @@ static ssize_t write_raw_marker_to_buffe
ssize_t written;
size_t size;
- size = sizeof(*entry) + cnt;
+ /* cnt includes both the entry->id and the data behind it. */
+ size = struct_size(entry, buf, cnt - sizeof(entry->id));
buffer = tr->array_buffer.buffer;
@@ -7455,7 +7456,10 @@ static ssize_t write_raw_marker_to_buffe
return -EBADF;
entry = ring_buffer_event_data(event);
- memcpy(&entry->id, buf, cnt);
+ unsafe_memcpy(&entry->id, buf, cnt,
+ "id and content already reserved on ring buffer"
+ "'buf' includes the 'id' and the data."
+ "'entry' was allocated with cnt from 'id'.");
written = cnt;
__buffer_unlock_commit(buffer, event);
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 519/563] dm: fix queue start/stop imbalance under suspend/load/resume races
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (517 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 518/563] tracing: Stop fortify-string from warning in tracing_mark_raw_write() Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 520/563] dm: fix NULL pointer dereference in __dm_suspend() Greg Kroah-Hartman
` (57 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zheng Qixing, Mikulas Patocka
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <zhengqixing@huawei.com>
commit 7f597c2cdb9d3263a6fce07c4fc0a9eaa8e8fc43 upstream.
When suspend and load run concurrently, before q->mq_ops is set in
blk_mq_init_allocated_queue(), __dm_suspend() skip dm_stop_queue(). As a
result, the queue's quiesce depth is not incremented.
Later, once table load has finished and __dm_resume() runs, which triggers
q->quiesce_depth ==0 warning in blk_mq_unquiesce_queue():
Call Trace:
<TASK>
dm_start_queue+0x16/0x20 [dm_mod]
__dm_resume+0xac/0xb0 [dm_mod]
dm_resume+0x12d/0x150 [dm_mod]
do_resume+0x2c2/0x420 [dm_mod]
dev_suspend+0x30/0x130 [dm_mod]
ctl_ioctl+0x402/0x570 [dm_mod]
dm_ctl_ioctl+0x23/0x30 [dm_mod]
Fix this by explicitly tracking whether the request queue was
stopped in __dm_suspend() via a new DMF_QUEUE_STOPPED flag.
Only call dm_start_queue() in __dm_resume() if the queue was
actually stopped.
Fixes: e70feb8b3e68 ("blk-mq: support concurrent queue quiesce/unquiesce")
Cc: stable@vger.kernel.org
Signed-off-by: Zheng Qixing <zhengqixing@huawei.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-core.h | 1 +
drivers/md/dm.c | 8 +++++---
2 files changed, 6 insertions(+), 3 deletions(-)
--- a/drivers/md/dm-core.h
+++ b/drivers/md/dm-core.h
@@ -162,6 +162,7 @@ struct mapped_device {
#define DMF_SUSPENDED_INTERNALLY 7
#define DMF_POST_SUSPENDING 8
#define DMF_EMULATE_ZONE_APPEND 9
+#define DMF_QUEUE_STOPPED 10
static inline sector_t dm_get_size(struct mapped_device *md)
{
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2960,8 +2960,10 @@ static int __dm_suspend(struct mapped_de
* Stop md->queue before flushing md->wq in case request-based
* dm defers requests to md->wq from md->queue.
*/
- if (dm_request_based(md))
+ if (dm_request_based(md)) {
dm_stop_queue(md->queue);
+ set_bit(DMF_QUEUE_STOPPED, &md->flags);
+ }
flush_workqueue(md->wq);
@@ -2983,7 +2985,7 @@ static int __dm_suspend(struct mapped_de
if (r < 0) {
dm_queue_flush(md);
- if (dm_request_based(md))
+ if (test_and_clear_bit(DMF_QUEUE_STOPPED, &md->flags))
dm_start_queue(md->queue);
unlock_fs(md);
@@ -3067,7 +3069,7 @@ static int __dm_resume(struct mapped_dev
* so that mapping of targets can work correctly.
* Request-based dm is queueing the deferred I/Os in its request_queue.
*/
- if (dm_request_based(md))
+ if (test_and_clear_bit(DMF_QUEUE_STOPPED, &md->flags))
dm_start_queue(md->queue);
unlock_fs(md);
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 520/563] dm: fix NULL pointer dereference in __dm_suspend()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (518 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 519/563] dm: fix queue start/stop imbalance under suspend/load/resume races Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 521/563] LoongArch: Automatically disable kaslr if boot from kexec_file Greg Kroah-Hartman
` (56 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zheng Qixing, Mikulas Patocka
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <zhengqixing@huawei.com>
commit 8d33a030c566e1f105cd5bf27f37940b6367f3be upstream.
There is a race condition between dm device suspend and table load that
can lead to null pointer dereference. The issue occurs when suspend is
invoked before table load completes:
BUG: kernel NULL pointer dereference, address: 0000000000000054
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 6 PID: 6798 Comm: dmsetup Not tainted 6.6.0-g7e52f5f0ca9b #62
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014
RIP: 0010:blk_mq_wait_quiesce_done+0x0/0x50
Call Trace:
<TASK>
blk_mq_quiesce_queue+0x2c/0x50
dm_stop_queue+0xd/0x20
__dm_suspend+0x130/0x330
dm_suspend+0x11a/0x180
dev_suspend+0x27e/0x560
ctl_ioctl+0x4cf/0x850
dm_ctl_ioctl+0xd/0x20
vfs_ioctl+0x1d/0x50
__se_sys_ioctl+0x9b/0xc0
__x64_sys_ioctl+0x19/0x30
x64_sys_call+0x2c4a/0x4620
do_syscall_64+0x9e/0x1b0
The issue can be triggered as below:
T1 T2
dm_suspend table_load
__dm_suspend dm_setup_md_queue
dm_mq_init_request_queue
blk_mq_init_allocated_queue
=> q->mq_ops = set->ops; (1)
dm_stop_queue / dm_wait_for_completion
=> q->tag_set NULL pointer! (2)
=> q->tag_set = set; (3)
Fix this by checking if a valid table (map) exists before performing
request-based suspend and waiting for target I/O. When map is NULL,
skip these table-dependent suspend steps.
Even when map is NULL, no I/O can reach any target because there is
no table loaded; I/O submitted in this state will fail early in the
DM layer. Skipping the table-dependent suspend logic in this case
is safe and avoids NULL pointer dereferences.
Fixes: c4576aed8d85 ("dm: fix request-based dm's use of dm_wait_for_completion")
Cc: stable@vger.kernel.org
Signed-off-by: Zheng Qixing <zhengqixing@huawei.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2908,7 +2908,7 @@ static int __dm_suspend(struct mapped_de
{
bool do_lockfs = suspend_flags & DM_SUSPEND_LOCKFS_FLAG;
bool noflush = suspend_flags & DM_SUSPEND_NOFLUSH_FLAG;
- int r;
+ int r = 0;
lockdep_assert_held(&md->suspend_lock);
@@ -2960,7 +2960,7 @@ static int __dm_suspend(struct mapped_de
* Stop md->queue before flushing md->wq in case request-based
* dm defers requests to md->wq from md->queue.
*/
- if (dm_request_based(md)) {
+ if (map && dm_request_based(md)) {
dm_stop_queue(md->queue);
set_bit(DMF_QUEUE_STOPPED, &md->flags);
}
@@ -2972,7 +2972,8 @@ static int __dm_suspend(struct mapped_de
* We call dm_wait_for_completion to wait for all existing requests
* to finish.
*/
- r = dm_wait_for_completion(md, task_state);
+ if (map)
+ r = dm_wait_for_completion(md, task_state);
if (!r)
set_bit(dmf_suspended_flag, &md->flags);
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 521/563] LoongArch: Automatically disable kaslr if boot from kexec_file
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (519 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 520/563] dm: fix NULL pointer dereference in __dm_suspend() Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 522/563] pwm: loongson: Fix LOONGSON_PWM_FREQ_DEFAULT Greg Kroah-Hartman
` (55 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Youling Tang, Huacai Chen
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Youling Tang <tangyouling@kylinos.cn>
commit c8168b4faf1d62cbb320a3e518ad31cdd567cb05 upstream.
Automatically disable kaslr when the kernel loads from kexec_file.
kexec_file loads the secondary kernel image to a non-linked address,
inherently providing KASLR-like randomization.
However, on LoongArch where System RAM may be non-contiguous, enabling
KASLR for the second kernel may relocate it to an invalid memory region
and cause a boot failure. Thus, we disable KASLR when "kexec_file" is
detected in the command line.
To ensure compatibility with older kernels loaded via kexec_file, this
patch should be backported to stable branches.
Cc: stable@vger.kernel.org
Signed-off-by: Youling Tang <tangyouling@kylinos.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/kernel/relocate.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/arch/loongarch/kernel/relocate.c
+++ b/arch/loongarch/kernel/relocate.c
@@ -166,6 +166,10 @@ static inline __init bool kaslr_disabled
return true;
#endif
+ str = strstr(boot_command_line, "kexec_file");
+ if (str == boot_command_line || (str > boot_command_line && *(str - 1) == ' '))
+ return true;
+
return false;
}
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 522/563] pwm: loongson: Fix LOONGSON_PWM_FREQ_DEFAULT
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (520 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 521/563] LoongArch: Automatically disable kaslr if boot from kexec_file Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 523/563] LoongArch: BPF: Sign-extend struct ops return values properly Greg Kroah-Hartman
` (54 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xi Ruoyao, Binbin Zhou, Huacai Chen,
Uwe Kleine-König
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xi Ruoyao <xry111@xry111.site>
commit 75604e9a5b60707722028947d6dc6bdacb42282e upstream.
Per the 7A1000 and 7A2000 user manual, the clock frequency of their
PWM controllers is 50 MHz, not 50 kHz.
Fixes: 2b62c89448dd ("pwm: Add Loongson PWM controller support")
Signed-off-by: Xi Ruoyao <xry111@xry111.site>
Reviewed-by: Binbin Zhou <zhoubinbin@loongson.cn>
Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
Link: https://lore.kernel.org/r/20250816104904.4779-2-xry111@xry111.site
Cc: stable@vger.kernel.org
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pwm/pwm-loongson.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pwm/pwm-loongson.c b/drivers/pwm/pwm-loongson.c
index 1ba16168cbb4..31a57edecfd0 100644
--- a/drivers/pwm/pwm-loongson.c
+++ b/drivers/pwm/pwm-loongson.c
@@ -49,7 +49,7 @@
#define LOONGSON_PWM_CTRL_REG_DZONE BIT(10) /* Anti-dead Zone Enable Bit */
/* default input clk frequency for the ACPI case */
-#define LOONGSON_PWM_FREQ_DEFAULT 50000 /* Hz */
+#define LOONGSON_PWM_FREQ_DEFAULT 50000000 /* Hz */
struct pwm_loongson_ddata {
struct clk *clk;
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 523/563] LoongArch: BPF: Sign-extend struct ops return values properly
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (521 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 522/563] pwm: loongson: Fix LOONGSON_PWM_FREQ_DEFAULT Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 524/563] LoongArch: BPF: No support of struct argument in trampoline programs Greg Kroah-Hartman
` (53 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hengqi Chen, Huacai Chen
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengqi Chen <hengqi.chen@gmail.com>
commit 8b51b11b3d81c1ed48a52f87da9256d737b723a0 upstream.
The ns_bpf_qdisc selftest triggers a kernel panic:
Oops[#1]:
CPU 0 Unable to handle kernel paging request at virtual address 0000000000741d58, era == 90000000851b5ac0, ra == 90000000851b5aa4
CPU: 0 UID: 0 PID: 449 Comm: test_progs Tainted: G OE 6.16.0+ #3 PREEMPT(full)
Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022
pc 90000000851b5ac0 ra 90000000851b5aa4 tp 90000001076b8000 sp 90000001076bb600
a0 0000000000741ce8 a1 0000000000000001 a2 90000001076bb5c0 a3 0000000000000008
a4 90000001004c4620 a5 9000000100741ce8 a6 0000000000000000 a7 0100000000000000
t0 0000000000000010 t1 0000000000000000 t2 9000000104d24d30 t3 0000000000000001
t4 4f2317da8a7e08c4 t5 fffffefffc002f00 t6 90000001004c4620 t7 ffffffffc61c5b3d
t8 0000000000000000 u0 0000000000000001 s9 0000000000000050 s0 90000001075bc800
s1 0000000000000040 s2 900000010597c400 s3 0000000000000008 s4 90000001075bc880
s5 90000001075bc8f0 s6 0000000000000000 s7 0000000000741ce8 s8 0000000000000000
ra: 90000000851b5aa4 __qdisc_run+0xac/0x8d8
ERA: 90000000851b5ac0 __qdisc_run+0xc8/0x8d8
CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)
PRMD: 00000004 (PPLV0 +PIE -PWE)
EUEN: 00000007 (+FPE +SXE +ASXE -BTE)
ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)
ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)
BADV: 0000000000741d58
PRID: 0014c010 (Loongson-64bit, Loongson-3A5000)
Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE)]
Process test_progs (pid: 449, threadinfo=000000009af02b3a, task=00000000e9ba4956)
Stack : 0000000000000000 90000001075bc8ac 90000000869524a8 9000000100741ce8
90000001075bc800 9000000100415300 90000001075bc8ac 0000000000000000
900000010597c400 900000008694a000 0000000000000000 9000000105b59000
90000001075bc800 9000000100741ce8 0000000000000050 900000008513000c
9000000086936000 0000000100094d4c fffffff400676208 0000000000000000
9000000105b59000 900000008694a000 9000000086bf0dc0 9000000105b59000
9000000086bf0d68 9000000085147010 90000001075be788 0000000000000000
9000000086bf0f98 0000000000000001 0000000000000010 9000000006015840
0000000000000000 9000000086be6c40 0000000000000000 0000000000000000
0000000000000000 4f2317da8a7e08c4 0000000000000101 4f2317da8a7e08c4
...
Call Trace:
[<90000000851b5ac0>] __qdisc_run+0xc8/0x8d8
[<9000000085130008>] __dev_queue_xmit+0x578/0x10f0
[<90000000853701c0>] ip6_finish_output2+0x2f0/0x950
[<9000000085374bc8>] ip6_finish_output+0x2b8/0x448
[<9000000085370b24>] ip6_xmit+0x304/0x858
[<90000000853c4438>] inet6_csk_xmit+0x100/0x170
[<90000000852b32f0>] __tcp_transmit_skb+0x490/0xdd0
[<90000000852b47fc>] tcp_connect+0xbcc/0x1168
[<90000000853b9088>] tcp_v6_connect+0x580/0x8a0
[<90000000852e7738>] __inet_stream_connect+0x170/0x480
[<90000000852e7a98>] inet_stream_connect+0x50/0x88
[<90000000850f2814>] __sys_connect+0xe4/0x110
[<90000000850f2858>] sys_connect+0x18/0x28
[<9000000085520c94>] do_syscall+0x94/0x1a0
[<9000000083df1fb8>] handle_syscall+0xb8/0x158
Code: 4001ad80 2400873f 2400832d <240073cc> 001137ff 001133ff 6407b41f 001503cc 0280041d
---[ end trace 0000000000000000 ]---
The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer
is treated as a 32bit value and sign extend to 64bit in epilogue. This
behavior is right for most bpf prog types but wrong for struct ops which
requires LoongArch ABI.
So let's sign extend struct ops return values according to the LoongArch
ABI ([1]) and return value spec in function model.
[1]: https://loongson.github.io/LoongArch-Documentation/LoongArch-ELF-ABI-EN.html
Cc: stable@vger.kernel.org
Fixes: 6abf17d690d8 ("LoongArch: BPF: Add struct ops support for trampoline")
Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/net/bpf_jit.c | 37 +++++++++++++++++++++++++++++++++++-
1 file changed, 36 insertions(+), 1 deletion(-)
diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
index fa1a3234e9a6..cbe53d0b7fb0 100644
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -1448,6 +1448,37 @@ void arch_free_bpf_trampoline(void *image, unsigned int size)
bpf_prog_pack_free(image, size);
}
+/*
+ * Sign-extend the register if necessary
+ */
+static void sign_extend(struct jit_ctx *ctx, int rd, int rj, u8 size, bool sign)
+{
+ /* ABI requires unsigned char/short to be zero-extended */
+ if (!sign && (size == 1 || size == 2)) {
+ if (rd != rj)
+ move_reg(ctx, rd, rj);
+ return;
+ }
+
+ switch (size) {
+ case 1:
+ emit_insn(ctx, extwb, rd, rj);
+ break;
+ case 2:
+ emit_insn(ctx, extwh, rd, rj);
+ break;
+ case 4:
+ emit_insn(ctx, addiw, rd, rj, 0);
+ break;
+ case 8:
+ if (rd != rj)
+ move_reg(ctx, rd, rj);
+ break;
+ default:
+ pr_warn("bpf_jit: invalid size %d for sign_extend\n", size);
+ }
+}
+
static int __arch_prepare_bpf_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im,
const struct btf_func_model *m, struct bpf_tramp_links *tlinks,
void *func_addr, u32 flags)
@@ -1655,8 +1686,12 @@ static int __arch_prepare_bpf_trampoline(struct jit_ctx *ctx, struct bpf_tramp_i
restore_args(ctx, m->nr_args, args_off);
if (save_ret) {
- emit_insn(ctx, ldd, LOONGARCH_GPR_A0, LOONGARCH_GPR_FP, -retval_off);
emit_insn(ctx, ldd, regmap[BPF_REG_0], LOONGARCH_GPR_FP, -(retval_off - 8));
+ if (is_struct_ops)
+ sign_extend(ctx, LOONGARCH_GPR_A0, regmap[BPF_REG_0],
+ m->ret_size, m->ret_flags & BTF_FMODEL_SIGNED_ARG);
+ else
+ emit_insn(ctx, ldd, LOONGARCH_GPR_A0, LOONGARCH_GPR_FP, -retval_off);
}
emit_insn(ctx, ldd, LOONGARCH_GPR_S1, LOONGARCH_GPR_FP, -sreg_off);
--
2.51.0
^ permalink raw reply related [flat|nested] 591+ messages in thread* [PATCH 6.17 524/563] LoongArch: BPF: No support of struct argument in trampoline programs
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (522 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 523/563] LoongArch: BPF: Sign-extend struct ops return values properly Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 525/563] LoongArch: BPF: Dont align trampoline size Greg Kroah-Hartman
` (52 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Vincent Li, Hengqi Chen, Huacai Chen
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengqi Chen <hengqi.chen@gmail.com>
commit e82406c7cbdd368c5459b8a45e118811d2ba0794 upstream.
