* [PATCH 6.1 001/568] net/sched: sch_qfq: Fix null-deref in agg_dequeue
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 002/568] perf: Have get_perf_callchain() return NULL if crosstask and user are set Greg Kroah-Hartman
` (573 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xiang Mei, Cong Wang, Paolo Abeni
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
commit dd831ac8221e691e9e918585b1003c7071df0379 upstream.
To prevent a potential crash in agg_dequeue (net/sched/sch_qfq.c)
when cl->qdisc->ops->peek(cl->qdisc) returns NULL, we check the return
value before using it, similar to the existing approach in sch_hfsc.c.
To avoid code duplication, the following changes are made:
1. Changed qdisc_warn_nonwc(include/net/pkt_sched.h) into a static
inline function.
2. Moved qdisc_peek_len from net/sched/sch_hfsc.c to
include/net/pkt_sched.h so that sch_qfq can reuse it.
3. Applied qdisc_peek_len in agg_dequeue to avoid crashing.
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com>
Link: https://patch.msgid.link/20250705212143.3982664-1-xmei5@asu.edu
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/pkt_sched.h | 25 ++++++++++++++++++++++++-
net/sched/sch_api.c | 10 ----------
net/sched/sch_hfsc.c | 16 ----------------
net/sched/sch_qfq.c | 2 +-
4 files changed, 25 insertions(+), 28 deletions(-)
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -113,7 +113,6 @@ struct qdisc_rate_table *qdisc_get_rtab(
struct netlink_ext_ack *extack);
void qdisc_put_rtab(struct qdisc_rate_table *tab);
void qdisc_put_stab(struct qdisc_size_table *tab);
-void qdisc_warn_nonwc(const char *txt, struct Qdisc *qdisc);
bool sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q,
struct net_device *dev, struct netdev_queue *txq,
spinlock_t *root_lock, bool validate);
@@ -247,4 +246,28 @@ static inline bool tc_qdisc_stats_dump(s
return true;
}
+static inline void qdisc_warn_nonwc(const char *txt, struct Qdisc *qdisc)
+{
+ if (!(qdisc->flags & TCQ_F_WARN_NONWC)) {
+ pr_warn("%s: %s qdisc %X: is non-work-conserving?\n",
+ txt, qdisc->ops->id, qdisc->handle >> 16);
+ qdisc->flags |= TCQ_F_WARN_NONWC;
+ }
+}
+
+static inline unsigned int qdisc_peek_len(struct Qdisc *sch)
+{
+ struct sk_buff *skb;
+ unsigned int len;
+
+ skb = sch->ops->peek(sch);
+ if (unlikely(skb == NULL)) {
+ qdisc_warn_nonwc("qdisc_peek_len", sch);
+ return 0;
+ }
+ len = qdisc_pkt_len(skb);
+
+ return len;
+}
+
#endif
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -598,16 +598,6 @@ out:
qdisc_skb_cb(skb)->pkt_len = pkt_len;
}
-void qdisc_warn_nonwc(const char *txt, struct Qdisc *qdisc)
-{
- if (!(qdisc->flags & TCQ_F_WARN_NONWC)) {
- pr_warn("%s: %s qdisc %X: is non-work-conserving?\n",
- txt, qdisc->ops->id, qdisc->handle >> 16);
- qdisc->flags |= TCQ_F_WARN_NONWC;
- }
-}
-EXPORT_SYMBOL(qdisc_warn_nonwc);
-
static enum hrtimer_restart qdisc_watchdog(struct hrtimer *timer)
{
struct qdisc_watchdog *wd = container_of(timer, struct qdisc_watchdog,
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -836,22 +836,6 @@ update_vf(struct hfsc_class *cl, unsigne
}
}
-static unsigned int
-qdisc_peek_len(struct Qdisc *sch)
-{
- struct sk_buff *skb;
- unsigned int len;
-
- skb = sch->ops->peek(sch);
- if (unlikely(skb == NULL)) {
- qdisc_warn_nonwc("qdisc_peek_len", sch);
- return 0;
- }
- len = qdisc_pkt_len(skb);
-
- return len;
-}
-
static void
hfsc_adjust_levels(struct hfsc_class *cl)
{
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -1001,7 +1001,7 @@ static struct sk_buff *agg_dequeue(struc
if (cl->qdisc->q.qlen == 0) /* no more packets, remove from list */
list_del_init(&cl->alist);
- else if (cl->deficit < qdisc_pkt_len(cl->qdisc->ops->peek(cl->qdisc))) {
+ else if (cl->deficit < qdisc_peek_len(cl->qdisc)) {
cl->deficit += agg->lmax;
list_move_tail(&cl->alist, &agg->active);
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 002/568] perf: Have get_perf_callchain() return NULL if crosstask and user are set
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 001/568] net/sched: sch_qfq: Fix null-deref in agg_dequeue Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 003/568] x86/bugs: Fix reporting of LFENCE retpoline Greg Kroah-Hartman
` (572 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josh Poimboeuf,
Steven Rostedt (Google), Peter Zijlstra (Intel), Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <jpoimboe@kernel.org>
[ Upstream commit 153f9e74dec230f2e070e16fa061bc7adfd2c450 ]
get_perf_callchain() doesn't support cross-task unwinding for user space
stacks, have it return NULL if both the crosstask and user arguments are
set.
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20250820180428.426423415@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/events/callchain.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/kernel/events/callchain.c b/kernel/events/callchain.c
index 1273be84392cf..ce5534c97cd1d 100644
--- a/kernel/events/callchain.c
+++ b/kernel/events/callchain.c
@@ -184,6 +184,10 @@ get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user,
struct perf_callchain_entry_ctx ctx;
int rctx;
+ /* crosstask is not supported for user stacks */
+ if (crosstask && user && !kernel)
+ return NULL;
+
entry = get_callchain_entry(&rctx);
if (!entry)
return NULL;
@@ -200,7 +204,7 @@ get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user,
perf_callchain_kernel(&ctx, regs);
}
- if (user) {
+ if (user && !crosstask) {
if (!user_mode(regs)) {
if (current->mm)
regs = task_pt_regs(current);
@@ -209,9 +213,6 @@ get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user,
}
if (regs) {
- if (crosstask)
- goto exit_put;
-
if (add_mark)
perf_callchain_store_context(&ctx, PERF_CONTEXT_USER);
@@ -219,7 +220,6 @@ get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user,
}
}
-exit_put:
put_callchain_entry(rctx);
return entry;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 003/568] x86/bugs: Fix reporting of LFENCE retpoline
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 001/568] net/sched: sch_qfq: Fix null-deref in agg_dequeue Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 002/568] perf: Have get_perf_callchain() return NULL if crosstask and user are set Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 004/568] EDAC/mc_sysfs: Increase legacy channel support to 16 Greg Kroah-Hartman
` (571 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Kaplan, Borislav Petkov (AMD),
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Kaplan <david.kaplan@amd.com>
[ Upstream commit d1cc1baef67ac6c09b74629ca053bf3fb812f7dc ]
The LFENCE retpoline mitigation is not secure but the kernel prints
inconsistent messages about this fact. The dmesg log says 'Mitigation:
LFENCE', implying the system is mitigated. But sysfs reports 'Vulnerable:
LFENCE' implying the system (correctly) is not mitigated.
Fix this by printing a consistent 'Vulnerable: LFENCE' string everywhere
when this mitigation is selected.
Signed-off-by: David Kaplan <david.kaplan@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/20250915134706.3201818-1-david.kaplan@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/cpu/bugs.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index ff8965bce6c90..a0b362ac50a1b 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1539,7 +1539,7 @@ spectre_v2_user_select_mitigation(void)
static const char * const spectre_v2_strings[] = {
[SPECTRE_V2_NONE] = "Vulnerable",
[SPECTRE_V2_RETPOLINE] = "Mitigation: Retpolines",
- [SPECTRE_V2_LFENCE] = "Mitigation: LFENCE",
+ [SPECTRE_V2_LFENCE] = "Vulnerable: LFENCE",
[SPECTRE_V2_EIBRS] = "Mitigation: Enhanced / Automatic IBRS",
[SPECTRE_V2_EIBRS_LFENCE] = "Mitigation: Enhanced / Automatic IBRS + LFENCE",
[SPECTRE_V2_EIBRS_RETPOLINE] = "Mitigation: Enhanced / Automatic IBRS + Retpolines",
@@ -3169,9 +3169,6 @@ static const char *spectre_bhi_state(void)
static ssize_t spectre_v2_show_state(char *buf)
{
- if (spectre_v2_enabled == SPECTRE_V2_LFENCE)
- return sysfs_emit(buf, "Vulnerable: LFENCE\n");
-
if (spectre_v2_enabled == SPECTRE_V2_EIBRS && unprivileged_ebpf_enabled())
return sysfs_emit(buf, "Vulnerable: eIBRS with unprivileged eBPF\n");
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 004/568] EDAC/mc_sysfs: Increase legacy channel support to 16
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 003/568] x86/bugs: Fix reporting of LFENCE retpoline Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 005/568] btrfs: zoned: refine extent allocator hint selection Greg Kroah-Hartman
` (570 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Avadhut Naik, Borislav Petkov (AMD),
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avadhut Naik <avadhut.naik@amd.com>
[ Upstream commit 6e1c2c6c2c40ce99e0d2633b212f43c702c1a002 ]
Newer AMD systems can support up to 16 channels per EDAC "mc" device.
These are detected by the EDAC module running on the device, and the
current EDAC interface is appropriately enumerated.
The legacy EDAC sysfs interface however, provides device attributes for
channels 0 through 11 only. Consequently, the last four channels, 12
through 15, will not be enumerated and will not be visible through the
legacy sysfs interface.
Add additional device attributes to ensure that all 16 channels, if
present, are enumerated by and visible through the legacy EDAC sysfs
interface.
Signed-off-by: Avadhut Naik <avadhut.naik@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/20250916203242.1281036-1-avadhut.naik@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/edac/edac_mc_sysfs.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
index 15f63452a9bec..b01436d9ddaed 100644
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -306,6 +306,14 @@ DEVICE_CHANNEL(ch10_dimm_label, S_IRUGO | S_IWUSR,
channel_dimm_label_show, channel_dimm_label_store, 10);
DEVICE_CHANNEL(ch11_dimm_label, S_IRUGO | S_IWUSR,
channel_dimm_label_show, channel_dimm_label_store, 11);
+DEVICE_CHANNEL(ch12_dimm_label, S_IRUGO | S_IWUSR,
+ channel_dimm_label_show, channel_dimm_label_store, 12);
+DEVICE_CHANNEL(ch13_dimm_label, S_IRUGO | S_IWUSR,
+ channel_dimm_label_show, channel_dimm_label_store, 13);
+DEVICE_CHANNEL(ch14_dimm_label, S_IRUGO | S_IWUSR,
+ channel_dimm_label_show, channel_dimm_label_store, 14);
+DEVICE_CHANNEL(ch15_dimm_label, S_IRUGO | S_IWUSR,
+ channel_dimm_label_show, channel_dimm_label_store, 15);
/* Total possible dynamic DIMM Label attribute file table */
static struct attribute *dynamic_csrow_dimm_attr[] = {
@@ -321,6 +329,10 @@ static struct attribute *dynamic_csrow_dimm_attr[] = {
&dev_attr_legacy_ch9_dimm_label.attr.attr,
&dev_attr_legacy_ch10_dimm_label.attr.attr,
&dev_attr_legacy_ch11_dimm_label.attr.attr,
+ &dev_attr_legacy_ch12_dimm_label.attr.attr,
+ &dev_attr_legacy_ch13_dimm_label.attr.attr,
+ &dev_attr_legacy_ch14_dimm_label.attr.attr,
+ &dev_attr_legacy_ch15_dimm_label.attr.attr,
NULL
};
@@ -349,6 +361,14 @@ DEVICE_CHANNEL(ch10_ce_count, S_IRUGO,
channel_ce_count_show, NULL, 10);
DEVICE_CHANNEL(ch11_ce_count, S_IRUGO,
channel_ce_count_show, NULL, 11);
+DEVICE_CHANNEL(ch12_ce_count, S_IRUGO,
+ channel_ce_count_show, NULL, 12);
+DEVICE_CHANNEL(ch13_ce_count, S_IRUGO,
+ channel_ce_count_show, NULL, 13);
+DEVICE_CHANNEL(ch14_ce_count, S_IRUGO,
+ channel_ce_count_show, NULL, 14);
+DEVICE_CHANNEL(ch15_ce_count, S_IRUGO,
+ channel_ce_count_show, NULL, 15);
/* Total possible dynamic ce_count attribute file table */
static struct attribute *dynamic_csrow_ce_count_attr[] = {
@@ -364,6 +384,10 @@ static struct attribute *dynamic_csrow_ce_count_attr[] = {
&dev_attr_legacy_ch9_ce_count.attr.attr,
&dev_attr_legacy_ch10_ce_count.attr.attr,
&dev_attr_legacy_ch11_ce_count.attr.attr,
+ &dev_attr_legacy_ch12_ce_count.attr.attr,
+ &dev_attr_legacy_ch13_ce_count.attr.attr,
+ &dev_attr_legacy_ch14_ce_count.attr.attr,
+ &dev_attr_legacy_ch15_ce_count.attr.attr,
NULL
};
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 005/568] btrfs: zoned: refine extent allocator hint selection
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 004/568] EDAC/mc_sysfs: Increase legacy channel support to 16 Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 006/568] btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() Greg Kroah-Hartman
` (569 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Thumshirn, Naohiro Aota,
David Sterba, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <naohiro.aota@wdc.com>
[ Upstream commit 0d703963d297964451783e1a0688ebdf74cd6151 ]
The hint block group selection in the extent allocator is wrong in the
first place, as it can select the dedicated data relocation block group for
the normal data allocation.
Since we separated the normal data space_info and the data relocation
space_info, we can easily identify a block group is for data relocation or
not. Do not choose it for the normal data allocation.
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/extent-tree.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 5395e27f9e89a..7985ca56f6b70 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -4224,7 +4224,8 @@ static int prepare_allocation_clustered(struct btrfs_fs_info *fs_info,
}
static int prepare_allocation_zoned(struct btrfs_fs_info *fs_info,
- struct find_free_extent_ctl *ffe_ctl)
+ struct find_free_extent_ctl *ffe_ctl,
+ struct btrfs_space_info *space_info)
{
if (ffe_ctl->for_treelog) {
spin_lock(&fs_info->treelog_bg_lock);
@@ -4248,6 +4249,7 @@ static int prepare_allocation_zoned(struct btrfs_fs_info *fs_info,
u64 avail = block_group->zone_capacity - block_group->alloc_offset;
if (block_group_bits(block_group, ffe_ctl->flags) &&
+ block_group->space_info == space_info &&
avail >= ffe_ctl->num_bytes) {
ffe_ctl->hint_byte = block_group->start;
break;
@@ -4269,7 +4271,7 @@ static int prepare_allocation(struct btrfs_fs_info *fs_info,
return prepare_allocation_clustered(fs_info, ffe_ctl,
space_info, ins);
case BTRFS_EXTENT_ALLOC_ZONED:
- return prepare_allocation_zoned(fs_info, ffe_ctl);
+ return prepare_allocation_zoned(fs_info, ffe_ctl, space_info);
default:
BUG();
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 006/568] btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 005/568] btrfs: zoned: refine extent allocator hint selection Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 007/568] btrfs: always drop log root tree reference in btrfs_replay_log() Greg Kroah-Hartman
` (568 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, David Sterba,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
[ Upstream commit a7f3dfb8293c4cee99743132d69863a92e8f4875 ]
Replace max_t() followed by min_t() with a single clamp().
As was pointed by David Laight in
https://lore.kernel.org/linux-btrfs/20250906122458.75dfc8f0@pumpkin/
the calculation may overflow u32 when the input value is too large, so
clamp_t() is not used. In practice the expected values are in range of
megabytes to gigabytes (throughput limit) so the bug would not happen.
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: David Sterba <dsterba@suse.com>
[ Use clamp() and add explanation. ]
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/scrub.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index f48895a9b165e..ce8a9c226534f 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -2191,8 +2191,7 @@ static void scrub_throttle(struct scrub_ctx *sctx)
* Slice is divided into intervals when the IO is submitted, adjust by
* bwlimit and maximum of 64 intervals.
*/
- div = max_t(u32, 1, (u32)(bwlimit / (16 * 1024 * 1024)));
- div = min_t(u32, 64, div);
+ div = clamp(bwlimit / (16 * 1024 * 1024), 1, 64);
/* Start new epoch, set deadline */
now = ktime_get();
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 007/568] btrfs: always drop log root tree reference in btrfs_replay_log()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 006/568] btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 008/568] btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() Greg Kroah-Hartman
` (567 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Filipe Manana, David Sterba,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit 2f5b8095ea47b142c56c09755a8b1e14145a2d30 ]
Currently we have this odd behaviour:
1) At btrfs_replay_log() we drop the reference of the log root tree if
the call to btrfs_recover_log_trees() failed;
2) But if the call to btrfs_recover_log_trees() did not fail, we don't
drop the reference in btrfs_replay_log() - we expect that
btrfs_recover_log_trees() does it in case it returns success.
Let's simplify this and make btrfs_replay_log() always drop the reference
on the log root tree, not only this simplifies code as it's what makes
sense since it's btrfs_replay_log() who grabbed the reference in the first
place.
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/disk-io.c | 2 +-
fs/btrfs/tree-log.c | 1 -
2 files changed, 1 insertion(+), 2 deletions(-)
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 76a261cbf39d6..8576ba4aa0b7d 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2413,10 +2413,10 @@ static int btrfs_replay_log(struct btrfs_fs_info *fs_info,
/* returns with log_tree_root freed on success */
ret = btrfs_recover_log_trees(log_tree_root);
+ btrfs_put_root(log_tree_root);
if (ret) {
btrfs_handle_fs_error(fs_info, ret,
"Failed to recover log tree");
- btrfs_put_root(log_tree_root);
return ret;
}
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index e4cc287eee993..fdcf66ba318ad 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -7366,7 +7366,6 @@ int btrfs_recover_log_trees(struct btrfs_root *log_root_tree)
log_root_tree->log_root = NULL;
clear_bit(BTRFS_FS_LOG_RECOVERING, &fs_info->flags);
- btrfs_put_root(log_root_tree);
return 0;
error:
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 008/568] btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 007/568] btrfs: always drop log root tree reference in btrfs_replay_log() Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 009/568] arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c Greg Kroah-Hartman
` (566 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Filipe Manana, David Sterba,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit 45c222468d33202c07c41c113301a4b9c8451b8f ]
After setting the BTRFS_ROOT_FORCE_COW flag on the root we are doing a
full write barrier, smp_wmb(), but we don't need to, all we need is a
smp_mb__after_atomic(). The use of the smp_wmb() is from the old days
when we didn't use a bit and used instead an int field in the root to
signal if cow is forced. After the int field was changed to a bit in
the root's state (flags field), we forgot to update the memory barrier
in create_pending_snapshot() to smp_mb__after_atomic(), but we did the
change in commit_fs_roots() after clearing BTRFS_ROOT_FORCE_COW. That
happened in commit 27cdeb7096b8 ("Btrfs: use bitfield instead of integer
data type for the some variants in btrfs_root"). On the reader side, in
should_cow_block(), we also use the counterpart smp_mb__before_atomic()
which generates further confusion.
So change the smp_wmb() to smp_mb__after_atomic(). In fact we don't
even need any barrier at all since create_pending_snapshot() is called
in the critical section of a transaction commit and therefore no one
can concurrently join/attach the transaction, or start a new one, until
the transaction is unblocked. By the time someone starts a new transaction
and enters should_cow_block(), a lot of implicit memory barriers already
took place by having acquired several locks such as fs_info->trans_lock
and extent buffer locks on the root node at least. Nevertlheless, for
consistency use smp_mb__after_atomic() after setting the force cow bit
in create_pending_snapshot().
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/transaction.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index ff3e0d4cf4b48..54894a950c6f7 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1787,7 +1787,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
}
/* see comments in should_cow_block() */
set_bit(BTRFS_ROOT_FORCE_COW, &root->state);
- smp_wmb();
+ smp_mb__after_atomic();
btrfs_set_root_node(new_root_item, tmp);
/* record when the snapshot was created in key.offset */
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 009/568] arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 008/568] btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 010/568] mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR Greg Kroah-Hartman
` (565 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Menglong Dong,
Peter Zijlstra (Intel), Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Menglong Dong <menglong8.dong@gmail.com>
[ Upstream commit 35561bab768977c9e05f1f1a9bc00134c85f3e28 ]
The include/generated/asm-offsets.h is generated in Kbuild during
compiling from arch/SRCARCH/kernel/asm-offsets.c. When we want to
generate another similar offset header file, circular dependency can
happen.
For example, we want to generate a offset file include/generated/test.h,
which is included in include/sched/sched.h. If we generate asm-offsets.h
first, it will fail, as include/sched/sched.h is included in asm-offsets.c
and include/generated/test.h doesn't exist; If we generate test.h first,
it can't success neither, as include/generated/asm-offsets.h is included
by it.
In x86_64, the macro COMPILE_OFFSETS is used to avoid such circular
dependency. We can generate asm-offsets.h first, and if the
COMPILE_OFFSETS is defined, we don't include the "generated/test.h".
And we define the macro COMPILE_OFFSETS for all the asm-offsets.c for this
purpose.
Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/kernel/asm-offsets.c | 1 +
arch/arc/kernel/asm-offsets.c | 1 +
arch/arm/kernel/asm-offsets.c | 2 ++
arch/arm64/kernel/asm-offsets.c | 1 +
arch/csky/kernel/asm-offsets.c | 1 +
arch/hexagon/kernel/asm-offsets.c | 1 +
arch/loongarch/kernel/asm-offsets.c | 2 ++
arch/m68k/kernel/asm-offsets.c | 1 +
arch/microblaze/kernel/asm-offsets.c | 1 +
arch/mips/kernel/asm-offsets.c | 2 ++
arch/nios2/kernel/asm-offsets.c | 1 +
arch/openrisc/kernel/asm-offsets.c | 1 +
arch/parisc/kernel/asm-offsets.c | 1 +
arch/powerpc/kernel/asm-offsets.c | 1 +
arch/riscv/kernel/asm-offsets.c | 1 +
arch/s390/kernel/asm-offsets.c | 1 +
arch/sh/kernel/asm-offsets.c | 1 +
arch/sparc/kernel/asm-offsets.c | 1 +
arch/um/kernel/asm-offsets.c | 2 ++
arch/xtensa/kernel/asm-offsets.c | 1 +
20 files changed, 24 insertions(+)
diff --git a/arch/alpha/kernel/asm-offsets.c b/arch/alpha/kernel/asm-offsets.c
index 05d9296af5ea6..a251f1bc74acf 100644
--- a/arch/alpha/kernel/asm-offsets.c
+++ b/arch/alpha/kernel/asm-offsets.c
@@ -4,6 +4,7 @@
* This code generates raw asm output which is post-processed to extract
* and format the required data.
*/
+#define COMPILE_OFFSETS
#include <linux/types.h>
#include <linux/stddef.h>
diff --git a/arch/arc/kernel/asm-offsets.c b/arch/arc/kernel/asm-offsets.c
index 0e884036ab743..897dcfc7c9fa0 100644
--- a/arch/arc/kernel/asm-offsets.c
+++ b/arch/arc/kernel/asm-offsets.c
@@ -2,6 +2,7 @@
/*
* Copyright (C) 2004, 2007-2010, 2011-2012 Synopsys, Inc. (www.synopsys.com)
*/
+#define COMPILE_OFFSETS
#include <linux/sched.h>
#include <linux/mm.h>
diff --git a/arch/arm/kernel/asm-offsets.c b/arch/arm/kernel/asm-offsets.c
index 2c8d76fd7c662..820bc05685bab 100644
--- a/arch/arm/kernel/asm-offsets.c
+++ b/arch/arm/kernel/asm-offsets.c
@@ -7,6 +7,8 @@
* This code generates raw asm output which is post-processed to extract
* and format the required data.
*/
+#define COMPILE_OFFSETS
+
#include <linux/compiler.h>
#include <linux/sched.h>
#include <linux/mm.h>
diff --git a/arch/arm64/kernel/asm-offsets.c b/arch/arm64/kernel/asm-offsets.c
index 1197e7679882e..4785e8947f520 100644
--- a/arch/arm64/kernel/asm-offsets.c
+++ b/arch/arm64/kernel/asm-offsets.c
@@ -6,6 +6,7 @@
* 2001-2002 Keith Owens
* Copyright (C) 2012 ARM Ltd.
*/
+#define COMPILE_OFFSETS
#include <linux/arm_sdei.h>
#include <linux/sched.h>
diff --git a/arch/csky/kernel/asm-offsets.c b/arch/csky/kernel/asm-offsets.c
index d1e9035794733..5525c8e7e1d9e 100644
--- a/arch/csky/kernel/asm-offsets.c
+++ b/arch/csky/kernel/asm-offsets.c
@@ -1,5 +1,6 @@
// SPDX-License-Identifier: GPL-2.0
// Copyright (C) 2018 Hangzhou C-SKY Microsystems co.,ltd.
+#define COMPILE_OFFSETS
#include <linux/sched.h>
#include <linux/kernel_stat.h>
diff --git a/arch/hexagon/kernel/asm-offsets.c b/arch/hexagon/kernel/asm-offsets.c
index 03a7063f94561..50eea9fa6f137 100644
--- a/arch/hexagon/kernel/asm-offsets.c
+++ b/arch/hexagon/kernel/asm-offsets.c
@@ -8,6 +8,7 @@
*
* Copyright (c) 2010-2012, The Linux Foundation. All rights reserved.
*/
+#define COMPILE_OFFSETS
#include <linux/compat.h>
#include <linux/types.h>
diff --git a/arch/loongarch/kernel/asm-offsets.c b/arch/loongarch/kernel/asm-offsets.c
index bdd88eda9513f..91b3eae9414f7 100644
--- a/arch/loongarch/kernel/asm-offsets.c
+++ b/arch/loongarch/kernel/asm-offsets.c
@@ -4,6 +4,8 @@
*
* Copyright (C) 2020-2022 Loongson Technology Corporation Limited
*/
+#define COMPILE_OFFSETS
+
#include <linux/types.h>
#include <linux/sched.h>
#include <linux/mm.h>
diff --git a/arch/m68k/kernel/asm-offsets.c b/arch/m68k/kernel/asm-offsets.c
index 906d732305374..67a1990f9d748 100644
--- a/arch/m68k/kernel/asm-offsets.c
+++ b/arch/m68k/kernel/asm-offsets.c
@@ -9,6 +9,7 @@
* #defines from the assembly-language output.
*/
+#define COMPILE_OFFSETS
#define ASM_OFFSETS_C
#include <linux/stddef.h>
diff --git a/arch/microblaze/kernel/asm-offsets.c b/arch/microblaze/kernel/asm-offsets.c
index 104c3ac5f30c8..b4b67d58e7f6a 100644
--- a/arch/microblaze/kernel/asm-offsets.c
+++ b/arch/microblaze/kernel/asm-offsets.c
@@ -7,6 +7,7 @@
* License. See the file "COPYING" in the main directory of this archive
* for more details.
*/
+#define COMPILE_OFFSETS
#include <linux/init.h>
#include <linux/stddef.h>
diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c
index 08342b9eccdbd..0f9ed454faf19 100644
--- a/arch/mips/kernel/asm-offsets.c
+++ b/arch/mips/kernel/asm-offsets.c
@@ -9,6 +9,8 @@
* Kevin Kissell, kevink@mips.com and Carsten Langgaard, carstenl@mips.com
* Copyright (C) 2000 MIPS Technologies, Inc.
*/
+#define COMPILE_OFFSETS
+
#include <linux/compat.h>
#include <linux/types.h>
#include <linux/sched.h>
diff --git a/arch/nios2/kernel/asm-offsets.c b/arch/nios2/kernel/asm-offsets.c
index e3d9b7b6fb48a..88190b503ce5d 100644
--- a/arch/nios2/kernel/asm-offsets.c
+++ b/arch/nios2/kernel/asm-offsets.c
@@ -2,6 +2,7 @@
/*
* Copyright (C) 2011 Tobias Klauser <tklauser@distanz.ch>
*/
+#define COMPILE_OFFSETS
#include <linux/stddef.h>
#include <linux/sched.h>
diff --git a/arch/openrisc/kernel/asm-offsets.c b/arch/openrisc/kernel/asm-offsets.c
index 710651d5aaae1..3cc826f2216b1 100644
--- a/arch/openrisc/kernel/asm-offsets.c
+++ b/arch/openrisc/kernel/asm-offsets.c
@@ -18,6 +18,7 @@
* compile this file to assembler, and then extract the
* #defines from the assembly-language output.
*/
+#define COMPILE_OFFSETS
#include <linux/signal.h>
#include <linux/sched.h>
diff --git a/arch/parisc/kernel/asm-offsets.c b/arch/parisc/kernel/asm-offsets.c
index 94652e13c2603..21e900c0aa958 100644
--- a/arch/parisc/kernel/asm-offsets.c
+++ b/arch/parisc/kernel/asm-offsets.c
@@ -13,6 +13,7 @@
* Copyright (C) 2002 Randolph Chung <tausq with parisc-linux.org>
* Copyright (C) 2003 James Bottomley <jejb at parisc-linux.org>
*/
+#define COMPILE_OFFSETS
#include <linux/types.h>
#include <linux/sched.h>
diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
index 65d79dd0c92ce..5a4edc1e5504f 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -8,6 +8,7 @@
* compile this file to assembler, and then extract the
* #defines from the assembly-language output.
*/
+#define COMPILE_OFFSETS
#include <linux/compat.h>
#include <linux/signal.h>
diff --git a/arch/riscv/kernel/asm-offsets.c b/arch/riscv/kernel/asm-offsets.c
index 1ecafbcee9a0a..21f034b3fdbeb 100644
--- a/arch/riscv/kernel/asm-offsets.c
+++ b/arch/riscv/kernel/asm-offsets.c
@@ -3,6 +3,7 @@
* Copyright (C) 2012 Regents of the University of California
* Copyright (C) 2017 SiFive
*/
+#define COMPILE_OFFSETS
#include <linux/kbuild.h>
#include <linux/mm.h>
diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
index d8ce965c0a97c..9ff68c7f61cc0 100644
--- a/arch/s390/kernel/asm-offsets.c
+++ b/arch/s390/kernel/asm-offsets.c
@@ -4,6 +4,7 @@
* This code generates raw asm output which is post-processed to extract
* and format the required data.
*/
+#define COMPILE_OFFSETS
#define ASM_OFFSETS_C
diff --git a/arch/sh/kernel/asm-offsets.c b/arch/sh/kernel/asm-offsets.c
index a0322e8328456..429b6a7631468 100644
--- a/arch/sh/kernel/asm-offsets.c
+++ b/arch/sh/kernel/asm-offsets.c
@@ -8,6 +8,7 @@
* compile this file to assembler, and then extract the
* #defines from the assembly-language output.
*/
+#define COMPILE_OFFSETS
#include <linux/stddef.h>
#include <linux/types.h>
diff --git a/arch/sparc/kernel/asm-offsets.c b/arch/sparc/kernel/asm-offsets.c
index 5784f2df489a4..f1e27a7f800f4 100644
--- a/arch/sparc/kernel/asm-offsets.c
+++ b/arch/sparc/kernel/asm-offsets.c
@@ -10,6 +10,7 @@
*
* On sparc, thread_info data is static and TI_XXX offsets are computed by hand.
*/
+#define COMPILE_OFFSETS
#include <linux/sched.h>
#include <linux/mm_types.h>
diff --git a/arch/um/kernel/asm-offsets.c b/arch/um/kernel/asm-offsets.c
index 1fb12235ab9c8..a69873aa697f4 100644
--- a/arch/um/kernel/asm-offsets.c
+++ b/arch/um/kernel/asm-offsets.c
@@ -1 +1,3 @@
+#define COMPILE_OFFSETS
+
#include <sysdep/kernel-offsets.h>
diff --git a/arch/xtensa/kernel/asm-offsets.c b/arch/xtensa/kernel/asm-offsets.c
index da38de20ae598..cfbced95e944a 100644
--- a/arch/xtensa/kernel/asm-offsets.c
+++ b/arch/xtensa/kernel/asm-offsets.c
@@ -11,6 +11,7 @@
*
* Chris Zankel <chris@zankel.net>
*/
+#define COMPILE_OFFSETS
#include <asm/processor.h>
#include <asm/coprocessor.h>
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 010/568] mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 009/568] arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 011/568] dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp Greg Kroah-Hartman
` (564 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geliang Tang, Matthieu Baerts (NGI0),
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
[ Upstream commit e84cb860ac3ce67ec6ecc364433fd5b412c448bc ]
The special C-flag case expects the ADD_ADDR to be received when
switching to 'fully-established'. But for various reasons, the ADD_ADDR
could be sent after the "4th ACK", and the special case doesn't work.
On NIPA, the new test validating this special case for the C-flag failed
a few times, e.g.
102 default limits, server deny join id 0
syn rx [FAIL] got 0 JOIN[s] syn rx expected 2
Server ns stats
(...)
MPTcpExtAddAddrTx 1
MPTcpExtEchoAdd 1
Client ns stats
(...)
MPTcpExtAddAddr 1
MPTcpExtEchoAddTx 1
synack rx [FAIL] got 0 JOIN[s] synack rx expected 2
ack rx [FAIL] got 0 JOIN[s] ack rx expected 2
join Rx [FAIL] see above
syn tx [FAIL] got 0 JOIN[s] syn tx expected 2
join Tx [FAIL] see above
I had a suspicion about what the issue could be: the ADD_ADDR might have
been received after the switch to the 'fully-established' state. The
issue was not easy to reproduce. The packet capture shown that the
ADD_ADDR can indeed be sent with a delay, and the client would not try
to establish subflows to it as expected.
A simple fix is not to mark the endpoints as 'used' in the C-flag case,
when looking at creating subflows to the remote initial IP address and
port. In this case, there is no need to try.
Note: newly added fullmesh endpoints will still continue to be used as
expected, thanks to the conditions behind mptcp_pm_add_addr_c_flag_case.
Fixes: 4b1ff850e0c1 ("mptcp: pm: in-kernel: usable client side with C-flag")
Cc: stable@vger.kernel.org
Reviewed-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251020-net-mptcp-c-flag-late-add-addr-v1-1-8207030cb0e8@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ applied to pm_netlink.c instead of pm_kernel.c ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/pm_netlink.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/net/mptcp/pm_netlink.c
+++ b/net/mptcp/pm_netlink.c
@@ -623,6 +623,10 @@ static void mptcp_pm_create_subflow_or_s
}
subflow:
+ /* No need to try establishing subflows to remote id0 if not allowed */
+ if (mptcp_pm_add_addr_c_flag_case(msk))
+ goto exit;
+
/* check if should create a new subflow */
while (msk->pm.local_addr_used < local_addr_max &&
msk->pm.subflows < subflows_max) {
@@ -654,6 +658,8 @@ subflow:
__mptcp_subflow_connect(sk, &local.addr, &addrs[i]);
spin_lock_bh(&msk->pm.lock);
}
+
+exit:
mptcp_pm_nl_check_work_pending(msk);
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 011/568] dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 010/568] mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 012/568] selftests: mptcp: disable add_addr retrans in endpoint_tests Greg Kroah-Hartman
` (563 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Jun Li, Xu Yang, Frank Li,
Conor Dooley, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <xu.yang_2@nxp.com>
[ Upstream commit 268eb6fb908bc82ce479e4dba9a2cad11f536c9c ]
Only i.MX8MP need dma-range property to let USB controller work properly.
Remove dma-range from required list and add limitation for imx8mp.
Fixes: d2a704e29711 ("dt-bindings: usb: dwc3-imx8mp: add imx8mp dwc3 glue bindings")
Cc: stable <stable@kernel.org>
Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/devicetree/bindings/usb/fsl,imx8mp-dwc3.yaml | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/Documentation/devicetree/bindings/usb/fsl,imx8mp-dwc3.yaml
+++ b/Documentation/devicetree/bindings/usb/fsl,imx8mp-dwc3.yaml
@@ -82,12 +82,20 @@ required:
- reg
- "#address-cells"
- "#size-cells"
- - dma-ranges
- ranges
- clocks
- clock-names
- interrupts
+allOf:
+ - if:
+ properties:
+ compatible:
+ const: fsl,imx8mp-dwc3
+ then:
+ required:
+ - dma-ranges
+
additionalProperties: false
examples:
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 012/568] selftests: mptcp: disable add_addr retrans in endpoint_tests
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 011/568] dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 013/568] selftests: mptcp: join: mark delete re-add signal as skipped if not supported Greg Kroah-Hartman
` (562 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthieu Baerts, Geliang Tang,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <tanggeliang@kylinos.cn>
[ Upstream commit f92199f551e617fae028c5c5905ddd63e3616e18 ]
To prevent test instability in the "delete re-add signal" test caused by
ADD_ADDR retransmissions, disable retransmissions for this test by setting
net.mptcp.add_addr_timeout to 0.
Suggested-by: Matthieu Baerts <matttbe@kernel.org>
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20250815-net-mptcp-misc-fixes-6-17-rc2-v1-6-521fe9957892@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: c3496c052ac3 ("selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/mptcp/mptcp_join.sh | 1 +
1 file changed, 1 insertion(+)
--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
@@ -3394,6 +3394,7 @@ endpoint_tests()
# remove and re-add
if reset_with_events "delete re-add signal" &&
mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then
+ ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=0
pm_nl_set_limits $ns1 0 3
pm_nl_set_limits $ns2 3 3
pm_nl_add_endpoint $ns1 10.0.2.1 id 1 flags signal
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 013/568] selftests: mptcp: join: mark delete re-add signal as skipped if not supported
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 012/568] selftests: mptcp: disable add_addr retrans in endpoint_tests Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 014/568] xhci: dbc: Provide sysfs option to configure dbc descriptors Greg Kroah-Hartman
` (561 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geliang Tang, Matthieu Baerts (NGI0),
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
[ Upstream commit c3496c052ac36ea98ec4f8e95ae6285a425a2457 ]
The call to 'continue_if' was missing: it properly marks a subtest as
'skipped' if the attached condition is not valid.
Without that, the test is wrongly marked as passed on older kernels.
Fixes: b5e2fb832f48 ("selftests: mptcp: add explicit test case for remove/readd")
Cc: stable@vger.kernel.org
Reviewed-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251020-net-mptcp-c-flag-late-add-addr-v1-4-8207030cb0e8@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/mptcp/mptcp_join.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
@@ -3393,7 +3393,7 @@ endpoint_tests()
# remove and re-add
if reset_with_events "delete re-add signal" &&
- mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then
+ continue_if mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then
ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=0
pm_nl_set_limits $ns1 0 3
pm_nl_set_limits $ns2 3 3
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 014/568] xhci: dbc: Provide sysfs option to configure dbc descriptors
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 013/568] selftests: mptcp: join: mark delete re-add signal as skipped if not supported Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 015/568] xhci: dbc: poll at different rate depending on data transfer activity Greg Kroah-Hartman
` (560 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mathias Nyman, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[ Upstream commit edf1664f3249a091a2b91182fc087b3253b0b4c2 ]
When DbC is enabled the first port on the xHC host acts as a usb device.
xHC provides the descriptors automatically when the DbC device is
enumerated. Most of the values are hardcoded, but some fields such as
idProduct, idVendor, bcdDevice and bInterfaceProtocol can be modified.
Add sysfs entries that allow userspace to change these.
User can only change them before dbc is enabled, i.e. before writing
"enable" to dbc sysfs file as we don't want these values to change while
device is connected, or during enumeration.
Add documentation for these entries in
Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230317154715.535523-9-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: f3d12ec847b9 ("xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd | 52 ++++
drivers/usb/host/xhci-dbgcap.c | 191 ++++++++++++++-
drivers/usb/host/xhci-dbgcap.h | 4
3 files changed, 243 insertions(+), 4 deletions(-)
--- a/Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd
+++ b/Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd
@@ -23,3 +23,55 @@ Description:
Reading this attribute gives the state of the DbC. It
can be one of the following states: disabled, enabled,
initialized, connected, configured and stalled.
+
+What: /sys/bus/pci/drivers/xhci_hcd/.../dbc_idVendor
+Date: March 2023
+Contact: Mathias Nyman <mathias.nyman@linux.intel.com>
+Description:
+ This dbc_idVendor attribute lets us change the idVendor field
+ presented in the USB device descriptor by this xhci debug
+ device.
+ Value can only be changed while debug capability (DbC) is in
+ disabled state to prevent USB device descriptor change while
+ connected to a USB host.
+ The default value is 0x1d6b (Linux Foundation).
+ It can be any 16-bit integer.
+
+What: /sys/bus/pci/drivers/xhci_hcd/.../dbc_idProduct
+Date: March 2023
+Contact: Mathias Nyman <mathias.nyman@linux.intel.com>
+Description:
+ This dbc_idProduct attribute lets us change the idProduct field
+ presented in the USB device descriptor by this xhci debug
+ device.
+ Value can only be changed while debug capability (DbC) is in
+ disabled state to prevent USB device descriptor change while
+ connected to a USB host.
+ The default value is 0x0010. It can be any 16-bit integer.
+
+What: /sys/bus/pci/drivers/xhci_hcd/.../dbc_bcdDevice
+Date: March 2023
+Contact: Mathias Nyman <mathias.nyman@linux.intel.com>
+Description:
+ This dbc_bcdDevice attribute lets us change the bcdDevice field
+ presented in the USB device descriptor by this xhci debug
+ device.
+ Value can only be changed while debug capability (DbC) is in
+ disabled state to prevent USB device descriptor change while
+ connected to a USB host.
+ The default value is 0x0010. (device rev 0.10)
+ It can be any 16-bit integer.
+
+What: /sys/bus/pci/drivers/xhci_hcd/.../dbc_bInterfaceProtocol
+Date: March 2023
+Contact: Mathias Nyman <mathias.nyman@linux.intel.com>
+Description:
+ This attribute lets us change the bInterfaceProtocol field
+ presented in the USB Interface descriptor by the xhci debug
+ device.
+ Value can only be changed while debug capability (DbC) is in
+ disabled state to prevent USB descriptor change while
+ connected to a USB host.
+ The default value is 1 (GNU Remote Debug command).
+ Other permissible value is 0 which is for vendor defined debug
+ target.
--- a/drivers/usb/host/xhci-dbgcap.c
+++ b/drivers/usb/host/xhci-dbgcap.c
@@ -133,10 +133,10 @@ static void xhci_dbc_init_contexts(struc
/* Set DbC context and info registers: */
lo_hi_writeq(dbc->ctx->dma, &dbc->regs->dccp);
- dev_info = cpu_to_le32((DBC_VENDOR_ID << 16) | DBC_PROTOCOL);
+ dev_info = (dbc->idVendor << 16) | dbc->bInterfaceProtocol;
writel(dev_info, &dbc->regs->devinfo1);
- dev_info = cpu_to_le32((DBC_DEVICE_REV << 16) | DBC_PRODUCT_ID);
+ dev_info = (dbc->bcdDevice << 16) | dbc->idProduct;
writel(dev_info, &dbc->regs->devinfo2);
}
@@ -1044,7 +1044,186 @@ static ssize_t dbc_store(struct device *
return count;
}
+static ssize_t dbc_idVendor_show(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+{
+ struct xhci_dbc *dbc;
+ struct xhci_hcd *xhci;
+
+ xhci = hcd_to_xhci(dev_get_drvdata(dev));
+ dbc = xhci->dbc;
+
+ return sprintf(buf, "%04x\n", dbc->idVendor);
+}
+
+static ssize_t dbc_idVendor_store(struct device *dev,
+ struct device_attribute *attr,
+ const char *buf, size_t size)
+{
+ struct xhci_dbc *dbc;
+ struct xhci_hcd *xhci;
+ void __iomem *ptr;
+ u16 value;
+ u32 dev_info;
+
+ if (kstrtou16(buf, 0, &value))
+ return -EINVAL;
+
+ xhci = hcd_to_xhci(dev_get_drvdata(dev));
+ dbc = xhci->dbc;
+ if (dbc->state != DS_DISABLED)
+ return -EBUSY;
+
+ dbc->idVendor = value;
+ ptr = &dbc->regs->devinfo1;
+ dev_info = readl(ptr);
+ dev_info = (dev_info & ~(0xffffu << 16)) | (value << 16);
+ writel(dev_info, ptr);
+
+ return size;
+}
+
+static ssize_t dbc_idProduct_show(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+{
+ struct xhci_dbc *dbc;
+ struct xhci_hcd *xhci;
+
+ xhci = hcd_to_xhci(dev_get_drvdata(dev));
+ dbc = xhci->dbc;
+
+ return sprintf(buf, "%04x\n", dbc->idProduct);
+}
+
+static ssize_t dbc_idProduct_store(struct device *dev,
+ struct device_attribute *attr,
+ const char *buf, size_t size)
+{
+ struct xhci_dbc *dbc;
+ struct xhci_hcd *xhci;
+ void __iomem *ptr;
+ u32 dev_info;
+ u16 value;
+
+ if (kstrtou16(buf, 0, &value))
+ return -EINVAL;
+
+ xhci = hcd_to_xhci(dev_get_drvdata(dev));
+ dbc = xhci->dbc;
+ if (dbc->state != DS_DISABLED)
+ return -EBUSY;
+
+ dbc->idProduct = value;
+ ptr = &dbc->regs->devinfo2;
+ dev_info = readl(ptr);
+ dev_info = (dev_info & ~(0xffffu)) | value;
+ writel(dev_info, ptr);
+ return size;
+}
+
+static ssize_t dbc_bcdDevice_show(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+{
+ struct xhci_dbc *dbc;
+ struct xhci_hcd *xhci;
+
+ xhci = hcd_to_xhci(dev_get_drvdata(dev));
+ dbc = xhci->dbc;
+
+ return sprintf(buf, "%04x\n", dbc->bcdDevice);
+}
+
+static ssize_t dbc_bcdDevice_store(struct device *dev,
+ struct device_attribute *attr,
+ const char *buf, size_t size)
+{
+ struct xhci_dbc *dbc;
+ struct xhci_hcd *xhci;
+ void __iomem *ptr;
+ u32 dev_info;
+ u16 value;
+
+ if (kstrtou16(buf, 0, &value))
+ return -EINVAL;
+
+ xhci = hcd_to_xhci(dev_get_drvdata(dev));
+ dbc = xhci->dbc;
+ if (dbc->state != DS_DISABLED)
+ return -EBUSY;
+
+ dbc->bcdDevice = value;
+ ptr = &dbc->regs->devinfo2;
+ dev_info = readl(ptr);
+ dev_info = (dev_info & ~(0xffffu << 16)) | (value << 16);
+ writel(dev_info, ptr);
+
+ return size;
+}
+
+static ssize_t dbc_bInterfaceProtocol_show(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+{
+ struct xhci_dbc *dbc;
+ struct xhci_hcd *xhci;
+
+ xhci = hcd_to_xhci(dev_get_drvdata(dev));
+ dbc = xhci->dbc;
+
+ return sprintf(buf, "%02x\n", dbc->bInterfaceProtocol);
+}
+
+static ssize_t dbc_bInterfaceProtocol_store(struct device *dev,
+ struct device_attribute *attr,
+ const char *buf, size_t size)
+{
+ struct xhci_dbc *dbc;
+ struct xhci_hcd *xhci;
+ void __iomem *ptr;
+ u32 dev_info;
+ u8 value;
+ int ret;
+
+ /* bInterfaceProtocol is 8 bit, but xhci only supports values 0 and 1 */
+ ret = kstrtou8(buf, 0, &value);
+ if (ret || value > 1)
+ return -EINVAL;
+
+ xhci = hcd_to_xhci(dev_get_drvdata(dev));
+ dbc = xhci->dbc;
+ if (dbc->state != DS_DISABLED)
+ return -EBUSY;
+
+ dbc->bInterfaceProtocol = value;
+ ptr = &dbc->regs->devinfo1;
+ dev_info = readl(ptr);
+ dev_info = (dev_info & ~(0xffu)) | value;
+ writel(dev_info, ptr);
+
+ return size;
+}
+
static DEVICE_ATTR_RW(dbc);
+static DEVICE_ATTR_RW(dbc_idVendor);
+static DEVICE_ATTR_RW(dbc_idProduct);
+static DEVICE_ATTR_RW(dbc_bcdDevice);
+static DEVICE_ATTR_RW(dbc_bInterfaceProtocol);
+
+static struct attribute *dbc_dev_attributes[] = {
+ &dev_attr_dbc.attr,
+ &dev_attr_dbc_idVendor.attr,
+ &dev_attr_dbc_idProduct.attr,
+ &dev_attr_dbc_bcdDevice.attr,
+ &dev_attr_dbc_bInterfaceProtocol.attr,
+ NULL
+};
+
+static const struct attribute_group dbc_dev_attrib_grp = {
+ .attrs = dbc_dev_attributes,
+};
struct xhci_dbc *
xhci_alloc_dbc(struct device *dev, void __iomem *base, const struct dbc_driver *driver)
@@ -1059,6 +1238,10 @@ xhci_alloc_dbc(struct device *dev, void
dbc->regs = base;
dbc->dev = dev;
dbc->driver = driver;
+ dbc->idProduct = DBC_PRODUCT_ID;
+ dbc->idVendor = DBC_VENDOR_ID;
+ dbc->bcdDevice = DBC_DEVICE_REV;
+ dbc->bInterfaceProtocol = DBC_PROTOCOL;
if (readl(&dbc->regs->control) & DBC_CTRL_DBC_ENABLE)
goto err;
@@ -1066,7 +1249,7 @@ xhci_alloc_dbc(struct device *dev, void
INIT_DELAYED_WORK(&dbc->event_work, xhci_dbc_handle_events);
spin_lock_init(&dbc->lock);
- ret = device_create_file(dev, &dev_attr_dbc);
+ ret = sysfs_create_group(&dev->kobj, &dbc_dev_attrib_grp);
if (ret)
goto err;
@@ -1085,7 +1268,7 @@ void xhci_dbc_remove(struct xhci_dbc *db
xhci_dbc_stop(dbc);
/* remove sysfs files */
- device_remove_file(dbc->dev, &dev_attr_dbc);
+ sysfs_remove_group(&dbc->dev->kobj, &dbc_dev_attrib_grp);
kfree(dbc);
}
--- a/drivers/usb/host/xhci-dbgcap.h
+++ b/drivers/usb/host/xhci-dbgcap.h
@@ -132,6 +132,10 @@ struct xhci_dbc {
struct dbc_str_descs *string;
dma_addr_t string_dma;
size_t string_size;
+ u16 idVendor;
+ u16 idProduct;
+ u16 bcdDevice;
+ u8 bInterfaceProtocol;
enum dbc_state state;
struct delayed_work event_work;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 015/568] xhci: dbc: poll at different rate depending on data transfer activity
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 014/568] xhci: dbc: Provide sysfs option to configure dbc descriptors Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 016/568] xhci: dbc: Allow users to modify DbC poll interval via sysfs Greg Kroah-Hartman
` (559 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Uday M Bhat, Mathias Nyman,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[ Upstream commit fb18e5bb96603cc79d97f03e4c05f3992cf28624 ]
DbC driver starts polling for events immediately when DbC is enabled.
The current polling interval is 1ms, which keeps the CPU busy, impacting
power management even when there are no active data transfers.
Solve this by polling at a slower rate, with a 64ms interval as default
until a transfer request is queued, or if there are still are pending
unhandled transfers at event completion.
Tested-by: Uday M Bhat <uday.m.bhat@intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20240229141438.619372-9-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: f3d12ec847b9 ("xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-dbgcap.c | 13 +++++++++++--
drivers/usb/host/xhci-dbgcap.h | 2 ++
2 files changed, 13 insertions(+), 2 deletions(-)
--- a/drivers/usb/host/xhci-dbgcap.c
+++ b/drivers/usb/host/xhci-dbgcap.c
@@ -665,7 +665,8 @@ static int xhci_dbc_start(struct xhci_db
return ret;
}
- return mod_delayed_work(system_wq, &dbc->event_work, 1);
+ return mod_delayed_work(system_wq, &dbc->event_work,
+ msecs_to_jiffies(dbc->poll_interval));
}
static void xhci_dbc_stop(struct xhci_dbc *dbc)
@@ -964,8 +965,10 @@ static void xhci_dbc_handle_events(struc
enum evtreturn evtr;
struct xhci_dbc *dbc;
unsigned long flags;
+ unsigned int poll_interval;
dbc = container_of(to_delayed_work(work), struct xhci_dbc, event_work);
+ poll_interval = dbc->poll_interval;
spin_lock_irqsave(&dbc->lock, flags);
evtr = xhci_dbc_do_handle_events(dbc);
@@ -981,13 +984,18 @@ static void xhci_dbc_handle_events(struc
dbc->driver->disconnect(dbc);
break;
case EVT_DONE:
+ /* set fast poll rate if there are pending data transfers */
+ if (!list_empty(&dbc->eps[BULK_OUT].list_pending) ||
+ !list_empty(&dbc->eps[BULK_IN].list_pending))
+ poll_interval = 1;
break;
default:
dev_info(dbc->dev, "stop handling dbc events\n");
return;
}
- mod_delayed_work(system_wq, &dbc->event_work, 1);
+ mod_delayed_work(system_wq, &dbc->event_work,
+ msecs_to_jiffies(poll_interval));
}
static ssize_t dbc_show(struct device *dev,
@@ -1242,6 +1250,7 @@ xhci_alloc_dbc(struct device *dev, void
dbc->idVendor = DBC_VENDOR_ID;
dbc->bcdDevice = DBC_DEVICE_REV;
dbc->bInterfaceProtocol = DBC_PROTOCOL;
+ dbc->poll_interval = DBC_POLL_INTERVAL_DEFAULT;
if (readl(&dbc->regs->control) & DBC_CTRL_DBC_ENABLE)
goto err;
--- a/drivers/usb/host/xhci-dbgcap.h
+++ b/drivers/usb/host/xhci-dbgcap.h
@@ -93,6 +93,7 @@ struct dbc_ep {
#define DBC_QUEUE_SIZE 16
#define DBC_WRITE_BUF_SIZE 8192
+#define DBC_POLL_INTERVAL_DEFAULT 64 /* milliseconds */
/*
* Private structure for DbC hardware state:
@@ -139,6 +140,7 @@ struct xhci_dbc {
enum dbc_state state;
struct delayed_work event_work;
+ unsigned int poll_interval; /* ms */
unsigned resume_required:1;
struct dbc_ep eps[2];
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 016/568] xhci: dbc: Allow users to modify DbC poll interval via sysfs
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 015/568] xhci: dbc: poll at different rate depending on data transfer activity Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 017/568] xhci: dbc: Improve performance by removing delay in transfer event polling Greg Kroah-Hartman
` (558 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Jacob, Uday M Bhat,
Mathias Nyman, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uday M Bhat <uday.m.bhat@intel.com>
[ Upstream commit de3edd47a18fe05a560847cc3165871474e08196 ]
xhci DbC driver polls the host controller for DbC events at a reduced
rate when DbC is enabled but there are no active data transfers.
Allow users to modify this reduced poll interval via dbc_poll_interval_ms
sysfs entry. Unit is milliseconds and accepted range is 0 to 5000.
Max interval of 5000 ms is selected as it matches the common 5 second
timeout used in usb stack.
Default value is 64 milliseconds.
A long interval is useful when users know there won't be any activity
on systems connected via DbC for long periods, and want to avoid
battery drainage due to unnecessary CPU usage.
Example being Android Debugger (ADB) usage over DbC on ChromeOS systems
running Android Runtime.
[minor changes and rewording -Mathias]
Co-developed-by: Samuel Jacob <samjaco@google.com>
Signed-off-by: Samuel Jacob <samjaco@google.com>
Signed-off-by: Uday M Bhat <uday.m.bhat@intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20240626124835.1023046-5-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: f3d12ec847b9 ("xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd | 10 +++
drivers/usb/host/xhci-dbgcap.c | 38 +++++++++++++++
drivers/usb/host/xhci-dbgcap.h | 2
3 files changed, 49 insertions(+), 1 deletion(-)
--- a/Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd
+++ b/Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd
@@ -75,3 +75,13 @@ Description:
The default value is 1 (GNU Remote Debug command).
Other permissible value is 0 which is for vendor defined debug
target.
+
+What: /sys/bus/pci/drivers/xhci_hcd/.../dbc_poll_interval_ms
+Date: February 2024
+Contact: Mathias Nyman <mathias.nyman@linux.intel.com>
+Description:
+ This attribute adjust the polling interval used to check for
+ DbC events. Unit is milliseconds. Accepted values range from 0
+ up to 5000. The default value is 64 ms.
+ This polling interval is used while DbC is enabled but has no
+ active data transfers.
--- a/drivers/usb/host/xhci-dbgcap.c
+++ b/drivers/usb/host/xhci-dbgcap.c
@@ -1214,11 +1214,48 @@ static ssize_t dbc_bInterfaceProtocol_st
return size;
}
+static ssize_t dbc_poll_interval_ms_show(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+{
+ struct xhci_dbc *dbc;
+ struct xhci_hcd *xhci;
+
+ xhci = hcd_to_xhci(dev_get_drvdata(dev));
+ dbc = xhci->dbc;
+
+ return sysfs_emit(buf, "%u\n", dbc->poll_interval);
+}
+
+static ssize_t dbc_poll_interval_ms_store(struct device *dev,
+ struct device_attribute *attr,
+ const char *buf, size_t size)
+{
+ struct xhci_dbc *dbc;
+ struct xhci_hcd *xhci;
+ u32 value;
+ int ret;
+
+ ret = kstrtou32(buf, 0, &value);
+ if (ret || value > DBC_POLL_INTERVAL_MAX)
+ return -EINVAL;
+
+ xhci = hcd_to_xhci(dev_get_drvdata(dev));
+ dbc = xhci->dbc;
+
+ dbc->poll_interval = value;
+
+ mod_delayed_work(system_wq, &dbc->event_work, 0);
+
+ return size;
+}
+
static DEVICE_ATTR_RW(dbc);
static DEVICE_ATTR_RW(dbc_idVendor);
static DEVICE_ATTR_RW(dbc_idProduct);
static DEVICE_ATTR_RW(dbc_bcdDevice);
static DEVICE_ATTR_RW(dbc_bInterfaceProtocol);
+static DEVICE_ATTR_RW(dbc_poll_interval_ms);
static struct attribute *dbc_dev_attributes[] = {
&dev_attr_dbc.attr,
@@ -1226,6 +1263,7 @@ static struct attribute *dbc_dev_attribu
&dev_attr_dbc_idProduct.attr,
&dev_attr_dbc_bcdDevice.attr,
&dev_attr_dbc_bInterfaceProtocol.attr,
+ &dev_attr_dbc_poll_interval_ms.attr,
NULL
};
--- a/drivers/usb/host/xhci-dbgcap.h
+++ b/drivers/usb/host/xhci-dbgcap.h
@@ -94,7 +94,7 @@ struct dbc_ep {
#define DBC_QUEUE_SIZE 16
#define DBC_WRITE_BUF_SIZE 8192
#define DBC_POLL_INTERVAL_DEFAULT 64 /* milliseconds */
-
+#define DBC_POLL_INTERVAL_MAX 5000 /* milliseconds */
/*
* Private structure for DbC hardware state:
*/
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 017/568] xhci: dbc: Improve performance by removing delay in transfer event polling.
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 016/568] xhci: dbc: Allow users to modify DbC poll interval via sysfs Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 018/568] xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive Greg Kroah-Hartman
` (557 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Łukasz Bartosik, Mathias Nyman,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[ Upstream commit 03e3d9c2bd85cda941b3cf78e895c1498ac05c5f ]
Queue event polling work with 0 delay in case there are pending transfers
queued up. This is part 2 of a 3 part series that roughly triples dbc
performace when using adb push and pull over dbc.
Max/min push rate after patches is 210/118 MB/s, pull rate 171/133 MB/s,
tested with large files (300MB-9GB) by Łukasz Bartosik
First performance improvement patch was commit 31128e7492dc
("xhci: dbc: add dbgtty request to end of list once it completes")
Cc: Łukasz Bartosik <ukaszb@chromium.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20241227120142.1035206-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: f3d12ec847b9 ("xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-dbgcap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-dbgcap.c
+++ b/drivers/usb/host/xhci-dbgcap.c
@@ -987,7 +987,7 @@ static void xhci_dbc_handle_events(struc
/* set fast poll rate if there are pending data transfers */
if (!list_empty(&dbc->eps[BULK_OUT].list_pending) ||
!list_empty(&dbc->eps[BULK_IN].list_pending))
- poll_interval = 1;
+ poll_interval = 0;
break;
default:
dev_info(dbc->dev, "stop handling dbc events\n");
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 018/568] xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive.
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 017/568] xhci: dbc: Improve performance by removing delay in transfer event polling Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 019/568] xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event Greg Kroah-Hartman
` (556 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Łukasz Bartosik, Mathias Nyman,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[ Upstream commit cab63934c33b12c0d1e9f4da7450928057f2c142 ]
Event polling delay is set to 0 if there are any pending requests in
either rx or tx requests lists. Checking for pending requests does
not work well for "IN" transfers as the tty driver always queues
requests to the list and TRBs to the ring, preparing to receive data
from the host.
This causes unnecessary busylooping and cpu hogging.
Only set the event polling delay to 0 if there are pending tx "write"
transfers, or if it was less than 10ms since last active data transfer
in any direction.
Cc: Łukasz Bartosik <ukaszb@chromium.org>
Fixes: fb18e5bb9660 ("xhci: dbc: poll at different rate depending on data transfer activity")
Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20250505125630.561699-3-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: f3d12ec847b9 ("xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-dbgcap.c | 19 ++++++++++++++++---
drivers/usb/host/xhci-dbgcap.h | 3 +++
2 files changed, 19 insertions(+), 3 deletions(-)
--- a/drivers/usb/host/xhci-dbgcap.c
+++ b/drivers/usb/host/xhci-dbgcap.c
@@ -855,6 +855,7 @@ static enum evtreturn xhci_dbc_do_handle
{
dma_addr_t deq;
union xhci_trb *evt;
+ enum evtreturn ret = EVT_DONE;
u32 ctrl, portsc;
bool update_erdp = false;
@@ -939,6 +940,7 @@ static enum evtreturn xhci_dbc_do_handle
break;
case TRB_TYPE(TRB_TRANSFER):
dbc_handle_xfer_event(dbc, evt);
+ ret = EVT_XFER_DONE;
break;
default:
break;
@@ -957,7 +959,7 @@ static enum evtreturn xhci_dbc_do_handle
lo_hi_writeq(deq, &dbc->regs->erdp);
}
- return EVT_DONE;
+ return ret;
}
static void xhci_dbc_handle_events(struct work_struct *work)
@@ -966,6 +968,7 @@ static void xhci_dbc_handle_events(struc
struct xhci_dbc *dbc;
unsigned long flags;
unsigned int poll_interval;
+ unsigned long busypoll_timelimit;
dbc = container_of(to_delayed_work(work), struct xhci_dbc, event_work);
poll_interval = dbc->poll_interval;
@@ -984,11 +987,21 @@ static void xhci_dbc_handle_events(struc
dbc->driver->disconnect(dbc);
break;
case EVT_DONE:
- /* set fast poll rate if there are pending data transfers */
+ /*
+ * Set fast poll rate if there are pending out transfers, or
+ * a transfer was recently processed
+ */
+ busypoll_timelimit = dbc->xfer_timestamp +
+ msecs_to_jiffies(DBC_XFER_INACTIVITY_TIMEOUT);
+
if (!list_empty(&dbc->eps[BULK_OUT].list_pending) ||
- !list_empty(&dbc->eps[BULK_IN].list_pending))
+ time_is_after_jiffies(busypoll_timelimit))
poll_interval = 0;
break;
+ case EVT_XFER_DONE:
+ dbc->xfer_timestamp = jiffies;
+ poll_interval = 0;
+ break;
default:
dev_info(dbc->dev, "stop handling dbc events\n");
return;
--- a/drivers/usb/host/xhci-dbgcap.h
+++ b/drivers/usb/host/xhci-dbgcap.h
@@ -95,6 +95,7 @@ struct dbc_ep {
#define DBC_WRITE_BUF_SIZE 8192
#define DBC_POLL_INTERVAL_DEFAULT 64 /* milliseconds */
#define DBC_POLL_INTERVAL_MAX 5000 /* milliseconds */
+#define DBC_XFER_INACTIVITY_TIMEOUT 10 /* milliseconds */
/*
* Private structure for DbC hardware state:
*/
@@ -141,6 +142,7 @@ struct xhci_dbc {
enum dbc_state state;
struct delayed_work event_work;
unsigned int poll_interval; /* ms */
+ unsigned long xfer_timestamp;
unsigned resume_required:1;
struct dbc_ep eps[2];
@@ -186,6 +188,7 @@ struct dbc_request {
enum evtreturn {
EVT_ERR = -1,
EVT_DONE,
+ EVT_XFER_DONE,
EVT_GSER,
EVT_DISC,
};
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 019/568] xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 018/568] xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 020/568] serial: sc16is7xx: remove unused to_sc16is7xx_port macro Greg Kroah-Hartman
` (555 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Łukasz Bartosik,
Mathias Nyman, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[ Upstream commit f3d12ec847b945d5d65846c85f062d07d5e73164 ]
DbC may add 1024 bogus bytes to the beginneing of the receiving endpoint
if DbC hw triggers a STALL event before any Transfer Blocks (TRBs) for
incoming data are queued, but driver handles the event after it queued
the TRBs.
This is possible as xHCI DbC hardware may trigger spurious STALL transfer
events even if endpoint is empty. The STALL event contains a pointer
to the stalled TRB, and "remaining" untransferred data length.
As there are no TRBs queued yet the STALL event will just point to first
TRB position of the empty ring, with '0' bytes remaining untransferred.
DbC driver is polling for events, and may not handle the STALL event
before /dev/ttyDBC0 is opened and incoming data TRBs are queued.
The DbC event handler will now assume the first queued TRB (length 1024)
has stalled with '0' bytes remaining untransferred, and copies the data
This race situation can be practically mitigated by making sure the event
handler handles all pending transfer events when DbC reaches configured
state, and only then create dev/ttyDbC0, and start queueing transfers.
The event handler can this way detect the STALL events on empty rings
and discard them before any transfers are queued.
This does in practice solve the issue, but still leaves a small possible
gap for the race to trigger.
We still need a way to distinguish spurious STALLs on empty rings with '0'
bytes remaing, from actual STALL events with all bytes transmitted.