The current implementation does not support struct argument. This causes
a oops when running bpf selftest:
$ ./test_progs -a tracing_struct
Oops[#1]:
CPU -1 Unable to handle kernel paging request at virtual address 0000000000000018, era == 9000000085bef268, ra == 90000000844f3938
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 1-...0: (19 ticks this GP) idle=1094/1/0x4000000000000000 softirq=1380/1382 fqs=801
rcu: (detected by 0, t=5252 jiffies, g=1197, q=52 ncpus=4)
Sending NMI from CPU 0 to CPUs 1:
rcu: rcu_preempt kthread starved for 2495 jiffies! g1197 f0x0 RCU_GP_DOING_FQS(6) ->state=0x0 ->cpu=2
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:I stack:0 pid:15 tgid:15 ppid:2 task_flags:0x208040 flags:0x00000800
Stack : 9000000100423e80 0000000000000402 0000000000000010 90000001003b0680
9000000085d88000 0000000000000000 0000000000000040 9000000087159350
9000000085c2b9b0 0000000000000001 900000008704a000 0000000000000005
00000000ffff355b 00000000ffff355b 0000000000000000 0000000000000004
9000000085d90510 0000000000000000 0000000000000002 7b5d998f8281e86e
00000000ffff355c 7b5d998f8281e86e 000000000000003f 9000000087159350
900000008715bf98 0000000000000005 9000000087036000 900000008704a000
9000000100407c98 90000001003aff80 900000008715c4c0 9000000085c2b9b0
00000000ffff355b 9000000085c33d3c 00000000000000b4 0000000000000000
9000000007002150 00000000ffff355b 9000000084615480 0000000007000002
...
Call Trace:
[<9000000085c2a868>] __schedule+0x410/0x1520
[<9000000085c2b9ac>] schedule+0x34/0x190
[<9000000085c33d38>] schedule_timeout+0x98/0x140
[<90000000845e9120>] rcu_gp_fqs_loop+0x5f8/0x868
[<90000000845ed538>] rcu_gp_kthread+0x260/0x2e0
[<900000008454e8a4>] kthread+0x144/0x238
[<9000000085c26b60>] ret_from_kernel_thread+0x28/0xc8
[<90000000844f20e4>] ret_from_kernel_thread_asm+0xc/0x88
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 2:
NMI backtrace for cpu 2 skipped: idling at idle_exit+0x0/0x4
Reject it for now.
Cc: stable@vger.kernel.org
Fixes: f9b6b41f0cf3 ("LoongArch: BPF: Add basic bpf trampoline support")
Tested-by: Vincent Li <vincent.mc.li@gmail.com>
Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/net/bpf_jit.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -1526,6 +1526,12 @@ static int __arch_prepare_bpf_trampoline
if (m->nr_args > LOONGARCH_MAX_REG_ARGS)
return -ENOTSUPP;
+ /* FIXME: No support of struct argument */
+ for (i = 0; i < m->nr_args; i++) {
+ if (m->arg_flags[i] & BTF_FMODEL_STRUCT_ARG)
+ return -ENOTSUPP;
+ }
+
if (flags & (BPF_TRAMP_F_ORIG_STACK | BPF_TRAMP_F_SHARE_IPMODIFY))
return -ENOTSUPP;
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 525/563] LoongArch: BPF: Dont align trampoline size
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (523 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 524/563] LoongArch: BPF: No support of struct argument in trampoline programs Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 526/563] LoongArch: BPF: Make trampoline size stable Greg Kroah-Hartman
` (51 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Vincent Li, Hengqi Chen, Huacai Chen
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengqi Chen <hengqi.chen@gmail.com>
commit a04731cbee6e981afa4263289a0c0059c8b2e7b9 upstream.
Currently, arch_alloc_bpf_trampoline() use bpf_prog_pack_alloc() which
will pack multiple trampolines into a huge page. So, no need to assume
the trampoline size is page aligned.
Cc: stable@vger.kernel.org
Tested-by: Vincent Li <vincent.mc.li@gmail.com>
Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/net/bpf_jit.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -1785,8 +1785,7 @@ int arch_bpf_trampoline_size(const struc
ret = __arch_prepare_bpf_trampoline(&ctx, &im, m, tlinks, func_addr, flags);
- /* Page align */
- return ret < 0 ? ret : round_up(ret * LOONGARCH_INSN_SIZE, PAGE_SIZE);
+ return ret < 0 ? ret : ret * LOONGARCH_INSN_SIZE;
}
struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 526/563] LoongArch: BPF: Make trampoline size stable
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (524 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 525/563] LoongArch: BPF: Dont align trampoline size Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 527/563] LoongArch: BPF: Make error handling robust in arch_prepare_bpf_trampoline() Greg Kroah-Hartman
` (50 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Vincent Li, Hengqi Chen, Huacai Chen
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengqi Chen <hengqi.chen@gmail.com>
commit ea645cfd3d5f74a2bd40a60003f113b3c467975d upstream.
When attach fentry/fexit BPF programs, __arch_prepare_bpf_trampoline()
is called twice with different `struct bpf_tramp_image *im`:
bpf_trampoline_update()
-> arch_bpf_trampoline_size()
-> __arch_prepare_bpf_trampoline()
-> arch_prepare_bpf_trampoline()
-> __arch_prepare_bpf_trampoline()
Use move_imm() will emit unstable instruction sequences, so let's use
move_addr() instead to prevent subtle bugs.
(I observed this while debugging other issues with printk.)
Cc: stable@vger.kernel.org
Tested-by: Vincent Li <vincent.mc.li@gmail.com>
Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/net/bpf_jit.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -1632,7 +1632,7 @@ static int __arch_prepare_bpf_trampoline
orig_call += LOONGARCH_BPF_FENTRY_NBYTES;
if (flags & BPF_TRAMP_F_CALL_ORIG) {
- move_imm(ctx, LOONGARCH_GPR_A0, (const s64)im, false);
+ move_addr(ctx, LOONGARCH_GPR_A0, (const u64)im);
ret = emit_call(ctx, (const u64)__bpf_tramp_enter);
if (ret)
return ret;
@@ -1682,7 +1682,7 @@ static int __arch_prepare_bpf_trampoline
if (flags & BPF_TRAMP_F_CALL_ORIG) {
im->ip_epilogue = ctx->ro_image + ctx->idx;
- move_imm(ctx, LOONGARCH_GPR_A0, (const s64)im, false);
+ move_addr(ctx, LOONGARCH_GPR_A0, (const u64)im);
ret = emit_call(ctx, (const u64)__bpf_tramp_exit);
if (ret)
goto out;
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 527/563] LoongArch: BPF: Make error handling robust in arch_prepare_bpf_trampoline()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (525 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 526/563] LoongArch: BPF: Make trampoline size stable Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 528/563] LoongArch: BPF: Remove duplicated bpf_flush_icache() Greg Kroah-Hartman
` (49 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Vincent Li, Hengqi Chen, Huacai Chen
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengqi Chen <hengqi.chen@gmail.com>
commit de2c0b7788648850b68b75f7cc8698b2749dd31e upstream.
Bail out instead of trying to perform a bpf_arch_text_copy() if
__arch_prepare_bpf_trampoline() failed.
Cc: stable@vger.kernel.org
Tested-by: Vincent Li <vincent.mc.li@gmail.com>
Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/net/bpf_jit.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -1756,7 +1756,10 @@ int arch_prepare_bpf_trampoline(struct b
jit_fill_hole(image, (unsigned int)(ro_image_end - ro_image));
ret = __arch_prepare_bpf_trampoline(&ctx, im, m, tlinks, func_addr, flags);
- if (ret > 0 && validate_code(&ctx) < 0) {
+ if (ret < 0)
+ goto out;
+
+ if (validate_code(&ctx) < 0) {
ret = -EINVAL;
goto out;
}
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 528/563] LoongArch: BPF: Remove duplicated bpf_flush_icache()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (526 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 527/563] LoongArch: BPF: Make error handling robust in arch_prepare_bpf_trampoline() Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 529/563] LoongArch: BPF: No text_poke() for kernel text Greg Kroah-Hartman
` (48 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Vincent Li, Hengqi Chen, Huacai Chen
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengqi Chen <hengqi.chen@gmail.com>
commit b0f50dc09bf008b2e581d5e6ad570d325725881c upstream.
The bpf_flush_icache() is called by bpf_arch_text_copy() already. So
remove it. This has been done in arm64 and riscv.
Cc: stable@vger.kernel.org
Tested-by: Vincent Li <vincent.mc.li@gmail.com>
Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/net/bpf_jit.c | 1 -
1 file changed, 1 deletion(-)
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -1770,7 +1770,6 @@ int arch_prepare_bpf_trampoline(struct b
goto out;
}
- bpf_flush_icache(ro_image, ro_image_end);
out:
kvfree(image);
return ret < 0 ? ret : size;
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 529/563] LoongArch: BPF: No text_poke() for kernel text
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (527 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 528/563] LoongArch: BPF: Remove duplicated bpf_flush_icache() Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 530/563] LoongArch: BPF: Remove duplicated flags check Greg Kroah-Hartman
` (47 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Vincent Li, Hengqi Chen, Huacai Chen
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengqi Chen <hengqi.chen@gmail.com>
commit 3d770bd11b943066db11dba7be0b6f0d81cb5d50 upstream.
The current implementation of bpf_arch_text_poke() requires 5 nops
at patch site which is not applicable for kernel/module functions.
Because LoongArch reserves ONLY 2 nops at the function entry. With
CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y, this can be done by ftrace
instead.
See the following commit for details:
* commit b91e014f078e ("bpf: Make BPF trampoline use register_ftrace_direct() API")
* commit 9cdc3b6a299c ("LoongArch: ftrace: Add direct call support")
Cc: stable@vger.kernel.org
Tested-by: Vincent Li <vincent.mc.li@gmail.com>
Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/net/bpf_jit.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -1294,8 +1294,10 @@ int bpf_arch_text_poke(void *ip, enum bp
u32 old_insns[LOONGARCH_LONG_JUMP_NINSNS] = {[0 ... 4] = INSN_NOP};
u32 new_insns[LOONGARCH_LONG_JUMP_NINSNS] = {[0 ... 4] = INSN_NOP};
- if (!is_kernel_text((unsigned long)ip) &&
- !is_bpf_text_address((unsigned long)ip))
+ /* Only poking bpf text is supported. Since kernel function entry
+ * is set up by ftrace, we rely on ftrace to poke kernel functions.
+ */
+ if (!is_bpf_text_address((unsigned long)ip))
return -ENOTSUPP;
ret = emit_jump_or_nops(old_addr, ip, old_insns, is_call);
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 530/563] LoongArch: BPF: Remove duplicated flags check
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (528 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 529/563] LoongArch: BPF: No text_poke() for kernel text Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 531/563] LoongArch: BPF: Fix uninitialized symbol retval_off Greg Kroah-Hartman
` (46 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Vincent Li, Hengqi Chen, Huacai Chen
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengqi Chen <hengqi.chen@gmail.com>
commit 909d3e3f51b1bc00f33a484ce0d41b42fed01965 upstream.
The check for (BPF_TRAMP_F_ORIG_STACK | BPF_TRAMP_F_SHARE_IPMODIFY) is
duplicated in __arch_prepare_bpf_trampoline(). Remove it.
While at it, make sure stack_size and nargs are initialized once.
Cc: stable@vger.kernel.org
Tested-by: Vincent Li <vincent.mc.li@gmail.com>
Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/net/bpf_jit.c | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -1486,7 +1486,7 @@ static int __arch_prepare_bpf_trampoline
void *func_addr, u32 flags)
{
int i, ret, save_ret;
- int stack_size = 0, nargs = 0;
+ int stack_size, nargs;
int retval_off, args_off, nargs_off, ip_off, run_ctx_off, sreg_off, tcc_ptr_off;
bool is_struct_ops = flags & BPF_TRAMP_F_INDIRECT;
void *orig_call = func_addr;
@@ -1495,9 +1495,6 @@ static int __arch_prepare_bpf_trampoline
struct bpf_tramp_links *fmod_ret = &tlinks[BPF_TRAMP_MODIFY_RETURN];
u32 **branches = NULL;
- if (flags & (BPF_TRAMP_F_ORIG_STACK | BPF_TRAMP_F_SHARE_IPMODIFY))
- return -ENOTSUPP;
-
/*
* FP + 8 [ RA to parent func ] return address to parent
* function
@@ -1537,10 +1534,8 @@ static int __arch_prepare_bpf_trampoline
if (flags & (BPF_TRAMP_F_ORIG_STACK | BPF_TRAMP_F_SHARE_IPMODIFY))
return -ENOTSUPP;
- stack_size = 0;
-
/* Room of trampoline frame to store return address and frame pointer */
- stack_size += 16;
+ stack_size = 16;
save_ret = flags & (BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_RET_FENTRY_RET);
if (save_ret) {
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 531/563] LoongArch: BPF: Fix uninitialized symbol retval_off
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (529 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 530/563] LoongArch: BPF: Remove duplicated flags check Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 532/563] mm/ksm: fix flag-dropping behavior in ksm_madvise Greg Kroah-Hartman
` (45 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Dan Carpenter,
Huacai Chen
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhuacai@loongson.cn>
commit 7b6c2d172d023d344527d3cb4516d0d6b29f4919 upstream.
In __arch_prepare_bpf_trampoline(), retval_off is meaningful only when
save_ret is not 0, so the current logic is correct. But it may cause a
build warning:
arch/loongarch/net/bpf_jit.c:1547 __arch_prepare_bpf_trampoline() error: uninitialized symbol 'retval_off'.
So initialize retval_off unconditionally to fix it.
Cc: stable@vger.kernel.org
Fixes: f9b6b41f0cf3 ("LoongArch: BPF: Add basic bpf trampoline support")
Closes: https://lore.kernel.org/r/202508191020.PBBh07cK-lkp@intel.com/
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/net/bpf_jit.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -1538,11 +1538,10 @@ static int __arch_prepare_bpf_trampoline
stack_size = 16;
save_ret = flags & (BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_RET_FENTRY_RET);
- if (save_ret) {
- /* Save BPF R0 and A0 */
- stack_size += 16;
- retval_off = stack_size;
- }
+ if (save_ret)
+ stack_size += 16; /* Save BPF R0 and A0 */
+
+ retval_off = stack_size;
/* Room of trampoline frame to store args */
nargs = m->nr_args;
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 532/563] mm/ksm: fix flag-dropping behavior in ksm_madvise
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (530 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 531/563] LoongArch: BPF: Fix uninitialized symbol retval_off Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 533/563] ksmbd: Fix race condition in RPC handle list access Greg Kroah-Hartman
` (44 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Acs, Miguel Ojeda,
David Hildenbrand, SeongJae Park, Alice Ryhl, Xu Xin,
Chengming Zhou, Peter Xu, Axel Rasmussen, Andrew Morton
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Acs <acsjakub@amazon.de>
commit f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93 upstream.
syzkaller discovered the following crash: (kernel BUG)
[ 44.607039] ------------[ cut here ]------------
[ 44.607422] kernel BUG at mm/userfaultfd.c:2067!
[ 44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI
[ 44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproducer Not tainted 6.16.0-rc6 #1 PREEMPT(none)
[ 44.609635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460
<snip other registers, drop unreliable trace>
[ 44.617726] Call Trace:
[ 44.617926] <TASK>
[ 44.619284] userfaultfd_release+0xef/0x1b0
[ 44.620976] __fput+0x3f9/0xb60
[ 44.621240] fput_close_sync+0x110/0x210
[ 44.622222] __x64_sys_close+0x8f/0x120
[ 44.622530] do_syscall_64+0x5b/0x2f0
[ 44.622840] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 44.623244] RIP: 0033:0x7f365bb3f227
Kernel panics because it detects UFFD inconsistency during
userfaultfd_release_all(). Specifically, a VMA which has a valid pointer
to vma->vm_userfaultfd_ctx, but no UFFD flags in vma->vm_flags.
The inconsistency is caused in ksm_madvise(): when user calls madvise()
with MADV_UNMEARGEABLE on a VMA that is registered for UFFD in MINOR mode,
it accidentally clears all flags stored in the upper 32 bits of
vma->vm_flags.
Assuming x86_64 kernel build, unsigned long is 64-bit and unsigned int and
int are 32-bit wide. This setup causes the following mishap during the &=
~VM_MERGEABLE assignment.
VM_MERGEABLE is a 32-bit constant of type unsigned int, 0x8000'0000.
After ~ is applied, it becomes 0x7fff'ffff unsigned int, which is then
promoted to unsigned long before the & operation. This promotion fills
upper 32 bits with leading 0s, as we're doing unsigned conversion (and
even for a signed conversion, this wouldn't help as the leading bit is 0).
& operation thus ends up AND-ing vm_flags with 0x0000'0000'7fff'ffff
instead of intended 0xffff'ffff'7fff'ffff and hence accidentally clears
the upper 32-bits of its value.
Fix it by changing `VM_MERGEABLE` constant to unsigned long, using the
BIT() macro.
Note: other VM_* flags are not affected: This only happens to the
VM_MERGEABLE flag, as the other VM_* flags are all constants of type int
and after ~ operation, they end up with leading 1 and are thus converted
to unsigned long with leading 1s.
Note 2:
After commit 31defc3b01d9 ("userfaultfd: remove (VM_)BUG_ON()s"), this is
no longer a kernel BUG, but a WARNING at the same place:
[ 45.595973] WARNING: CPU: 1 PID: 2474 at mm/userfaultfd.c:2067
but the root-cause (flag-drop) remains the same.
[akpm@linux-foundation.org: rust bindgen wasn't able to handle BIT(), from Miguel]
Link: https://lore.kernel.org/oe-kbuild-all/202510030449.VfSaAjvd-lkp@intel.com/
Link: https://lkml.kernel.org/r/20251001090353.57523-2-acsjakub@amazon.de
Fixes: 7677f7fd8be7 ("userfaultfd: add minor fault registration mode")
Signed-off-by: Jakub Acs <acsjakub@amazon.de>
Signed-off-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: SeongJae Park <sj@kernel.org>
Tested-by: Alice Ryhl <aliceryhl@google.com>
Tested-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
Cc: Xu Xin <xu.xin16@zte.com.cn>
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Cc: Peter Xu <peterx@redhat.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/mm.h | 2 +-
rust/bindings/bindings_helper.h | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -296,7 +296,7 @@ extern unsigned int kobjsize(const void
#define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
#define VM_HUGEPAGE 0x20000000 /* MADV_HUGEPAGE marked this vma */
#define VM_NOHUGEPAGE 0x40000000 /* MADV_NOHUGEPAGE marked this vma */
-#define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
+#define VM_MERGEABLE BIT(31) /* KSM may merge identical pages */
#ifdef CONFIG_ARCH_USES_HIGH_VMA_FLAGS
#define VM_HIGH_ARCH_BIT_0 32 /* bit only usable on 64-bit architectures */
--- a/rust/bindings/bindings_helper.h
+++ b/rust/bindings/bindings_helper.h
@@ -99,3 +99,4 @@ const xa_mark_t RUST_CONST_HELPER_XA_PRE
const gfp_t RUST_CONST_HELPER_XA_FLAGS_ALLOC = XA_FLAGS_ALLOC;
const gfp_t RUST_CONST_HELPER_XA_FLAGS_ALLOC1 = XA_FLAGS_ALLOC1;
+const vm_flags_t RUST_CONST_HELPER_VM_MERGEABLE = VM_MERGEABLE;
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 533/563] ksmbd: Fix race condition in RPC handle list access
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (531 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 532/563] mm/ksm: fix flag-dropping behavior in ksm_madvise Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 534/563] ksmbd: fix error code overwriting in smb2_get_info_filesystem() Greg Kroah-Hartman
` (43 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yunseong Kim, Namjae Jeon,
Steve French
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunseong Kim <ysk@kzalloc.com>
commit 305853cce379407090a73b38c5de5ba748893aee upstream.