Cc: stable <stable@kernel.org>
Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver")
Tested-by: Łukasz Bartosik <ukaszb@chromium.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-dbgcap.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/usb/host/xhci-dbgcap.c
+++ b/drivers/usb/host/xhci-dbgcap.c
@@ -880,7 +880,8 @@ static enum evtreturn xhci_dbc_do_handle
dev_info(dbc->dev, "DbC configured\n");
portsc = readl(&dbc->regs->portsc);
writel(portsc, &dbc->regs->portsc);
- return EVT_GSER;
+ ret = EVT_GSER;
+ break;
}
return EVT_DONE;
@@ -940,7 +941,8 @@ static enum evtreturn xhci_dbc_do_handle
break;
case TRB_TYPE(TRB_TRANSFER):
dbc_handle_xfer_event(dbc, evt);
- ret = EVT_XFER_DONE;
+ if (ret != EVT_GSER)
+ ret = EVT_XFER_DONE;
break;
default:
break;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 020/568] serial: sc16is7xx: remove unused to_sc16is7xx_port macro
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 019/568] xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 021/568] serial: sc16is7xx: reorder code to remove prototype declarations Greg Kroah-Hartman
` (554 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hugo Villeneuve, Ilpo Järvinen,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
[ Upstream commit 22a048b0749346b6e3291892d06b95278d5ba84a ]
This macro is not used anywhere.
Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Link: https://lore.kernel.org/r/20230905181649.134720-1-hugo@hugovil.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 1c05bf6c0262 ("serial: sc16is7xx: remove useless enable of enhanced features")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/sc16is7xx.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -358,7 +358,6 @@ static struct uart_driver sc16is7xx_uart
static void sc16is7xx_ier_set(struct uart_port *port, u8 bit);
static void sc16is7xx_stop_tx(struct uart_port *port);
-#define to_sc16is7xx_port(p,e) ((container_of((p), struct sc16is7xx_port, e)))
#define to_sc16is7xx_one(p,e) ((container_of((p), struct sc16is7xx_one, e)))
static u8 sc16is7xx_port_read(struct uart_port *port, u8 reg)
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 021/568] serial: sc16is7xx: reorder code to remove prototype declarations
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 020/568] serial: sc16is7xx: remove unused to_sc16is7xx_port macro Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 022/568] serial: sc16is7xx: refactor EFR lock Greg Kroah-Hartman
` (553 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Hugo Villeneuve,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
[ Upstream commit 2de8a1b46756b5a79d8447f99afdfe49e914225a ]
Move/reorder some functions to remove sc16is7xx_ier_set() and
sc16is7xx_stop_tx() prototypes declarations.
No functional change.
sc16is7xx_ier_set() was introduced in
commit cc4c1d05eb10 ("sc16is7xx: Properly resume TX after stop").
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
Link: https://lore.kernel.org/r/20231221231823.2327894-16-hugo@hugovil.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 1c05bf6c0262 ("serial: sc16is7xx: remove useless enable of enhanced features")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/sc16is7xx.c | 75 +++++++++++++++++++----------------------
1 file changed, 36 insertions(+), 39 deletions(-)
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -355,9 +355,6 @@ static struct uart_driver sc16is7xx_uart
.nr = SC16IS7XX_MAX_DEVS,
};
-static void sc16is7xx_ier_set(struct uart_port *port, u8 bit);
-static void sc16is7xx_stop_tx(struct uart_port *port);
-
#define to_sc16is7xx_one(p,e) ((container_of((p), struct sc16is7xx_one, e)))
static u8 sc16is7xx_port_read(struct uart_port *port, u8 reg)
@@ -415,6 +412,42 @@ static void sc16is7xx_power(struct uart_
on ? 0 : SC16IS7XX_IER_SLEEP_BIT);
}
+static void sc16is7xx_ier_clear(struct uart_port *port, u8 bit)
+{
+ struct sc16is7xx_port *s = dev_get_drvdata(port->dev);
+ struct sc16is7xx_one *one = to_sc16is7xx_one(port, port);
+
+ lockdep_assert_held_once(&port->lock);
+
+ one->config.flags |= SC16IS7XX_RECONF_IER;
+ one->config.ier_mask |= bit;
+ one->config.ier_val &= ~bit;
+ kthread_queue_work(&s->kworker, &one->reg_work);
+}
+
+static void sc16is7xx_ier_set(struct uart_port *port, u8 bit)
+{
+ struct sc16is7xx_port *s = dev_get_drvdata(port->dev);
+ struct sc16is7xx_one *one = to_sc16is7xx_one(port, port);
+
+ lockdep_assert_held_once(&port->lock);
+
+ one->config.flags |= SC16IS7XX_RECONF_IER;
+ one->config.ier_mask |= bit;
+ one->config.ier_val |= bit;
+ kthread_queue_work(&s->kworker, &one->reg_work);
+}
+
+static void sc16is7xx_stop_tx(struct uart_port *port)
+{
+ sc16is7xx_ier_clear(port, SC16IS7XX_IER_THRI_BIT);
+}
+
+static void sc16is7xx_stop_rx(struct uart_port *port)
+{
+ sc16is7xx_ier_clear(port, SC16IS7XX_IER_RDI_BIT);
+}
+
static const struct sc16is7xx_devtype sc16is74x_devtype = {
.name = "SC16IS74X",
.nr_gpio = 0,
@@ -891,42 +924,6 @@ static void sc16is7xx_reg_proc(struct kt
sc16is7xx_reconf_rs485(&one->port);
}
-static void sc16is7xx_ier_clear(struct uart_port *port, u8 bit)
-{
- struct sc16is7xx_port *s = dev_get_drvdata(port->dev);
- struct sc16is7xx_one *one = to_sc16is7xx_one(port, port);
-
- lockdep_assert_held_once(&port->lock);
-
- one->config.flags |= SC16IS7XX_RECONF_IER;
- one->config.ier_mask |= bit;
- one->config.ier_val &= ~bit;
- kthread_queue_work(&s->kworker, &one->reg_work);
-}
-
-static void sc16is7xx_ier_set(struct uart_port *port, u8 bit)
-{
- struct sc16is7xx_port *s = dev_get_drvdata(port->dev);
- struct sc16is7xx_one *one = to_sc16is7xx_one(port, port);
-
- lockdep_assert_held_once(&port->lock);
-
- one->config.flags |= SC16IS7XX_RECONF_IER;
- one->config.ier_mask |= bit;
- one->config.ier_val |= bit;
- kthread_queue_work(&s->kworker, &one->reg_work);
-}
-
-static void sc16is7xx_stop_tx(struct uart_port *port)
-{
- sc16is7xx_ier_clear(port, SC16IS7XX_IER_THRI_BIT);
-}
-
-static void sc16is7xx_stop_rx(struct uart_port *port)
-{
- sc16is7xx_ier_clear(port, SC16IS7XX_IER_RDI_BIT);
-}
-
static void sc16is7xx_ms_proc(struct kthread_work *ws)
{
struct sc16is7xx_one *one = to_sc16is7xx_one(ws, ms_work.work);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 022/568] serial: sc16is7xx: refactor EFR lock
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 021/568] serial: sc16is7xx: reorder code to remove prototype declarations Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 023/568] serial: sc16is7xx: remove useless enable of enhanced features Greg Kroah-Hartman
` (552 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hugo Villeneuve, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
[ Upstream commit 0c84bea0cabc4e2b98a3de88eeb4ff798931f056 ]
Move common code for EFR lock/unlock of mutex into functions for code reuse
and clarity.
With the addition of old_lcr, move irda_mode within struct sc16is7xx_one to
reduce memory usage:
Before: /* size: 752, cachelines: 12, members: 10 */
After: /* size: 744, cachelines: 12, members: 10 */
Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
Link: https://lore.kernel.org/r/20231221231823.2327894-17-hugo@hugovil.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 1c05bf6c0262 ("serial: sc16is7xx: remove useless enable of enhanced features")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/sc16is7xx.c | 106 ++++++++++++++++++++++-------------------
1 file changed, 57 insertions(+), 49 deletions(-)
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -329,8 +329,9 @@ struct sc16is7xx_one {
struct kthread_work reg_work;
struct kthread_delayed_work ms_work;
struct sc16is7xx_one_config config;
- bool irda_mode;
unsigned int old_mctrl;
+ u8 old_lcr; /* Value before EFR access. */
+ bool irda_mode;
};
struct sc16is7xx_port {
@@ -412,6 +413,49 @@ static void sc16is7xx_power(struct uart_
on ? 0 : SC16IS7XX_IER_SLEEP_BIT);
}
+/*
+ * In an amazing feat of design, the Enhanced Features Register (EFR)
+ * shares the address of the Interrupt Identification Register (IIR).
+ * Access to EFR is switched on by writing a magic value (0xbf) to the
+ * Line Control Register (LCR). Any interrupt firing during this time will
+ * see the EFR where it expects the IIR to be, leading to
+ * "Unexpected interrupt" messages.
+ *
+ * Prevent this possibility by claiming a mutex while accessing the EFR,
+ * and claiming the same mutex from within the interrupt handler. This is
+ * similar to disabling the interrupt, but that doesn't work because the
+ * bulk of the interrupt processing is run as a workqueue job in thread
+ * context.
+ */
+static void sc16is7xx_efr_lock(struct uart_port *port)
+{
+ struct sc16is7xx_one *one = to_sc16is7xx_one(port, port);
+
+ mutex_lock(&one->efr_lock);
+
+ /* Backup content of LCR. */
+ one->old_lcr = sc16is7xx_port_read(port, SC16IS7XX_LCR_REG);
+
+ /* Enable access to Enhanced register set */
+ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, SC16IS7XX_LCR_CONF_MODE_B);
+
+ /* Disable cache updates when writing to EFR registers */
+ regcache_cache_bypass(one->regmap, true);
+}
+
+static void sc16is7xx_efr_unlock(struct uart_port *port)
+{
+ struct sc16is7xx_one *one = to_sc16is7xx_one(port, port);
+
+ /* Re-enable cache updates when writing to normal registers */
+ regcache_cache_bypass(one->regmap, false);
+
+ /* Restore original content of LCR */
+ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, one->old_lcr);
+
+ mutex_unlock(&one->efr_lock);
+}
+
static void sc16is7xx_ier_clear(struct uart_port *port, u8 bit)
{
struct sc16is7xx_port *s = dev_get_drvdata(port->dev);
@@ -538,39 +582,12 @@ static int sc16is7xx_set_baud(struct uar
div /= prescaler;
}
- /* In an amazing feat of design, the Enhanced Features Register shares
- * the address of the Interrupt Identification Register, and is
- * switched in by writing a magic value (0xbf) to the Line Control
- * Register. Any interrupt firing during this time will see the EFR
- * where it expects the IIR to be, leading to "Unexpected interrupt"
- * messages.
- *
- * Prevent this possibility by claiming a mutex while accessing the
- * EFR, and claiming the same mutex from within the interrupt handler.
- * This is similar to disabling the interrupt, but that doesn't work
- * because the bulk of the interrupt processing is run as a workqueue
- * job in thread context.
- */
- mutex_lock(&one->efr_lock);
-
- lcr = sc16is7xx_port_read(port, SC16IS7XX_LCR_REG);
-
- /* Open the LCR divisors for configuration */
- sc16is7xx_port_write(port, SC16IS7XX_LCR_REG,
- SC16IS7XX_LCR_CONF_MODE_B);
-
/* Enable enhanced features */
- regcache_cache_bypass(one->regmap, true);
+ sc16is7xx_efr_lock(port);
sc16is7xx_port_update(port, SC16IS7XX_EFR_REG,
SC16IS7XX_EFR_ENABLE_BIT,
SC16IS7XX_EFR_ENABLE_BIT);
-
- regcache_cache_bypass(one->regmap, false);
-
- /* Put LCR back to the normal mode */
- sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr);
-
- mutex_unlock(&one->efr_lock);
+ sc16is7xx_efr_unlock(port);
/* If bit MCR_CLKSEL is set, the divide by 4 prescaler is activated. */
sc16is7xx_port_update(port, SC16IS7XX_MCR_REG,
@@ -580,7 +597,8 @@ static int sc16is7xx_set_baud(struct uar
mutex_lock(&one->efr_lock);
- /* Open the LCR divisors for configuration */
+ /* Backup LCR and access special register set (DLL/DLH) */
+ lcr = sc16is7xx_port_read(port, SC16IS7XX_LCR_REG);
sc16is7xx_port_write(port, SC16IS7XX_LCR_REG,
SC16IS7XX_LCR_CONF_MODE_A);
@@ -590,7 +608,7 @@ static int sc16is7xx_set_baud(struct uar
sc16is7xx_port_write(port, SC16IS7XX_DLL_REG, div % 256);
regcache_cache_bypass(one->regmap, false);
- /* Put LCR back to the normal mode */
+ /* Restore LCR and access to general register set */
sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr);
mutex_unlock(&one->efr_lock);
@@ -1073,17 +1091,7 @@ static void sc16is7xx_set_termios(struct
if (!(termios->c_cflag & CREAD))
port->ignore_status_mask |= SC16IS7XX_LSR_BRK_ERROR_MASK;
- /* As above, claim the mutex while accessing the EFR. */
- mutex_lock(&one->efr_lock);
-
- sc16is7xx_port_write(port, SC16IS7XX_LCR_REG,
- SC16IS7XX_LCR_CONF_MODE_B);
-
/* Configure flow control */
- regcache_cache_bypass(one->regmap, true);
- sc16is7xx_port_write(port, SC16IS7XX_XON1_REG, termios->c_cc[VSTART]);
- sc16is7xx_port_write(port, SC16IS7XX_XOFF1_REG, termios->c_cc[VSTOP]);
-
port->status &= ~(UPSTAT_AUTOCTS | UPSTAT_AUTORTS);
if (termios->c_cflag & CRTSCTS) {
flow |= SC16IS7XX_EFR_AUTOCTS_BIT |
@@ -1095,16 +1103,16 @@ static void sc16is7xx_set_termios(struct
if (termios->c_iflag & IXOFF)
flow |= SC16IS7XX_EFR_SWFLOW1_BIT;
- sc16is7xx_port_update(port,
- SC16IS7XX_EFR_REG,
- SC16IS7XX_EFR_FLOWCTRL_BITS,
- flow);
- regcache_cache_bypass(one->regmap, false);
-
/* Update LCR register */
sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr);
- mutex_unlock(&one->efr_lock);
+ /* Update EFR registers */
+ sc16is7xx_efr_lock(port);
+ sc16is7xx_port_write(port, SC16IS7XX_XON1_REG, termios->c_cc[VSTART]);
+ sc16is7xx_port_write(port, SC16IS7XX_XOFF1_REG, termios->c_cc[VSTOP]);
+ sc16is7xx_port_update(port, SC16IS7XX_EFR_REG,
+ SC16IS7XX_EFR_FLOWCTRL_BITS, flow);
+ sc16is7xx_efr_unlock(port);
/* Get baud rate generator configuration */
baud = uart_get_baud_rate(port, termios, old,
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 023/568] serial: sc16is7xx: remove useless enable of enhanced features
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 022/568] serial: sc16is7xx: refactor EFR lock Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 024/568] NFSD: Fix crash in nfsd4_read_release() Greg Kroah-Hartman
` (551 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Hugo Villeneuve, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
[ Upstream commit 1c05bf6c0262f946571a37678250193e46b1ff0f ]
Commit 43c51bb573aa ("sc16is7xx: make sure device is in suspend once
probed") permanently enabled access to the enhanced features in
sc16is7xx_probe(), and it is never disabled after that.
Therefore, remove re-enable of enhanced features in
sc16is7xx_set_baud(). This eliminates a potential useless read + write
cycle each time the baud rate is reconfigured.
Fixes: 43c51bb573aa ("sc16is7xx: make sure device is in suspend once probed")
Cc: stable <stable@kernel.org>
Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
Link: https://patch.msgid.link/20251006142002.177475-1-hugo@hugovil.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/sc16is7xx.c | 7 -------
1 file changed, 7 deletions(-)
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -582,13 +582,6 @@ static int sc16is7xx_set_baud(struct uar
div /= prescaler;
}
- /* Enable enhanced features */
- sc16is7xx_efr_lock(port);
- sc16is7xx_port_update(port, SC16IS7XX_EFR_REG,
- SC16IS7XX_EFR_ENABLE_BIT,
- SC16IS7XX_EFR_ENABLE_BIT);
- sc16is7xx_efr_unlock(port);
-
/* If bit MCR_CLKSEL is set, the divide by 4 prescaler is activated. */
sc16is7xx_port_update(port, SC16IS7XX_MCR_REG,
SC16IS7XX_MCR_CLKSEL_BIT,
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 024/568] NFSD: Fix crash in nfsd4_read_release()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 023/568] serial: sc16is7xx: remove useless enable of enhanced features Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 025/568] net: usb: asix_devices: Check return value of usbnet_get_endpoints Greg Kroah-Hartman
` (550 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit abb1f08a2121dd270193746e43b2a9373db9ad84 upstream.
When tracing is enabled, the trace_nfsd_read_done trace point
crashes during the pynfs read.testNoFh test.
Fixes: 15a8b55dbb1b ("nfsd: call op_release, even when op_func returns an error")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -944,10 +944,11 @@ nfsd4_read(struct svc_rqst *rqstp, struc
static void
nfsd4_read_release(union nfsd4_op_u *u)
{
- if (u->read.rd_nf)
+ if (u->read.rd_nf) {
+ trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp,
+ u->read.rd_offset, u->read.rd_length);
nfsd_file_put(u->read.rd_nf);
- trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp,
- u->read.rd_offset, u->read.rd_length);
+ }
}
static __be32
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 025/568] net: usb: asix_devices: Check return value of usbnet_get_endpoints
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 024/568] NFSD: Fix crash in nfsd4_read_release() Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 026/568] fbcon: Set fb_display[i]->mode to NULL when the mode is released Greg Kroah-Hartman
` (549 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Miaoqian Lin, Jakub Kicinski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <linmq006@gmail.com>
commit dc89548c6926d68dfdda11bebc1a5258bc41d887 upstream.
The code did not check the return value of usbnet_get_endpoints.
Add checks and return the error if it fails to transfer the error.
Found via static anlaysis and this is similar to
commit 07161b2416f7 ("sr9800: Add check for usbnet_get_endpoints").
Fixes: 933a27d39e0e ("USB: asix - Add AX88178 support and many other changes")
Fixes: 2e55cc7210fe ("[PATCH] USB: usbnet (3/9) module for ASIX Ethernet adapters")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Link: https://patch.msgid.link/20251026164318.57624-1-linmq006@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/asix_devices.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -230,7 +230,9 @@ static int ax88172_bind(struct usbnet *d
int i;
unsigned long gpio_bits = dev->driver_info->data;
- usbnet_get_endpoints(dev,intf);
+ ret = usbnet_get_endpoints(dev, intf);
+ if (ret)
+ goto out;
/* Toggle the GPIOs in a manufacturer/model specific way */
for (i = 2; i >= 0; i--) {
@@ -851,7 +853,9 @@ static int ax88772_bind(struct usbnet *d
dev->driver_priv = priv;
- usbnet_get_endpoints(dev, intf);
+ ret = usbnet_get_endpoints(dev, intf);
+ if (ret)
+ return ret;
/* Maybe the boot loader passed the MAC address via device tree */
if (!eth_platform_get_mac_address(&dev->udev->dev, buf)) {
@@ -1284,7 +1288,9 @@ static int ax88178_bind(struct usbnet *d
int ret;
u8 buf[ETH_ALEN] = {0};
- usbnet_get_endpoints(dev,intf);
+ ret = usbnet_get_endpoints(dev, intf);
+ if (ret)
+ return ret;
/* Get the MAC address */
ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf, 0);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 026/568] fbcon: Set fb_display[i]->mode to NULL when the mode is released
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 025/568] net: usb: asix_devices: Check return value of usbnet_get_endpoints Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 027/568] fbdev: atyfb: Check if pll_ops->init_pll failed Greg Kroah-Hartman
` (548 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Quanmin Yan, Thomas Zimmermann,
Helge Deller
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quanmin Yan <yanquanmin1@huawei.com>
commit a1f3058930745d2b938b6b4f5bd9630dc74b26b7 upstream.
Recently, we discovered the following issue through syzkaller:
BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0
Read of size 4 at addr ff11000001b3c69c by task syz.xxx
...
Call Trace:
<TASK>
dump_stack_lvl+0xab/0xe0
print_address_description.constprop.0+0x2c/0x390
print_report+0xb9/0x280
kasan_report+0xb8/0xf0
fb_mode_is_equal+0x285/0x2f0
fbcon_mode_deleted+0x129/0x180
fb_set_var+0xe7f/0x11d0
do_fb_ioctl+0x6a0/0x750
fb_ioctl+0xe0/0x140
__x64_sys_ioctl+0x193/0x210
do_syscall_64+0x5f/0x9c0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Based on experimentation and analysis, during framebuffer unregistration,
only the memory of fb_info->modelist is freed, without setting the
corresponding fb_display[i]->mode to NULL for the freed modes. This leads
to UAF issues during subsequent accesses. Here's an example of reproduction
steps:
1. With /dev/fb0 already registered in the system, load a kernel module
to register a new device /dev/fb1;
2. Set fb1's mode to the global fb_display[] array (via FBIOPUT_CON2FBMAP);
3. Switch console from fb to VGA (to allow normal rmmod of the ko);
4. Unload the kernel module, at this point fb1's modelist is freed, leaving
a wild pointer in fb_display[];
5. Trigger the bug via system calls through fb0 attempting to delete a mode
from fb0.
Add a check in do_unregister_framebuffer(): if the mode to be freed exists
in fb_display[], set the corresponding mode pointer to NULL.
Signed-off-by: Quanmin Yan <yanquanmin1@huawei.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/core/fbcon.c | 19 +++++++++++++++++++
drivers/video/fbdev/core/fbmem.c | 1 +
include/linux/fbcon.h | 2 ++
3 files changed, 22 insertions(+)
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2830,6 +2830,25 @@ int fbcon_mode_deleted(struct fb_info *i
return found;
}
+static void fbcon_delete_mode(struct fb_videomode *m)
+{
+ struct fbcon_display *p;
+
+ for (int i = first_fb_vc; i <= last_fb_vc; i++) {
+ p = &fb_display[i];
+ if (p->mode == m)
+ p->mode = NULL;
+ }
+}
+
+void fbcon_delete_modelist(struct list_head *head)
+{
+ struct fb_modelist *modelist;
+
+ list_for_each_entry(modelist, head, list)
+ fbcon_delete_mode(&modelist->mode);
+}
+
#ifdef CONFIG_VT_HW_CONSOLE_BINDING
static void fbcon_unbind(void)
{
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -1650,6 +1650,7 @@ static void do_unregister_framebuffer(st
fb_info->pixmap.addr = NULL;
}
+ fbcon_delete_modelist(&fb_info->modelist);
fb_destroy_modelist(&fb_info->modelist);
registered_fb[fb_info->node] = NULL;
num_registered_fb--;
--- a/include/linux/fbcon.h
+++ b/include/linux/fbcon.h
@@ -11,6 +11,7 @@ void fbcon_suspended(struct fb_info *inf
void fbcon_resumed(struct fb_info *info);
int fbcon_mode_deleted(struct fb_info *info,
struct fb_videomode *mode);
+void fbcon_delete_modelist(struct list_head *head);
void fbcon_new_modelist(struct fb_info *info);
void fbcon_get_requirement(struct fb_info *info,
struct fb_blit_caps *caps);
@@ -31,6 +32,7 @@ static inline void fbcon_suspended(struc
static inline void fbcon_resumed(struct fb_info *info) {}
static inline int fbcon_mode_deleted(struct fb_info *info,
struct fb_videomode *mode) { return 0; }
+static inline void fbcon_delete_modelist(struct list_head *head) {}
static inline void fbcon_new_modelist(struct fb_info *info) {}
static inline void fbcon_get_requirement(struct fb_info *info,
struct fb_blit_caps *caps) {}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 027/568] fbdev: atyfb: Check if pll_ops->init_pll failed
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 026/568] fbcon: Set fb_display[i]->mode to NULL when the mode is released Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 028/568] ACPI: video: Fix use-after-free in acpi_video_switch_brightness() Greg Kroah-Hartman
` (547 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Daniel Palmer, Helge Deller
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <daniel@0x0f.com>
commit 7073c7fc8d8ba47194e5fc58fcafc0efe7586e9b upstream.
Actually check the return value from pll_ops->init_pll()
as it can return an error.
If the card's BIOS didn't run because it's not the primary VGA card
the fact that the xclk source is unsupported is printed as shown
below but the driver continues on regardless and on my machine causes
a hard lock up.
[ 61.470088] atyfb 0000:03:05.0: enabling device (0080 -> 0083)
[ 61.476191] atyfb: using auxiliary register aperture
[ 61.481239] atyfb: 3D RAGE XL (Mach64 GR, PCI-33) [0x4752 rev 0x27]
[ 61.487569] atyfb: 512K SGRAM (1:1), 14.31818 MHz XTAL, 230 MHz PLL, 83 Mhz MCLK, 63 MHz XCLK
[ 61.496112] atyfb: Unsupported xclk source: 5.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Daniel Palmer <daniel@0x0f.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/aty/atyfb_base.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/video/fbdev/aty/atyfb_base.c
+++ b/drivers/video/fbdev/aty/atyfb_base.c
@@ -2617,8 +2617,12 @@ static int aty_init(struct fb_info *info
pr_cont("\n");
}
#endif
- if (par->pll_ops->init_pll)
- par->pll_ops->init_pll(info, &par->pll);
+ if (par->pll_ops->init_pll) {
+ ret = par->pll_ops->init_pll(info, &par->pll);
+ if (ret)
+ return ret;
+ }
+
if (par->pll_ops->resume_pll)
par->pll_ops->resume_pll(info, &par->pll);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 028/568] ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 027/568] fbdev: atyfb: Check if pll_ops->init_pll failed Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 029/568] fbdev: bitblit: bound-check glyph index in bit_putcs* Greg Kroah-Hartman
` (546 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Hans de Goede,
Rafael J. Wysocki
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuhao Jiang <danisjiang@gmail.com>
commit 8f067aa59430266386b83c18b983ca583faa6a11 upstream.
The switch_brightness_work delayed work accesses device->brightness
and device->backlight, freed by acpi_video_dev_unregister_backlight()
during device removal.
If the work executes after acpi_video_bus_unregister_backlight()
frees these resources, it causes a use-after-free when
acpi_video_switch_brightness() dereferences device->brightness or
device->backlight.
Fix this by calling cancel_delayed_work_sync() for each device's
switch_brightness_work in acpi_video_bus_remove_notify_handler()
after removing the notify handler that queues the work. This ensures
the work completes before the memory is freed.
Fixes: 8ab58e8e7e097 ("ACPI / video: Fix backlight taking 2 steps on a brightness up/down keypress")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Yuhao Jiang <danisjiang@gmail.com>
Reviewed-by: Hans de Goede <hansg@kernel.org>
[ rjw: Changelog edit ]
Link: https://patch.msgid.link/20251022200704.2655507-1-danisjiang@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/acpi_video.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/acpi/acpi_video.c
+++ b/drivers/acpi/acpi_video.c
@@ -1965,8 +1965,10 @@ static void acpi_video_bus_remove_notify
struct acpi_video_device *dev;
mutex_lock(&video->device_list_lock);
- list_for_each_entry(dev, &video->video_device_list, entry)
+ list_for_each_entry(dev, &video->video_device_list, entry) {
acpi_video_dev_remove_notify_handler(dev);
+ cancel_delayed_work_sync(&dev->switch_brightness_work);
+ }
mutex_unlock(&video->device_list_lock);
acpi_video_bus_stop_devices(video);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 029/568] fbdev: bitblit: bound-check glyph index in bit_putcs*
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 028/568] ACPI: video: Fix use-after-free in acpi_video_switch_brightness() Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 030/568] wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode Greg Kroah-Hartman
` (545 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+793cf822d213be1a74f2,
Junjie Cao, Thomas Zimmermann, Helge Deller
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junjie Cao <junjie.cao@intel.com>
commit 18c4ef4e765a798b47980555ed665d78b71aeadf upstream.
bit_putcs_aligned()/unaligned() derived the glyph pointer from the
character value masked by 0xff/0x1ff, which may exceed the actual font's
glyph count and read past the end of the built-in font array.
Clamp the index to the actual glyph count before computing the address.
This fixes a global out-of-bounds read reported by syzbot.
Reported-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=793cf822d213be1a74f2
Tested-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/core/bitblit.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
--- a/drivers/video/fbdev/core/bitblit.c
+++ b/drivers/video/fbdev/core/bitblit.c
@@ -79,12 +79,16 @@ static inline void bit_putcs_aligned(str
struct fb_image *image, u8 *buf, u8 *dst)
{
u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
+ unsigned int charcnt = vc->vc_font.charcount;
u32 idx = vc->vc_font.width >> 3;
u8 *src;
while (cnt--) {
- src = vc->vc_font.data + (scr_readw(s++)&
- charmask)*cellsize;
+ u16 ch = scr_readw(s++) & charmask;
+
+ if (ch >= charcnt)
+ ch = 0;
+ src = vc->vc_font.data + (unsigned int)ch * cellsize;
if (attr) {
update_attr(buf, src, attr, vc);
@@ -112,14 +116,18 @@ static inline void bit_putcs_unaligned(s
u8 *dst)
{
u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
+ unsigned int charcnt = vc->vc_font.charcount;
u32 shift_low = 0, mod = vc->vc_font.width % 8;
u32 shift_high = 8;
u32 idx = vc->vc_font.width >> 3;
u8 *src;
while (cnt--) {
- src = vc->vc_font.data + (scr_readw(s++)&
- charmask)*cellsize;
+ u16 ch = scr_readw(s++) & charmask;
+
+ if (ch >= charcnt)
+ ch = 0;
+ src = vc->vc_font.data + (unsigned int)ch * cellsize;
if (attr) {
update_attr(buf, src, attr, vc);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 030/568] wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 029/568] fbdev: bitblit: bound-check glyph index in bit_putcs* Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 031/568] fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS Greg Kroah-Hartman
` (544 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gokul Sivakumar, Arend van Spriel,
Johannes Berg
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gokul Sivakumar <gokulkumar.sivakumar@infineon.com>
commit 3776c685ebe5f43e9060af06872661de55e80b9a upstream.
Currently, whenever there is a need to transmit an Action frame,
the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to
firmware. The P2P interfaces were available when wpa_supplicant is managing
the wlan interface.
However, the P2P interfaces are not created/initialized when only hostapd
is managing the wlan interface. And if hostapd receives an ANQP Query REQ
Action frame even from an un-associated STA, the brcmfmac driver tries
to use an uninitialized P2P vif pointer for sending the IOVAR to firmware.
This NULL pointer dereferencing triggers a driver crash.
[ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual
address 0000000000000000
[...]
[ 1417.075188] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)
[...]
[ 1417.075653] Call trace:
[ 1417.075662] brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac]
[ 1417.075738] brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac]
[ 1417.075810] cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211]
[ 1417.076067] nl80211_tx_mgmt+0x238/0x388 [cfg80211]
[ 1417.076281] genl_family_rcv_msg_doit+0xe0/0x158
[ 1417.076302] genl_rcv_msg+0x220/0x2a0
[ 1417.076317] netlink_rcv_skb+0x68/0x140
[ 1417.076330] genl_rcv+0x40/0x60
[ 1417.076343] netlink_unicast+0x330/0x3b8
[ 1417.076357] netlink_sendmsg+0x19c/0x3f8
[ 1417.076370] __sock_sendmsg+0x64/0xc0
[ 1417.076391] ____sys_sendmsg+0x268/0x2a0
[ 1417.076408] ___sys_sendmsg+0xb8/0x118
[ 1417.076427] __sys_sendmsg+0x90/0xf8
[ 1417.076445] __arm64_sys_sendmsg+0x2c/0x40
[ 1417.076465] invoke_syscall+0x50/0x120
[ 1417.076486] el0_svc_common.constprop.0+0x48/0xf0
[ 1417.076506] do_el0_svc+0x24/0x38
[ 1417.076525] el0_svc+0x30/0x100
[ 1417.076548] el0t_64_sync_handler+0x100/0x130
[ 1417.076569] el0t_64_sync+0x190/0x198
[ 1417.076589] Code: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000)
Fix this, by always using the vif corresponding to the wdev on which the
Action frame Transmission request was initiated by the userspace. This way,
even if P2P vif is not available, the IOVAR is sent to firmware on AP vif
and the ANQP Query RESP Action frame is transmitted without crashing the
driver.
Move init_completion() for "send_af_done" from brcmf_p2p_create_p2pdev()
to brcmf_p2p_attach(). Because the former function would not get executed
when only hostapd is managing wlan interface, and it is not safe to do
reinit_completion() later in brcmf_p2p_tx_action_frame(), without any prior
init_completion().
And in the brcmf_p2p_tx_action_frame() function, the condition check for
P2P Presence response frame is not needed, since the wpa_supplicant is
properly sending the P2P Presense Response frame on the P2P-GO vif instead
of the P2P-Device vif.
Cc: stable@vger.kernel.org
Fixes: 18e2f61db3b7 ("brcmfmac: P2P action frame tx")
Signed-off-by: Gokul Sivakumar <gokulkumar.sivakumar@infineon.com>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Link: https://patch.msgid.link/20251013102819.9727-1-gokulkumar.sivakumar@infineon.com
[Cc stable]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 -
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 28 ++++--------
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h | 3 -
3 files changed, 12 insertions(+), 22 deletions(-)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -5197,8 +5197,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
*cookie, le16_to_cpu(action_frame->len), freq);
- ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
- af_params);
+ ack = brcmf_p2p_send_action_frame(vif->ifp, af_params);
cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
GFP_KERNEL);
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -1529,6 +1529,7 @@ int brcmf_p2p_notify_action_tx_complete(
/**
* brcmf_p2p_tx_action_frame() - send action frame over fil.
*
+ * @ifp: interface to transmit on.
* @p2p: p2p info struct for vif.
* @af_params: action frame data/info.
*
@@ -1538,12 +1539,11 @@ int brcmf_p2p_notify_action_tx_complete(
* The WLC_E_ACTION_FRAME_COMPLETE event will be received when the action
* frame is transmitted.
*/
-static s32 brcmf_p2p_tx_action_frame(struct brcmf_p2p_info *p2p,
+static s32 brcmf_p2p_tx_action_frame(struct brcmf_if *ifp,
+ struct brcmf_p2p_info *p2p,
struct brcmf_fil_af_params_le *af_params)
{
struct brcmf_pub *drvr = p2p->cfg->pub;
- struct brcmf_cfg80211_vif *vif;
- struct brcmf_p2p_action_frame *p2p_af;
s32 err = 0;
brcmf_dbg(TRACE, "Enter\n");
@@ -1552,14 +1552,7 @@ static s32 brcmf_p2p_tx_action_frame(str
clear_bit(BRCMF_P2P_STATUS_ACTION_TX_COMPLETED, &p2p->status);
clear_bit(BRCMF_P2P_STATUS_ACTION_TX_NOACK, &p2p->status);
- /* check if it is a p2p_presence response */
- p2p_af = (struct brcmf_p2p_action_frame *)af_params->action_frame.data;
- if (p2p_af->subtype == P2P_AF_PRESENCE_RSP)
- vif = p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif;
- else
- vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
-
- err = brcmf_fil_bsscfg_data_set(vif->ifp, "actframe", af_params,
+ err = brcmf_fil_bsscfg_data_set(ifp, "actframe", af_params,
sizeof(*af_params));
if (err) {
bphy_err(drvr, " sending action frame has failed\n");
@@ -1711,16 +1704,14 @@ static bool brcmf_p2p_check_dwell_overfl
/**
* brcmf_p2p_send_action_frame() - send action frame .
*
- * @cfg: driver private data for cfg80211 interface.
- * @ndev: net device to transmit on.
+ * @ifp: interface to transmit on.
* @af_params: configuration data for action frame.
*/
-bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,
- struct net_device *ndev,
+bool brcmf_p2p_send_action_frame(struct brcmf_if *ifp,
struct brcmf_fil_af_params_le *af_params)
{
+ struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
struct brcmf_p2p_info *p2p = &cfg->p2p;
- struct brcmf_if *ifp = netdev_priv(ndev);
struct brcmf_fil_action_frame_le *action_frame;
struct brcmf_config_af_params config_af_params;
struct afx_hdl *afx_hdl = &p2p->afx_hdl;
@@ -1857,7 +1848,7 @@ bool brcmf_p2p_send_action_frame(struct
if (af_params->channel)
msleep(P2P_AF_RETRY_DELAY_TIME);
- ack = !brcmf_p2p_tx_action_frame(p2p, af_params);
+ ack = !brcmf_p2p_tx_action_frame(ifp, p2p, af_params);
tx_retry++;
dwell_overflow = brcmf_p2p_check_dwell_overflow(requested_dwell,
dwell_jiffies);
@@ -2217,7 +2208,6 @@ static struct wireless_dev *brcmf_p2p_cr
WARN_ON(p2p_ifp->bsscfgidx != bsscfgidx);
- init_completion(&p2p->send_af_done);
INIT_WORK(&p2p->afx_hdl.afx_work, brcmf_p2p_afx_handler);
init_completion(&p2p->afx_hdl.act_frm_scan);
init_completion(&p2p->wait_next_af);
@@ -2509,6 +2499,8 @@ s32 brcmf_p2p_attach(struct brcmf_cfg802
pri_ifp = brcmf_get_ifp(cfg->pub, 0);
p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif = pri_ifp->vif;
+ init_completion(&p2p->send_af_done);
+
if (p2pdev_forced) {
err_ptr = brcmf_p2p_create_p2pdev(p2p, NULL, NULL);
if (IS_ERR(err_ptr)) {
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
@@ -168,8 +168,7 @@ int brcmf_p2p_notify_action_frame_rx(str
int brcmf_p2p_notify_action_tx_complete(struct brcmf_if *ifp,
const struct brcmf_event_msg *e,
void *data);
-bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,
- struct net_device *ndev,
+bool brcmf_p2p_send_action_frame(struct brcmf_if *ifp,
struct brcmf_fil_af_params_le *af_params);
bool brcmf_p2p_scan_finding_common_channel(struct brcmf_cfg80211_info *cfg,
struct brcmf_bss_info_le *bi);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 031/568] fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 030/568] wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 032/568] fbdev: valkyriefb: Fix reference count leak in valkyriefb_init Greg Kroah-Hartman
` (543 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Fuchs,
John Paul Adrian Glaubitz, Helge Deller
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fuchs <fuchsfl@gmail.com>
commit 5f566c0ac51cd2474e47da68dbe719d3acf7d999 upstream.
Commit e24cca19babe ("sh: Kill off MAX_DMA_ADDRESS leftovers.") removed
the define ONCHIP_NR_DMA_CHANNELS. So that the leftover reference needs
to be replaced by CONFIG_NR_ONCHIP_DMA_CHANNELS to compile successfully
with CONFIG_PVR2_DMA enabled.
Signed-off-by: Florian Fuchs <fuchsfl@gmail.com>
Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/pvr2fb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/video/fbdev/pvr2fb.c
+++ b/drivers/video/fbdev/pvr2fb.c
@@ -192,7 +192,7 @@ static unsigned long pvr2fb_map;
#ifdef CONFIG_PVR2_DMA
static unsigned int shdma = PVR2_CASCADE_CHAN;
-static unsigned int pvr2dma = ONCHIP_NR_DMA_CHANNELS;
+static unsigned int pvr2dma = CONFIG_NR_ONCHIP_DMA_CHANNELS;
#endif
static struct fb_videomode pvr2_modedb[] = {
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 032/568] fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 031/568] fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 033/568] mptcp: restore window probe Greg Kroah-Hartman
` (542 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Miaoqian Lin, Helge Deller
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <linmq006@gmail.com>
commit eb53368f8d6e2dfba84c8a94d245719bcf9ae270 upstream.
The of_find_node_by_name() function returns a device tree node with its
reference count incremented. The caller is responsible for calling
of_node_put() to release this reference when done.
Found via static analysis.
Fixes: cc5d0189b9ba ("[PATCH] powerpc: Remove device_node addrs/n_addr")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/valkyriefb.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/video/fbdev/valkyriefb.c
+++ b/drivers/video/fbdev/valkyriefb.c
@@ -331,11 +331,13 @@ static int __init valkyriefb_init(void)
if (of_address_to_resource(dp, 0, &r)) {
printk(KERN_ERR "can't find address for valkyrie\n");
+ of_node_put(dp);
return 0;
}
frame_buffer_phys = r.start;
cmap_regs_phys = r.start + 0x304000;
+ of_node_put(dp);
}
#endif /* ppc (!CONFIG_MAC) */
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 033/568] mptcp: restore window probe
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 032/568] fbdev: valkyriefb: Fix reference count leak in valkyriefb_init Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 034/568] ASoC: qdsp6: q6asm: do not sleep while atomic Greg Kroah-Hartman
` (541 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geliang Tang, Mat Martineau,
Paolo Abeni, Matthieu Baerts (NGI0), Jakub Kicinski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <pabeni@redhat.com>
commit a824084b98d8a1dbd6e85d0842a8eb5e73467f59 upstream.
Since commit 72377ab2d671 ("mptcp: more conservative check for zero
probes") the MPTCP-level zero window probe check is always disabled, as
the TCP-level write queue always contains at least the newly allocated
skb.
Refine the relevant check tacking in account that the above condition
and that such skb can have zero length.
Fixes: 72377ab2d671 ("mptcp: more conservative check for zero probes")
Cc: stable@vger.kernel.org
Reported-by: Geliang Tang <geliang@kernel.org>
Closes: https://lore.kernel.org/d0a814c364e744ca6b836ccd5b6e9146882e8d42.camel@kernel.org
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Tested-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251028-net-mptcp-send-timeout-v1-3-38ffff5a9ec8@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/protocol.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -1391,7 +1391,12 @@ alloc_skb:
if (copy == 0) {
u64 snd_una = READ_ONCE(msk->snd_una);
- if (snd_una != msk->snd_nxt || tcp_write_queue_tail(ssk)) {
+ /* No need for zero probe if there are any data pending
+ * either at the msk or ssk level; skb is the current write
+ * queue tail and can be empty at this point.
+ */
+ if (snd_una != msk->snd_nxt || skb->len ||
+ skb != tcp_send_head(ssk)) {
tcp_remove_empty_skb(ssk);
return 0;
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 034/568] ASoC: qdsp6: q6asm: do not sleep while atomic
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 033/568] mptcp: restore window probe Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 035/568] x86/fpu: Ensure XFD state on signal delivery Greg Kroah-Hartman
` (540 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Stable, Srinivas Kandagatla,
Mark Brown
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
commit fdbb53d318aa94a094434e5f226617f0eb1e8f22 upstream.
For some reason we ended up kfree between spinlock lock and unlock,
which can sleep.
move the kfree out of spinlock section.
Fixes: a2a5d30218fd ("ASoC: qdsp6: q6asm: Add support to memory map and unmap")
Cc: Stable@vger.kernel.org
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20251017085307.4325-2-srinivas.kandagatla@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/qcom/qdsp6/q6asm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/soc/qcom/qdsp6/q6asm.c
+++ b/sound/soc/qcom/qdsp6/q6asm.c
@@ -376,9 +376,9 @@ static void q6asm_audio_client_free_buf(
spin_lock_irqsave(&ac->lock, flags);
port->num_periods = 0;
+ spin_unlock_irqrestore(&ac->lock, flags);
kfree(port->buf);
port->buf = NULL;
- spin_unlock_irqrestore(&ac->lock, flags);
}
/**
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 035/568] x86/fpu: Ensure XFD state on signal delivery
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 034/568] ASoC: qdsp6: q6asm: do not sleep while atomic Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 036/568] wifi: ath10k: Fix memory leak on unsupported WMI command Greg Kroah-Hartman
` (539 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Christopherson, Chang S. Bae,
Dave Hansen, Chao Gao
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chang S. Bae <chang.seok.bae@intel.com>
commit 388eff894d6bc5f921e9bfff0e4b0ab2684a96e9 upstream.
Sean reported [1] the following splat when running KVM tests:
WARNING: CPU: 232 PID: 15391 at xfd_validate_state+0x65/0x70
Call Trace:
<TASK>
fpu__clear_user_states+0x9c/0x100
arch_do_signal_or_restart+0x142/0x210
exit_to_user_mode_loop+0x55/0x100
do_syscall_64+0x205/0x2c0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Chao further identified [2] a reproducible scenario involving signal
delivery: a non-AMX task is preempted by an AMX-enabled task which
modifies the XFD MSR.
When the non-AMX task resumes and reloads XSTATE with init values,
a warning is triggered due to a mismatch between fpstate::xfd and the
CPU's current XFD state. fpu__clear_user_states() does not currently
re-synchronize the XFD state after such preemption.
Invoke xfd_update_state() which detects and corrects the mismatch if
there is a dynamic feature.
This also benefits the sigreturn path, as fpu__restore_sig() may call
fpu__clear_user_states() when the sigframe is inaccessible.
[ dhansen: minor changelog munging ]
Closes: https://lore.kernel.org/lkml/aDCo_SczQOUaB2rS@google.com [1]
Fixes: 672365477ae8a ("x86/fpu: Update XFD state where required")
Reported-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Chang S. Bae <chang.seok.bae@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Chao Gao <chao.gao@intel.com>
Tested-by: Chao Gao <chao.gao@intel.com>
Link: https://lore.kernel.org/all/aDWbctO%2FRfTGiCg3@intel.com [2]
Cc:stable@vger.kernel.org
Link: https://patch.msgid.link/20250610001700.4097-1-chang.seok.bae%40intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/fpu/core.c | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/x86/kernel/fpu/core.c
+++ b/arch/x86/kernel/fpu/core.c
@@ -723,6 +723,9 @@ void fpu__clear_user_states(struct fpu *
!fpregs_state_valid(fpu, smp_processor_id()))
os_xrstor_supervisor(fpu->fpstate);
+ /* Ensure XFD state is in sync before reloading XSTATE */
+ xfd_update_state(fpu->fpstate);
+
/* Reset user states in registers. */
restore_fpregs_from_init_fpstate(XFEATURE_MASK_USER_RESTORE);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 036/568] wifi: ath10k: Fix memory leak on unsupported WMI command
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 035/568] x86/fpu: Ensure XFD state on signal delivery Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 037/568] drm/msm/a6xx: Fix GMU firmware parser Greg Kroah-Hartman
` (538 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeff Johnson, Loic Poulain,
Baochen Qiang, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <loic.poulain@oss.qualcomm.com>
[ Upstream commit 2e9c1da4ee9d0acfca2e0a3d78f3d8cb5802da1b ]
ath10k_wmi_cmd_send takes ownership of the passed buffer (skb) and has the
responsibility to release it in case of error. This patch fixes missing
free in case of early error due to unhandled WMI command ID.
Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1
Fixes: 553215592f14 ("ath10k: warn if give WMI command is not supported")
Suggested-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20250926195656.187970-1-loic.poulain@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath10k/wmi.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index 2fda5ca3e6ee9..22ce8b529067d 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -1935,6 +1935,7 @@ int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id)
if (cmd_id == WMI_CMD_UNSUPPORTED) {
ath10k_warn(ar, "wmi command %d is not supported by firmware\n",
cmd_id);
+ dev_kfree_skb_any(skb);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 037/568] drm/msm/a6xx: Fix GMU firmware parser
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 036/568] wifi: ath10k: Fix memory leak on unsupported WMI command Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 038/568] ALSA: usb-audio: fix control pipe direction Greg Kroah-Hartman
` (537 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Akhil P Oommen, Konrad Dybcio,
Rob Clark, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil P Oommen <akhilpo@oss.qualcomm.com>
[ Upstream commit b4789aac9d3441d9f830f0a4022d8dc122d6cab3 ]
Current parser logic for GMU firmware assumes a dword aligned payload
size for every block. This is not true for all GMU firmwares. So, fix
this by using correct 'size' value in the calculation for the offset
for the next block's header.
Fixes: c6ed04f856a4 ("drm/msm/a6xx: A640/A650 GMU firmware path")
Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
Acked-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/674040/
Message-ID: <20250911-assorted-sept-1-v2-2-a8bf1ee20792@oss.qualcomm.com>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
index cd1d11104607c..7c1894e5627f8 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
@@ -689,6 +689,9 @@ static bool fw_block_mem(struct a6xx_gmu_bo *bo, const struct block_header *blk)
return true;
}
+#define NEXT_BLK(blk) \
+ ((const struct block_header *)((const char *)(blk) + sizeof(*(blk)) + (blk)->size))
+
static int a6xx_gmu_fw_load(struct a6xx_gmu *gmu)
{
struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
@@ -719,7 +722,7 @@ static int a6xx_gmu_fw_load(struct a6xx_gmu *gmu)
for (blk = (const struct block_header *) fw_image->data;
(const u8*) blk < fw_image->data + fw_image->size;
- blk = (const struct block_header *) &blk->data[blk->size >> 2]) {
+ blk = NEXT_BLK(blk)) {
if (blk->size == 0)
continue;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 038/568] ALSA: usb-audio: fix control pipe direction
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 037/568] drm/msm/a6xx: Fix GMU firmware parser Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 039/568] bpf: Sync pending IRQ work before freeing ring buffer Greg Kroah-Hartman
` (536 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Roy Vegard Ovesen, Takashi Iwai,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
[ Upstream commit 7963891f7c9c6f759cc9ab7da71406b4234f3dd6 ]
Since the requesttype has USB_DIR_OUT the pipe should be
constructed with usb_sndctrlpipe().
Fixes: 8dc5efe3d17c ("ALSA: usb-audio: Add support for Presonus Studio 1810c")
Signed-off-by: Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
Link: https://patch.msgid.link/aPPL3tBFE_oU-JHv@ark
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_s1810c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/usb/mixer_s1810c.c b/sound/usb/mixer_s1810c.c
index fac4bbc6b2757..65bdda0841048 100644
--- a/sound/usb/mixer_s1810c.c
+++ b/sound/usb/mixer_s1810c.c
@@ -181,7 +181,7 @@ snd_sc1810c_get_status_field(struct usb_device *dev,
pkt_out.fields[SC1810C_STATE_F1_IDX] = SC1810C_SET_STATE_F1;
pkt_out.fields[SC1810C_STATE_F2_IDX] = SC1810C_SET_STATE_F2;
- ret = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0),
+ ret = snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0),
SC1810C_SET_STATE_REQ,
SC1810C_SET_STATE_REQTYPE,
(*seqnum), 0, &pkt_out, sizeof(pkt_out));
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 039/568] bpf: Sync pending IRQ work before freeing ring buffer
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 038/568] ALSA: usb-audio: fix control pipe direction Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 040/568] scsi: ufs: core: Initialize value of an attribute returned by uic cmd Greg Kroah-Hartman
` (535 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+2617fc732430968b45d2,
Noorain Eqbal, Alexei Starovoitov, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Noorain Eqbal <nooraineqbal@gmail.com>
[ Upstream commit 4e9077638301816a7d73fa1e1b4c1db4a7e3b59c ]
Fix a race where irq_work can be queued in bpf_ringbuf_commit()
but the ring buffer is freed before the work executes.
In the syzbot reproducer, a BPF program attached to sched_switch
triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer
is freed before this work executes, the irq_work thread may accesses
freed memory.
Calling `irq_work_sync(&rb->work)` ensures that all pending irq_work
complete before freeing the buffer.
Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it")
Reported-by: syzbot+2617fc732430968b45d2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2617fc732430968b45d2
Tested-by: syzbot+2617fc732430968b45d2@syzkaller.appspotmail.com
Signed-off-by: Noorain Eqbal <nooraineqbal@gmail.com>
Link: https://lore.kernel.org/r/20251020180301.103366-1-nooraineqbal@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/ringbuf.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c
index 095416e40df3c..1d49e77a6a01b 100644
--- a/kernel/bpf/ringbuf.c
+++ b/kernel/bpf/ringbuf.c
@@ -218,6 +218,8 @@ static struct bpf_map *ringbuf_map_alloc(union bpf_attr *attr)
static void bpf_ringbuf_free(struct bpf_ringbuf *rb)
{
+ irq_work_sync(&rb->work);
+
/* copy pages pointer and nr_pages to local variable, as we are going
* to unmap rb itself with vunmap() below
*/
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 040/568] scsi: ufs: core: Initialize value of an attribute returned by uic cmd
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 039/568] bpf: Sync pending IRQ work before freeing ring buffer Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 041/568] bpf: Do not audit capability check in do_jit() Greg Kroah-Hartman
` (534 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wonkon Kim, Bart Van Assche,
Martin K. Petersen, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wonkon Kim <wkon.kim@samsung.com>
[ Upstream commit 6fe4c679dde3075cb481beb3945269bb2ef8b19a ]
If ufshcd_send_cmd() fails, *mib_val may have a garbage value. It can
get an unintended value of an attribute.
Make ufshcd_dme_get_attr() always initialize *mib_val.
Fixes: 12b4fdb4f6bc ("[SCSI] ufs: add dme configuration primitives")
Signed-off-by: Wonkon Kim <wkon.kim@samsung.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20251020061539.28661-2-wkon.kim@samsung.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/core/ufshcd.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index f9adb11067470..d78ac2817c1ff 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -4027,8 +4027,8 @@ int ufshcd_dme_get_attr(struct ufs_hba *hba, u32 attr_sel,
get, UIC_GET_ATTR_ID(attr_sel),
UFS_UIC_COMMAND_RETRIES - retries);
- if (mib_val && !ret)
- *mib_val = uic_cmd.argument3;
+ if (mib_val)
+ *mib_val = ret == 0 ? uic_cmd.argument3 : 0;
if (peer && (hba->quirks & UFSHCD_QUIRK_DME_PEER_ACCESS_AUTO_MODE)
&& pwr_mode_change)
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 041/568] bpf: Do not audit capability check in do_jit()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 040/568] scsi: ufs: core: Initialize value of an attribute returned by uic cmd Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 042/568] ASoC: Intel: avs: Unprepare a stream when XRUN occurs Greg Kroah-Hartman
` (533 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ondrej Mosnacek, Paul Moore,
Alexei Starovoitov, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Mosnacek <omosnace@redhat.com>
[ Upstream commit 881a9c9cb7856b24e390fad9f59acfd73b98b3b2 ]
The failure of this check only results in a security mitigation being
applied, slightly affecting performance of the compiled BPF program. It
doesn't result in a failed syscall, an thus auditing a failed LSM
permission check for it is unwanted. For example with SELinux, it causes
a denial to be reported for confined processes running as root, which
tends to be flagged as a problem to be fixed in the policy. Yet
dontauditing or allowing CAP_SYS_ADMIN to the domain may not be
desirable, as it would allow/silence also other checks - either going
against the principle of least privilege or making debugging potentially
harder.
Fix it by changing it from capable() to ns_capable_noaudit(), which
instructs the LSMs to not audit the resulting denials.
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2369326
Fixes: d4e89d212d40 ("x86/bpf: Call branch history clearing sequence on exit")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-by: Paul Moore <paul@paul-moore.com>
Link: https://lore.kernel.org/r/20251021122758.2659513-1-omosnace@redhat.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/net/bpf_jit_comp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index f3068bb53c4db..095fec941bb73 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -1809,7 +1809,7 @@ st: if (is_imm8(insn->off))
ctx->cleanup_addr = proglen;
if (bpf_prog_was_classic(bpf_prog) &&
- !capable(CAP_SYS_ADMIN)) {
+ !ns_capable_noaudit(&init_user_ns, CAP_SYS_ADMIN)) {
u8 *ip = image + addrs[i - 1];
if (emit_spectre_bhb_barrier(&prog, ip, bpf_prog))
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 042/568] ASoC: Intel: avs: Unprepare a stream when XRUN occurs
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 041/568] bpf: Do not audit capability check in do_jit() Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 043/568] ASoC: fsl_sai: fix bit order for DSD format Greg Kroah-Hartman
` (532 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cezary Rojewski, Mark Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cezary Rojewski <cezary.rojewski@intel.com>
[ Upstream commit cfca1637bc2b6b1e4f191d2f0b25f12402fbbb26 ]
The pcm->prepare() function may be called multiple times in a row by the
userspace, as mentioned in the documentation. The driver shall take that
into account and prevent redundancy. However, the exact same function is
called during XRUNs and in such case, the particular stream shall be
reset and setup anew.
Fixes: 9114700b496c ("ASoC: Intel: avs: Generic PCM FE operations")
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://patch.msgid.link/20251023092348.3119313-2-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/avs/pcm.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/soc/intel/avs/pcm.c b/sound/soc/intel/avs/pcm.c
index 07428b5755b8a..9d3c0ea99a298 100644
--- a/sound/soc/intel/avs/pcm.c
+++ b/sound/soc/intel/avs/pcm.c
@@ -556,6 +556,8 @@ static int avs_dai_fe_prepare(struct snd_pcm_substream *substream, struct snd_so
data = snd_soc_dai_get_dma_data(dai, substream);
host_stream = data->host_stream;
+ if (runtime->state == SNDRV_PCM_STATE_XRUN)
+ hdac_stream(host_stream)->prepared = false;
if (hdac_stream(host_stream)->prepared)
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 043/568] ASoC: fsl_sai: fix bit order for DSD format
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 042/568] ASoC: Intel: avs: Unprepare a stream when XRUN occurs Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 044/568] libbpf: Fix powerpcs stack register definition in bpf_tracing.h Greg Kroah-Hartman
` (531 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shengjiu Wang, Mark Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <shengjiu.wang@nxp.com>
[ Upstream commit d9fbe5b0bf7e2d1e20d53e4e2274f9f61bdcca98 ]
The DSD little endian format requires the msb first, because oldest bit
is in msb.
found this issue by testing with pipewire.
Fixes: c111c2ddb3fd ("ASoC: fsl_sai: Add PDM daifmt support")
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Link: https://patch.msgid.link/20251023064538.368850-2-shengjiu.wang@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/fsl/fsl_sai.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
index e622c8375a465..f5266be2bbc22 100644
--- a/sound/soc/fsl/fsl_sai.c
+++ b/sound/soc/fsl/fsl_sai.c
@@ -322,7 +322,6 @@ static int fsl_sai_set_dai_fmt_tr(struct snd_soc_dai *cpu_dai,
break;
case SND_SOC_DAIFMT_PDM:
val_cr2 |= FSL_SAI_CR2_BCP;
- val_cr4 &= ~FSL_SAI_CR4_MF;
sai->is_pdm_mode = true;
break;
case SND_SOC_DAIFMT_RIGHT_J:
@@ -597,7 +596,7 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream,
val_cr5 |= FSL_SAI_CR5_WNW(slot_width);
val_cr5 |= FSL_SAI_CR5_W0W(slot_width);
- if (sai->is_lsb_first || sai->is_pdm_mode)
+ if (sai->is_lsb_first)
val_cr5 |= FSL_SAI_CR5_FBT(0);
else
val_cr5 |= FSL_SAI_CR5_FBT(word_width - 1);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 044/568] libbpf: Fix powerpcs stack register definition in bpf_tracing.h
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 043/568] ASoC: fsl_sai: fix bit order for DSD format Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 045/568] usbnet: Prevents free active kevent Greg Kroah-Hartman
` (530 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrii Nakryiko, Naveen N Rao (AMD),
Alexei Starovoitov, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <andrii@kernel.org>
[ Upstream commit 7221b9caf84b3294688228a19273d74ea19a2ee4 ]
retsnoop's build on powerpc (ppc64le) architecture ([0]) failed due to
wrong definition of PT_REGS_SP() macro. Looking at powerpc's
implementation of stack unwinding in perf_callchain_user_64() clearly
shows that stack pointer register is gpr[1].
Fix libbpf's definition of __PT_SP_REG for powerpc to fix all this.
[0] https://kojipkgs.fedoraproject.org/work/tasks/1544/137921544/build.log
Fixes: 138d6153a139 ("samples/bpf: Enable powerpc support")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Naveen N Rao (AMD) <naveen@kernel.org>
Link: https://lore.kernel.org/r/20251020203643.989467-1-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/bpf_tracing.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/lib/bpf/bpf_tracing.h b/tools/lib/bpf/bpf_tracing.h
index 9c1b1689068d1..8f87a1765c80a 100644
--- a/tools/lib/bpf/bpf_tracing.h
+++ b/tools/lib/bpf/bpf_tracing.h
@@ -202,7 +202,7 @@ struct pt_regs___arm64 {
#define __PT_RET_REG regs[31]
#define __PT_FP_REG __unsupported__
#define __PT_RC_REG gpr[3]
-#define __PT_SP_REG sp
+#define __PT_SP_REG gpr[1]
#define __PT_IP_REG nip
/* powerpc does not select ARCH_HAS_SYSCALL_WRAPPER. */
#define PT_REGS_SYSCALL_REGS(ctx) ctx
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 045/568] usbnet: Prevents free active kevent
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 044/568] libbpf: Fix powerpcs stack register definition in bpf_tracing.h Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 046/568] Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once Greg Kroah-Hartman
` (529 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sam Sun, Lizhi Xu, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Xu <lizhi.xu@windriver.com>
[ Upstream commit 420c84c330d1688b8c764479e5738bbdbf0a33de ]
The root cause of this issue are:
1. When probing the usbnet device, executing usbnet_link_change(dev, 0, 0);
put the kevent work in global workqueue. However, the kevent has not yet
been scheduled when the usbnet device is unregistered. Therefore, executing
free_netdev() results in the "free active object (kevent)" error reported
here.
2. Another factor is that when calling usbnet_disconnect()->unregister_netdev(),
if the usbnet device is up, ndo_stop() is executed to cancel the kevent.
However, because the device is not up, ndo_stop() is not executed.
The solution to this problem is to cancel the kevent before executing
free_netdev().
Fixes: a69e617e533e ("usbnet: Fix linkwatch use-after-free on disconnect")
Reported-by: Sam Sun <samsun1006219@gmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=8bfd7bcc98f7300afb84
Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
Link: https://patch.msgid.link/20251022024007.1831898-1-lizhi.xu@windriver.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/usbnet.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index a68fead887207..6bdf035e35f56 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1645,6 +1645,8 @@ void usbnet_disconnect (struct usb_interface *intf)
net = dev->net;
unregister_netdev (net);
+ cancel_work_sync(&dev->kevent);
+
while ((urb = usb_get_from_anchor(&dev->deferred))) {
dev_kfree_skb(urb->context);
kfree(urb->sg);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 046/568] Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 045/568] usbnet: Prevents free active kevent Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 047/568] Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset Greg Kroah-Hartman
` (528 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cen Zhang, Luiz Augusto von Dentz,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <zzzccc427@163.com>
[ Upstream commit 09b0cd1297b4dbfe736aeaa0ceeab2265f47f772 ]
hci_cmd_sync_dequeue_once() does lookup and then cancel
the entry under two separate lock sections. Meanwhile,
hci_cmd_sync_work() can also delete the same entry,
leading to double list_del() and "UAF".
Fix this by holding cmd_sync_work_lock across both
lookup and cancel, so that the entry cannot be removed
concurrently.
Fixes: 505ea2b29592 ("Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue")
Reported-by: Cen Zhang <zzzccc427@163.com>
Signed-off-by: Cen Zhang <zzzccc427@163.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_sync.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 851a43a5aee0c..2937e7a37bcba 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -838,11 +838,17 @@ bool hci_cmd_sync_dequeue_once(struct hci_dev *hdev,
{
struct hci_cmd_sync_work_entry *entry;
- entry = hci_cmd_sync_lookup_entry(hdev, func, data, destroy);
- if (!entry)
+ mutex_lock(&hdev->cmd_sync_work_lock);
+
+ entry = _hci_cmd_sync_lookup_entry(hdev, func, data, destroy);
+ if (!entry) {
+ mutex_unlock(&hdev->cmd_sync_work_lock);
return false;
+ }
- hci_cmd_sync_cancel_entry(hdev, entry);
+ _hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED);
+
+ mutex_unlock(&hdev->cmd_sync_work_lock);
return true;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 047/568] Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 046/568] Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 048/568] Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 Greg Kroah-Hartman
` (527 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Lu, Luiz Augusto von Dentz,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lu <chris.lu@mediatek.com>
[ Upstream commit 77343b8b4f87560f8f03e77b98a81ff3a147b262 ]
This patch adds logic to handle power management control when the
Bluetooth function is closed during the SDIO reset sequence.
Specifically, if BT is closed before reset, the driver enables the
SDIO function and sets driver pmctrl. After reset, if BT remains
closed, the driver sets firmware pmctrl and disables the SDIO function.
These changes ensure proper power management and device state consistency
across the reset flow.
Fixes: 8fafe702253d ("Bluetooth: mt7921s: support bluetooth reset mechanism")
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btmtksdio.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
index f9a3444753c2b..97659b4792e69 100644
--- a/drivers/bluetooth/btmtksdio.c
+++ b/drivers/bluetooth/btmtksdio.c
@@ -1257,6 +1257,12 @@ static void btmtksdio_cmd_timeout(struct hci_dev *hdev)
sdio_claim_host(bdev->func);
+ /* set drv_pmctrl if BT is closed before doing reset */
+ if (!test_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state)) {
+ sdio_enable_func(bdev->func);
+ btmtksdio_drv_pmctrl(bdev);
+ }
+
sdio_writel(bdev->func, C_INT_EN_CLR, MTK_REG_CHLPCR, NULL);
skb_queue_purge(&bdev->txq);
cancel_work_sync(&bdev->txrx_work);
@@ -1272,6 +1278,12 @@ static void btmtksdio_cmd_timeout(struct hci_dev *hdev)
goto err;
}
+ /* set fw_pmctrl back if BT is closed after doing reset */
+ if (!test_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state)) {
+ btmtksdio_fw_pmctrl(bdev);
+ sdio_disable_func(bdev->func);
+ }
+
clear_bit(BTMTKSDIO_PATCH_ENABLED, &bdev->tx_state);
err:
sdio_release_host(bdev->func);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 048/568] Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 047/568] Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 049/568] Bluetooth: ISO: Add support for periodic adv reports processing Greg Kroah-Hartman
` (526 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit 0d92808024b4e9868cef68d16f121d509843e80e ]
This fixes the state tracking of advertisement set/instance 0x00 which
is considered a legacy instance and is not tracked individually by
adv_instances list, previously it was assumed that hci_dev itself would
track it via HCI_LE_ADV but that is a global state not specifc to
instance 0x00, so to fix it a new flag is introduced that only tracks the
state of instance 0x00.
Fixes: 1488af7b8b5f ("Bluetooth: hci_sync: Fix hci_resume_advertising_sync")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/bluetooth/hci.h | 1 +
net/bluetooth/hci_event.c | 4 ++++
net/bluetooth/hci_sync.c | 5 ++---
3 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 09bc4bf805c62..1a20fb1fa157b 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -372,6 +372,7 @@ enum {
HCI_USER_CHANNEL,
HCI_EXT_CONFIGURED,
HCI_LE_ADV,
+ HCI_LE_ADV_0,
HCI_LE_PER_ADV,
HCI_LE_SCAN,
HCI_SSP_ENABLED,
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index a0ce0a1e3258e..e1f1be4dfe97a 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1655,6 +1655,8 @@ static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data,
if (adv)
adv->enabled = true;
+ else if (!set->handle)
+ hci_dev_set_flag(hdev, HCI_LE_ADV_0);
conn = hci_lookup_le_connect(hdev);
if (conn)
@@ -1665,6 +1667,8 @@ static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data,
if (cp->num_of_sets) {
if (adv)
adv->enabled = false;
+ else if (!set->handle)
+ hci_dev_clear_flag(hdev, HCI_LE_ADV_0);
/* If just one instance was disabled check if there are
* any other instance enabled before clearing HCI_LE_ADV
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 2937e7a37bcba..5ad09900f8ff1 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -2607,9 +2607,8 @@ static int hci_resume_advertising_sync(struct hci_dev *hdev)
/* If current advertising instance is set to instance 0x00
* then we need to re-enable it.