The 'sess->rpc_handle_list' XArray manages RPC handles within a ksmbd
session. Access to this list is intended to be protected by
'sess->rpc_lock' (an rw_semaphore). However, the locking implementation was
flawed, leading to potential race conditions.
In ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock
before calling xa_store() and xa_erase(). Since these operations modify
the XArray structure, a write lock is required to ensure exclusive access
and prevent data corruption from concurrent modifications.
Furthermore, ksmbd_session_rpc_method() accessed the list using xa_load()
without holding any lock at all. This could lead to reading inconsistent
data or a potential use-after-free if an entry is concurrently removed and
the pointer is dereferenced.
Fix these issues by:
1. Using down_write() and up_write() in ksmbd_session_rpc_open()
to ensure exclusive access during XArray modification, and ensuring
the lock is correctly released on error paths.
2. Adding down_read() and up_read() in ksmbd_session_rpc_method()
to safely protect the lookup.
Fixes: a1f46c99d9ea ("ksmbd: fix use-after-free in ksmbd_session_rpc_open")
Fixes: b685757c7b08 ("ksmbd: Implements sess->rpc_handle_list as xarray")
Cc: stable@vger.kernel.org
Signed-off-by: Yunseong Kim <ysk@kzalloc.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/mgmt/user_session.c | 26 +++++++++++++++++---------
1 file changed, 17 insertions(+), 9 deletions(-)
--- a/fs/smb/server/mgmt/user_session.c
+++ b/fs/smb/server/mgmt/user_session.c
@@ -104,29 +104,32 @@ int ksmbd_session_rpc_open(struct ksmbd_
if (!entry)
return -ENOMEM;
- down_read(&sess->rpc_lock);
entry->method = method;
entry->id = id = ksmbd_ipc_id_alloc();
if (id < 0)
goto free_entry;
+
+ down_write(&sess->rpc_lock);
old = xa_store(&sess->rpc_handle_list, id, entry, KSMBD_DEFAULT_GFP);
- if (xa_is_err(old))
+ if (xa_is_err(old)) {
+ up_write(&sess->rpc_lock);
goto free_id;
+ }
resp = ksmbd_rpc_open(sess, id);
- if (!resp)
- goto erase_xa;
+ if (!resp) {
+ xa_erase(&sess->rpc_handle_list, entry->id);
+ up_write(&sess->rpc_lock);
+ goto free_id;
+ }
- up_read(&sess->rpc_lock);
+ up_write(&sess->rpc_lock);
kvfree(resp);
return id;
-erase_xa:
- xa_erase(&sess->rpc_handle_list, entry->id);
free_id:
ksmbd_rpc_id_free(entry->id);
free_entry:
kfree(entry);
- up_read(&sess->rpc_lock);
return -EINVAL;
}
@@ -144,9 +147,14 @@ void ksmbd_session_rpc_close(struct ksmb
int ksmbd_session_rpc_method(struct ksmbd_session *sess, int id)
{
struct ksmbd_session_rpc *entry;
+ int method;
+ down_read(&sess->rpc_lock);
entry = xa_load(&sess->rpc_handle_list, id);
- return entry ? entry->method : 0;
+ method = entry ? entry->method : 0;
+ up_read(&sess->rpc_lock);
+
+ return method;
}
void ksmbd_session_destroy(struct ksmbd_session *sess)
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 534/563] ksmbd: fix error code overwriting in smb2_get_info_filesystem()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (532 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 533/563] ksmbd: Fix race condition in RPC handle list access Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 535/563] ksmbd: add max ip connections parameter Greg Kroah-Hartman
` (42 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matvey Kovalev, Namjae Jeon,
Steve French
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matvey Kovalev <matvey.kovalev@ispras.ru>
commit 88daf2f448aad05a2e6df738d66fe8b0cf85cee0 upstream.
If client doesn't negotiate with SMB3.1.1 POSIX Extensions,
then proper error code won't be returned due to overwriting.
Return error immediately.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: e2f34481b24db ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: Matvey Kovalev <matvey.kovalev@ispras.ru>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -5628,7 +5628,8 @@ static int smb2_get_info_filesystem(stru
if (!work->tcon->posix_extensions) {
pr_err("client doesn't negotiate with SMB3.1.1 POSIX Extensions\n");
- rc = -EOPNOTSUPP;
+ path_put(&path);
+ return -EOPNOTSUPP;
} else {
info = (struct filesystem_posix_info *)(rsp->Buffer);
info->OptimalTransferSize = cpu_to_le32(stfs.f_bsize);
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 535/563] ksmbd: add max ip connections parameter
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (533 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 534/563] ksmbd: fix error code overwriting in smb2_get_info_filesystem() Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 536/563] ext4: fix potential null deref in ext4_mb_init() Greg Kroah-Hartman
` (41 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Namjae Jeon, Steve French
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
commit d8b6dc9256762293048bf122fc11c4e612d0ef5d upstream.
This parameter set the maximum number of connections per ip address.
The default is 8.
Cc: stable@vger.kernel.org
Fixes: c0d41112f1a5 ("ksmbd: extend the connection limiting mechanism to support IPv6")
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/ksmbd_netlink.h | 5 +++--
fs/smb/server/server.h | 1 +
fs/smb/server/transport_ipc.c | 3 +++
fs/smb/server/transport_tcp.c | 27 ++++++++++++++++-----------
4 files changed, 23 insertions(+), 13 deletions(-)
--- a/fs/smb/server/ksmbd_netlink.h
+++ b/fs/smb/server/ksmbd_netlink.h
@@ -112,10 +112,11 @@ struct ksmbd_startup_request {
__u32 smbd_max_io_size; /* smbd read write size */
__u32 max_connections; /* Number of maximum simultaneous connections */
__s8 bind_interfaces_only;
- __s8 reserved[503]; /* Reserved room */
+ __u32 max_ip_connections; /* Number of maximum connection per ip address */
+ __s8 reserved[499]; /* Reserved room */
__u32 ifc_list_sz; /* interfaces list size */
__s8 ____payload[];
-};
+} __packed;
#define KSMBD_STARTUP_CONFIG_INTERFACES(s) ((s)->____payload)
--- a/fs/smb/server/server.h
+++ b/fs/smb/server/server.h
@@ -43,6 +43,7 @@ struct ksmbd_server_config {
unsigned int auth_mechs;
unsigned int max_connections;
unsigned int max_inflight_req;
+ unsigned int max_ip_connections;
char *conf[SERVER_CONF_WORK_GROUP + 1];
struct task_struct *dh_task;
--- a/fs/smb/server/transport_ipc.c
+++ b/fs/smb/server/transport_ipc.c
@@ -335,6 +335,9 @@ static int ipc_server_config_on_startup(
if (req->max_connections)
server_conf.max_connections = req->max_connections;
+ if (req->max_ip_connections)
+ server_conf.max_ip_connections = req->max_ip_connections;
+
ret = ksmbd_set_netbios_name(req->netbios_name);
ret |= ksmbd_set_server_string(req->server_string);
ret |= ksmbd_set_work_group(req->work_group);
--- a/fs/smb/server/transport_tcp.c
+++ b/fs/smb/server/transport_tcp.c
@@ -238,6 +238,7 @@ static int ksmbd_kthread_fn(void *p)
struct interface *iface = (struct interface *)p;
struct ksmbd_conn *conn;
int ret;
+ unsigned int max_ip_conns;
while (!kthread_should_stop()) {
mutex_lock(&iface->sock_release_lock);
@@ -255,34 +256,38 @@ static int ksmbd_kthread_fn(void *p)
continue;
}
+ if (!server_conf.max_ip_connections)
+ goto skip_max_ip_conns_limit;
+
/*
* Limits repeated connections from clients with the same IP.
*/
+ max_ip_conns = 0;
down_read(&conn_list_lock);
- list_for_each_entry(conn, &conn_list, conns_list)
+ list_for_each_entry(conn, &conn_list, conns_list) {
#if IS_ENABLED(CONFIG_IPV6)
if (client_sk->sk->sk_family == AF_INET6) {
if (memcmp(&client_sk->sk->sk_v6_daddr,
- &conn->inet6_addr, 16) == 0) {
- ret = -EAGAIN;
- break;
- }
+ &conn->inet6_addr, 16) == 0)
+ max_ip_conns++;
} else if (inet_sk(client_sk->sk)->inet_daddr ==
- conn->inet_addr) {
- ret = -EAGAIN;
- break;
- }
+ conn->inet_addr)
+ max_ip_conns++;
#else
if (inet_sk(client_sk->sk)->inet_daddr ==
- conn->inet_addr) {
+ conn->inet_addr)
+ max_ip_conns++;
+#endif
+ if (server_conf.max_ip_connections <= max_ip_conns) {
ret = -EAGAIN;
break;
}
-#endif
+ }
up_read(&conn_list_lock);
if (ret == -EAGAIN)
continue;
+skip_max_ip_conns_limit:
if (server_conf.max_connections &&
atomic_inc_return(&active_num_conn) >= server_conf.max_connections) {
pr_info_ratelimited("Limit the maximum number of connections(%u)\n",
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 536/563] ext4: fix potential null deref in ext4_mb_init()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (534 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 535/563] ksmbd: add max ip connections parameter Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 537/563] ext4: fix checks for orphan inodes Greg Kroah-Hartman
` (40 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+1713b1aa266195b916c2, stable,
Baokun Li, Zhang Yi, Ritesh Harjani (IBM), Theodore Tso
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <libaokun1@huawei.com>
commit 3c3fac6bc0a9c00dbe65d8dc0d3a282afe4d3188 upstream.
In ext4_mb_init(), ext4_mb_avg_fragment_size_destroy() may be called
when sbi->s_mb_avg_fragment_size remains uninitialized (e.g., if groupinfo
slab cache allocation fails). Since ext4_mb_avg_fragment_size_destroy()
lacks null pointer checking, this leads to a null pointer dereference.
==================================================================
EXT4-fs: no memory for groupinfo slab cache
BUG: kernel NULL pointer dereference, address: 0000000000000000
PGD 0 P4D 0
Oops: Oops: 0002 [#1] SMP PTI
CPU:2 UID: 0 PID: 87 Comm:mount Not tainted 6.17.0-rc2 #1134 PREEMPT(none)
RIP: 0010:_raw_spin_lock_irqsave+0x1b/0x40
Call Trace:
<TASK>
xa_destroy+0x61/0x130
ext4_mb_init+0x483/0x540
__ext4_fill_super+0x116d/0x17b0
ext4_fill_super+0xd3/0x280
get_tree_bdev_flags+0x132/0x1d0
vfs_get_tree+0x29/0xd0
do_new_mount+0x197/0x300
__x64_sys_mount+0x116/0x150
do_syscall_64+0x50/0x1c0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
==================================================================
Therefore, add necessary null check to ext4_mb_avg_fragment_size_destroy()
to prevent this issue. The same fix is also applied to
ext4_mb_largest_free_orders_destroy().
Reported-by: syzbot+1713b1aa266195b916c2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1713b1aa266195b916c2
Cc: stable@kernel.org
Fixes: f7eaacbb4e54 ("ext4: convert free groups order lists to xarrays")
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/mballoc.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -3655,16 +3655,26 @@ static void ext4_discard_work(struct wor
static inline void ext4_mb_avg_fragment_size_destroy(struct ext4_sb_info *sbi)
{
+ if (!sbi->s_mb_avg_fragment_size)
+ return;
+
for (int i = 0; i < MB_NUM_ORDERS(sbi->s_sb); i++)
xa_destroy(&sbi->s_mb_avg_fragment_size[i]);
+
kfree(sbi->s_mb_avg_fragment_size);
+ sbi->s_mb_avg_fragment_size = NULL;
}
static inline void ext4_mb_largest_free_orders_destroy(struct ext4_sb_info *sbi)
{
+ if (!sbi->s_mb_largest_free_orders)
+ return;
+
for (int i = 0; i < MB_NUM_ORDERS(sbi->s_sb); i++)
xa_destroy(&sbi->s_mb_largest_free_orders[i]);
+
kfree(sbi->s_mb_largest_free_orders);
+ sbi->s_mb_largest_free_orders = NULL;
}
int ext4_mb_init(struct super_block *sb)
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 537/563] ext4: fix checks for orphan inodes
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (535 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 536/563] ext4: fix potential null deref in ext4_mb_init() Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 538/563] KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isnt valid Greg Kroah-Hartman
` (39 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Jan Kara, Zhang Yi,
Theodore Tso
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit acf943e9768ec9d9be80982ca0ebc4bfd6b7631e upstream.
When orphan file feature is enabled, inode can be tracked as orphan
either in the standard orphan list or in the orphan file. The first can
be tested by checking ei->i_orphan list head, the second is recorded by
EXT4_STATE_ORPHAN_FILE inode state flag. There are several places where
we want to check whether inode is tracked as orphan and only some of
them properly check for both possibilities. Luckily the consequences are
mostly minor, the worst that can happen is that we track an inode as
orphan although we don't need to and e2fsck then complains (resulting in
occasional ext4/307 xfstest failures). Fix the problem by introducing a
helper for checking whether an inode is tracked as orphan and use it in
appropriate places.
Fixes: 4a79a98c7b19 ("ext4: Improve scalability of ext4 orphan file handling")
Cc: stable@kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Message-ID: <20250925123038.20264-2-jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/ext4.h | 10 ++++++++++
fs/ext4/file.c | 2 +-
fs/ext4/inode.c | 2 +-
fs/ext4/orphan.c | 6 +-----
fs/ext4/super.c | 4 ++--
5 files changed, 15 insertions(+), 9 deletions(-)
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1982,6 +1982,16 @@ static inline bool ext4_verity_in_progre
#define NEXT_ORPHAN(inode) EXT4_I(inode)->i_dtime
/*
+ * Check whether the inode is tracked as orphan (either in orphan file or
+ * orphan list).
+ */
+static inline bool ext4_inode_orphan_tracked(struct inode *inode)
+{
+ return ext4_test_inode_state(inode, EXT4_STATE_ORPHAN_FILE) ||
+ !list_empty(&EXT4_I(inode)->i_orphan);
+}
+
+/*
* Codes for operating systems
*/
#define EXT4_OS_LINUX 0
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -354,7 +354,7 @@ static void ext4_inode_extension_cleanup
* to cleanup the orphan list in ext4_handle_inode_extension(). Do it
* now.
*/
- if (!list_empty(&EXT4_I(inode)->i_orphan) && inode->i_nlink) {
+ if (ext4_inode_orphan_tracked(inode) && inode->i_nlink) {
handle_t *handle = ext4_journal_start(inode, EXT4_HT_INODE, 2);
if (IS_ERR(handle)) {
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4748,7 +4748,7 @@ static int ext4_fill_raw_inode(struct in
* old inodes get re-used with the upper 16 bits of the
* uid/gid intact.
*/
- if (ei->i_dtime && list_empty(&ei->i_orphan)) {
+ if (ei->i_dtime && !ext4_inode_orphan_tracked(inode)) {
raw_inode->i_uid_high = 0;
raw_inode->i_gid_high = 0;
} else {
--- a/fs/ext4/orphan.c
+++ b/fs/ext4/orphan.c
@@ -109,11 +109,7 @@ int ext4_orphan_add(handle_t *handle, st
WARN_ON_ONCE(!(inode->i_state & (I_NEW | I_FREEING)) &&
!inode_is_locked(inode));
- /*
- * Inode orphaned in orphan file or in orphan list?
- */
- if (ext4_test_inode_state(inode, EXT4_STATE_ORPHAN_FILE) ||
- !list_empty(&EXT4_I(inode)->i_orphan))
+ if (ext4_inode_orphan_tracked(inode))
return 0;
/*
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1438,9 +1438,9 @@ static void ext4_free_in_core_inode(stru
static void ext4_destroy_inode(struct inode *inode)
{
- if (!list_empty(&(EXT4_I(inode)->i_orphan))) {
+ if (ext4_inode_orphan_tracked(inode)) {
ext4_msg(inode->i_sb, KERN_ERR,
- "Inode %lu (%p): orphan list check failed!",
+ "Inode %lu (%p): inode tracked as orphan!",
inode->i_ino, EXT4_I(inode));
print_hex_dump(KERN_INFO, "", DUMP_PREFIX_ADDRESS, 16, 4,
EXT4_I(inode), sizeof(struct ext4_inode_info),
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 538/563] KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isnt valid
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (536 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 537/563] ext4: fix checks for orphan inodes Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 539/563] fbdev: simplefb: Fix use after free in simplefb_detach_genpds() Greg Kroah-Hartman
` (38 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Christopherson
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 0910dd7c9ad45a2605c45fd2bf3d1bcac087687c upstream.
Skip the WRMSR and HLT fastpaths in SVM's VM-Exit handler if the next RIP
isn't valid, e.g. because KVM is running with nrips=false. SVM must
decode and emulate to skip the instruction if the CPU doesn't provide the
next RIP, and getting the instruction bytes to decode requires reading
guest memory. Reading guest memory through the emulator can fault, i.e.
can sleep, which is disallowed since the fastpath handlers run with IRQs
disabled.
BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:106
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 32611, name: qemu
preempt_count: 1, expected: 0
INFO: lockdep is turned off.
irq event stamp: 30580
hardirqs last enabled at (30579): [<ffffffffc08b2527>] vcpu_run+0x1787/0x1db0 [kvm]
hardirqs last disabled at (30580): [<ffffffffb4f62e32>] __schedule+0x1e2/0xed0
softirqs last enabled at (30570): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210
softirqs last disabled at (30568): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210
CPU: 298 UID: 0 PID: 32611 Comm: qemu Tainted: G U 6.16.0-smp--e6c618b51cfe-sleep #782 NONE
Tainted: [U]=USER
Hardware name: Google Astoria-Turin/astoria, BIOS 0.20241223.2-0 01/17/2025
Call Trace:
<TASK>
dump_stack_lvl+0x7d/0xb0
__might_resched+0x271/0x290
__might_fault+0x28/0x80
kvm_vcpu_read_guest_page+0x8d/0xc0 [kvm]
kvm_fetch_guest_virt+0x92/0xc0 [kvm]
__do_insn_fetch_bytes+0xf3/0x1e0 [kvm]
x86_decode_insn+0xd1/0x1010 [kvm]
x86_emulate_instruction+0x105/0x810 [kvm]
__svm_skip_emulated_instruction+0xc4/0x140 [kvm_amd]
handle_fastpath_invd+0xc4/0x1a0 [kvm]
vcpu_run+0x11a1/0x1db0 [kvm]
kvm_arch_vcpu_ioctl_run+0x5cc/0x730 [kvm]
kvm_vcpu_ioctl+0x578/0x6a0 [kvm]
__se_sys_ioctl+0x6d/0xb0
do_syscall_64+0x8a/0x2c0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x7f479d57a94b
</TASK>
Note, this is essentially a reapply of commit 5c30e8101e8d ("KVM: SVM:
Skip WRMSR fastpath on VM-Exit if next RIP isn't valid"), but with
different justification (KVM now grabs SRCU when skipping the instruction
for other reasons).
Fixes: b439eb8ab578 ("Revert "KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid"")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20250805190526.1453366-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/svm/svm.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -4180,13 +4180,21 @@ static int svm_vcpu_pre_run(struct kvm_v
static fastpath_t svm_exit_handlers_fastpath(struct kvm_vcpu *vcpu)
{
struct vcpu_svm *svm = to_svm(vcpu);
+ struct vmcb_control_area *control = &svm->vmcb->control;
+
+ /*
+ * Next RIP must be provided as IRQs are disabled, and accessing guest
+ * memory to decode the instruction might fault, i.e. might sleep.
+ */
+ if (!nrips || !control->next_rip)
+ return EXIT_FASTPATH_NONE;
if (is_guest_mode(vcpu))
return EXIT_FASTPATH_NONE;
- switch (svm->vmcb->control.exit_code) {
+ switch (control->exit_code) {
case SVM_EXIT_MSR:
- if (!svm->vmcb->control.exit_info_1)
+ if (!control->exit_info_1)
break;
return handle_fastpath_set_msr_irqoff(vcpu);
case SVM_EXIT_HLT:
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 539/563] fbdev: simplefb: Fix use after free in simplefb_detach_genpds()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (537 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 538/563] KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isnt valid Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 540/563] mm: hugetlb: avoid soft lockup when mprotect to large memory area Greg Kroah-Hartman
` (37 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Huhardeaux, Janne Grunau,
Hans de Goede, Helge Deller
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janne Grunau <j@jannau.net>
commit da1bb9135213744e7ec398826c8f2e843de4fb94 upstream.
The pm_domain cleanup can not be devres managed as it uses struct
simplefb_par which is allocated within struct fb_info by
framebuffer_alloc(). This allocation is explicitly freed by
unregister_framebuffer() in simplefb_remove().
Devres managed cleanup runs after the device remove call and thus can no
longer access struct simplefb_par.
Call simplefb_detach_genpds() explicitly from simplefb_destroy() like
the cleanup functions for clocks and regulators.
Fixes an use after free on M2 Mac mini during
aperture_remove_conflicting_devices() using the downstream asahi kernel
with Debian's kernel config. For unknown reasons this started to
consistently dereference an invalid pointer in v6.16.3 based kernels.
[ 6.736134] BUG: KASAN: slab-use-after-free in simplefb_detach_genpds+0x58/0x220
[ 6.743545] Read of size 4 at addr ffff8000304743f0 by task (udev-worker)/227
[ 6.750697]
[ 6.752182] CPU: 6 UID: 0 PID: 227 Comm: (udev-worker) Tainted: G S 6.16.3-asahi+ #16 PREEMPTLAZY
[ 6.752186] Tainted: [S]=CPU_OUT_OF_SPEC
[ 6.752187] Hardware name: Apple Mac mini (M2, 2023) (DT)
[ 6.752189] Call trace:
[ 6.752190] show_stack+0x34/0x98 (C)
[ 6.752194] dump_stack_lvl+0x60/0x80
[ 6.752197] print_report+0x17c/0x4d8
[ 6.752201] kasan_report+0xb4/0x100
[ 6.752206] __asan_report_load4_noabort+0x20/0x30
[ 6.752209] simplefb_detach_genpds+0x58/0x220
[ 6.752213] devm_action_release+0x50/0x98
[ 6.752216] release_nodes+0xd0/0x2c8
[ 6.752219] devres_release_all+0xfc/0x178
[ 6.752221] device_unbind_cleanup+0x28/0x168
[ 6.752224] device_release_driver_internal+0x34c/0x470
[ 6.752228] device_release_driver+0x20/0x38
[ 6.752231] bus_remove_device+0x1b0/0x380
[ 6.752234] device_del+0x314/0x820
[ 6.752238] platform_device_del+0x3c/0x1e8
[ 6.752242] platform_device_unregister+0x20/0x50
[ 6.752246] aperture_detach_platform_device+0x1c/0x30
[ 6.752250] aperture_detach_devices+0x16c/0x290
[ 6.752253] aperture_remove_conflicting_devices+0x34/0x50
...
[ 6.752343]
[ 6.967409] Allocated by task 62:
[ 6.970724] kasan_save_stack+0x3c/0x70
[ 6.974560] kasan_save_track+0x20/0x40
[ 6.978397] kasan_save_alloc_info+0x40/0x58
[ 6.982670] __kasan_kmalloc+0xd4/0xd8
[ 6.986420] __kmalloc_noprof+0x194/0x540
[ 6.990432] framebuffer_alloc+0xc8/0x130
[ 6.994444] simplefb_probe+0x258/0x2378
...
[ 7.054356]
[ 7.055838] Freed by task 227:
[ 7.058891] kasan_save_stack+0x3c/0x70
[ 7.062727] kasan_save_track+0x20/0x40
[ 7.066565] kasan_save_free_info+0x4c/0x80
[ 7.070751] __kasan_slab_free+0x6c/0xa0
[ 7.074675] kfree+0x10c/0x380
[ 7.077727] framebuffer_release+0x5c/0x90
[ 7.081826] simplefb_destroy+0x1b4/0x2c0
[ 7.085837] put_fb_info+0x98/0x100
[ 7.089326] unregister_framebuffer+0x178/0x320
[ 7.093861] simplefb_remove+0x3c/0x60
[ 7.097611] platform_remove+0x60/0x98
[ 7.101361] device_remove+0xb8/0x160
[ 7.105024] device_release_driver_internal+0x2fc/0x470
[ 7.110256] device_release_driver+0x20/0x38
[ 7.114529] bus_remove_device+0x1b0/0x380
[ 7.118628] device_del+0x314/0x820
[ 7.122116] platform_device_del+0x3c/0x1e8
[ 7.126302] platform_device_unregister+0x20/0x50
[ 7.131012] aperture_detach_platform_device+0x1c/0x30
[ 7.136157] aperture_detach_devices+0x16c/0x290
[ 7.140779] aperture_remove_conflicting_devices+0x34/0x50
...
Reported-by: Daniel Huhardeaux <tech@tootai.net>
Cc: stable@vger.kernel.org
Fixes: 92a511a568e44 ("fbdev/simplefb: Add support for generic power-domains")
Signed-off-by: Janne Grunau <j@jannau.net>
Reviewed-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/simplefb.c | 31 +++++++++++++++++++++++--------
1 file changed, 23 insertions(+), 8 deletions(-)
--- a/drivers/video/fbdev/simplefb.c
+++ b/drivers/video/fbdev/simplefb.c
@@ -93,6 +93,7 @@ struct simplefb_par {
static void simplefb_clocks_destroy(struct simplefb_par *par);
static void simplefb_regulators_destroy(struct simplefb_par *par);
+static void simplefb_detach_genpds(void *res);
/*
* fb_ops.fb_destroy is called by the last put_fb_info() call at the end
@@ -105,6 +106,7 @@ static void simplefb_destroy(struct fb_i
simplefb_regulators_destroy(info->par);
simplefb_clocks_destroy(info->par);
+ simplefb_detach_genpds(info->par);
if (info->screen_base)
iounmap(info->screen_base);
@@ -445,13 +447,14 @@ static void simplefb_detach_genpds(void
if (!IS_ERR_OR_NULL(par->genpds[i]))
dev_pm_domain_detach(par->genpds[i], true);
}
+ par->num_genpds = 0;
}
static int simplefb_attach_genpds(struct simplefb_par *par,
struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
- unsigned int i;
+ unsigned int i, num_genpds;
int err;
err = of_count_phandle_with_args(dev->of_node, "power-domains",
@@ -465,26 +468,35 @@ static int simplefb_attach_genpds(struct
return err;
}
- par->num_genpds = err;
+ num_genpds = err;
/*
* Single power-domain devices are handled by the driver core, so
* nothing to do here.
*/
- if (par->num_genpds <= 1)
+ if (num_genpds <= 1) {
+ par->num_genpds = num_genpds;
return 0;
+ }
- par->genpds = devm_kcalloc(dev, par->num_genpds, sizeof(*par->genpds),
+ par->genpds = devm_kcalloc(dev, num_genpds, sizeof(*par->genpds),
GFP_KERNEL);
if (!par->genpds)
return -ENOMEM;
- par->genpd_links = devm_kcalloc(dev, par->num_genpds,
+ par->genpd_links = devm_kcalloc(dev, num_genpds,
sizeof(*par->genpd_links),
GFP_KERNEL);
if (!par->genpd_links)
return -ENOMEM;
+ /*
+ * Set par->num_genpds only after genpds and genpd_links are allocated
+ * to exit early from simplefb_detach_genpds() without full
+ * initialisation.
+ */
+ par->num_genpds = num_genpds;
+
for (i = 0; i < par->num_genpds; i++) {
par->genpds[i] = dev_pm_domain_attach_by_id(dev, i);
if (IS_ERR(par->genpds[i])) {
@@ -506,9 +518,10 @@ static int simplefb_attach_genpds(struct
dev_warn(dev, "failed to link power-domain %u\n", i);
}
- return devm_add_action_or_reset(dev, simplefb_detach_genpds, par);
+ return 0;
}
#else
+static void simplefb_detach_genpds(void *res) { }
static int simplefb_attach_genpds(struct simplefb_par *par,
struct platform_device *pdev)
{
@@ -622,18 +635,20 @@ static int simplefb_probe(struct platfor
ret = devm_aperture_acquire_for_platform_device(pdev, par->base, par->size);
if (ret) {
dev_err(&pdev->dev, "Unable to acquire aperture: %d\n", ret);
- goto error_regulators;
+ goto error_genpds;
}
ret = register_framebuffer(info);
if (ret < 0) {
dev_err(&pdev->dev, "Unable to register simplefb: %d\n", ret);
- goto error_regulators;
+ goto error_genpds;
}
dev_info(&pdev->dev, "fb%d: simplefb registered!\n", info->node);
return 0;
+error_genpds:
+ simplefb_detach_genpds(par);
error_regulators:
simplefb_regulators_destroy(par);
error_clocks:
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 540/563] mm: hugetlb: avoid soft lockup when mprotect to large memory area
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (538 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 539/563] fbdev: simplefb: Fix use after free in simplefb_detach_genpds() Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 541/563] selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled Greg Kroah-Hartman
` (36 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Shi, Carl Worth,
Christoph Lameter (Ampere), Catalin Marinas, David Hildenbrand,
Oscar Salvador, Anshuman Khandual, Dev Jain, Muchun Song,
Will Deacon, Andrew Morton
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Shi <yang@os.amperecomputing.com>
commit f52ce0ea90c83a28904c7cc203a70e6434adfecb upstream.
When calling mprotect() to a large hugetlb memory area in our customer's
workload (~300GB hugetlb memory), soft lockup was observed:
watchdog: BUG: soft lockup - CPU#98 stuck for 23s! [t2_new_sysv:126916]
CPU: 98 PID: 126916 Comm: t2_new_sysv Kdump: loaded Not tainted 6.17-rc7
Hardware name: GIGACOMPUTING R2A3-T40-AAV1/Jefferson CIO, BIOS 5.4.4.1 07/15/2025
pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : mte_clear_page_tags+0x14/0x24
lr : mte_sync_tags+0x1c0/0x240
sp : ffff80003150bb80
x29: ffff80003150bb80 x28: ffff00739e9705a8 x27: 0000ffd2d6a00000
x26: 0000ff8e4bc00000 x25: 00e80046cde00f45 x24: 0000000000022458
x23: 0000000000000000 x22: 0000000000000004 x21: 000000011b380000
x20: ffff000000000000 x19: 000000011b379f40 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc875e0aa5e2c
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : fffffc01ce7a5c00 x4 : 00000000046cde00 x3 : fffffc0000000000
x2 : 0000000000000004 x1 : 0000000000000040 x0 : ffff0046cde7c000
Call trace:
mte_clear_page_tags+0x14/0x24
set_huge_pte_at+0x25c/0x280
hugetlb_change_protection+0x220/0x430
change_protection+0x5c/0x8c
mprotect_fixup+0x10c/0x294
do_mprotect_pkey.constprop.0+0x2e0/0x3d4
__arm64_sys_mprotect+0x24/0x44
invoke_syscall+0x50/0x160
el0_svc_common+0x48/0x144
do_el0_svc+0x30/0xe0
el0_svc+0x30/0xf0
el0t_64_sync_handler+0xc4/0x148
el0t_64_sync+0x1a4/0x1a8
Soft lockup is not triggered with THP or base page because there is
cond_resched() called for each PMD size.
Although the soft lockup was triggered by MTE, it should be not MTE
specific. The other processing which takes long time in the loop may
trigger soft lockup too.
So add cond_resched() for hugetlb to avoid soft lockup.
Link: https://lkml.kernel.org/r/20250929202402.1663290-1-yang@os.amperecomputing.com
Fixes: 8f860591ffb2 ("[PATCH] Enable mprotect on huge pages")
Signed-off-by: Yang Shi <yang@os.amperecomputing.com>
Tested-by: Carl Worth <carl@os.amperecomputing.com>
Reviewed-by: Christoph Lameter (Ampere) <cl@gentwo.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: Oscar Salvador <osalvador@suse.de>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Reviewed-by: Dev Jain <dev.jain@arm.com>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Will Deacon <will@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/hugetlb.c | 2 ++
1 file changed, 2 insertions(+)
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -7203,6 +7203,8 @@ long hugetlb_change_protection(struct vm
psize);
}
spin_unlock(ptl);
+
+ cond_resched();
}
/*
* Must flush TLB before releasing i_mmap_rwsem: x86's huge_pmd_unshare
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 541/563] selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (539 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 540/563] mm: hugetlb: avoid soft lockup when mprotect to large memory area Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 542/563] nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() Greg Kroah-Hartman
` (35 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lance Yang, David Hildenbrand,
Lorenzo Stoakes, Shuah Khan, Gabriel Krisman Bertazi,
Andrew Morton
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lance Yang <lance.yang@linux.dev>
commit 0389c305ef56cbadca4cbef44affc0ec3213ed30 upstream.
The madv_populate and soft-dirty kselftests currently fail on systems
where CONFIG_MEM_SOFT_DIRTY is disabled.
Introduce a new helper softdirty_supported() into vm_util.c/h to ensure
tests are properly skipped when the feature is not enabled.
Link: https://lkml.kernel.org/r/20250917133137.62802-1-lance.yang@linux.dev
Fixes: 9f3265db6ae8 ("selftests: vm: add test for Soft-Dirty PTE bit")
Signed-off-by: Lance Yang <lance.yang@linux.dev>
Acked-by: David Hildenbrand <david@redhat.com>
Suggested-by: David Hildenbrand <david@redhat.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Gabriel Krisman Bertazi <krisman@collabora.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/mm/madv_populate.c | 21 ++-------------------
tools/testing/selftests/mm/soft-dirty.c | 5 ++++-
tools/testing/selftests/mm/vm_util.c | 17 +++++++++++++++++
tools/testing/selftests/mm/vm_util.h | 1 +
4 files changed, 24 insertions(+), 20 deletions(-)
--- a/tools/testing/selftests/mm/madv_populate.c
+++ b/tools/testing/selftests/mm/madv_populate.c
@@ -264,23 +264,6 @@ static void test_softdirty(void)
munmap(addr, SIZE);
}
-static int system_has_softdirty(void)
-{
- /*
- * There is no way to check if the kernel supports soft-dirty, other
- * than by writing to a page and seeing if the bit was set. But the
- * tests are intended to check that the bit gets set when it should, so
- * doing that check would turn a potentially legitimate fail into a
- * skip. Fortunately, we know for sure that arm64 does not support
- * soft-dirty. So for now, let's just use the arch as a corse guide.
- */
-#if defined(__aarch64__)
- return 0;
-#else
- return 1;
-#endif
-}
-
int main(int argc, char **argv)
{
int nr_tests = 16;
@@ -288,7 +271,7 @@ int main(int argc, char **argv)
pagesize = getpagesize();
- if (system_has_softdirty())
+ if (softdirty_supported())
nr_tests += 5;
ksft_print_header();
@@ -300,7 +283,7 @@ int main(int argc, char **argv)
test_holes();
test_populate_read();
test_populate_write();
- if (system_has_softdirty())
+ if (softdirty_supported())
test_softdirty();
err = ksft_get_fail_cnt();
--- a/tools/testing/selftests/mm/soft-dirty.c
+++ b/tools/testing/selftests/mm/soft-dirty.c
@@ -200,8 +200,11 @@ int main(int argc, char **argv)
int pagesize;
ksft_print_header();
- ksft_set_plan(15);
+ if (!softdirty_supported())
+ ksft_exit_skip("soft-dirty is not support\n");
+
+ ksft_set_plan(15);
pagemap_fd = open(PAGEMAP_FILE_PATH, O_RDONLY);
if (pagemap_fd < 0)
ksft_exit_fail_msg("Failed to open %s\n", PAGEMAP_FILE_PATH);
--- a/tools/testing/selftests/mm/vm_util.c
+++ b/tools/testing/selftests/mm/vm_util.c
@@ -426,6 +426,23 @@ bool check_vmflag_io(void *addr)
}
}
+bool softdirty_supported(void)
+{
+ char *addr;
+ bool supported = false;
+ const size_t pagesize = getpagesize();
+
+ /* New mappings are expected to be marked with VM_SOFTDIRTY (sd). */
+ addr = mmap(0, pagesize, PROT_READ | PROT_WRITE,
+ MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
+ if (!addr)
+ ksft_exit_fail_msg("mmap failed\n");
+
+ supported = check_vmflag(addr, "sd");
+ munmap(addr, pagesize);
+ return supported;
+}
+
/*
* Open an fd at /proc/$pid/maps and configure procmap_out ready for
* PROCMAP_QUERY query. Returns 0 on success, or an error code otherwise.