*/
- if (!hdev->cur_adv_instance)
- err = hci_enable_ext_advertising_sync(hdev,
- hdev->cur_adv_instance);
+ if (hci_dev_test_and_clear_flag(hdev, HCI_LE_ADV_0))
+ err = hci_enable_ext_advertising_sync(hdev, 0x00);
} else {
/* Schedule for most recent instance to be restarted and begin
* the software rotation loop
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 049/568] Bluetooth: ISO: Add support for periodic adv reports processing
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 048/568] Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 050/568] Bluetooth: ISO: Fix another instance of dst_type handling Greg Kroah-Hartman
` (525 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudia Draghicescu,
Luiz Augusto von Dentz, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudia Draghicescu <claudia.rosu@nxp.com>
[ Upstream commit 9c0826310bfb784c9bac7d1d9454e304185446c5 ]
In the case of a Periodic Synchronized Receiver,
the PA report received from a Broadcaster contains the BASE,
which has information about codec and other parameters of a BIG.
This isnformation is stored and the application can retrieve it
using getsockopt(BT_ISO_BASE).
Signed-off-by: Claudia Draghicescu <claudia.rosu@nxp.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: c403da5e98b0 ("Bluetooth: ISO: Fix another instance of dst_type handling")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/bluetooth/hci.h | 11 +++++++++++
net/bluetooth/hci_event.c | 23 +++++++++++++++++++++++
net/bluetooth/iso.c | 28 +++++++++++++++++++++++++++-
3 files changed, 61 insertions(+), 1 deletion(-)
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 1a20fb1fa157b..018fc64329fc6 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -2768,6 +2768,17 @@ struct hci_ev_le_enh_conn_complete {
__u8 clk_accurancy;
} __packed;
+#define HCI_EV_LE_PER_ADV_REPORT 0x0f
+struct hci_ev_le_per_adv_report {
+ __le16 sync_handle;
+ __u8 tx_power;
+ __u8 rssi;
+ __u8 cte_type;
+ __u8 data_status;
+ __u8 length;
+ __u8 data[];
+} __packed;
+
#define HCI_EV_LE_EXT_ADV_SET_TERM 0x12
struct hci_evt_le_ext_adv_set_term {
__u8 status;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index e1f1be4dfe97a..e516b169b12fb 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -6469,6 +6469,24 @@ static void hci_le_pa_sync_estabilished_evt(struct hci_dev *hdev, void *data,
hci_dev_unlock(hdev);
}
+static void hci_le_per_adv_report_evt(struct hci_dev *hdev, void *data,
+ struct sk_buff *skb)
+{
+ struct hci_ev_le_per_adv_report *ev = data;
+ int mask = hdev->link_mode;
+ __u8 flags = 0;
+
+ bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle));
+
+ hci_dev_lock(hdev);
+
+ mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, ISO_LINK, &flags);
+ if (!(mask & HCI_LM_ACCEPT))
+ hci_le_pa_term_sync(hdev, ev->sync_handle);
+
+ hci_dev_unlock(hdev);
+}
+
static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev, void *data,
struct sk_buff *skb)
{
@@ -7002,6 +7020,11 @@ static const struct hci_le_ev {
HCI_LE_EV(HCI_EV_LE_PA_SYNC_ESTABLISHED,
hci_le_pa_sync_estabilished_evt,
sizeof(struct hci_ev_le_pa_sync_established)),
+ /* [0x0f = HCI_EV_LE_PER_ADV_REPORT] */
+ HCI_LE_EV_VL(HCI_EV_LE_PER_ADV_REPORT,
+ hci_le_per_adv_report_evt,
+ sizeof(struct hci_ev_le_per_adv_report),
+ HCI_MAX_EVENT_SIZE),
/* [0x12 = HCI_EV_LE_EXT_ADV_SET_TERM] */
HCI_LE_EV(HCI_EV_LE_EXT_ADV_SET_TERM, hci_le_ext_adv_term_evt,
sizeof(struct hci_evt_le_ext_adv_set_term)),
diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index c542497f040cc..bf7692e15deef 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -1314,7 +1314,8 @@ static int iso_sock_getsockopt(struct socket *sock, int level, int optname,
break;
case BT_ISO_BASE:
- if (sk->sk_state == BT_CONNECTED) {
+ if (sk->sk_state == BT_CONNECTED &&
+ !bacmp(&iso_pi(sk)->dst, BDADDR_ANY)) {
base_len = iso_pi(sk)->conn->hcon->le_per_adv_data_len;
base = iso_pi(sk)->conn->hcon->le_per_adv_data;
} else {
@@ -1487,6 +1488,9 @@ static void iso_conn_ready(struct iso_conn *conn)
bacpy(&iso_pi(sk)->dst, &hcon->dst);
iso_pi(sk)->dst_type = hcon->dst_type;
+ iso_pi(sk)->sync_handle = iso_pi(parent)->sync_handle;
+ memcpy(iso_pi(sk)->base, iso_pi(parent)->base, iso_pi(parent)->base_len);
+ iso_pi(sk)->base_len = iso_pi(parent)->base_len;
hci_conn_hold(hcon);
iso_chan_add(conn, sk, parent);
@@ -1517,12 +1521,20 @@ static bool iso_match_sync_handle(struct sock *sk, void *data)
return le16_to_cpu(ev->sync_handle) == iso_pi(sk)->sync_handle;
}
+static bool iso_match_sync_handle_pa_report(struct sock *sk, void *data)
+{
+ struct hci_ev_le_per_adv_report *ev = data;
+
+ return le16_to_cpu(ev->sync_handle) == iso_pi(sk)->sync_handle;
+}
+
/* ----- ISO interface with lower layer (HCI) ----- */
int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
{
struct hci_ev_le_pa_sync_established *ev1;
struct hci_evt_le_big_info_adv_report *ev2;
+ struct hci_ev_le_per_adv_report *ev3;
struct sock *sk;
int lm = 0;
@@ -1538,6 +1550,9 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
* 2. HCI_EVT_LE_BIG_INFO_ADV_REPORT: When connect_ind is triggered by a
* a BIG Info it attempts to check if there any listening socket with
* the same sync_handle and if it does then attempt to create a sync.
+ * 3. HCI_EV_LE_PER_ADV_REPORT: When a PA report is received, it is stored
+ * in iso_pi(sk)->base so it can be passed up to user, in the case of a
+ * broadcast sink.
*/
ev1 = hci_recv_event_data(hdev, HCI_EV_LE_PA_SYNC_ESTABLISHED);
if (ev1) {
@@ -1570,6 +1585,17 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
sk = NULL;
}
}
+ }
+
+ ev3 = hci_recv_event_data(hdev, HCI_EV_LE_PER_ADV_REPORT);
+ if (ev3) {
+ sk = iso_get_sock_listen(&hdev->bdaddr, bdaddr,
+ iso_match_sync_handle_pa_report, ev3);
+
+ if (sk) {
+ memcpy(iso_pi(sk)->base, ev3->data, ev3->length);
+ iso_pi(sk)->base_len = ev3->length;
+ }
} else {
sk = iso_get_sock_listen(&hdev->bdaddr, BDADDR_ANY, NULL, NULL);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 050/568] Bluetooth: ISO: Fix another instance of dst_type handling
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 049/568] Bluetooth: ISO: Add support for periodic adv reports processing Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 051/568] drm/etnaviv: fix flush sequence logic Greg Kroah-Hartman
` (524 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit c403da5e98b04a2aec9cfb25cbeeb28d7ce29975 ]
Socket dst_type cannot be directly assigned to hci_conn->type since
there domain is different which may lead to the wrong address type being
used.
Fixes: 6a5ad251b7cd ("Bluetooth: ISO: Fix possible circular locking dependency")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/iso.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index bf7692e15deef..7d521ffc66767 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -1487,7 +1487,13 @@ static void iso_conn_ready(struct iso_conn *conn)
}
bacpy(&iso_pi(sk)->dst, &hcon->dst);
- iso_pi(sk)->dst_type = hcon->dst_type;
+
+ /* Convert from HCI to three-value type */
+ if (hcon->dst_type == ADDR_LE_DEV_PUBLIC)
+ iso_pi(sk)->dst_type = BDADDR_LE_PUBLIC;
+ else
+ iso_pi(sk)->dst_type = BDADDR_LE_RANDOM;
+
iso_pi(sk)->sync_handle = iso_pi(parent)->sync_handle;
memcpy(iso_pi(sk)->base, iso_pi(parent)->base, iso_pi(parent)->base_len);
iso_pi(sk)->base_len = iso_pi(parent)->base_len;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 051/568] drm/etnaviv: fix flush sequence logic
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 050/568] Bluetooth: ISO: Fix another instance of dst_type handling Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 052/568] net: hns3: return error code when function fails Greg Kroah-Hartman
` (523 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tomeu Vizoso, Lucas Stach,
Christian Gmeiner, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomeu Vizoso <tomeu@tomeuvizoso.net>
[ Upstream commit a042beac6e6f8ac1e923784cfff98b47cbabb185 ]
The current logic uses the flush sequence from the current address
space. This is harmless when deducing the flush requirements for the
current submit, as either the incoming address space is the same one
as the currently active one or we switch context, in which case the
flush is unconditional.
However, this sequence is also stored as the current flush sequence
of the GPU. If we switch context the stored flush sequence will no
longer belong to the currently active address space. This incoherency
can then cause missed flushes, resulting in translation errors.
Fixes: 27b67278e007 ("drm/etnaviv: rework MMU handling")
Signed-off-by: Tomeu Vizoso <tomeu@tomeuvizoso.net>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Reviewed-by: Christian Gmeiner <cgmeiner@igalia.com>
Link: https://lore.kernel.org/r/20251021093723.3887980-1-l.stach@pengutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_buffer.c b/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
index 982174af74b1e..7d897aafb2a6a 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
@@ -346,7 +346,7 @@ void etnaviv_buffer_queue(struct etnaviv_gpu *gpu, u32 exec_state,
u32 link_target, link_dwords;
bool switch_context = gpu->exec_state != exec_state;
bool switch_mmu_context = gpu->mmu_context != mmu_context;
- unsigned int new_flush_seq = READ_ONCE(gpu->mmu_context->flush_seq);
+ unsigned int new_flush_seq = READ_ONCE(mmu_context->flush_seq);
bool need_flush = switch_mmu_context || gpu->flush_seq != new_flush_seq;
bool has_blt = !!(gpu->identity.minor_features5 &
chipMinorFeatures5_BLT_ENGINE);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 052/568] net: hns3: return error code when function fails
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 051/568] drm/etnaviv: fix flush sequence logic Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 053/568] drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() Greg Kroah-Hartman
` (522 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jijie Shao, Alexander Lobakin,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jijie Shao <shaojijie@huawei.com>
[ Upstream commit 03ca7c8c42be913529eb9f188278114430c6abbd ]
Currently, in hclge_mii_ioctl(), the operation to
read the PHY register (SIOCGMIIREG) always returns 0.
This patch changes the return type of hclge_read_phy_reg(),
returning an error code when the function fails.
Fixes: 024712f51e57 ("net: hns3: add ioctl support for imp-controlled PHYs")
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>
Link: https://patch.msgid.link/20251023131338.2642520-2-shaojijie@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 +--
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c | 9 ++++++---
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h | 2 +-
3 files changed, 8 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index c509c1e12109f..c45340f26ee49 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -9452,8 +9452,7 @@ static int hclge_mii_ioctl(struct hclge_dev *hdev, struct ifreq *ifr, int cmd)
/* this command reads phy id and register at the same time */
fallthrough;
case SIOCGMIIREG:
- data->val_out = hclge_read_phy_reg(hdev, data->reg_num);
- return 0;
+ return hclge_read_phy_reg(hdev, data->reg_num, &data->val_out);
case SIOCSMIIREG:
return hclge_write_phy_reg(hdev, data->reg_num, data->val_in);
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c
index 80079657afebe..b8dbf932caf94 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c
@@ -274,7 +274,7 @@ void hclge_mac_stop_phy(struct hclge_dev *hdev)
phy_stop(phydev);
}
-u16 hclge_read_phy_reg(struct hclge_dev *hdev, u16 reg_addr)
+int hclge_read_phy_reg(struct hclge_dev *hdev, u16 reg_addr, u16 *val)
{
struct hclge_phy_reg_cmd *req;
struct hclge_desc desc;
@@ -286,11 +286,14 @@ u16 hclge_read_phy_reg(struct hclge_dev *hdev, u16 reg_addr)
req->reg_addr = cpu_to_le16(reg_addr);
ret = hclge_cmd_send(&hdev->hw, &desc, 1);
- if (ret)
+ if (ret) {
dev_err(&hdev->pdev->dev,
"failed to read phy reg, ret = %d.\n", ret);
+ return ret;
+ }
- return le16_to_cpu(req->reg_val);
+ *val = le16_to_cpu(req->reg_val);
+ return 0;
}
int hclge_write_phy_reg(struct hclge_dev *hdev, u16 reg_addr, u16 val)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h
index 4200d0b6d9317..21d434c82475b 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h
@@ -13,7 +13,7 @@ int hclge_mac_connect_phy(struct hnae3_handle *handle);
void hclge_mac_disconnect_phy(struct hnae3_handle *handle);
void hclge_mac_start_phy(struct hclge_dev *hdev);
void hclge_mac_stop_phy(struct hclge_dev *hdev);
-u16 hclge_read_phy_reg(struct hclge_dev *hdev, u16 reg_addr);
+int hclge_read_phy_reg(struct hclge_dev *hdev, u16 reg_addr, u16 *val);
int hclge_write_phy_reg(struct hclge_dev *hdev, u16 reg_addr, u16 val);
#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 053/568] drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 052/568] net: hns3: return error code when function fails Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 054/568] drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji Greg Kroah-Hartman
` (521 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Wang, Hawking Zhang,
Alex Deucher, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <kevinyang.wang@amd.com>
[ Upstream commit 238d468d3ed18a324bb9d8c99f18c665dbac0511 ]
'table_index' is a variable defined by the smu driver (kmd)
'table_id' is a variable defined by the hw smu (pmfw)
This code should use table_index as a bounds check.
Fixes: caad2613dc4bd ("drm/amd/powerplay: move table setting common code to smu_cmn.c")
Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit fca0c66b22303de0d1d6313059baf4dc960a4753)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c
index fd1faa840ec09..24b39a80481a8 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c
@@ -862,7 +862,7 @@ int smu_cmn_update_table(struct smu_context *smu,
table_index);
uint32_t table_size;
int ret = 0;
- if (!table_data || table_id >= SMU_TABLE_COUNT || table_id < 0)
+ if (!table_data || table_index >= SMU_TABLE_COUNT || table_id < 0)
return -EINVAL;
table_size = smu_table->tables[table_index].size;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 054/568] drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 053/568] drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 055/568] drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland Greg Kroah-Hartman
` (520 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, John Smith, Alex Deucher,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Smith <itistotalbotnet@gmail.com>
[ Upstream commit 07a13f913c291d6ec72ee4fc848d13ecfdc0e705 ]
Previously this was initialized with zero which represented PCIe Gen
1.0 instead of using the
maximum value from the speed table which is the behaviour of all other
smumgr implementations.
Fixes: 18edef19ea44 ("drm/amd/powerplay: implement fw image related smu interface for Fiji.")
Signed-off-by: John Smith <itistotalbotnet@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit c52238c9fb414555c68340cd80e487d982c1921c)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c b/drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c
index 02c094a06605d..50deb4ce767ee 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c
@@ -2024,7 +2024,7 @@ static int fiji_init_smc_table(struct pp_hwmgr *hwmgr)
table->VoltageResponseTime = 0;
table->PhaseResponseTime = 0;
table->MemoryThermThrottleEnable = 1;
- table->PCIeBootLinkLevel = 0; /* 0:Gen1 1:Gen2 2:Gen3*/
+ table->PCIeBootLinkLevel = (uint8_t) (data->dpm_table.pcie_speed_table.count);
table->PCIeGenInterval = 1;
table->VRConfig = 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 055/568] drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 054/568] drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 056/568] block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL Greg Kroah-Hartman
` (519 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, John Smith, Alex Deucher,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Smith <itistotalbotnet@gmail.com>
[ Upstream commit 501672e3c1576aa9a8364144213c77b98a31a42c ]
Previously this was initialized with zero which represented PCIe Gen
1.0 instead of using the
maximum value from the speed table which is the behaviour of all other
smumgr implementations.
Fixes: 18aafc59b106 ("drm/amd/powerplay: implement fw related smu interface for iceland.")
Signed-off-by: John Smith <itistotalbotnet@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 92b0a6ae6672857ddeabf892223943d2f0e06c97)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c b/drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c
index 03df35dee8ba8..6ddf9ce5471e8 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c
@@ -2028,7 +2028,7 @@ static int iceland_init_smc_table(struct pp_hwmgr *hwmgr)
table->VoltageResponseTime = 0;
table->PhaseResponseTime = 0;
table->MemoryThermThrottleEnable = 1;
- table->PCIeBootLinkLevel = 0;
+ table->PCIeBootLinkLevel = (uint8_t) (data->dpm_table.pcie_speed_table.count);
table->PCIeGenInterval = 1;
result = iceland_populate_smc_svi2_config(hwmgr, table);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 056/568] block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 055/568] drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:20 ` [PATCH 6.1 057/568] block: make REQ_OP_ZONE_OPEN a write operation Greg Kroah-Hartman
` (518 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Chaitanya Kulkarni,
Christoph Hellwig, Johannes Thumshirn, Jens Axboe
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <dlemoal@kernel.org>
commit 12a1c9353c47c0fb3464eba2d78cdf649dee1cf7 upstream.
REQ_OP_ZONE_RESET_ALL is a zone management request. Fix
op_is_zone_mgmt() to return true for that operation, like it already
does for REQ_OP_ZONE_RESET.
While no problems were reported without this fix, this change allows
strengthening checks in various block device drivers (scsi sd,
virtioblk, DM) where op_is_zone_mgmt() is used to verify that a zone
management command is not being issued to a regular block device.
Fixes: 6c1b1da58f8c ("block: add zone open, close and finish operations")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/blk_types.h | 1 +
1 file changed, 1 insertion(+)
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -519,6 +519,7 @@ static inline bool op_is_zone_mgmt(enum
{
switch (op & REQ_OP_MASK) {
case REQ_OP_ZONE_RESET:
+ case REQ_OP_ZONE_RESET_ALL:
case REQ_OP_ZONE_OPEN:
case REQ_OP_ZONE_CLOSE:
case REQ_OP_ZONE_FINISH:
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 057/568] block: make REQ_OP_ZONE_OPEN a write operation
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 056/568] block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL Greg Kroah-Hartman
@ 2025-12-03 15:20 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 058/568] regmap: slimbus: fix bus_context pointer in regmap init calls Greg Kroah-Hartman
` (517 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Chaitanya Kulkarni,
Christoph Hellwig, Johannes Thumshirn, Jens Axboe
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <dlemoal@kernel.org>
commit 19de03b312d69a7e9bacb51c806c6e3f4207376c upstream.
A REQ_OP_OPEN_ZONE request changes the condition of a sequential zone of
a zoned block device to the explicitly open condition
(BLK_ZONE_COND_EXP_OPEN). As such, it should be considered a write
operation.
Change this operation code to be an odd number to reflect this. The
following operation numbers are changed to keep the numbering compact.
No problems were reported without this change as this operation has no
data. However, this unifies the zone operation to reflect that they
modify the device state and also allows strengthening checks in the
block layer, e.g. checking if this operation is not issued against a
read-only device.
Fixes: 6c1b1da58f8c ("block: add zone open, close and finish operations")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/blk_types.h | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -371,15 +371,15 @@ enum req_op {
/* write the zero filled sector many times */
REQ_OP_WRITE_ZEROES = (__force blk_opf_t)9,
/* Open a zone */
- REQ_OP_ZONE_OPEN = (__force blk_opf_t)10,
+ REQ_OP_ZONE_OPEN = (__force blk_opf_t)11,
/* Close a zone */
- REQ_OP_ZONE_CLOSE = (__force blk_opf_t)11,
+ REQ_OP_ZONE_CLOSE = (__force blk_opf_t)13,
/* Transition a zone to full */
- REQ_OP_ZONE_FINISH = (__force blk_opf_t)13,
+ REQ_OP_ZONE_FINISH = (__force blk_opf_t)15,
/* reset a zone write pointer */
- REQ_OP_ZONE_RESET = (__force blk_opf_t)15,
+ REQ_OP_ZONE_RESET = (__force blk_opf_t)17,
/* reset all the zone present on the device */
- REQ_OP_ZONE_RESET_ALL = (__force blk_opf_t)17,
+ REQ_OP_ZONE_RESET_ALL = (__force blk_opf_t)19,
/* Driver private requests */
REQ_OP_DRV_IN = (__force blk_opf_t)34,
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 058/568] regmap: slimbus: fix bus_context pointer in regmap init calls
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2025-12-03 15:20 ` [PATCH 6.1 057/568] block: make REQ_OP_ZONE_OPEN a write operation Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 059/568] Reapply "Revert drm/amd/display: Enable Freesync Video Mode by default" Greg Kroah-Hartman
` (516 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Ma Ke,
Steev Klimaszewski, Srinivas Kandagatla, Abel Vesa, Alexey Klimov,
Mark Brown
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Klimov <alexey.klimov@linaro.org>
commit 434f7349a1f00618a620b316f091bd13a12bc8d2 upstream.
Commit 4e65bda8273c ("ASoC: wcd934x: fix error handling in
wcd934x_codec_parse_data()") revealed the problem in the slimbus regmap.
That commit breaks audio playback, for instance, on sdm845 Thundercomm
Dragonboard 845c board:
Unable to handle kernel paging request at virtual address ffff8000847cbad4
...
CPU: 5 UID: 0 PID: 776 Comm: aplay Not tainted 6.18.0-rc1-00028-g7ea30958b305 #11 PREEMPT
Hardware name: Thundercomm Dragonboard 845c (DT)
...
Call trace:
slim_xfer_msg+0x24/0x1ac [slimbus] (P)
slim_read+0x48/0x74 [slimbus]
regmap_slimbus_read+0x18/0x24 [regmap_slimbus]
_regmap_raw_read+0xe8/0x174
_regmap_bus_read+0x44/0x80
_regmap_read+0x60/0xd8
_regmap_update_bits+0xf4/0x140
_regmap_select_page+0xa8/0x124
_regmap_raw_write_impl+0x3b8/0x65c
_regmap_bus_raw_write+0x60/0x80
_regmap_write+0x58/0xc0
regmap_write+0x4c/0x80
wcd934x_hw_params+0x494/0x8b8 [snd_soc_wcd934x]
snd_soc_dai_hw_params+0x3c/0x7c [snd_soc_core]
__soc_pcm_hw_params+0x22c/0x634 [snd_soc_core]
dpcm_be_dai_hw_params+0x1d4/0x38c [snd_soc_core]
dpcm_fe_dai_hw_params+0x9c/0x17c [snd_soc_core]
snd_pcm_hw_params+0x124/0x464 [snd_pcm]
snd_pcm_common_ioctl+0x110c/0x1820 [snd_pcm]
snd_pcm_ioctl+0x34/0x4c [snd_pcm]
__arm64_sys_ioctl+0xac/0x104
invoke_syscall+0x48/0x104
el0_svc_common.constprop.0+0x40/0xe0
do_el0_svc+0x1c/0x28
el0_svc+0x34/0xec
el0t_64_sync_handler+0xa0/0xf0
el0t_64_sync+0x198/0x19c
The __devm_regmap_init_slimbus() started to be used instead of
__regmap_init_slimbus() after the commit mentioned above and turns out
the incorrect bus_context pointer (3rd argument) was used in
__devm_regmap_init_slimbus(). It should be just "slimbus" (which is equal
to &slimbus->dev). Correct it. The wcd934x codec seems to be the only or
the first user of devm_regmap_init_slimbus() but we should fix it till
the point where __devm_regmap_init_slimbus() was introduced therefore
two "Fixes" tags.
While at this, also correct the same argument in __regmap_init_slimbus().
Fixes: 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()")
Fixes: 7d6f7fb053ad ("regmap: add SLIMbus support")
Cc: stable@vger.kernel.org
Cc: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Cc: Ma Ke <make24@iscas.ac.cn>
Cc: Steev Klimaszewski <steev@kali.org>
Cc: Srinivas Kandagatla <srini@kernel.org>
Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://patch.msgid.link/20251022201013.1740211-1-alexey.klimov@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/regmap/regmap-slimbus.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/drivers/base/regmap/regmap-slimbus.c
+++ b/drivers/base/regmap/regmap-slimbus.c
@@ -48,8 +48,7 @@ struct regmap *__regmap_init_slimbus(str
if (IS_ERR(bus))
return ERR_CAST(bus);
- return __regmap_init(&slimbus->dev, bus, &slimbus->dev, config,
- lock_key, lock_name);
+ return __regmap_init(&slimbus->dev, bus, slimbus, config, lock_key, lock_name);
}
EXPORT_SYMBOL_GPL(__regmap_init_slimbus);
@@ -63,8 +62,7 @@ struct regmap *__devm_regmap_init_slimbu
if (IS_ERR(bus))
return ERR_CAST(bus);
- return __devm_regmap_init(&slimbus->dev, bus, &slimbus, config,
- lock_key, lock_name);
+ return __devm_regmap_init(&slimbus->dev, bus, slimbus, config, lock_key, lock_name);
}
EXPORT_SYMBOL_GPL(__devm_regmap_init_slimbus);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 059/568] Reapply "Revert drm/amd/display: Enable Freesync Video Mode by default"
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 058/568] regmap: slimbus: fix bus_context pointer in regmap init calls Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 060/568] s390/pci: Restore IRQ unconditionally for the zPCI device Greg Kroah-Hartman
` (515 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hamza Mahfooz, Alex Deucher,
Salvatore Bonaccorso
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
This reverts commit 11b92df8a2f7f4605ccc764ce6ae4a72760674df.
This conflicts with how compositors want to handle VRR. Now
that compositors actually handle VRR, we probably don't need
freesync video.
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2985
Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[ Salvatore Bonaccorso: Adjust context due to missing 3e094a287526
("drm/amd/display: Use drm_connector in create_stream_for_sink") in
6.1.y stable series ]
Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -6044,7 +6044,8 @@ create_stream_for_sink(struct amdgpu_dm_
*/
DRM_DEBUG_DRIVER("No preferred mode found\n");
} else {
- recalculate_timing = is_freesync_video_mode(&mode, aconnector);
+ recalculate_timing = amdgpu_freesync_vid_mode &&
+ is_freesync_video_mode(&mode, aconnector);
if (recalculate_timing) {
freesync_mode = get_highest_refresh_rate_mode(aconnector, false);
drm_mode_copy(&saved_mode, &mode);
@@ -7147,7 +7148,7 @@ static void amdgpu_dm_connector_add_free
struct amdgpu_dm_connector *amdgpu_dm_connector =
to_amdgpu_dm_connector(connector);
- if (!edid)
+ if (!(amdgpu_freesync_vid_mode && edid))
return;
if (amdgpu_dm_connector->max_vfreq - amdgpu_dm_connector->min_vfreq > 10)
@@ -9160,7 +9161,8 @@ static int dm_update_crtc_state(struct a
* TODO: Refactor this function to allow this check to work
* in all conditions.
*/
- if (dm_new_crtc_state->stream &&
+ if (amdgpu_freesync_vid_mode &&
+ dm_new_crtc_state->stream &&
is_timing_unchanged_for_freesync(new_crtc_state, old_crtc_state))
goto skip_modeset;
@@ -9200,7 +9202,7 @@ static int dm_update_crtc_state(struct a
}
/* Now check if we should set freesync video mode */
- if (dm_new_crtc_state->stream &&
+ if (amdgpu_freesync_vid_mode && dm_new_crtc_state->stream &&
dc_is_stream_unchanged(new_stream, dm_old_crtc_state->stream) &&
dc_is_stream_scaling_unchanged(new_stream, dm_old_crtc_state->stream) &&
is_timing_unchanged_for_freesync(new_crtc_state,
@@ -9213,7 +9215,7 @@ static int dm_update_crtc_state(struct a
set_freesync_fixed_config(dm_new_crtc_state);
goto skip_modeset;
- } else if (aconnector &&
+ } else if (amdgpu_freesync_vid_mode && aconnector &&
is_freesync_video_mode(&new_crtc_state->mode,
aconnector)) {
struct drm_display_mode *high_mode;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 060/568] s390/pci: Restore IRQ unconditionally for the zPCI device
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 059/568] Reapply "Revert drm/amd/display: Enable Freesync Video Mode by default" Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 061/568] net: phy: dp83867: Disable EEE support as not implemented Greg Kroah-Hartman
` (514 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Niklas Schnelle,
Matthew Rosato, Farhan Ali, Heiko Carstens, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Farhan Ali <alifm@linux.ibm.com>
[ Upstream commit b45873c3f09153d1ad9b3a7bf9e5c0b0387fd2ea ]
Commit c1e18c17bda6 ("s390/pci: add zpci_set_irq()/zpci_clear_irq()"),
introduced the zpci_set_irq() and zpci_clear_irq(), to be used while
resetting a zPCI device.
Commit da995d538d3a ("s390/pci: implement reset_slot for hotplug
slot"), mentions zpci_clear_irq() being called in the path for
zpci_hot_reset_device(). But that is not the case anymore and these
functions are not called outside of this file. Instead
zpci_hot_reset_device() relies on zpci_disable_device() also clearing
the IRQs, but misses to reset the zdev->irqs_registered flag.
However after a CLP disable/enable reset, the device's IRQ are
unregistered, but the flag zdev->irq_registered does not get cleared. It
creates an inconsistent state and so arch_restore_msi_irqs() doesn't
correctly restore the device's IRQ. This becomes a problem when a PCI
driver tries to restore the state of the device through
pci_restore_state(). Restore IRQ unconditionally for the device and remove
the irq_registered flag as its redundant.
Fixes: c1e18c17bda6 ("s390/pci: add zpci_set_irq()/zpci_clear_irq()")
Cc: stable@vger.kernnel.org
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
[ adjusted bitfield context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/include/asm/pci.h | 1 -
arch/s390/pci/pci_irq.c | 9 +--------
2 files changed, 1 insertion(+), 9 deletions(-)
--- a/arch/s390/include/asm/pci.h
+++ b/arch/s390/include/asm/pci.h
@@ -136,7 +136,6 @@ struct zpci_dev {
u8 has_resources : 1;
u8 is_physfn : 1;
u8 util_str_avail : 1;
- u8 irqs_registered : 1;
u8 reserved : 2;
unsigned int devfn; /* DEVFN part of the RID*/
--- a/arch/s390/pci/pci_irq.c
+++ b/arch/s390/pci/pci_irq.c
@@ -107,9 +107,6 @@ static int zpci_set_irq(struct zpci_dev
else
rc = zpci_set_airq(zdev);
- if (!rc)
- zdev->irqs_registered = 1;
-
return rc;
}
@@ -123,9 +120,6 @@ static int zpci_clear_irq(struct zpci_de
else
rc = zpci_clear_airq(zdev);
- if (!rc)
- zdev->irqs_registered = 0;
-
return rc;
}
@@ -427,8 +421,7 @@ bool arch_restore_msi_irqs(struct pci_de
{
struct zpci_dev *zdev = to_zpci(pdev);
- if (!zdev->irqs_registered)
- zpci_set_irq(zdev);
+ zpci_set_irq(zdev);
return true;
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 061/568] net: phy: dp83867: Disable EEE support as not implemented
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 060/568] s390/pci: Restore IRQ unconditionally for the zPCI device Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 062/568] mptcp: change first as a parameter Greg Kroah-Hartman
` (513 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Emanuele Ghidoli, Andrew Lunn,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
[ Upstream commit 84a905290cb4c3d9a71a9e3b2f2e02e031e7512f ]
While the DP83867 PHYs report EEE capability through their feature
registers, the actual hardware does not support EEE (see Links).
When the connected MAC enables EEE, it causes link instability and
communication failures.
The issue is reproducible with a iMX8MP and relevant stmmac ethernet port.
Since the introduction of phylink-managed EEE support in the stmmac driver,
EEE is now enabled by default, leading to issues on systems using the
DP83867 PHY.
Call phy_disable_eee during phy initialization to prevent EEE from being
enabled on DP83867 PHYs.
Link: https://e2e.ti.com/support/interface-group/interface/f/interface-forum/1445244/dp83867ir-dp83867-disable-eee-lpi
Link: https://e2e.ti.com/support/interface-group/interface/f/interface-forum/658638/dp83867ir-eee-energy-efficient-ethernet
Fixes: 2a10154abcb7 ("net: phy: dp83867: Add TI dp83867 phy")
Cc: stable@vger.kernel.org
Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20251023144857.529566-1-ghidoliemanuele@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ replaced phy_disable_eee() call with direct eee_broken_modes assignment ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/phy/dp83867.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/net/phy/dp83867.c
+++ b/drivers/net/phy/dp83867.c
@@ -743,6 +743,12 @@ static int dp83867_config_init(struct ph
return ret;
}
+ /* Although the DP83867 reports EEE capability through the
+ * MDIO_PCS_EEE_ABLE and MDIO_AN_EEE_ADV registers, the feature
+ * is not actually implemented in hardware.
+ */
+ phydev->eee_broken_modes = MDIO_EEE_100TX | MDIO_EEE_1000T;
+
if (phy_interface_is_rgmii(phydev) ||
phydev->interface == PHY_INTERFACE_MODE_SGMII) {
val = phy_read(phydev, MII_DP83867_PHYCTRL);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 062/568] mptcp: change first as a parameter
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 061/568] net: phy: dp83867: Disable EEE support as not implemented Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 063/568] mptcp: drop bogus optimization in __mptcp_check_push() Greg Kroah-Hartman
` (512 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mat Martineau, Geliang Tang,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <geliang.tang@suse.com>
[ Upstream commit 73a0052a61f98354f39f461e03f1a7e513b84578 ]
The function mptcp_subflow_process_delegated() uses the input ssk first,
while __mptcp_check_push() invokes the packet scheduler first.
So this patch adds a new parameter named 'first' for the function
__mptcp_subflow_push_pending() to deal with these two cases separately.
With this change, the code that invokes the packet scheduler in the
function __mptcp_check_push() can be removed, and replaced by invoking
__mptcp_subflow_push_pending() directly.
Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: Geliang Tang <geliang.tang@suse.com>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 27b0e701d387 ("mptcp: drop bogus optimization in __mptcp_check_push()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/protocol.c | 20 ++++++--------------
1 file changed, 6 insertions(+), 14 deletions(-)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -1706,7 +1706,7 @@ out:
mptcp_check_send_data_fin(sk);
}
-static void __mptcp_subflow_push_pending(struct sock *sk, struct sock *ssk)
+static void __mptcp_subflow_push_pending(struct sock *sk, struct sock *ssk, bool first)
{
struct mptcp_sock *msk = mptcp_sk(sk);
struct mptcp_sendmsg_info info = {
@@ -1715,7 +1715,6 @@ static void __mptcp_subflow_push_pending
struct mptcp_data_frag *dfrag;
struct sock *xmit_ssk;
int len, copied = 0;
- bool first = true;
info.flags = 0;
while ((dfrag = mptcp_send_head(sk))) {
@@ -1725,8 +1724,7 @@ static void __mptcp_subflow_push_pending
while (len > 0) {
int ret = 0;
- /* the caller already invoked the packet scheduler,
- * check for a different subflow usage only after
+ /* check for a different subflow usage only after
* spooling the first chunk of data
*/
xmit_ssk = first ? ssk : mptcp_subflow_get_send(mptcp_sk(sk));
@@ -3501,16 +3499,10 @@ void __mptcp_check_push(struct sock *sk,
if (!mptcp_send_head(sk))
return;
- if (!sock_owned_by_user(sk)) {
- struct sock *xmit_ssk = mptcp_subflow_get_send(mptcp_sk(sk));
-
- if (xmit_ssk == ssk)
- __mptcp_subflow_push_pending(sk, ssk);
- else if (xmit_ssk)
- mptcp_subflow_delegate(mptcp_subflow_ctx(xmit_ssk), MPTCP_DELEGATE_SEND);
- } else {
+ if (!sock_owned_by_user(sk))
+ __mptcp_subflow_push_pending(sk, ssk, false);
+ else
__set_bit(MPTCP_PUSH_PENDING, &mptcp_sk(sk)->cb_flags);
- }
}
#define MPTCP_FLAGS_PROCESS_CTX_NEED (BIT(MPTCP_PUSH_PENDING) | \
@@ -3605,7 +3597,7 @@ void mptcp_subflow_process_delegated(str
if (status & BIT(MPTCP_DELEGATE_SEND)) {
mptcp_data_lock(sk);
if (!sock_owned_by_user(sk))
- __mptcp_subflow_push_pending(sk, ssk);
+ __mptcp_subflow_push_pending(sk, ssk, true);
else
__set_bit(MPTCP_PUSH_PENDING, &mptcp_sk(sk)->cb_flags);
mptcp_data_unlock(sk);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 063/568] mptcp: drop bogus optimization in __mptcp_check_push()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 062/568] mptcp: change first as a parameter Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 064/568] can: gs_usb: increase max interface to U8_MAX Greg Kroah-Hartman
` (511 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Geliang Tang,
Mat Martineau, Matthieu Baerts (NGI0), Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <pabeni@redhat.com>
[ Upstream commit 27b0e701d3872ba59c5b579a9e8a02ea49ad3d3b ]
Accessing the transmit queue without owning the msk socket lock is
inherently racy, hence __mptcp_check_push() could actually quit early
even when there is pending data.
That in turn could cause unexpected tx lock and timeout.
Dropping the early check avoids the race, implicitly relaying on later
tests under the relevant lock. With such change, all the other
mptcp_send_head() call sites are now under the msk socket lock and we
can additionally drop the now unneeded annotation on the transmit head
pointer accesses.
Fixes: 6e628cd3a8f7 ("mptcp: use mptcp release_cb for delayed tasks")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Geliang Tang <geliang@kernel.org>
Tested-by: Geliang Tang <geliang@kernel.org>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251028-net-mptcp-send-timeout-v1-1-38ffff5a9ec8@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ split upstream __subflow_push_pending change across __mptcp_push_pending and __mptcp_subflow_push_pending ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/protocol.c | 13 +++++--------
net/mptcp/protocol.h | 2 +-
2 files changed, 6 insertions(+), 9 deletions(-)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -1101,7 +1101,7 @@ static void __mptcp_clean_una(struct soc
if (WARN_ON_ONCE(!msk->recovery))
break;
- WRITE_ONCE(msk->first_pending, mptcp_send_next(sk));
+ msk->first_pending = mptcp_send_next(sk);
}
dfrag_clear(sk, dfrag);
@@ -1691,7 +1691,7 @@ void __mptcp_push_pending(struct sock *s
mptcp_update_post_push(msk, dfrag, ret);
}
- WRITE_ONCE(msk->first_pending, mptcp_send_next(sk));
+ msk->first_pending = mptcp_send_next(sk);
}
/* at this point we held the socket lock for the last subflow we used */
@@ -1747,7 +1747,7 @@ static void __mptcp_subflow_push_pending
mptcp_update_post_push(msk, dfrag, ret);
}
- WRITE_ONCE(msk->first_pending, mptcp_send_next(sk));
+ msk->first_pending = mptcp_send_next(sk);
}
out:
@@ -1917,7 +1917,7 @@ static int mptcp_sendmsg(struct sock *sk
get_page(dfrag->page);
list_add_tail(&dfrag->list, &msk->rtx_queue);
if (!msk->first_pending)
- WRITE_ONCE(msk->first_pending, dfrag);
+ msk->first_pending = dfrag;
}
pr_debug("msk=%p dfrag at seq=%llu len=%u sent=%u new=%d\n", msk,
dfrag->data_seq, dfrag->data_len, dfrag->already_sent,
@@ -2915,7 +2915,7 @@ static void __mptcp_clear_xmit(struct so
struct mptcp_sock *msk = mptcp_sk(sk);
struct mptcp_data_frag *dtmp, *dfrag;
- WRITE_ONCE(msk->first_pending, NULL);
+ msk->first_pending = NULL;
list_for_each_entry_safe(dfrag, dtmp, &msk->rtx_queue, list)
dfrag_clear(sk, dfrag);
}
@@ -3496,9 +3496,6 @@ void __mptcp_data_acked(struct sock *sk)
void __mptcp_check_push(struct sock *sk, struct sock *ssk)
{
- if (!mptcp_send_head(sk))
- return;
-
if (!sock_owned_by_user(sk))
__mptcp_subflow_push_pending(sk, ssk, false);
else
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -360,7 +360,7 @@ static inline struct mptcp_data_frag *mp
{
const struct mptcp_sock *msk = mptcp_sk(sk);
- return READ_ONCE(msk->first_pending);
+ return msk->first_pending;
}
static inline struct mptcp_data_frag *mptcp_send_next(struct sock *sk)
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 064/568] can: gs_usb: increase max interface to U8_MAX
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 063/568] mptcp: drop bogus optimization in __mptcp_check_push() Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 065/568] cacheinfo: Use RISC-Vs init_cache_level() as generic OF implementation Greg Kroah-Hartman
` (510 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runcheng Lu, Vincent Mailhol,
Celeste Liu, Marc Kleine-Budde
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Celeste Liu <uwu@coelacanthus.name>
commit 2a27f6a8fb5722223d526843040f747e9b0e8060 upstream
This issue was found by Runcheng Lu when develop HSCanT USB to CAN FD
converter[1]. The original developers may have only 3 interfaces
device to test so they write 3 here and wait for future change.
During the HSCanT development, we actually used 4 interfaces, so the
limitation of 3 is not enough now. But just increase one is not
future-proofed. Since the channel index type in gs_host_frame is u8,
just make canch[] become a flexible array with a u8 index, so it
naturally constraint by U8_MAX and avoid statically allocate 256
pointer for every gs_usb device.
[1]: https://github.com/cherry-embedded/HSCanT-hardware
Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
Reported-by: Runcheng Lu <runcheng.lu@hpmicro.com>
Cc: stable@vger.kernel.org
Reviewed-by: Vincent Mailhol <mailhol@kernel.org>
Signed-off-by: Celeste Liu <uwu@coelacanthus.name>
Link: https://patch.msgid.link/20250930-gs-usb-max-if-v5-1-863330bf6666@coelacanthus.name
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/usb/gs_usb.c | 21 ++++++++++-----------
1 file changed, 10 insertions(+), 11 deletions(-)
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -277,10 +277,6 @@ struct gs_host_frame {
#define GS_MAX_TX_URBS 10
/* Only launch a max of GS_MAX_RX_URBS usb requests at a time. */
#define GS_MAX_RX_URBS 30
-/* Maximum number of interfaces the driver supports per device.
- * Current hardware only supports 3 interfaces. The future may vary.
- */
-#define GS_MAX_INTF 3
struct gs_tx_context {
struct gs_can *dev;
@@ -318,14 +314,15 @@ struct gs_can {
/* usb interface struct */
struct gs_usb {
- struct gs_can *canch[GS_MAX_INTF];
struct usb_anchor rx_submitted;
struct usb_device *udev;
unsigned int hf_size_rx;
u8 active_channels;
+ u8 channel_cnt;
unsigned int pipe_in;
unsigned int pipe_out;
+ struct gs_can *canch[];
};
/* 'allocate' a tx context.
@@ -550,7 +547,7 @@ static void gs_usb_receive_bulk_callback
}
/* device reports out of range channel id */
- if (hf->channel >= GS_MAX_INTF)
+ if (hf->channel >= parent->channel_cnt)
goto device_detach;
dev = parent->canch[hf->channel];
@@ -653,7 +650,7 @@ resubmit_urb:
/* USB failure take down all interfaces */
if (rc == -ENODEV) {
device_detach:
- for (rc = 0; rc < GS_MAX_INTF; rc++) {
+ for (rc = 0; rc < parent->channel_cnt; rc++) {
if (parent->canch[rc])
netif_device_detach(parent->canch[rc]->netdev);
}
@@ -1374,17 +1371,19 @@ static int gs_usb_probe(struct usb_inter
icount = dconf.icount + 1;
dev_info(&intf->dev, "Configuring for %u interfaces\n", icount);
- if (icount > GS_MAX_INTF) {
+ if (icount > type_max(typeof(parent->channel_cnt))) {
dev_err(&intf->dev,
"Driver cannot handle more that %u CAN interfaces\n",
- GS_MAX_INTF);
+ type_max(typeof(parent->channel_cnt)));
return -EINVAL;
}
- parent = kzalloc(sizeof(*parent), GFP_KERNEL);
+ parent = kzalloc(struct_size(parent, canch, icount), GFP_KERNEL);
if (!parent)
return -ENOMEM;
+ parent->channel_cnt = icount;
+
init_usb_anchor(&parent->rx_submitted);
usb_set_intfdata(intf, parent);
@@ -1445,7 +1444,7 @@ static void gs_usb_disconnect(struct usb
return;
}
- for (i = 0; i < GS_MAX_INTF; i++)
+ for (i = 0; i < parent->channel_cnt; i++)
if (parent->canch[i])
gs_destroy_candev(parent->canch[i]);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 065/568] cacheinfo: Use RISC-Vs init_cache_level() as generic OF implementation
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 064/568] can: gs_usb: increase max interface to U8_MAX Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 066/568] cacheinfo: Return error code in init_of_cache_level() Greg Kroah-Hartman
` (509 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre Gondois, Conor Dooley,
Palmer Dabbelt, Sudeep Holla, Wen Yang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Gondois <pierre.gondois@arm.com>
[ Upstream commit c3719bd9eeb2edf84bd263d662e36ca0ba262a23 ]
RISC-V's implementation of init_of_cache_level() is following
the Devicetree Specification v0.3 regarding caches, cf.:
- s3.7.3 'Internal (L1) Cache Properties'
- s3.8 'Multi-level and Shared Cache Nodes'
Allow reusing the implementation by moving it.
Also make 'levels', 'leaves' and 'level' unsigned int.
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Acked-by: Palmer Dabbelt <palmer@rivosinc.com>
Link: https://lore.kernel.org/r/20230104183033.755668-2-pierre.gondois@arm.com
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Wen Yang <wen.yang@linux.dev>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/kernel/cacheinfo.c | 39 -------------------------------------
drivers/base/cacheinfo.c | 44 ++++++++++++++++++++++++++++++++++++++++++
include/linux/cacheinfo.h | 1
3 files changed, 46 insertions(+), 38 deletions(-)
--- a/arch/riscv/kernel/cacheinfo.c
+++ b/arch/riscv/kernel/cacheinfo.c
@@ -115,44 +115,7 @@ static void fill_cacheinfo(struct cachei
int init_cache_level(unsigned int cpu)
{
- struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
- struct device_node *np = of_cpu_device_node_get(cpu);
- struct device_node *prev = NULL;
- int levels = 0, leaves = 0, level;
-
- if (of_property_read_bool(np, "cache-size"))
- ++leaves;
- if (of_property_read_bool(np, "i-cache-size"))
- ++leaves;
- if (of_property_read_bool(np, "d-cache-size"))
- ++leaves;
- if (leaves > 0)
- levels = 1;
-
- prev = np;
- while ((np = of_find_next_cache_node(np))) {
- of_node_put(prev);
- prev = np;
- if (!of_device_is_compatible(np, "cache"))
- break;
- if (of_property_read_u32(np, "cache-level", &level))
- break;
- if (level <= levels)
- break;
- if (of_property_read_bool(np, "cache-size"))
- ++leaves;
- if (of_property_read_bool(np, "i-cache-size"))
- ++leaves;
- if (of_property_read_bool(np, "d-cache-size"))
- ++leaves;
- levels = level;
- }
-
- of_node_put(np);
- this_cpu_ci->num_levels = levels;
- this_cpu_ci->num_leaves = leaves;
-
- return 0;
+ return init_of_cache_level(cpu);
}
int populate_cache_leaves(unsigned int cpu)
--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -223,8 +223,52 @@ static int cache_setup_of_node(unsigned
return 0;
}
+
+int init_of_cache_level(unsigned int cpu)
+{
+ struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
+ struct device_node *np = of_cpu_device_node_get(cpu);
+ struct device_node *prev = NULL;
+ unsigned int levels = 0, leaves = 0, level;
+
+ if (of_property_read_bool(np, "cache-size"))
+ ++leaves;
+ if (of_property_read_bool(np, "i-cache-size"))
+ ++leaves;
+ if (of_property_read_bool(np, "d-cache-size"))
+ ++leaves;
+ if (leaves > 0)
+ levels = 1;
+
+ prev = np;
+ while ((np = of_find_next_cache_node(np))) {
+ of_node_put(prev);
+ prev = np;
+ if (!of_device_is_compatible(np, "cache"))
+ break;
+ if (of_property_read_u32(np, "cache-level", &level))
+ break;
+ if (level <= levels)
+ break;
+ if (of_property_read_bool(np, "cache-size"))
+ ++leaves;
+ if (of_property_read_bool(np, "i-cache-size"))
+ ++leaves;
+ if (of_property_read_bool(np, "d-cache-size"))
+ ++leaves;
+ levels = level;
+ }
+
+ of_node_put(np);
+ this_cpu_ci->num_levels = levels;
+ this_cpu_ci->num_leaves = leaves;
+
+ return 0;
+}
+
#else
static inline int cache_setup_of_node(unsigned int cpu) { return 0; }
+int init_of_cache_level(unsigned int cpu) { return 0; }
#endif
int __weak cache_setup_acpi(unsigned int cpu)
--- a/include/linux/cacheinfo.h
+++ b/include/linux/cacheinfo.h
@@ -80,6 +80,7 @@ struct cpu_cacheinfo {
struct cpu_cacheinfo *get_cpu_cacheinfo(unsigned int cpu);
int init_cache_level(unsigned int cpu);
+int init_of_cache_level(unsigned int cpu);
int populate_cache_leaves(unsigned int cpu);
int cache_setup_acpi(unsigned int cpu);
bool last_level_cache_is_valid(unsigned int cpu);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 066/568] cacheinfo: Return error code in init_of_cache_level()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 065/568] cacheinfo: Use RISC-Vs init_cache_level() as generic OF implementation Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 067/568] cacheinfo: Check cache-unified property to count cache leaves Greg Kroah-Hartman
` (508 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre Gondois, Palmer Dabbelt,
Sudeep Holla, Wen Yang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Gondois <pierre.gondois@arm.com>
[ Upstream commit 8844c3df001bc1d8397fddea341308da63855d53 ]
Make init_of_cache_level() return an error code when the cache
information parsing fails to help detecting missing information.
init_of_cache_level() is only called for riscv. Returning an error
code instead of 0 will prevent detect_cache_attributes() to allocate
memory if an incomplete DT is parsed.
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Acked-by: Palmer Dabbelt <palmer@rivosinc.com>
Link: https://lore.kernel.org/r/20230104183033.755668-3-pierre.gondois@arm.com
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Wen Yang <wen.yang@linux.dev>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/cacheinfo.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -245,11 +245,11 @@ int init_of_cache_level(unsigned int cpu
of_node_put(prev);
prev = np;
if (!of_device_is_compatible(np, "cache"))
- break;
+ goto err_out;
if (of_property_read_u32(np, "cache-level", &level))
- break;
+ goto err_out;
if (level <= levels)
- break;
+ goto err_out;
if (of_property_read_bool(np, "cache-size"))
++leaves;
if (of_property_read_bool(np, "i-cache-size"))
@@ -264,6 +264,10 @@ int init_of_cache_level(unsigned int cpu
this_cpu_ci->num_leaves = leaves;
return 0;
+
+err_out:
+ of_node_put(np);
+ return -EINVAL;
}
#else
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 067/568] cacheinfo: Check cache-unified property to count cache leaves
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 066/568] cacheinfo: Return error code in init_of_cache_level() Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 068/568] ACPI: PPTT: Remove acpi_find_cache_levels() Greg Kroah-Hartman
` (507 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Pierre Gondois,
Sudeep Holla, Wen Yang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Gondois <pierre.gondois@arm.com>
[ Upstream commit de0df442ee49cb1f6ee58f3fec5dcb5e5eb70aab ]
The DeviceTree Specification v0.3 specifies that the cache node
'[d-|i-|]cache-size' property is required. The 'cache-unified'
property is specifies whether the cache level is separate
or unified.
If the cache-size property is missing, no cache leaves is accounted.
This can lead to a 'BUG: KASAN: slab-out-of-bounds' [1] bug.
Check 'cache-unified' property and always account for at least
one cache leaf when parsing the device tree.
[1] https://lore.kernel.org/all/0f19cb3f-d6cf-4032-66d2-dedc9d09a0e3@linaro.org/
Reported-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Tested-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20230104183033.755668-4-pierre.gondois@arm.com
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Wen Yang <wen.yang@linux.dev>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/cacheinfo.c | 37 ++++++++++++++++++++++++++-----------
1 file changed, 26 insertions(+), 11 deletions(-)
--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -224,12 +224,9 @@ static int cache_setup_of_node(unsigned
return 0;
}
-int init_of_cache_level(unsigned int cpu)
+static int of_count_cache_leaves(struct device_node *np)
{
- struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
- struct device_node *np = of_cpu_device_node_get(cpu);
- struct device_node *prev = NULL;
- unsigned int levels = 0, leaves = 0, level;
+ unsigned int leaves = 0;
if (of_property_read_bool(np, "cache-size"))
++leaves;
@@ -237,6 +234,28 @@ int init_of_cache_level(unsigned int cpu
++leaves;
if (of_property_read_bool(np, "d-cache-size"))
++leaves;
+
+ if (!leaves) {
+ /* The '[i-|d-|]cache-size' property is required, but
+ * if absent, fallback on the 'cache-unified' property.
+ */
+ if (of_property_read_bool(np, "cache-unified"))
+ return 1;
+ else
+ return 2;
+ }
+
+ return leaves;
+}
+
+int init_of_cache_level(unsigned int cpu)
+{
+ struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
+ struct device_node *np = of_cpu_device_node_get(cpu);
+ struct device_node *prev = NULL;
+ unsigned int levels = 0, leaves, level;
+
+ leaves = of_count_cache_leaves(np);
if (leaves > 0)
levels = 1;
@@ -250,12 +269,8 @@ int init_of_cache_level(unsigned int cpu
goto err_out;
if (level <= levels)
goto err_out;
- if (of_property_read_bool(np, "cache-size"))
- ++leaves;
- if (of_property_read_bool(np, "i-cache-size"))
- ++leaves;
- if (of_property_read_bool(np, "d-cache-size"))
- ++leaves;
+
+ leaves += of_count_cache_leaves(np);
levels = level;
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 068/568] ACPI: PPTT: Remove acpi_find_cache_levels()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 067/568] cacheinfo: Check cache-unified property to count cache leaves Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 069/568] ACPI: PPTT: Update acpi_find_last_cache_level() to acpi_get_cache_info() Greg Kroah-Hartman
` (506 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre Gondois, Jeremy Linton,
Rafael J. Wysocki, Palmer Dabbelt, Sudeep Holla, Wen Yang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Gondois <pierre.gondois@arm.com>
[ Upstream commit fa4d566a605bc4cf32d69f16ef8cf9696635f75a ]
acpi_find_cache_levels() is used at a single place and is short
enough to be merged into the calling function. The removal allows
an easier renaming of the calling function in the next patch.
Also reorder the local variables in the 'reversed Christmas tree'
order.
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Reviewed-by: Jeremy Linton <jeremy.linton@arm.com>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Palmer Dabbelt <palmer@rivosinc.com>
Link: https://lore.kernel.org/r/20230104183033.755668-5-pierre.gondois@arm.com
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Wen Yang <wen.yang@linux.dev>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/pptt.c | 21 ++++++---------------
1 file changed, 6 insertions(+), 15 deletions(-)
--- a/drivers/acpi/pptt.c
+++ b/drivers/acpi/pptt.c
@@ -286,19 +286,6 @@ static struct acpi_pptt_processor *acpi_
return NULL;
}
-static int acpi_find_cache_levels(struct acpi_table_header *table_hdr,
- u32 acpi_cpu_id)
-{
- int number_of_levels = 0;
- struct acpi_pptt_processor *cpu;
-
- cpu = acpi_find_processor_node(table_hdr, acpi_cpu_id);
- if (cpu)
- number_of_levels = acpi_count_levels(table_hdr, cpu);
-
- return number_of_levels;
-}
-
static u8 acpi_cache_type(enum cache_type type)
{
switch (type) {
@@ -621,9 +608,10 @@ static int check_acpi_cpu_flag(unsigned
*/
int acpi_find_last_cache_level(unsigned int cpu)
{
- u32 acpi_cpu_id;
+ struct acpi_pptt_processor *cpu_node;
struct acpi_table_header *table;
int number_of_levels = 0;
+ u32 acpi_cpu_id;
table = acpi_get_pptt();
if (!table)
@@ -632,7 +620,10 @@ int acpi_find_last_cache_level(unsigned
pr_debug("Cache Setup find last level CPU=%d\n", cpu);
acpi_cpu_id = get_acpi_id_for_cpu(cpu);
- number_of_levels = acpi_find_cache_levels(table, acpi_cpu_id);
+ cpu_node = acpi_find_processor_node(table, acpi_cpu_id);
+ if (cpu_node)
+ number_of_levels = acpi_count_levels(table, cpu_node);
+
pr_debug("Cache Setup find last level level=%d\n", number_of_levels);
return number_of_levels;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 069/568] ACPI: PPTT: Update acpi_find_last_cache_level() to acpi_get_cache_info()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 068/568] ACPI: PPTT: Remove acpi_find_cache_levels() Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 070/568] arch_topology: Build cacheinfo from primary CPU Greg Kroah-Hartman
` (505 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeremy Linton, Pierre Gondois,
Rafael J. Wysocki, Palmer Dabbelt, Sudeep Holla, Wen Yang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Gondois <pierre.gondois@arm.com>
[ Upstream commit bd500361a937c03a3da57178287ce543c8f3681b ]
acpi_find_last_cache_level() allows to find the last level of cache
for a given CPU. The function is only called on arm64 ACPI based
platforms to check for cache information that would be missing in
the CLIDR_EL1 register.
To allow populating (struct cpu_cacheinfo).num_leaves by only parsing
a PPTT, update acpi_find_last_cache_level() to get the 'split_levels',
i.e. the number of cache levels being split in data/instruction
caches.
It is assumed that there will not be data/instruction caches above a
unified cache.
If a split level consist of one data cache and no instruction cache
(or opposite), then the missing cache will still be populated
by default with minimal cache information, and maximal cpumask
(all non-existing caches have the same fw_token).
Suggested-by: Jeremy Linton <jeremy.linton@arm.com>
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Reviewed-by: Jeremy Linton <jeremy.linton@arm.com>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Palmer Dabbelt <palmer@rivosinc.com>
Link: https://lore.kernel.org/r/20230104183033.755668-6-pierre.gondois@arm.com
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Wen Yang <wen.yang@linux.dev>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/cacheinfo.c | 11 +++---
drivers/acpi/pptt.c | 76 +++++++++++++++++++++++++++---------------
include/linux/cacheinfo.h | 9 +++-
3 files changed, 63 insertions(+), 33 deletions(-)
--- a/arch/arm64/kernel/cacheinfo.c
+++ b/arch/arm64/kernel/cacheinfo.c
@@ -46,7 +46,7 @@ static void ci_leaf_init(struct cacheinf
int init_cache_level(unsigned int cpu)
{
unsigned int ctype, level, leaves;
- int fw_level;
+ int fw_level, ret;
struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
for (level = 1, leaves = 0; level <= MAX_CACHE_LEVEL; level++) {
@@ -59,10 +59,13 @@ int init_cache_level(unsigned int cpu)
leaves += (ctype == CACHE_TYPE_SEPARATE) ? 2 : 1;
}
- if (acpi_disabled)
+ if (acpi_disabled) {
fw_level = of_find_last_cache_level(cpu);
- else
- fw_level = acpi_find_last_cache_level(cpu);
+ } else {
+ ret = acpi_get_cache_info(cpu, &fw_level, NULL);
+ if (ret < 0)
+ return ret;
+ }
if (fw_level < 0)
return fw_level;
--- a/drivers/acpi/pptt.c
+++ b/drivers/acpi/pptt.c
@@ -81,6 +81,7 @@ static inline bool acpi_pptt_match_type(
* acpi_pptt_walk_cache() - Attempt to find the requested acpi_pptt_cache
* @table_hdr: Pointer to the head of the PPTT table
* @local_level: passed res reflects this cache level
+ * @split_levels: Number of split cache levels (data/instruction).
* @res: cache resource in the PPTT we want to walk
* @found: returns a pointer to the requested level if found
* @level: the requested cache level
@@ -100,6 +101,7 @@ static inline bool acpi_pptt_match_type(
*/
static unsigned int acpi_pptt_walk_cache(struct acpi_table_header *table_hdr,
unsigned int local_level,
+ unsigned int *split_levels,
struct acpi_subtable_header *res,
struct acpi_pptt_cache **found,
unsigned int level, int type)
@@ -113,8 +115,17 @@ static unsigned int acpi_pptt_walk_cache
while (cache) {
local_level++;
+ if (!(cache->flags & ACPI_PPTT_CACHE_TYPE_VALID)) {
+ cache = fetch_pptt_cache(table_hdr, cache->next_level_of_cache);
+ continue;
+ }
+
+ if (split_levels &&
+ (acpi_pptt_match_type(cache->attributes, ACPI_PPTT_CACHE_TYPE_DATA) ||
+ acpi_pptt_match_type(cache->attributes, ACPI_PPTT_CACHE_TYPE_INSTR)))
+ *split_levels = local_level;
+
if (local_level == level &&
- cache->flags & ACPI_PPTT_CACHE_TYPE_VALID &&
acpi_pptt_match_type(cache->attributes, type)) {
if (*found != NULL && cache != *found)
pr_warn("Found duplicate cache level/type unable to determine uniqueness\n");
@@ -135,8 +146,8 @@ static unsigned int acpi_pptt_walk_cache
static struct acpi_pptt_cache *
acpi_find_cache_level(struct acpi_table_header *table_hdr,
struct acpi_pptt_processor *cpu_node,
- unsigned int *starting_level, unsigned int level,
- int type)
+ unsigned int *starting_level, unsigned int *split_levels,
+ unsigned int level, int type)
{
struct acpi_subtable_header *res;
unsigned int number_of_levels = *starting_level;
@@ -149,7 +160,8 @@ acpi_find_cache_level(struct acpi_table_
resource++;
local_level = acpi_pptt_walk_cache(table_hdr, *starting_level,
- res, &ret, level, type);
+ split_levels, res, &ret,
+ level, type);
/*
* we are looking for the max depth. Since its potentially
* possible for a given node to have resources with differing
@@ -165,29 +177,29 @@ acpi_find_cache_level(struct acpi_table_
}
/**
- * acpi_count_levels() - Given a PPTT table, and a CPU node, count the caches
+ * acpi_count_levels() - Given a PPTT table, and a CPU node, count the cache
+ * levels and split cache levels (data/instruction).
* @table_hdr: Pointer to the head of the PPTT table
* @cpu_node: processor node we wish to count caches for
+ * @levels: Number of levels if success.
+ * @split_levels: Number of split cache levels (data/instruction) if
+ * success. Can by NULL.
*
* Given a processor node containing a processing unit, walk into it and count
* how many levels exist solely for it, and then walk up each level until we hit
* the root node (ignore the package level because it may be possible to have
- * caches that exist across packages). Count the number of cache levels that
- * exist at each level on the way up.
- *
- * Return: Total number of levels found.
+ * caches that exist across packages). Count the number of cache levels and
+ * split cache levels (data/instruction) that exist at each level on the way
+ * up.
*/
-static int acpi_count_levels(struct acpi_table_header *table_hdr,
- struct acpi_pptt_processor *cpu_node)
+static void acpi_count_levels(struct acpi_table_header *table_hdr,
+ struct acpi_pptt_processor *cpu_node,
+ unsigned int *levels, unsigned int *split_levels)
{
- int total_levels = 0;
-
do {
- acpi_find_cache_level(table_hdr, cpu_node, &total_levels, 0, 0);
+ acpi_find_cache_level(table_hdr, cpu_node, levels, split_levels, 0, 0);
cpu_node = fetch_pptt_node(table_hdr, cpu_node->parent);
} while (cpu_node);
-
- return total_levels;
}
/**
@@ -326,7 +338,7 @@ static struct acpi_pptt_cache *acpi_find
while (cpu_node && !found) {
found = acpi_find_cache_level(table_hdr, cpu_node,
- &total_levels, level, acpi_type);
+ &total_levels, NULL, level, acpi_type);
*node = cpu_node;
cpu_node = fetch_pptt_node(table_hdr, cpu_node->parent);
}
@@ -597,36 +609,48 @@ static int check_acpi_cpu_flag(unsigned
}
/**
- * acpi_find_last_cache_level() - Determines the number of cache levels for a PE
+ * acpi_get_cache_info() - Determine the number of cache levels and
+ * split cache levels (data/instruction) and for a PE.
* @cpu: Kernel logical CPU number
+ * @levels: Number of levels if success.
+ * @split_levels: Number of levels being split (i.e. data/instruction)
+ * if success. Can by NULL.
*
* Given a logical CPU number, returns the number of levels of cache represented
* in the PPTT. Errors caused by lack of a PPTT table, or otherwise, return 0
* indicating we didn't find any cache levels.
*
- * Return: Cache levels visible to this core.
+ * Return: -ENOENT if no PPTT table or no PPTT processor struct found.
+ * 0 on success.
*/
-int acpi_find_last_cache_level(unsigned int cpu)
+int acpi_get_cache_info(unsigned int cpu, unsigned int *levels,
+ unsigned int *split_levels)
{
struct acpi_pptt_processor *cpu_node;
struct acpi_table_header *table;
- int number_of_levels = 0;
u32 acpi_cpu_id;
+ *levels = 0;
+ if (split_levels)
+ *split_levels = 0;
+
table = acpi_get_pptt();
if (!table)
return -ENOENT;
- pr_debug("Cache Setup find last level CPU=%d\n", cpu);
+ pr_debug("Cache Setup: find cache levels for CPU=%d\n", cpu);
acpi_cpu_id = get_acpi_id_for_cpu(cpu);
cpu_node = acpi_find_processor_node(table, acpi_cpu_id);
- if (cpu_node)
- number_of_levels = acpi_count_levels(table, cpu_node);
+ if (!cpu_node)
+ return -ENOENT;
+
+ acpi_count_levels(table, cpu_node, levels, split_levels);
- pr_debug("Cache Setup find last level level=%d\n", number_of_levels);
+ pr_debug("Cache Setup: last_level=%d split_levels=%d\n",
+ *levels, split_levels ? *split_levels : -1);
- return number_of_levels;
+ return 0;
}
/**
--- a/include/linux/cacheinfo.h
+++ b/include/linux/cacheinfo.h
@@ -88,19 +88,22 @@ bool last_level_cache_is_shared(unsigned
int detect_cache_attributes(unsigned int cpu);
#ifndef CONFIG_ACPI_PPTT
/*
- * acpi_find_last_cache_level is only called on ACPI enabled
+ * acpi_get_cache_info() is only called on ACPI enabled
* platforms using the PPTT for topology. This means that if
* the platform supports other firmware configuration methods
* we need to stub out the call when ACPI is disabled.