--- a/tools/testing/selftests/mm/vm_util.h
+++ b/tools/testing/selftests/mm/vm_util.h
@@ -99,6 +99,7 @@ bool find_vma_procmap(struct procmap_fd
int close_procmap(struct procmap_fd *procmap);
int write_sysfs(const char *file_path, unsigned long val);
int read_sysfs(const char *file_path, unsigned long *val);
+bool softdirty_supported(void);
static inline int open_self_procmap(struct procmap_fd *procmap_out)
{
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 542/563] nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (540 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 541/563] selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 543/563] misc: fastrpc: Save actual DMA size in fastrpc_map structure Greg Kroah-Hartman
` (34 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Alison Schofield,
Ira Weiny, Dave Jiang
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
commit a9e6aa994917ee602798bbb03180a194b37865bb upstream.
devm_kcalloc() may fail. ndtest_probe() allocates three DMA address
arrays (dcr_dma, label_dma, dimm_dma) and later unconditionally uses
them in ndtest_nvdimm_init(), which can lead to a NULL pointer
dereference under low-memory conditions.
Check all three allocations and return -ENOMEM if any allocation fails,
jumping to the common error path. Do not emit an extra error message
since the allocator already warns on allocation failure.
Fixes: 9399ab61ad82 ("ndtest: Add dimms to the two buses")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/nvdimm/test/ndtest.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
--- a/tools/testing/nvdimm/test/ndtest.c
+++ b/tools/testing/nvdimm/test/ndtest.c
@@ -850,11 +850,22 @@ static int ndtest_probe(struct platform_
p->dcr_dma = devm_kcalloc(&p->pdev.dev, NUM_DCR,
sizeof(dma_addr_t), GFP_KERNEL);
+ if (!p->dcr_dma) {
+ rc = -ENOMEM;
+ goto err;
+ }
p->label_dma = devm_kcalloc(&p->pdev.dev, NUM_DCR,
sizeof(dma_addr_t), GFP_KERNEL);
+ if (!p->label_dma) {
+ rc = -ENOMEM;
+ goto err;
+ }
p->dimm_dma = devm_kcalloc(&p->pdev.dev, NUM_DCR,
sizeof(dma_addr_t), GFP_KERNEL);
-
+ if (!p->dimm_dma) {
+ rc = -ENOMEM;
+ goto err;
+ }
rc = ndtest_nvdimm_init(p);
if (rc)
goto err;
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 543/563] misc: fastrpc: Save actual DMA size in fastrpc_map structure
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (541 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 542/563] nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 544/563] misc: fastrpc: Fix fastrpc_map_lookup operation Greg Kroah-Hartman
` (33 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Dmitry Baryshkov,
Ekansh Gupta, Ling Xu, Dmitry Baryshkov, Srinivas Kandagatla
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ling Xu <quic_lxu5@quicinc.com>
commit 8b5b456222fd604079b5cf2af1f25ad690f54a25 upstream.
For user passed fd buffer, map is created using DMA calls. The
map related information is stored in fastrpc_map structure. The
actual DMA size is not stored in the structure. Store the actual
size of buffer and check it against the user passed size.
Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: stable@kernel.org
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Co-developed-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Ling Xu <quic_lxu5@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://lore.kernel.org/r/20250912131236.303102-2-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/fastrpc.c | 27 ++++++++++++++++++---------
1 file changed, 18 insertions(+), 9 deletions(-)
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -323,11 +323,11 @@ static void fastrpc_free_map(struct kref
perm.vmid = QCOM_SCM_VMID_HLOS;
perm.perm = QCOM_SCM_PERM_RWX;
- err = qcom_scm_assign_mem(map->phys, map->size,
+ err = qcom_scm_assign_mem(map->phys, map->len,
&src_perms, &perm, 1);
if (err) {
dev_err(map->fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d\n",
- map->phys, map->size, err);
+ map->phys, map->len, err);
return;
}
}
@@ -758,7 +758,8 @@ static int fastrpc_map_create(struct fas
struct fastrpc_session_ctx *sess = fl->sctx;
struct fastrpc_map *map = NULL;
struct sg_table *table;
- int err = 0;
+ struct scatterlist *sgl = NULL;
+ int err = 0, sgl_index = 0;
if (!fastrpc_map_lookup(fl, fd, ppmap, true))
return 0;
@@ -798,7 +799,15 @@ static int fastrpc_map_create(struct fas
map->phys = sg_dma_address(map->table->sgl);
map->phys += ((u64)fl->sctx->sid << 32);
}
- map->size = len;
+ for_each_sg(map->table->sgl, sgl, map->table->nents,
+ sgl_index)
+ map->size += sg_dma_len(sgl);
+ if (len > map->size) {
+ dev_dbg(sess->dev, "Bad size passed len 0x%llx map size 0x%llx\n",
+ len, map->size);
+ err = -EINVAL;
+ goto map_err;
+ }
map->va = sg_virt(map->table->sgl);
map->len = len;
@@ -815,10 +824,10 @@ static int fastrpc_map_create(struct fas
dst_perms[1].vmid = fl->cctx->vmperms[0].vmid;
dst_perms[1].perm = QCOM_SCM_PERM_RWX;
map->attr = attr;
- err = qcom_scm_assign_mem(map->phys, (u64)map->size, &src_perms, dst_perms, 2);
+ err = qcom_scm_assign_mem(map->phys, (u64)map->len, &src_perms, dst_perms, 2);
if (err) {
dev_err(sess->dev, "Failed to assign memory with phys 0x%llx size 0x%llx err %d\n",
- map->phys, map->size, err);
+ map->phys, map->len, err);
goto map_err;
}
}
@@ -2046,7 +2055,7 @@ static int fastrpc_req_mem_map(struct fa
args[0].length = sizeof(req_msg);
pages.addr = map->phys;
- pages.size = map->size;
+ pages.size = map->len;
args[1].ptr = (u64) (uintptr_t) &pages;
args[1].length = sizeof(pages);
@@ -2061,7 +2070,7 @@ static int fastrpc_req_mem_map(struct fa
err = fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE, sc, &args[0]);
if (err) {
dev_err(dev, "mem mmap error, fd %d, vaddr %llx, size %lld\n",
- req.fd, req.vaddrin, map->size);
+ req.fd, req.vaddrin, map->len);
goto err_invoke;
}
@@ -2074,7 +2083,7 @@ static int fastrpc_req_mem_map(struct fa
if (copy_to_user((void __user *)argp, &req, sizeof(req))) {
/* unmap the memory and release the buffer */
req_unmap.vaddr = (uintptr_t) rsp_msg.vaddr;
- req_unmap.length = map->size;
+ req_unmap.length = map->len;
fastrpc_req_mem_unmap_impl(fl, &req_unmap);
return -EFAULT;
}
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 544/563] misc: fastrpc: Fix fastrpc_map_lookup operation
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (542 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 543/563] misc: fastrpc: Save actual DMA size in fastrpc_map structure Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 545/563] misc: fastrpc: fix possible map leak in fastrpc_put_args Greg Kroah-Hartman
` (32 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Ekansh Gupta, Ling Xu,
Dmitry Baryshkov, Srinivas Kandagatla
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ling Xu <quic_lxu5@quicinc.com>
commit 9031626ade38b092b72638dfe0c6ffce8d8acd43 upstream.
Fastrpc driver creates maps for user allocated fd buffers. Before
creating a new map, the map list is checked for any already existing
maps using map fd. Checking with just map fd is not sufficient as the
user can pass offsetted buffer with less size when the map is created
and then a larger size the next time which could result in memory
issues. Check for dma_buf object also when looking up for the map.
Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: stable@kernel.org
Co-developed-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Ling Xu <quic_lxu5@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://lore.kernel.org/r/20250912131236.303102-3-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/fastrpc.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -367,11 +367,16 @@ static int fastrpc_map_lookup(struct fas
{
struct fastrpc_session_ctx *sess = fl->sctx;
struct fastrpc_map *map = NULL;
+ struct dma_buf *buf;
int ret = -ENOENT;
+ buf = dma_buf_get(fd);
+ if (IS_ERR(buf))
+ return PTR_ERR(buf);
+
spin_lock(&fl->lock);
list_for_each_entry(map, &fl->maps, node) {
- if (map->fd != fd)
+ if (map->fd != fd || map->buf != buf)
continue;
if (take_ref) {
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 545/563] misc: fastrpc: fix possible map leak in fastrpc_put_args
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (543 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 544/563] misc: fastrpc: Fix fastrpc_map_lookup operation Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 546/563] misc: fastrpc: Skip reference for DMA handles Greg Kroah-Hartman
` (31 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Ekansh Gupta, Ling Xu,
Dmitry Baryshkov, Srinivas Kandagatla
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ling Xu <quic_lxu5@quicinc.com>
commit da1ba64176e0138f2bfa96f9e43e8c3640d01e1e upstream.
copy_to_user() failure would cause an early return without cleaning up
the fdlist, which has been updated by the DSP. This could lead to map
leak. Fix this by redirecting to a cleanup path on failure, ensuring
that all mapped buffers are properly released before returning.
Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: stable@kernel.org
Co-developed-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Ling Xu <quic_lxu5@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://lore.kernel.org/r/20250912131236.303102-4-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/fastrpc.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1085,6 +1085,7 @@ static int fastrpc_put_args(struct fastr
struct fastrpc_phy_page *pages;
u64 *fdlist;
int i, inbufs, outbufs, handles;
+ int ret = 0;
inbufs = REMOTE_SCALARS_INBUFS(ctx->sc);
outbufs = REMOTE_SCALARS_OUTBUFS(ctx->sc);
@@ -1100,14 +1101,17 @@ static int fastrpc_put_args(struct fastr
u64 len = rpra[i].buf.len;
if (!kernel) {
- if (copy_to_user((void __user *)dst, src, len))
- return -EFAULT;
+ if (copy_to_user((void __user *)dst, src, len)) {
+ ret = -EFAULT;
+ goto cleanup_fdlist;
+ }
} else {
memcpy(dst, src, len);
}
}
}
+cleanup_fdlist:
/* Clean up fdlist which is updated by DSP */
for (i = 0; i < FASTRPC_MAX_FDLIST; i++) {
if (!fdlist[i])
@@ -1116,7 +1120,7 @@ static int fastrpc_put_args(struct fastr
fastrpc_map_put(mmap);
}
- return 0;
+ return ret;
}
static int fastrpc_invoke_send(struct fastrpc_session_ctx *sctx,
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 546/563] misc: fastrpc: Skip reference for DMA handles
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (544 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 545/563] misc: fastrpc: fix possible map leak in fastrpc_put_args Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 547/563] Input: atmel_mxt_ts - allow reset GPIO to sleep Greg Kroah-Hartman
` (30 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Ekansh Gupta, Ling Xu,
Dmitry Baryshkov, Srinivas Kandagatla
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ling Xu <quic_lxu5@quicinc.com>
commit 10df039834f84a297c72ec962c0f9b7c8c5ca31a upstream.
If multiple dma handles are passed with same fd over a remote call
the kernel driver takes a reference and expects that put for the
map will be called as many times to free the map. But DSP only
updates the fd one time in the fd list when the DSP refcount
goes to zero and hence kernel make put call only once for the
fd. This can cause SMMU fault issue as the same fd can be used
in future for some other call.
Fixes: 35a82b87135d ("misc: fastrpc: Add dma handle implementation")
Cc: stable@kernel.org
Co-developed-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Ling Xu <quic_lxu5@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://lore.kernel.org/r/20250912131236.303102-5-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/fastrpc.c | 45 +++++++++++++++++++++++++++------------------
1 file changed, 27 insertions(+), 18 deletions(-)
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -363,9 +363,8 @@ static int fastrpc_map_get(struct fastrp
static int fastrpc_map_lookup(struct fastrpc_user *fl, int fd,
- struct fastrpc_map **ppmap, bool take_ref)
+ struct fastrpc_map **ppmap)
{
- struct fastrpc_session_ctx *sess = fl->sctx;
struct fastrpc_map *map = NULL;
struct dma_buf *buf;
int ret = -ENOENT;
@@ -379,15 +378,6 @@ static int fastrpc_map_lookup(struct fas
if (map->fd != fd || map->buf != buf)
continue;
- if (take_ref) {
- ret = fastrpc_map_get(map);
- if (ret) {
- dev_dbg(sess->dev, "%s: Failed to get map fd=%d ret=%d\n",
- __func__, fd, ret);
- break;
- }
- }
-
*ppmap = map;
ret = 0;
break;
@@ -757,7 +747,7 @@ static const struct dma_buf_ops fastrpc_
.release = fastrpc_release,
};
-static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
+static int fastrpc_map_attach(struct fastrpc_user *fl, int fd,
u64 len, u32 attr, struct fastrpc_map **ppmap)
{
struct fastrpc_session_ctx *sess = fl->sctx;
@@ -766,9 +756,6 @@ static int fastrpc_map_create(struct fas
struct scatterlist *sgl = NULL;
int err = 0, sgl_index = 0;
- if (!fastrpc_map_lookup(fl, fd, ppmap, true))
- return 0;
-
map = kzalloc(sizeof(*map), GFP_KERNEL);
if (!map)
return -ENOMEM;
@@ -853,6 +840,24 @@ get_err:
return err;
}
+static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
+ u64 len, u32 attr, struct fastrpc_map **ppmap)
+{
+ struct fastrpc_session_ctx *sess = fl->sctx;
+ int err = 0;
+
+ if (!fastrpc_map_lookup(fl, fd, ppmap)) {
+ if (!fastrpc_map_get(*ppmap))
+ return 0;
+ dev_dbg(sess->dev, "%s: Failed to get map fd=%d\n",
+ __func__, fd);
+ }
+
+ err = fastrpc_map_attach(fl, fd, len, attr, ppmap);
+
+ return err;
+}
+
/*
* Fastrpc payload buffer with metadata looks like:
*
@@ -925,8 +930,12 @@ static int fastrpc_create_maps(struct fa
ctx->args[i].length == 0)
continue;
- err = fastrpc_map_create(ctx->fl, ctx->args[i].fd,
- ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]);
+ if (i < ctx->nbufs)
+ err = fastrpc_map_create(ctx->fl, ctx->args[i].fd,
+ ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]);
+ else
+ err = fastrpc_map_attach(ctx->fl, ctx->args[i].fd,
+ ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]);
if (err) {
dev_err(dev, "Error Creating map %d\n", err);
return -EINVAL;
@@ -1116,7 +1125,7 @@ cleanup_fdlist:
for (i = 0; i < FASTRPC_MAX_FDLIST; i++) {
if (!fdlist[i])
break;
- if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap, false))
+ if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap))
fastrpc_map_put(mmap);
}
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 547/563] Input: atmel_mxt_ts - allow reset GPIO to sleep
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (545 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 546/563] misc: fastrpc: Skip reference for DMA handles Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 548/563] Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak Greg Kroah-Hartman
` (29 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marek Vasut, Dmitry Torokhov
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marek.vasut@mailbox.org>
commit c7866ee0a9ddd9789faadf58cdac6abd7aabf045 upstream.
The reset GPIO is not toggled in any critical section where it couldn't
sleep, allow the reset GPIO to sleep. This allows the driver to operate
reset GPIOs connected to I2C GPIO expanders.
Signed-off-by: Marek Vasut <marek.vasut@mailbox.org>
Link: https://lore.kernel.org/r/20251005023335.166483-1-marek.vasut@mailbox.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/touchscreen/atmel_mxt_ts.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -3317,7 +3317,7 @@ static int mxt_probe(struct i2c_client *
if (data->reset_gpio) {
/* Wait a while and then de-assert the RESET GPIO line */
msleep(MXT_RESET_GPIO_TIME);
- gpiod_set_value(data->reset_gpio, 0);
+ gpiod_set_value_cansleep(data->reset_gpio, 0);
msleep(MXT_RESET_INVALID_CHG);
}
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 548/563] Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (546 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 547/563] Input: atmel_mxt_ts - allow reset GPIO to sleep Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 549/563] sunrpc: fix null pointer dereference on zero-length checksum Greg Kroah-Hartman
` (28 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhen Ni, Dmitry Torokhov
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <zhen.ni@easystack.cn>
commit d3366a04770eea807f2826cbdb96934dd8c9bf79 upstream.
Struct ff_effect_compat is embedded twice inside
uinput_ff_upload_compat, contains internal padding. In particular, there
is a hole after struct ff_replay to satisfy alignment requirements for
the following union member. Without clearing the structure,
copy_to_user() may leak stack data to userspace.
Initialize ff_up_compat to zero before filling valid fields.
Fixes: 2d56f3a32c0e ("Input: refactor evdev 32bit compat to be shareable with uinput")
Cc: stable@vger.kernel.org
Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
Link: https://lore.kernel.org/r/20250928063737.74590-1-zhen.ni@easystack.cn
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/misc/uinput.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -775,6 +775,7 @@ static int uinput_ff_upload_to_user(char
if (in_compat_syscall()) {
struct uinput_ff_upload_compat ff_up_compat;
+ memset(&ff_up_compat, 0, sizeof(ff_up_compat));
ff_up_compat.request_id = ff_up->request_id;
ff_up_compat.retval = ff_up->retval;
/*
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 549/563] sunrpc: fix null pointer dereference on zero-length checksum
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (547 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 548/563] Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 550/563] PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() Greg Kroah-Hartman
` (27 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Lei Lu, Chuck Lever
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lei Lu <llfamsec@gmail.com>
commit 6df164e29bd4e6505c5a2e0e5f1e1f6957a16a42 upstream.
In xdr_stream_decode_opaque_auth(), zero-length checksum.len causes
checksum.data to be set to NULL. This triggers a NPD when accessing
checksum.data in gss_krb5_verify_mic_v2(). This patch ensures that
the value of checksum.len is not less than XDR_UNIT.