* ACPI enabled platforms not using PPTT won't be making calls
* to this function so we need not worry about them.
*/
-static inline int acpi_find_last_cache_level(unsigned int cpu)
+static inline
+int acpi_get_cache_info(unsigned int cpu,
+ unsigned int *levels, unsigned int *split_levels)
{
return 0;
}
#else
-int acpi_find_last_cache_level(unsigned int cpu);
+int acpi_get_cache_info(unsigned int cpu,
+ unsigned int *levels, unsigned int *split_levels);
#endif
const struct attribute_group *cache_get_priv_group(struct cacheinfo *this_leaf);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 070/568] arch_topology: Build cacheinfo from primary CPU
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 069/568] ACPI: PPTT: Update acpi_find_last_cache_level() to acpi_get_cache_info() Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 071/568] cacheinfo: Initialize variables in fetch_cache_info() Greg Kroah-Hartman
` (504 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre Gondois, Sudeep Holla,
Palmer Dabbelt, Wen Yang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Gondois <pierre.gondois@arm.com>
[ Upstream commit 5944ce092b97caed5d86d961e963b883b5c44ee2 ]
commit 3fcbf1c77d08 ("arch_topology: Fix cache attributes detection
in the CPU hotplug path")
adds a call to detect_cache_attributes() to populate the cacheinfo
before updating the siblings mask. detect_cache_attributes() allocates
memory and can take the PPTT mutex (on ACPI platforms). On PREEMPT_RT
kernels, on secondary CPUs, this triggers a:
'BUG: sleeping function called from invalid context' [1]
as the code is executed with preemption and interrupts disabled.
The primary CPU was previously storing the cache information using
the now removed (struct cpu_topology).llc_id:
commit 5b8dc787ce4a ("arch_topology: Drop LLC identifier stash from
the CPU topology")
allocate_cache_info() tries to build the cacheinfo from the primary
CPU prior secondary CPUs boot, if the DT/ACPI description
contains cache information.
If allocate_cache_info() fails, then fallback to the current state
for the cacheinfo allocation. [1] will be triggered in such case.
When unplugging a CPU, the cacheinfo memory cannot be freed. If it
was, then the memory would be allocated early by the re-plugged
CPU and would trigger [1].
Note that populate_cache_leaves() might be called multiple times
due to populate_leaves being moved up. This is required since
detect_cache_attributes() might be called with per_cpu_cacheinfo(cpu)
being allocated but not populated.
[1]:
| BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46
| in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 0, name: swapper/111
| preempt_count: 1, expected: 0
| RCU nest depth: 1, expected: 1
| 3 locks held by swapper/111/0:
| #0: (&pcp->lock){+.+.}-{3:3}, at: get_page_from_freelist+0x218/0x12c8
| #1: (rcu_read_lock){....}-{1:3}, at: rt_spin_trylock+0x48/0xf0
| #2: (&zone->lock){+.+.}-{3:3}, at: rmqueue_bulk+0x64/0xa80
| irq event stamp: 0
| hardirqs last enabled at (0): 0x0
| hardirqs last disabled at (0): copy_process+0x5dc/0x1ab8
| softirqs last enabled at (0): copy_process+0x5dc/0x1ab8
| softirqs last disabled at (0): 0x0
| Preemption disabled at:
| migrate_enable+0x30/0x130
| CPU: 111 PID: 0 Comm: swapper/111 Tainted: G W 6.0.0-rc4-rt6-[...]
| Call trace:
| __kmalloc+0xbc/0x1e8
| detect_cache_attributes+0x2d4/0x5f0
| update_siblings_masks+0x30/0x368
| store_cpu_topology+0x78/0xb8
| secondary_start_kernel+0xd0/0x198
| __secondary_switched+0xb0/0xb4
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
Acked-by: Palmer Dabbelt <palmer@rivosinc.com>
Link: https://lore.kernel.org/r/20230104183033.755668-7-pierre.gondois@arm.com
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Wen Yang <wen.yang@linux.dev>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/kernel/cacheinfo.c | 5 --
drivers/base/arch_topology.c | 12 +++++--
drivers/base/cacheinfo.c | 71 +++++++++++++++++++++++++++++++-----------
include/linux/cacheinfo.h | 1
4 files changed, 65 insertions(+), 24 deletions(-)
--- a/arch/riscv/kernel/cacheinfo.c
+++ b/arch/riscv/kernel/cacheinfo.c
@@ -113,11 +113,6 @@ static void fill_cacheinfo(struct cachei
}
}
-int init_cache_level(unsigned int cpu)
-{
- return init_of_cache_level(cpu);
-}
-
int populate_cache_leaves(unsigned int cpu)
{
struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
--- a/drivers/base/arch_topology.c
+++ b/drivers/base/arch_topology.c
@@ -736,7 +736,7 @@ void update_siblings_masks(unsigned int
ret = detect_cache_attributes(cpuid);
if (ret && ret != -ENOENT)
- pr_info("Early cacheinfo failed, ret = %d\n", ret);
+ pr_info("Early cacheinfo allocation failed, ret = %d\n", ret);
/* update core and thread sibling masks */
for_each_online_cpu(cpu) {
@@ -825,7 +825,7 @@ __weak int __init parse_acpi_topology(vo
#if defined(CONFIG_ARM64) || defined(CONFIG_RISCV)
void __init init_cpu_topology(void)
{
- int ret;
+ int cpu, ret;
reset_cpu_topology();
ret = parse_acpi_topology();
@@ -840,6 +840,14 @@ void __init init_cpu_topology(void)
reset_cpu_topology();
return;
}
+
+ for_each_possible_cpu(cpu) {
+ ret = fetch_cache_info(cpu);
+ if (ret) {
+ pr_err("Early cacheinfo failed, ret = %d\n", ret);
+ break;
+ }
+ }
}
void store_cpu_topology(unsigned int cpuid)
--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -412,10 +412,6 @@ static void free_cache_attributes(unsign
return;
cache_shared_cpu_map_remove(cpu);
-
- kfree(per_cpu_cacheinfo(cpu));
- per_cpu_cacheinfo(cpu) = NULL;
- cache_leaves(cpu) = 0;
}
int __weak init_cache_level(unsigned int cpu)
@@ -428,29 +424,71 @@ int __weak populate_cache_leaves(unsigne
return -ENOENT;
}
+static inline
+int allocate_cache_info(int cpu)
+{
+ per_cpu_cacheinfo(cpu) = kcalloc(cache_leaves(cpu),
+ sizeof(struct cacheinfo), GFP_ATOMIC);
+ if (!per_cpu_cacheinfo(cpu)) {
+ cache_leaves(cpu) = 0;
+ return -ENOMEM;
+ }
+
+ return 0;
+}
+
+int fetch_cache_info(unsigned int cpu)
+{
+ struct cpu_cacheinfo *this_cpu_ci;
+ unsigned int levels, split_levels;
+ int ret;
+
+ if (acpi_disabled) {
+ ret = init_of_cache_level(cpu);
+ if (ret < 0)
+ return ret;
+ } else {
+ ret = acpi_get_cache_info(cpu, &levels, &split_levels);
+ if (ret < 0)
+ return ret;
+
+ this_cpu_ci = get_cpu_cacheinfo(cpu);
+ this_cpu_ci->num_levels = levels;
+ /*
+ * This assumes that:
+ * - there cannot be any split caches (data/instruction)
+ * above a unified cache
+ * - data/instruction caches come by pair
+ */
+ this_cpu_ci->num_leaves = levels + split_levels;
+ }
+ if (!cache_leaves(cpu))
+ return -ENOENT;
+
+ return allocate_cache_info(cpu);
+}
+
int detect_cache_attributes(unsigned int cpu)
{
int ret;
- /* Since early detection of the cacheinfo is allowed via this
- * function and this also gets called as CPU hotplug callbacks via
- * cacheinfo_cpu_online, the initialisation can be skipped and only
- * CPU maps can be updated as the CPU online status would be update
- * if called via cacheinfo_cpu_online path.
+ /* Since early initialization/allocation of the cacheinfo is allowed
+ * via fetch_cache_info() and this also gets called as CPU hotplug
+ * callbacks via cacheinfo_cpu_online, the init/alloc can be skipped
+ * as it will happen only once (the cacheinfo memory is never freed).
+ * Just populate the cacheinfo.
*/
if (per_cpu_cacheinfo(cpu))
- goto update_cpu_map;
+ goto populate_leaves;
if (init_cache_level(cpu) || !cache_leaves(cpu))
return -ENOENT;
- per_cpu_cacheinfo(cpu) = kcalloc(cache_leaves(cpu),
- sizeof(struct cacheinfo), GFP_ATOMIC);
- if (per_cpu_cacheinfo(cpu) == NULL) {
- cache_leaves(cpu) = 0;
- return -ENOMEM;
- }
+ ret = allocate_cache_info(cpu);
+ if (ret)
+ return ret;
+populate_leaves:
/*
* populate_cache_leaves() may completely setup the cache leaves and
* shared_cpu_map or it may leave it partially setup.
@@ -459,7 +497,6 @@ int detect_cache_attributes(unsigned int
if (ret)
goto free_ci;
-update_cpu_map:
/*
* For systems using DT for cache hierarchy, fw_token
* and shared_cpu_map will be set up here only if they are
--- a/include/linux/cacheinfo.h
+++ b/include/linux/cacheinfo.h
@@ -85,6 +85,7 @@ int populate_cache_leaves(unsigned int c
int cache_setup_acpi(unsigned int cpu);
bool last_level_cache_is_valid(unsigned int cpu);
bool last_level_cache_is_shared(unsigned int cpu_x, unsigned int cpu_y);
+int fetch_cache_info(unsigned int cpu);
int detect_cache_attributes(unsigned int cpu);
#ifndef CONFIG_ACPI_PPTT
/*
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 071/568] cacheinfo: Initialize variables in fetch_cache_info()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 070/568] arch_topology: Build cacheinfo from primary CPU Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 072/568] cacheinfo: Fix LLC is not exported through sysfs Greg Kroah-Hartman
` (503 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Dan Carpenter,
Pierre Gondois, Conor Dooley, Wen Yang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Gondois <pierre.gondois@arm.com>
[ Upstream commit ecaef469920fd6d2c7687f19081946f47684a423 ]
Set potentially uninitialized variables to 0. This is particularly
relevant when CONFIG_ACPI_PPTT is not set.
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/all/202301052307.JYt1GWaJ-lkp@intel.com/
Reported-by: Dan Carpenter <error27@gmail.com>
Link: https://lore.kernel.org/all/Y86iruJPuwNN7rZw@kili/
Fixes: 5944ce092b97 ("arch_topology: Build cacheinfo from primary CPU")
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://lore.kernel.org/r/20230124154053.355376-2-pierre.gondois@arm.com
Signed-off-by: Wen Yang <wen.yang@linux.dev>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/cacheinfo.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -440,7 +440,7 @@ int allocate_cache_info(int cpu)
int fetch_cache_info(unsigned int cpu)
{
struct cpu_cacheinfo *this_cpu_ci;
- unsigned int levels, split_levels;
+ unsigned int levels = 0, split_levels = 0;
int ret;
if (acpi_disabled) {
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 072/568] cacheinfo: Fix LLC is not exported through sysfs
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 071/568] cacheinfo: Initialize variables in fetch_cache_info() Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 073/568] drivers: base: cacheinfo: Update cpu_map_populated during CPU Hotplug Greg Kroah-Hartman
` (502 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yicong Yang, Pierre Gondois,
Sudeep Holla, Wen Yang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yicong Yang <yangyicong@hisilicon.com>
[ Upstream commit 5c2712387d4850e0b64121d5fd3e6c4e84ea3266 ]
After entering 6.3-rc1 the LLC cacheinfo is not exported on our ACPI
based arm64 server. This is because the LLC cacheinfo is partly reset
when secondary CPUs boot up. On arm64 the primary cpu will allocate
and setup cacheinfo:
init_cpu_topology()
for_each_possible_cpu()
fetch_cache_info() // Allocate cacheinfo and init levels
detect_cache_attributes()
cache_shared_cpu_map_setup()
if (!last_level_cache_is_valid()) // not valid, setup LLC
cache_setup_properties() // setup LLC
On secondary CPU boot up:
detect_cache_attributes()
populate_cache_leaves()
get_cache_type() // Get cache type from clidr_el1,
// for LLC type=CACHE_TYPE_NOCACHE
cache_shared_cpu_map_setup()
if (!last_level_cache_is_valid()) // Valid and won't go to this branch,
// leave LLC's type=CACHE_TYPE_NOCACHE
The last_level_cache_is_valid() use cacheinfo->{attributes, fw_token} to
test it's valid or not, but populate_cache_leaves() will only reset
LLC's type, so we won't try to re-setup LLC's type and leave it
CACHE_TYPE_NOCACHE and won't export it through sysfs.
This patch tries to fix this by not re-populating the cache leaves if
the LLC is valid.
Fixes: 5944ce092b97 ("arch_topology: Build cacheinfo from primary CPU")
Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
Reviewed-by: Pierre Gondois <pierre.gondois@arm.com>
Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
Link: https://lore.kernel.org/r/20230328114915.33340-1-yangyicong@huawei.com
Signed-off-by: Wen Yang <wen.yang@linux.dev>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/cacheinfo.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -490,12 +490,18 @@ int detect_cache_attributes(unsigned int
populate_leaves:
/*
- * populate_cache_leaves() may completely setup the cache leaves and
- * shared_cpu_map or it may leave it partially setup.
+ * If LLC is valid the cache leaves were already populated so just go to
+ * update the cpu map.
*/
- ret = populate_cache_leaves(cpu);
- if (ret)
- goto free_ci;
+ if (!last_level_cache_is_valid(cpu)) {
+ /*
+ * populate_cache_leaves() may completely setup the cache leaves and
+ * shared_cpu_map or it may leave it partially setup.
+ */
+ ret = populate_cache_leaves(cpu);
+ if (ret)
+ goto free_ci;
+ }
/*
* For systems using DT for cache hierarchy, fw_token
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 073/568] drivers: base: cacheinfo: Update cpu_map_populated during CPU Hotplug
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 072/568] cacheinfo: Fix LLC is not exported through sysfs Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 074/568] arm64: tegra: Update cache properties Greg Kroah-Hartman
` (501 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, K Prateek Nayak, Yicong Yang,
Sudeep Holla, Wen Yang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: K Prateek Nayak <kprateek.nayak@amd.com>
[ Upstream commit c26fabe73330d983c7ce822c6b6ec0879b4da61f ]
Until commit 5c2712387d48 ("cacheinfo: Fix LLC is not exported through
sysfs"), cacheinfo called populate_cache_leaves() for CPU coming online
which let the arch specific functions handle (at least on x86)
populating the shared_cpu_map. However, with the changes in the
aforementioned commit, populate_cache_leaves() is not called when a CPU
comes online as a result of hotplug since last_level_cache_is_valid()
returns true as the cacheinfo data is not discarded. The CPU coming
online is not present in shared_cpu_map, however, it will not be added
since the cpu_cacheinfo->cpu_map_populated flag is set (it is set in
populate_cache_leaves() when cacheinfo is first populated for x86)
This can lead to inconsistencies in the shared_cpu_map when an offlined
CPU comes online again. Example below depicts the inconsistency in the
shared_cpu_list in cacheinfo when CPU8 is offlined and onlined again on
a 3rd Generation EPYC processor:
# for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done
/sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8-15,136-143
# echo 0 > /sys/devices/system/cpu/cpu8/online
# echo 1 > /sys/devices/system/cpu/cpu8/online
# for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done
/sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8
/sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8
/sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8
/sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8
# cat /sys/devices/system/cpu/cpu136/cache/index0/shared_cpu_list
136
# cat /sys/devices/system/cpu/cpu136/cache/index3/shared_cpu_list
9-15,136-143
Clear the flag when the CPU is removed from shared_cpu_map when
cache_shared_cpu_map_remove() is called during CPU hotplug. This will
allow cache_shared_cpu_map_setup() to add the CPU coming back online in
the shared_cpu_map. Set the flag again when the shared_cpu_map is setup.
Following are results of performing the same test as described above with
the changes:
# for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done
/sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8-15,136-143
# echo 0 > /sys/devices/system/cpu/cpu8/online
# echo 1 > /sys/devices/system/cpu/cpu8/online
# for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done
/sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8-15,136-143
# cat /sys/devices/system/cpu/cpu136/cache/index0/shared_cpu_list
8,136
# cat /sys/devices/system/cpu/cpu136/cache/index3/shared_cpu_list
8-15,136-143
Fixes: 5c2712387d48 ("cacheinfo: Fix LLC is not exported through sysfs")
Signed-off-by: K Prateek Nayak <kprateek.nayak@amd.com>
Reviewed-by: Yicong Yang <yangyicong@hisilicon.com>
Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
Link: https://lore.kernel.org/r/20230508084115.1157-3-kprateek.nayak@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Wen Yang <wen.yang@linux.dev>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/cacheinfo.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -365,11 +365,14 @@ static int cache_shared_cpu_map_setup(un
coherency_max_size = this_leaf->coherency_line_size;
}
+ /* shared_cpu_map is now populated for the cpu */
+ this_cpu_ci->cpu_map_populated = true;
return 0;
}
static void cache_shared_cpu_map_remove(unsigned int cpu)
{
+ struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
struct cacheinfo *this_leaf, *sib_leaf;
unsigned int sibling, index, sib_index;
@@ -404,6 +407,9 @@ static void cache_shared_cpu_map_remove(
if (of_have_populated_dt())
of_node_put(this_leaf->fw_token);
}
+
+ /* cpu is no longer populated in the shared map */
+ this_cpu_ci->cpu_map_populated = false;
}
static void free_cache_attributes(unsigned int cpu)
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 074/568] arm64: tegra: Update cache properties
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 073/568] drivers: base: cacheinfo: Update cpu_map_populated during CPU Hotplug Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 075/568] filemap: add a kiocb_invalidate_pages helper Greg Kroah-Hartman
` (500 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre Gondois, Thierry Reding,
Wen Yang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Gondois <pierre.gondois@arm.com>
[ Upstream commit 27f1568b1d5fe35014074f92717b250afbe67031 ]
The DeviceTree Specification v0.3 specifies that the cache node
'compatible' and 'cache-level' properties are 'required'. Cf.
s3.8 Multi-level and Shared Cache Nodes
The 'cache-unified' property should be present if one of the
properties for unified cache is present ('cache-size', ...).
Update the Device Trees accordingly.
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Wen Yang <wen.yang@linux.dev>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/nvidia/tegra194.dtsi | 15 ++++++++++++++
arch/arm64/boot/dts/nvidia/tegra210.dtsi | 1
arch/arm64/boot/dts/nvidia/tegra234.dtsi | 33 +++++++++++++++++++++++++++++++
3 files changed, 49 insertions(+)
--- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
@@ -3029,36 +3029,51 @@
};
l2c_0: l2-cache0 {
+ compatible = "cache";
+ cache-unified;
cache-size = <2097152>;
cache-line-size = <64>;
cache-sets = <2048>;
+ cache-level = <2>;
next-level-cache = <&l3c>;
};
l2c_1: l2-cache1 {
+ compatible = "cache";
+ cache-unified;
cache-size = <2097152>;
cache-line-size = <64>;
cache-sets = <2048>;
+ cache-level = <2>;
next-level-cache = <&l3c>;
};
l2c_2: l2-cache2 {
+ compatible = "cache";
+ cache-unified;
cache-size = <2097152>;
cache-line-size = <64>;
cache-sets = <2048>;
+ cache-level = <2>;
next-level-cache = <&l3c>;
};
l2c_3: l2-cache3 {
+ compatible = "cache";
+ cache-unified;
cache-size = <2097152>;
cache-line-size = <64>;
cache-sets = <2048>;
+ cache-level = <2>;
next-level-cache = <&l3c>;
};
l3c: l3-cache {
+ compatible = "cache";
+ cache-unified;
cache-size = <4194304>;
cache-line-size = <64>;
+ cache-level = <3>;
cache-sets = <4096>;
};
};
--- a/arch/arm64/boot/dts/nvidia/tegra210.dtsi
+++ b/arch/arm64/boot/dts/nvidia/tegra210.dtsi
@@ -2005,6 +2005,7 @@
L2: l2-cache {
compatible = "cache";
+ cache-level = <2>;
};
};
--- a/arch/arm64/boot/dts/nvidia/tegra234.dtsi
+++ b/arch/arm64/boot/dts/nvidia/tegra234.dtsi
@@ -2907,117 +2907,150 @@
};
l2c0_0: l2-cache00 {
+ compatible = "cache";
cache-size = <262144>;
cache-line-size = <64>;
cache-sets = <512>;
cache-unified;
+ cache-level = <2>;
next-level-cache = <&l3c0>;
};
l2c0_1: l2-cache01 {
+ compatible = "cache";
cache-size = <262144>;
cache-line-size = <64>;
cache-sets = <512>;
cache-unified;
+ cache-level = <2>;
next-level-cache = <&l3c0>;
};
l2c0_2: l2-cache02 {
+ compatible = "cache";
cache-size = <262144>;
cache-line-size = <64>;
cache-sets = <512>;
cache-unified;
+ cache-level = <2>;
next-level-cache = <&l3c0>;
};
l2c0_3: l2-cache03 {
+ compatible = "cache";
cache-size = <262144>;
cache-line-size = <64>;
cache-sets = <512>;
cache-unified;
+ cache-level = <2>;
next-level-cache = <&l3c0>;
};
l2c1_0: l2-cache10 {
+ compatible = "cache";
cache-size = <262144>;
cache-line-size = <64>;
cache-sets = <512>;
cache-unified;
+ cache-level = <2>;
next-level-cache = <&l3c1>;
};
l2c1_1: l2-cache11 {
+ compatible = "cache";
cache-size = <262144>;
cache-line-size = <64>;
cache-sets = <512>;
cache-unified;
+ cache-level = <2>;
next-level-cache = <&l3c1>;
};
l2c1_2: l2-cache12 {
+ compatible = "cache";
cache-size = <262144>;
cache-line-size = <64>;
cache-sets = <512>;
cache-unified;
+ cache-level = <2>;
next-level-cache = <&l3c1>;
};
l2c1_3: l2-cache13 {
+ compatible = "cache";
cache-size = <262144>;
cache-line-size = <64>;
cache-sets = <512>;
cache-unified;
+ cache-level = <2>;
next-level-cache = <&l3c1>;
};
l2c2_0: l2-cache20 {
+ compatible = "cache";
cache-size = <262144>;
cache-line-size = <64>;
cache-sets = <512>;
cache-unified;
+ cache-level = <2>;
next-level-cache = <&l3c2>;
};
l2c2_1: l2-cache21 {
+ compatible = "cache";
cache-size = <262144>;
cache-line-size = <64>;
cache-sets = <512>;
cache-unified;
+ cache-level = <2>;
next-level-cache = <&l3c2>;
};
l2c2_2: l2-cache22 {
+ compatible = "cache";
cache-size = <262144>;
cache-line-size = <64>;
cache-sets = <512>;
cache-unified;
+ cache-level = <2>;
next-level-cache = <&l3c2>;
};
l2c2_3: l2-cache23 {
+ compatible = "cache";
cache-size = <262144>;
cache-line-size = <64>;
cache-sets = <512>;
cache-unified;
+ cache-level = <2>;
next-level-cache = <&l3c2>;
};
l3c0: l3-cache0 {
+ compatible = "cache";
+ cache-unified;
cache-size = <2097152>;
cache-line-size = <64>;
cache-sets = <2048>;
+ cache-level = <3>;
};
l3c1: l3-cache1 {
+ compatible = "cache";
+ cache-unified;
cache-size = <2097152>;
cache-line-size = <64>;
cache-sets = <2048>;
+ cache-level = <3>;
};
l3c2: l3-cache2 {
+ compatible = "cache";
+ cache-unified;
cache-size = <2097152>;
cache-line-size = <64>;
cache-sets = <2048>;
+ cache-level = <3>;
};
};
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 075/568] filemap: add a kiocb_invalidate_pages helper
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 074/568] arm64: tegra: Update cache properties Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 076/568] filemap: add a kiocb_invalidate_post_direct_write helper Greg Kroah-Hartman
` (499 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Damien Le Moal,
Hannes Reinecke, Darrick J. Wong, Al Viro, Andreas Gruenbacher,
Anna Schumaker, Chao Yu, Christian Brauner, Ilya Dryomov,
Jaegeuk Kim, Jens Axboe, Johannes Thumshirn, Matthew Wilcox,
Miklos Szeredi, Miklos Szeredi, Theodore Tso, Trond Myklebust,
Xiubo Li, Andrew Morton, Mahmoud Adam
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
commit e003f74afbd2feadbb9ffbf9135e2d2fb5d320a5 upstream.
Factor out a helper that calls filemap_write_and_wait_range and
invalidate_inode_pages2_range for the range covered by a write kiocb or
returns -EAGAIN if the kiocb is marked as nowait and there would be pages
to write or invalidate.
Link: https://lkml.kernel.org/r/20230601145904.1385409-6-hch@lst.de
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Acked-by: Darrick J. Wong <djwong@kernel.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Andreas Gruenbacher <agruenba@redhat.com>
Cc: Anna Schumaker <anna@kernel.org>
Cc: Chao Yu <chao@kernel.org>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Ilya Dryomov <idryomov@gmail.com>
Cc: Jaegeuk Kim <jaegeuk@kernel.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Miklos Szeredi <mszeredi@redhat.com>
Cc: Theodore Ts'o <tytso@mit.edu>
Cc: Trond Myklebust <trond.myklebust@hammerspace.com>
Cc: Xiubo Li <xiubli@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Mahmoud Adam <mngyadam@amazon.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/pagemap.h | 1 +
mm/filemap.c | 48 ++++++++++++++++++++++++++++--------------------
2 files changed, 29 insertions(+), 20 deletions(-)
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -30,6 +30,7 @@ static inline void invalidate_remote_ino
int invalidate_inode_pages2(struct address_space *mapping);
int invalidate_inode_pages2_range(struct address_space *mapping,
pgoff_t start, pgoff_t end);
+int kiocb_invalidate_pages(struct kiocb *iocb, size_t count);
int write_inode_now(struct inode *, int sync);
int filemap_fdatawrite(struct address_space *);
int filemap_flush(struct address_space *);
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2839,6 +2839,33 @@ put_folios:
}
EXPORT_SYMBOL_GPL(filemap_read);
+int kiocb_invalidate_pages(struct kiocb *iocb, size_t count)
+{
+ struct address_space *mapping = iocb->ki_filp->f_mapping;
+ loff_t pos = iocb->ki_pos;
+ loff_t end = pos + count - 1;
+ int ret;
+
+ if (iocb->ki_flags & IOCB_NOWAIT) {
+ /* we could block if there are any pages in the range */
+ if (filemap_range_has_page(mapping, pos, end))
+ return -EAGAIN;
+ } else {
+ ret = filemap_write_and_wait_range(mapping, pos, end);
+ if (ret)
+ return ret;
+ }
+
+ /*
+ * After a write we want buffered reads to be sure to go to disk to get
+ * the new data. We invalidate clean cached page from the region we're
+ * about to write. We do this *before* the write so that we can return
+ * without clobbering -EIOCBQUEUED from ->direct_IO().
+ */
+ return invalidate_inode_pages2_range(mapping, pos >> PAGE_SHIFT,
+ end >> PAGE_SHIFT);
+}
+
/**
* generic_file_read_iter - generic filesystem read routine
* @iocb: kernel I/O control block
@@ -3737,30 +3764,11 @@ generic_file_direct_write(struct kiocb *
write_len = iov_iter_count(from);
end = (pos + write_len - 1) >> PAGE_SHIFT;
- if (iocb->ki_flags & IOCB_NOWAIT) {
- /* If there are pages to writeback, return */
- if (filemap_range_has_page(file->f_mapping, pos,
- pos + write_len - 1))
- return -EAGAIN;
- } else {
- written = filemap_write_and_wait_range(mapping, pos,
- pos + write_len - 1);
- if (written)
- goto out;
- }
-
- /*
- * After a write we want buffered reads to be sure to go to disk to get
- * the new data. We invalidate clean cached page from the region we're
- * about to write. We do this *before* the write so that we can return
- * without clobbering -EIOCBQUEUED from ->direct_IO().
- */
- written = invalidate_inode_pages2_range(mapping,
- pos >> PAGE_SHIFT, end);
/*
* If a page can not be invalidated, return 0 to fall back
* to buffered write.
*/
+ written = kiocb_invalidate_pages(iocb, write_len);
if (written) {
if (written == -EBUSY)
return 0;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 076/568] filemap: add a kiocb_invalidate_post_direct_write helper
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 075/568] filemap: add a kiocb_invalidate_pages helper Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 077/568] filemap: update ki_pos in generic_perform_write Greg Kroah-Hartman
` (498 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Damien Le Moal,
Hannes Reinecke, Darrick J. Wong, Al Viro, Andreas Gruenbacher,
Anna Schumaker, Chao Yu, Christian Brauner, Ilya Dryomov,
Jaegeuk Kim, Jens Axboe, Johannes Thumshirn, Matthew Wilcox,
Miklos Szeredi, Miklos Szeredi, Theodore Tso, Trond Myklebust,
Xiubo Li, Andrew Morton, Mahmoud Adam
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
commit c402a9a9430b670926decbb284b756ee6f47c1ec upstream.
Add a helper to invalidate page cache after a dio write.
Link: https://lkml.kernel.org/r/20230601145904.1385409-7-hch@lst.de
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Acked-by: Darrick J. Wong <djwong@kernel.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Andreas Gruenbacher <agruenba@redhat.com>
Cc: Anna Schumaker <anna@kernel.org>
Cc: Chao Yu <chao@kernel.org>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Ilya Dryomov <idryomov@gmail.com>
Cc: Jaegeuk Kim <jaegeuk@kernel.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Miklos Szeredi <mszeredi@redhat.com>
Cc: Theodore Ts'o <tytso@mit.edu>
Cc: Trond Myklebust <trond.myklebust@hammerspace.com>
Cc: Xiubo Li <xiubli@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Mahmoud Adam <mngyadam@amazon.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/direct-io.c | 10 ++--------
fs/iomap/direct-io.c | 12 ++----------
include/linux/fs.h | 5 -----
include/linux/pagemap.h | 1 +
mm/filemap.c | 37 ++++++++++++++++++++-----------------
5 files changed, 25 insertions(+), 40 deletions(-)
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -286,14 +286,8 @@ static ssize_t dio_complete(struct dio *
* zeros from unwritten extents.
*/
if (flags & DIO_COMPLETE_INVALIDATE &&
- ret > 0 && dio_op == REQ_OP_WRITE &&
- dio->inode->i_mapping->nrpages) {
- err = invalidate_inode_pages2_range(dio->inode->i_mapping,
- offset >> PAGE_SHIFT,
- (offset + ret - 1) >> PAGE_SHIFT);
- if (err)
- dio_warn_stale_pagecache(dio->iocb->ki_filp);
- }
+ ret > 0 && dio_op == REQ_OP_WRITE)
+ kiocb_invalidate_post_direct_write(dio->iocb, ret);
inode_dio_end(dio->inode);
--- a/fs/iomap/direct-io.c
+++ b/fs/iomap/direct-io.c
@@ -81,7 +81,6 @@ ssize_t iomap_dio_complete(struct iomap_
{
const struct iomap_dio_ops *dops = dio->dops;
struct kiocb *iocb = dio->iocb;
- struct inode *inode = file_inode(iocb->ki_filp);
loff_t offset = iocb->ki_pos;
ssize_t ret = dio->error;
@@ -108,15 +107,8 @@ ssize_t iomap_dio_complete(struct iomap_
* ->end_io() when necessary, otherwise a racing buffer read would cache
* zeros from unwritten extents.
*/
- if (!dio->error && dio->size &&
- (dio->flags & IOMAP_DIO_WRITE) && inode->i_mapping->nrpages) {
- int err;
- err = invalidate_inode_pages2_range(inode->i_mapping,
- offset >> PAGE_SHIFT,
- (offset + dio->size - 1) >> PAGE_SHIFT);
- if (err)
- dio_warn_stale_pagecache(iocb->ki_filp);
- }
+ if (!dio->error && dio->size && (dio->flags & IOMAP_DIO_WRITE))
+ kiocb_invalidate_post_direct_write(iocb, dio->size);
inode_dio_end(file_inode(iocb->ki_filp));
if (ret > 0) {
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -3371,11 +3371,6 @@ static inline void inode_dio_end(struct
wake_up_bit(&inode->i_state, __I_DIO_WAKEUP);
}
-/*
- * Warn about a page cache invalidation failure diring a direct I/O write.
- */
-void dio_warn_stale_pagecache(struct file *filp);
-
extern void inode_set_flags(struct inode *inode, unsigned int flags,
unsigned int mask);
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -31,6 +31,7 @@ int invalidate_inode_pages2(struct addre
int invalidate_inode_pages2_range(struct address_space *mapping,
pgoff_t start, pgoff_t end);
int kiocb_invalidate_pages(struct kiocb *iocb, size_t count);
+void kiocb_invalidate_post_direct_write(struct kiocb *iocb, size_t count);
int write_inode_now(struct inode *, int sync);
int filemap_fdatawrite(struct address_space *);
int filemap_flush(struct address_space *);
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -3733,7 +3733,7 @@ EXPORT_SYMBOL(read_cache_page_gfp);
/*
* Warn about a page cache invalidation failure during a direct I/O write.
*/
-void dio_warn_stale_pagecache(struct file *filp)
+static void dio_warn_stale_pagecache(struct file *filp)
{
static DEFINE_RATELIMIT_STATE(_rs, 86400 * HZ, DEFAULT_RATELIMIT_BURST);
char pathname[128];
@@ -3750,19 +3750,23 @@ void dio_warn_stale_pagecache(struct fil
}
}
+void kiocb_invalidate_post_direct_write(struct kiocb *iocb, size_t count)
+{
+ struct address_space *mapping = iocb->ki_filp->f_mapping;
+
+ if (mapping->nrpages &&
+ invalidate_inode_pages2_range(mapping,
+ iocb->ki_pos >> PAGE_SHIFT,
+ (iocb->ki_pos + count - 1) >> PAGE_SHIFT))
+ dio_warn_stale_pagecache(iocb->ki_filp);
+}
+
ssize_t
generic_file_direct_write(struct kiocb *iocb, struct iov_iter *from)
{
- struct file *file = iocb->ki_filp;
- struct address_space *mapping = file->f_mapping;
- struct inode *inode = mapping->host;
- loff_t pos = iocb->ki_pos;
- ssize_t written;
- size_t write_len;
- pgoff_t end;
-
- write_len = iov_iter_count(from);
- end = (pos + write_len - 1) >> PAGE_SHIFT;
+ struct address_space *mapping = iocb->ki_filp->f_mapping;
+ size_t write_len = iov_iter_count(from);
+ ssize_t written;
/*
* If a page can not be invalidated, return 0 to fall back
@@ -3772,7 +3776,7 @@ generic_file_direct_write(struct kiocb *
if (written) {
if (written == -EBUSY)
return 0;
- goto out;
+ return written;
}
written = mapping->a_ops->direct_IO(iocb, from);
@@ -3794,11 +3798,11 @@ generic_file_direct_write(struct kiocb *
*
* Skip invalidation for async writes or if mapping has no pages.
*/
- if (written > 0 && mapping->nrpages &&
- invalidate_inode_pages2_range(mapping, pos >> PAGE_SHIFT, end))
- dio_warn_stale_pagecache(file);
-
if (written > 0) {
+ struct inode *inode = mapping->host;
+ loff_t pos = iocb->ki_pos;
+
+ kiocb_invalidate_post_direct_write(iocb, written);
pos += written;
write_len -= written;
if (pos > i_size_read(inode) && !S_ISBLK(inode->i_mode)) {
@@ -3809,7 +3813,6 @@ generic_file_direct_write(struct kiocb *
}
if (written != -EIOCBQUEUED)
iov_iter_revert(from, write_len - iov_iter_count(from));
-out:
return written;
}
EXPORT_SYMBOL(generic_file_direct_write);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 077/568] filemap: update ki_pos in generic_perform_write
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 076/568] filemap: add a kiocb_invalidate_post_direct_write helper Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 078/568] fs: factor out a direct_write_fallback helper Greg Kroah-Hartman
` (497 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Xiubo Li,
Damien Le Moal, Hannes Reinecke, Theodore Tso, Darrick J. Wong,
Al Viro, Andreas Gruenbacher, Anna Schumaker, Chao Yu,
Christian Brauner, Ilya Dryomov, Jaegeuk Kim, Jens Axboe,
Johannes Thumshirn, Matthew Wilcox, Miklos Szeredi,
Miklos Szeredi, Trond Myklebust, Andrew Morton, Mahmoud Adam
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
commit 182c25e9c157f37bd0ab5a82fe2417e2223df459 upstream.
All callers of generic_perform_write need to updated ki_pos, move it into
common code.
Link: https://lkml.kernel.org/r/20230601145904.1385409-4-hch@lst.de
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Acked-by: Theodore Ts'o <tytso@mit.edu>
Acked-by: Darrick J. Wong <djwong@kernel.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Andreas Gruenbacher <agruenba@redhat.com>
Cc: Anna Schumaker <anna@kernel.org>
Cc: Chao Yu <chao@kernel.org>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Ilya Dryomov <idryomov@gmail.com>
Cc: Jaegeuk Kim <jaegeuk@kernel.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Miklos Szeredi <mszeredi@redhat.com>
Cc: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Mahmoud Adam <mngyadam@amazon.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/file.c | 2 --
fs/ext4/file.c | 9 +++------
fs/f2fs/file.c | 1 -
fs/nfs/file.c | 1 -
mm/filemap.c | 8 ++++----
5 files changed, 7 insertions(+), 14 deletions(-)
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -1891,8 +1891,6 @@ retry_snap:
* can not run at the same time
*/
written = generic_perform_write(iocb, from);
- if (likely(written >= 0))
- iocb->ki_pos = pos + written;
ceph_end_io_write(inode);
}
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -287,12 +287,9 @@ static ssize_t ext4_buffered_write_iter(
out:
inode_unlock(inode);
- if (likely(ret > 0)) {
- iocb->ki_pos += ret;
- ret = generic_write_sync(iocb, ret);
- }
-
- return ret;
+ if (unlikely(ret <= 0))
+ return ret;
+ return generic_write_sync(iocb, ret);
}
static ssize_t ext4_handle_inode_extension(struct inode *inode, loff_t offset,
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -4659,7 +4659,6 @@ static ssize_t f2fs_buffered_write_iter(
current->backing_dev_info = NULL;
if (ret > 0) {
- iocb->ki_pos += ret;
f2fs_update_iostat(F2FS_I_SB(inode), inode,
APP_BUFFERED_IO, ret);
}
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -645,7 +645,6 @@ ssize_t nfs_file_write(struct kiocb *ioc
goto out;
written = result;
- iocb->ki_pos += written;
nfs_add_stats(inode, NFSIOS_NORMALWRITTENBYTES, written);
if (mntflags & NFS_MOUNT_WRITE_EAGER) {
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -3891,7 +3891,10 @@ again:
balance_dirty_pages_ratelimited(mapping);
} while (iov_iter_count(i));
- return written ? written : status;
+ if (!written)
+ return status;
+ iocb->ki_pos += written;
+ return written;
}
EXPORT_SYMBOL(generic_perform_write);
@@ -3970,7 +3973,6 @@ ssize_t __generic_file_write_iter(struct
endbyte = pos + status - 1;
err = filemap_write_and_wait_range(mapping, pos, endbyte);
if (err == 0) {
- iocb->ki_pos = endbyte + 1;
written += status;
invalidate_mapping_pages(mapping,
pos >> PAGE_SHIFT,
@@ -3983,8 +3985,6 @@ ssize_t __generic_file_write_iter(struct
}
} else {
written = generic_perform_write(iocb, from);
- if (likely(written > 0))
- iocb->ki_pos += written;
}
out:
current->backing_dev_info = NULL;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 078/568] fs: factor out a direct_write_fallback helper
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 077/568] filemap: update ki_pos in generic_perform_write Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 079/568] direct_write_fallback(): on error revert the ->ki_pos update from buffered write Greg Kroah-Hartman
` (496 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Damien Le Moal,
Miklos Szeredi, Darrick J. Wong, Al Viro, Andreas Gruenbacher,
Anna Schumaker, Chao Yu, Christian Brauner, Hannes Reinecke,
Ilya Dryomov, Jaegeuk Kim, Jens Axboe, Johannes Thumshirn,
Matthew Wilcox, Miklos Szeredi, Theodore Tso, Trond Myklebust,
Xiubo Li, Andrew Morton, Mahmoud Adam
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
commit 44fff0fa08ec5a6d9d5fb05443a36d854d0ece4d upstream.
Add a helper dealing with handling the syncing of a buffered write
fallback for direct I/O.
Link: https://lkml.kernel.org/r/20230601145904.1385409-10-hch@lst.de
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Miklos Szeredi <mszeredi@redhat.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Andreas Gruenbacher <agruenba@redhat.com>
Cc: Anna Schumaker <anna@kernel.org>
Cc: Chao Yu <chao@kernel.org>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Hannes Reinecke <hare@suse.de>
Cc: Ilya Dryomov <idryomov@gmail.com>
Cc: Jaegeuk Kim <jaegeuk@kernel.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Theodore Ts'o <tytso@mit.edu>
Cc: Trond Myklebust <trond.myklebust@hammerspace.com>
Cc: Xiubo Li <xiubli@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
[backing_dev_info still being used here. do small changes to the patch
to keep the out label. Which means replacing all returns to goto out.]
Signed-off-by: Mahmoud Adam <mngyadam@amazon.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/libfs.c | 41 +++++++++++++++++++++++++++++++++++
include/linux/fs.h | 2 +
mm/filemap.c | 61 ++++++++++++-----------------------------------------
3 files changed, 57 insertions(+), 47 deletions(-)
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -1582,3 +1582,44 @@ bool inode_maybe_inc_iversion(struct ino
return true;
}
EXPORT_SYMBOL(inode_maybe_inc_iversion);
+
+ssize_t direct_write_fallback(struct kiocb *iocb, struct iov_iter *iter,
+ ssize_t direct_written, ssize_t buffered_written)
+{
+ struct address_space *mapping = iocb->ki_filp->f_mapping;
+ loff_t pos = iocb->ki_pos - buffered_written;
+ loff_t end = iocb->ki_pos - 1;
+ int err;
+
+ /*
+ * If the buffered write fallback returned an error, we want to return
+ * the number of bytes which were written by direct I/O, or the error
+ * code if that was zero.
+ *
+ * Note that this differs from normal direct-io semantics, which will
+ * return -EFOO even if some bytes were written.
+ */
+ if (unlikely(buffered_written < 0)) {
+ if (direct_written)
+ return direct_written;
+ return buffered_written;
+ }
+
+ /*
+ * We need to ensure that the page cache pages are written to disk and
+ * invalidated to preserve the expected O_DIRECT semantics.
+ */
+ err = filemap_write_and_wait_range(mapping, pos, end);
+ if (err < 0) {
+ /*
+ * We don't know how much we wrote, so just return the number of
+ * bytes which were direct-written
+ */
+ if (direct_written)
+ return direct_written;
+ return err;
+ }
+ invalidate_mapping_pages(mapping, pos >> PAGE_SHIFT, end >> PAGE_SHIFT);
+ return direct_written + buffered_written;
+}
+EXPORT_SYMBOL_GPL(direct_write_fallback);
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -3278,6 +3278,8 @@ extern ssize_t __generic_file_write_iter
extern ssize_t generic_file_write_iter(struct kiocb *, struct iov_iter *);
extern ssize_t generic_file_direct_write(struct kiocb *, struct iov_iter *);
ssize_t generic_perform_write(struct kiocb *, struct iov_iter *);
+ssize_t direct_write_fallback(struct kiocb *iocb, struct iov_iter *iter,
+ ssize_t direct_written, ssize_t buffered_written);
ssize_t vfs_iter_read(struct file *file, struct iov_iter *iter, loff_t *ppos,
rwf_t flags);
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -3923,25 +3923,21 @@ ssize_t __generic_file_write_iter(struct
{
struct file *file = iocb->ki_filp;
struct address_space *mapping = file->f_mapping;
- struct inode *inode = mapping->host;
- ssize_t written = 0;
- ssize_t err;
- ssize_t status;
+ struct inode *inode = mapping->host;
+ ssize_t ret;
/* We can write back this queue in page reclaim */
current->backing_dev_info = inode_to_bdi(inode);
- err = file_remove_privs(file);
- if (err)
+ ret = file_remove_privs(file);
+ if (ret)
goto out;
- err = file_update_time(file);
- if (err)
+ ret = file_update_time(file);
+ if (ret)
goto out;
if (iocb->ki_flags & IOCB_DIRECT) {
- loff_t pos, endbyte;
-
- written = generic_file_direct_write(iocb, from);
+ ret = generic_file_direct_write(iocb, from);
/*
* If the write stopped short of completing, fall back to
* buffered writes. Some filesystems do this for writes to
@@ -3949,46 +3945,17 @@ ssize_t __generic_file_write_iter(struct
* not succeed (even if it did, DAX does not handle dirty
* page-cache pages correctly).
*/
- if (written < 0 || !iov_iter_count(from) || IS_DAX(inode))
- goto out;
-
- pos = iocb->ki_pos;
- status = generic_perform_write(iocb, from);
- /*
- * If generic_perform_write() returned a synchronous error
- * then we want to return the number of bytes which were
- * direct-written, or the error code if that was zero. Note
- * that this differs from normal direct-io semantics, which
- * will return -EFOO even if some bytes were written.
- */
- if (unlikely(status < 0)) {
- err = status;
+ if (ret < 0 || !iov_iter_count(from) || IS_DAX(inode))
goto out;
- }
- /*
- * We need to ensure that the page cache pages are written to
- * disk and invalidated to preserve the expected O_DIRECT
- * semantics.
- */
- endbyte = pos + status - 1;
- err = filemap_write_and_wait_range(mapping, pos, endbyte);
- if (err == 0) {
- written += status;
- invalidate_mapping_pages(mapping,
- pos >> PAGE_SHIFT,
- endbyte >> PAGE_SHIFT);
- } else {
- /*
- * We don't know how much we wrote, so just return
- * the number of bytes which were direct-written
- */
- }
- } else {
- written = generic_perform_write(iocb, from);
+ ret = direct_write_fallback(iocb, from, ret,
+ generic_perform_write(iocb, from));
+ goto out;
}
+
+ ret = generic_perform_write(iocb, from);
out:
current->backing_dev_info = NULL;
- return written ? written : err;
+ return ret;
}
EXPORT_SYMBOL(__generic_file_write_iter);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 079/568] direct_write_fallback(): on error revert the ->ki_pos update from buffered write
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 078/568] fs: factor out a direct_write_fallback helper Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 080/568] block: open code __generic_file_write_iter for blkdev writes Greg Kroah-Hartman
` (495 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Al Viro, Christian Brauner,
Mahmoud Adam
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 8287474aa5ffb41df52552c4ae4748e791d2faf2 upstream.
If we fail filemap_write_and_wait_range() on the range the buffered write went
into, we only report the "number of bytes which we direct-written", to quote
the comment in there. Which is fine, but buffered write has already advanced
iocb->ki_pos, so we need to roll that back. Otherwise we end up with e.g.
write(2) advancing position by more than the amount it reports having written.
Fixes: 182c25e9c157 "filemap: update ki_pos in generic_perform_write"
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Message-Id: <20230827214518.GU3390869@ZenIV>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Mahmoud Adam <mngyadam@amazon.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/libfs.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -1615,6 +1615,7 @@ ssize_t direct_write_fallback(struct kio
* We don't know how much we wrote, so just return the number of
* bytes which were direct-written
*/
+ iocb->ki_pos -= buffered_written;
if (direct_written)
return direct_written;
return err;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 080/568] block: open code __generic_file_write_iter for blkdev writes
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 079/568] direct_write_fallback(): on error revert the ->ki_pos update from buffered write Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 081/568] block: fix race between set_blocksize and read paths Greg Kroah-Hartman
` (494 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig,
Johannes Thumshirn, Christian Brauner, Hannes Reinecke,
Luis Chamberlain, Jens Axboe, Mahmoud Adam
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
commit 727cfe976758b79f8d2f8051c75a5ccb14539a56 upstream.
Open code __generic_file_write_iter to remove the indirect call into
->direct_IO and to prepare using the iomap based write code.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Christian Brauner <brauner@kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Link: https://lore.kernel.org/r/20230801172201.1923299-4-hch@lst.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[fix contextual changes]
Signed-off-by: Mahmoud Adam <mngyadam@amazon.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/fops.c | 45 +++++++++++++++++++++++++++++++++++++++++++--
1 file changed, 43 insertions(+), 2 deletions(-)
--- a/block/fops.c
+++ b/block/fops.c
@@ -515,6 +515,30 @@ static int blkdev_close(struct inode *in
return 0;
}
+static ssize_t
+blkdev_direct_write(struct kiocb *iocb, struct iov_iter *from)
+{
+ size_t count = iov_iter_count(from);
+ ssize_t written;
+
+ written = kiocb_invalidate_pages(iocb, count);
+ if (written) {
+ if (written == -EBUSY)
+ return 0;
+ return written;
+ }
+
+ written = blkdev_direct_IO(iocb, from);
+ if (written > 0) {
+ kiocb_invalidate_post_direct_write(iocb, count);
+ iocb->ki_pos += written;
+ count -= written;
+ }
+ if (written != -EIOCBQUEUED)
+ iov_iter_revert(from, count - iov_iter_count(from));
+ return written;
+}
+
/*
* Write data to the block device. Only intended for the block device itself
* and the raw driver which basically is a fake block device.
@@ -524,7 +548,8 @@ static int blkdev_close(struct inode *in
*/
static ssize_t blkdev_write_iter(struct kiocb *iocb, struct iov_iter *from)
{
- struct block_device *bdev = iocb->ki_filp->private_data;
+ struct file *file = iocb->ki_filp;
+ struct block_device *bdev = file->private_data;
struct inode *bd_inode = bdev->bd_inode;
loff_t size = bdev_nr_bytes(bdev);
struct blk_plug plug;
@@ -553,7 +578,23 @@ static ssize_t blkdev_write_iter(struct
}
blk_start_plug(&plug);
- ret = __generic_file_write_iter(iocb, from);
+ ret = file_remove_privs(file);
+ if (ret)
+ return ret;
+
+ ret = file_update_time(file);
+ if (ret)
+ return ret;
+
+ if (iocb->ki_flags & IOCB_DIRECT) {
+ ret = blkdev_direct_write(iocb, from);
+ if (ret >= 0 && iov_iter_count(from))
+ ret = direct_write_fallback(iocb, from, ret,
+ generic_perform_write(iocb, from));
+ } else {
+ ret = generic_perform_write(iocb, from);
+ }
+
if (ret > 0)
ret = generic_write_sync(iocb, ret);
iov_iter_reexpand(from, iov_iter_count(from) + shorted);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 081/568] block: fix race between set_blocksize and read paths
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 080/568] block: open code __generic_file_write_iter for blkdev writes Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 082/568] nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() Greg Kroah-Hartman
` (493 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Luis Chamberlain, Shinichiro Kawasaki, Jens Axboe, Mahmoud Adam
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Darrick J. Wong" <djwong@kernel.org>
commit c0e473a0d226479e8e925d5ba93f751d8df628e9 upstream.
With the new large sector size support, it's now the case that
set_blocksize can change i_blksize and the folio order in a manner that
conflicts with a concurrent reader and causes a kernel crash.
Specifically, let's say that udev-worker calls libblkid to detect the
labels on a block device. The read call can create an order-0 folio to
read the first 4096 bytes from the disk. But then udev is preempted.
Next, someone tries to mount an 8k-sectorsize filesystem from the same
block device. The filesystem calls set_blksize, which sets i_blksize to
8192 and the minimum folio order to 1.
Now udev resumes, still holding the order-0 folio it allocated. It then
tries to schedule a read bio and do_mpage_readahead tries to create
bufferheads for the folio. Unfortunately, blocks_per_folio == 0 because
the page size is 4096 but the blocksize is 8192 so no bufferheads are
attached and the bh walk never sets bdev. We then submit the bio with a
NULL block device and crash.
Therefore, truncate the page cache after flushing but before updating
i_blksize. However, that's not enough -- we also need to lock out file
IO and page faults during the update. Take both the i_rwsem and the
invalidate_lock in exclusive mode for invalidations, and in shared mode
for read/write operations.
I don't know if this is the correct fix, but xfs/259 found it.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Link: https://lore.kernel.org/r/174543795699.4139148.2086129139322431423.stgit@frogsfrogsfrogs
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[use bdev->bd_inode instead & fix small contextual changes]
Signed-off-by: Mahmoud Adam <mngyadam@amazon.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/bdev.c | 17 +++++++++++++++++
block/blk-zoned.c | 5 ++++-
block/fops.c | 16 ++++++++++++++++
block/ioctl.c | 6 ++++++
4 files changed, 43 insertions(+), 1 deletion(-)
--- a/block/bdev.c
+++ b/block/bdev.c
@@ -147,9 +147,26 @@ int set_blocksize(struct block_device *b
/* Don't change the size if it is same as current */
if (bdev->bd_inode->i_blkbits != blksize_bits(size)) {
+ /*
+ * Flush and truncate the pagecache before we reconfigure the
+ * mapping geometry because folio sizes are variable now. If a
+ * reader has already allocated a folio whose size is smaller
+ * than the new min_order but invokes readahead after the new
+ * min_order becomes visible, readahead will think there are
+ * "zero" blocks per folio and crash. Take the inode and
+ * invalidation locks to avoid racing with
+ * read/write/fallocate.
+ */
+ inode_lock(bdev->bd_inode);
+ filemap_invalidate_lock(bdev->bd_inode->i_mapping);
+
sync_blockdev(bdev);
+ kill_bdev(bdev);
+
bdev->bd_inode->i_blkbits = blksize_bits(size);
kill_bdev(bdev);
+ filemap_invalidate_unlock(bdev->bd_inode->i_mapping);
+ inode_unlock(bdev->bd_inode);
}
return 0;
}
--- a/block/blk-zoned.c
+++ b/block/blk-zoned.c
@@ -417,6 +417,7 @@ int blkdev_zone_mgmt_ioctl(struct block_
op = REQ_OP_ZONE_RESET;
/* Invalidate the page cache, including dirty pages. */
+ inode_lock(bdev->bd_inode);
filemap_invalidate_lock(bdev->bd_inode->i_mapping);
ret = blkdev_truncate_zone_range(bdev, mode, &zrange);
if (ret)
@@ -439,8 +440,10 @@ int blkdev_zone_mgmt_ioctl(struct block_
GFP_KERNEL);
fail:
- if (cmd == BLKRESETZONE)
+ if (cmd == BLKRESETZONE) {
filemap_invalidate_unlock(bdev->bd_inode->i_mapping);
+ inode_unlock(bdev->bd_inode);
+ }
return ret;
}
--- a/block/fops.c
+++ b/block/fops.c
@@ -592,7 +592,14 @@ static ssize_t blkdev_write_iter(struct
ret = direct_write_fallback(iocb, from, ret,
generic_perform_write(iocb, from));
} else {
+ /*
+ * Take i_rwsem and invalidate_lock to avoid racing with
+ * set_blocksize changing i_blkbits/folio order and punching
+ * out the pagecache.
+ */
+ inode_lock_shared(bd_inode);
ret = generic_perform_write(iocb, from);
+ inode_unlock_shared(bd_inode);
}
if (ret > 0)
@@ -605,6 +612,7 @@ static ssize_t blkdev_write_iter(struct
static ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to)
{
struct block_device *bdev = iocb->ki_filp->private_data;
+ struct inode *bd_inode = bdev->bd_inode;
loff_t size = bdev_nr_bytes(bdev);
loff_t pos = iocb->ki_pos;
size_t shorted = 0;
@@ -652,7 +660,13 @@ static ssize_t blkdev_read_iter(struct k
goto reexpand;
}
+ /*
+ * Take i_rwsem and invalidate_lock to avoid racing with set_blocksize
+ * changing i_blkbits/folio order and punching out the pagecache.
+ */
+ inode_lock_shared(bd_inode);
ret = filemap_read(iocb, to, ret);
+ inode_unlock_shared(bd_inode);
reexpand:
if (unlikely(shorted))
@@ -695,6 +709,7 @@ static long blkdev_fallocate(struct file
if ((start | len) & (bdev_logical_block_size(bdev) - 1))
return -EINVAL;
+ inode_lock(inode);
filemap_invalidate_lock(inode->i_mapping);
/*
@@ -735,6 +750,7 @@ static long blkdev_fallocate(struct file
fail:
filemap_invalidate_unlock(inode->i_mapping);
+ inode_unlock(inode);
return error;
}
--- a/block/ioctl.c
+++ b/block/ioctl.c
@@ -114,6 +114,7 @@ static int blk_ioctl_discard(struct bloc
end > bdev_nr_bytes(bdev))
return -EINVAL;
+ inode_lock(inode);
filemap_invalidate_lock(inode->i_mapping);
err = truncate_bdev_range(bdev, mode, start, end - 1);
if (err)
@@ -121,6 +122,7 @@ static int blk_ioctl_discard(struct bloc
err = blkdev_issue_discard(bdev, start >> 9, len >> 9, GFP_KERNEL);
fail:
filemap_invalidate_unlock(inode->i_mapping);
+ inode_unlock(inode);
return err;
}
@@ -146,12 +148,14 @@ static int blk_ioctl_secure_erase(struct
end > bdev_nr_bytes(bdev))
return -EINVAL;
+ inode_lock(bdev->bd_inode);
filemap_invalidate_lock(bdev->bd_inode->i_mapping);
err = truncate_bdev_range(bdev, mode, start, end - 1);
if (!err)
err = blkdev_issue_secure_erase(bdev, start >> 9, len >> 9,
GFP_KERNEL);
filemap_invalidate_unlock(bdev->bd_inode->i_mapping);
+ inode_unlock(bdev->bd_inode);
return err;
}
@@ -184,6 +188,7 @@ static int blk_ioctl_zeroout(struct bloc
return -EINVAL;
/* Invalidate the page cache, including dirty pages */
+ inode_lock(inode);
filemap_invalidate_lock(inode->i_mapping);
err = truncate_bdev_range(bdev, mode, start, end);
if (err)
@@ -194,6 +199,7 @@ static int blk_ioctl_zeroout(struct bloc
fail:
filemap_invalidate_unlock(inode->i_mapping);
+ inode_unlock(inode);
return err;
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 082/568] nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 081/568] block: fix race between set_blocksize and read paths Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 083/568] usb: gadget: f_fs: Fix epfile null pointer access after ep enable Greg Kroah-Hartman
` (492 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ryusuke Konishi,
syzbot+00f7f5b884b117ee6773, syzbot+f30591e72bfc24d4715b,
Andrew Morton, Mahmoud Adam
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
commit fb881cd7604536b17a1927fb0533f9a6982ffcc5 upstream.
After commit c0e473a0d226 ("block: fix race between set_blocksize and read
paths") was merged, set_blocksize() called by sb_set_blocksize() now locks
the inode of the backing device file. As a result of this change, syzbot
started reporting deadlock warnings due to a circular dependency involving
the semaphore "ns_sem" of the nilfs object, the inode lock of the backing
device file, and the locks that this inode lock is transitively dependent
on.
This is caused by a new lock dependency added by the above change, since
init_nilfs() calls sb_set_blocksize() in the lock section of "ns_sem".
However, these warnings are false positives because init_nilfs() is called
in the early stage of the mount operation and the filesystem has not yet
started.
The reason why "ns_sem" is locked in init_nilfs() was to avoid a race
condition in nilfs_fill_super() caused by sharing a nilfs object among
multiple filesystem instances (super block structures) in the early
implementation. However, nilfs objects and super block structures have
long ago become one-to-one, and there is no longer any need to use the
semaphore there.
So, fix this issue by removing the use of the semaphore "ns_sem" in
init_nilfs().
Link: https://lkml.kernel.org/r/20250503053327.12294-1-konishi.ryusuke@gmail.com
Fixes: c0e473a0d226 ("block: fix race between set_blocksize and read paths")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+00f7f5b884b117ee6773@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=00f7f5b884b117ee6773
Tested-by: syzbot+00f7f5b884b117ee6773@syzkaller.appspotmail.com
Reported-by: syzbot+f30591e72bfc24d4715b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f30591e72bfc24d4715b
Tested-by: syzbot+f30591e72bfc24d4715b@syzkaller.appspotmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Mahmoud Adam <mngyadam@amazon.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nilfs2/the_nilfs.c | 3 ---
1 file changed, 3 deletions(-)
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -680,8 +680,6 @@ int init_nilfs(struct the_nilfs *nilfs,
int blocksize;
int err;
- down_write(&nilfs->ns_sem);
-
blocksize = sb_min_blocksize(sb, NILFS_MIN_BLOCK_SIZE);
if (!blocksize) {
nilfs_err(sb, "unable to set blocksize");
@@ -757,7 +755,6 @@ int init_nilfs(struct the_nilfs *nilfs,
set_nilfs_init(nilfs);
err = 0;
out:
- up_write(&nilfs->ns_sem);
return err;
failed_sbh:
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 083/568] usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 082/568] nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 084/568] drm/sysfb: Do not dereference NULL pointer in plane reset Greg Kroah-Hartman
` (491 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Owen Gu
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Owen Gu <guhuinan@xiaomi.com>
commit cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4 upstream.
A race condition occurs when ffs_func_eps_enable() runs concurrently
with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset()
sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading
to a NULL pointer dereference when accessing epfile->ep in
ffs_func_eps_enable() after successful usb_ep_enable().
The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and
ffs_data_close() functions, and its modification is protected by the
spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function
is also protected by ffs->eps_lock.
Thus, add NULL pointer handling for ffs->epfiles in the
ffs_func_eps_enable() function to fix issues
Signed-off-by: Owen Gu <guhuinan@xiaomi.com>
Link: https://lore.kernel.org/r/20250915092907.17802-1-guhuinan@xiaomi.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_fs.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -2005,7 +2005,12 @@ static int ffs_func_eps_enable(struct ff
ep = func->eps;
epfile = ffs->epfiles;
count = ffs->eps_count;
- while(count--) {
+ if (!epfile) {
+ ret = -ENOMEM;
+ goto done;
+ }
+
+ while (count--) {
ep->ep->driver_data = ep;
ret = config_ep_by_speed(func->gadget, &func->function, ep->ep);
@@ -2029,6 +2034,7 @@ static int ffs_func_eps_enable(struct ff
}
wake_up_interruptible(&ffs->wait);
+done:
spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
return ret;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 084/568] drm/sysfb: Do not dereference NULL pointer in plane reset
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 083/568] usb: gadget: f_fs: Fix epfile null pointer access after ep enable Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 085/568] drm/sched: Fix race in drm_sched_entity_select_rq() Greg Kroah-Hartman
` (490 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Dan Carpenter,
Melissa Wen, Maarten Lankhorst, Maxime Ripard, David Airlie,
Simona Vetter, dri-devel, Javier Martinez Canillas, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit 14e02ed3876f4ab0ed6d3f41972175f8b8df3d70 ]
The plane state in __drm_gem_reset_shadow_plane() can be NULL. Do not
deref that pointer, but forward NULL to the other plane-reset helpers.
Clears plane->state to NULL.
v2:
- fix typo in commit description (Javier)
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: b71565022031 ("drm/gem: Export implementation of shadow-plane helpers")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/dri-devel/aPIDAsHIUHp_qSW4@stanley.mountain/
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Melissa Wen <melissa.srw@gmail.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: David Airlie <airlied@gmail.com>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v5.15+
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://patch.msgid.link/20251017091407.58488-1-tzimmermann@suse.de
[ removed drm_format_conv_state_init() call ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_gem_atomic_helper.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/drm_gem_atomic_helper.c
+++ b/drivers/gpu/drm/drm_gem_atomic_helper.c
@@ -330,7 +330,11 @@ EXPORT_SYMBOL(drm_gem_destroy_shadow_pla
void __drm_gem_reset_shadow_plane(struct drm_plane *plane,
struct drm_shadow_plane_state *shadow_plane_state)
{
- __drm_atomic_helper_plane_reset(plane, &shadow_plane_state->base);
+ if (shadow_plane_state) {
+ __drm_atomic_helper_plane_reset(plane, &shadow_plane_state->base);
+ } else {
+ __drm_atomic_helper_plane_reset(plane, NULL);
+ }
}
EXPORT_SYMBOL(__drm_gem_reset_shadow_plane);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 085/568] drm/sched: Fix race in drm_sched_entity_select_rq()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 084/568] drm/sysfb: Do not dereference NULL pointer in plane reset Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 086/568] s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump Greg Kroah-Hartman
` (489 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tvrtko Ursulin, Philipp Stanner,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Stanner <phasta@kernel.org>
[ Upstream commit d25e3a610bae03bffc5c14b5d944a5d0cd844678 ]
In a past bug fix it was forgotten that entity access must be protected
by the entity lock. That's a data race and potentially UB.
Move the spin_unlock() to the appropriate position.
Cc: stable@vger.kernel.org # v5.13+
Fixes: ac4eb83ab255 ("drm/sched: select new rq even if there is only one v3")
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Signed-off-by: Philipp Stanner <phasta@kernel.org>
Link: https://patch.msgid.link/20251022063402.87318-2-phasta@kernel.org
[ adapted lock field name from entity->lock to entity->rq_lock ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/scheduler/sched_entity.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/scheduler/sched_entity.c
+++ b/drivers/gpu/drm/scheduler/sched_entity.c
@@ -471,10 +471,11 @@ void drm_sched_entity_select_rq(struct d
drm_sched_rq_remove_entity(entity->rq, entity);
entity->rq = rq;
}
- spin_unlock(&entity->rq_lock);
if (entity->num_sched_list == 1)
entity->sched_list = NULL;
+
+ spin_unlock(&entity->rq_lock);
}
/**
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 086/568] s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 085/568] drm/sched: Fix race in drm_sched_entity_select_rq() Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 087/568] soc: aspeed: socinfo: Add AST27xx silicon IDs Greg Kroah-Hartman
` (488 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Schnelle, Gerd Bayer,
Heiko Carstens, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerd Bayer <gbayer@linux.ibm.com>
[ Upstream commit 0fd20f65df6aa430454a0deed8f43efa91c54835 ]
Do not block PCI config accesses through pci_cfg_access_lock() when
executing the s390 variant of PCI error recovery: Acquire just
device_lock() instead of pci_dev_lock() as powerpc's EEH and
generig PCI AER processing do.