Fixes: 0653028e8f1c ("SUNRPC: Convert gss_verify_header() to use xdr_stream")
Cc: stable@kernel.org
Signed-off-by: Lei Lu <llfamsec@gmail.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/auth_gss/svcauth_gss.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -724,7 +724,7 @@ svcauth_gss_verify_header(struct svc_rqs
rqstp->rq_auth_stat = rpc_autherr_badverf;
return SVC_DENIED;
}
- if (flavor != RPC_AUTH_GSS) {
+ if (flavor != RPC_AUTH_GSS || checksum.len < XDR_UNIT) {
rqstp->rq_auth_stat = rpc_autherr_badverf;
return SVC_DENIED;
}
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 550/563] PCI/AER: Avoid NULL pointer dereference in aer_ratelimit()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (548 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 549/563] sunrpc: fix null pointer dereference on zero-length checksum Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 551/563] remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() Greg Kroah-Hartman
` (26 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Breno Leitao, Bjorn Helgaas,
Kuppuswamy Sathyanarayanan
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
commit deb2f228388ff3a9d0623e3b59a053e9235c341d upstream.
When platform firmware supplies error information to the OS, e.g., via the
ACPI APEI GHES mechanism, it may identify an error source device that
doesn't advertise an AER Capability and therefore dev->aer_info, which
contains AER stats and ratelimiting data, is NULL.
pci_dev_aer_stats_incr() already checks dev->aer_info for NULL, but
aer_ratelimit() did not, leading to NULL pointer dereferences like this one
from the URL below:
{1}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 0
{1}[Hardware Error]: event severity: corrected
{1}[Hardware Error]: device_id: 0000:00:00.0
{1}[Hardware Error]: vendor_id: 0x8086, device_id: 0x2020
{1}[Hardware Error]: aer_cor_status: 0x00001000, aer_cor_mask: 0x00002000
BUG: kernel NULL pointer dereference, address: 0000000000000264
RIP: 0010:___ratelimit+0xc/0x1b0
pci_print_aer+0x141/0x360
aer_recover_work_func+0xb5/0x130
[8086:2020] is an Intel "Sky Lake-E DMI3 Registers" device that claims to
be a Root Port but does not advertise an AER Capability.
Add a NULL check in aer_ratelimit() to avoid the NULL pointer dereference.
Note that this also prevents ratelimiting these events from GHES.
Fixes: a57f2bfb4a5863 ("PCI/AER: Ratelimit correctable and non-fatal error logging")
Link: https://lore.kernel.org/r/buduna6darbvwfg3aogl5kimyxkggu3n4romnmq6sozut6axeu@clnx7sfsy457/
Signed-off-by: Breno Leitao <leitao@debian.org>
[bhelgaas: add crash details to commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20250929-aer_crash_2-v1-1-68ec4f81c356@debian.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/pcie/aer.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/pci/pcie/aer.c
+++ b/drivers/pci/pcie/aer.c
@@ -786,6 +786,9 @@ static void pci_rootport_aer_stats_incr(
static int aer_ratelimit(struct pci_dev *dev, unsigned int severity)
{
+ if (!dev->aer_info)
+ return 1;
+
switch (severity) {
case AER_NONFATAL:
return __ratelimit(&dev->aer_info->nonfatal_ratelimit);
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 551/563] remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (549 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 550/563] PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 552/563] PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release Greg Kroah-Hartman
` (25 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhen Ni, Mathieu Poirier
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <zhen.ni@easystack.cn>
commit d41e075b077142bb9ae5df40b9ddf9fd7821a811 upstream.
pru_rproc_set_ctable() accessed rproc->priv before the IS_ERR_OR_NULL
check, which could lead to a null pointer dereference. Move the pru
assignment, ensuring we never dereference a NULL rproc pointer.
Fixes: 102853400321 ("remoteproc: pru: Add pru_rproc_set_ctable() function")
Cc: stable@vger.kernel.org
Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
Link: https://lore.kernel.org/r/20250923112109.1165126-1-zhen.ni@easystack.cn
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/remoteproc/pru_rproc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/remoteproc/pru_rproc.c
+++ b/drivers/remoteproc/pru_rproc.c
@@ -340,7 +340,7 @@ EXPORT_SYMBOL_GPL(pru_rproc_put);
*/
int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, u32 addr)
{
- struct pru_rproc *pru = rproc->priv;
+ struct pru_rproc *pru;
unsigned int reg;
u32 mask, set;
u16 idx;
@@ -352,6 +352,7 @@ int pru_rproc_set_ctable(struct rproc *r
if (!rproc->dev.parent || !is_pru_rproc(rproc->dev.parent))
return -ENODEV;
+ pru = rproc->priv;
/* pointer is 16 bit and index is 8-bit so mask out the rest */
idx_mask = (c >= PRU_C28) ? 0xFFFF : 0xFF;
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 552/563] PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (550 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 551/563] remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 553/563] thunderbolt: Fix use-after-free in tb_dp_dprx_work Greg Kroah-Hartman
` (24 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shinichiro Kawasaki,
Manivannan Sadhasivam, Damien Le Moal, Krzysztof Wilczyński
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
commit 85afa9ea122dd9d4a2ead104a951d318975dcd25 upstream.
The fields dma_chan_tx and dma_chan_rx of the struct pci_epf_test can be
NULL even after EPF initialization. Then it is prudent to check that
they have non-NULL values before releasing the channels. Add the checks
in pci_epf_test_clean_dma_chan().
Without the checks, NULL pointer dereferences happen and they can lead
to a kernel panic in some cases:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050
Call trace:
dma_release_channel+0x2c/0x120 (P)
pci_epf_test_epc_deinit+0x94/0xc0 [pci_epf_test]
pci_epc_deinit_notify+0x74/0xc0
tegra_pcie_ep_pex_rst_irq+0x250/0x5d8
irq_thread_fn+0x34/0xb8
irq_thread+0x18c/0x2e8
kthread+0x14c/0x210
ret_from_fork+0x10/0x20
Fixes: 8353813c88ef ("PCI: endpoint: Enable DMA tests for endpoints with DMA capabilities")
Fixes: 5ebf3fc59bd2 ("PCI: endpoint: functions/pci-epf-test: Add DMA support to transfer data")
Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
[mani: trimmed the stack trace]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20250916025756.34807-1-shinichiro.kawasaki@wdc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/endpoint/functions/pci-epf-test.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
--- a/drivers/pci/endpoint/functions/pci-epf-test.c
+++ b/drivers/pci/endpoint/functions/pci-epf-test.c
@@ -301,15 +301,20 @@ static void pci_epf_test_clean_dma_chan(
if (!epf_test->dma_supported)
return;
- dma_release_channel(epf_test->dma_chan_tx);
- if (epf_test->dma_chan_tx == epf_test->dma_chan_rx) {
+ if (epf_test->dma_chan_tx) {
+ dma_release_channel(epf_test->dma_chan_tx);
+ if (epf_test->dma_chan_tx == epf_test->dma_chan_rx) {
+ epf_test->dma_chan_tx = NULL;
+ epf_test->dma_chan_rx = NULL;
+ return;
+ }
epf_test->dma_chan_tx = NULL;
- epf_test->dma_chan_rx = NULL;
- return;
}
- dma_release_channel(epf_test->dma_chan_rx);
- epf_test->dma_chan_rx = NULL;
+ if (epf_test->dma_chan_rx) {
+ dma_release_channel(epf_test->dma_chan_rx);
+ epf_test->dma_chan_rx = NULL;
+ }
}
static void pci_epf_test_print_rate(struct pci_epf_test *epf_test,
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 553/563] thunderbolt: Fix use-after-free in tb_dp_dprx_work
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (551 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 552/563] PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 554/563] tee: fix register_shm_helper() Greg Kroah-Hartman
` (23 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Duoming Zhou, Mika Westerberg
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <duoming@zju.edu.cn>
commit 67600ccfc4f38ebd331b9332ac94717bfbc87ea7 upstream.
The original code relies on cancel_delayed_work() in tb_dp_dprx_stop(),
which does not ensure that the delayed work item tunnel->dprx_work has
fully completed if it was already running. This leads to use-after-free
scenarios where tb_tunnel is deallocated by tb_tunnel_put(), while
tunnel->dprx_work remains active and attempts to dereference tb_tunnel
in tb_dp_dprx_work().
A typical race condition is illustrated below:
CPU 0 | CPU 1
tb_dp_tunnel_active() |
tb_deactivate_and_free_tunnel()| tb_dp_dprx_start()
tb_tunnel_deactivate() | queue_delayed_work()
tb_dp_activate() |
tb_dp_dprx_stop() | tb_dp_dprx_work() //delayed worker
cancel_delayed_work() |
tb_tunnel_put(tunnel); |
| tunnel = container_of(...); //UAF
| tunnel-> //UAF
Replacing cancel_delayed_work() with cancel_delayed_work_sync() is
not feasible as it would introduce a deadlock: both tb_dp_dprx_work()
and the cleanup path acquire tb->lock, and cancel_delayed_work_sync()
would wait indefinitely for the work item that cannot proceed.
Instead, implement proper reference counting:
- If cancel_delayed_work() returns true (work is pending), we release
the reference in the stop function.
- If it returns false (work is executing or already completed), the
reference is released in delayed work function itself.
This ensures the tb_tunnel remains valid during work item execution
while preventing memory leaks.
This bug was found by static analysis.
Fixes: d6d458d42e1e ("thunderbolt: Handle DisplayPort tunnel activation asynchronously")
Cc: stable@vger.kernel.org
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thunderbolt/tunnel.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/thunderbolt/tunnel.c
+++ b/drivers/thunderbolt/tunnel.c
@@ -1073,6 +1073,7 @@ static void tb_dp_dprx_work(struct work_
if (tunnel->callback)
tunnel->callback(tunnel, tunnel->callback_data);
+ tb_tunnel_put(tunnel);
}
static int tb_dp_dprx_start(struct tb_tunnel *tunnel)
@@ -1100,8 +1101,8 @@ static void tb_dp_dprx_stop(struct tb_tu
if (tunnel->dprx_started) {
tunnel->dprx_started = false;
tunnel->dprx_canceled = true;
- cancel_delayed_work(&tunnel->dprx_work);
- tb_tunnel_put(tunnel);
+ if (cancel_delayed_work(&tunnel->dprx_work))
+ tb_tunnel_put(tunnel);
}
}
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 554/563] tee: fix register_shm_helper()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (552 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 553/563] thunderbolt: Fix use-after-free in tb_dp_dprx_work Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 555/563] pinctrl: check the return value of pinmux_ops::get_function_name() Greg Kroah-Hartman
` (22 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Masami Ichikawa, Jens Wiklander
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Wiklander <jens.wiklander@linaro.org>
commit d5cf5b37064b1699d946e8b7ab4ac7d7d101814c upstream.
In register_shm_helper(), fix incorrect error handling for a call to
iov_iter_extract_pages(). A case is missing for when
iov_iter_extract_pages() only got some pages and return a number larger
than 0, but not the requested amount.
This fixes a possible NULL pointer dereference following a bad input from
ioctl(TEE_IOC_SHM_REGISTER) where parts of the buffer isn't mapped.
Cc: stable@vger.kernel.org
Reported-by: Masami Ichikawa <masami256@gmail.com>
Closes: https://lore.kernel.org/op-tee/CACOXgS-Bo2W72Nj1_44c7bntyNYOavnTjJAvUbEiQfq=u9W+-g@mail.gmail.com/
Tested-by: Masami Ichikawa <masami256@gmail.com>
Fixes: 7bdee4157591 ("tee: Use iov_iter to better support shared buffer registration")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tee/tee_shm.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/tee/tee_shm.c
+++ b/drivers/tee/tee_shm.c
@@ -321,6 +321,14 @@ register_shm_helper(struct tee_context *
if (unlikely(len <= 0)) {
ret = len ? ERR_PTR(len) : ERR_PTR(-ENOMEM);
goto err_free_shm_pages;
+ } else if (DIV_ROUND_UP(len + off, PAGE_SIZE) != num_pages) {
+ /*
+ * If we only got a few pages, update to release the
+ * correct amount below.
+ */
+ shm->num_pages = len / PAGE_SIZE;
+ ret = ERR_PTR(-ENOMEM);
+ goto err_put_shm_pages;
}
/*
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 555/563] pinctrl: check the return value of pinmux_ops::get_function_name()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (553 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 554/563] tee: fix register_shm_helper() Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 556/563] bus: fsl-mc: Check return value of platform_get_resource() Greg Kroah-Hartman
` (21 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Bartosz Golaszewski,
Linus Walleij
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
commit 4002ee98c022d671ecc1e4a84029e9ae7d8a5603 upstream.
While the API contract in docs doesn't specify it explicitly, the
generic implementation of the get_function_name() callback from struct
pinmux_ops - pinmux_generic_get_function_name() - can fail and return
NULL. This is already checked in pinmux_check_ops() so add a similar
check in pinmux_func_name_to_selector() instead of passing the returned
pointer right down to strcmp() where the NULL can get dereferenced. This
is normal operation when adding new pinfunctions.
Cc: stable@vger.kernel.org
Tested-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/pinmux.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pinctrl/pinmux.c
+++ b/drivers/pinctrl/pinmux.c
@@ -337,7 +337,7 @@ static int pinmux_func_name_to_selector(
while (selector < nfuncs) {
const char *fname = ops->get_function_name(pctldev, selector);
- if (!strcmp(function, fname))
+ if (fname && !strcmp(function, fname))
return selector;
selector++;
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 556/563] bus: fsl-mc: Check return value of platform_get_resource()
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (554 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 555/563] pinctrl: check the return value of pinmux_ops::get_function_name() Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 557/563] net/9p: Fix buffer overflow in USB transport layer Greg Kroah-Hartman
` (20 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Salah Triki, Ioana Ciornei,
Christophe Leroy
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Salah Triki <salah.triki@gmail.com>
commit 25f526507b8ccc6ac3a43bc094d09b1f9b0b90ae upstream.
platform_get_resource() returns NULL in case of failure, so check its
return value and propagate the error in order to prevent NULL pointer
dereference.
Fixes: 6305166c8771 ("bus: fsl-mc: Add ACPI support for fsl-mc")
Cc: stable@vger.kernel.org
Signed-off-by: Salah Triki <salah.triki@gmail.com>
Acked-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://lore.kernel.org/r/aKwuK6TRr5XNYQ8u@pc
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bus/fsl-mc/fsl-mc-bus.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
+++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
@@ -1104,6 +1104,9 @@ static int fsl_mc_bus_probe(struct platf
* Get physical address of MC portal for the root DPRC:
*/
plat_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (!plat_res)
+ return -EINVAL;
+
mc_portal_phys_addr = plat_res->start;
mc_portal_size = resource_size(plat_res);
mc_portal_base_phys_addr = mc_portal_phys_addr & ~0x3ffffff;
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 557/563] net/9p: Fix buffer overflow in USB transport layer
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (555 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 556/563] bus: fsl-mc: Check return value of platform_get_resource() Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:46 ` [PATCH 6.17 558/563] net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock Greg Kroah-Hartman
` (19 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Dominique Martinet
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominique Martinet <asmadeus@codewreck.org>
commit c04db81cd0288dfc68b7a0f7d09bd49b40bba451 upstream.
A buffer overflow vulnerability exists in the USB 9pfs transport layer
where inconsistent size validation between packet header parsing and
actual data copying allows a malicious USB host to overflow heap buffers.
The issue occurs because:
- usb9pfs_rx_header() validates only the declared size in packet header
- usb9pfs_rx_complete() uses req->actual (actual received bytes) for
memcpy
This allows an attacker to craft packets with small declared size
(bypassing validation) but large actual payload (triggering overflow
in memcpy).
Add validation in usb9pfs_rx_complete() to ensure req->actual does not
exceed the buffer capacity before copying data.
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Closes: https://lkml.kernel.org/r/20250616132539.63434-1-danisjiang@gmail.com
Fixes: a3be076dc174 ("net/9p/usbg: Add new usb gadget function transport")
Cc: stable@vger.kernel.org
Message-ID: <20250622-9p-usb_overflow-v3-1-ab172691b946@codewreck.org>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/9p/trans_usbg.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
--- a/net/9p/trans_usbg.c
+++ b/net/9p/trans_usbg.c
@@ -231,6 +231,8 @@ static void usb9pfs_rx_complete(struct u
struct f_usb9pfs *usb9pfs = ep->driver_data;
struct usb_composite_dev *cdev = usb9pfs->function.config->cdev;
struct p9_req_t *p9_rx_req;
+ unsigned int req_size = req->actual;
+ int status = REQ_STATUS_RCVD;
if (req->status) {
dev_err(&cdev->gadget->dev, "%s usb9pfs complete --> %d, %d/%d\n",
@@ -242,11 +244,19 @@ static void usb9pfs_rx_complete(struct u
if (!p9_rx_req)
return;
- memcpy(p9_rx_req->rc.sdata, req->buf, req->actual);
+ if (req_size > p9_rx_req->rc.capacity) {
+ dev_err(&cdev->gadget->dev,
+ "%s received data size %u exceeds buffer capacity %zu\n",
+ ep->name, req_size, p9_rx_req->rc.capacity);
+ req_size = 0;
+ status = REQ_STATUS_ERROR;
+ }
+
+ memcpy(p9_rx_req->rc.sdata, req->buf, req_size);
- p9_rx_req->rc.size = req->actual;
+ p9_rx_req->rc.size = req_size;
- p9_client_cb(usb9pfs->client, p9_rx_req, REQ_STATUS_RCVD);
+ p9_client_cb(usb9pfs->client, p9_rx_req, status);
p9_req_put(usb9pfs->client, p9_rx_req);
complete(&usb9pfs->received);
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 558/563] net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (556 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 557/563] net/9p: Fix buffer overflow in USB transport layer Greg Kroah-Hartman
@ 2025-10-13 14:46 ` Greg Kroah-Hartman
2025-10-13 14:47 ` [PATCH 6.17 559/563] usb: typec: tipd: Clear interrupts first Greg Kroah-Hartman
` (18 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hubert Wiśniewski,
Marek Szyprowski, Oleksij Rempel, Paolo Abeni
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <o.rempel@pengutronix.de>
commit 3d3c4cd5c62f24bb3cb4511b7a95df707635e00a upstream.
Prevent USB runtime PM (autosuspend) for AX88772* in bind.
usbnet enables runtime PM (autosuspend) by default, so disabling it via
the usb_driver flag is ineffective. On AX88772B, autosuspend shows no
measurable power saving with current driver (no link partner, admin
up/down). The ~0.453 W -> ~0.248 W drop on v6.1 comes from phylib powering
the PHY off on admin-down, not from USB autosuspend.
The real hazard is that with runtime PM enabled, ndo_open() (under RTNL)
may synchronously trigger autoresume (usb_autopm_get_interface()) into
asix_resume() while the USB PM lock is held. Resume paths then invoke
phylink/phylib and MDIO, which also expect RTNL, leading to possible
deadlocks or PM lock vs MDIO wake issues.
To avoid this, keep the device runtime-PM active by taking a usage
reference in ax88772_bind() and dropping it in unbind(). A non-zero PM
usage count blocks runtime suspend regardless of userspace policy
(.../power/control - pm_runtime_allow/forbid), making this approach
robust against sysfs overrides.