During error recovery testing a pair of tasks was reported to be hung:
mlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working
INFO: task kmcheck:72 blocked for more than 122 seconds.
Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kmcheck state:D stack:0 pid:72 tgid:72 ppid:2 flags:0x00000000
Call Trace:
[<000000065256f030>] __schedule+0x2a0/0x590
[<000000065256f356>] schedule+0x36/0xe0
[<000000065256f572>] schedule_preempt_disabled+0x22/0x30
[<0000000652570a94>] __mutex_lock.constprop.0+0x484/0x8a8
[<000003ff800673a4>] mlx5_unload_one+0x34/0x58 [mlx5_core]
[<000003ff8006745c>] mlx5_pci_err_detected+0x94/0x140 [mlx5_core]
[<0000000652556c5a>] zpci_event_attempt_error_recovery+0xf2/0x398
[<0000000651b9184a>] __zpci_event_error+0x23a/0x2c0
INFO: task kworker/u1664:6:1514 blocked for more than 122 seconds.
Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u1664:6 state:D stack:0 pid:1514 tgid:1514 ppid:2 flags:0x00000000
Workqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core]
Call Trace:
[<000000065256f030>] __schedule+0x2a0/0x590
[<000000065256f356>] schedule+0x36/0xe0
[<0000000652172e28>] pci_wait_cfg+0x80/0xe8
[<0000000652172f94>] pci_cfg_access_lock+0x74/0x88
[<000003ff800916b6>] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core]
[<000003ff80098824>] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core]
[<000003ff80074b62>] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core]
[<0000000652512242>] devlink_health_do_dump.part.0+0x82/0x168
[<0000000652513212>] devlink_health_report+0x19a/0x230
[<000003ff80075a12>] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core]
No kernel log of the exact same error with an upstream kernel is
available - but the very same deadlock situation can be constructed there,
too:
- task: kmcheck
mlx5_unload_one() tries to acquire devlink lock while the PCI error
recovery code has set pdev->block_cfg_access by way of
pci_cfg_access_lock()
- task: kworker
mlx5_crdump_collect() tries to set block_cfg_access through
pci_cfg_access_lock() while devlink_health_report() had acquired
the devlink lock.
A similar deadlock situation can be reproduced by requesting a
crdump with
> devlink health dump show pci/<BDF> reporter fw_fatal
while PCI error recovery is executed on the same <BDF> physical function
by mlx5_core's pci_error_handlers. On s390 this can be injected with
> zpcictl --reset-fw <BDF>
Tests with this patch failed to reproduce that second deadlock situation,
the devlink command is rejected with "kernel answers: Permission denied" -
and we get a kernel log message of:
mlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5
because the config read of VSC_SEMAPHORE is rejected by the underlying
hardware.
Two prior attempts to address this issue have been discussed and
ultimately rejected [see link], with the primary argument that s390's
implementation of PCI error recovery is imposing restrictions that
neither powerpc's EEH nor PCI AER handling need. Tests show that PCI
error recovery on s390 is running to completion even without blocking
access to PCI config space.
Link: https://lore.kernel.org/all/20251007144826.2825134-1-gbayer@linux.ibm.com/
Cc: stable@vger.kernel.org
Fixes: 4cdf2f4e24ff ("s390/pci: implement minimal PCI error recovery")
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Gerd Bayer <gbayer@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
[ Adjust context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/pci/pci_event.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/s390/pci/pci_event.c
+++ b/arch/s390/pci/pci_event.c
@@ -173,7 +173,7 @@ static pci_ers_result_t zpci_event_attem
* is unbound or probed and that userspace can't access its
* configuration space while we perform recovery.
*/
- pci_dev_lock(pdev);
+ device_lock(&pdev->dev);
if (pdev->error_state == pci_channel_io_perm_failure) {
ers_res = PCI_ERS_RESULT_DISCONNECT;
goto out_unlock;
@@ -221,7 +221,7 @@ static pci_ers_result_t zpci_event_attem
if (driver->err_handler->resume)
driver->err_handler->resume(pdev);
out_unlock:
- pci_dev_unlock(pdev);
+ device_unlock(&pdev->dev);
return ers_res;
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 087/568] soc: aspeed: socinfo: Add AST27xx silicon IDs
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 086/568] s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 088/568] soc: qcom: smem: Fix endian-unaware access of num_entries Greg Kroah-Hartman
` (487 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ryan Chen, Andrew Jeffery,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Chen <ryan_chen@aspeedtech.com>
[ Upstream commit c30dcfd4b5a0f0e3fe7138bf287f6de6b1b00278 ]
Extend the ASPEED SoC info driver to support AST27XX silicon IDs.
Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com>
Link: https://patch.msgid.link/20250807005208.3517283-1-ryan_chen@aspeedtech.com
Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/aspeed/aspeed-socinfo.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/soc/aspeed/aspeed-socinfo.c b/drivers/soc/aspeed/aspeed-socinfo.c
index 3f759121dc00a..67e9ac3d08ecc 100644
--- a/drivers/soc/aspeed/aspeed-socinfo.c
+++ b/drivers/soc/aspeed/aspeed-socinfo.c
@@ -27,6 +27,10 @@ static struct {
{ "AST2620", 0x05010203 },
{ "AST2605", 0x05030103 },
{ "AST2625", 0x05030403 },
+ /* AST2700 */
+ { "AST2750", 0x06000003 },
+ { "AST2700", 0x06000103 },
+ { "AST2720", 0x06000203 },
};
static const char *siliconid_to_name(u32 siliconid)
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 088/568] soc: qcom: smem: Fix endian-unaware access of num_entries
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 087/568] soc: aspeed: socinfo: Add AST27xx silicon IDs Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 089/568] spi: loopback-test: Dont use %pK through printk Greg Kroah-Hartman
` (486 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jens Reidel, Bjorn Andersson,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Reidel <adrian@mainlining.org>
[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
Add a missing le32_to_cpu when accessing num_entries, which is always a
little endian integer.
Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
Signed-off-by: Jens Reidel <adrian@mainlining.org>
Link: https://lore.kernel.org/r/20250726235646.254730-1-adrian@mainlining.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/qcom/smem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c
index af8d90efd91fa..e4e6c6d69bf55 100644
--- a/drivers/soc/qcom/smem.c
+++ b/drivers/soc/qcom/smem.c
@@ -810,7 +810,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)
if (IS_ERR_OR_NULL(ptable))
return SMEM_ITEM_COUNT;
- info = (struct smem_info *)&ptable->entry[ptable->num_entries];
+ info = (struct smem_info *)&ptable->entry[le32_to_cpu(ptable->num_entries)];
if (memcmp(info->magic, SMEM_INFO_MAGIC, sizeof(info->magic)))
return SMEM_ITEM_COUNT;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 089/568] spi: loopback-test: Dont use %pK through printk
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 088/568] soc: qcom: smem: Fix endian-unaware access of num_entries Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 090/568] soc: ti: pruss: dont " Greg Kroah-Hartman
` (485 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh, Mark Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
In the past %pK was preferable to %p as it would not leak raw pointer
values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
the regular %p has been improved to avoid this issue.
Furthermore, restricted pointers ("%pK") were never meant to be used
through printk(). They can still unintentionally leak raw pointers or
acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and
easier to reason about.
There are still a few users of %pK left, but these use it through seq_file,
for which its usage is safe.
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Link: https://patch.msgid.link/20250811-restricted-pointers-spi-v1-1-32c47f954e4d@linutronix.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-loopback-test.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
index ab29ae463f677..c011a67ce2108 100644
--- a/drivers/spi/spi-loopback-test.c
+++ b/drivers/spi/spi-loopback-test.c
@@ -436,7 +436,7 @@ static void spi_test_dump_message(struct spi_device *spi,
int i;
u8 b;
- dev_info(&spi->dev, " spi_msg@%pK\n", msg);
+ dev_info(&spi->dev, " spi_msg@%p\n", msg);
if (msg->status)
dev_info(&spi->dev, " status: %i\n",
msg->status);
@@ -446,15 +446,15 @@ static void spi_test_dump_message(struct spi_device *spi,
msg->actual_length);
list_for_each_entry(xfer, &msg->transfers, transfer_list) {
- dev_info(&spi->dev, " spi_transfer@%pK\n", xfer);
+ dev_info(&spi->dev, " spi_transfer@%p\n", xfer);
dev_info(&spi->dev, " len: %i\n", xfer->len);
- dev_info(&spi->dev, " tx_buf: %pK\n", xfer->tx_buf);
+ dev_info(&spi->dev, " tx_buf: %p\n", xfer->tx_buf);
if (dump_data && xfer->tx_buf)
spi_test_print_hex_dump(" TX: ",
xfer->tx_buf,
xfer->len);
- dev_info(&spi->dev, " rx_buf: %pK\n", xfer->rx_buf);
+ dev_info(&spi->dev, " rx_buf: %p\n", xfer->rx_buf);
if (dump_data && xfer->rx_buf)
spi_test_print_hex_dump(" RX: ",
xfer->rx_buf,
@@ -548,7 +548,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,
/* if still not found then something has modified too much */
/* we could list the "closest" transfer here... */
dev_err(&spi->dev,
- "loopback strangeness - rx changed outside of allowed range at: %pK\n",
+ "loopback strangeness - rx changed outside of allowed range at: %p\n",
addr);
/* do not return, only set ret,
* so that we list all addresses
@@ -686,7 +686,7 @@ static int spi_test_translate(struct spi_device *spi,
}
dev_err(&spi->dev,
- "PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n",
+ "PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n",
*ptr, *ptr + len,
RX(0), RX(SPI_TEST_MAX_SIZE),
TX(0), TX(SPI_TEST_MAX_SIZE));
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 090/568] soc: ti: pruss: dont use %pK through printk
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 089/568] spi: loopback-test: Dont use %pK through printk Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 091/568] bpf: Dont " Greg Kroah-Hartman
` (484 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh,
Nishanth Menon, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit a5039648f86424885aae37f03dc39bc9cb972ecb ]
In the past %pK was preferable to %p as it would not leak raw pointer
values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
the regular %p has been improved to avoid this issue.
Furthermore, restricted pointers ("%pK") were never meant to be used
through printk(). They can still unintentionally leak raw pointers or
acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and
easier to reason about.
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Link: https://lore.kernel.org/r/20250811-restricted-pointers-soc-v2-1-7af7ed993546@linutronix.de
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/ti/pruss.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/soc/ti/pruss.c b/drivers/soc/ti/pruss.c
index 6882c86b3ce54..dd5d4675d26f4 100644
--- a/drivers/soc/ti/pruss.c
+++ b/drivers/soc/ti/pruss.c
@@ -270,7 +270,7 @@ static int pruss_probe(struct platform_device *pdev)
pruss->mem_regions[i].pa = res.start;
pruss->mem_regions[i].size = resource_size(&res);
- dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %pK\n",
+ dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %p\n",
mem_names[i], &pruss->mem_regions[i].pa,
pruss->mem_regions[i].size, pruss->mem_regions[i].va);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 091/568] bpf: Dont use %pK through printk
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 090/568] soc: ti: pruss: dont " Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 092/568] pinctrl: single: fix bias pull up/down handling in pin_config_set Greg Kroah-Hartman
` (483 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh,
Andrii Nakryiko, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
In the past %pK was preferable to %p as it would not leak raw pointer
values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
the regular %p has been improved to avoid this issue.
Furthermore, restricted pointers ("%pK") were never meant to be used
through printk(). They can still unintentionally leak raw pointers or
acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and
easier to reason about.
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20250811-restricted-pointers-bpf-v1-1-a1d7cc3cb9e7@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/filter.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/filter.h b/include/linux/filter.h
index f3ef1a8965bb2..bbdae97d50c42 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -1082,7 +1082,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);
static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
u32 pass, void *image)
{
- pr_err("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n", flen,
+ pr_err("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n", flen,
proglen, pass, image, current->comm, task_pid_nr(current));
if (image)
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 092/568] pinctrl: single: fix bias pull up/down handling in pin_config_set
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 091/568] bpf: Dont " Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 093/568] mmc: host: renesas_sdhi: Fix the actual clock Greg Kroah-Hartman
` (482 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chi Zhang, Linus Walleij,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chi Zhang <chizhang@asrmicro.com>
[ Upstream commit 236152dd9b1675a35eee912e79e6c57ca6b6732f ]
In the pin_config_set function, when handling PIN_CONFIG_BIAS_PULL_DOWN or
PIN_CONFIG_BIAS_PULL_UP, the function calls pcs_pinconf_clear_bias()
which writes the register. However, the subsequent operations continue
using the stale 'data' value from before the register write, effectively
causing the bias clear operation to be overwritten and not take effect.
Fix this by reading the 'data' value from the register after calling
pcs_pinconf_clear_bias().
This bug seems to have existed when this code was first merged in commit
9dddb4df90d1 ("pinctrl: single: support generic pinconf").
Signed-off-by: Chi Zhang <chizhang@asrmicro.com>
Link: https://lore.kernel.org/20250807062038.13610-1-chizhang@asrmicro.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/pinctrl-single.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index 28f3fabc72e30..a72911e8ea82d 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -588,8 +588,10 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev,
break;
case PIN_CONFIG_BIAS_PULL_DOWN:
case PIN_CONFIG_BIAS_PULL_UP:
- if (arg)
+ if (arg) {
pcs_pinconf_clear_bias(pctldev, pin);
+ data = pcs->read(pcs->base + offset);
+ }
fallthrough;
case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
data &= ~func->conf[i].mask;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 093/568] mmc: host: renesas_sdhi: Fix the actual clock
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 092/568] pinctrl: single: fix bias pull up/down handling in pin_config_set Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 094/568] memstick: Add timeout to prevent indefinite waiting Greg Kroah-Hartman
` (481 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Biju Das, Ulf Hansson, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <biju.das.jz@bp.renesas.com>
[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
Wrong actual clock reported, if the SD clock division ratio is other
than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
On high speed mode, cat /sys/kernel/debug/mmc1/ios
Without the patch:
clock: 50000000 Hz
actual clock: 200000000 Hz
After the fix:
clock: 50000000 Hz
actual clock: 50000000 Hz
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://lore.kernel.org/r/20250629203859.170850-1-biju.das.jz@bp.renesas.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/renesas_sdhi_core.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
index d0a15645a0b8f..37c81cc076553 100644
--- a/drivers/mmc/host/renesas_sdhi_core.c
+++ b/drivers/mmc/host/renesas_sdhi_core.c
@@ -220,7 +220,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host,
clk &= ~0xff;
}
- sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & CLK_CTL_DIV_MASK);
+ clock = clk & CLK_CTL_DIV_MASK;
+ if (clock != 0xff)
+ host->mmc->actual_clock /= (1 << (ffs(clock) + 1));
+
+ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clock);
if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
usleep_range(10000, 11000);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 094/568] memstick: Add timeout to prevent indefinite waiting
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 093/568] mmc: host: renesas_sdhi: Fix the actual clock Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 095/568] irqchip/sifive-plic: Respect mask state when setting affinity Greg Kroah-Hartman
` (480 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiayi Li, Ulf Hansson, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayi Li <lijiayi@kylinos.cn>
[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
Add timeout handling to wait_for_completion calls in memstick_set_rw_addr()
and memstick_alloc_card() to prevent indefinite blocking in case of
hardware or communication failures.
Signed-off-by: Jiayi Li <lijiayi@kylinos.cn>
Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memstick/core/memstick.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
index 9a2acf5c40143..fc9e6db3bb72b 100644
--- a/drivers/memstick/core/memstick.c
+++ b/drivers/memstick/core/memstick.c
@@ -367,7 +367,9 @@ int memstick_set_rw_addr(struct memstick_dev *card)
{
card->next_request = h_memstick_set_rw_addr;
memstick_new_req(card->host);
- wait_for_completion(&card->mrq_complete);
+ if (!wait_for_completion_timeout(&card->mrq_complete,
+ msecs_to_jiffies(500)))
+ card->current_mrq.error = -ETIMEDOUT;
return card->current_mrq.error;
}
@@ -401,7 +403,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host)
card->next_request = h_memstick_read_dev_id;
memstick_new_req(host);
- wait_for_completion(&card->mrq_complete);
+ if (!wait_for_completion_timeout(&card->mrq_complete,
+ msecs_to_jiffies(500)))
+ card->current_mrq.error = -ETIMEDOUT;
if (card->current_mrq.error)
goto err_out;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 095/568] irqchip/sifive-plic: Respect mask state when setting affinity
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 094/568] memstick: Add timeout to prevent indefinite waiting Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 096/568] selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 Greg Kroah-Hartman
` (479 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Gleixner, Inochi Amaoto,
Nam Cao, Chen Wang, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Inochi Amaoto <inochiama@gmail.com>
[ Upstream commit adecf78df945f4c7a1d29111b0002827f487df51 ]
plic_set_affinity() always calls plic_irq_enable(), which clears up the
priority setting even the interrupt is only masked. This unmasks the
interrupt unexpectly.
Replace the plic_irq_enable/disable() with plic_irq_toggle() to avoid
changing the priority setting.
Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Nam Cao <namcao@linutronix.de> # VisionFive 2
Tested-by: Chen Wang <unicorn_wang@outlook.com> # Pioneerbox
Reviewed-by: Nam Cao <namcao@linutronix.de>
Reviewed-by: Chen Wang <unicorn_wang@outlook.com>
Link: https://lore.kernel.org/all/20250811002633.55275-1-inochiama@gmail.com
Link: https://lore.kernel.org/lkml/20250722224513.22125-1-inochiama@gmail.com/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-sifive-plic.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c
index 164c3e71ea70c..36de764ee2b61 100644
--- a/drivers/irqchip/irq-sifive-plic.c
+++ b/drivers/irqchip/irq-sifive-plic.c
@@ -172,12 +172,14 @@ static int plic_set_affinity(struct irq_data *d,
if (cpu >= nr_cpu_ids)
return -EINVAL;
- plic_irq_disable(d);
+ /* Invalidate the original routing entry */
+ plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 0);
irq_data_update_effective_affinity(d, cpumask_of(cpu));
+ /* Setting the new routing entry if irq is enabled */
if (!irqd_irq_disabled(d))
- plic_irq_enable(d);
+ plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 1);
return IRQ_SET_MASK_OK_DONE;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 096/568] selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 095/568] irqchip/sifive-plic: Respect mask state when setting affinity Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 097/568] cpufreq/longhaul: handle NULL policy in longhaul_exit Greg Kroah-Hartman
` (478 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo B . Marlière,
Andrii Nakryiko, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <rbm@suse.com>
[ Upstream commit 98857d111c53954aa038fcbc4cf48873e4240f7c ]
Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level
APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt
the usage in test_lirc_mode2_user.c.
Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-v1-1-c7811cd8b98c@suse.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/test_lirc_mode2_user.c b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
index 4694422aa76c3..88e4aeab21b7b 100644
--- a/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+++ b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
@@ -74,7 +74,7 @@ int main(int argc, char **argv)
/* Let's try detach it before it was ever attached */
ret = bpf_prog_detach2(progfd, lircfd, BPF_LIRC_MODE2);
- if (ret != -1 || errno != ENOENT) {
+ if (ret != -ENOENT) {
printf("bpf_prog_detach2 not attached should fail: %m\n");
return 1;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 097/568] cpufreq/longhaul: handle NULL policy in longhaul_exit
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 096/568] selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 098/568] arc: Fix __fls() const-foldability via __builtin_clzl() Greg Kroah-Hartman
` (477 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dennis Beier, Viresh Kumar,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Beier <nanovim@gmail.com>
[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
longhaul_exit() was calling cpufreq_cpu_get(0) without checking
for a NULL policy pointer. On some systems, this could lead to a
NULL dereference and a kernel warning or panic.
This patch adds a check using unlikely() and returns early if the
policy is NULL.
Bugzilla: #219962
Signed-off-by: Dennis Beier <nanovim@gmail.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/longhaul.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
index 3e000e1a75c6c..9b6ec68753dde 100644
--- a/drivers/cpufreq/longhaul.c
+++ b/drivers/cpufreq/longhaul.c
@@ -953,6 +953,9 @@ static void __exit longhaul_exit(void)
struct cpufreq_policy *policy = cpufreq_cpu_get(0);
int i;
+ if (unlikely(!policy))
+ return;
+
for (i = 0; i < numscales; i++) {
if (mults[i] == maxmult) {
struct cpufreq_freqs freqs;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 098/568] arc: Fix __fls() const-foldability via __builtin_clzl()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 097/568] cpufreq/longhaul: handle NULL policy in longhaul_exit Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 099/568] selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh Greg Kroah-Hartman
` (476 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Kees Cook,
Vineet Gupta, Yury Norov (NVIDIA), Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <kees@kernel.org>
[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
While tracking down a problem where constant expressions used by
BUILD_BUG_ON() suddenly stopped working[1], we found that an added static
initializer was convincing the compiler that it couldn't track the state
of the prior statically initialized value. Tracing this down found that
ffs() was used in the initializer macro, but since it wasn't marked with
__attribute__const__, the compiler had to assume the function might
change variable states as a side-effect (which is not true for ffs(),
which provides deterministic math results).
For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function
uses __builtin_arc_fls() which lacks GCC's const attribute, preventing
compile-time constant folding, and KUnit testing of ffs/fls fails on
arc[3]. A patch[2] to GCC to solve this has been sent.
Add a fix for this by handling compile-time constants with the standard
__builtin_clzl() builtin (which has const attribute) while preserving
the optimized arc-specific builtin for runtime cases. This has the added
benefit of skipping runtime calculation of compile-time constant values.
Even with the GCC bug fixed (which is about "attribute const") this is a
good change to avoid needless runtime costs, and should be done
regardless of the state of GCC's bug.
Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
Link: https://github.com/KSPP/linux/issues/364 [1]
Link: https://gcc.gnu.org/pipermail/gcc-patches/2025-August/693273.html
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202508031025.doWxtzzc-lkp@intel.com/ [3]
Signed-off-by: Kees Cook <kees@kernel.org>
Acked-by: Vineet Gupta <vgupta@kernel.org>
Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arc/include/asm/bitops.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
index f5a936496f060..24981bba974d3 100644
--- a/arch/arc/include/asm/bitops.h
+++ b/arch/arc/include/asm/bitops.h
@@ -133,6 +133,8 @@ static inline __attribute__ ((const)) int fls(unsigned int x)
*/
static inline __attribute__ ((const)) unsigned long __fls(unsigned long x)
{
+ if (__builtin_constant_p(x))
+ return x ? BITS_PER_LONG - 1 - __builtin_clzl(x) : 0;
/* FLS insn has exactly same semantics as the API */
return __builtin_arc_fls(x);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 099/568] selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 098/568] arc: Fix __fls() const-foldability via __builtin_clzl() Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 100/568] irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment Greg Kroah-Hartman
` (475 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo B . Marlière,
Andrii Nakryiko, Magnus Karlsson, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <rbm@suse.com>
[ Upstream commit 2a912258c90e895363c0ffc0be8a47f112ab67b7 ]
Currently, even if some subtests fails, the end result will still yield
"ok 1 selftests: bpf: test_xsk.sh". Fix it by exiting with 1 if there are
any failures.
Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-test_xsk_ret-v1-1-e6656c01f397@suse.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/test_xsk.sh | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/testing/selftests/bpf/test_xsk.sh b/tools/testing/selftests/bpf/test_xsk.sh
index 4e3ec38cbe68c..09788b847e89b 100755
--- a/tools/testing/selftests/bpf/test_xsk.sh
+++ b/tools/testing/selftests/bpf/test_xsk.sh
@@ -206,4 +206,6 @@ done
if [ $failures -eq 0 ]; then
echo "All tests successful!"
+else
+ exit 1
fi
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 100/568] irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 099/568] selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 101/568] ACPI: PRM: Skip handlers with NULL handler_address or NULL VA Greg Kroah-Hartman
` (474 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Bruel, Thomas Gleixner,
Marc Zyngier, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Bruel <christian.bruel@foss.st.com>
[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the
low-order bits of the MSI Message DATA register to encode nr_irqs interrupt
numbers in the log2(nr_irqs) bits for the domain.
The problem arises if the base vector (GICV2m base spi) is not aligned with
nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base
vector conflict with the nr_irqs masking, causing the wrong MSI interrupt
to be identified.
To fix this, use bitmap_find_next_zero_area_off() instead of
bitmap_find_free_region() to align the initial base vector with nr_irqs.
Signed-off-by: Christian Bruel <christian.bruel@foss.st.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/all/20250902091045.220847-1-christian.bruel@foss.st.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-gic-v2m.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
index c04f2481068bb..8aa28dfea6342 100644
--- a/drivers/irqchip/irq-gic-v2m.c
+++ b/drivers/irqchip/irq-gic-v2m.c
@@ -178,14 +178,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
{
msi_alloc_info_t *info = args;
struct v2m_data *v2m = NULL, *tmp;
- int hwirq, offset, i, err = 0;
+ int hwirq, i, err = 0;
+ unsigned long offset;
+ unsigned long align_mask = nr_irqs - 1;
spin_lock(&v2m_lock);
list_for_each_entry(tmp, &v2m_nodes, entry) {
- offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis,
- get_count_order(nr_irqs));
- if (offset >= 0) {
+ unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask);
+
+ offset = bitmap_find_next_zero_area_off(tmp->bm, tmp->nr_spis, 0,
+ nr_irqs, align_mask, align_off);
+ if (offset < tmp->nr_spis) {
v2m = tmp;
+ bitmap_set(v2m->bm, offset, nr_irqs);
break;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 101/568] ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 100/568] irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 102/568] ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] Greg Kroah-Hartman
` (473 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shang song (Lenovo),
Rafael J. Wysocki, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shang song (Lenovo) <shangsong2@foxmail.com>
[ Upstream commit 311942ce763e21dacef7e53996d5a1e19b8adab1 ]
If handler_address or mapped VA is NULL, the related buffer address and
VA can be ignored, so make acpi_parse_prmt() skip the current handler
in those cases.
Signed-off-by: Shang song (Lenovo) <shangsong2@foxmail.com>
Link: https://patch.msgid.link/20250826030229.834901-1-shangsong2@foxmail.com
[ rjw: Subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/prmt.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/drivers/acpi/prmt.c b/drivers/acpi/prmt.c
index 215ca8d60616f..22225bcda6f4c 100644
--- a/drivers/acpi/prmt.c
+++ b/drivers/acpi/prmt.c
@@ -150,15 +150,28 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
th = &tm->handlers[cur_handler];
guid_copy(&th->guid, (guid_t *)handler_info->handler_guid);
+
+ /*
+ * Print an error message if handler_address is NULL, the parse of VA also
+ * can be skipped.
+ */
+ if (unlikely(!handler_info->handler_address)) {
+ pr_info("Skipping handler with NULL address for GUID: %pUL",
+ (guid_t *)handler_info->handler_guid);
+ continue;
+ }
+
th->handler_addr =
(void *)efi_pa_va_lookup(&th->guid, handler_info->handler_address);
/*
- * Print a warning message if handler_addr is zero which is not expected to
- * ever happen.
+ * Print a warning message and skip the parse of VA if handler_addr is zero
+ * which is not expected to ever happen.
*/
- if (unlikely(!th->handler_addr))
+ if (unlikely(!th->handler_addr)) {
pr_warn("Failed to find VA of handler for GUID: %pUL, PA: 0x%llx",
&th->guid, handler_info->handler_address);
+ continue;
+ }
th->static_data_buffer_addr =
efi_pa_va_lookup(&th->guid, handler_info->static_data_buffer_address);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 102/568] ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 101/568] ACPI: PRM: Skip handlers with NULL handler_address or NULL VA Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 103/568] hwmon: (sbtsi_temp) AMD CPU extended temperature range support Greg Kroah-Hartman
` (472 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Rafael J. Wysocki,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hansg@kernel.org>
[ Upstream commit 4405a214df146775338a1e6232701a29024b82e1 ]
Some x86/ACPI laptops with MIPI cameras have a INTC10DE or INTC10E0 ACPI
device in the _DEP dependency list of the ACPI devices for the camera-
sensors (which have flags.honor_deps set).
These devices are for an Intel Vision CVS chip for which an out of tree
driver is available [1].
The camera sensor works fine without a driver being loaded for this
ACPI device on the 2 laptops this was tested on:
ThinkPad X1 Carbon Gen 12 (Meteor Lake)
ThinkPad X1 2-in-1 Gen 10 (Arrow Lake)
For now add these HIDs to acpi_ignore_dep_ids[] so that
acpi_dev_ready_for_enumeration() will return true once the other _DEP
dependencies are met and an i2c_client for the camera sensor will get
instantiated.
Link: https://github.com/intel/vision-drivers/ [1]
Signed-off-by: Hans de Goede <hansg@kernel.org>
Link: https://patch.msgid.link/20250829142748.21089-1-hansg@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/scan.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 293cdf486fd81..9e8f38e525893 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -785,6 +785,8 @@ static bool acpi_info_matches_ids(struct acpi_device_info *info,
static const char * const acpi_ignore_dep_ids[] = {
"PNP0D80", /* Windows-compatible System Power Management Controller */
"INT33BD", /* Intel Baytrail Mailbox Device */
+ "INTC10DE", /* Intel CVS LNL */
+ "INTC10E0", /* Intel CVS ARL */
"LATT2021", /* Lattice FW Update Client Driver */
NULL
};
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 103/568] hwmon: (sbtsi_temp) AMD CPU extended temperature range support
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 102/568] ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 104/568] power: supply: sbs-charger: Support multiple devices Greg Kroah-Hartman
` (471 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuande Chen, Guenter Roeck,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuande Chen <chuachen@cisco.com>
[ Upstream commit d9d61f1da35038793156c04bb13f0a1350709121 ]
Many AMD CPUs can support this feature now. We would get a wrong CPU DIE
temperature if don't consider this. In low-temperature environments,
the CPU die temperature can drop below zero. So many platforms would like
to make extended temperature range as their default configuration.
Default temperature range (0C to 255.875C).
Extended temperature range (-49C to +206.875C).
Ref Doc: AMD V3000 PPR (Doc ID #56558).
Signed-off-by: Chuande Chen <chuachen@cisco.com>
Link: https://lore.kernel.org/r/20250814053940.96764-1-chenchuande@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/sbtsi_temp.c | 46 +++++++++++++++++++++++++-------------
1 file changed, 31 insertions(+), 15 deletions(-)
diff --git a/drivers/hwmon/sbtsi_temp.c b/drivers/hwmon/sbtsi_temp.c
index e35357c48b8e6..b2ef2ada4bfe2 100644
--- a/drivers/hwmon/sbtsi_temp.c
+++ b/drivers/hwmon/sbtsi_temp.c
@@ -15,6 +15,7 @@
#include <linux/mutex.h>
#include <linux/of_device.h>
#include <linux/of.h>
+#include <linux/bitfield.h>
/*
* SB-TSI registers only support SMBus byte data access. "_INT" registers are
@@ -30,8 +31,22 @@
#define SBTSI_REG_TEMP_HIGH_DEC 0x13 /* RW */
#define SBTSI_REG_TEMP_LOW_DEC 0x14 /* RW */
+/*
+ * Bit for reporting value with temperature measurement range.
+ * bit == 0: Use default temperature range (0C to 255.875C).
+ * bit == 1: Use extended temperature range (-49C to +206.875C).
+ */
+#define SBTSI_CONFIG_EXT_RANGE_SHIFT 2
+/*
+ * ReadOrder bit specifies the reading order of integer and decimal part of
+ * CPU temperature for atomic reads. If bit == 0, reading integer part triggers
+ * latching of the decimal part, so integer part should be read first.
+ * If bit == 1, read order should be reversed.
+ */
#define SBTSI_CONFIG_READ_ORDER_SHIFT 5
+#define SBTSI_TEMP_EXT_RANGE_ADJ 49000
+
#define SBTSI_TEMP_MIN 0
#define SBTSI_TEMP_MAX 255875
@@ -39,6 +54,8 @@
struct sbtsi_data {
struct i2c_client *client;
struct mutex lock;
+ bool ext_range_mode;
+ bool read_order;
};
/*
@@ -75,23 +92,11 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
{
struct sbtsi_data *data = dev_get_drvdata(dev);
s32 temp_int, temp_dec;
- int err;
switch (attr) {
case hwmon_temp_input:
- /*
- * ReadOrder bit specifies the reading order of integer and
- * decimal part of CPU temp for atomic reads. If bit == 0,
- * reading integer part triggers latching of the decimal part,
- * so integer part should be read first. If bit == 1, read
- * order should be reversed.
- */
- err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
- if (err < 0)
- return err;
-
mutex_lock(&data->lock);
- if (err & BIT(SBTSI_CONFIG_READ_ORDER_SHIFT)) {
+ if (data->read_order) {
temp_dec = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_DEC);
temp_int = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_INT);
} else {
@@ -123,6 +128,8 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
return temp_dec;
*val = sbtsi_reg_to_mc(temp_int, temp_dec);
+ if (data->ext_range_mode)
+ *val -= SBTSI_TEMP_EXT_RANGE_ADJ;
return 0;
}
@@ -147,6 +154,8 @@ static int sbtsi_write(struct device *dev, enum hwmon_sensor_types type,
return -EINVAL;
}
+ if (data->ext_range_mode)
+ val += SBTSI_TEMP_EXT_RANGE_ADJ;
val = clamp_val(val, SBTSI_TEMP_MIN, SBTSI_TEMP_MAX);
sbtsi_mc_to_reg(val, &temp_int, &temp_dec);
@@ -205,6 +214,7 @@ static int sbtsi_probe(struct i2c_client *client,
struct device *dev = &client->dev;
struct device *hwmon_dev;
struct sbtsi_data *data;
+ int err;
data = devm_kzalloc(dev, sizeof(struct sbtsi_data), GFP_KERNEL);
if (!data)
@@ -213,8 +223,14 @@ static int sbtsi_probe(struct i2c_client *client,
data->client = client;
mutex_init(&data->lock);
- hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data, &sbtsi_chip_info,
- NULL);
+ err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
+ if (err < 0)
+ return err;
+ data->ext_range_mode = FIELD_GET(BIT(SBTSI_CONFIG_EXT_RANGE_SHIFT), err);
+ data->read_order = FIELD_GET(BIT(SBTSI_CONFIG_READ_ORDER_SHIFT), err);
+
+ hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data,
+ &sbtsi_chip_info, NULL);
return PTR_ERR_OR_ZERO(hwmon_dev);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 104/568] power: supply: sbs-charger: Support multiple devices
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 103/568] hwmon: (sbtsi_temp) AMD CPU extended temperature range support Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 105/568] hwmon: sy7636a: add alias Greg Kroah-Hartman
` (470 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fabien Proriol, Sebastian Reichel,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabien Proriol <fabien.proriol@viavisolutions.com>
[ Upstream commit 3ec600210849cf122606e24caab85f0b936cf63c ]
If we have 2 instances of sbs-charger in the DTS, the driver probe for the second instance will fail:
[ 8.012874] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
[ 8.039094] sbs-charger 18-0009: ltc4100: smart charger device registered
[ 8.112911] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
[ 8.134533] sysfs: cannot create duplicate filename '/class/power_supply/sbs-charger'
[ 8.143871] CPU: 3 PID: 295 Comm: systemd-udevd Tainted: G O 5.10.147 #22
[ 8.151974] Hardware name: ALE AMB (DT)
[ 8.155828] Call trace:
[ 8.158292] dump_backtrace+0x0/0x1d4
[ 8.161960] show_stack+0x18/0x6c
[ 8.165280] dump_stack+0xcc/0x128
[ 8.168687] sysfs_warn_dup+0x60/0x7c
[ 8.172353] sysfs_do_create_link_sd+0xf0/0x100
[ 8.176886] sysfs_create_link+0x20/0x40
[ 8.180816] device_add+0x270/0x7a4
[ 8.184311] __power_supply_register+0x304/0x560
[ 8.188930] devm_power_supply_register+0x54/0xa0
[ 8.193644] sbs_probe+0xc0/0x214 [sbs_charger]
[ 8.198183] i2c_device_probe+0x2dc/0x2f4
[ 8.202196] really_probe+0xf0/0x510
[ 8.205774] driver_probe_device+0xfc/0x160
[ 8.209960] device_driver_attach+0xc0/0xcc
[ 8.214146] __driver_attach+0xc0/0x170
[ 8.218002] bus_for_each_dev+0x74/0xd4
[ 8.221862] driver_attach+0x24/0x30
[ 8.225444] bus_add_driver+0x148/0x250
[ 8.229283] driver_register+0x78/0x130
[ 8.233140] i2c_register_driver+0x4c/0xe0
[ 8.237250] sbs_driver_init+0x20/0x1000 [sbs_charger]
[ 8.242424] do_one_initcall+0x50/0x1b0
[ 8.242434] do_init_module+0x44/0x230
[ 8.242438] load_module+0x2200/0x27c0
[ 8.242442] __do_sys_finit_module+0xa8/0x11c
[ 8.242447] __arm64_sys_finit_module+0x20/0x30
[ 8.242457] el0_svc_common.constprop.0+0x64/0x154
[ 8.242464] do_el0_svc+0x24/0x8c
[ 8.242474] el0_svc+0x10/0x20
[ 8.242481] el0_sync_handler+0x108/0x114
[ 8.242485] el0_sync+0x180/0x1c0
[ 8.243847] sbs-charger 20-0009: Failed to register power supply
[ 8.287934] sbs-charger: probe of 20-0009 failed with error -17
This is mainly because the "name" field of power_supply_desc is a constant.
This patch fixes the issue by reusing the same approach as sbs-battery.
With this patch, the result is:
[ 7.819532] sbs-charger 18-0009: ltc4100: smart charger device registered
[ 7.825305] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
[ 7.887423] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
[ 7.893501] sbs-charger 20-0009: ltc4100: smart charger device registered
Signed-off-by: Fabien Proriol <fabien.proriol@viavisolutions.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/sbs-charger.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/drivers/power/supply/sbs-charger.c b/drivers/power/supply/sbs-charger.c
index bc927c0ddd343..7dfed22fbce3b 100644
--- a/drivers/power/supply/sbs-charger.c
+++ b/drivers/power/supply/sbs-charger.c
@@ -154,8 +154,7 @@ static const struct regmap_config sbs_regmap = {
.val_format_endian = REGMAP_ENDIAN_LITTLE, /* since based on SMBus */
};
-static const struct power_supply_desc sbs_desc = {
- .name = "sbs-charger",
+static const struct power_supply_desc sbs_default_desc = {
.type = POWER_SUPPLY_TYPE_MAINS,
.properties = sbs_properties,
.num_properties = ARRAY_SIZE(sbs_properties),
@@ -166,9 +165,20 @@ static int sbs_probe(struct i2c_client *client,
const struct i2c_device_id *id)
{
struct power_supply_config psy_cfg = {};
+ struct power_supply_desc *sbs_desc;
struct sbs_info *chip;
int ret, val;
+ sbs_desc = devm_kmemdup(&client->dev, &sbs_default_desc,
+ sizeof(*sbs_desc), GFP_KERNEL);
+ if (!sbs_desc)
+ return -ENOMEM;
+
+ sbs_desc->name = devm_kasprintf(&client->dev, GFP_KERNEL, "sbs-%s",
+ dev_name(&client->dev));
+ if (!sbs_desc->name)
+ return -ENOMEM;
+
chip = devm_kzalloc(&client->dev, sizeof(struct sbs_info), GFP_KERNEL);
if (!chip)
return -ENOMEM;
@@ -192,7 +202,7 @@ static int sbs_probe(struct i2c_client *client,
return dev_err_probe(&client->dev, ret, "Failed to get device status\n");
chip->last_state = val;
- chip->power_supply = devm_power_supply_register(&client->dev, &sbs_desc, &psy_cfg);
+ chip->power_supply = devm_power_supply_register(&client->dev, sbs_desc, &psy_cfg);
if (IS_ERR(chip->power_supply))
return dev_err_probe(&client->dev, PTR_ERR(chip->power_supply),
"Failed to register power supply\n");
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 105/568] hwmon: sy7636a: add alias
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 104/568] power: supply: sbs-charger: Support multiple devices Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 106/568] irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller Greg Kroah-Hartman
` (469 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Kemnade, Guenter Roeck,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Kemnade <andreas@kemnade.info>
[ Upstream commit 80038a758b7fc0cdb6987532cbbf3f75b13e0826 ]
Add module alias to have it autoloaded.
Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
Link: https://lore.kernel.org/r/20250909080249.30656-1-andreas@kemnade.info
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/sy7636a-hwmon.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hwmon/sy7636a-hwmon.c b/drivers/hwmon/sy7636a-hwmon.c
index 6dd9c2a0f0e03..9fabd60e9a970 100644
--- a/drivers/hwmon/sy7636a-hwmon.c
+++ b/drivers/hwmon/sy7636a-hwmon.c
@@ -104,3 +104,4 @@ module_platform_driver(sy7636a_sensor_driver);
MODULE_DESCRIPTION("SY7636A sensor driver");
MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:sy7636a-temperature");
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 106/568] irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 105/568] hwmon: sy7636a: add alias Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 107/568] soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups Greg Kroah-Hartman
` (468 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ming Wang, Thomas Gleixner,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Wang <wangming01@loongson.cn>
[ Upstream commit c33c43f71bda362b292a6e57ac41b64342dc87b3 ]
On certain Loongson platforms, drivers attempting to request a legacy
ISA IRQ directly via request_irq() (e.g., IRQ 4) may fail. The
virtual IRQ descriptor is not fully initialized and lacks a valid irqchip.
This issue does not affect ACPI-enumerated devices described in DSDT,
as their interrupts are properly mapped via the GSI translation path.
This indicates the LPC irqdomain itself is functional but is not correctly
handling direct VIRQ-to-HWIRQ mappings.
The root cause is the use of irq_domain_create_linear(). This API sets
up a domain for dynamic, on-demand mapping, typically triggered by a GSI
request. It does not pre-populate the mappings for the legacy VIRQ range
(0-15). Consequently, if no ACPI device claims a specific GSI
(e.g., GSI 4), the corresponding VIRQ (e.g., VIRQ 4) is never mapped to
the LPC domain. A direct call to request_irq(4, ...) then fails because
the kernel cannot resolve this VIRQ to a hardware interrupt managed by
the LPC controller.
The PCH-LPC interrupt controller is an i8259-compatible legacy device
that requires a deterministic, static 1-to-1 mapping for IRQs 0-15 to
support legacy drivers.
Fix this by replacing irq_domain_create_linear() with
irq_domain_create_legacy(). This API is specifically designed for such
controllers. It establishes the required static 1-to-1 VIRQ-to-HWIRQ
mapping for the entire legacy range (0-15) immediately upon domain
creation. This ensures that any VIRQ in this range is always resolvable,
making direct calls to request_irq() for legacy IRQs function correctly.
Signed-off-by: Ming Wang <wangming01@loongson.cn>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-loongson-pch-lpc.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/irqchip/irq-loongson-pch-lpc.c b/drivers/irqchip/irq-loongson-pch-lpc.c
index bf2324910a75c..c11c645cce525 100644
--- a/drivers/irqchip/irq-loongson-pch-lpc.c
+++ b/drivers/irqchip/irq-loongson-pch-lpc.c
@@ -176,8 +176,13 @@ int __init pch_lpc_acpi_init(struct irq_domain *parent,
goto iounmap_base;
}
- priv->lpc_domain = irq_domain_create_linear(irq_handle, LPC_COUNT,
- &pch_lpc_domain_ops, priv);
+ /*
+ * The LPC interrupt controller is a legacy i8259-compatible device,
+ * which requires a static 1:1 mapping for IRQs 0-15.
+ * Use irq_domain_create_legacy to establish this static mapping early.
+ */
+ priv->lpc_domain = irq_domain_create_legacy(irq_handle, LPC_COUNT, 0, 0,
+ &pch_lpc_domain_ops, priv);
if (!priv->lpc_domain) {
pr_err("Failed to create IRQ domain\n");
goto free_irq_handle;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 107/568] soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 106/568] irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 108/568] mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card Greg Kroah-Hartman
` (467 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Svyatoslav Ryhel, Mikko Perttunen,
Thierry Reding, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Svyatoslav Ryhel <clamor95@gmail.com>
[ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
Add missing Tegra114 nvmem cells and fuse lookups which were added for
Tegra124+ but omitted for Tegra114.
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++++++++++++++++++++++
1 file changed, 122 insertions(+)
diff --git a/drivers/soc/tegra/fuse/fuse-tegra30.c b/drivers/soc/tegra/fuse/fuse-tegra30.c
index f01d8a2547b6d..01f212057ee34 100644
--- a/drivers/soc/tegra/fuse/fuse-tegra30.c
+++ b/drivers/soc/tegra/fuse/fuse-tegra30.c
@@ -117,6 +117,124 @@ const struct tegra_fuse_soc tegra30_fuse_soc = {
#endif
#ifdef CONFIG_ARCH_TEGRA_114_SOC
+static const struct nvmem_cell_info tegra114_fuse_cells[] = {
+ {
+ .name = "tsensor-cpu1",
+ .offset = 0x084,
+ .bytes = 4,
+ .bit_offset = 0,
+ .nbits = 32,
+ }, {
+ .name = "tsensor-cpu2",
+ .offset = 0x088,
+ .bytes = 4,
+ .bit_offset = 0,
+ .nbits = 32,
+ }, {
+ .name = "tsensor-common",
+ .offset = 0x08c,
+ .bytes = 4,
+ .bit_offset = 0,
+ .nbits = 32,
+ }, {
+ .name = "tsensor-cpu0",
+ .offset = 0x098,
+ .bytes = 4,
+ .bit_offset = 0,
+ .nbits = 32,
+ }, {
+ .name = "xusb-pad-calibration",
+ .offset = 0x0f0,
+ .bytes = 4,
+ .bit_offset = 0,
+ .nbits = 32,
+ }, {
+ .name = "tsensor-cpu3",
+ .offset = 0x12c,
+ .bytes = 4,
+ .bit_offset = 0,
+ .nbits = 32,
+ }, {
+ .name = "tsensor-gpu",
+ .offset = 0x154,
+ .bytes = 4,
+ .bit_offset = 0,
+ .nbits = 32,
+ }, {
+ .name = "tsensor-mem0",
+ .offset = 0x158,
+ .bytes = 4,
+ .bit_offset = 0,
+ .nbits = 32,
+ }, {
+ .name = "tsensor-mem1",
+ .offset = 0x15c,
+ .bytes = 4,
+ .bit_offset = 0,
+ .nbits = 32,
+ }, {
+ .name = "tsensor-pllx",
+ .offset = 0x160,
+ .bytes = 4,
+ .bit_offset = 0,
+ .nbits = 32,
+ },
+};
+
+static const struct nvmem_cell_lookup tegra114_fuse_lookups[] = {
+ {
+ .nvmem_name = "fuse",
+ .cell_name = "xusb-pad-calibration",
+ .dev_id = "7009f000.padctl",
+ .con_id = "calibration",
+ }, {
+ .nvmem_name = "fuse",
+ .cell_name = "tsensor-common",
+ .dev_id = "700e2000.thermal-sensor",
+ .con_id = "common",
+ }, {
+ .nvmem_name = "fuse",
+ .cell_name = "tsensor-cpu0",
+ .dev_id = "700e2000.thermal-sensor",
+ .con_id = "cpu0",
+ }, {
+ .nvmem_name = "fuse",
+ .cell_name = "tsensor-cpu1",
+ .dev_id = "700e2000.thermal-sensor",
+ .con_id = "cpu1",
+ }, {
+ .nvmem_name = "fuse",
+ .cell_name = "tsensor-cpu2",
+ .dev_id = "700e2000.thermal-sensor",
+ .con_id = "cpu2",
+ }, {
+ .nvmem_name = "fuse",
+ .cell_name = "tsensor-cpu3",
+ .dev_id = "700e2000.thermal-sensor",
+ .con_id = "cpu3",
+ }, {
+ .nvmem_name = "fuse",
+ .cell_name = "tsensor-mem0",
+ .dev_id = "700e2000.thermal-sensor",
+ .con_id = "mem0",
+ }, {
+ .nvmem_name = "fuse",
+ .cell_name = "tsensor-mem1",
+ .dev_id = "700e2000.thermal-sensor",
+ .con_id = "mem1",
+ }, {
+ .nvmem_name = "fuse",
+ .cell_name = "tsensor-gpu",
+ .dev_id = "700e2000.thermal-sensor",
+ .con_id = "gpu",
+ }, {
+ .nvmem_name = "fuse",
+ .cell_name = "tsensor-pllx",
+ .dev_id = "700e2000.thermal-sensor",
+ .con_id = "pllx",
+ },
+};
+
static const struct tegra_fuse_info tegra114_fuse_info = {
.read = tegra30_fuse_read,
.size = 0x2a0,
@@ -127,6 +245,10 @@ const struct tegra_fuse_soc tegra114_fuse_soc = {
.init = tegra30_fuse_init,
.speedo_init = tegra114_init_speedo_data,
.info = &tegra114_fuse_info,
+ .lookups = tegra114_fuse_lookups,
+ .num_lookups = ARRAY_SIZE(tegra114_fuse_lookups),
+ .cells = tegra114_fuse_cells,
+ .num_cells = ARRAY_SIZE(tegra114_fuse_cells),
.soc_attr_group = &tegra_soc_attr_group,
.clk_suspend_on = false,
};
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 108/568] mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 107/568] soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 109/568] ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() Greg Kroah-Hartman
` (466 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sarthak Garg, Adrian Hunter,
Ulf Hansson, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarthak Garg <quic_sartgarg@quicinc.com>
[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
For Qualcomm SoCs which needs level shifter for SD card, extra delay is
seen on receiver data path.
To compensate this delay enable tuning for SDR50 mode for targets which
has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets
with level shifter on Qualcomm SOC's.
Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
index f507fa491c58f..996ab8c760d35 100644
--- a/drivers/mmc/host/sdhci-msm.c
+++ b/drivers/mmc/host/sdhci-msm.c
@@ -79,6 +79,7 @@
#define CORE_IO_PAD_PWR_SWITCH_EN BIT(15)
#define CORE_IO_PAD_PWR_SWITCH BIT(16)
#define CORE_HC_SELECT_IN_EN BIT(18)
+#define CORE_HC_SELECT_IN_SDR50 (4 << 19)
#define CORE_HC_SELECT_IN_HS400 (6 << 19)
#define CORE_HC_SELECT_IN_MASK (7 << 19)
@@ -1129,6 +1130,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host)
{
struct mmc_ios *ios = &host->mmc->ios;
+ if (ios->timing == MMC_TIMING_UHS_SDR50 &&
+ host->flags & SDHCI_SDR50_NEEDS_TUNING)
+ return true;
+
/*
* Tuning is required for SDR104, HS200 and HS400 cards and
* if clock frequency is greater than 100MHz in these modes.
@@ -1197,6 +1202,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
struct mmc_ios ios = host->mmc->ios;
struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
+ const struct sdhci_msm_offset *msm_offset = msm_host->offset;
+ u32 config;
if (!sdhci_msm_is_tuning_needed(host)) {
msm_host->use_cdr = false;
@@ -1213,6 +1220,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
*/
msm_host->tuning_done = 0;
+ if (ios.timing == MMC_TIMING_UHS_SDR50 &&
+ host->flags & SDHCI_SDR50_NEEDS_TUNING) {
+ config = readl_relaxed(host->ioaddr + msm_offset->core_vendor_spec);
+ config &= ~CORE_HC_SELECT_IN_MASK;
+ config |= CORE_HC_SELECT_IN_EN | CORE_HC_SELECT_IN_SDR50;
+ writel_relaxed(config, host->ioaddr + msm_offset->core_vendor_spec);
+ }
+
/*
* For HS400 tuning in HS200 timing requires:
* - select MCLK/2 in VENDOR_SPEC
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 109/568] ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 108/568] mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 110/568] tee: allow a driver to allocate a tee_device without a pool Greg Kroah-Hartman
` (465 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Rafael J. Wysocki,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hansg@kernel.org>
[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
When deleting the previous walkstate operand stack
acpi_ds_call_control_method() was deleting obj_desc->Method.param_count
operands. But Method.param_count does not necessarily match
this_walk_state->num_operands, it may be either less or more.
After correcting the for loop to check `i < this_walk_state->num_operands`
the code is identical to acpi_ds_clear_operands(), so just outright
replace the code with acpi_ds_clear_operands() to fix this.
Link: https://github.com/acpica/acpica/commit/53fc0220
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/dsmethod.c | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
index 05fd1ec8de14e..c5ad377558645 100644
--- a/drivers/acpi/acpica/dsmethod.c
+++ b/drivers/acpi/acpica/dsmethod.c
@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
* Delete the operands on the previous walkstate operand stack
* (they were copied to new objects)
*/
- for (i = 0; i < obj_desc->method.param_count; i++) {
- acpi_ut_remove_reference(this_walk_state->operands[i]);
- this_walk_state->operands[i] = NULL;
- }
-
- /* Clear the operand stack */
-
- this_walk_state->num_operands = 0;
+ acpi_ds_clear_operands(this_walk_state);
ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
"**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 110/568] tee: allow a driver to allocate a tee_device without a pool
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 109/568] ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 111/568] nvmet-fc: avoid scheduling association deletion twice Greg Kroah-Hartman
` (464 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sumit Garg, Amirreza Zarrabi,
Jens Wiklander, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
A TEE driver doesn't always need to provide a pool if it doesn't
support memory sharing ioctls and can allocate memory for TEE
messages in another way. Although this is mentioned in the
documentation for tee_device_alloc(), it is not handled correctly.
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tee/tee_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
index a9a893bc19fa4..a2feea6e16f38 100644
--- a/drivers/tee/tee_core.c
+++ b/drivers/tee/tee_core.c
@@ -889,7 +889,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,
if (!teedesc || !teedesc->name || !teedesc->ops ||
!teedesc->ops->get_version || !teedesc->ops->open ||
- !teedesc->ops->release || !pool)
+ !teedesc->ops->release)
return ERR_PTR(-EINVAL);
teedev = kzalloc(sizeof(*teedev), GFP_KERNEL);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 111/568] nvmet-fc: avoid scheduling association deletion twice
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 110/568] tee: allow a driver to allocate a tee_device without a pool Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 112/568] nvme-fc: use lock accessing port_state and rport state Greg Kroah-Hartman
` (463 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shinichiro Kawasaki, Hannes Reinecke,
Daniel Wagner, Keith Busch, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <wagi@kernel.org>
[ Upstream commit f2537be4f8421f6495edfa0bc284d722f253841d ]
When forcefully shutting down a port via the configfs interface,
nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and
then nvmet_disable_port(). Both functions will eventually schedule all
remaining associations for deletion.
The current implementation checks whether an association is about to be
removed, but only after the work item has already been scheduled. As a
result, it is possible for the first scheduled work item to free all
resources, and then for the same work item to be scheduled again for
deletion.
Because the association list is an RCU list, it is not possible to take
a lock and remove the list entry directly, so it cannot be looked up
again. Instead, a flag (terminating) must be used to determine whether
the association is already in the process of being deleted.
Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Closes: https://lore.kernel.org/all/rsdinhafrtlguauhesmrrzkybpnvwantwmyfq2ih5aregghax5@mhr7v3eryci3/
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Daniel Wagner <wagi@kernel.org>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/fc.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index a15e764bae35b..188b9f1bdaca1 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -1090,6 +1090,14 @@ nvmet_fc_delete_assoc_work(struct work_struct *work)
static void
nvmet_fc_schedule_delete_assoc(struct nvmet_fc_tgt_assoc *assoc)
{
+ int terminating;
+
+ terminating = atomic_xchg(&assoc->terminating, 1);
+
+ /* if already terminating, do nothing */
+ if (terminating)
+ return;
+
nvmet_fc_tgtport_get(assoc->tgtport);
if (!queue_work(nvmet_wq, &assoc->del_work))
nvmet_fc_tgtport_put(assoc->tgtport);
@@ -1209,13 +1217,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc)
{
struct nvmet_fc_tgtport *tgtport = assoc->tgtport;
unsigned long flags;
- int i, terminating;
-
- terminating = atomic_xchg(&assoc->terminating, 1);
-
- /* if already terminating, do nothing */
- if (terminating)
- return;
+ int i;
spin_lock_irqsave(&tgtport->lock, flags);
list_del_rcu(&assoc->a_list);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 112/568] nvme-fc: use lock accessing port_state and rport state
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 111/568] nvmet-fc: avoid scheduling association deletion twice Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 113/568] video: backlight: lp855x_bl: Set correct EPROM start for LP8556 Greg Kroah-Hartman
` (462 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shinichiro Kawasaki, Daniel Wagner,
Hannes Reinecke, Keith Busch, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <wagi@kernel.org>
[ Upstream commit 891cdbb162ccdb079cd5228ae43bdeebce8597ad ]
nvme_fc_unregister_remote removes the remote port on a lport object at
any point in time when there is no active association. This races with
with the reconnect logic, because nvme_fc_create_association is not
taking a lock to check the port_state and atomically increase the
active count on the rport.
Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Closes: https://lore.kernel.org/all/u4ttvhnn7lark5w3sgrbuy2rxupcvosp4qmvj46nwzgeo5ausc@uyrkdls2muwx
Signed-off-by: Daniel Wagner <wagi@kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/fc.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 2b0f15de77111..786715e9eeb93 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -3048,11 +3048,17 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
++ctrl->ctrl.nr_reconnects;
- if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE)
+ spin_lock_irqsave(&ctrl->rport->lock, flags);
+ if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE) {
+ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
return -ENODEV;
+ }
- if (nvme_fc_ctlr_active_on_rport(ctrl))
+ if (nvme_fc_ctlr_active_on_rport(ctrl)) {
+ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
return -ENOTUNIQ;
+ }
+ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
dev_info(ctrl->ctrl.device,
"NVME-FC{%d}: create association : host wwpn 0x%016llx "
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 113/568] video: backlight: lp855x_bl: Set correct EPROM start for LP8556
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 112/568] nvme-fc: use lock accessing port_state and rport state Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 114/568] tools/cpupower: fix error return value in cpupower_write_sysfs() Greg Kroah-Hartman
` (461 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Svyatoslav Ryhel,
Daniel Thompson (RISCstar), Lee Jones, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Svyatoslav Ryhel <clamor95@gmail.com>
[ Upstream commit 07c7efda24453e05951fb2879f5452b720b91169 ]
According to LP8556 datasheet EPROM region starts at 0x98 so adjust value
in the driver accordingly.
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
Reviewed-by: "Daniel Thompson (RISCstar)" <danielt@kernel.org>
Link: https://lore.kernel.org/r/20250909074304.92135-2-clamor95@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/backlight/lp855x_bl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
index bd0bdeae23a4f..7e6d252313b7d 100644
--- a/drivers/video/backlight/lp855x_bl.c
+++ b/drivers/video/backlight/lp855x_bl.c
@@ -22,7 +22,7 @@
#define LP855X_DEVICE_CTRL 0x01
#define LP855X_EEPROM_START 0xA0
#define LP855X_EEPROM_END 0xA7
-#define LP8556_EPROM_START 0xA0
+#define LP8556_EPROM_START 0x98
#define LP8556_EPROM_END 0xAF
/* LP8555/7 Registers */
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 114/568] tools/cpupower: fix error return value in cpupower_write_sysfs()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 113/568] video: backlight: lp855x_bl: Set correct EPROM start for LP8556 Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 115/568] bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 Greg Kroah-Hartman
` (460 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kaushlendra Kumar, Shuah Khan,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
[ Upstream commit 57b100d4cf14276e0340eecb561005c07c129eb8 ]
The cpupower_write_sysfs() function currently returns -1 on
write failure, but the function signature indicates it should
return an unsigned int. Returning -1 from an unsigned function
results in a large positive value rather than indicating
an error condition.
Fix this by returning 0 on failure, which is more appropriate
for an unsigned return type and maintains consistency with typical
success/failure semantics where 0 indicates failure and non-zero
indicates success (bytes written).
Link: https://lore.kernel.org/r/20250828063000.803229-1-kaushlendra.kumar@intel.com
Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/power/cpupower/lib/cpupower.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/power/cpupower/lib/cpupower.c b/tools/power/cpupower/lib/cpupower.c
index 3f7d0c0c50676..0e29365e23a59 100644
--- a/tools/power/cpupower/lib/cpupower.c
+++ b/tools/power/cpupower/lib/cpupower.c
@@ -48,7 +48,7 @@ unsigned int cpupower_write_sysfs(const char *path, char *buf, size_t buflen)
if (numwritten < 1) {
perror(path);
close(fd);
- return -1;
+ return 0;
}
close(fd);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 115/568] bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 114/568] tools/cpupower: fix error return value in cpupower_write_sysfs() Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 116/568] cpuidle: Fail cpuidle device registration if there is one already Greg Kroah-Hartman
` (459 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tom Stellard, Andrii Nakryiko,
Quentin Monnet, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Stellard <tstellar@redhat.com>
[ Upstream commit 5612ea8b554375d45c14cbb0f8ea93ec5d172891 ]
This fixes the build with -Werror -Wall.
btf_dumper.c:71:31: error: variable 'finfo' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
71 | info.func_info = ptr_to_u64(&finfo);
| ^~~~~
prog.c:2294:31: error: variable 'func_info' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
2294 | info.func_info = ptr_to_u64(&func_info);
|
v2:
- Initialize instead of using memset.
Signed-off-by: Tom Stellard <tstellar@redhat.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Quentin Monnet <qmo@kernel.org>
Link: https://lore.kernel.org/bpf/20250917183847.318163-1-tstellar@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/bpf/bpftool/btf_dumper.c | 2 +-
tools/bpf/bpftool/prog.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c
index 19924b6ce796f..56100ad2fa0d2 100644
--- a/tools/bpf/bpftool/btf_dumper.c
+++ b/tools/bpf/bpftool/btf_dumper.c
@@ -38,7 +38,7 @@ static int dump_prog_id_as_func_ptr(const struct btf_dumper *d,
__u32 info_len = sizeof(info);
const char *prog_name = NULL;
struct btf *prog_btf = NULL;
- struct bpf_func_info finfo;
+ struct bpf_func_info finfo = {};
__u32 finfo_rec_size;
char prog_str[1024];
int err;
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index 1c3dc1dae23f6..e158e010266d5 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -2104,7 +2104,7 @@ static void profile_print_readings(void)
static char *profile_target_name(int tgt_fd)
{
- struct bpf_func_info func_info;
+ struct bpf_func_info func_info = {};
struct bpf_prog_info info = {};
__u32 info_len = sizeof(info);
const struct btf_type *t;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 116/568] cpuidle: Fail cpuidle device registration if there is one already
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 115/568] bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:21 ` [PATCH 6.1 117/568] futex: Dont leak robust_list pointer on exec race Greg Kroah-Hartman
` (458 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit 7b1b7961170e4fcad488755e5ffaaaf9bd527e8f ]
Refuse to register a cpuidle device if the given CPU has a cpuidle
device already and print a message regarding it.
Without this, an attempt to register a new cpuidle device without
unregistering the existing one leads to the removal of the existing
cpuidle device without removing its sysfs interface.
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpuidle/cpuidle.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index 6eceb19882430..fdd25271106a3 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -602,8 +602,14 @@ static void __cpuidle_device_init(struct cpuidle_device *dev)
static int __cpuidle_register_device(struct cpuidle_device *dev)
{
struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
+ unsigned int cpu = dev->cpu;
int i, ret;
+ if (per_cpu(cpuidle_devices, cpu)) {
+ pr_info("CPU%d: cpuidle device already registered\n", cpu);
+ return -EEXIST;
+ }
+
if (!try_module_get(drv->owner))
return -EINVAL;
@@ -615,7 +621,7 @@ static int __cpuidle_register_device(struct cpuidle_device *dev)
dev->states_usage[i].disable |= CPUIDLE_STATE_DISABLED_BY_USER;
}
- per_cpu(cpuidle_devices, dev->cpu) = dev;
+ per_cpu(cpuidle_devices, cpu) = dev;
list_add(&dev->device_list, &cpuidle_detected_devices);
ret = cpuidle_coupled_register_device(dev);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 117/568] futex: Dont leak robust_list pointer on exec race
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 116/568] cpuidle: Fail cpuidle device registration if there is one already Greg Kroah-Hartman
@ 2025-12-03 15:21 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 118/568] spi: rpc-if: Add resume support for RZ/G3E Greg Kroah-Hartman
` (457 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jann Horn, Pranav Tyagi,
Thomas Gleixner, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pranav Tyagi <pranav.tyagi03@gmail.com>
[ Upstream commit 6b54082c3ed4dc9821cdf0edb17302355cc5bb45 ]
sys_get_robust_list() and compat_get_robust_list() use ptrace_may_access()
to check if the calling task is allowed to access another task's
robust_list pointer. This check is racy against a concurrent exec() in the
target process.
During exec(), a task may transition from a non-privileged binary to a
privileged one (e.g., setuid binary) and its credentials/memory mappings
may change. If get_robust_list() performs ptrace_may_access() before
this transition, it may erroneously allow access to sensitive information
after the target becomes privileged.
A racy access allows an attacker to exploit a window during which
ptrace_may_access() passes before a target process transitions to a
privileged state via exec().
For example, consider a non-privileged task T that is about to execute a
setuid-root binary. An attacker task A calls get_robust_list(T) while T
is still unprivileged. Since ptrace_may_access() checks permissions
based on current credentials, it succeeds. However, if T begins exec
immediately afterwards, it becomes privileged and may change its memory
mappings. Because get_robust_list() proceeds to access T->robust_list
without synchronizing with exec() it may read user-space pointers from a
now-privileged process.
This violates the intended post-exec access restrictions and could
expose sensitive memory addresses or be used as a primitive in a larger
exploit chain. Consequently, the race can lead to unauthorized
disclosure of information across privilege boundaries and poses a
potential security risk.
Take a read lock on signal->exec_update_lock prior to invoking
ptrace_may_access() and accessing the robust_list/compat_robust_list.
This ensures that the target task's exec state remains stable during the
check, allowing for consistent and synchronized validation of
credentials.
Suggested-by: Jann Horn <jann@thejh.net>
Signed-off-by: Pranav Tyagi <pranav.tyagi03@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/linux-fsdevel/1477863998-3298-5-git-send-email-jann@thejh.net/
Link: https://github.com/KSPP/linux/issues/119
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/futex/syscalls.c | 106 +++++++++++++++++++++-------------------
1 file changed, 56 insertions(+), 50 deletions(-)
diff --git a/kernel/futex/syscalls.c b/kernel/futex/syscalls.c
index a8074079b09e8..48feaa545b3c7 100644
--- a/kernel/futex/syscalls.c
+++ b/kernel/futex/syscalls.c
@@ -40,6 +40,56 @@ SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
return 0;
}
+static inline void __user *futex_task_robust_list(struct task_struct *p, bool compat)
+{
+#ifdef CONFIG_COMPAT
+ if (compat)
+ return p->compat_robust_list;
+#endif
+ return p->robust_list;
+}
+
+static void __user *futex_get_robust_list_common(int pid, bool compat)
+{
+ struct task_struct *p = current;
+ void __user *head;
+ int ret;
+
+ scoped_guard(rcu) {
+ if (pid) {
+ p = find_task_by_vpid(pid);
+ if (!p)
+ return (void __user *)ERR_PTR(-ESRCH);
+ }
+ get_task_struct(p);
+ }
+
+ /*
+ * Hold exec_update_lock to serialize with concurrent exec()
+ * so ptrace_may_access() is checked against stable credentials
+ */
+ ret = down_read_killable(&p->signal->exec_update_lock);
+ if (ret)
+ goto err_put;
+
+ ret = -EPERM;
+ if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+ goto err_unlock;
+
+ head = futex_task_robust_list(p, compat);
+
+ up_read(&p->signal->exec_update_lock);
+ put_task_struct(p);
+
+ return head;
+
+err_unlock:
+ up_read(&p->signal->exec_update_lock);
+err_put:
+ put_task_struct(p);
+ return (void __user *)ERR_PTR(ret);
+}
+
/**
* sys_get_robust_list() - Get the robust-futex list head of a task
* @pid: pid of the process [zero for current task]
@@ -50,36 +100,14 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
struct robust_list_head __user * __user *, head_ptr,
size_t __user *, len_ptr)
{
- struct robust_list_head __user *head;
- unsigned long ret;
- struct task_struct *p;
-
- rcu_read_lock();
-
- ret = -ESRCH;
- if (!pid)
- p = current;
- else {
- p = find_task_by_vpid(pid);
- if (!p)
- goto err_unlock;
- }
-
- ret = -EPERM;
- if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
- goto err_unlock;
+ struct robust_list_head __user *head = futex_get_robust_list_common(pid, false);
- head = p->robust_list;
- rcu_read_unlock();
+ if (IS_ERR(head))
+ return PTR_ERR(head);
if (put_user(sizeof(*head), len_ptr))
return -EFAULT;
return put_user(head, head_ptr);
-
-err_unlock:
- rcu_read_unlock();
-
- return ret;
}
long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
@@ -322,36 +350,14 @@ COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
compat_uptr_t __user *, head_ptr,
compat_size_t __user *, len_ptr)
{
- struct compat_robust_list_head __user *head;
- unsigned long ret;
- struct task_struct *p;
-
- rcu_read_lock();
-
- ret = -ESRCH;
- if (!pid)
- p = current;
- else {
- p = find_task_by_vpid(pid);
- if (!p)
- goto err_unlock;
- }
-
- ret = -EPERM;
- if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
- goto err_unlock;
+ struct compat_robust_list_head __user *head = futex_get_robust_list_common(pid, true);
- head = p->compat_robust_list;
- rcu_read_unlock();
+ if (IS_ERR(head))
+ return PTR_ERR(head);
if (put_user(sizeof(*head), len_ptr))
return -EFAULT;
return put_user(ptr_to_compat(head), head_ptr);
-
-err_unlock:
- rcu_read_unlock();
-
- return ret;
}
#endif /* CONFIG_COMPAT */
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 118/568] spi: rpc-if: Add resume support for RZ/G3E
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2025-12-03 15:21 ` [PATCH 6.1 117/568] futex: Dont leak robust_list pointer on exec race Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 119/568] clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel Greg Kroah-Hartman
` (456 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Biju Das, Mark Brown, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <biju.das.jz@bp.renesas.com>
[ Upstream commit ad4728740bd68d74365a43acc25a65339a9b2173 ]
On RZ/G3E using PSCI, s2ram powers down the SoC. After resume,
reinitialize the hardware for SPI operations.
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://patch.msgid.link/20250921112649.104516-3-biju.das.jz@bp.renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-rpc-if.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/spi/spi-rpc-if.c b/drivers/spi/spi-rpc-if.c
index ec0904faf3a10..b294ac56470a0 100644
--- a/drivers/spi/spi-rpc-if.c
+++ b/drivers/spi/spi-rpc-if.c
@@ -195,6 +195,8 @@ static int __maybe_unused rpcif_spi_resume(struct device *dev)
{
struct spi_controller *ctlr = dev_get_drvdata(dev);
+ rpcif_hw_init(dev, false);
+
return spi_controller_resume(ctlr);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 119/568] clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 118/568] spi: rpc-if: Add resume support for RZ/G3E Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 120/568] bpf: Clear pfmemalloc flag when freeing all fragments Greg Kroah-Hartman
` (455 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Lezcano, Arnd Bergmann,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Lezcano <daniel.lezcano@linaro.org>
[ Upstream commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c ]
The driver uses the raw_readl() and raw_writel() functions. Those are
not for MMIO devices. Replace them with readl() and writel()
[ dlezcano: Fixed typo in the subject s/reald/readl/ ]
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Cc: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20250804152344.1109310-2-daniel.lezcano@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/timer-vf-pit.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/drivers/clocksource/timer-vf-pit.c b/drivers/clocksource/timer-vf-pit.c
index 911c92146eca6..8041a8f62d1fa 100644
--- a/drivers/clocksource/timer-vf-pit.c
+++ b/drivers/clocksource/timer-vf-pit.c
@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy;
static inline void pit_timer_enable(void)
{
- __raw_writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
+ writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
}
static inline void pit_timer_disable(void)
{
- __raw_writel(0, clkevt_base + PITTCTRL);
+ writel(0, clkevt_base + PITTCTRL);
}
static inline void pit_irq_acknowledge(void)
{
- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ writel(PITTFLG_TIF, clkevt_base + PITTFLG);
}
static u64 notrace pit_read_sched_clock(void)
{
- return ~__raw_readl(clksrc_base + PITCVAL);
+ return ~readl(clksrc_base + PITCVAL);
}
static int __init pit_clocksource_init(unsigned long rate)
{
/* set the max load value and start the clock source counter */
- __raw_writel(0, clksrc_base + PITTCTRL);
- __raw_writel(~0UL, clksrc_base + PITLDVAL);
- __raw_writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
+ writel(0, clksrc_base + PITTCTRL);
+ writel(~0UL, clksrc_base + PITLDVAL);
+ writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
sched_clock_register(pit_read_sched_clock, 32, rate);
return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta,
* hardware requirement.
*/
pit_timer_disable();
- __raw_writel(delta - 1, clkevt_base + PITLDVAL);
+ writel(delta - 1, clkevt_base + PITLDVAL);
pit_timer_enable();
return 0;
@@ -125,8 +125,8 @@ static struct clock_event_device clockevent_pit = {
static int __init pit_clockevent_init(unsigned long rate, int irq)
{
- __raw_writel(0, clkevt_base + PITTCTRL);
- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ writel(0, clkevt_base + PITTCTRL);
+ writel(PITTFLG_TIF, clkevt_base + PITTFLG);
BUG_ON(request_irq(irq, pit_timer_interrupt, IRQF_TIMER | IRQF_IRQPOLL,
"VF pit timer", &clockevent_pit));
@@ -183,7 +183,7 @@ static int __init pit_timer_init(struct device_node *np)
cycle_per_jiffy = clk_rate / (HZ);
/* enable the pit module */
- __raw_writel(~PITMCR_MDIS, timer_base + PITMCR);
+ writel(~PITMCR_MDIS, timer_base + PITMCR);
ret = pit_clocksource_init(clk_rate);
if (ret)
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 120/568] bpf: Clear pfmemalloc flag when freeing all fragments
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 119/568] clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 121/568] nvme: Use non zero KATO for persistent discovery connections Greg Kroah-Hartman
` (454 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Amery Hung, Martin KaFai Lau,
Maciej Fijalkowski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amery Hung <ameryhung@gmail.com>
[ Upstream commit 8f12d1137c2382c80aada8e05d7cc650cd4e403c ]
It is possible for bpf_xdp_adjust_tail() to free all fragments. The
kfunc currently clears the XDP_FLAGS_HAS_FRAGS bit, but not
XDP_FLAGS_FRAGS_PF_MEMALLOC. So far, this has not caused a issue when
building sk_buff from xdp_buff since all readers of xdp_buff->flags
use the flag only when there are fragments. Clear the
XDP_FLAGS_FRAGS_PF_MEMALLOC bit as well to make the flags correct.
Signed-off-by: Amery Hung <ameryhung@gmail.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Link: https://patch.msgid.link/20250922233356.3356453-2-ameryhung@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/xdp.h | 5 +++++
net/core/filter.c | 1 +
2 files changed, 6 insertions(+)
diff --git a/include/net/xdp.h b/include/net/xdp.h
index 55dbc68bfffce..8a0a69f691595 100644
--- a/include/net/xdp.h
+++ b/include/net/xdp.h
@@ -110,6 +110,11 @@ static __always_inline void xdp_buff_set_frag_pfmemalloc(struct xdp_buff *xdp)
xdp->flags |= XDP_FLAGS_FRAGS_PF_MEMALLOC;
}
+static __always_inline void xdp_buff_clear_frag_pfmemalloc(struct xdp_buff *xdp)
+{
+ xdp->flags &= ~XDP_FLAGS_FRAGS_PF_MEMALLOC;
+}
+
static __always_inline void
xdp_init_buff(struct xdp_buff *xdp, u32 frame_sz, struct xdp_rxq_info *rxq)
{
diff --git a/net/core/filter.c b/net/core/filter.c
index 9b4254feefccd..786064ac889a1 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4118,6 +4118,7 @@ static int bpf_xdp_frags_shrink_tail(struct xdp_buff *xdp, int offset)
if (unlikely(!sinfo->nr_frags)) {
xdp_buff_clear_frags_flag(xdp);
+ xdp_buff_clear_frag_pfmemalloc(xdp);
xdp->data_end -= offset;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 121/568] nvme: Use non zero KATO for persistent discovery connections
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 120/568] bpf: Clear pfmemalloc flag when freeing all fragments Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 122/568] uprobe: Do not emulate/sstep original instruction when ip is changed Greg Kroah-Hartman
` (453 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alistair Francis, Hannes Reinecke,
Christoph Hellwig, Keith Busch, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alistair Francis <alistair.francis@wdc.com>
[ Upstream commit 2e482655019ab6fcfe8865b62432c6d03f0b5f80 ]
The NVMe Base Specification 2.1 states that:
"""
A host requests an explicit persistent connection ... by specifying a
non-zero Keep Alive Timer value in the Connect command.
"""
As such if we are starting a persistent connection to a discovery
controller and the KATO is currently 0 we need to update KATO to a non
zero value to avoid continuous timeouts on the target.
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/core.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 7d3759f875b23..938af571dc13e 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -5131,8 +5131,14 @@ void nvme_start_ctrl(struct nvme_ctrl *ctrl)
* checking that they started once before, hence are reconnecting back.
*/
if (test_bit(NVME_CTRL_STARTED_ONCE, &ctrl->flags) &&
- nvme_discovery_ctrl(ctrl))
+ nvme_discovery_ctrl(ctrl)) {
+ if (!ctrl->kato) {
+ nvme_stop_keep_alive(ctrl);
+ ctrl->kato = NVME_DEFAULT_KATO;
+ nvme_start_keep_alive(ctrl);
+ }
nvme_change_uevent(ctrl, "NVME_EVENT=rediscover");
+ }
if (ctrl->queue_count > 1) {
nvme_queue_scan(ctrl);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 122/568] uprobe: Do not emulate/sstep original instruction when ip is changed
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 121/568] nvme: Use non zero KATO for persistent discovery connections Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 123/568] hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex Greg Kroah-Hartman
` (452 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Oleg Nesterov, Andrii Nakryiko,
Jiri Olsa, Alexei Starovoitov, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <jolsa@kernel.org>
[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]
If uprobe handler changes instruction pointer we still execute single
step) or emulate the original instruction and increment the (new) ip
with its length.
This makes the new instruction pointer bogus and application will
likely crash on illegal instruction execution.
If user decided to take execution elsewhere, it makes little sense
to execute the original instruction, so let's skip it.
Acked-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/r/20250916215301.664963-3-jolsa@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/events/uprobes.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 4c8fc82fc27a0..29c0e7c6a6d24 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -2248,6 +2248,13 @@ static void handle_swbp(struct pt_regs *regs)
handler_chain(uprobe, regs);
+ /*
+ * If user decided to take execution elsewhere, it makes little sense
+ * to execute the original instruction, so let's skip it.
+ */
+ if (instruction_pointer(regs) != bp_vaddr)
+ goto out;
+
if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
goto out;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 123/568] hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 122/568] uprobe: Do not emulate/sstep original instruction when ip is changed Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 124/568] hwmon: (dell-smm) Add support for Dell OptiPlex 7040 Greg Kroah-Hartman
` (451 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ben Copeland, Eugene Shalygin,
Guenter Roeck, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Copeland <ben.copeland@linaro.org>
[ Upstream commit 584d55be66ef151e6ef9ccb3dcbc0a2155559be1 ]
Some motherboards require more time to acquire the ACPI mutex,
causing "Failed to acquire mutex" messages to appear in the kernel log.
Increase the timeout from 500ms to 800ms to accommodate these cases.
Signed-off-by: Ben Copeland <ben.copeland@linaro.org>
Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com>
Link: https://lore.kernel.org/r/20250923192935.11339-3-eugene.shalygin@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/asus-ec-sensors.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
index 6f20b55f41f2e..c9222c83ba240 100644
--- a/drivers/hwmon/asus-ec-sensors.c
+++ b/drivers/hwmon/asus-ec-sensors.c
@@ -49,7 +49,7 @@ static char *mutex_path_override;
*/
#define ASUS_EC_MAX_BANK 3
-#define ACPI_LOCK_DELAY_MS 500
+#define ACPI_LOCK_DELAY_MS 800
/* ACPI mutex for locking access to the EC for the firmware */
#define ASUS_HW_ACCESS_MUTEX_ASMX "\\AMW0.ASMX"
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 124/568] hwmon: (dell-smm) Add support for Dell OptiPlex 7040
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 123/568] hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 125/568] tools/cpupower: Fix incorrect size in cpuidle_state_disable() Greg Kroah-Hartman
` (450 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Armin Wolf, Guenter Roeck,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <W_Armin@gmx.de>
[ Upstream commit 53d3bd48ef6ff1567a75ca77728968f5ab493cb4 ]
The Dell OptiPlex 7040 supports the legacy SMM interface for reading
sensors and performing fan control. Whitelist this machine so that
this driver loads automatically.
Closes: https://github.com/Wer-Wolf/i8kutils/issues/15
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://lore.kernel.org/r/20250917181036.10972-5-W_Armin@gmx.de
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
index dbcb8f362061d..e13d545fbc570 100644
--- a/drivers/hwmon/dell-smm-hwmon.c
+++ b/drivers/hwmon/dell-smm-hwmon.c
@@ -1158,6 +1158,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = {
},
.driver_data = (void *)&i8k_config_data[DELL_PRECISION_490],
},
+ {
+ .ident = "Dell OptiPlex 7040",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7040"),
+ },
+ },
{
.ident = "Dell Precision",
.matches = {
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 125/568] tools/cpupower: Fix incorrect size in cpuidle_state_disable()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 124/568] hwmon: (dell-smm) Add support for Dell OptiPlex 7040 Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 126/568] tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage Greg Kroah-Hartman
` (449 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kaushlendra Kumar, Shuah Khan,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
[ Upstream commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 ]
Fix incorrect size parameter passed to cpuidle_state_write_file() in
cpuidle_state_disable().
The function was incorrectly using sizeof(disable) which returns the
size of the unsigned int variable (4 bytes) instead of the actual
length of the string stored in the 'value' buffer.
Since 'value' is populated with snprintf() to contain the string
representation of the disable value, we should use the length
returned by snprintf() to get the correct string length for
writing to the sysfs file.
This ensures the correct number of bytes is written to the cpuidle
state disable file in sysfs.
Link: https://lore.kernel.org/r/20250917050820.1785377-1-kaushlendra.kumar@intel.com
Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/power/cpupower/lib/cpuidle.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
index 479c5971aa6da..c15d0de12357f 100644
--- a/tools/power/cpupower/lib/cpuidle.c
+++ b/tools/power/cpupower/lib/cpuidle.c
@@ -231,6 +231,7 @@ int cpuidle_state_disable(unsigned int cpu,
{
char value[SYSFS_PATH_MAX];
int bytes_written;
+ int len;
if (cpuidle_state_count(cpu) <= idlestate)
return -1;
@@ -239,10 +240,10 @@ int cpuidle_state_disable(unsigned int cpu,
idlestate_value_files[IDLESTATE_DISABLE]))
return -2;
- snprintf(value, SYSFS_PATH_MAX, "%u", disable);
+ len = snprintf(value, SYSFS_PATH_MAX, "%u", disable);
bytes_written = cpuidle_state_write_file(cpu, idlestate, "disable",
- value, sizeof(disable));
+ value, len);
if (bytes_written)
return 0;
return -3;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 126/568] tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 125/568] tools/cpupower: Fix incorrect size in cpuidle_state_disable() Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 127/568] tools/power x86_energy_perf_policy: Enhance HWP enable Greg Kroah-Hartman
` (448 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kaushlendra Kumar, Len Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
[ Upstream commit 62127655b7ab7b8c2997041aca48a81bf5c6da0c ]
The fopen_or_die() function was previously hardcoded
to open files in read-only mode ("r"), ignoring the
mode parameter passed to it. This patch corrects
fopen_or_die() to use the provided mode argument,
allowing for flexible file access as intended.
Additionally, the call to fopen_or_die() in
err_on_hypervisor() incorrectly used the mode
"ro", which is not a valid fopen mode. This is
fixed to use the correct "r" mode.
Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
index ebda9c366b2ba..c883f211dbcc9 100644
--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
@@ -630,7 +630,7 @@ void cmdline(int argc, char **argv)
*/
FILE *fopen_or_die(const char *path, const char *mode)
{
- FILE *filep = fopen(path, "r");
+ FILE *filep = fopen(path, mode);
if (!filep)
err(1, "%s: open failed", path);
@@ -644,7 +644,7 @@ void err_on_hypervisor(void)
char *buffer;
/* On VMs /proc/cpuinfo contains a "flags" entry for hypervisor */
- cpuinfo = fopen_or_die("/proc/cpuinfo", "ro");
+ cpuinfo = fopen_or_die("/proc/cpuinfo", "r");
buffer = malloc(4096);
if (!buffer) {
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 127/568] tools/power x86_energy_perf_policy: Enhance HWP enable
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 126/568] tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 128/568] tools/power x86_energy_perf_policy: Prefer driver HWP limits Greg Kroah-Hartman
` (447 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Len Brown, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Len Brown <len.brown@intel.com>
[ Upstream commit c97c057d357c4b39b153e9e430bbf8976e05bd4e ]
On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE.
Also, skip writing the MSR_PM_ENABLE if HWP is already enabled.
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
index c883f211dbcc9..0bda8e3ae7f77 100644
--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
@@ -1166,13 +1166,18 @@ int update_hwp_request_pkg(int pkg)
int enable_hwp_on_cpu(int cpu)
{
- unsigned long long msr;
+ unsigned long long old_msr, new_msr;
+
+ get_msr(cpu, MSR_PM_ENABLE, &old_msr);
+
+ if (old_msr & 1)
+ return 0; /* already enabled */
- get_msr(cpu, MSR_PM_ENABLE, &msr);
- put_msr(cpu, MSR_PM_ENABLE, 1);
+ new_msr = old_msr | 1;
+ put_msr(cpu, MSR_PM_ENABLE, new_msr);
if (verbose)
- printf("cpu%d: MSR_PM_ENABLE old: %d new: %d\n", cpu, (unsigned int) msr, 1);
+ printf("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n", cpu, old_msr, new_msr);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 128/568] tools/power x86_energy_perf_policy: Prefer driver HWP limits
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 127/568] tools/power x86_energy_perf_policy: Enhance HWP enable Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 129/568] mfd: stmpe: Remove IRQ domain upon removal Greg Kroah-Hartman
` (446 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Len Brown, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Len Brown <len.brown@intel.com>
[ Upstream commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 ]
When we are successful in using cpufreq min/max limits,
skip setting the raw MSR limits entirely.
This is necessary to avoid undoing any modification that
the cpufreq driver makes to our sysfs request.
eg. intel_pstate may take our request for a limit
that is valid according to HWP.CAP.MIN/MAX and clip
it to be within the range available in PLATFORM_INFO.
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
index 0bda8e3ae7f77..891738116c8b2 100644
--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
@@ -62,6 +62,7 @@ unsigned char turbo_update_value;
unsigned char update_hwp_epp;
unsigned char update_hwp_min;
unsigned char update_hwp_max;
+unsigned char hwp_limits_done_via_sysfs;
unsigned char update_hwp_desired;
unsigned char update_hwp_window;
unsigned char update_hwp_use_pkg;
@@ -951,8 +952,10 @@ int ratio_2_sysfs_khz(int ratio)
}
/*
* If HWP is enabled and cpufreq sysfs attribtes are present,
- * then update sysfs, so that it will not become
- * stale when we write to MSRs.
+ * then update via sysfs. The intel_pstate driver may modify (clip)
+ * this request, say, when HWP_CAP is outside of PLATFORM_INFO limits,
+ * and the driver-chosen value takes precidence.
+ *
* (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq,
* so we don't have to touch that.)
*/
@@ -1007,6 +1010,8 @@ int update_sysfs(int cpu)
if (update_hwp_max)
update_cpufreq_scaling_freq(1, cpu, req_update.hwp_max);
+ hwp_limits_done_via_sysfs = 1;
+
return 0;
}
@@ -1085,10 +1090,10 @@ int update_hwp_request(int cpu)
if (debug)
print_hwp_request(cpu, &req, "old: ");
- if (update_hwp_min)
+ if (update_hwp_min && !hwp_limits_done_via_sysfs)
req.hwp_min = req_update.hwp_min;
- if (update_hwp_max)
+ if (update_hwp_max && !hwp_limits_done_via_sysfs)
req.hwp_max = req_update.hwp_max;
if (update_hwp_desired)
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 129/568] mfd: stmpe: Remove IRQ domain upon removal
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 128/568] tools/power x86_energy_perf_policy: Prefer driver HWP limits Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 130/568] mfd: stmpe-i2c: Add missing MODULE_LICENSE Greg Kroah-Hartman
` (445 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander Stein, Lee Jones,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <alexander.stein@ew.tq-group.com>
[ Upstream commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d ]
The IRQ domain is (optionally) added during stmpe_probe, but never removed.
Add the call to stmpe_remove.
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Link: https://lore.kernel.org/r/20250725070752.338376-1-alexander.stein@ew.tq-group.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/stmpe.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
index aef29221d7c12..a23b3816eee37 100644
--- a/drivers/mfd/stmpe.c
+++ b/drivers/mfd/stmpe.c
@@ -1485,6 +1485,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
void stmpe_remove(struct stmpe *stmpe)
{
+ if (stmpe->domain)
+ irq_domain_remove(stmpe->domain);
+
if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
regulator_disable(stmpe->vio);
if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 130/568] mfd: stmpe-i2c: Add missing MODULE_LICENSE
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 129/568] mfd: stmpe: Remove IRQ domain upon removal Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 131/568] mfd: madera: Work around false-positive -Wininitialized warning Greg Kroah-Hartman
` (444 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander Stein, Lee Jones,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <alexander.stein@ew.tq-group.com>
[ Upstream commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 ]
This driver is licensed GPL-2.0-only, so add the corresponding module flag.
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Link: https://lore.kernel.org/r/20250725071153.338912-3-alexander.stein@ew.tq-group.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/stmpe-i2c.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
index 4d55494a97c4b..8c36b7d122856 100644
--- a/drivers/mfd/stmpe-i2c.c
+++ b/drivers/mfd/stmpe-i2c.c
@@ -139,3 +139,4 @@ module_exit(stmpe_exit);
MODULE_LICENSE("GPL v2");
MODULE_DESCRIPTION("STMPE MFD I2C Interface Driver");
MODULE_AUTHOR("Rabin Vincent <rabin.vincent@stericsson.com>");
+MODULE_LICENSE("GPL");
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 131/568] mfd: madera: Work around false-positive -Wininitialized warning
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 130/568] mfd: stmpe-i2c: Add missing MODULE_LICENSE Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 132/568] mfd: da9063: Split chip variant reading in two bus transactions Greg Kroah-Hartman
` (443 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Richard Fitzgerald,
Lee Jones, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 ]
clang-21 warns about one uninitialized variable getting dereferenced
in madera_dev_init:
drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized]
739 | mfd_devs, n_devs,
| ^~~~~~~~
drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning
459 | const struct mfd_cell *mfd_devs;
| ^
| = NULL
The code is actually correct here because n_devs is only nonzero
when mfd_devs is a valid pointer, but this is impossible for the
compiler to see reliably.
Change the logic to check for the pointer as well, to make this easier
for the compiler to follow.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20250807071932.4085458-1-arnd@kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/madera-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c
index a2abc0094def7..87797d77c9f0c 100644
--- a/drivers/mfd/madera-core.c
+++ b/drivers/mfd/madera-core.c
@@ -457,7 +457,7 @@ int madera_dev_init(struct madera *madera)
struct device *dev = madera->dev;
unsigned int hwid;
int (*patch_fn)(struct madera *) = NULL;
- const struct mfd_cell *mfd_devs;
+ const struct mfd_cell *mfd_devs = NULL;
int n_devs = 0;
int i, ret;
@@ -671,7 +671,7 @@ int madera_dev_init(struct madera *madera)
goto err_reset;
}
- if (!n_devs) {
+ if (!n_devs || !mfd_devs) {
dev_err(madera->dev, "Device ID 0x%x not a %s\n", hwid,
madera->type_name);
ret = -ENODEV;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 132/568] mfd: da9063: Split chip variant reading in two bus transactions
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 131/568] mfd: madera: Work around false-positive -Wininitialized warning Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 133/568] drm/amd/display: add more cyan skillfish devices Greg Kroah-Hartman
` (442 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jens Kehne, Lee Jones, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Kehne <jens.kehne@agilent.com>
[ Upstream commit 9ac4890ac39352ccea132109e32911495574c3ec ]
We observed the initial probe of the da9063 failing in
da9063_get_device_type in about 30% of boots on a Xilinx ZynqMP based
board. The problem originates in da9063_i2c_blockreg_read, which uses
a single bus transaction to turn the register page and then read a
register. On the bus, this should translate to a write to register 0,
followed by a read to the target register, separated by a repeated
start. However, we found that after the write to register 0, the
controller sometimes continues directly with the register address of
the read request, without sending the chip address or a repeated start
in between, which makes the read request invalid.
To fix this, separate turning the page and reading the register into
two separate transactions. This brings the initialization code in line
with the rest of the driver, which uses register maps (which to my
knowledge do not use repeated starts after turning the page). This has
been included in our kernel for several months and was recently
included in a shipped product. For us, it reliably fixes the issue,
and we have not observed any new issues.
While the underlying problem is probably with the i2c controller or
its driver, I still propose a change here in the interest of
robustness: First, I'm not sure this issue can be fixed on the
controller side, since there are other issues related to repeated
start which can't (AR# 60695, AR# 61664). Second, similar problems
might exist with other controllers.
Signed-off-by: Jens Kehne <jens.kehne@agilent.com>
Link: https://lore.kernel.org/r/20250804133754.3496718-1-jens.kehne@agilent.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/da9063-i2c.c | 27 +++++++++++++++++++++------
1 file changed, 21 insertions(+), 6 deletions(-)
diff --git a/drivers/mfd/da9063-i2c.c b/drivers/mfd/da9063-i2c.c
index 343ed6e96d87e..6e48348cff054 100644
--- a/drivers/mfd/da9063-i2c.c
+++ b/drivers/mfd/da9063-i2c.c
@@ -37,9 +37,13 @@ enum da9063_page_sel_buf_fmt {
DA9063_PAGE_SEL_BUF_SIZE,
};
+enum da9063_page_sel_msgs {
+ DA9063_PAGE_SEL_MSG = 0,
+ DA9063_PAGE_SEL_CNT,
+};
+
enum da9063_paged_read_msgs {
- DA9063_PAGED_READ_MSG_PAGE_SEL = 0,
- DA9063_PAGED_READ_MSG_REG_SEL,
+ DA9063_PAGED_READ_MSG_REG_SEL = 0,
DA9063_PAGED_READ_MSG_DATA,
DA9063_PAGED_READ_MSG_CNT,
};
@@ -65,10 +69,21 @@ static int da9063_i2c_blockreg_read(struct i2c_client *client, u16 addr,
(page_num << DA9063_I2C_PAGE_SEL_SHIFT) & DA9063_REG_PAGE_MASK;
/* Write reg address, page selection */
- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].addr = client->addr;
- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].flags = 0;
- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].len = DA9063_PAGE_SEL_BUF_SIZE;
- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].buf = page_sel_buf;
+ xfer[DA9063_PAGE_SEL_MSG].addr = client->addr;
+ xfer[DA9063_PAGE_SEL_MSG].flags = 0;
+ xfer[DA9063_PAGE_SEL_MSG].len = DA9063_PAGE_SEL_BUF_SIZE;
+ xfer[DA9063_PAGE_SEL_MSG].buf = page_sel_buf;
+
+ ret = i2c_transfer(client->adapter, xfer, DA9063_PAGE_SEL_CNT);
+ if (ret < 0) {
+ dev_err(&client->dev, "Page switch failed: %d\n", ret);
+ return ret;
+ }
+
+ if (ret != DA9063_PAGE_SEL_CNT) {
+ dev_err(&client->dev, "Page switch failed to complete\n");
+ return -EIO;
+ }
/* Select register address */
xfer[DA9063_PAGED_READ_MSG_REG_SEL].addr = client->addr;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 133/568] drm/amd/display: add more cyan skillfish devices
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 132/568] mfd: da9063: Split chip variant reading in two bus transactions Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 134/568] drm/amd/pm: Use cached metrics data on aldebaran Greg Kroah-Hartman
` (441 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Harry Wentland, Alex Deucher,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
[ Upstream commit 3cf06bd4cf2512d564fdb451b07de0cebe7b138d ]
Add PCI IDs to support display probe for cyan skillfish
family of SOCs.
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 8 +++++++-
drivers/gpu/drm/amd/display/include/dal_asic_id.h | 5 +++++
2 files changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
index f036e9988a0d3..876b70157faa3 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
@@ -136,7 +136,13 @@ enum dce_version resource_parse_asic_id(struct hw_asic_id asic_id)
case FAMILY_NV:
dc_version = DCN_VERSION_2_0;
- if (asic_id.chip_id == DEVICE_ID_NV_13FE || asic_id.chip_id == DEVICE_ID_NV_143F) {
+ if (asic_id.chip_id == DEVICE_ID_NV_13FE ||
+ asic_id.chip_id == DEVICE_ID_NV_143F ||
+ asic_id.chip_id == DEVICE_ID_NV_13F9 ||
+ asic_id.chip_id == DEVICE_ID_NV_13FA ||
+ asic_id.chip_id == DEVICE_ID_NV_13FB ||
+ asic_id.chip_id == DEVICE_ID_NV_13FC ||
+ asic_id.chip_id == DEVICE_ID_NV_13DB) {
dc_version = DCN_VERSION_2_01;
break;
}
diff --git a/drivers/gpu/drm/amd/display/include/dal_asic_id.h b/drivers/gpu/drm/amd/display/include/dal_asic_id.h
index c3089c673975b..e044d8589d4f3 100644
--- a/drivers/gpu/drm/amd/display/include/dal_asic_id.h
+++ b/drivers/gpu/drm/amd/display/include/dal_asic_id.h
@@ -213,6 +213,11 @@ enum {
#endif
#define DEVICE_ID_NV_13FE 0x13FE // CYAN_SKILLFISH
#define DEVICE_ID_NV_143F 0x143F
+#define DEVICE_ID_NV_13F9 0x13F9
+#define DEVICE_ID_NV_13FA 0x13FA
+#define DEVICE_ID_NV_13FB 0x13FB
+#define DEVICE_ID_NV_13FC 0x13FC
+#define DEVICE_ID_NV_13DB 0x13DB
#define FAMILY_VGH 144
#define DEVICE_ID_VGH_163F 0x163F
#define DEVICE_ID_VGH_1435 0x1435
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 134/568] drm/amd/pm: Use cached metrics data on aldebaran
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 133/568] drm/amd/display: add more cyan skillfish devices Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 135/568] drm/amd/pm: Use cached metrics data on arcturus Greg Kroah-Hartman
` (440 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lijo Lazar, Asad Kamal, Alex Deucher,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <lijo.lazar@amd.com>
[ Upstream commit e87577ef6daa0cfb10ca139c720f0c57bd894174 ]
Cached metrics data validity is 1ms on aldebaran. It's not reasonable
for any client to query gpu_metrics at a faster rate and constantly
interrupt PMFW.
Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Asad Kamal <asad.kamal@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
index 1ba1bb4f5bd77..749031d1f4b3c 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
@@ -1744,7 +1744,7 @@ static ssize_t aldebaran_get_gpu_metrics(struct smu_context *smu,
ret = smu_cmn_get_metrics_table(smu,
&metrics,
- true);
+ false);
if (ret)
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 135/568] drm/amd/pm: Use cached metrics data on arcturus
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 134/568] drm/amd/pm: Use cached metrics data on aldebaran Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 136/568] drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff Greg Kroah-Hartman
` (439 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lijo Lazar, Asad Kamal, Alex Deucher,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <lijo.lazar@amd.com>
[ Upstream commit 2f3b1ccf83be83a3330e38194ddfd1a91fec69be ]
Cached metrics data validity is 1ms on arcturus. It's not reasonable for
any client to query gpu_metrics at a faster rate and constantly
interrupt PMFW.
Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Asad Kamal <asad.kamal@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
index ff4447702b125..ff3b2c86b0c1c 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
@@ -2375,7 +2375,7 @@ static ssize_t arcturus_get_gpu_metrics(struct smu_context *smu,
ret = smu_cmn_get_metrics_table(smu,
&metrics,
- true);
+ false);
if (ret)
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 136/568] drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 135/568] drm/amd/pm: Use cached metrics data on arcturus Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 137/568] drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() Greg Kroah-Hartman
` (438 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sathishkumar S, Leo Liu,
Alex Deucher, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sathishkumar S <sathishkumar.sundararaju@amd.com>
[ Upstream commit 0e7581eda8c76d1ca4cf519631a4d4eb9f82b94c ]
Acquire jpeg_pg_lock before changes to jpeg power state
and release it after power off from idle work handler.
Signed-off-by: Sathishkumar S <sathishkumar.sundararaju@amd.com>
Reviewed-by: Leo Liu <leo.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
index 518eb0e40d32f..d5ae89876a061 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
@@ -85,10 +85,12 @@ static void amdgpu_jpeg_idle_work_handler(struct work_struct *work)
fences += amdgpu_fence_count_emitted(&adev->jpeg.inst[i].ring_dec);
}
- if (!fences && !atomic_read(&adev->jpeg.total_submission_cnt))
+ if (!fences && !atomic_read(&adev->jpeg.total_submission_cnt)) {
+ mutex_lock(&adev->jpeg.jpeg_pg_lock);
amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_JPEG,
AMD_PG_STATE_GATE);
- else
+ mutex_unlock(&adev->jpeg.jpeg_pg_lock);
+ } else
schedule_delayed_work(&adev->jpeg.idle_work, JPEG_IDLE_TIMEOUT);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 137/568] drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 136/568] drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 138/568] PCI: Disable MSI on RDC PCI to PCIe bridges Greg Kroah-Hartman
` (437 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Seyediman Seyedarab,
Danilo Krummrich, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seyediman Seyedarab <imandevel@gmail.com>
[ Upstream commit 6510b62fe9303aaf48ff136ff69186bcfc32172d ]
snprintf() returns the number of characters that *would* have been
written, which can overestimate how much you actually wrote to the
buffer in case of truncation. That leads to 'data += this' advancing
the pointer past the end of the buffer and size going negative.
Switching to scnprintf() prevents potential buffer overflows and ensures
consistent behavior when building the output string.
Signed-off-by: Seyediman Seyedarab <ImanDevel@gmail.com>
Link: https://lore.kernel.org/r/20250724195913.60742-1-ImanDevel@gmail.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nvkm/core/enum.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nvkm/core/enum.c b/drivers/gpu/drm/nouveau/nvkm/core/enum.c
index b9581feb24ccb..a23b40b27b81b 100644
--- a/drivers/gpu/drm/nouveau/nvkm/core/enum.c
+++ b/drivers/gpu/drm/nouveau/nvkm/core/enum.c
@@ -44,7 +44,7 @@ nvkm_snprintbf(char *data, int size, const struct nvkm_bitfield *bf, u32 value)
bool space = false;
while (size >= 1 && bf->name) {
if (value & bf->mask) {
- int this = snprintf(data, size, "%s%s",
+ int this = scnprintf(data, size, "%s%s",
space ? " " : "", bf->name);
size -= this;
data += this;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 138/568] PCI: Disable MSI on RDC PCI to PCIe bridges
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 137/568] drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 139/568] selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 Greg Kroah-Hartman
` (436 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marcos Del Sol Vives, Bjorn Helgaas,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcos Del Sol Vives <marcos@orca.pet>
[ Upstream commit ebc7086b39e5e4f3d3ca82caaea20538c9b62d42 ]
RDC PCI to PCIe bridges, present on Vortex86DX3 and Vortex86EX2 SoCs, do
not support MSIs. If enabled, interrupts generated by PCIe devices never
reach the processor.
I have contacted the manufacturer (DM&P) and they confirmed that PCI MSIs
need to be disabled for them.
Signed-off-by: Marcos Del Sol Vives <marcos@orca.pet>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20250705233209.721507-1-marcos@orca.pet
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/quirks.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index f4932d2f9f973..0772ce28cba41 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2604,6 +2604,7 @@ static void quirk_disable_msi(struct pci_dev *dev)
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8131_BRIDGE, quirk_disable_msi);
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0xa238, quirk_disable_msi);
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x5a3f, quirk_disable_msi);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_RDC, 0x1031, quirk_disable_msi);
/*
* The APC bridge device in AMD 780 family northbridges has some random
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 139/568] selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 138/568] PCI: Disable MSI on RDC PCI to PCIe bridges Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 140/568] selftests/net: Ensure assert() triggers in psock_tpacket.c Greg Kroah-Hartman
` (435 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wake Liu, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wake Liu <wakel@google.com>
[ Upstream commit c36748e8733ef9c5f4cd1d7c4327994e5b88b8df ]
The `__WORDSIZE` macro, defined in the non-standard `<bits/wordsize.h>`
header, is a GNU extension and not universally available with all
toolchains, such as Clang when used with musl libc.
This can lead to build failures in environments where this header is
missing.
The intention of the code is to determine the bit width of a C `long`.
Replace the non-portable `__WORDSIZE` with the standard and portable
`sizeof(long) * 8` expression to achieve the same result.
This change also removes the inclusion of the now-unused
`<bits/wordsize.h>` header.
Signed-off-by: Wake Liu <wakel@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/psock_tpacket.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/tools/testing/selftests/net/psock_tpacket.c b/tools/testing/selftests/net/psock_tpacket.c
index 404a2ce759ab6..93092d13b3c59 100644
--- a/tools/testing/selftests/net/psock_tpacket.c
+++ b/tools/testing/selftests/net/psock_tpacket.c
@@ -33,7 +33,6 @@
#include <ctype.h>
#include <fcntl.h>
#include <unistd.h>
-#include <bits/wordsize.h>
#include <net/ethernet.h>
#include <netinet/ip.h>
#include <arpa/inet.h>
@@ -785,7 +784,7 @@ static int test_kernel_bit_width(void)
static int test_user_bit_width(void)
{
- return __WORDSIZE;
+ return sizeof(long) * 8;
}
static const char *tpacket_str[] = {
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 140/568] selftests/net: Ensure assert() triggers in psock_tpacket.c
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 139/568] selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 141/568] drm/amdkfd: return -ENOTTY for unsupported IOCTLs Greg Kroah-Hartman
` (434 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wake Liu, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wake Liu <wakel@google.com>
[ Upstream commit bc4c0a48bdad7f225740b8e750fdc1da6d85e1eb ]
The get_next_frame() function in psock_tpacket.c was missing a return
statement in its default switch case, leading to a compiler warning.
This was caused by a `bug_on(1)` call, which is defined as an
`assert()`, being compiled out because NDEBUG is defined during the
build.
Instead of adding a `return NULL;` which would silently hide the error
and could lead to crashes later, this change restores the original
author's intent. By adding `#undef NDEBUG` before including <assert.h>,
we ensure the assertion is active and will cause the test to abort if
this unreachable code is ever executed.
Signed-off-by: Wake Liu <wakel@google.com>
Link: https://patch.msgid.link/20250809062013.2407822-1-wakel@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/psock_tpacket.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/testing/selftests/net/psock_tpacket.c b/tools/testing/selftests/net/psock_tpacket.c
index 93092d13b3c59..ca0d9a5a9e08c 100644
--- a/tools/testing/selftests/net/psock_tpacket.c
+++ b/tools/testing/selftests/net/psock_tpacket.c
@@ -22,6 +22,7 @@
* - TPACKET_V3: RX_RING
*/
+#undef NDEBUG
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 141/568] drm/amdkfd: return -ENOTTY for unsupported IOCTLs
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 140/568] selftests/net: Ensure assert() triggers in psock_tpacket.c Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 142/568] media: pci: ivtv: Dont create fake v4l2_fh Greg Kroah-Hartman
` (433 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geoffrey McRae, Alex Deucher,
Felix Kuehling, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geoffrey McRae <geoffrey.mcrae@amd.com>
[ Upstream commit 57af162bfc8c05332a28c4d458d246cc46d2746d ]
Some kfd ioctls may not be available depending on the kernel version the
user is running, as such we need to report -ENOTTY so userland can
determine the cause of the ioctl failure.
Signed-off-by: Geoffrey McRae <geoffrey.mcrae@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 773913a7d6e90..c1cb91a79b796 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -2790,8 +2790,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
int retcode = -EINVAL;
bool ptrace_attached = false;
- if (nr >= AMDKFD_CORE_IOCTL_COUNT)
+ if (nr >= AMDKFD_CORE_IOCTL_COUNT) {
+ retcode = -ENOTTY;
goto err_i1;
+ }
if ((nr >= AMDKFD_COMMAND_START) && (nr < AMDKFD_COMMAND_END)) {
u32 amdkfd_size;
@@ -2804,8 +2806,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
asize = amdkfd_size;
cmd = ioctl->cmd;
- } else
+ } else {
+ retcode = -ENOTTY;
goto err_i1;
+ }
dev_dbg(kfd_device, "ioctl cmd 0x%x (#0x%x), arg 0x%lx\n", cmd, nr, arg);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 142/568] media: pci: ivtv: Dont create fake v4l2_fh
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 141/568] drm/amdkfd: return -ENOTTY for unsupported IOCTLs Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 143/568] media: amphion: Delete v4l2_fh synchronously in .release() Greg Kroah-Hartman
` (432 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laurent Pinchart, Hans Verkuil,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
[ Upstream commit cc6e8d1ccea792d8550428e0831e3a35b0ccfddc ]
The ivtv driver has a structure named ivtv_open_id that models an open
file handle for the device. It embeds a v4l2_fh instance for file
handles that correspond to a V4L2 video device, and stores a pointer to
that v4l2_fh in struct ivtv_stream to identify which open file handle
owns a particular stream.
In addition to video devices, streams can be owned by ALSA PCM devices.
Those devices do not make use of the v4l2_fh instance for obvious
reasons, but the snd_ivtv_pcm_capture_open() function still initializes
a "fake" v4l2_fh for the sole purpose of using it as an open file handle
identifier. The v4l2_fh is not properly destroyed when the ALSA PCM
device is closed, leading to possible resource leaks.
Fortunately, the v4l2_fh instance pointed to by ivtv_stream is not
accessed, only the pointer value is used for comparison. Replace it with
a pointer to the ivtv_open_id structure that embeds the v4l2_fh, and
don't initialize the v4l2_fh for ALSA PCM devices.
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/ivtv/ivtv-alsa-pcm.c | 2 --
drivers/media/pci/ivtv/ivtv-driver.h | 3 ++-
drivers/media/pci/ivtv/ivtv-fileops.c | 18 +++++++++---------
drivers/media/pci/ivtv/ivtv-irq.c | 4 ++--
4 files changed, 13 insertions(+), 14 deletions(-)
diff --git a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
index 8f346d7da9c8d..269a799ec046c 100644
--- a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
+++ b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
@@ -148,14 +148,12 @@ static int snd_ivtv_pcm_capture_open(struct snd_pcm_substream *substream)
s = &itv->streams[IVTV_ENC_STREAM_TYPE_PCM];
- v4l2_fh_init(&item.fh, &s->vdev);
item.itv = itv;
item.type = s->type;
/* See if the stream is available */
if (ivtv_claim_stream(&item, item.type)) {
/* No, it's already in use */
- v4l2_fh_exit(&item.fh);
snd_ivtv_unlock(itvsc);
return -EBUSY;
}
diff --git a/drivers/media/pci/ivtv/ivtv-driver.h b/drivers/media/pci/ivtv/ivtv-driver.h
index ce3a7ca51736e..df2dcef1af3f0 100644
--- a/drivers/media/pci/ivtv/ivtv-driver.h
+++ b/drivers/media/pci/ivtv/ivtv-driver.h
@@ -322,6 +322,7 @@ struct ivtv_queue {
};
struct ivtv; /* forward reference */
+struct ivtv_open_id;
struct ivtv_stream {
/* These first four fields are always set, even if the stream
@@ -331,7 +332,7 @@ struct ivtv_stream {
const char *name; /* name of the stream */
int type; /* stream type */
- struct v4l2_fh *fh; /* pointer to the streaming filehandle */
+ struct ivtv_open_id *id; /* pointer to the streaming ivtv_open_id */
spinlock_t qlock; /* locks access to the queues */
unsigned long s_flags; /* status flags, see above */
int dma; /* can be PCI_DMA_TODEVICE, PCI_DMA_FROMDEVICE or PCI_DMA_NONE */
diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
index 4202c3a47d33e..7ed0d2d85253e 100644
--- a/drivers/media/pci/ivtv/ivtv-fileops.c
+++ b/drivers/media/pci/ivtv/ivtv-fileops.c
@@ -38,16 +38,16 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)
if (test_and_set_bit(IVTV_F_S_CLAIMED, &s->s_flags)) {
/* someone already claimed this stream */
- if (s->fh == &id->fh) {
+ if (s->id == id) {
/* yes, this file descriptor did. So that's OK. */
return 0;
}
- if (s->fh == NULL && (type == IVTV_DEC_STREAM_TYPE_VBI ||
+ if (s->id == NULL && (type == IVTV_DEC_STREAM_TYPE_VBI ||
type == IVTV_ENC_STREAM_TYPE_VBI)) {
/* VBI is handled already internally, now also assign
the file descriptor to this stream for external
reading of the stream. */
- s->fh = &id->fh;
+ s->id = id;
IVTV_DEBUG_INFO("Start Read VBI\n");
return 0;
}
@@ -55,7 +55,7 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)
IVTV_DEBUG_INFO("Stream %d is busy\n", type);
return -EBUSY;
}
- s->fh = &id->fh;
+ s->id = id;
if (type == IVTV_DEC_STREAM_TYPE_VBI) {
/* Enable reinsertion interrupt */
ivtv_clear_irq_mask(itv, IVTV_IRQ_DEC_VBI_RE_INSERT);
@@ -93,7 +93,7 @@ void ivtv_release_stream(struct ivtv_stream *s)
struct ivtv *itv = s->itv;
struct ivtv_stream *s_vbi;
- s->fh = NULL;
+ s->id = NULL;
if ((s->type == IVTV_DEC_STREAM_TYPE_VBI || s->type == IVTV_ENC_STREAM_TYPE_VBI) &&
test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) {
/* this stream is still in use internally */
@@ -125,7 +125,7 @@ void ivtv_release_stream(struct ivtv_stream *s)
/* was already cleared */
return;
}
- if (s_vbi->fh) {
+ if (s_vbi->id) {
/* VBI stream still claimed by a file descriptor */
return;
}
@@ -349,7 +349,7 @@ static ssize_t ivtv_read(struct ivtv_stream *s, char __user *ubuf, size_t tot_co
size_t tot_written = 0;
int single_frame = 0;
- if (atomic_read(&itv->capturing) == 0 && s->fh == NULL) {
+ if (atomic_read(&itv->capturing) == 0 && s->id == NULL) {
/* shouldn't happen */
IVTV_DEBUG_WARN("Stream %s not initialized before read\n", s->name);
return -EIO;
@@ -819,7 +819,7 @@ void ivtv_stop_capture(struct ivtv_open_id *id, int gop_end)
id->type == IVTV_ENC_STREAM_TYPE_VBI) &&
test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) {
/* Also used internally, don't stop capturing */
- s->fh = NULL;
+ s->id = NULL;
}
else {
ivtv_stop_v4l2_encode_stream(s, gop_end);
@@ -903,7 +903,7 @@ int ivtv_v4l2_close(struct file *filp)
v4l2_fh_exit(fh);
/* Easy case first: this stream was never claimed by us */
- if (s->fh != &id->fh)
+ if (s->id != id)
goto close_done;
/* 'Unclaim' this stream */
diff --git a/drivers/media/pci/ivtv/ivtv-irq.c b/drivers/media/pci/ivtv/ivtv-irq.c
index e39bf64c5c715..404335e5aff4e 100644
--- a/drivers/media/pci/ivtv/ivtv-irq.c
+++ b/drivers/media/pci/ivtv/ivtv-irq.c
@@ -305,7 +305,7 @@ static void dma_post(struct ivtv_stream *s)
ivtv_process_vbi_data(itv, buf, 0, s->type);
s->q_dma.bytesused += buf->bytesused;
}
- if (s->fh == NULL) {
+ if (s->id == NULL) {
ivtv_queue_move(s, &s->q_dma, NULL, &s->q_free, 0);
return;
}
@@ -330,7 +330,7 @@ static void dma_post(struct ivtv_stream *s)
set_bit(IVTV_F_I_HAVE_WORK, &itv->i_flags);
}
- if (s->fh)
+ if (s->id)
wake_up(&s->waitq);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 143/568] media: amphion: Delete v4l2_fh synchronously in .release()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 142/568] media: pci: ivtv: Dont create fake v4l2_fh Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 144/568] drm/tidss: Use the crtc_* timings when programming the HW Greg Kroah-Hartman
` (431 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laurent Pinchart, Ming Qian,
Hans Verkuil, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
[ Upstream commit 19fb9c5b815f70eb90d5b545f65b83bc9c490ecd ]
The v4l2_fh initialized and added in vpu_v4l2_open() is delete and
cleaned up when the last reference to the vpu_inst is released. This may
happen later than at vpu_v4l2_close() time.
Not deleting and cleaning up the v4l2_fh when closing the file handle to
the video device is not ideal, as the v4l2_fh will still be present in
the video device's fh_list, and will store a copy of events queued to
the video device. There may also be other side effects of keeping alive
an object that represents an open file handle after the file handle is
closed.
The v4l2_fh instance is embedded in the vpu_inst structure, and is
accessed in two different ways:
- in vpu_notify_eos() and vpu_notify_source_change(), to queue V4L2
events to the file handle ; and
- through the driver to access the v4l2_fh.m2m_ctx pointer.
The v4l2_fh.m2m_ctx pointer is not touched by v4l2_fh_del() and
v4l2_fh_exit(). It is set to NULL by the driver when closing the file
handle, in vpu_v4l2_close().
The vpu_notify_eos() and vpu_notify_source_change() functions are called
in vpu_set_last_buffer_dequeued() and vdec_handle_resolution_change()
respectively, only if the v4l2_fh.m2m_ctx pointer is not NULL. There is
therefore a guarantee that no new event will be queued to the v4l2_fh
after vpu_v4l2_close() destroys the m2m_ctx.
The vpu_notify_eos() function is also called from vpu_vb2_buf_finish(),
which is guaranteed to be called for all queued buffers when
vpu_v4l2_close() calls v4l2_m2m_ctx_release(), and will not be called
later.
It is therefore safe to assume that the driver will not touch the
v4l2_fh, except to check the m2m_ctx pointer, after vpu_v4l2_close()
destroys the m2m_ctx. We can safely delete and cleanup the v4l2_fh
synchronously in vpu_v4l2_close().
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Ming Qian <ming.qian@oss.nxp.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/amphion/vpu_v4l2.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/amphion/vpu_v4l2.c b/drivers/media/platform/amphion/vpu_v4l2.c
index 19189d7449dc8..30aebefddc9c9 100644
--- a/drivers/media/platform/amphion/vpu_v4l2.c
+++ b/drivers/media/platform/amphion/vpu_v4l2.c
@@ -608,8 +608,6 @@ static int vpu_v4l2_release(struct vpu_inst *inst)
v4l2_ctrl_handler_free(&inst->ctrl_handler);
mutex_destroy(&inst->lock);
- v4l2_fh_del(&inst->fh);
- v4l2_fh_exit(&inst->fh);
call_void_vop(inst, cleanup);
@@ -678,6 +676,8 @@ int vpu_v4l2_open(struct file *file, struct vpu_inst *inst)
return 0;
error:
+ v4l2_fh_del(&inst->fh);
+ v4l2_fh_exit(&inst->fh);
vpu_inst_put(inst);
return ret;
}
@@ -697,6 +697,9 @@ int vpu_v4l2_close(struct file *file)
call_void_vop(inst, release);
vpu_inst_unlock(inst);
+ v4l2_fh_del(&inst->fh);
+ v4l2_fh_exit(&inst->fh);
+
vpu_inst_unregister(inst);
vpu_inst_put(inst);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 144/568] drm/tidss: Use the crtc_* timings when programming the HW
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 143/568] media: amphion: Delete v4l2_fh synchronously in .release() Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 145/568] drm/tidss: Set crtc modesetting parameters with adjusted mode Greg Kroah-Hartman
` (430 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aradhya Bhatia, Parth Pancholi,
Jayesh Choudhary, Devarsh Thakkar, Tomi Valkeinen, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
[ Upstream commit 478306edc23eec4f0ec24a46222485910c66212d ]
Use the crtc_* fields from drm_display_mode, instead of the "logical"
fields. This shouldn't change anything in practice, but afaiu the crtc_*
fields are the correct ones to use here.
Reviewed-by: Aradhya Bhatia <aradhya.bhatia@linux.dev>
Tested-by: Parth Pancholi <parth.pancholi@toradex.com>
Tested-by: Jayesh Choudhary <j-choudhary@ti.com>
Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-3-e61cc06074c2@ideasonboard.com
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tidss/tidss_crtc.c | 2 +-
drivers/gpu/drm/tidss/tidss_dispc.c | 16 ++++++++--------
2 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/tidss/tidss_crtc.c b/drivers/gpu/drm/tidss/tidss_crtc.c
index 896a77853ebc5..f33d2b7fc1b7e 100644
--- a/drivers/gpu/drm/tidss/tidss_crtc.c
+++ b/drivers/gpu/drm/tidss/tidss_crtc.c
@@ -230,7 +230,7 @@ static void tidss_crtc_atomic_enable(struct drm_crtc *crtc,
tidss_runtime_get(tidss);
r = dispc_vp_set_clk_rate(tidss->dispc, tcrtc->hw_videoport,
- mode->clock * 1000);
+ mode->crtc_clock * 1000);
if (r != 0)
return;
diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
index 38b2ae0d7ec1d..0fd79446eaab7 100644
--- a/drivers/gpu/drm/tidss/tidss_dispc.c
+++ b/drivers/gpu/drm/tidss/tidss_dispc.c
@@ -981,13 +981,13 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport,
dispc_set_num_datalines(dispc, hw_videoport, fmt->data_width);
- hfp = mode->hsync_start - mode->hdisplay;
- hsw = mode->hsync_end - mode->hsync_start;
- hbp = mode->htotal - mode->hsync_end;
+ hfp = mode->crtc_hsync_start - mode->crtc_hdisplay;
+ hsw = mode->crtc_hsync_end - mode->crtc_hsync_start;
+ hbp = mode->crtc_htotal - mode->crtc_hsync_end;
- vfp = mode->vsync_start - mode->vdisplay;
- vsw = mode->vsync_end - mode->vsync_start;
- vbp = mode->vtotal - mode->vsync_end;
+ vfp = mode->crtc_vsync_start - mode->crtc_vdisplay;
+ vsw = mode->crtc_vsync_end - mode->crtc_vsync_start;
+ vbp = mode->crtc_vtotal - mode->crtc_vsync_end;
dispc_vp_write(dispc, hw_videoport, DISPC_VP_TIMING_H,
FLD_VAL(hsw - 1, 7, 0) |
@@ -1029,8 +1029,8 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport,
FLD_VAL(ivs, 12, 12));
dispc_vp_write(dispc, hw_videoport, DISPC_VP_SIZE_SCREEN,
- FLD_VAL(mode->hdisplay - 1, 11, 0) |
- FLD_VAL(mode->vdisplay - 1, 27, 16));
+ FLD_VAL(mode->crtc_hdisplay - 1, 11, 0) |
+ FLD_VAL(mode->crtc_vdisplay - 1, 27, 16));
VP_REG_FLD_MOD(dispc, hw_videoport, DISPC_VP_CONTROL, 1, 0, 0);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 145/568] drm/tidss: Set crtc modesetting parameters with adjusted mode
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 144/568] drm/tidss: Use the crtc_* timings when programming the HW Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 146/568] media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR Greg Kroah-Hartman
` (429 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tomi Valkeinen, Jayesh Choudhary,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jayesh Choudhary <j-choudhary@ti.com>
[ Upstream commit cfb29225db20c56432a8525366321c0c09edfb2e ]
TIDSS uses crtc_* fields to propagate its registers and set the
clock rates. So set the CRTC modesetting timing parameters with
the adjusted mode when needed, to set correct values.
Cc: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Jayesh Choudhary <j-choudhary@ti.com>
Link: https://lore.kernel.org/r/20250624080402.302526-1-j-choudhary@ti.com
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tidss/tidss_crtc.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/tidss/tidss_crtc.c b/drivers/gpu/drm/tidss/tidss_crtc.c
index f33d2b7fc1b7e..b56d0d78edfd2 100644
--- a/drivers/gpu/drm/tidss/tidss_crtc.c
+++ b/drivers/gpu/drm/tidss/tidss_crtc.c
@@ -92,7 +92,7 @@ static int tidss_crtc_atomic_check(struct drm_crtc *crtc,
struct dispc_device *dispc = tidss->dispc;
struct tidss_crtc *tcrtc = to_tidss_crtc(crtc);
u32 hw_videoport = tcrtc->hw_videoport;
- const struct drm_display_mode *mode;
+ struct drm_display_mode *mode;
enum drm_mode_status ok;
dev_dbg(ddev->dev, "%s\n", __func__);
@@ -109,6 +109,9 @@ static int tidss_crtc_atomic_check(struct drm_crtc *crtc,
return -EINVAL;
}
+ if (drm_atomic_crtc_needs_modeset(crtc_state))
+ drm_mode_set_crtcinfo(mode, 0);
+
return dispc_vp_bus_check(dispc, hw_videoport, crtc_state);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 146/568] media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 145/568] drm/tidss: Set crtc modesetting parameters with adjusted mode Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 147/568] x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall Greg Kroah-Hartman
` (428 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mehdi Djait, Arnd Bergmann,
Sakari Ailus, Hans Verkuil, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mehdi Djait <mehdi.djait@linux.intel.com>
[ Upstream commit 2d240b124cc9df62ccccee6054bc3d1d19018758 ]
Both ACPI and DT-based systems are required to obtain the external
camera sensor clock using the new devm_v4l2_sensor_clk_get() helper
function.
Ensure a dependency on HAVE_CLK when config VIDEO_CAMERA_SENSOR is
enabled.
Signed-off-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
index a34afb5217ebc..5c7ca13210871 100644
--- a/drivers/media/i2c/Kconfig
+++ b/drivers/media/i2c/Kconfig
@@ -27,7 +27,7 @@ config VIDEO_IR_I2C
menuconfig VIDEO_CAMERA_SENSOR
bool "Camera sensor devices"
- depends on MEDIA_CAMERA_SUPPORT && I2C
+ depends on MEDIA_CAMERA_SUPPORT && I2C && HAVE_CLK
select MEDIA_CONTROLLER
select V4L2_FWNODE
select VIDEO_V4L2_SUBDEV_API
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 147/568] x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 146/568] media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 148/568] net: stmmac: Check stmmac_hw_setup() in stmmac_resume() Greg Kroah-Hartman
` (427 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrew Cooper, Kirill A. Shutemov,
Dave Hansen, Sasha Levin, Dave Hansen
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
[ Upstream commit 8ba38a7a9a699905b84fa97578a8291010dec273 ]
emulate_vsyscall() expects to see X86_PF_INSTR in PFEC on a vsyscall
page fault, but the CPU does not report X86_PF_INSTR if neither
X86_FEATURE_NX nor X86_FEATURE_SMEP are enabled.
X86_FEATURE_NX should be enabled on nearly all 64-bit CPUs, except for
early P4 processors that did not support this feature.
Instead of explicitly checking for X86_PF_INSTR, compare the fault
address to RIP.
On machines with X86_FEATURE_NX enabled, issue a warning if RIP is equal
to fault address but X86_PF_INSTR is absent.
[ dhansen: flesh out code comments ]
Originally-by: Dave Hansen <dave.hansen@intel.com>
Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Link: https://lore.kernel.org/all/bd81a98b-f8d4-4304-ac55-d4151a1a77ab@intel.com
Link: https://lore.kernel.org/all/20250624145918.2720487-1-kirill.shutemov%40linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/entry/vsyscall/vsyscall_64.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
index 5d4ca8b942939..9404f9f416660 100644
--- a/arch/x86/entry/vsyscall/vsyscall_64.c
+++ b/arch/x86/entry/vsyscall/vsyscall_64.c
@@ -124,7 +124,12 @@ bool emulate_vsyscall(unsigned long error_code,
if ((error_code & (X86_PF_WRITE | X86_PF_USER)) != X86_PF_USER)
return false;
- if (!(error_code & X86_PF_INSTR)) {
+ /*
+ * Assume that faults at regs->ip are because of an
+ * instruction fetch. Return early and avoid
+ * emulation for faults during data accesses:
+ */
+ if (address != regs->ip) {
/* Failed vsyscall read */
if (vsyscall_mode == EMULATE)
return false;
@@ -136,13 +141,19 @@ bool emulate_vsyscall(unsigned long error_code,
return false;
}
+ /*
+ * X86_PF_INSTR is only set when NX is supported. When
+ * available, use it to double-check that the emulation code
+ * is only being used for instruction fetches:
+ */
+ if (cpu_feature_enabled(X86_FEATURE_NX))
+ WARN_ON_ONCE(!(error_code & X86_PF_INSTR));
+
/*
* No point in checking CS -- the only way to get here is a user mode
* trap to a high address, which means that we're in 64-bit user code.
*/
- WARN_ON_ONCE(address != regs->ip);
-
if (vsyscall_mode == NONE) {
warn_bad_vsyscall(KERN_INFO, regs,
"vsyscall attempted with vsyscall=none");
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 148/568] net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 147/568] x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 149/568] ice: Dont use %pK through printk or tracepoints Greg Kroah-Hartman
` (426 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tiezhu Yang, Maxime Chevallier,
Huacai Chen, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit 6896c2449a1858acb643014894d01b3a1223d4e5 ]
stmmac_hw_setup() may return 0 on success and an appropriate negative
integer as defined in errno.h file on failure, just check it and then
return early if failed in stmmac_resume().
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
Link: https://patch.msgid.link/20250811073506.27513-2-yangtiezhu@loongson.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index be84aed471603..03fbb611b2a67 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -7589,7 +7589,14 @@ int stmmac_resume(struct device *dev)
stmmac_free_tx_skbufs(priv);
stmmac_clear_descriptors(priv, &priv->dma_conf);
- stmmac_hw_setup(ndev, false);
+ ret = stmmac_hw_setup(ndev, false);
+ if (ret < 0) {
+ netdev_err(priv->dev, "%s: Hw setup failed\n", __func__);
+ mutex_unlock(&priv->lock);
+ rtnl_unlock();
+ return ret;
+ }
+
stmmac_init_coalesce(priv);
stmmac_set_rx_mode(ndev);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 149/568] ice: Dont use %pK through printk or tracepoints
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 148/568] net: stmmac: Check stmmac_hw_setup() in stmmac_resume() Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 150/568] thunderbolt: Use is_pciehp instead of is_hotplug_bridge Greg Kroah-Hartman
` (425 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh,
Przemek Kitszel, Aleksandr Loktionov, Simon Horman, Paul Menzel,
Jacob Keller, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit 66ceb45b7d7e9673254116eefe5b6d3a44eba267 ]
In the past %pK was preferable to %p as it would not leak raw pointer
values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
the regular %p has been improved to avoid this issue.
Furthermore, restricted pointers ("%pK") were never meant to be used
through printk(). They can still unintentionally leak raw pointers or
acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and
easier to reason about.
There are still a few users of %pK left, but these use it through seq_file,
for which its usage is safe.
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Acked-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20250811-restricted-pointers-net-v5-1-2e2fdc7d3f2c@linutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_main.c | 2 +-
drivers/net/ethernet/intel/ice/ice_trace.h | 10 +++++-----
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index 9be88820b77c3..9a540b85756f4 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -8609,7 +8609,7 @@ static int ice_create_q_channels(struct ice_vsi *vsi)
list_add_tail(&ch->list, &vsi->ch_list);
vsi->tc_map_vsi[i] = ch->ch_vsi;
dev_dbg(ice_pf_to_dev(pf),
- "successfully created channel: VSI %pK\n", ch->ch_vsi);
+ "successfully created channel: VSI %p\n", ch->ch_vsi);
}
return 0;
diff --git a/drivers/net/ethernet/intel/ice/ice_trace.h b/drivers/net/ethernet/intel/ice/ice_trace.h
index ae98d5a8ff60e..ab76d4bb9aea8 100644
--- a/drivers/net/ethernet/intel/ice/ice_trace.h
+++ b/drivers/net/ethernet/intel/ice/ice_trace.h
@@ -129,7 +129,7 @@ DECLARE_EVENT_CLASS(ice_tx_template,
__entry->buf = buf;
__assign_str(devname, ring->netdev->name);),
- TP_printk("netdev: %s ring: %pK desc: %pK buf %pK", __get_str(devname),
+ TP_printk("netdev: %s ring: %p desc: %p buf %p", __get_str(devname),
__entry->ring, __entry->desc, __entry->buf)
);
@@ -157,7 +157,7 @@ DECLARE_EVENT_CLASS(ice_rx_template,
__entry->desc = desc;
__assign_str(devname, ring->netdev->name);),
- TP_printk("netdev: %s ring: %pK desc: %pK", __get_str(devname),
+ TP_printk("netdev: %s ring: %p desc: %p", __get_str(devname),
__entry->ring, __entry->desc)
);
DEFINE_EVENT(ice_rx_template, ice_clean_rx_irq,
@@ -181,7 +181,7 @@ DECLARE_EVENT_CLASS(ice_rx_indicate_template,
__entry->skb = skb;
__assign_str(devname, ring->netdev->name);),
- TP_printk("netdev: %s ring: %pK desc: %pK skb %pK", __get_str(devname),
+ TP_printk("netdev: %s ring: %p desc: %p skb %p", __get_str(devname),
__entry->ring, __entry->desc, __entry->skb)
);
@@ -204,7 +204,7 @@ DECLARE_EVENT_CLASS(ice_xmit_template,
__entry->skb = skb;
__assign_str(devname, ring->netdev->name);),
- TP_printk("netdev: %s skb: %pK ring: %pK", __get_str(devname),
+ TP_printk("netdev: %s skb: %p ring: %p", __get_str(devname),
__entry->skb, __entry->ring)
);
@@ -227,7 +227,7 @@ DECLARE_EVENT_CLASS(ice_tx_tstamp_template,
TP_fast_assign(__entry->skb = skb;
__entry->idx = idx;),
- TP_printk("skb %pK idx %d",
+ TP_printk("skb %p idx %d",
__entry->skb, __entry->idx)
);
#define DEFINE_TX_TSTAMP_OP_EVENT(name) \
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 150/568] thunderbolt: Use is_pciehp instead of is_hotplug_bridge
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 149/568] ice: Dont use %pK through printk or tracepoints Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 151/568] powerpc/eeh: Use result of error_detected() in uevent Greg Kroah-Hartman
` (424 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukas Wunner, Bjorn Helgaas,
Mika Westerberg, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
[ Upstream commit 5d03847175e81e86d4865456c15638faaf7c0634 ]
The thunderbolt driver sets up device link dependencies from hotplug ports
to the Host Router (aka Native Host Interface, NHI). When resuming from
system sleep, this allows the Host Router to re-establish tunnels to
attached Thunderbolt devices before the hotplug ports resume.