Holding a runtime-PM usage ref does not affect system-wide suspend;
system sleep/resume callbacks continue to run as before.
Fixes: 4a2c7217cd5a ("net: usb: asix: ax88772: manage PHY PM from MAC")
Reported-by: Hubert Wiśniewski <hubert.wisniewski.25632@gmail.com>
Closes: https://lore.kernel.org/all/DCGHG5UJT9G3.2K1GHFZ3H87T0@gmail.com
Tested-by: Hubert Wiśniewski <hubert.wisniewski.25632@gmail.com>
Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
Closes: https://lore.kernel.org/all/b5ea8296-f981-445d-a09a-2f389d7f6fdd@samsung.com
Cc: stable@vger.kernel.org
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://patch.msgid.link/20251005081203.3067982-1-o.rempel@pengutronix.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/asix_devices.c | 29 +++++++++++++++++++++++++++++
1 file changed, 29 insertions(+)
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -625,6 +625,21 @@ static void ax88772_suspend(struct usbne
asix_read_medium_status(dev, 1));
}
+/* Notes on PM callbacks and locking context:
+ *
+ * - asix_suspend()/asix_resume() are invoked for both runtime PM and
+ * system-wide suspend/resume. For struct usb_driver the ->resume()
+ * callback does not receive pm_message_t, so the resume type cannot
+ * be distinguished here.
+ *
+ * - The MAC driver must hold RTNL when calling phylink interfaces such as
+ * phylink_suspend()/resume(). Those calls will also perform MDIO I/O.
+ *
+ * - Taking RTNL and doing MDIO from a runtime-PM resume callback (while
+ * the USB PM lock is held) is fragile. Since autosuspend brings no
+ * measurable power saving here, we block it by holding a PM usage
+ * reference in ax88772_bind().
+ */
static int asix_suspend(struct usb_interface *intf, pm_message_t message)
{
struct usbnet *dev = usb_get_intfdata(intf);
@@ -919,6 +934,13 @@ static int ax88772_bind(struct usbnet *d
if (ret)
goto initphy_err;
+ /* Keep this interface runtime-PM active by taking a usage ref.
+ * Prevents runtime suspend while bound and avoids resume paths
+ * that could deadlock (autoresume under RTNL while USB PM lock
+ * is held, phylink/MDIO wants RTNL).
+ */
+ pm_runtime_get_noresume(&intf->dev);
+
return 0;
initphy_err:
@@ -948,6 +970,8 @@ static void ax88772_unbind(struct usbnet
phylink_destroy(priv->phylink);
ax88772_mdio_unregister(priv);
asix_rx_fixup_common_free(dev->driver_priv);
+ /* Drop the PM usage ref taken in bind() */
+ pm_runtime_put(&intf->dev);
}
static void ax88178_unbind(struct usbnet *dev, struct usb_interface *intf)
@@ -1600,6 +1624,11 @@ static struct usb_driver asix_driver = {
.resume = asix_resume,
.reset_resume = asix_resume,
.disconnect = usbnet_disconnect,
+ /* usbnet enables autosuspend by default (supports_autosuspend=1).
+ * We keep runtime-PM active for AX88772* by taking a PM usage
+ * reference in ax88772_bind() (pm_runtime_get_noresume()) and
+ * dropping it in unbind(), which effectively blocks autosuspend.
+ */
.supports_autosuspend = 1,
.disable_hub_initiated_lpm = 1,
};
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 559/563] usb: typec: tipd: Clear interrupts first
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (557 preceding siblings ...)
2025-10-13 14:46 ` [PATCH 6.17 558/563] net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock Greg Kroah-Hartman
@ 2025-10-13 14:47 ` Greg Kroah-Hartman
2025-10-13 14:47 ` [PATCH 6.17 560/563] arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode Greg Kroah-Hartman
` (17 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Heikki Krogerus, Neal Gompa,
Sven Peter
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Peter <sven@kernel.org>
commit be5ae730ffa6fd774a00a4705c1e11e078b08ca1 upstream.
Right now the interrupt handler first reads all updated status registers
and only then clears the interrupts. It's possible that a duplicate
interrupt for a changed register or plug state comes in after the
interrupts have been processed but before they have been cleared:
* plug is inserted, TPS_REG_INT_PLUG_EVENT is set
* TPS_REG_INT_EVENT1 is read
* tps6598x_handle_plug_event() has run and registered the plug
* plug is removed again, TPS_REG_INT_PLUG_EVENT is set (again)
* TPS_REG_INT_CLEAR1 is written, TPS_REG_INT_PLUG_EVENT is cleared
We then have no plug connected and no pending interrupt but the tipd
core still thinks there is a plug. It's possible to trigger this with
e.g. a slightly broken Type-C to USB A converter.
Fix this by first clearing the interrupts and only then reading the
updated registers.
Fixes: 45188f27b3d0 ("usb: typec: tipd: Add support for Apple CD321X")
Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers")
Cc: stable@kernel.org
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Neal Gompa <neal@gompa.dev>
Signed-off-by: Sven Peter <sven@kernel.org>
Link: https://lore.kernel.org/r/20250914-apple-usb3-tipd-v1-1-4e99c8649024@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/tipd/core.c | 24 +++++++++++-------------
1 file changed, 11 insertions(+), 13 deletions(-)
--- a/drivers/usb/typec/tipd/core.c
+++ b/drivers/usb/typec/tipd/core.c
@@ -545,24 +545,23 @@ static irqreturn_t cd321x_interrupt(int
if (!event)
goto err_unlock;
+ tps6598x_write64(tps, TPS_REG_INT_CLEAR1, event);
+
if (!tps6598x_read_status(tps, &status))
- goto err_clear_ints;
+ goto err_unlock;
if (event & APPLE_CD_REG_INT_POWER_STATUS_UPDATE)
if (!tps6598x_read_power_status(tps))
- goto err_clear_ints;
+ goto err_unlock;
if (event & APPLE_CD_REG_INT_DATA_STATUS_UPDATE)
if (!tps6598x_read_data_status(tps))
- goto err_clear_ints;
+ goto err_unlock;
/* Handle plug insert or removal */
if (event & APPLE_CD_REG_INT_PLUG_EVENT)
tps6598x_handle_plug_event(tps, status);
-err_clear_ints:
- tps6598x_write64(tps, TPS_REG_INT_CLEAR1, event);
-
err_unlock:
mutex_unlock(&tps->lock);
@@ -668,25 +667,24 @@ static irqreturn_t tps6598x_interrupt(in
if (!(event1[0] | event1[1] | event2[0] | event2[1]))
goto err_unlock;
+ tps6598x_block_write(tps, TPS_REG_INT_CLEAR1, event1, intev_len);
+ tps6598x_block_write(tps, TPS_REG_INT_CLEAR2, event2, intev_len);
+
if (!tps6598x_read_status(tps, &status))
- goto err_clear_ints;
+ goto err_unlock;
if ((event1[0] | event2[0]) & TPS_REG_INT_POWER_STATUS_UPDATE)
if (!tps6598x_read_power_status(tps))
- goto err_clear_ints;
+ goto err_unlock;
if ((event1[0] | event2[0]) & TPS_REG_INT_DATA_STATUS_UPDATE)
if (!tps6598x_read_data_status(tps))
- goto err_clear_ints;
+ goto err_unlock;
/* Handle plug insert or removal */
if ((event1[0] | event2[0]) & TPS_REG_INT_PLUG_EVENT)
tps6598x_handle_plug_event(tps, status);
-err_clear_ints:
- tps6598x_block_write(tps, TPS_REG_INT_CLEAR1, event1, intev_len);
- tps6598x_block_write(tps, TPS_REG_INT_CLEAR2, event2, intev_len);
-
err_unlock:
mutex_unlock(&tps->lock);
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 560/563] arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (558 preceding siblings ...)
2025-10-13 14:47 ` [PATCH 6.17 559/563] usb: typec: tipd: Clear interrupts first Greg Kroah-Hartman
@ 2025-10-13 14:47 ` Greg Kroah-Hartman
2025-10-13 14:47 ` [PATCH 6.17 561/563] usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call Greg Kroah-Hartman
` (16 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rob Clark, Konrad Dybcio,
Dmitry Baryshkov, Bjorn Andersson
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
commit 27f94b71532203b079537180924023a5f636fca1 upstream.
2290 was found in the field to also require this quirk, as long &
high-bandwidth workloads (e.g. USB ethernet) are consistently able to
crash the controller otherwise.
The same change has been made for a number of SoCs in [1], but QCM2290
somehow escaped the list (even though the very closely related SM6115
was there).
Upon a controller crash, the log would read:
xhci-hcd.12.auto: xHCI host not responding to stop endpoint command
xhci-hcd.12.auto: xHCI host controller not responding, assume dead
xhci-hcd.12.auto: HC died; cleaning up
Add snps,parkmode-disable-ss-quirk to the DWC3 instance in order to
prevent the aforementioned breakage.
[1] https://lore.kernel.org/all/20240704152848.3380602-1-quic_kriskura@quicinc.com/
Cc: stable@vger.kernel.org
Reported-by: Rob Clark <robin.clark@oss.qualcomm.com>
Fixes: a64a0192b70c ("arm64: dts: qcom: Add initial QCM2290 device tree")
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250708-topic-2290_usb-v1-1-661e70a63339@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/qcm2290.dtsi | 1 +
1 file changed, 1 insertion(+)
--- a/arch/arm64/boot/dts/qcom/qcm2290.dtsi
+++ b/arch/arm64/boot/dts/qcom/qcm2290.dtsi
@@ -1454,6 +1454,7 @@
snps,has-lpm-erratum;
snps,hird-threshold = /bits/ 8 <0x10>;
snps,usb3_lpm_capable;
+ snps,parkmode-disable-ss-quirk;
maximum-speed = "super-speed";
dr_mode = "otg";
usb-role-switch;
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 561/563] usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (559 preceding siblings ...)
2025-10-13 14:47 ` [PATCH 6.17 560/563] arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode Greg Kroah-Hartman
@ 2025-10-13 14:47 ` Greg Kroah-Hartman
2025-10-13 14:47 ` [PATCH 6.17 562/563] scsi: ufs: core: Fix PM QoS mutex initialization Greg Kroah-Hartman
` (15 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Miaoqian Lin
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <linmq006@gmail.com>
commit e9c206324eeb213957a567a9d066bdeb355c7491 upstream.
The cdnsp-pci driver uses pcim_enable_device() to enable a PCI device,
which means the device will be automatically disabled on driver detach
through the managed device framework. The manual pci_disable_device()
call in the error path is therefore redundant.
Found via static anlaysis and this is similar to commit 99ca0b57e49f
("thermal: intel: int340x: processor: Fix warning during module unload").
Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Link: https://lore.kernel.org/r/20250903141613.2535472-1-linmq006@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/cdns3/cdnsp-pci.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
--- a/drivers/usb/cdns3/cdnsp-pci.c
+++ b/drivers/usb/cdns3/cdnsp-pci.c
@@ -85,7 +85,7 @@ static int cdnsp_pci_probe(struct pci_de
cdnsp = kzalloc(sizeof(*cdnsp), GFP_KERNEL);
if (!cdnsp) {
ret = -ENOMEM;
- goto disable_pci;
+ goto put_pci;
}
}
@@ -168,9 +168,6 @@ free_cdnsp:
if (!pci_is_enabled(func))
kfree(cdnsp);
-disable_pci:
- pci_disable_device(pdev);
-
put_pci:
pci_dev_put(func);
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 562/563] scsi: ufs: core: Fix PM QoS mutex initialization
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (560 preceding siblings ...)
2025-10-13 14:47 ` [PATCH 6.17 561/563] usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call Greg Kroah-Hartman
@ 2025-10-13 14:47 ` Greg Kroah-Hartman
2025-10-13 14:47 ` [PATCH 6.17 563/563] drm/amdgpu/vcn: Fix double-free of vcn dump buffer Greg Kroah-Hartman
` (14 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Szyprowski, Bart Van Assche,
Martin K. Petersen
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
commit 0ba7a254afd037cfc2b656f379c54b43c6e574e8 upstream.
hba->pm_qos_mutex is used very early as a part of ufshcd_init(), so it
need to be initialized before that call. This fixes the following
warning:
------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(lock->magic != lock)
WARNING: kernel/locking/mutex.c:577 at __mutex_lock+0x268/0x894, CPU#4: kworker/u32:4/72
Modules linked in:
CPU: 4 UID: 0 PID: 72 Comm: kworker/u32:4 Not tainted 6.17.0-rc7-next-20250926+ #11223 PREEMPT
Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
Workqueue: events_unbound deferred_probe_work_func
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __mutex_lock+0x268/0x894
lr : __mutex_lock+0x268/0x894
...
Call trace:
__mutex_lock+0x268/0x894 (P)
mutex_lock_nested+0x24/0x30
ufshcd_pm_qos_update+0x30/0x78
ufshcd_setup_clocks+0x2d4/0x3c4
ufshcd_init+0x234/0x126c
ufshcd_pltfrm_init+0x62c/0x82c
ufs_qcom_probe+0x20/0x58
platform_probe+0x5c/0xac
really_probe+0xbc/0x298
__driver_probe_device+0x78/0x12c
driver_probe_device+0x40/0x164
__device_attach_driver+0xb8/0x138
bus_for_each_drv+0x80/0xdc
__device_attach+0xa8/0x1b0
device_initial_probe+0x14/0x20
bus_probe_device+0xb0/0xb4
deferred_probe_work_func+0x8c/0xc8
process_one_work+0x208/0x60c
worker_thread+0x244/0x388
kthread+0x150/0x228
ret_from_fork+0x10/0x20
irq event stamp: 57267
hardirqs last enabled at (57267): [<ffffd761485e868c>] _raw_spin_unlock_irqrestore+0x74/0x78
hardirqs last disabled at (57266): [<ffffd76147b13c44>] clk_enable_lock+0x7c/0xf0
softirqs last enabled at (56270): [<ffffd7614734446c>] handle_softirqs+0x4c4/0x4dc
softirqs last disabled at (56265): [<ffffd76147290690>] __do_softirq+0x14/0x20
---[ end trace 0000000000000000 ]---
Fixes: 79dde5f7dc7c ("scsi: ufs: core: Fix data race in CPU latency PM QoS request handling")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Message-Id: <20250929112730.3782765-1-m.szyprowski@samsung.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ufs/core/ufshcd.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -10674,6 +10674,9 @@ int ufshcd_init(struct ufs_hba *hba, voi
*/
spin_lock_init(&hba->clk_gating.lock);
+ /* Initialize mutex for PM QoS request synchronization */
+ mutex_init(&hba->pm_qos_mutex);
+
/*
* Set the default power management level for runtime and system PM.
* Host controller drivers can override them in their
@@ -10762,9 +10765,6 @@ int ufshcd_init(struct ufs_hba *hba, voi
mutex_init(&hba->wb_mutex);
- /* Initialize mutex for PM QoS request synchronization */
- mutex_init(&hba->pm_qos_mutex);
-
init_rwsem(&hba->clk_scaling_lock);
ufshcd_init_clk_gating(hba);
^ permalink raw reply [flat|nested] 591+ messages in thread* [PATCH 6.17 563/563] drm/amdgpu/vcn: Fix double-free of vcn dump buffer
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (561 preceding siblings ...)
2025-10-13 14:47 ` [PATCH 6.17 562/563] scsi: ufs: core: Fix PM QoS mutex initialization Greg Kroah-Hartman
@ 2025-10-13 14:47 ` Greg Kroah-Hartman
2025-10-13 16:09 ` [PATCH 6.17 000/563] 6.17.3-rc1 review Ronald Warsow
` (13 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-13 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lijo Lazar, Sathishkumar S,
Alex Deucher
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <lijo.lazar@amd.com>
commit 1a0e57eb96c3fca338665ffd7d9b59f351e5fea7 upstream.
The buffer is already freed as part of amdgpu_vcn_reg_dump_fini(). The
issue is introduced by below patch series.
Fixes: de55cbff5ce9 ("drm/amdgpu/vcn: Add regdump helper functions")
Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Sathishkumar S <sathishkumar.sundararaju@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 1 +
drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 1 -
drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c | 2 --
drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c | 2 --
4 files changed, 1 insertion(+), 5 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
@@ -1573,6 +1573,7 @@ int amdgpu_vcn_reg_dump_init(struct amdg
static void amdgpu_vcn_reg_dump_fini(struct amdgpu_device *adev)
{
kfree(adev->vcn.ip_dump);
+ adev->vcn.ip_dump = NULL;
adev->vcn.reg_list = NULL;
adev->vcn.reg_count = 0;
}
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
@@ -361,7 +361,6 @@ static int vcn_v3_0_sw_fini(struct amdgp
return r;
}
- kfree(adev->vcn.ip_dump);
return 0;
}
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
@@ -287,8 +287,6 @@ static int vcn_v4_0_3_sw_fini(struct amd
return r;
}
- kfree(adev->vcn.ip_dump);
-
return 0;
}
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c
@@ -284,8 +284,6 @@ static int vcn_v4_0_5_sw_fini(struct amd
return r;
}
- kfree(adev->vcn.ip_dump);
-
return 0;
}
^ permalink raw reply [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 000/563] 6.17.3-rc1 review
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (562 preceding siblings ...)
2025-10-13 14:47 ` [PATCH 6.17 563/563] drm/amdgpu/vcn: Fix double-free of vcn dump buffer Greg Kroah-Hartman
@ 2025-10-13 16:09 ` Ronald Warsow
2025-10-13 17:05 ` Brett A C Sheffield
` (12 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Ronald Warsow @ 2025-10-13 16:09 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
conor, hargar, broonie, achill
Hi
no regressions here on x86_64 (RKL, Intel 11th Gen. CPU)
Thanks
Tested-by: Ronald Warsow <rwarsow@gmx.de>
^ permalink raw reply [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 000/563] 6.17.3-rc1 review
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (563 preceding siblings ...)
2025-10-13 16:09 ` [PATCH 6.17 000/563] 6.17.3-rc1 review Ronald Warsow
@ 2025-10-13 17:05 ` Brett A C Sheffield
2025-10-13 17:09 ` Florian Fainelli
` (11 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Brett A C Sheffield @ 2025-10-13 17:05 UTC (permalink / raw)
To: gregkh
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill,
Brett A C Sheffield
# Librecast Test Results
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.17.3-rc1-g99cf54e7bd2f #106 SMP PREEMPT_DYNAMIC Mon Oct 13 16:44:03 -00 2025 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Tested-by: Brett A C Sheffield <bacs@librecast.net>
^ permalink raw reply [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 000/563] 6.17.3-rc1 review
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (564 preceding siblings ...)