To identify the hotplug ports, the driver utilizes the is_hotplug_bridge
flag which also encompasses ACPI slots handled by the ACPI hotplug driver.
Thunderbolt hotplug ports are always Hot-Plug Capable PCIe ports, so it is
more apt to identify them with the is_pciehp flag.
Similarly, hotplug ports on older Thunderbolt controllers have broken MSI
support and are quirked to use legacy INTx interrupts instead. The quirk
identifies them with is_hotplug_bridge, even though all affected ports are
also matched by is_pciehp. So use is_pciehp here as well.
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/quirks.c | 2 +-
drivers/thunderbolt/tb.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 0772ce28cba41..e8cfae79a47a9 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3717,7 +3717,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcf80, quirk_no_pm_reset);
*/
static void quirk_thunderbolt_hotplug_msi(struct pci_dev *pdev)
{
- if (pdev->is_hotplug_bridge &&
+ if (pdev->is_pciehp &&
(pdev->device != PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C ||
pdev->revision <= 1))
pdev->no_msi = 1;
diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
index 0668e1645bc50..f417ce477d4a0 100644
--- a/drivers/thunderbolt/tb.c
+++ b/drivers/thunderbolt/tb.c
@@ -1888,7 +1888,7 @@ static void tb_apple_add_links(struct tb_nhi *nhi)
if (!pci_is_pcie(pdev))
continue;
if (pci_pcie_type(pdev) != PCI_EXP_TYPE_DOWNSTREAM ||
- !pdev->is_hotplug_bridge)
+ !pdev->is_pciehp)
continue;
link = device_link_add(&pdev->dev, &nhi->pdev->dev,
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 151/568] powerpc/eeh: Use result of error_detected() in uevent
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 150/568] thunderbolt: Use is_pciehp instead of is_hotplug_bridge Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 152/568] s390/pci: Use pci_uevent_ers() in PCI recovery Greg Kroah-Hartman
` (423 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukas Wunner, Niklas Schnelle,
Bjorn Helgaas, Kuppuswamy Sathyanarayanan, Mahesh Salgaonkar,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <schnelle@linux.ibm.com>
[ Upstream commit 704e5dd1c02371dfc7d22e1520102b197a3b628b ]
Ever since uevent support was added for AER and EEH with commit
856e1eb9bdd4 ("PCI/AER: Add uevents in AER and EEH error/resume"), it
reported PCI_ERS_RESULT_NONE as uevent when recovery begins.
Commit 7b42d97e99d3 ("PCI/ERR: Always report current recovery status for
udev") subsequently amended AER to report the actual return value of
error_detected().
Make the same change to EEH to align it with AER and s390.
Suggested-by: Lukas Wunner <lukas@wunner.de>
Link: https://lore.kernel.org/linux-pci/aIp6LiKJor9KLVpv@wunner.de/
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Acked-by: Mahesh Salgaonkar <mahesh@linux.ibm.com>
Link: https://patch.msgid.link/20250807-add_err_uevents-v5-3-adf85b0620b0@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/eeh_driver.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
index 429abaecad416..9a761f46c7b23 100644
--- a/arch/powerpc/kernel/eeh_driver.c
+++ b/arch/powerpc/kernel/eeh_driver.c
@@ -334,7 +334,7 @@ static enum pci_ers_result eeh_report_error(struct eeh_dev *edev,
rc = driver->err_handler->error_detected(pdev, pci_channel_io_frozen);
edev->in_error = true;
- pci_uevent_ers(pdev, PCI_ERS_RESULT_NONE);
+ pci_uevent_ers(pdev, rc);
return rc;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 152/568] s390/pci: Use pci_uevent_ers() in PCI recovery
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 151/568] powerpc/eeh: Use result of error_detected() in uevent Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 153/568] bridge: Redirect to backup port when port is administratively down Greg Kroah-Hartman
` (422 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Schnelle, Bjorn Helgaas,
Lukas Wunner, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <schnelle@linux.ibm.com>
[ Upstream commit dab32f2576a39d5f54f3dbbbc718d92fa5109ce9 ]
Issue uevents on s390 during PCI recovery using pci_uevent_ers() as done by
EEH and AER PCIe recovery routines.
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Link: https://patch.msgid.link/20250807-add_err_uevents-v5-2-adf85b0620b0@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/pci/pci_event.c | 3 +++
drivers/pci/pci-driver.c | 2 +-
include/linux/pci.h | 2 +-
3 files changed, 5 insertions(+), 2 deletions(-)
--- a/arch/s390/pci/pci_event.c
+++ b/arch/s390/pci/pci_event.c
@@ -83,6 +83,7 @@ static pci_ers_result_t zpci_event_notif
pci_ers_result_t ers_res = PCI_ERS_RESULT_DISCONNECT;
ers_res = driver->err_handler->error_detected(pdev, pdev->error_state);
+ pci_uevent_ers(pdev, ers_res);
if (ers_result_indicates_abort(ers_res))
pr_info("%s: Automatic recovery failed after initial reporting\n", pci_name(pdev));
else if (ers_res == PCI_ERS_RESULT_NEED_RESET)
@@ -212,6 +213,7 @@ static pci_ers_result_t zpci_event_attem
ers_res = zpci_event_do_reset(pdev, driver);
if (ers_res != PCI_ERS_RESULT_RECOVERED) {
+ pci_uevent_ers(pdev, PCI_ERS_RESULT_DISCONNECT);
pr_err("%s: Automatic recovery failed; operator intervention is required\n",
pci_name(pdev));
goto out_unlock;
@@ -220,6 +222,7 @@ static pci_ers_result_t zpci_event_attem
pr_info("%s: The device is ready to resume operations\n", pci_name(pdev));
if (driver->err_handler->resume)
driver->err_handler->resume(pdev);
+ pci_uevent_ers(pdev, PCI_ERS_RESULT_RECOVERED);
out_unlock:
device_unlock(&pdev->dev);
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -1597,7 +1597,7 @@ static int pci_uevent(struct device *dev
return 0;
}
-#if defined(CONFIG_PCIEAER) || defined(CONFIG_EEH)
+#if defined(CONFIG_PCIEAER) || defined(CONFIG_EEH) || defined(CONFIG_S390)
/**
* pci_uevent_ers - emit a uevent during recovery path of PCI device
* @pdev: PCI device undergoing error recovery
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -2561,7 +2561,7 @@ static inline bool pci_is_thunderbolt_at
return false;
}
-#if defined(CONFIG_PCIEPORTBUS) || defined(CONFIG_EEH)
+#if defined(CONFIG_PCIEPORTBUS) || defined(CONFIG_EEH) || defined(CONFIG_S390)
void pci_uevent_ers(struct pci_dev *pdev, enum pci_ers_result err_type);
#endif
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 153/568] bridge: Redirect to backup port when port is administratively down
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 152/568] s390/pci: Use pci_uevent_ers() in PCI recovery Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 154/568] scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change Greg Kroah-Hartman
` (421 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Machata, Ido Schimmel,
Nikolay Aleksandrov, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <idosch@nvidia.com>
[ Upstream commit 3d05b24429e1de7a17c8fdccb04a04dbc8ad297b ]
If a backup port is configured for a bridge port, the bridge will
redirect known unicast traffic towards the backup port when the primary
port is administratively up but without a carrier. This is useful, for
example, in MLAG configurations where a system is connected to two
switches and there is a peer link between both switches. The peer link
serves as the backup port in case one of the switches loses its
connection to the multi-homed system.
In order to avoid flooding when the primary port loses its carrier, the
bridge does not flush dynamic FDB entries pointing to the port upon STP
disablement, if the port has a backup port.
The above means that known unicast traffic destined to the primary port
will be blackholed when the port is put administratively down, until the
FDB entries pointing to it are aged-out.
Given that the current behavior is quite weird and unlikely to be
depended on by anyone, amend the bridge to redirect to the backup port
also when the primary port is administratively down and not only when it
does not have a carrier.
The change is motivated by a report from a user who expected traffic to
be redirected to the backup port when the primary port was put
administratively down while debugging a network issue.
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20250812080213.325298-2-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bridge/br_forward.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index a32d73f381558..d3257c9bfa920 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -148,7 +148,8 @@ void br_forward(const struct net_bridge_port *to,
goto out;
/* redirect to backup link if the destination port is down */
- if (rcu_access_pointer(to->backup_port) && !netif_carrier_ok(to->dev)) {
+ if (rcu_access_pointer(to->backup_port) &&
+ (!netif_carrier_ok(to->dev) || !netif_running(to->dev))) {
struct net_bridge_port *backup_port;
backup_port = rcu_dereference(to->backup_port);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 154/568] scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 153/568] bridge: Redirect to backup port when port is administratively down Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 155/568] scsi: ufs: host: mediatek: Change reset sequence for improved stability Greg Kroah-Hartman
` (420 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alice Chao, Peter Wang,
Martin K. Petersen, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Chao <alice.chao@mediatek.com>
[ Upstream commit 979feee0cf43b32d288931649d7c6d9a5524ea55 ]
Assign power mode userdata settings before transitioning to FASTAUTO
power mode. This ensures that default timeout values are set for various
parameters, enhancing the reliability and performance of the power mode
change process.
Signed-off-by: Alice Chao <alice.chao@mediatek.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Signed-off-by: Peter Wang <peter.wang@mediatek.com>
Link: https://lore.kernel.org/r/20250811131423.3444014-7-peter.wang@mediatek.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/host/ufs-mediatek.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
index 7309f3f87eacf..023ded88acef8 100644
--- a/drivers/ufs/host/ufs-mediatek.c
+++ b/drivers/ufs/host/ufs-mediatek.c
@@ -991,6 +991,28 @@ static int ufs_mtk_pre_pwr_change(struct ufs_hba *hba,
ufshcd_dme_set(hba, UIC_ARG_MIB(PA_TXHSADAPTTYPE),
PA_NO_ADAPT);
+ if (!(hba->quirks & UFSHCD_QUIRK_SKIP_DEF_UNIPRO_TIMEOUT_SETTING)) {
+ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA0),
+ DL_FC0ProtectionTimeOutVal_Default);
+ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA1),
+ DL_TC0ReplayTimeOutVal_Default);
+ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA2),
+ DL_AFC0ReqTimeOutVal_Default);
+ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA3),
+ DL_FC1ProtectionTimeOutVal_Default);
+ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA4),
+ DL_TC1ReplayTimeOutVal_Default);
+ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA5),
+ DL_AFC1ReqTimeOutVal_Default);
+
+ ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalFC0ProtectionTimeOutVal),
+ DL_FC0ProtectionTimeOutVal_Default);
+ ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalTC0ReplayTimeOutVal),
+ DL_TC0ReplayTimeOutVal_Default);
+ ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalAFC0ReqTimeOutVal),
+ DL_AFC0ReqTimeOutVal_Default);
+ }
+
ret = ufshcd_uic_change_pwr_mode(hba,
FASTAUTO_MODE << 4 | FASTAUTO_MODE);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 155/568] scsi: ufs: host: mediatek: Change reset sequence for improved stability
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 154/568] scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 156/568] scsi: ufs: host: mediatek: Fix invalid access in vccqx handling Greg Kroah-Hartman
` (419 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Wang, Martin K. Petersen,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Wang <peter.wang@mediatek.com>
[ Upstream commit 878ed88c50bfb14d972dd3b86a1c8188c58de4e5 ]
Modify the reset sequence to ensure that the device reset pin is set low
before the host is disabled. This change enhances the stability of the
reset process by ensuring the correct order of operations.
Signed-off-by: Peter Wang <peter.wang@mediatek.com>
Link: https://lore.kernel.org/r/20250811131423.3444014-10-peter.wang@mediatek.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/host/ufs-mediatek.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
index 023ded88acef8..df17e6d606ded 100644
--- a/drivers/ufs/host/ufs-mediatek.c
+++ b/drivers/ufs/host/ufs-mediatek.c
@@ -1158,11 +1158,11 @@ static int ufs_mtk_device_reset(struct ufs_hba *hba)
{
struct arm_smccc_res res;
- /* disable hba before device reset */
- ufshcd_hba_stop(hba);
-
ufs_mtk_device_reset_ctrl(0, res);
+ /* disable hba in middle of device reset */
+ ufshcd_hba_stop(hba);
+
/*
* The reset signal is active low. UFS devices shall detect
* more than or equal to 1us of positive or negative RST_n
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 156/568] scsi: ufs: host: mediatek: Fix invalid access in vccqx handling
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 155/568] scsi: ufs: host: mediatek: Change reset sequence for improved stability Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 157/568] net: ipv6: fix field-spanning memcpy warning in AH output Greg Kroah-Hartman
` (418 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alice Chao, Peter Wang,
Martin K. Petersen, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Chao <alice.chao@mediatek.com>
[ Upstream commit 5863638598f5e4f64d2f85b03f376383ca1f2ab7 ]
Add a NULL check before accessing the 'vccqx' pointer to prevent invalid
memory access. This ensures that the function safely handles cases where
'vccq' and 'vccq2' are not initialized, improving the robustness of the
power management code.
Signed-off-by: Alice Chao <alice.chao@mediatek.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Signed-off-by: Peter Wang <peter.wang@mediatek.com>
Link: https://lore.kernel.org/r/20250811131423.3444014-11-peter.wang@mediatek.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/host/ufs-mediatek.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
index df17e6d606ded..1c6348ee58092 100644
--- a/drivers/ufs/host/ufs-mediatek.c
+++ b/drivers/ufs/host/ufs-mediatek.c
@@ -1230,6 +1230,9 @@ static void ufs_mtk_vccqx_set_lpm(struct ufs_hba *hba, bool lpm)
{
struct ufs_vreg *vccqx = NULL;
+ if (!hba->vreg_info.vccq && !hba->vreg_info.vccq2)
+ return;
+
if (hba->vreg_info.vccq)
vccqx = hba->vreg_info.vccq;
else
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 157/568] net: ipv6: fix field-spanning memcpy warning in AH output
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 156/568] scsi: ufs: host: mediatek: Fix invalid access in vccqx handling Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 158/568] media: imon: make send_packet() more robust Greg Kroah-Hartman
` (417 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+01b0667934cdceb4451c,
Charalampos Mitrodimas, Steffen Klassert, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charalampos Mitrodimas <charmitro@posteo.net>
[ Upstream commit 2327a3d6f65ce2fe2634546dde4a25ef52296fec ]
Fix field-spanning memcpy warnings in ah6_output() and
ah6_output_done() where extension headers are copied to/from IPv6
address fields, triggering fortify-string warnings about writes beyond
the 16-byte address fields.
memcpy: detected field-spanning write (size 40) of single field "&top_iph->saddr" at net/ipv6/ah6.c:439 (size 16)
WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439
The warnings are false positives as the extension headers are
intentionally placed after the IPv6 header in memory. Fix by properly
copying addresses and extension headers separately, and introduce
helper functions to avoid code duplication.
Reported-by: syzbot+01b0667934cdceb4451c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=01b0667934cdceb4451c
Signed-off-by: Charalampos Mitrodimas <charmitro@posteo.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/ah6.c | 50 +++++++++++++++++++++++++++++++-------------------
1 file changed, 31 insertions(+), 19 deletions(-)
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 5228d27162893..151d8d98d0463 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -46,6 +46,34 @@ struct ah_skb_cb {
#define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0]))
+/* Helper to save IPv6 addresses and extension headers to temporary storage */
+static inline void ah6_save_hdrs(struct tmp_ext *iph_ext,
+ struct ipv6hdr *top_iph, int extlen)
+{
+ if (!extlen)
+ return;
+
+#if IS_ENABLED(CONFIG_IPV6_MIP6)
+ iph_ext->saddr = top_iph->saddr;
+#endif
+ iph_ext->daddr = top_iph->daddr;
+ memcpy(&iph_ext->hdrs, top_iph + 1, extlen - sizeof(*iph_ext));
+}
+
+/* Helper to restore IPv6 addresses and extension headers from temporary storage */
+static inline void ah6_restore_hdrs(struct ipv6hdr *top_iph,
+ struct tmp_ext *iph_ext, int extlen)
+{
+ if (!extlen)
+ return;
+
+#if IS_ENABLED(CONFIG_IPV6_MIP6)
+ top_iph->saddr = iph_ext->saddr;
+#endif
+ top_iph->daddr = iph_ext->daddr;
+ memcpy(top_iph + 1, &iph_ext->hdrs, extlen - sizeof(*iph_ext));
+}
+
static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags,
unsigned int size)
{
@@ -304,13 +332,7 @@ static void ah6_output_done(struct crypto_async_request *base, int err)
memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
- if (extlen) {
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
- memcpy(&top_iph->saddr, iph_ext, extlen);
-#else
- memcpy(&top_iph->daddr, iph_ext, extlen);
-#endif
- }
+ ah6_restore_hdrs(top_iph, iph_ext, extlen);
kfree(AH_SKB_CB(skb)->tmp);
xfrm_output_resume(skb->sk, skb, err);
@@ -381,12 +403,8 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
*/
memcpy(iph_base, top_iph, IPV6HDR_BASELEN);
+ ah6_save_hdrs(iph_ext, top_iph, extlen);
if (extlen) {
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
- memcpy(iph_ext, &top_iph->saddr, extlen);
-#else
- memcpy(iph_ext, &top_iph->daddr, extlen);
-#endif
err = ipv6_clear_mutable_options(top_iph,
extlen - sizeof(*iph_ext) +
sizeof(*top_iph),
@@ -437,13 +455,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
- if (extlen) {
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
- memcpy(&top_iph->saddr, iph_ext, extlen);
-#else
- memcpy(&top_iph->daddr, iph_ext, extlen);
-#endif
- }
+ ah6_restore_hdrs(top_iph, iph_ext, extlen);
out_free:
kfree(iph_base);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 158/568] media: imon: make send_packet() more robust
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 157/568] net: ipv6: fix field-spanning memcpy warning in AH output Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 159/568] drm/bridge: display-connector: dont set OP_DETECT for DisplayPorts Greg Kroah-Hartman
` (416 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tetsuo Handa, Sean Young,
Hans Verkuil, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
[ Upstream commit eecd203ada43a4693ce6fdd3a58ae10c7819252c ]
syzbot is reporting that imon has three problems which result in
hung tasks due to forever holding device lock [1].
First problem is that when usb_rx_callback_intf0() once got -EPROTO error
after ictx->dev_present_intf0 became true, usb_rx_callback_intf0()
resubmits urb after printk(), and resubmitted urb causes
usb_rx_callback_intf0() to again get -EPROTO error. This results in
printk() flooding (RCU stalls).
Alan Stern commented [2] that
In theory it's okay to resubmit _if_ the driver has a robust
error-recovery scheme (such as giving up after some fixed limit on the
number of errors or after some fixed time has elapsed, perhaps with a
time delay to prevent a flood of errors). Most drivers don't bother to
do this; they simply give up right away. This makes them more
vulnerable to short-term noise interference during USB transfers, but in
reality such interference is quite rare. There's nothing really wrong
with giving up right away.
but imon has a poor error-recovery scheme which just retries forever;
this behavior should be fixed.
Since I'm not sure whether it is safe for imon users to give up upon any
error code, this patch takes care of only union of error codes chosen from
modules in drivers/media/rc/ directory which handle -EPROTO error (i.e.
ir_toy, mceusb and igorplugusb).
Second problem is that when usb_rx_callback_intf0() once got -EPROTO error
before ictx->dev_present_intf0 becomes true, usb_rx_callback_intf0() always
resubmits urb due to commit 8791d63af0cf ("[media] imon: don't wedge
hardware after early callbacks"). Move the ictx->dev_present_intf0 test
introduced by commit 6f6b90c9231a ("[media] imon: don't parse scancodes
until intf configured") to immediately before imon_incoming_packet(), or
the first problem explained above happens without printk() flooding (i.e.
hung task).
Third problem is that when usb_rx_callback_intf0() is not called for some
reason (e.g. flaky hardware; the reproducer for this problem sometimes
prevents usb_rx_callback_intf0() from being called),
wait_for_completion_interruptible() in send_packet() never returns (i.e.
hung task). As a workaround for such situation, change send_packet() to
wait for completion with timeout of 10 seconds.
Link: https://syzkaller.appspot.com/bug?extid=592e2ab8775dbe0bf09a [1]
Link: https://lkml.kernel.org/r/d6da6709-d799-4be3-a695-850bddd6eb24@rowland.harvard.edu [2]
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/imon.c | 61 +++++++++++++++++++++++++----------------
1 file changed, 37 insertions(+), 24 deletions(-)
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index f4deca8894e0f..bb4aabb08c06e 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -650,12 +650,15 @@ static int send_packet(struct imon_context *ictx)
smp_rmb(); /* ensure later readers know we're not busy */
pr_err_ratelimited("error submitting urb(%d)\n", retval);
} else {
- /* Wait for transmission to complete (or abort) */
- retval = wait_for_completion_interruptible(
- &ictx->tx.finished);
- if (retval) {
+ /* Wait for transmission to complete (or abort or timeout) */
+ retval = wait_for_completion_interruptible_timeout(&ictx->tx.finished, 10 * HZ);
+ if (retval <= 0) {
usb_kill_urb(ictx->tx_urb);
pr_err_ratelimited("task interrupted\n");
+ if (retval < 0)
+ ictx->tx.status = retval;
+ else
+ ictx->tx.status = -ETIMEDOUT;
}
ictx->tx.busy = false;
@@ -1754,14 +1757,6 @@ static void usb_rx_callback_intf0(struct urb *urb)
if (!ictx)
return;
- /*
- * if we get a callback before we're done configuring the hardware, we
- * can't yet process the data, as there's nowhere to send it, but we
- * still need to submit a new rx URB to avoid wedging the hardware
- */
- if (!ictx->dev_present_intf0)
- goto out;
-
switch (urb->status) {
case -ENOENT: /* usbcore unlink successful! */
return;
@@ -1770,16 +1765,29 @@ static void usb_rx_callback_intf0(struct urb *urb)
break;
case 0:
- imon_incoming_packet(ictx, urb, intfnum);
+ /*
+ * if we get a callback before we're done configuring the hardware, we
+ * can't yet process the data, as there's nowhere to send it, but we
+ * still need to submit a new rx URB to avoid wedging the hardware
+ */
+ if (ictx->dev_present_intf0)
+ imon_incoming_packet(ictx, urb, intfnum);
break;
+ case -ECONNRESET:
+ case -EILSEQ:
+ case -EPROTO:
+ case -EPIPE:
+ dev_warn(ictx->dev, "imon %s: status(%d)\n",
+ __func__, urb->status);
+ return;
+
default:
dev_warn(ictx->dev, "imon %s: status(%d): ignored\n",
__func__, urb->status);
break;
}
-out:
usb_submit_urb(ictx->rx_urb_intf0, GFP_ATOMIC);
}
@@ -1795,14 +1803,6 @@ static void usb_rx_callback_intf1(struct urb *urb)
if (!ictx)
return;
- /*
- * if we get a callback before we're done configuring the hardware, we
- * can't yet process the data, as there's nowhere to send it, but we
- * still need to submit a new rx URB to avoid wedging the hardware
- */
- if (!ictx->dev_present_intf1)
- goto out;
-
switch (urb->status) {
case -ENOENT: /* usbcore unlink successful! */
return;
@@ -1811,16 +1811,29 @@ static void usb_rx_callback_intf1(struct urb *urb)
break;
case 0:
- imon_incoming_packet(ictx, urb, intfnum);
+ /*
+ * if we get a callback before we're done configuring the hardware, we
+ * can't yet process the data, as there's nowhere to send it, but we
+ * still need to submit a new rx URB to avoid wedging the hardware
+ */
+ if (ictx->dev_present_intf1)
+ imon_incoming_packet(ictx, urb, intfnum);
break;
+ case -ECONNRESET:
+ case -EILSEQ:
+ case -EPROTO:
+ case -EPIPE:
+ dev_warn(ictx->dev, "imon %s: status(%d)\n",
+ __func__, urb->status);
+ return;
+
default:
dev_warn(ictx->dev, "imon %s: status(%d): ignored\n",
__func__, urb->status);
break;
}
-out:
usb_submit_urb(ictx->rx_urb_intf1, GFP_ATOMIC);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 159/568] drm/bridge: display-connector: dont set OP_DETECT for DisplayPorts
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 158/568] media: imon: make send_packet() more robust Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 160/568] iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register Greg Kroah-Hartman
` (415 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bjorn Andersson, Konrad Dybcio,
linux-arm-msm, Laurent Pinchart, Dmitry Baryshkov, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
[ Upstream commit cb640b2ca54617f4a9d4d6efd5ff2afd6be11f19 ]
Detecting the monitor for DisplayPort targets is more complicated than
just reading the HPD pin level: it requires reading the DPCD in order to
check what kind of device is attached to the port and whether there is
an actual display attached.
In order to let DRM framework handle such configurations, disable
DRM_BRIDGE_OP_DETECT for dp-connector devices, letting the actual DP
driver perform detection. This still keeps DRM_BRIDGE_OP_HPD enabled, so
it is valid for the bridge to report HPD events.
Currently inside the kernel there are only two targets which list
hpd-gpios for dp-connector devices: arm64/qcom/qcs6490-rb3gen2 and
arm64/qcom/sa8295p-adp. Both should be fine with this change.
Cc: Bjorn Andersson <andersson@kernel.org>
Cc: Konrad Dybcio <konradybcio@kernel.org>
Cc: linux-arm-msm@vger.kernel.org
Acked-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Link: https://lore.kernel.org/r/20250802-dp-conn-no-detect-v1-1-2748c2b946da@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/display-connector.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/display-connector.c b/drivers/gpu/drm/bridge/display-connector.c
index 9a12449ad7b87..8eded18ad2ec2 100644
--- a/drivers/gpu/drm/bridge/display-connector.c
+++ b/drivers/gpu/drm/bridge/display-connector.c
@@ -364,7 +364,8 @@ static int display_connector_probe(struct platform_device *pdev)
if (conn->bridge.ddc)
conn->bridge.ops |= DRM_BRIDGE_OP_EDID
| DRM_BRIDGE_OP_DETECT;
- if (conn->hpd_gpio)
+ /* Detecting the monitor requires reading DPCD */
+ if (conn->hpd_gpio && type != DRM_MODE_CONNECTOR_DisplayPort)
conn->bridge.ops |= DRM_BRIDGE_OP_DETECT;
if (conn->hpd_irq >= 0)
conn->bridge.ops |= DRM_BRIDGE_OP_HPD;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 160/568] iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 159/568] drm/bridge: display-connector: dont set OP_DETECT for DisplayPorts Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 161/568] usb: gadget: f_ncm: Fix MAC assignment NCM ethernet Greg Kroah-Hartman
` (414 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rodrigo Gobbi, David Lechner,
Jonathan Cameron, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
[ Upstream commit d75c7021c08e8ae3f311ef2464dca0eaf75fab9f ]
avg sample info is a bit field coded inside the following
bits: 5,6,7 and 8 of a device status register.
Channel num info the same, but over bits: 1, 2 and 3.
Mask both values in order to avoid touching other register bits,
since the first info (avg sample), came from DT.
Signed-off-by: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Link: https://patch.msgid.link/20250717221559.158872-1-rodrigo.gobbi.7@gmail.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/spear_adc.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/iio/adc/spear_adc.c b/drivers/iio/adc/spear_adc.c
index d93e580b3dc5b..8fda16dd012f7 100644
--- a/drivers/iio/adc/spear_adc.c
+++ b/drivers/iio/adc/spear_adc.c
@@ -12,6 +12,7 @@
#include <linux/kernel.h>
#include <linux/slab.h>
#include <linux/io.h>
+#include <linux/bitfield.h>
#include <linux/clk.h>
#include <linux/err.h>
#include <linux/completion.h>
@@ -29,9 +30,9 @@
/* Bit definitions for SPEAR_ADC_STATUS */
#define SPEAR_ADC_STATUS_START_CONVERSION BIT(0)
-#define SPEAR_ADC_STATUS_CHANNEL_NUM(x) ((x) << 1)
+#define SPEAR_ADC_STATUS_CHANNEL_NUM_MASK GENMASK(3, 1)
#define SPEAR_ADC_STATUS_ADC_ENABLE BIT(4)
-#define SPEAR_ADC_STATUS_AVG_SAMPLE(x) ((x) << 5)
+#define SPEAR_ADC_STATUS_AVG_SAMPLE_MASK GENMASK(8, 5)
#define SPEAR_ADC_STATUS_VREF_INTERNAL BIT(9)
#define SPEAR_ADC_DATA_MASK 0x03ff
@@ -157,8 +158,8 @@ static int spear_adc_read_raw(struct iio_dev *indio_dev,
case IIO_CHAN_INFO_RAW:
mutex_lock(&st->lock);
- status = SPEAR_ADC_STATUS_CHANNEL_NUM(chan->channel) |
- SPEAR_ADC_STATUS_AVG_SAMPLE(st->avg_samples) |
+ status = FIELD_PREP(SPEAR_ADC_STATUS_CHANNEL_NUM_MASK, chan->channel) |
+ FIELD_PREP(SPEAR_ADC_STATUS_AVG_SAMPLE_MASK, st->avg_samples) |
SPEAR_ADC_STATUS_START_CONVERSION |
SPEAR_ADC_STATUS_ADC_ENABLE;
if (st->vref_external == 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 161/568] usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 160/568] iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 162/568] char: misc: Does not request module for miscdevice with dynamic minor Greg Kroah-Hartman
` (413 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, raub camaioni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: raub camaioni <raubcameo@gmail.com>
[ Upstream commit 956606bafb5fc6e5968aadcda86fc0037e1d7548 ]
This fix is already present in f_ecm.c and was never
propagated to f_ncm.c
When creating multiple NCM ethernet devices
on a composite usb gadget device
each MAC address on the HOST side will be identical.
Having the same MAC on different network interfaces is bad.
This fix updates the MAC address inside the
ncm_strings_defs global during the ncm_bind call.
This ensures each device has a unique MAC.
In f_ecm.c ecm_string_defs is updated in the same way.
The defunct MAC assignment in ncm_alloc has been removed.
Signed-off-by: raub camaioni <raubcameo@gmail.com>
Link: https://lore.kernel.org/r/20250815131358.1047525-1-raubcameo@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/function/f_ncm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
index ba99f2bce646f..0b12bf0942124 100644
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -1464,6 +1464,8 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
ncm_opts->bound = true;
+ ncm_string_defs[1].s = ncm->ethaddr;
+
us = usb_gstrings_attach(cdev, ncm_strings,
ARRAY_SIZE(ncm_string_defs));
if (IS_ERR(us))
@@ -1713,7 +1715,6 @@ static struct usb_function *ncm_alloc(struct usb_function_instance *fi)
mutex_unlock(&opts->lock);
return ERR_PTR(-EINVAL);
}
- ncm_string_defs[STRING_MAC_IDX].s = ncm->ethaddr;
spin_lock_init(&ncm->lock);
ncm_reset_values(ncm);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 162/568] char: misc: Does not request module for miscdevice with dynamic minor
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 161/568] usb: gadget: f_ncm: Fix MAC assignment NCM ethernet Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 163/568] net: When removing nexthops, dont call synchronize_net if it is not necessary Greg Kroah-Hartman
` (412 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thadeu Lima de Souza Cascardo,
Zijun Hu, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <zijun.hu@oss.qualcomm.com>
[ Upstream commit 1ba0fb42aa6a5f072b1b8c0b0520b32ad4ef4b45 ]
misc_open() may request module for miscdevice with dynamic minor, which
is meaningless since:
- The dynamic minor allocated is unknown in advance without registering
miscdevice firstly.
- Macro MODULE_ALIAS_MISCDEV() is not applicable for dynamic minor.
Fix by only requesting module for miscdevice with fixed minor.
Acked-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250714-rfc_miscdev-v6-6-2ed949665bde@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/misc.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/char/misc.c b/drivers/char/misc.c
index cba19bfdc44dd..b5dd944d0282d 100644
--- a/drivers/char/misc.c
+++ b/drivers/char/misc.c
@@ -114,7 +114,8 @@ static int misc_open(struct inode *inode, struct file *file)
break;
}
- if (!new_fops) {
+ /* Only request module for fixed minor code */
+ if (!new_fops && minor < MISC_DYNAMIC_MINOR) {
mutex_unlock(&misc_mtx);
request_module("char-major-%d-%d", MISC_MAJOR, minor);
mutex_lock(&misc_mtx);
@@ -126,10 +127,11 @@ static int misc_open(struct inode *inode, struct file *file)
new_fops = fops_get(iter->fops);
break;
}
- if (!new_fops)
- goto fail;
}
+ if (!new_fops)
+ goto fail;
+
/*
* Place the miscdevice in the file's
* private_data so it can be used by the
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 163/568] net: When removing nexthops, dont call synchronize_net if it is not necessary
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 162/568] char: misc: Does not request module for miscdevice with dynamic minor Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 164/568] net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV Greg Kroah-Hartman
` (411 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Paasch, Ido Schimmel,
Nikolay Aleksandrov, Eric Dumazet, David Ahern, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Paasch <cpaasch@openai.com>
[ Upstream commit b0ac6d3b56a2384db151696cfda2836a8a961b6d ]
When removing a nexthop, commit
90f33bffa382 ("nexthops: don't modify published nexthop groups") added a
call to synchronize_rcu() (later changed to _net()) to make sure
everyone sees the new nexthop-group before the rtnl-lock is released.
When one wants to delete a large number of groups and nexthops, it is
fastest to first flush the groups (ip nexthop flush groups) and then
flush the nexthops themselves (ip -6 nexthop flush). As that way the
groups don't need to be rebalanced.
However, `ip -6 nexthop flush` will still take a long time if there is
a very large number of nexthops because of the call to
synchronize_net(). Now, if there are no more groups, there is no point
in calling synchronize_net(). So, let's skip that entirely by checking
if nh->grp_list is empty.
This gives us a nice speedup:
BEFORE:
=======
$ time sudo ip -6 nexthop flush
Dump was interrupted and may be inconsistent.
Flushed 2097152 nexthops
real 1m45.345s
user 0m0.001s
sys 0m0.005s
$ time sudo ip -6 nexthop flush
Dump was interrupted and may be inconsistent.
Flushed 4194304 nexthops
real 3m10.430s
user 0m0.002s
sys 0m0.004s
AFTER:
======
$ time sudo ip -6 nexthop flush
Dump was interrupted and may be inconsistent.
Flushed 2097152 nexthops
real 0m17.545s
user 0m0.003s
sys 0m0.003s
$ time sudo ip -6 nexthop flush
Dump was interrupted and may be inconsistent.
Flushed 4194304 nexthops
real 0m35.823s
user 0m0.002s
sys 0m0.004s
Signed-off-by: Christoph Paasch <cpaasch@openai.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250816-nexthop_dump-v2-2-491da3462118@openai.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/nexthop.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c
index c0f9d125f401c..10cb365639aaa 100644
--- a/net/ipv4/nexthop.c
+++ b/net/ipv4/nexthop.c
@@ -1812,6 +1812,12 @@ static void remove_nexthop_from_groups(struct net *net, struct nexthop *nh,
{
struct nh_grp_entry *nhge, *tmp;
+ /* If there is nothing to do, let's avoid the costly call to
+ * synchronize_net()
+ */
+ if (list_empty(&nh->grp_list))
+ return;
+
list_for_each_entry_safe(nhge, tmp, &nh->grp_list, nh_list)
remove_nh_grp_entry(net, nhge, nlinfo);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 164/568] net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 163/568] net: When removing nexthops, dont call synchronize_net if it is not necessary Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 165/568] PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call Greg Kroah-Hartman
` (410 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Eric Dumazet,
Shakeel Butt, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 9d85c565a7b7c78b732393c02bcaa4d5c275fe58 ]
Initially, trace_sock_exceed_buf_limit() was invoked when
__sk_mem_raise_allocated() failed due to the memcg limit or the
global limit.
However, commit d6f19938eb031 ("net: expose sk wmem in
sock_exceed_buf_limit tracepoint") somehow suppressed the event
only when memcg failed to charge for SK_MEM_RECV, although the
memcg failure for SK_MEM_SEND still triggers the event.
Let's restore the event for SK_MEM_RECV.
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Shakeel Butt <shakeel.butt@linux.dev>
Link: https://patch.msgid.link/20250815201712.1745332-5-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/sock.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/net/core/sock.c b/net/core/sock.c
index d4de3c01bdb67..1c4d225e93290 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -3075,8 +3075,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
}
}
- if (kind == SK_MEM_SEND || (kind == SK_MEM_RECV && charged))
- trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
+ trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
sk_memory_allocated_sub(sk, amt);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 165/568] PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 164/568] net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 166/568] ALSA: usb-audio: Add validation of UAC2/UAC3 effect units Greg Kroah-Hartman
` (409 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sungho Kim, Bjorn Helgaas,
Logan Gunthorpe, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sungho Kim <sungho.kim@furiosa.ai>
[ Upstream commit 6238784e502b6a9fbeb3a6b77284b29baa4135cc ]
The error handling path in pci_p2pdma_add_resource() contains a bug in its
`pgmap_free` label.
Memory is allocated for the `p2p_pgmap` struct, and the pointer is stored
in `p2p_pgmap`. However, the error path calls devm_kfree() with `pgmap`,
which is a pointer to a member field within the `p2p_pgmap` struct, not the
base pointer of the allocation.
Correct the bug by passing the correct base pointer, `p2p_pgmap`, to
devm_kfree().
Signed-off-by: Sungho Kim <sungho.kim@furiosa.ai>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Link: https://patch.msgid.link/20250820105714.2939896-1-sungho.kim@furiosa.ai
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/p2pdma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c
index 88dc66ee1c467..d5e38c6a812f0 100644
--- a/drivers/pci/p2pdma.c
+++ b/drivers/pci/p2pdma.c
@@ -225,7 +225,7 @@ int pci_p2pdma_add_resource(struct pci_dev *pdev, int bar, size_t size,
pages_free:
devm_memunmap_pages(&pdev->dev, pgmap);
pgmap_free:
- devm_kfree(&pdev->dev, pgmap);
+ devm_kfree(&pdev->dev, p2p_pgmap);
return error;
}
EXPORT_SYMBOL_GPL(pci_p2pdma_add_resource);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 166/568] ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 165/568] PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 167/568] rds: Fix endianness annotation for RDS_MPATH_HASH Greg Kroah-Hartman
` (408 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 2aec0b6a6b5395bca7d6fde9c7e9dc391d329698 ]
Just add fixed struct size validations for UAC2 and UAC3 effect
units. The descriptor has a variable-length array, so it should be
validated with a proper function later once when the unit is really
parsed and used by the driver (currently only referred partially for
the input terminal parsing).
Link: https://patch.msgid.link/20250821151751.12100-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/validate.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/sound/usb/validate.c b/sound/usb/validate.c
index a0d55b77c9941..4bb4893f6e74f 100644
--- a/sound/usb/validate.c
+++ b/sound/usb/validate.c
@@ -266,7 +266,11 @@ static const struct usb_desc_validator audio_validators[] = {
FUNC(UAC_VERSION_2, UAC_MIXER_UNIT, validate_mixer_unit),
FUNC(UAC_VERSION_2, UAC_SELECTOR_UNIT, validate_selector_unit),
FUNC(UAC_VERSION_2, UAC_FEATURE_UNIT, validate_uac2_feature_unit),
- /* UAC_VERSION_2, UAC2_EFFECT_UNIT: not implemented yet */
+ /* just a stop-gap, it should be a proper function for the array
+ * once if the unit is really parsed/used
+ */
+ FIXED(UAC_VERSION_2, UAC2_EFFECT_UNIT,
+ struct uac2_effect_unit_descriptor),
FUNC(UAC_VERSION_2, UAC2_PROCESSING_UNIT_V2, validate_processing_unit),
FUNC(UAC_VERSION_2, UAC2_EXTENSION_UNIT_V2, validate_processing_unit),
FIXED(UAC_VERSION_2, UAC2_CLOCK_SOURCE,
@@ -286,7 +290,8 @@ static const struct usb_desc_validator audio_validators[] = {
FUNC(UAC_VERSION_3, UAC3_MIXER_UNIT, validate_mixer_unit),
FUNC(UAC_VERSION_3, UAC3_SELECTOR_UNIT, validate_selector_unit),
FUNC(UAC_VERSION_3, UAC3_FEATURE_UNIT, validate_uac3_feature_unit),
- /* UAC_VERSION_3, UAC3_EFFECT_UNIT: not implemented yet */
+ FIXED(UAC_VERSION_3, UAC3_EFFECT_UNIT,
+ struct uac2_effect_unit_descriptor), /* sharing the same struct */
FUNC(UAC_VERSION_3, UAC3_PROCESSING_UNIT, validate_processing_unit),
FUNC(UAC_VERSION_3, UAC3_EXTENSION_UNIT, validate_processing_unit),
FIXED(UAC_VERSION_3, UAC3_CLOCK_SOURCE,
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 167/568] rds: Fix endianness annotation for RDS_MPATH_HASH
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 166/568] ALSA: usb-audio: Add validation of UAC2/UAC3 effect units Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 168/568] scsi: mpi3mr: Fix controller init failure on fault during queue creation Greg Kroah-Hartman
` (407 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ujwal Kundur, Allison Henderson,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ujwal Kundur <ujwal.kundur@gmail.com>
[ Upstream commit 77907a068717fbefb25faf01fecca553aca6ccaa ]
jhash_1word accepts host endian inputs while rs_bound_port is a be16
value (sockaddr_in6.sin6_port). Use ntohs() for consistency.
Flagged by Sparse.
Signed-off-by: Ujwal Kundur <ujwal.kundur@gmail.com>
Reviewed-by: Allison Henderson <allison.henderson@oracle.com>
Link: https://patch.msgid.link/20250820175550.498-4-ujwal.kundur@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rds/rds.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/rds/rds.h b/net/rds/rds.h
index d35d1fc398076..1257867e85e4e 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -93,7 +93,7 @@ enum {
/* Max number of multipaths per RDS connection. Must be a power of 2 */
#define RDS_MPATH_WORKERS 8
-#define RDS_MPATH_HASH(rs, n) (jhash_1word((rs)->rs_bound_port, \
+#define RDS_MPATH_HASH(rs, n) (jhash_1word(ntohs((rs)->rs_bound_port), \
(rs)->rs_hash_initval) & ((n) - 1))
#define IS_CANONICAL(laddr, faddr) (htonl(laddr) < htonl(faddr))
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 168/568] scsi: mpi3mr: Fix controller init failure on fault during queue creation
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 167/568] rds: Fix endianness annotation for RDS_MPATH_HASH Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 169/568] scsi: pm80xx: Fix race condition caused by static variables Greg Kroah-Hartman
` (406 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chandrakanth Patil,
Martin K. Petersen, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
[ Upstream commit 829fa1582b6ff607b0e2fe41ba1c45c77f686618 ]
Firmware can enter a transient fault while creating operational queues.
The driver fails the load immediately.
Add a retry loop that checks controller status and history bit after
queue creation. If either indicates a fault, retry init up to a set
limit before failing.
Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
Link: https://lore.kernel.org/r/20250820084138.228471-3-chandrakanth.patil@broadcom.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/mpi3mr/mpi3mr_fw.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/scsi/mpi3mr/mpi3mr_fw.c b/drivers/scsi/mpi3mr/mpi3mr_fw.c
index d50bc67061563..9d8f5a4794666 100644
--- a/drivers/scsi/mpi3mr/mpi3mr_fw.c
+++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c
@@ -2111,6 +2111,8 @@ static int mpi3mr_create_op_queues(struct mpi3mr_ioc *mrioc)
{
int retval = 0;
u16 num_queues = 0, i = 0, msix_count_op_q = 1;
+ u32 ioc_status;
+ enum mpi3mr_iocstate ioc_state;
num_queues = min_t(int, mrioc->facts.max_op_reply_q,
mrioc->facts.max_op_req_q);
@@ -2166,6 +2168,14 @@ static int mpi3mr_create_op_queues(struct mpi3mr_ioc *mrioc)
retval = -1;
goto out_failed;
}
+ ioc_status = readl(&mrioc->sysif_regs->ioc_status);
+ ioc_state = mpi3mr_get_iocstate(mrioc);
+ if ((ioc_status & MPI3_SYSIF_IOC_STATUS_RESET_HISTORY) ||
+ ioc_state != MRIOC_STATE_READY) {
+ mpi3mr_print_fault_info(mrioc);
+ retval = -1;
+ goto out_failed;
+ }
mrioc->num_op_reply_q = mrioc->num_op_req_q = i;
ioc_info(mrioc,
"successfully created %d operational queue pairs(default/polled) queue = (%d/%d)\n",
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 169/568] scsi: pm80xx: Fix race condition caused by static variables
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 168/568] scsi: mpi3mr: Fix controller init failure on fault during queue creation Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 170/568] extcon: adc-jack: Fix wakeup source leaks on device unbind Greg Kroah-Hartman
` (405 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francisco Gutierrez,
Martin K. Petersen, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francisco Gutierrez <frankramirez@google.com>
[ Upstream commit d6477ee38ccfbeaed885733c13f41d9076e2f94a ]
Eliminate the use of static variables within the log pull implementation
to resolve a race condition and prevent data gaps when pulling logs from
multiple controllers in parallel, ensuring each operation is properly
isolated.
Signed-off-by: Francisco Gutierrez <frankramirez@google.com>
Link: https://lore.kernel.org/r/20250723183543.1443301-1-frankramirez@google.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/pm8001/pm8001_ctl.c | 22 ++++++++++++----------
drivers/scsi/pm8001/pm8001_init.c | 1 +
drivers/scsi/pm8001/pm8001_sas.h | 4 ++++
3 files changed, 17 insertions(+), 10 deletions(-)
diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
index 73f036bed1281..2f67f51785e64 100644
--- a/drivers/scsi/pm8001/pm8001_ctl.c
+++ b/drivers/scsi/pm8001/pm8001_ctl.c
@@ -538,23 +538,25 @@ static ssize_t pm8001_ctl_iop_log_show(struct device *cdev,
char *str = buf;
u32 read_size =
pm8001_ha->main_cfg_tbl.pm80xx_tbl.event_log_size / 1024;
- static u32 start, end, count;
u32 max_read_times = 32;
u32 max_count = (read_size * 1024) / (max_read_times * 4);
u32 *temp = (u32 *)pm8001_ha->memoryMap.region[IOP].virt_ptr;
- if ((count % max_count) == 0) {
- start = 0;
- end = max_read_times;
- count = 0;
+ mutex_lock(&pm8001_ha->iop_log_lock);
+
+ if ((pm8001_ha->iop_log_count % max_count) == 0) {
+ pm8001_ha->iop_log_start = 0;
+ pm8001_ha->iop_log_end = max_read_times;
+ pm8001_ha->iop_log_count = 0;
} else {
- start = end;
- end = end + max_read_times;
+ pm8001_ha->iop_log_start = pm8001_ha->iop_log_end;
+ pm8001_ha->iop_log_end = pm8001_ha->iop_log_end + max_read_times;
}
- for (; start < end; start++)
- str += sprintf(str, "%08x ", *(temp+start));
- count++;
+ for (; pm8001_ha->iop_log_start < pm8001_ha->iop_log_end; pm8001_ha->iop_log_start++)
+ str += sprintf(str, "%08x ", *(temp+pm8001_ha->iop_log_start));
+ pm8001_ha->iop_log_count++;
+ mutex_unlock(&pm8001_ha->iop_log_lock);
return str - buf;
}
static DEVICE_ATTR(iop_log, S_IRUGO, pm8001_ctl_iop_log_show, NULL);
diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
index 18b150f27c868..60b477e65a66a 100644
--- a/drivers/scsi/pm8001/pm8001_init.c
+++ b/drivers/scsi/pm8001/pm8001_init.c
@@ -532,6 +532,7 @@ static struct pm8001_hba_info *pm8001_pci_alloc(struct pci_dev *pdev,
pm8001_ha->id = pm8001_id++;
pm8001_ha->logging_level = logging_level;
pm8001_ha->non_fatal_count = 0;
+ mutex_init(&pm8001_ha->iop_log_lock);
if (link_rate >= 1 && link_rate <= 15)
pm8001_ha->link_rate = (link_rate << 8);
else {
diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
index b08f52673889c..9306f05674d18 100644
--- a/drivers/scsi/pm8001/pm8001_sas.h
+++ b/drivers/scsi/pm8001/pm8001_sas.h
@@ -544,6 +544,10 @@ struct pm8001_hba_info {
u32 ci_offset;
u32 pi_offset;
u32 max_memcnt;
+ u32 iop_log_start;
+ u32 iop_log_end;
+ u32 iop_log_count;
+ struct mutex iop_log_lock;
};
struct pm8001_work {
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 170/568] extcon: adc-jack: Fix wakeup source leaks on device unbind
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 169/568] scsi: pm80xx: Fix race condition caused by static variables Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 171/568] net: phy: fixed_phy: let fixed_phy_unregister free the phy_device Greg Kroah-Hartman
` (404 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, MyungJoo Ham, Krzysztof Kozlowski,
Chanwoo Choi, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 78b6a991eb6c6f19ed7d0ac91cda3b3b117fda8f ]
Device can be unbound, so driver must also release memory for the wakeup
source. Do not use devm interface, because it would change the order of
cleanup.
Link: https://lore.kernel.org/lkml/20250501-device-wakeup-leak-extcon-v2-1-7af77802cbea@linaro.org/
Acked-by: MyungJoo Ham <myungjoo.ham@samsung.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/extcon/extcon-adc-jack.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/extcon/extcon-adc-jack.c b/drivers/extcon/extcon-adc-jack.c
index 0317b614b6805..ea06cd4340525 100644
--- a/drivers/extcon/extcon-adc-jack.c
+++ b/drivers/extcon/extcon-adc-jack.c
@@ -162,6 +162,7 @@ static int adc_jack_remove(struct platform_device *pdev)
{
struct adc_jack_data *data = platform_get_drvdata(pdev);
+ device_init_wakeup(&pdev->dev, false);
free_irq(data->irq, data);
cancel_work_sync(&data->handler.work);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 171/568] net: phy: fixed_phy: let fixed_phy_unregister free the phy_device
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 170/568] extcon: adc-jack: Fix wakeup source leaks on device unbind Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 172/568] drm/amdkfd: fix vram allocation failure for a special case Greg Kroah-Hartman
` (403 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heiner Kallweit,
Russell King (Oracle), Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <hkallweit1@gmail.com>
[ Upstream commit a0f849c1cc6df0db9083b4c81c05a5456b1ed0fb ]
fixed_phy_register() creates and registers the phy_device. To be
symmetric, we should not only unregister, but also free the phy_device
in fixed_phy_unregister(). This allows to simplify code in users.
Note wrt of_phy_deregister_fixed_link():
put_device(&phydev->mdio.dev) and phy_device_free(phydev) are identical.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Link: https://patch.msgid.link/ad8dda9a-10ed-4060-916b-3f13bdbb899d@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/dsa_loop.c | 9 +++------
drivers/net/mdio/of_mdio.c | 1 -
drivers/net/phy/fixed_phy.c | 1 +
3 files changed, 4 insertions(+), 7 deletions(-)
diff --git a/drivers/net/dsa/dsa_loop.c b/drivers/net/dsa/dsa_loop.c
index 5b139f2206b6e..48cf9d300bbf5 100644
--- a/drivers/net/dsa/dsa_loop.c
+++ b/drivers/net/dsa/dsa_loop.c
@@ -378,13 +378,10 @@ static struct mdio_driver dsa_loop_drv = {
static void dsa_loop_phydevs_unregister(void)
{
- unsigned int i;
-
- for (i = 0; i < NUM_FIXED_PHYS; i++)
- if (!IS_ERR(phydevs[i])) {
+ for (int i = 0; i < NUM_FIXED_PHYS; i++) {
+ if (!IS_ERR(phydevs[i]))
fixed_phy_unregister(phydevs[i]);
- phy_device_free(phydevs[i]);
- }
+ }
}
static int __init dsa_loop_init(void)
diff --git a/drivers/net/mdio/of_mdio.c b/drivers/net/mdio/of_mdio.c
index 1e46e39f5f46a..6444f77931708 100644
--- a/drivers/net/mdio/of_mdio.c
+++ b/drivers/net/mdio/of_mdio.c
@@ -440,6 +440,5 @@ void of_phy_deregister_fixed_link(struct device_node *np)
fixed_phy_unregister(phydev);
put_device(&phydev->mdio.dev); /* of_phy_find_device() */
- phy_device_free(phydev); /* fixed_phy_register() */
}
EXPORT_SYMBOL(of_phy_deregister_fixed_link);
diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
index aef739c20ac4d..4694fb3eaa2ff 100644
--- a/drivers/net/phy/fixed_phy.c
+++ b/drivers/net/phy/fixed_phy.c
@@ -329,6 +329,7 @@ void fixed_phy_unregister(struct phy_device *phy)
phy_device_remove(phy);
of_node_put(phy->mdio.dev.of_node);
fixed_phy_del(phy->mdio.addr);
+ phy_device_free(phy);
}
EXPORT_SYMBOL_GPL(fixed_phy_unregister);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 172/568] drm/amdkfd: fix vram allocation failure for a special case
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 171/568] net: phy: fixed_phy: let fixed_phy_unregister free the phy_device Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 173/568] drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption Greg Kroah-Hartman
` (402 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Huang, Harish Kasiviswanathan,
Alex Deucher, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Huang <jinhuieric.huang@amd.com>
[ Upstream commit 93aa919ca05bec544b17ee9a1bfe394ce6c94bd8 ]
When it only allocates vram without va, which is 0, and a
SVM range allocated stays in this range, the vram allocation
returns failure. It should be skipped for this case from
SVM usage check.
Signed-off-by: Eric Huang <jinhuieric.huang@amd.com>
Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index c1cb91a79b796..890c2befe7dce 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -1067,7 +1067,12 @@ static int kfd_ioctl_alloc_memory_of_gpu(struct file *filep,
svm_range_list_lock_and_flush_work(&p->svms, current->mm);
mutex_lock(&p->svms.lock);
mmap_write_unlock(current->mm);
- if (interval_tree_iter_first(&p->svms.objects,
+
+ /* Skip a special case that allocates VRAM without VA,
+ * VA will be invalid of 0.
+ */
+ if (!(!args->va_addr && (flags & KFD_IOC_ALLOC_MEM_FLAGS_VRAM)) &&
+ interval_tree_iter_first(&p->svms.objects,
args->va_addr >> PAGE_SHIFT,
(args->va_addr + args->size - 1) >> PAGE_SHIFT)) {
pr_err("Address: 0x%llx already allocated by SVM\n",
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 173/568] drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 172/568] drm/amdkfd: fix vram allocation failure for a special case Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 174/568] media: fix uninitialized symbol warnings Greg Kroah-Hartman
` (401 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Amber Lin, Harish Kasiviswanathan,
Alex Deucher, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amber Lin <Amber.Lin@amd.com>
[ Upstream commit f3820e9d356132e18405cd7606e22dc87ccfa6d1 ]
When KFD asks CP to preempt queues, other than preempt CP queues, CP
also requests SDMA to preempt SDMA queues with UNMAP_LATENCY timeout.
Currently queue_preemption_timeout_ms is 9000 ms by default but can be
configured via module parameter. KFD_UNMAP_LATENCY_MS is hard coded as
4000 ms though. This patch ties KFD_UNMAP_LATENCY_MS to
queue_preemption_timeout_ms so in a slow system such as emulator, both
CP and SDMA slowness are taken into account.
Signed-off-by: Amber Lin <Amber.Lin@amd.com>
Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
index 3c7d267f2a07b..d1ebae9519d6c 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -111,7 +111,14 @@
#define KFD_KERNEL_QUEUE_SIZE 2048
-#define KFD_UNMAP_LATENCY_MS (4000)
+/* KFD_UNMAP_LATENCY_MS is the timeout CP waiting for SDMA preemption. One XCC
+ * can be associated to 2 SDMA engines. queue_preemption_timeout_ms is the time
+ * driver waiting for CP returning the UNMAP_QUEUE fence. Thus the math is
+ * queue_preemption_timeout_ms = sdma_preemption_time * 2 + cp workload
+ * The format here makes CP workload 10% of total timeout
+ */
+#define KFD_UNMAP_LATENCY_MS \
+ ((queue_preemption_timeout_ms - queue_preemption_timeout_ms / 10) >> 1)
/*
* 512 = 0x200
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 174/568] media: fix uninitialized symbol warnings
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 173/568] drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 175/568] drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) Greg Kroah-Hartman
` (400 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chelsy Ratnawat, Hans Verkuil,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
[ Upstream commit b4c441310c3baaa7c39a5457e305ca93c7a0400d ]
Initialize variables to fix these smatch warnings
drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
symbol 'protocol'.
drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
symbol 'scancode'.
drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
symbol 'toggle'.
drivers/media/tuners/xc4000.c:1102 xc_debug_dump() error: uninitialized
symbol 'adc_envelope'.
drivers/media/tuners/xc4000.c:1108 xc_debug_dump() error: uninitialized
symbol 'lock_status'.
drivers/media/tuners/xc4000.c:1123 xc_debug_dump() error: uninitialized
symbol 'frame_lines'.
drivers/media/tuners/xc4000.c:1127 xc_debug_dump() error: uninitialized
symbol 'quality'.
drivers/media/tuners/xc5000.c:645 xc_debug_dump() error: uninitialized
symbol 'adc_envelope'.
drivers/media/tuners/xc5000.c:651 xc_debug_dump() error: uninitialized
symbol 'lock_status'.
drivers/media/tuners/xc5000.c:665 xc_debug_dump() error: uninitialized
symbol 'frame_lines'.
drivers/media/tuners/xc5000.c:668 xc_debug_dump() error: uninitialized
symbol 'quality'.
drivers/media/tuners/xc5000.c:671 xc_debug_dump() error: uninitialized
symbol 'snr'.
drivers/media/tuners/xc5000.c:674 xc_debug_dump() error: uninitialized
symbol 'totalgain'.
Signed-off-by: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
[hverkuil: dropped ' = 0' from rc in ir-kbd-i2c.c, not needed]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ir-kbd-i2c.c | 6 +++---
drivers/media/tuners/xc4000.c | 8 ++++----
drivers/media/tuners/xc5000.c | 12 ++++++------
3 files changed, 13 insertions(+), 13 deletions(-)
diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c
index 25bf1132dbff8..fce54c8dad3e4 100644
--- a/drivers/media/i2c/ir-kbd-i2c.c
+++ b/drivers/media/i2c/ir-kbd-i2c.c
@@ -321,9 +321,9 @@ static int get_key_avermedia_cardbus(struct IR_i2c *ir, enum rc_proto *protocol,
static int ir_key_poll(struct IR_i2c *ir)
{
- enum rc_proto protocol;
- u32 scancode;
- u8 toggle;
+ enum rc_proto protocol = 0;
+ u32 scancode = 0;
+ u8 toggle = 0;
int rc;
dev_dbg(&ir->rc->dev, "%s\n", __func__);
diff --git a/drivers/media/tuners/xc4000.c b/drivers/media/tuners/xc4000.c
index 29bc63021c5aa..6fb3550811a28 100644
--- a/drivers/media/tuners/xc4000.c
+++ b/drivers/media/tuners/xc4000.c
@@ -1087,12 +1087,12 @@ static int check_firmware(struct dvb_frontend *fe, unsigned int type,
static void xc_debug_dump(struct xc4000_priv *priv)
{
- u16 adc_envelope;
+ u16 adc_envelope = 0;
u32 freq_error_hz = 0;
- u16 lock_status;
+ u16 lock_status = 0;
u32 hsync_freq_hz = 0;
- u16 frame_lines;
- u16 quality;
+ u16 frame_lines = 0;
+ u16 quality = 0;
u16 signal = 0;
u16 noise = 0;
u8 hw_majorversion = 0, hw_minorversion = 0;
diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c
index ec9a3cd4784e1..a28481edd22ed 100644
--- a/drivers/media/tuners/xc5000.c
+++ b/drivers/media/tuners/xc5000.c
@@ -622,14 +622,14 @@ static int xc5000_fwupload(struct dvb_frontend *fe,
static void xc_debug_dump(struct xc5000_priv *priv)
{
- u16 adc_envelope;
+ u16 adc_envelope = 0;
u32 freq_error_hz = 0;
- u16 lock_status;
+ u16 lock_status = 0;
u32 hsync_freq_hz = 0;
- u16 frame_lines;
- u16 quality;
- u16 snr;
- u16 totalgain;
+ u16 frame_lines = 0;
+ u16 quality = 0;
+ u16 snr = 0;
+ u16 totalgain = 0;
u8 hw_majorversion = 0, hw_minorversion = 0;
u8 fw_majorversion = 0, fw_minorversion = 0;
u16 fw_buildversion = 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 175/568] drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 174/568] media: fix uninitialized symbol warnings Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 176/568] mips: lantiq: danube: add missing properties to cpu node Greg Kroah-Hartman
` (399 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Timur Kristóf,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <timur.kristof@gmail.com>
[ Upstream commit 585b2f685c56c5095cc22c7202bf74d8e9a73cdd ]
Update the legacy (non-DC) display code to respect the maximum
pixel clock for HDMI and DVI-D. Reject modes that would require
a higher pixel clock than can be supported.
Also update the maximum supported HDMI clock value depending on
the ASIC type.
For reference, see the DC code:
check max_hdmi_pixel_clock in dce*_resource.c
v2:
Fix maximum clocks for DVI-D and DVI/HDMI adapters.
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/amd/amdgpu/amdgpu_connectors.c | 57 ++++++++++++++-----
1 file changed, 44 insertions(+), 13 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
index cfb262911bfc7..9ec5706d26219 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
@@ -1165,29 +1165,60 @@ static void amdgpu_connector_dvi_force(struct drm_connector *connector)
amdgpu_connector->use_digital = true;
}
+/**
+ * Returns the maximum supported HDMI (TMDS) pixel clock in KHz.
+ */
+static int amdgpu_max_hdmi_pixel_clock(const struct amdgpu_device *adev)
+{
+ if (adev->asic_type >= CHIP_POLARIS10)
+ return 600000;
+ else if (adev->asic_type >= CHIP_TONGA)
+ return 300000;
+ else
+ return 297000;
+}
+
+/**
+ * Validates the given display mode on DVI and HDMI connectors,
+ * including analog signals on DVI-I.
+ */
static enum drm_mode_status amdgpu_connector_dvi_mode_valid(struct drm_connector *connector,
struct drm_display_mode *mode)
{
struct drm_device *dev = connector->dev;
struct amdgpu_device *adev = drm_to_adev(dev);
struct amdgpu_connector *amdgpu_connector = to_amdgpu_connector(connector);
+ const int max_hdmi_pixel_clock = amdgpu_max_hdmi_pixel_clock(adev);
+ const int max_dvi_single_link_pixel_clock = 165000;
+ int max_digital_pixel_clock_khz;
/* XXX check mode bandwidth */
- if (amdgpu_connector->use_digital && (mode->clock > 165000)) {
- if ((amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I) ||
- (amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D) ||
- (amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_HDMI_TYPE_B)) {
- return MODE_OK;
- } else if (connector->display_info.is_hdmi) {
- /* HDMI 1.3+ supports max clock of 340 Mhz */
- if (mode->clock > 340000)
- return MODE_CLOCK_HIGH;
- else
- return MODE_OK;
- } else {
- return MODE_CLOCK_HIGH;
+ if (amdgpu_connector->use_digital) {
+ switch (amdgpu_connector->connector_object_id) {
+ case CONNECTOR_OBJECT_ID_HDMI_TYPE_A:
+ max_digital_pixel_clock_khz = max_hdmi_pixel_clock;
+ break;
+ case CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I:
+ case CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_D:
+ max_digital_pixel_clock_khz = max_dvi_single_link_pixel_clock;
+ break;
+ case CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I:
+ case CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D:
+ case CONNECTOR_OBJECT_ID_HDMI_TYPE_B:
+ max_digital_pixel_clock_khz = max_dvi_single_link_pixel_clock * 2;
+ break;
}
+
+ /* When the display EDID claims that it's an HDMI display,
+ * we use the HDMI encoder mode of the display HW,
+ * so we should verify against the max HDMI clock here.