2025-10-13 17:05 ` Brett A C Sheffield
@ 2025-10-13 17:09 ` Florian Fainelli
2025-10-14 3:18 ` Peter Schneider
` (10 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Florian Fainelli @ 2025-10-13 17:09 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, rwarsow, conor,
hargar, broonie, achill
On 10/13/25 07:37, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.17.3 release.
> There are 563 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 15 Oct 2025 14:42:41 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.17.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on
BMIPS_GENERIC:
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 000/563] 6.17.3-rc1 review
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (565 preceding siblings ...)
2025-10-13 17:09 ` Florian Fainelli
@ 2025-10-14 3:18 ` Peter Schneider
2025-10-14 3:40 ` Takeshi Ogasawara
` (9 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Peter Schneider @ 2025-10-14 3:18 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill
Am 13.10.2025 um 16:37 schrieb Greg Kroah-Hartman:
> This is the start of the stable review cycle for the 6.17.3 release.
> There are 563 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Tested-by: Peter Schneider <pschneider1968@googlemail.com>
Beste Grüße,
Peter Schneider
--
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you. -- David McCullough Jr.
OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com
^ permalink raw reply [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 000/563] 6.17.3-rc1 review
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (566 preceding siblings ...)
2025-10-14 3:18 ` Peter Schneider
@ 2025-10-14 3:40 ` Takeshi Ogasawara
2025-10-14 7:58 ` Naresh Kamboju
` (8 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Takeshi Ogasawara @ 2025-10-14 3:40 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill
Hi Greg
On Tue, Oct 14, 2025 at 12:33 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.17.3 release.
> There are 563 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 15 Oct 2025 14:42:41 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.17.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
6.17.3-rc1 tested.
Build successfully completed.
Boot successfully completed.
No dmesg regressions.
Video output normal.
Sound output normal.
Lenovo ThinkPad X1 Carbon Gen10(Intel i7-1260P(x86_64) arch linux)
[ 0.000000] Linux version 6.17.3-rc1rv-g99cf54e7bd2f
(takeshi@ThinkPadX1Gen10J0764) (gcc (GCC) 15.2.1 20250813, GNU ld (GNU
Binutils) 2.45.0) #1 SMP PREEMPT_DYNAMIC Tue Oct 14 12:16:46 JST 2025
Thanks
Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com>
^ permalink raw reply [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 000/563] 6.17.3-rc1 review
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (567 preceding siblings ...)
2025-10-14 3:40 ` Takeshi Ogasawara
@ 2025-10-14 7:58 ` Naresh Kamboju
2025-10-14 8:13 ` Pascal Ernster
` (7 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Naresh Kamboju @ 2025-10-14 7:58 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill
On Mon, 13 Oct 2025 at 20:50, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.17.3 release.
> There are 563 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 15 Oct 2025 14:42:41 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.17.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
## Build
* kernel: 6.17.3-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: 99cf54e7bd2fde42d75c71b54fb3652adea2e7a4
* git describe: v6.17.2-564-g99cf54e7bd2f
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.17.y/build/v6.17.2-564-g99cf54e7bd2f
## Test Regressions (compared to v6.17-43-g8902adbbfd36)
## Metric Regressions (compared to v6.17-43-g8902adbbfd36)
## Test Fixes (compared to v6.17-43-g8902adbbfd36)
## Metric Fixes (compared to v6.17-43-g8902adbbfd36)
## Test result summary
total: 150604, pass: 129081, fail: 4610, skip: 16913, xfail: 0
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 139 total, 138 passed, 1 failed
* arm64: 57 total, 51 passed, 6 failed
* i386: 18 total, 18 passed, 0 failed
* mips: 34 total, 33 passed, 1 failed
* parisc: 4 total, 4 passed, 0 failed
* powerpc: 40 total, 39 passed, 1 failed
* riscv: 25 total, 24 passed, 1 failed
* s390: 22 total, 21 passed, 1 failed
* sh: 5 total, 5 passed, 0 failed
* sparc: 4 total, 3 passed, 1 failed
* x86_64: 49 total, 46 passed, 3 failed
## Test suites summary
* boot
* commands
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-exec
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-kcmp
* kselftest-kvm
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-mincore
* kselftest-mm
* kselftest-mqueue
* kselftest-net
* kselftest-net-mptcp
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-rust
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-x86
* kunit
* kvm-unit-tests
* lava
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-build-clang
* log-parser-build-gcc
* log-parser-test
* ltp-capability
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
* rt-tests-cyclicdeadline
* rt-tests-pi-stress
* rt-tests-pmqtest
* rt-tests-rt-migrate-test
* rt-tests-signaltest
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 000/563] 6.17.3-rc1 review
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (568 preceding siblings ...)
2025-10-14 7:58 ` Naresh Kamboju
@ 2025-10-14 8:13 ` Pascal Ernster
2025-10-14 9:47 ` Dileep malepu
` (6 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Pascal Ernster @ 2025-10-14 8:13 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill
[2025-10-13 16:37] Greg Kroah-Hartman:
> This is the start of the stable review cycle for the 6.17.3 release.
> There are 563 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 15 Oct 2025 14:42:41 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.17.y
> and the diffstat can be found below.
Kernel 6.17.3-rc1 compiles fine for x86_64 using GCC 15.2.1+r22+gc4e96a094636 and binutils 2.45+r29+g2b2e51a31ec7, and the resulting kernel boots and runs without any discernible issues on various physical machines of mine (Ivy Bridge, Haswell, Kaby Lake, Coffee Lake) and on a Zen 2 VM and a bunch of Kaby Lake VMs.
Tested-by: Pascal Ernster <git@hardfalcon.net>
^ permalink raw reply [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 000/563] 6.17.3-rc1 review
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (569 preceding siblings ...)
2025-10-14 8:13 ` Pascal Ernster
@ 2025-10-14 9:47 ` Dileep malepu
2025-10-14 10:43 ` Ron Economos
` (5 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Dileep malepu @ 2025-10-14 9:47 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill
Hiii Greg,
On Mon, Oct 13, 2025 at 9:29 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.17.3 release.
> There are 563 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 15 Oct 2025 14:42:41 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.17.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
Build and boot tested 6.17.3-rc1 using qemu-x86_64. The kernel was
successfully built and booted in a virtualized environment without any
issues.
Build
kernel: 6.17.1-rc1
git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git commit: 99cf54e7bd2fde42d75c71b54fb3652adea2e7a4
Tested-by: Dileep Malepu <dileep.debian@gmail.com>
Best regards
Dileep Malepu.
^ permalink raw reply [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 000/563] 6.17.3-rc1 review
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (570 preceding siblings ...)
2025-10-14 9:47 ` Dileep malepu
@ 2025-10-14 10:43 ` Ron Economos
2025-10-14 13:09 ` Jon Hunter
` (4 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Ron Economos @ 2025-10-14 10:43 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill
On 10/13/25 07:37, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.17.3 release.
> There are 563 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 15 Oct 2025 14:42:41 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.17.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Tested-by: Ron Economos <re@w6rz.net>
^ permalink raw reply [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 000/563] 6.17.3-rc1 review
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (571 preceding siblings ...)
2025-10-14 10:43 ` Ron Economos
@ 2025-10-14 13:09 ` Jon Hunter
2025-10-14 16:58 ` Shuah Khan
` (3 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Jon Hunter @ 2025-10-14 13:09 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill,
linux-tegra, stable
On Mon, 13 Oct 2025 16:37:41 +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.17.3 release.
> There are 563 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 15 Oct 2025 14:42:41 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.17.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
All tests passing for Tegra ...
Test results for stable-v6.17:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
120 tests: 120 pass, 0 fail
Linux version: 6.17.3-rc1-g99cf54e7bd2f
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Jon
^ permalink raw reply [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 000/563] 6.17.3-rc1 review
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (572 preceding siblings ...)
2025-10-14 13:09 ` Jon Hunter
@ 2025-10-14 16:58 ` Shuah Khan
2025-10-14 18:15 ` Miguel Ojeda
` (2 subsequent siblings)
576 siblings, 0 replies; 591+ messages in thread
From: Shuah Khan @ 2025-10-14 16:58 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, Shuah Khan
On 10/13/25 08:37, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.17.3 release.
> There are 563 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 15 Oct 2025 14:42:41 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.17.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 000/563] 6.17.3-rc1 review
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (573 preceding siblings ...)
2025-10-14 16:58 ` Shuah Khan
@ 2025-10-14 18:15 ` Miguel Ojeda
2025-10-14 22:19 ` Justin Forbes
2025-10-17 18:03 ` Guenter Roeck
576 siblings, 0 replies; 591+ messages in thread
From: Miguel Ojeda @ 2025-10-14 18:15 UTC (permalink / raw)
To: gregkh
Cc: achill, akpm, broonie, conor, f.fainelli, hargar, jonathanh,
linux-kernel, linux, lkft-triage, patches, patches, pavel,
rwarsow, shuah, stable, sudipm.mukherjee, torvalds, Miguel Ojeda
On Mon, 13 Oct 2025 16:37:41 +0200 Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.17.3 release.
> There are 563 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 15 Oct 2025 14:42:41 +0000.
> Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64, arm64 and riscv64; built-tested
for arm and loongarch64:
Tested-by: Miguel Ojeda <ojeda@kernel.org>
Thanks!
Cheers,
Miguel
^ permalink raw reply [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 000/563] 6.17.3-rc1 review
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (574 preceding siblings ...)
2025-10-14 18:15 ` Miguel Ojeda
@ 2025-10-14 22:19 ` Justin Forbes
2025-10-17 18:03 ` Guenter Roeck
576 siblings, 0 replies; 591+ messages in thread
From: Justin Forbes @ 2025-10-14 22:19 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill
On Mon, Oct 13, 2025 at 04:37:41PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.17.3 release.
> There are 563 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 15 Oct 2025 14:42:41 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.17.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Tested rc1 against the Fedora build system (aarch64, ppc64le, s390x,
x86_64), and boot tested x86_64. No regressions noted.
Tested-by: Justin M. Forbes <jforbes@fedoraproject.org>
^ permalink raw reply [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 000/563] 6.17.3-rc1 review
2025-10-13 14:37 [PATCH 6.17 000/563] 6.17.3-rc1 review Greg Kroah-Hartman
` (575 preceding siblings ...)
2025-10-14 22:19 ` Justin Forbes
@ 2025-10-17 18:03 ` Guenter Roeck
2025-10-22 13:08 ` Nathan Chancellor
576 siblings, 1 reply; 591+ messages in thread
From: Guenter Roeck @ 2025-10-17 18:03 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill
On 10/13/25 07:37, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.17.3 release.
> There are 563 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 15 Oct 2025 14:42:41 +0000.
> Anything received after that time might be too late.
>
Building m68k:allmodconfig ... failed
--------------
Error log:
drivers/vfio/cdx/intr.c: In function 'vfio_cdx_msi_enable':
drivers/vfio/cdx/intr.c:41:15: error: implicit declaration of function 'msi_domain_alloc_irqs'; did you mean 'msi_domain_get_virq'? [-Wimplicit-function-declaration]
41 | ret = msi_domain_alloc_irqs(dev, MSI_DEFAULT_DOMAIN, nvec);
| ^~~~~~~~~~~~~~~~~~~~~
| msi_domain_get_virq
drivers/vfio/cdx/intr.c: In function 'vfio_cdx_msi_disable':
drivers/vfio/cdx/intr.c:135:9: error: implicit declaration of function 'msi_domain_free_irqs_all' [-Wimplicit-function-declaration]
135 | msi_domain_free_irqs_all(dev, MSI_DEFAULT_DOMAIN);
Bisect results below.
Guenter
---
# bad: [17e9266e1aff69de51dbd554c8dad36c4cfef0bd] Linux 6.17.3
# good: [449d48b1b99fdaa076166e200132705ac2bee711] Linux 6.17.2
git bisect start 'HEAD' 'v6.17.2'
# bad: [8e0a18d6ee733f4fc77bc05d73f28dba33914ccb] accel/amdxdna: Use int instead of u32 to store error codes
git bisect bad 8e0a18d6ee733f4fc77bc05d73f28dba33914ccb
# good: [6b4eacd05f6b96dabc2d26b753f2bc4e39094f82] Revert "arm64: dts: ti: k3-j721e-beagleboneai64: Fix reversed C6x carveout locations"
git bisect good 6b4eacd05f6b96dabc2d26b753f2bc4e39094f82
# good: [f74032d51f93114e361f17d9919d12d6036f3687] mfd: max77705: Setup the core driver as an interrupt controller
git bisect good f74032d51f93114e361f17d9919d12d6036f3687
# good: [83ced3c206c292458e47c7fac54223abc7141585] scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
git bisect good 83ced3c206c292458e47c7fac54223abc7141585
# good: [2ca40698d2d78da82b6450968ab6a8b606a90304] drm/panel: Allow powering on panel follower after panel is enabled
git bisect good 2ca40698d2d78da82b6450968ab6a8b606a90304
# good: [03f3cd82ec4d88905e53ed60ece681266d54c000] PCI: qcom: Restrict port parsing only to PCIe bridge child nodes
git bisect good 03f3cd82ec4d88905e53ed60ece681266d54c000
# bad: [5e6ebfc78c11ff4ffe01aed73555a6c97c866300] ALSA: lx_core: use int type to store negative error codes
git bisect bad 5e6ebfc78c11ff4ffe01aed73555a6c97c866300
# bad: [ab6cfdfd8bd76367828cc952d57120436a076258] PCI/ACPI: Fix pci_acpi_preserve_config() memory leak
git bisect bad ab6cfdfd8bd76367828cc952d57120436a076258
# bad: [db05b70c5d4c34c748e25697bf7489b909d1d71a] cdx: don't select CONFIG_GENERIC_MSI_IRQ
git bisect bad db05b70c5d4c34c748e25697bf7489b909d1d71a
# first bad commit: [db05b70c5d4c34c748e25697bf7489b909d1d71a] cdx: don't select CONFIG_GENERIC_MSI_IRQ
^ permalink raw reply [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 000/563] 6.17.3-rc1 review
2025-10-17 18:03 ` Guenter Roeck
@ 2025-10-22 13:08 ` Nathan Chancellor
2025-10-23 15:37 ` Greg Kroah-Hartman
0 siblings, 1 reply; 591+ messages in thread
From: Nathan Chancellor @ 2025-10-22 13:08 UTC (permalink / raw)
To: Guenter Roeck
Cc: Greg Kroah-Hartman, stable, patches, linux-kernel, torvalds, akpm,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill
On Fri, Oct 17, 2025 at 11:03:47AM -0700, Guenter Roeck wrote:
> On 10/13/25 07:37, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 6.17.3 release.
> > There are 563 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed, 15 Oct 2025 14:42:41 +0000.
> > Anything received after that time might be too late.
> >
>
> Building m68k:allmodconfig ... failed
> --------------
> Error log:
> drivers/vfio/cdx/intr.c: In function 'vfio_cdx_msi_enable':
> drivers/vfio/cdx/intr.c:41:15: error: implicit declaration of function 'msi_domain_alloc_irqs'; did you mean 'msi_domain_get_virq'? [-Wimplicit-function-declaration]
> 41 | ret = msi_domain_alloc_irqs(dev, MSI_DEFAULT_DOMAIN, nvec);
> | ^~~~~~~~~~~~~~~~~~~~~
> | msi_domain_get_virq
> drivers/vfio/cdx/intr.c: In function 'vfio_cdx_msi_disable':
> drivers/vfio/cdx/intr.c:135:9: error: implicit declaration of function 'msi_domain_free_irqs_all' [-Wimplicit-function-declaration]
> 135 | msi_domain_free_irqs_all(dev, MSI_DEFAULT_DOMAIN);
...
> # first bad commit: [db05b70c5d4c34c748e25697bf7489b909d1d71a] cdx: don't select CONFIG_GENERIC_MSI_IRQ
Our CI sees this as well with ARCH=hexagon allmodconfig. Commit
9f3acb3d9a18 ("vfio/cdx: update driver to build without
CONFIG_GENERIC_MSI_IRQ") resolves this for me.
Cheers,
Nathan
^ permalink raw reply [flat|nested] 591+ messages in thread* Re: [PATCH 6.17 000/563] 6.17.3-rc1 review
2025-10-22 13:08 ` Nathan Chancellor
@ 2025-10-23 15:37 ` Greg Kroah-Hartman
0 siblings, 0 replies; 591+ messages in thread
From: Greg Kroah-Hartman @ 2025-10-23 15:37 UTC (permalink / raw)
To: Nathan Chancellor
Cc: Guenter Roeck, stable, patches, linux-kernel, torvalds, akpm,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill
On Wed, Oct 22, 2025 at 03:08:52PM +0200, Nathan Chancellor wrote:
> On Fri, Oct 17, 2025 at 11:03:47AM -0700, Guenter Roeck wrote:
> > On 10/13/25 07:37, Greg Kroah-Hartman wrote:
> > > This is the start of the stable review cycle for the 6.17.3 release.
> > > There are 563 patches in this series, all will be posted as a response
> > > to this one. If anyone has any issues with these being applied, please
> > > let me know.
> > >
> > > Responses should be made by Wed, 15 Oct 2025 14:42:41 +0000.
> > > Anything received after that time might be too late.
> > >
> >
> > Building m68k:allmodconfig ... failed
> > --------------
> > Error log:
> > drivers/vfio/cdx/intr.c: In function 'vfio_cdx_msi_enable':
> > drivers/vfio/cdx/intr.c:41:15: error: implicit declaration of function 'msi_domain_alloc_irqs'; did you mean 'msi_domain_get_virq'? [-Wimplicit-function-declaration]
> > 41 | ret = msi_domain_alloc_irqs(dev, MSI_DEFAULT_DOMAIN, nvec);
> > | ^~~~~~~~~~~~~~~~~~~~~
> > | msi_domain_get_virq
> > drivers/vfio/cdx/intr.c: In function 'vfio_cdx_msi_disable':
> > drivers/vfio/cdx/intr.c:135:9: error: implicit declaration of function 'msi_domain_free_irqs_all' [-Wimplicit-function-declaration]
> > 135 | msi_domain_free_irqs_all(dev, MSI_DEFAULT_DOMAIN);
> ...
> > # first bad commit: [db05b70c5d4c34c748e25697bf7489b909d1d71a] cdx: don't select CONFIG_GENERIC_MSI_IRQ
>
> Our CI sees this as well with ARCH=hexagon allmodconfig. Commit
> 9f3acb3d9a18 ("vfio/cdx: update driver to build without
> CONFIG_GENERIC_MSI_IRQ") resolves this for me.
Now queued up,t hanks.
greg k-h
^ permalink raw reply [flat|nested] 591+ messages in thread