+ */
+ if (connector->display_info.is_hdmi)
+ max_digital_pixel_clock_khz = max_hdmi_pixel_clock;
+
+ if (mode->clock > max_digital_pixel_clock_khz)
+ return MODE_CLOCK_HIGH;
}
/* check against the max pixel clock */
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 176/568] mips: lantiq: danube: add missing properties to cpu node
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 175/568] drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:22 ` [PATCH 6.1 177/568] mips: lantiq: danube: add model to EASY50712 dts Greg Kroah-Hartman
` (398 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aleksander Jan Bajkowski,
Thomas Bogendoerfer, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <olek2@wp.pl>
[ Upstream commit e8dee66c37085dc9858eb8608bc783c2900e50e7 ]
This fixes the following warnings:
arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#address-cells' is a required property
from schema $id: http://devicetree.org/schemas/cpus.yaml#
arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#size-cells' is a required property
from schema $id: http://devicetree.org/schemas/cpus.yaml#
arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpu@0 (mips,mips24Kc): 'reg' is a required property
from schema $id: http://devicetree.org/schemas/mips/cpus.yaml#
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/boot/dts/lantiq/danube.dtsi | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/mips/boot/dts/lantiq/danube.dtsi b/arch/mips/boot/dts/lantiq/danube.dtsi
index 510be63c8bdf1..ff6ff9568e1bc 100644
--- a/arch/mips/boot/dts/lantiq/danube.dtsi
+++ b/arch/mips/boot/dts/lantiq/danube.dtsi
@@ -5,8 +5,12 @@
compatible = "lantiq,xway", "lantiq,danube";
cpus {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
cpu@0 {
compatible = "mips,mips24Kc";
+ reg = <0>;
};
};
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 177/568] mips: lantiq: danube: add model to EASY50712 dts
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 176/568] mips: lantiq: danube: add missing properties to cpu node Greg Kroah-Hartman
@ 2025-12-03 15:22 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 178/568] mips: lantiq: danube: add missing device_type in pci node Greg Kroah-Hartman
` (397 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aleksander Jan Bajkowski,
Thomas Bogendoerfer, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <olek2@wp.pl>
[ Upstream commit cb96fd880ef78500b34d10fa76ddd3fa070287d6 ]
This fixes the following warning:
arch/mips/boot/dts/lantiq/danube_easy50712.dtb: / (lantiq,xway): 'model' is a required property
from schema $id: http://devicetree.org/schemas/root-node.yaml#
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/boot/dts/lantiq/danube_easy50712.dts | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/mips/boot/dts/lantiq/danube_easy50712.dts b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
index c4d7aa5753b04..ab70028dbefcf 100644
--- a/arch/mips/boot/dts/lantiq/danube_easy50712.dts
+++ b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
@@ -4,6 +4,8 @@
/include/ "danube.dtsi"
/ {
+ model = "Intel EASY50712";
+
chosen {
bootargs = "console=ttyLTQ0,115200 init=/etc/preinit";
};
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 178/568] mips: lantiq: danube: add missing device_type in pci node
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2025-12-03 15:22 ` [PATCH 6.1 177/568] mips: lantiq: danube: add model to EASY50712 dts Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 179/568] mips: lantiq: xway: sysctrl: rename stp clock Greg Kroah-Hartman
` (396 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aleksander Jan Bajkowski,
Thomas Bogendoerfer, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <olek2@wp.pl>
[ Upstream commit d66949a1875352d2ddd52b144333288952a9e36f ]
This fixes the following warning:
arch/mips/boot/dts/lantiq/danube_easy50712.dtb: pci@e105400 (lantiq,pci-xway): 'device_type' is a required property
from schema $id: http://devicetree.org/schemas/pci/pci-bus-common.yaml#
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/boot/dts/lantiq/danube.dtsi | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/mips/boot/dts/lantiq/danube.dtsi b/arch/mips/boot/dts/lantiq/danube.dtsi
index ff6ff9568e1bc..1a5f4faa0831f 100644
--- a/arch/mips/boot/dts/lantiq/danube.dtsi
+++ b/arch/mips/boot/dts/lantiq/danube.dtsi
@@ -105,6 +105,8 @@
0x1000000 0 0x00000000 0xae00000 0 0x200000>; /* io space */
reg = <0x7000000 0x8000 /* config space */
0xe105400 0x400>; /* pci bridge */
+
+ device_type = "pci";
};
};
};
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 179/568] mips: lantiq: xway: sysctrl: rename stp clock
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 178/568] mips: lantiq: danube: add missing device_type in pci node Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 180/568] mips: lantiq: danube: rename stp node on EASY50712 reference board Greg Kroah-Hartman
` (395 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aleksander Jan Bajkowski,
Thomas Bogendoerfer, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <olek2@wp.pl>
[ Upstream commit b0d04fe6a633ada2c7bc1b5ddd011cbd85961868 ]
Bindig requires a node name matching ‘^gpio@[0-9a-f]+$’. This patch
changes the clock name from “stp” to “gpio”.
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/lantiq/xway/sysctrl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c
index edf914393ad96..bcda4fa9fc87c 100644
--- a/arch/mips/lantiq/xway/sysctrl.c
+++ b/arch/mips/lantiq/xway/sysctrl.c
@@ -467,7 +467,7 @@ void __init ltq_soc_init(void)
/* add our generic xway clocks */
clkdev_add_pmu("10000000.fpi", NULL, 0, 0, PMU_FPI);
clkdev_add_pmu("1e100a00.gptu", NULL, 1, 0, PMU_GPT);
- clkdev_add_pmu("1e100bb0.stp", NULL, 1, 0, PMU_STP);
+ clkdev_add_pmu("1e100bb0.gpio", NULL, 1, 0, PMU_STP);
clkdev_add_pmu("1e100c00.serial", NULL, 0, 0, PMU_ASC1);
clkdev_add_pmu("1e104100.dma", NULL, 1, 0, PMU_DMA);
clkdev_add_pmu("1e100800.spi", NULL, 1, 0, PMU_SPI);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 180/568] mips: lantiq: danube: rename stp node on EASY50712 reference board
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 179/568] mips: lantiq: xway: sysctrl: rename stp clock Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 181/568] scsi: pm8001: Use int instead of u32 to store error codes Greg Kroah-Hartman
` (394 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aleksander Jan Bajkowski,
Thomas Bogendoerfer, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <olek2@wp.pl>
[ Upstream commit 2b9706ce84be9cb26be03e1ad2e43ec8bc3986be ]
This fixes the following warning:
arch/mips/boot/dts/lantiq/danube_easy50712.dtb: stp@e100bb0 (lantiq,gpio-stp-xway): $nodename:0: 'stp@e100bb0' does not match '^gpio@[0-9a-f]+$'
from schema $id: http://devicetree.org/schemas/gpio/gpio-stp-xway.yaml#
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/boot/dts/lantiq/danube_easy50712.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/mips/boot/dts/lantiq/danube_easy50712.dts b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
index ab70028dbefcf..c9f7886f57b8c 100644
--- a/arch/mips/boot/dts/lantiq/danube_easy50712.dts
+++ b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
@@ -96,7 +96,7 @@
lantiq,tx-burst-length = <4>;
};
- stp0: stp@e100bb0 {
+ stp0: gpio@e100bb0 {
#gpio-cells = <2>;
compatible = "lantiq,gpio-stp-xway";
gpio-controller;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 181/568] scsi: pm8001: Use int instead of u32 to store error codes
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 180/568] mips: lantiq: danube: rename stp node on EASY50712 reference board Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 182/568] ptp: Limit time setting of PTP clocks Greg Kroah-Hartman
` (393 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qianfeng Rong, Martin K. Petersen,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <rongqianfeng@vivo.com>
[ Upstream commit bee3554d1a4efbce91d6eca732f41b97272213a5 ]
Use int instead of u32 for 'ret' variable to store negative error codes
returned by PM8001_CHIP_DISP->set_nvmd_req().
Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Link: https://lore.kernel.org/r/20250826093242.230344-1-rongqianfeng@vivo.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/pm8001/pm8001_ctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
index 2f67f51785e64..3ac6b564a664a 100644
--- a/drivers/scsi/pm8001/pm8001_ctl.c
+++ b/drivers/scsi/pm8001/pm8001_ctl.c
@@ -686,7 +686,7 @@ static int pm8001_set_nvmd(struct pm8001_hba_info *pm8001_ha)
struct pm8001_ioctl_payload *payload;
DECLARE_COMPLETION_ONSTACK(completion);
u8 *ioctlbuffer;
- u32 ret;
+ int ret;
u32 length = 1024 * 5 + sizeof(*payload) - 1;
if (pm8001_ha->fw_image->size > 4096) {
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 182/568] ptp: Limit time setting of PTP clocks
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 181/568] scsi: pm8001: Use int instead of u32 to store error codes Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 183/568] dmaengine: sh: setup_xref error handling Greg Kroah-Hartman
` (392 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miroslav Lichvar, Richard Cochran,
Thomas Gleixner, John Stultz, Arnd Bergmann, Vadim Fedorenko,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miroslav Lichvar <mlichvar@redhat.com>
[ Upstream commit 5a8c02a6bf52b1cf9cfb7868a8330f7c3c6aebe9 ]
Networking drivers implementing PTP clocks and kernel socket code
handling hardware timestamps use the 64-bit signed ktime_t type counting
nanoseconds. When a PTP clock reaches the maximum value in year 2262,
the timestamps returned to applications will overflow into year 1667.
The same thing happens when injecting a large offset with
clock_adjtime(ADJ_SETOFFSET).
The commit 7a8e61f84786 ("timekeeping: Force upper bound for setting
CLOCK_REALTIME") limited the maximum accepted value setting the system
clock to 30 years before the maximum representable value (i.e. year
2232) to avoid the overflow, assuming the system will not run for more
than 30 years.
Enforce the same limit for PTP clocks. Don't allow negative values and
values closer than 30 years to the maximum value. Drivers may implement
an even lower limit if the hardware registers cannot represent the whole
interval between years 1970 and 2262 in the required resolution.
Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com>
Cc: Richard Cochran <richardcochran@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: John Stultz <jstultz@google.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Link: https://patch.msgid.link/20250828103300.1387025-1-mlichvar@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ptp/ptp_clock.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
index e6bcccf87cd6a..850ae55596850 100644
--- a/drivers/ptp/ptp_clock.c
+++ b/drivers/ptp/ptp_clock.c
@@ -83,6 +83,9 @@ static int ptp_clock_settime(struct posix_clock *pc, const struct timespec64 *tp
return -EBUSY;
}
+ if (!timespec64_valid_settod(tp))
+ return -EINVAL;
+
return ptp->info->settime64(ptp->info, tp);
}
@@ -113,7 +116,7 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx)
ops = ptp->info;
if (tx->modes & ADJ_SETOFFSET) {
- struct timespec64 ts;
+ struct timespec64 ts, ts2;
ktime_t kt;
s64 delta;
@@ -126,6 +129,14 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx)
if ((unsigned long) ts.tv_nsec >= NSEC_PER_SEC)
return -EINVAL;
+ /* Make sure the offset is valid */
+ err = ptp_clock_gettime(pc, &ts2);
+ if (err)
+ return err;
+ ts2 = timespec64_add(ts2, ts);
+ if (!timespec64_valid_settod(&ts2))
+ return -EINVAL;
+
kt = timespec64_to_ktime(ts);
delta = ktime_to_ns(kt);
err = ops->adjtime(ops, delta);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 183/568] dmaengine: sh: setup_xref error handling
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 182/568] ptp: Limit time setting of PTP clocks Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 184/568] dmaengine: mv_xor: match alloc_wc and free_wc Greg Kroah-Hartman
` (391 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Andreatta, Vinod Koul,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Andreatta <thomasandreatta2000@gmail.com>
[ Upstream commit d9a3e9929452780df16f3414f0d59b5f69d058cf ]
This patch modifies the type of setup_xref from void to int and handles
errors since the function can fail.
`setup_xref` now returns the (eventual) error from
`dmae_set_dmars`|`dmae_set_chcr`, while `shdma_tx_submit` handles the
result, removing the chunks from the queue and marking PM as idle in
case of an error.
Signed-off-by: Thomas Andreatta <thomas.andreatta2000@gmail.com>
Link: https://lore.kernel.org/r/20250827152442.90962-1-thomas.andreatta2000@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/sh/shdma-base.c | 25 +++++++++++++++++++------
drivers/dma/sh/shdmac.c | 17 +++++++++++++----
include/linux/shdma-base.h | 2 +-
3 files changed, 33 insertions(+), 11 deletions(-)
diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c
index 158e5e7defaeb..f309441f847ff 100644
--- a/drivers/dma/sh/shdma-base.c
+++ b/drivers/dma/sh/shdma-base.c
@@ -129,12 +129,25 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx)
const struct shdma_ops *ops = sdev->ops;
dev_dbg(schan->dev, "Bring up channel %d\n",
schan->id);
- /*
- * TODO: .xfer_setup() might fail on some platforms.
- * Make it int then, on error remove chunks from the
- * queue again
- */
- ops->setup_xfer(schan, schan->slave_id);
+
+ ret = ops->setup_xfer(schan, schan->slave_id);
+ if (ret < 0) {
+ dev_err(schan->dev, "setup_xfer failed: %d\n", ret);
+
+ /* Remove chunks from the queue and mark them as idle */
+ list_for_each_entry_safe(chunk, c, &schan->ld_queue, node) {
+ if (chunk->cookie == cookie) {
+ chunk->mark = DESC_IDLE;
+ list_move(&chunk->node, &schan->ld_free);
+ }
+ }
+
+ schan->pm_state = SHDMA_PM_ESTABLISHED;
+ ret = pm_runtime_put(schan->dev);
+
+ spin_unlock_irq(&schan->chan_lock);
+ return ret;
+ }
if (schan->pm_state == SHDMA_PM_PENDING)
shdma_chan_xfer_ld_queue(schan);
diff --git a/drivers/dma/sh/shdmac.c b/drivers/dma/sh/shdmac.c
index 5aafe548ca5f3..2b9774ae7fd32 100644
--- a/drivers/dma/sh/shdmac.c
+++ b/drivers/dma/sh/shdmac.c
@@ -301,21 +301,30 @@ static bool sh_dmae_channel_busy(struct shdma_chan *schan)
return dmae_is_busy(sh_chan);
}
-static void sh_dmae_setup_xfer(struct shdma_chan *schan,
- int slave_id)
+static int sh_dmae_setup_xfer(struct shdma_chan *schan, int slave_id)
{
struct sh_dmae_chan *sh_chan = container_of(schan, struct sh_dmae_chan,
shdma_chan);
+ int ret = 0;
if (slave_id >= 0) {
const struct sh_dmae_slave_config *cfg =
sh_chan->config;
- dmae_set_dmars(sh_chan, cfg->mid_rid);
- dmae_set_chcr(sh_chan, cfg->chcr);
+ ret = dmae_set_dmars(sh_chan, cfg->mid_rid);
+ if (ret < 0)
+ goto END;
+
+ ret = dmae_set_chcr(sh_chan, cfg->chcr);
+ if (ret < 0)
+ goto END;
+
} else {
dmae_init(sh_chan);
}
+
+END:
+ return ret;
}
/*
diff --git a/include/linux/shdma-base.h b/include/linux/shdma-base.h
index 6dfd05ef5c2d9..03ba4dab2ef73 100644
--- a/include/linux/shdma-base.h
+++ b/include/linux/shdma-base.h
@@ -96,7 +96,7 @@ struct shdma_ops {
int (*desc_setup)(struct shdma_chan *, struct shdma_desc *,
dma_addr_t, dma_addr_t, size_t *);
int (*set_slave)(struct shdma_chan *, int, dma_addr_t, bool);
- void (*setup_xfer)(struct shdma_chan *, int);
+ int (*setup_xfer)(struct shdma_chan *, int);
void (*start_xfer)(struct shdma_chan *, struct shdma_desc *);
struct shdma_desc *(*embedded_desc)(void *, int);
bool (*chan_irq)(struct shdma_chan *, int);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 184/568] dmaengine: mv_xor: match alloc_wc and free_wc
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 183/568] dmaengine: sh: setup_xref error handling Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 185/568] dmaengine: dw-edma: Set status for callback_result Greg Kroah-Hartman
` (390 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rosen Penev, Vinod Koul, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <rosenp@gmail.com>
[ Upstream commit a33e3b667d2f004fdfae6b442bd4676f6c510abb ]
dma_alloc_wc is used but not dma_free_wc.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://lore.kernel.org/r/20250821220942.10578-1-rosenp@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/mv_xor.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index ca0ba1d462832..8b215cbca1186 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -1013,7 +1013,7 @@ static int mv_xor_channel_remove(struct mv_xor_chan *mv_chan)
dma_async_device_unregister(&mv_chan->dmadev);
- dma_free_coherent(dev, MV_XOR_POOL_SIZE,
+ dma_free_wc(dev, MV_XOR_POOL_SIZE,
mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
dma_unmap_single(dev, mv_chan->dummy_src_addr,
MV_XOR_MIN_BYTE_COUNT, DMA_FROM_DEVICE);
@@ -1163,7 +1163,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
err_free_irq:
free_irq(mv_chan->irq, mv_chan);
err_free_dma:
- dma_free_coherent(&pdev->dev, MV_XOR_POOL_SIZE,
+ dma_free_wc(&pdev->dev, MV_XOR_POOL_SIZE,
mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
err_unmap_dst:
dma_unmap_single(dma_dev->dev, mv_chan->dummy_dst_addr,
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 185/568] dmaengine: dw-edma: Set status for callback_result
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 184/568] dmaengine: mv_xor: match alloc_wc and free_wc Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 186/568] drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL Greg Kroah-Hartman
` (389 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Devendra K Verma, Vinod Koul,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devendra K Verma <devverma@amd.com>
[ Upstream commit 5e742de97c806a4048418237ef1283e7d71eaf4b ]
DMA Engine has support for the callback_result which provides
the status of the request and the residue. This helps in
determining the correct status of the request and in
efficient resource management of the request.
The 'callback_result' method is preferred over the deprecated
'callback' method.
Signed-off-by: Devendra K Verma <devverma@amd.com>
Link: https://lore.kernel.org/r/20250821121505.318179-1-devverma@amd.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/dw-edma/dw-edma-core.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
index ef4cdcf6beba0..a4d9db43e62c8 100644
--- a/drivers/dma/dw-edma/dw-edma-core.c
+++ b/drivers/dma/dw-edma/dw-edma-core.c
@@ -563,6 +563,25 @@ dw_edma_device_prep_interleaved_dma(struct dma_chan *dchan,
return dw_edma_device_transfer(&xfer);
}
+static void dw_hdma_set_callback_result(struct virt_dma_desc *vd,
+ enum dmaengine_tx_result result)
+{
+ u32 residue = 0;
+ struct dw_edma_desc *desc;
+ struct dmaengine_result *res;
+
+ if (!vd->tx.callback_result)
+ return;
+
+ desc = vd2dw_edma_desc(vd);
+ if (desc)
+ residue = desc->alloc_sz - desc->xfer_sz;
+
+ res = &vd->tx_result;
+ res->result = result;
+ res->residue = residue;
+}
+
static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
{
struct dw_edma_desc *desc;
@@ -578,6 +597,8 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
case EDMA_REQ_NONE:
desc = vd2dw_edma_desc(vd);
if (!desc->chunks_alloc) {
+ dw_hdma_set_callback_result(vd,
+ DMA_TRANS_NOERROR);
list_del(&vd->node);
vchan_cookie_complete(vd);
}
@@ -616,6 +637,7 @@ static void dw_edma_abort_interrupt(struct dw_edma_chan *chan)
spin_lock_irqsave(&chan->vc.lock, flags);
vd = vchan_next_desc(&chan->vc);
if (vd) {
+ dw_hdma_set_callback_result(vd, DMA_TRANS_ABORTED);
list_del(&vd->node);
vchan_cookie_complete(vd);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 186/568] drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 185/568] dmaengine: dw-edma: Set status for callback_result Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 187/568] drm/msm/dsi/phy_7nm: Fix missing initial VCO rate Greg Kroah-Hartman
` (388 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov,
Krzysztof Kozlowski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit b63f008f395ca5f6bc89123db97440bdc19981c4 ]
According to Hardware Programming Guide for DSI PHY, the retime buffer
resync should be done after PLL clock users (byte_clk and intf_byte_clk)
are enabled. Downstream also does it as part of configuring the PLL.
Driver was only turning off the resync FIFO buffer, but never bringing it
on again.
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/657823/
Link: https://lore.kernel.org/r/20250610-b4-sm8750-display-v6-6-ee633e3ddbff@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
index 9e7fa7d88ead2..9f2806b9e1740 100644
--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
@@ -400,6 +400,10 @@ static int dsi_pll_7nm_vco_prepare(struct clk_hw *hw)
if (pll_7nm->slave)
dsi_pll_enable_global_clk(pll_7nm->slave);
+ writel(0x1, pll_7nm->phy->base + REG_DSI_7nm_PHY_CMN_RBUF_CTRL);
+ if (pll_7nm->slave)
+ writel(0x1, pll_7nm->slave->phy->base + REG_DSI_7nm_PHY_CMN_RBUF_CTRL);
+
error:
return rc;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 187/568] drm/msm/dsi/phy_7nm: Fix missing initial VCO rate
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 186/568] drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 188/568] drm/amdgpu: Allow kfd CRIU with no buffer objects Greg Kroah-Hartman
` (387 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov,
Krzysztof Kozlowski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 5ddcb0cb9d10e6e70a68e0cb8f0b8e3a7eb8ccaf ]
Driver unconditionally saves current state on first init in
dsi_pll_7nm_init(), but does not save the VCO rate, only some of the
divider registers. The state is then restored during probe/enable via
msm_dsi_phy_enable() -> msm_dsi_phy_pll_restore_state() ->
dsi_7nm_pll_restore_state().
Restoring calls dsi_pll_7nm_vco_set_rate() with
pll_7nm->vco_current_rate=0, which basically overwrites existing rate of
VCO and messes with clock hierarchy, by setting frequency to 0 to clock
tree. This makes anyway little sense - VCO rate was not saved, so
should not be restored.
If PLL was not configured configure it to minimum rate to avoid glitches
and configuring entire in clock hierarchy to 0 Hz.
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/657827/
Link: https://lore.kernel.org/r/20250610-b4-sm8750-display-v6-9-ee633e3ddbff@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
index 9f2806b9e1740..a44cb48c6db7f 100644
--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
@@ -752,6 +752,12 @@ static int dsi_pll_7nm_init(struct msm_dsi_phy *phy)
/* TODO: Remove this when we have proper display handover support */
msm_dsi_phy_pll_save_state(phy);
+ /*
+ * Store also proper vco_current_rate, because its value will be used in
+ * dsi_7nm_pll_restore_state().
+ */
+ if (!dsi_pll_7nm_vco_recalc_rate(&pll_7nm->clk_hw, VCO_REF_CLK_RATE))
+ pll_7nm->vco_current_rate = pll_7nm->phy->cfg->min_pll_rate;
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 188/568] drm/amdgpu: Allow kfd CRIU with no buffer objects
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 187/568] drm/msm/dsi/phy_7nm: Fix missing initial VCO rate Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 189/568] ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled Greg Kroah-Hartman
` (386 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Felix Kuehling, David Francis,
Alex Deucher, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Francis <David.Francis@amd.com>
[ Upstream commit 85705b18ae7674347f8675f64b2b3115fb1d5629 ]
The kfd CRIU checkpoint ioctl would return an error if trying
to checkpoint a process with no kfd buffer objects.
This is a normal case and should not be an error.
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: David Francis <David.Francis@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 890c2befe7dce..77af134842feb 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -2480,8 +2480,8 @@ static int criu_restore(struct file *filep,
pr_debug("CRIU restore (num_devices:%u num_bos:%u num_objects:%u priv_data_size:%llu)\n",
args->num_devices, args->num_bos, args->num_objects, args->priv_data_size);
- if (!args->bos || !args->devices || !args->priv_data || !args->priv_data_size ||
- !args->num_devices || !args->num_bos)
+ if ((args->num_bos > 0 && !args->bos) || !args->devices || !args->priv_data ||
+ !args->priv_data_size || !args->num_devices)
return -EINVAL;
mutex_lock(&p->mutex);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 189/568] ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 188/568] drm/amdgpu: Allow kfd CRIU with no buffer objects Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 190/568] net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms Greg Kroah-Hartman
` (385 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yue Haibing, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yue Haibing <yuehaibing@huawei.com>
[ Upstream commit 3d95261eeb74958cd496e1875684827dc5d028cc ]
In ipv6_rpl_srh_rcv() we use min(net->ipv6.devconf_all->rpl_seg_enabled,
idev->cnf.rpl_seg_enabled) is intended to return 0 when either value is
zero, but if one of the values is negative it will in fact return non-zero.
Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
Link: https://patch.msgid.link/20250901123726.1972881-3-yuehaibing@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index cbdb510b40ea2..03961f8080757 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -7070,7 +7070,9 @@ static const struct ctl_table addrconf_sysctl[] = {
.data = &ipv6_devconf.rpl_seg_enabled,
.maxlen = sizeof(int),
.mode = 0644,
- .proc_handler = proc_dointvec,
+ .proc_handler = proc_dointvec_minmax,
+ .extra1 = SYSCTL_ZERO,
+ .extra2 = SYSCTL_ONE,
},
{
.procname = "ioam6_enabled",
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 190/568] net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 189/568] ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 191/568] media: adv7180: Add missing lock in suspend callback Greg Kroah-Hartman
` (384 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Juraj Šarinay,
Krzysztof Kozlowski, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juraj Šarinay <juraj@sarinay.com>
[ Upstream commit 21f82062d0f241e55dd59eb630e8710862cc90b4 ]
An exchange with a NFC target must complete within NCI_DATA_TIMEOUT.
A delay of 700 ms is not sufficient for cryptographic operations on smart
cards. CardOS 6.0 may need up to 1.3 seconds to perform 256-bit ECDH
or 3072-bit RSA. To prevent brute-force attacks, passports and similar
documents introduce even longer delays into access control protocols
(BAC/PACE).
The timeout should be higher, but not too much. The expiration allows
us to detect that a NFC target has disappeared.
Signed-off-by: Juraj Šarinay <juraj@sarinay.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://patch.msgid.link/20250902113630.62393-1-juraj@sarinay.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/nfc/nci_core.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
index ea8595651c384..e066bdbc807be 100644
--- a/include/net/nfc/nci_core.h
+++ b/include/net/nfc/nci_core.h
@@ -52,7 +52,7 @@ enum nci_state {
#define NCI_RF_DISC_SELECT_TIMEOUT 5000
#define NCI_RF_DEACTIVATE_TIMEOUT 30000
#define NCI_CMD_TIMEOUT 5000
-#define NCI_DATA_TIMEOUT 700
+#define NCI_DATA_TIMEOUT 3000
struct nci_dev;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 191/568] media: adv7180: Add missing lock in suspend callback
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 190/568] net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 192/568] media: adv7180: Do not write format to device in set_fmt Greg Kroah-Hartman
` (383 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Söderlund, Hans Verkuil,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
[ Upstream commit 878c496ac5080f94a93a9216a8f70cfd67ace8c9 ]
The adv7180_set_power() utilizes adv7180_write() which in turn requires
the state mutex to be held, take it before calling adv7180_set_power()
to avoid tripping a lockdep_assert_held().
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/adv7180.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
index 46912a7b671a8..a7977f9c64c88 100644
--- a/drivers/media/i2c/adv7180.c
+++ b/drivers/media/i2c/adv7180.c
@@ -804,6 +804,8 @@ static int adv7180_set_pad_format(struct v4l2_subdev *sd,
if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE) {
if (state->field != format->format.field) {
+ guard(mutex)(&state->mutex);
+
state->field = format->format.field;
adv7180_set_power(state, false);
adv7180_set_field_mode(state);
@@ -1568,6 +1570,8 @@ static int adv7180_suspend(struct device *dev)
struct v4l2_subdev *sd = dev_get_drvdata(dev);
struct adv7180_state *state = to_state(sd);
+ guard(mutex)(&state->mutex);
+
return adv7180_set_power(state, false);
}
@@ -1581,6 +1585,8 @@ static int adv7180_resume(struct device *dev)
if (ret < 0)
return ret;
+ guard(mutex)(&state->mutex);
+
ret = adv7180_set_power(state, state->powered);
if (ret)
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 192/568] media: adv7180: Do not write format to device in set_fmt
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 191/568] media: adv7180: Add missing lock in suspend callback Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 193/568] media: adv7180: Only validate format in querystd Greg Kroah-Hartman
` (382 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Söderlund,
Laurent Pinchart, Hans Verkuil, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
[ Upstream commit 46c1e7814d1c3310ef23c01ed1a582ef0c8ab1d2 ]
The .set_fmt callback should not write the new format directly do the
device, it should only store it and have it applied by .s_stream.
The .s_stream callback already calls adv7180_set_field_mode() so it's
safe to remove programming of the device and just store the format and
have .s_stream apply it.
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/adv7180.c | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
index a7977f9c64c88..74356ea06deee 100644
--- a/drivers/media/i2c/adv7180.c
+++ b/drivers/media/i2c/adv7180.c
@@ -803,14 +803,7 @@ static int adv7180_set_pad_format(struct v4l2_subdev *sd,
ret = adv7180_mbus_fmt(sd, &format->format);
if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE) {
- if (state->field != format->format.field) {
- guard(mutex)(&state->mutex);
-
- state->field = format->format.field;
- adv7180_set_power(state, false);
- adv7180_set_field_mode(state);
- adv7180_set_power(state, true);
- }
+ state->field = format->format.field;
} else {
framefmt = v4l2_subdev_get_try_format(sd, sd_state, 0);
*framefmt = format->format;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 193/568] media: adv7180: Only validate format in querystd
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 192/568] media: adv7180: Do not write format to device in set_fmt Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 194/568] media: verisilicon: Explicitly disable selection api ioctls for decoders Greg Kroah-Hartman
` (381 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Söderlund, Hans Verkuil,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
[ Upstream commit 91c5d7c849273d14bc4bae1b92666bdb5409294a ]
The .querystd callback should not program the device with the detected
standard, it should only report the standard to user-space. User-space
may then use .s_std to set the standard, if it wants to use it.
All that is required of .querystd is to setup the auto detection of
standards and report its findings.
While at it add some documentation on why this can't happen while
streaming and improve the error handling using a scoped guard.
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/adv7180.c | 37 ++++++++++++++++---------------------
1 file changed, 16 insertions(+), 21 deletions(-)
diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
index 74356ea06deee..5d10edcfcc3b5 100644
--- a/drivers/media/i2c/adv7180.c
+++ b/drivers/media/i2c/adv7180.c
@@ -356,32 +356,27 @@ static inline struct adv7180_state *to_state(struct v4l2_subdev *sd)
static int adv7180_querystd(struct v4l2_subdev *sd, v4l2_std_id *std)
{
struct adv7180_state *state = to_state(sd);
- int err = mutex_lock_interruptible(&state->mutex);
- if (err)
- return err;
-
- if (state->streaming) {
- err = -EBUSY;
- goto unlock;
- }
+ int ret;
- err = adv7180_set_video_standard(state,
- ADV7180_STD_AD_PAL_BG_NTSC_J_SECAM);
- if (err)
- goto unlock;
+ guard(mutex)(&state->mutex);
- msleep(100);
- __adv7180_status(state, NULL, std);
+ /*
+ * We can't sample the standard if the device is streaming as that would
+ * interfere with the capture session as the VID_SEL reg is touched.
+ */
+ if (state->streaming)
+ return -EBUSY;
- err = v4l2_std_to_adv7180(state->curr_norm);
- if (err < 0)
- goto unlock;
+ /* Set the standard to autodetect PAL B/G/H/I/D, NTSC J or SECAM */
+ ret = adv7180_set_video_standard(state,
+ ADV7180_STD_AD_PAL_BG_NTSC_J_SECAM);
+ if (ret)
+ return ret;
- err = adv7180_set_video_standard(state, err);
+ /* Allow some time for the autodetection to run. */
+ msleep(100);
-unlock:
- mutex_unlock(&state->mutex);
- return err;
+ return __adv7180_status(state, NULL, std);
}
static int adv7180_s_routing(struct v4l2_subdev *sd, u32 input,
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 194/568] media: verisilicon: Explicitly disable selection api ioctls for decoders
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 193/568] media: adv7180: Only validate format in querystd Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 195/568] ALSA: usb-audio: apply quirk for MOONDROP Quark2 Greg Kroah-Hartman
` (380 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Kocialkowski, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Kocialkowski <paulk@sys-base.io>
[ Upstream commit 73d50aa92f28ee8414fbfde011974fce970b82cc ]
Call the dedicated v4l2_disable_ioctl helper instead of manually
checking whether the current context is an encoder for the selection
api ioctls.
Signed-off-by: Paul Kocialkowski <paulk@sys-base.io>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/verisilicon/hantro_drv.c | 2 ++
drivers/media/platform/verisilicon/hantro_v4l2.c | 6 ++----
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
index 69a2442f31223..a35b6ae62d585 100644
--- a/drivers/media/platform/verisilicon/hantro_drv.c
+++ b/drivers/media/platform/verisilicon/hantro_drv.c
@@ -819,6 +819,8 @@ static int hantro_add_func(struct hantro_dev *vpu, unsigned int funcid)
vpu->decoder = func;
v4l2_disable_ioctl(vfd, VIDIOC_TRY_ENCODER_CMD);
v4l2_disable_ioctl(vfd, VIDIOC_ENCODER_CMD);
+ v4l2_disable_ioctl(vfd, VIDIOC_G_SELECTION);
+ v4l2_disable_ioctl(vfd, VIDIOC_S_SELECTION);
}
video_set_drvdata(vfd, vpu);
diff --git a/drivers/media/platform/verisilicon/hantro_v4l2.c b/drivers/media/platform/verisilicon/hantro_v4l2.c
index b2da48936e3f1..31ae6750321c4 100644
--- a/drivers/media/platform/verisilicon/hantro_v4l2.c
+++ b/drivers/media/platform/verisilicon/hantro_v4l2.c
@@ -629,8 +629,7 @@ static int vidioc_g_selection(struct file *file, void *priv,
struct hantro_ctx *ctx = fh_to_ctx(priv);
/* Crop only supported on source. */
- if (!ctx->is_encoder ||
- sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
+ if (sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
return -EINVAL;
switch (sel->target) {
@@ -662,8 +661,7 @@ static int vidioc_s_selection(struct file *file, void *priv,
struct vb2_queue *vq;
/* Crop only supported on source. */
- if (!ctx->is_encoder ||
- sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
+ if (sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
return -EINVAL;
/* Change not allowed if the queue is streaming. */
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 195/568] ALSA: usb-audio: apply quirk for MOONDROP Quark2
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 194/568] media: verisilicon: Explicitly disable selection api ioctls for decoders Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 196/568] net: call cond_resched() less often in __release_sock() Greg Kroah-Hartman
` (379 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guoli An, Cryolitia PukNgae,
Takashi Iwai, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cryolitia PukNgae <cryolitia@uniontech.com>
[ Upstream commit a73349c5dd27bc544b048e2e2c8ef6394f05b793 ]
It reports a MIN value -15360 for volume control, but will mute when
setting it less than -14208
Tested-by: Guoli An <anguoli@uniontech.com>
Signed-off-by: Cryolitia PukNgae <cryolitia@uniontech.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20250903-sound-v1-4-d4ca777b8512@uniontech.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 4cded91d22a8d..d258c7324fcc7 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -1191,6 +1191,13 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
cval->res = 1;
}
break;
+ case USB_ID(0x3302, 0x12db): /* MOONDROP Quark2 */
+ if (!strcmp(kctl->id.name, "PCM Playback Volume")) {
+ usb_audio_info(chip,
+ "set volume quirk for MOONDROP Quark2\n");
+ cval->min = -14208; /* Mute under it */
+ }
+ break;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 196/568] net: call cond_resched() less often in __release_sock()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 195/568] ALSA: usb-audio: apply quirk for MOONDROP Quark2 Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 197/568] smsc911x: add second read of EEPROM mac when possible corruption seen Greg Kroah-Hartman
` (378 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Kuniyuki Iwashima,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 16c610162d1f1c332209de1c91ffb09b659bb65d ]
While stress testing TCP I had unexpected retransmits and sack packets
when a single cpu receives data from multiple high-throughput flows.
super_netperf 4 -H srv -T,10 -l 3000 &
Tcpdump extract:
00:00:00.000007 IP6 clnt > srv: Flags [.], seq 26062848:26124288, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440
00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26124288:26185728, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440
00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26185728:26243072, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 57344
00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26243072:26304512, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440
00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26304512:26365952, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440
00:00:00.000007 IP6 clnt > srv: Flags [P.], seq 26365952:26423296, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 57344
00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26423296:26484736, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440
00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26484736:26546176, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440
00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26546176:26603520, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 57344
00:00:00.003932 IP6 clnt > srv: Flags [P.], seq 26603520:26619904, ack 1, win 66, options [nop,nop,TS val 651464844 ecr 3100753141], length 16384
00:00:00.006602 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651471419 ecr 3100759716], length 4096
00:00:00.013000 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651484421 ecr 3100772718], length 4096
00:00:00.000416 IP6 srv > clnt: Flags [.], ack 26619904, win 1393, options [nop,nop,TS val 3100773185 ecr 651484421,nop,nop,sack 1 {24862720:24866816}], length 0
After analysis, it appears this is because of the cond_resched()
call from __release_sock().
When current thread is yielding, while still holding the TCP socket lock,
it might regain the cpu after a very long time.
Other peer TLP/RTO is firing (multiple times) and packets are retransmit,
while the initial copy is waiting in the socket backlog or receive queue.
In this patch, I call cond_resched() only once every 16 packets.
Modern TCP stack now spends less time per packet in the backlog,
especially because ACK are no longer sent (commit 133c4c0d3717
"tcp: defer regular ACK while processing socket backlog")
Before:
clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK"
TcpOutSegs 19046186 0.0
TcpRetransSegs 1471 0.0
TcpExtTCPTimeouts 1397 0.0
TcpExtTCPLossProbes 1356 0.0
TcpExtTCPDSACKRecv 1352 0.0
TcpExtTCPSpuriousRTOs 114 0.0
TcpExtTCPDSACKRecvSegs 1352 0.0
After:
clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK"
TcpOutSegs 19218936 0.0
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20250903174811.1930820-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/sock.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/net/core/sock.c b/net/core/sock.c
index 1c4d225e93290..7702033680e7b 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2930,23 +2930,27 @@ void __release_sock(struct sock *sk)
__acquires(&sk->sk_lock.slock)
{
struct sk_buff *skb, *next;
+ int nb = 0;
while ((skb = sk->sk_backlog.head) != NULL) {
sk->sk_backlog.head = sk->sk_backlog.tail = NULL;
spin_unlock_bh(&sk->sk_lock.slock);
- do {
+ while (1) {
next = skb->next;
prefetch(next);
DEBUG_NET_WARN_ON_ONCE(skb_dst_is_noref(skb));
skb_mark_not_on_list(skb);
sk_backlog_rcv(sk, skb);
- cond_resched();
-
skb = next;
- } while (skb != NULL);
+ if (!skb)
+ break;
+
+ if (!(++nb & 15))
+ cond_resched();
+ }
spin_lock_bh(&sk->sk_lock.slock);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 197/568] smsc911x: add second read of EEPROM mac when possible corruption seen
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 196/568] net: call cond_resched() less often in __release_sock() Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 198/568] iommu/amd: Skip enabling command/event buffers for kdump Greg Kroah-Hartman
` (377 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Colin Foster, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Foster <colin.foster@in-advantage.com>
[ Upstream commit 69777753a8919b0b8313c856e707e1d1fe5ced85 ]
When the EEPROM MAC is read by way of ADDRH, it can return all 0s the
first time. Subsequent reads succeed.
This is fully reproduceable on the Phytec PCM049 SOM.
Re-read the ADDRH when this behaviour is observed, in an attempt to
correctly apply the EEPROM MAC address.
Signed-off-by: Colin Foster <colin.foster@in-advantage.com>
Link: https://patch.msgid.link/20250903132610.966787-1-colin.foster@in-advantage.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/smsc/smsc911x.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index a690d139e1770..a1bb16ba36595 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -2165,10 +2165,20 @@ static const struct net_device_ops smsc911x_netdev_ops = {
static void smsc911x_read_mac_address(struct net_device *dev)
{
struct smsc911x_data *pdata = netdev_priv(dev);
- u32 mac_high16 = smsc911x_mac_read(pdata, ADDRH);
- u32 mac_low32 = smsc911x_mac_read(pdata, ADDRL);
+ u32 mac_high16, mac_low32;
u8 addr[ETH_ALEN];
+ mac_high16 = smsc911x_mac_read(pdata, ADDRH);
+ mac_low32 = smsc911x_mac_read(pdata, ADDRL);
+
+ /* The first mac_read in some setups can incorrectly read 0. Re-read it
+ * to get the full MAC if this is observed.
+ */
+ if (mac_high16 == 0) {
+ SMSC_TRACE(pdata, probe, "Re-read MAC ADDRH\n");
+ mac_high16 = smsc911x_mac_read(pdata, ADDRH);
+ }
+
addr[0] = (u8)(mac_low32);
addr[1] = (u8)(mac_low32 >> 8);
addr[2] = (u8)(mac_low32 >> 16);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 198/568] iommu/amd: Skip enabling command/event buffers for kdump
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 197/568] smsc911x: add second read of EEPROM mac when possible corruption seen Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 199/568] drm/amd: add more cyan skillfish PCI ids Greg Kroah-Hartman
` (376 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vasant Hegde, Sairaj Kodilkar,
Ashish Kalra, Joerg Roedel, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ashish Kalra <ashish.kalra@amd.com>
[ Upstream commit 9be15fbfc6c5c89c22cf6e209f66ea43ee0e58bb ]
After a panic if SNP is enabled in the previous kernel then the kdump
kernel boots with IOMMU SNP enforcement still enabled.
IOMMU command buffers and event buffer registers remain locked and
exclusive to the previous kernel. Attempts to enable command and event
buffers in the kdump kernel will fail, as hardware ignores writes to
the locked MMIO registers as per AMD IOMMU spec Section 2.12.2.1.
Skip enabling command buffers and event buffers for kdump boot as they
are already enabled in the previous kernel.
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Tested-by: Sairaj Kodilkar <sarunkod@amd.com>
Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
Link: https://lore.kernel.org/r/576445eb4f168b467b0fc789079b650ca7c5b037.1756157913.git.ashish.kalra@amd.com
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/amd/init.c | 28 +++++++++++++++++++---------
1 file changed, 19 insertions(+), 9 deletions(-)
diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index 23804270eda19..12bc854fd177f 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -805,11 +805,16 @@ static void iommu_enable_command_buffer(struct amd_iommu *iommu)
BUG_ON(iommu->cmd_buf == NULL);
- entry = iommu_virt_to_phys(iommu->cmd_buf);
- entry |= MMIO_CMD_SIZE_512;
-
- memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET,
- &entry, sizeof(entry));
+ if (!is_kdump_kernel()) {
+ /*
+ * Command buffer is re-used for kdump kernel and setting
+ * of MMIO register is not required.
+ */
+ entry = iommu_virt_to_phys(iommu->cmd_buf);
+ entry |= MMIO_CMD_SIZE_512;
+ memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET,
+ &entry, sizeof(entry));
+ }
amd_iommu_reset_cmd_buffer(iommu);
}
@@ -858,10 +863,15 @@ static void iommu_enable_event_buffer(struct amd_iommu *iommu)
BUG_ON(iommu->evt_buf == NULL);
- entry = iommu_virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK;
-
- memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET,
- &entry, sizeof(entry));
+ if (!is_kdump_kernel()) {
+ /*
+ * Event buffer is re-used for kdump kernel and setting
+ * of MMIO register is not required.
+ */
+ entry = iommu_virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK;
+ memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET,
+ &entry, sizeof(entry));
+ }
/* set head and tail to zero manually */
writel(0x00, iommu->mmio_base + MMIO_EVT_HEAD_OFFSET);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 199/568] drm/amd: add more cyan skillfish PCI ids
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 198/568] iommu/amd: Skip enabling command/event buffers for kdump Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 200/568] drm/amdgpu: dont enable SMU on cyan skillfish Greg Kroah-Hartman
` (375 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alex Deucher, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
[ Upstream commit 1e18746381793bef7c715fc5ec5611a422a75c4c ]
Add additional PCI IDs to the cyan skillfish family.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 1fbb73b2691d5..6104353e4c2f4 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -1997,6 +1997,11 @@ static const struct pci_device_id pciidlist[] = {
{0x1002, 0x7410, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ALDEBARAN},
/* CYAN_SKILLFISH */
+ {0x1002, 0x13DB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
+ {0x1002, 0x13F9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
+ {0x1002, 0x13FA, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
+ {0x1002, 0x13FB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
+ {0x1002, 0x13FC, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
{0x1002, 0x13FE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
{0x1002, 0x143F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 200/568] drm/amdgpu: dont enable SMU on cyan skillfish
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 199/568] drm/amd: add more cyan skillfish PCI ids Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 201/568] drm/amdgpu: add support for cyan skillfish gpu_info Greg Kroah-Hartman
` (374 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alex Deucher, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
[ Upstream commit 94bd7bf2c920998b4c756bc8a54fd3dbdf7e4360 ]
Cyan skillfish uses different SMU firmware.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
index d8441e273cb5d..9b1c4d5be61f8 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -1669,13 +1669,16 @@ static int amdgpu_discovery_set_smu_ip_blocks(struct amdgpu_device *adev)
case IP_VERSION(11, 0, 5):
case IP_VERSION(11, 0, 9):
case IP_VERSION(11, 0, 7):
- case IP_VERSION(11, 0, 8):
case IP_VERSION(11, 0, 11):
case IP_VERSION(11, 0, 12):
case IP_VERSION(11, 0, 13):
case IP_VERSION(11, 5, 0):
amdgpu_device_ip_block_add(adev, &smu_v11_0_ip_block);
break;
+ case IP_VERSION(11, 0, 8):
+ if (adev->apu_flags & AMD_APU_IS_CYAN_SKILLFISH2)
+ amdgpu_device_ip_block_add(adev, &smu_v11_0_ip_block);
+ break;
case IP_VERSION(12, 0, 0):
case IP_VERSION(12, 0, 1):
amdgpu_device_ip_block_add(adev, &smu_v12_0_ip_block);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 201/568] drm/amdgpu: add support for cyan skillfish gpu_info
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 200/568] drm/amdgpu: dont enable SMU on cyan skillfish Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 202/568] usb: gadget: f_hid: Fix zero length packet transfer Greg Kroah-Hartman
` (373 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alex Deucher, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
[ Upstream commit fa819e3a7c1ee994ce014cc5a991c7fd91bc00f1 ]
Some SOCs which are part of the cyan skillfish family
rely on an explicit firmware for IP discovery. Add support
for the gpu_info firmware.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 079cf3292f632..18a0802cb74dc 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -91,6 +91,7 @@ MODULE_FIRMWARE("amdgpu/picasso_gpu_info.bin");
MODULE_FIRMWARE("amdgpu/raven2_gpu_info.bin");
MODULE_FIRMWARE("amdgpu/arcturus_gpu_info.bin");
MODULE_FIRMWARE("amdgpu/navi12_gpu_info.bin");
+MODULE_FIRMWARE("amdgpu/cyan_skillfish_gpu_info.bin");
#define AMDGPU_RESUME_MS 2000
#define AMDGPU_MAX_RETRY_LIMIT 2
@@ -2019,6 +2020,9 @@ static int amdgpu_device_parse_gpu_info_fw(struct amdgpu_device *adev)
case CHIP_NAVI12:
chip_name = "navi12";
break;
+ case CHIP_CYAN_SKILLFISH:
+ chip_name = "cyan_skillfish";
+ break;
}
snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_gpu_info.bin", chip_name);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 202/568] usb: gadget: f_hid: Fix zero length packet transfer
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 201/568] drm/amdgpu: add support for cyan skillfish gpu_info Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 203/568] usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget Greg Kroah-Hartman
` (372 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, William Wu, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Wu <william.wu@rock-chips.com>
[ Upstream commit ed6f727c575b1eb8136e744acfd5e7306c9548f6 ]
Set the hid req->zero flag of ep0/in_ep to true by default,
then the UDC drivers can transfer a zero length packet at
the end if the hid transfer with size divisible to EPs max
packet size according to the USB 2.0 spec.
Signed-off-by: William Wu <william.wu@rock-chips.com>
Link: https://lore.kernel.org/r/1756204087-26111-1-git-send-email-william.wu@rock-chips.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/function/f_hid.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 4cc8750e2a6fd..c20d3426571ec 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -490,7 +490,7 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer,
}
req->status = 0;
- req->zero = 0;
+ req->zero = 1;
req->length = count;
req->complete = f_hidg_req_complete;
req->context = hidg;
@@ -761,7 +761,7 @@ static int hidg_setup(struct usb_function *f,
return -EOPNOTSUPP;
respond:
- req->zero = 0;
+ req->zero = 1;
req->length = length;
status = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
if (status < 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 203/568] usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 202/568] usb: gadget: f_hid: Fix zero length packet transfer Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 204/568] drm/msm: make sure to not queue up recovery more than once Greg Kroah-Hartman
` (371 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chen Yufeng, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Yufeng <chenyufeng@iie.ac.cn>
[ Upstream commit 87c5ff5615dc0a37167e8faf3adeeddc6f1344a3 ]
In the __cdnsp_gadget_init() and cdnsp_gadget_exit() functions, the gadget
structure (pdev->gadget) was freed before its endpoints.
The endpoints are linked via the ep_list in the gadget structure.
Freeing the gadget first leaves dangling pointers in the endpoint list.
When the endpoints are subsequently freed, this results in a use-after-free.
Fix:
By separating the usb_del_gadget_udc() operation into distinct "del" and
"put" steps, cdnsp_gadget_free_endpoints() can be executed prior to the
final release of the gadget structure with usb_put_gadget().
A patch similar to bb9c74a5bd14("usb: dwc3: gadget: Free gadget structure
only after freeing endpoints").
Signed-off-by: Chen Yufeng <chenyufeng@iie.ac.cn>
Link: https://lore.kernel.org/r/20250905094842.1232-1-chenyufeng@iie.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/cdns3/cdnsp-gadget.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/cdns3/cdnsp-gadget.c b/drivers/usb/cdns3/cdnsp-gadget.c
index ccd02f6be78ae..51dac7db52841 100644
--- a/drivers/usb/cdns3/cdnsp-gadget.c
+++ b/drivers/usb/cdns3/cdnsp-gadget.c
@@ -1975,7 +1975,10 @@ static int __cdnsp_gadget_init(struct cdns *cdns)
return 0;
del_gadget:
- usb_del_gadget_udc(&pdev->gadget);
+ usb_del_gadget(&pdev->gadget);
+ cdnsp_gadget_free_endpoints(pdev);
+ usb_put_gadget(&pdev->gadget);
+ goto halt_pdev;
free_endpoints:
cdnsp_gadget_free_endpoints(pdev);
halt_pdev:
@@ -1997,8 +2000,9 @@ static void cdnsp_gadget_exit(struct cdns *cdns)
devm_free_irq(pdev->dev, cdns->dev_irq, pdev);
pm_runtime_mark_last_busy(cdns->dev);
pm_runtime_put_autosuspend(cdns->dev);
- usb_del_gadget_udc(&pdev->gadget);
+ usb_del_gadget(&pdev->gadget);
cdnsp_gadget_free_endpoints(pdev);
+ usb_put_gadget(&pdev->gadget);
cdnsp_mem_cleanup(pdev);
kfree(pdev);
cdns->gadget_dev = NULL;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 204/568] drm/msm: make sure to not queue up recovery more than once
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 203/568] usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 205/568] media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer Greg Kroah-Hartman
` (370 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Antonino Maniscalco, Akhil P Oommen,
Rob Clark, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antonino Maniscalco <antomani103@gmail.com>
[ Upstream commit 10fb1b2fcaee5545a5e54db1ed4d7b15c2db50c8 ]
If two fault IRQs arrive in short succession recovery work will be
queued up twice.
When recovery runs a second time it may end up killing an unrelated
context.
Prevent this by masking off interrupts when triggering recovery.
Signed-off-by: Antonino Maniscalco <antomani103@gmail.com>
Reviewed-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/670023/
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
index cdb4665b953c8..e06204e00e935 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
@@ -1507,6 +1507,9 @@ static void a6xx_fault_detect_irq(struct msm_gpu *gpu)
/* Turn off the hangcheck timer to keep it from bothering us */
del_timer(&gpu->hangcheck_timer);
+ /* Turn off interrupts to avoid triggering recovery again */
+ gpu_write(gpu, REG_A6XX_RBBM_INT_0_MASK, 0);
+
kthread_queue_work(gpu->worker, &gpu->recover_work);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 205/568] media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 204/568] drm/msm: make sure to not queue up recovery more than once Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 206/568] scsi: ufs: host: mediatek: Enhance recovery on resume failure Greg Kroah-Hartman
` (369 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Zapolskiy, Sakari Ailus,
Hans Verkuil, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
[ Upstream commit bfbd5aa5347fbd11ade188b316b800bfb27d9e22 ]
The OmniVision OG01A1B image sensor is a monochrome sensor, it supports
8-bit and 10-bit RAW output formats only.
That said the planar greyscale Y8/Y10 media formats are more appropriate
for the sensor instead of the originally and arbitrary selected SGRBG one,
since there is no red, green or blue color components.
Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/og01a1b.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/media/i2c/og01a1b.c b/drivers/media/i2c/og01a1b.c
index 35663c10fcd9f..0ceb46d947a16 100644
--- a/drivers/media/i2c/og01a1b.c
+++ b/drivers/media/i2c/og01a1b.c
@@ -676,7 +676,7 @@ static void og01a1b_update_pad_format(const struct og01a1b_mode *mode,
{
fmt->width = mode->width;
fmt->height = mode->height;
- fmt->code = MEDIA_BUS_FMT_SGRBG10_1X10;
+ fmt->code = MEDIA_BUS_FMT_Y10_1X10;
fmt->field = V4L2_FIELD_NONE;
}
@@ -867,7 +867,7 @@ static int og01a1b_enum_mbus_code(struct v4l2_subdev *sd,
if (code->index > 0)
return -EINVAL;
- code->code = MEDIA_BUS_FMT_SGRBG10_1X10;
+ code->code = MEDIA_BUS_FMT_Y10_1X10;
return 0;
}
@@ -879,7 +879,7 @@ static int og01a1b_enum_frame_size(struct v4l2_subdev *sd,
if (fse->index >= ARRAY_SIZE(supported_modes))
return -EINVAL;
- if (fse->code != MEDIA_BUS_FMT_SGRBG10_1X10)
+ if (fse->code != MEDIA_BUS_FMT_Y10_1X10)
return -EINVAL;
fse->min_width = supported_modes[fse->index].width;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 206/568] scsi: ufs: host: mediatek: Enhance recovery on resume failure
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 205/568] media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 207/568] net: phy: marvell: Fix 88e1510 downshift counter errata Greg Kroah-Hartman
` (368 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Wang, Martin K. Petersen,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Wang <peter.wang@mediatek.com>
[ Upstream commit 15ef3f5aa822f32524cba1463422a2c9372443f0 ]
Improve the recovery process for failed resume operations. Log the
device's power status and return 0 if both resume and recovery fail to
prevent I/O hang.
Signed-off-by: Peter Wang <peter.wang@mediatek.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/host/ufs-mediatek.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
index 1c6348ee58092..3dbcb30e610fc 100644
--- a/drivers/ufs/host/ufs-mediatek.c
+++ b/drivers/ufs/host/ufs-mediatek.c
@@ -1359,8 +1359,21 @@ static int ufs_mtk_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op)
}
return 0;
+
fail:
- return ufshcd_link_recovery(hba);
+ /*
+ * Check if the platform (parent) device has resumed, and ensure that
+ * power, clock, and MTCMOS are all turned on.
+ */
+ err = ufshcd_link_recovery(hba);
+ if (err) {
+ dev_err(hba->dev, "Device PM: req=%d, status:%d, err:%d\n",
+ hba->dev->power.request,
+ hba->dev->power.runtime_status,
+ hba->dev->power.runtime_error);
+ }
+
+ return 0; /* Cannot return a failure, otherwise, the I/O will hang. */
}
static void ufs_mtk_dbg_register_dump(struct ufs_hba *hba)
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 207/568] net: phy: marvell: Fix 88e1510 downshift counter errata
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 206/568] scsi: ufs: host: mediatek: Enhance recovery on resume failure Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 208/568] ntfs3: pretend $Extend records as regular files Greg Kroah-Hartman
` (367 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rohan G Thomas, Matthew Gerlach,
Andrew Lunn, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rohan G Thomas <rohan.g.thomas@altera.com>
[ Upstream commit deb105f49879dd50d595f7f55207d6e74dec34e6 ]
The 88e1510 PHY has an erratum where the phy downshift counter is not
cleared after phy being suspended(BMCR_PDOWN set) and then later
resumed(BMCR_PDOWN cleared). This can cause the gigabit link to
intermittently downshift to a lower speed.
Disabling and re-enabling the downshift feature clears the counter,
allowing the PHY to retry gigabit link negotiation up to the programmed
retry count times before downshifting. This behavior has been observed
on copper links.
Signed-off-by: Rohan G Thomas <rohan.g.thomas@altera.com>
Reviewed-by: Matthew Gerlach <matthew.gerlach@altera.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20250906-marvell_fix-v2-1-f6efb286937f@altera.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/marvell.c | 39 ++++++++++++++++++++++++++++++++++++++-
1 file changed, 38 insertions(+), 1 deletion(-)
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 0d706ee266afd..339285690dd4c 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -1798,6 +1798,43 @@ static int marvell_resume(struct phy_device *phydev)
return err;
}
+/* m88e1510_resume
+ *
+ * The 88e1510 PHY has an erratum where the phy downshift counter is not cleared
+ * after phy being suspended(BMCR_PDOWN set) and then later resumed(BMCR_PDOWN
+ * cleared). This can cause the link to intermittently downshift to a lower speed.
+ *
+ * Disabling and re-enabling the downshift feature clears the counter, allowing
+ * the PHY to retry gigabit link negotiation up to the programmed retry count
+ * before downshifting. This behavior has been observed on copper links.
+ */
+static int m88e1510_resume(struct phy_device *phydev)
+{
+ int err;
+ u8 cnt = 0;
+
+ err = marvell_resume(phydev);
+ if (err < 0)
+ return err;
+
+ /* read downshift counter value */
+ err = m88e1011_get_downshift(phydev, &cnt);
+ if (err < 0)
+ return err;
+
+ if (cnt) {
+ /* downshift disabled */
+ err = m88e1011_set_downshift(phydev, 0);
+ if (err < 0)
+ return err;
+
+ /* downshift enabled, with previous counter value */
+ err = m88e1011_set_downshift(phydev, cnt);
+ }
+
+ return err;
+}
+
static int marvell_aneg_done(struct phy_device *phydev)
{
int retval = phy_read(phydev, MII_M1011_PHY_STATUS);
@@ -3174,7 +3211,7 @@ static struct phy_driver marvell_drivers[] = {
.handle_interrupt = marvell_handle_interrupt,
.get_wol = m88e1318_get_wol,
.set_wol = m88e1318_set_wol,
- .resume = marvell_resume,
+ .resume = m88e1510_resume,
.suspend = marvell_suspend,
.read_page = marvell_read_page,
.write_page = marvell_write_page,
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 208/568] ntfs3: pretend $Extend records as regular files
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 207/568] net: phy: marvell: Fix 88e1510 downshift counter errata Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 209/568] wifi: mac80211: Fix HE capabilities element check Greg Kroah-Hartman
` (366 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Tetsuo Handa,
Konstantin Komarov, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
[ Upstream commit 4e8011ffec79717e5fdac43a7e79faf811a384b7 ]
Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()")
requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/
S_IFIFO/S_IFSOCK type, use S_IFREG for $Extend records.
Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/inode.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
index 844113c3175c9..accff95baa847 100644
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -456,6 +456,7 @@ static struct inode *ntfs_read_mft(struct inode *inode,
fname->home.seq == cpu_to_le16(MFT_REC_EXTEND)) {
/* Records in $Extend are not a files or general directories. */
inode->i_op = &ntfs_file_inode_operations;
+ mode = S_IFREG;
} else {
err = -EINVAL;
goto out;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 209/568] wifi: mac80211: Fix HE capabilities element check
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 208/568] ntfs3: pretend $Extend records as regular files Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 210/568] phy: cadence: cdns-dphy: Enable lower resolutions in dphy Greg Kroah-Hartman
` (365 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilan Peer, Miri Korenblit,
Johannes Berg, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilan Peer <ilan.peer@intel.com>
[ Upstream commit ea928544f3215fdeac24d66bef85e10bb638b8c1 ]
The element data length check did not account for the extra
octet used for the extension ID. Fix it.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20250907115109.8da0012e2286.I8c0c69a0011f7153c13b365b14dfef48cfe7c3e3@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/mlme.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index cc47d6b88f04d..15826bbde70c2 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -4386,7 +4386,7 @@ static u8 ieee80211_max_rx_chains(struct ieee80211_link_data *link,
he_cap_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
ies->data, ies->len);
- if (!he_cap_elem || he_cap_elem->datalen < sizeof(*he_cap))
+ if (!he_cap_elem || he_cap_elem->datalen < sizeof(*he_cap) + 1)
return chains;
/* skip one byte ext_tag_id */
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 210/568] phy: cadence: cdns-dphy: Enable lower resolutions in dphy
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 209/568] wifi: mac80211: Fix HE capabilities element check Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 211/568] phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 Greg Kroah-Hartman
` (364 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Udit Kumar, Devarsh Thakkar,
Harikrishna Shenoy, Vinod Koul, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harikrishna Shenoy <h-shenoy@ti.com>
[ Upstream commit 43bd2c44515f8ee5c019ce6e6583f5640387a41b ]
Enable support for data lane rates between 80-160 Mbps cdns dphy
as mentioned in TRM [0] by setting the pll_opdiv field to 16.
This change enables lower resolutions like 640x480 at 60Hz.
[0]: https://www.ti.com/lit/zip/spruil1
(Table 12-552. DPHY_TX_PLL_CTRL Register Field Descriptions)
Reviewed-by: Udit Kumar <u-kumar1@ti.com>
Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
Signed-off-by: Harikrishna Shenoy <h-shenoy@ti.com>
Link: https://lore.kernel.org/r/20250807052002.717807-1-h-shenoy@ti.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/cadence/cdns-dphy.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/phy/cadence/cdns-dphy.c b/drivers/phy/cadence/cdns-dphy.c
index d65a7aeefe792..565f281b36eaf 100644
--- a/drivers/phy/cadence/cdns-dphy.c
+++ b/drivers/phy/cadence/cdns-dphy.c
@@ -146,7 +146,7 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy,
dlane_bps = opts->hs_clk_rate;
- if (dlane_bps > 2500000000UL || dlane_bps < 160000000UL)
+ if (dlane_bps > 2500000000UL || dlane_bps < 80000000UL)
return -EINVAL;
else if (dlane_bps >= 1250000000)
cfg->pll_opdiv = 1;
@@ -156,6 +156,8 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy,
cfg->pll_opdiv = 4;
else if (dlane_bps >= 160000000)
cfg->pll_opdiv = 8;
+ else if (dlane_bps >= 80000000)
+ cfg->pll_opdiv = 16;
cfg->pll_fbdiv = DIV_ROUND_UP_ULL(dlane_bps * 2 * cfg->pll_opdiv *
cfg->pll_ipdiv,
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 211/568] phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 210/568] phy: cadence: cdns-dphy: Enable lower resolutions in dphy Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 212/568] net: sh_eth: Disable WoL if system can not suspend Greg Kroah-Hartman
` (363 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Michael Riesch,
Vinod Koul, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Riesch <michael.riesch@collabora.com>
[ Upstream commit 8c7c19466c854fa86b82d2148eaa9bf0e6531423 ]
The driver for the Rockchip MIPI CSI-2 DPHY uses GRF register offset
value 0 to sort out undefined registers. However, the RK3588 CSIDPHY GRF
this offset is perfectly fine (in fact, register 0 is the only one in
this register file).
Introduce a boolean variable to indicate valid registers and allow writes
to register 0.
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Michael Riesch <michael.riesch@collabora.com>
Link: https://lore.kernel.org/r/20250616-rk3588-csi-dphy-v4-4-a4f340a7f0cf@collabora.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/rockchip/phy-rockchip-inno-csidphy.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c b/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
index 75f948bdea6a1..20737a0400f5c 100644
--- a/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
+++ b/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
@@ -87,10 +87,11 @@ struct dphy_reg {
u32 offset;
u32 mask;
u32 shift;
+ u8 valid;
};
#define PHY_REG(_offset, _width, _shift) \
- { .offset = _offset, .mask = BIT(_width) - 1, .shift = _shift, }
+ { .offset = _offset, .mask = BIT(_width) - 1, .shift = _shift, .valid = 1, }
static const struct dphy_reg rk1808_grf_dphy_regs[] = {
[GRF_DPHY_CSIPHY_FORCERXMODE] = PHY_REG(RK1808_GRF_PD_VI_CON_OFFSET, 4, 0),
@@ -145,7 +146,7 @@ static inline void write_grf_reg(struct rockchip_inno_csidphy *priv,
const struct dphy_drv_data *drv_data = priv->drv_data;
const struct dphy_reg *reg = &drv_data->grf_regs[index];
- if (reg->offset)
+ if (reg->valid)
regmap_write(priv->grf, reg->offset,
HIWORD_UPDATE(value, reg->mask, reg->shift));
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 212/568] net: sh_eth: Disable WoL if system can not suspend
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 211/568] phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 213/568] selftests: net: replace sleeps in fcnal-test with waits Greg Kroah-Hartman
` (362 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Söderlund, Andrew Lunn,
Geert Uytterhoeven, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
[ Upstream commit 9c02ea544ac35a9def5827d30594406947ccd81a ]
The MAC can't facilitate WoL if the system can't go to sleep. Gate the
WoL support callbacks in ethtool at compile time using CONFIG_PM_SLEEP.
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20250909085849.3808169-1-niklas.soderlund+renesas@ragnatech.se
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/renesas/sh_eth.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 5f4297e83aafe..6d66ce207fb44 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -2362,6 +2362,7 @@ static int sh_eth_set_ringparam(struct net_device *ndev,
return 0;
}
+#ifdef CONFIG_PM_SLEEP
static void sh_eth_get_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
{
struct sh_eth_private *mdp = netdev_priv(ndev);
@@ -2388,6 +2389,7 @@ static int sh_eth_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
return 0;
}
+#endif
static const struct ethtool_ops sh_eth_ethtool_ops = {
.get_regs_len = sh_eth_get_regs_len,
@@ -2403,8 +2405,10 @@ static const struct ethtool_ops sh_eth_ethtool_ops = {
.set_ringparam = sh_eth_set_ringparam,
.get_link_ksettings = phy_ethtool_get_link_ksettings,
.set_link_ksettings = phy_ethtool_set_link_ksettings,
+#ifdef CONFIG_PM_SLEEP
.get_wol = sh_eth_get_wol,
.set_wol = sh_eth_set_wol,
+#endif
};
/* network device open function */
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 213/568] selftests: net: replace sleeps in fcnal-test with waits
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 212/568] net: sh_eth: Disable WoL if system can not suspend Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 214/568] media: redrat3: use int type to store negative error codes Greg Kroah-Hartman
` (361 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Ahern, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit 15c068cb214d74a2faca9293b25f454242d0d65e ]
fcnal-test.sh already includes lib.sh, use relevant helpers
instead of sleeping. Replace sleep after starting nettest
as a server with wait_local_port_listen.
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250909223837.863217-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/fcnal-test.sh | 428 +++++++++++-----------
1 file changed, 214 insertions(+), 214 deletions(-)
diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
index ee6880ac3e5ed..1c0dcddbe2bd1 100755
--- a/tools/testing/selftests/net/fcnal-test.sh
+++ b/tools/testing/selftests/net/fcnal-test.sh
@@ -851,7 +851,7 @@ ipv4_tcp_md5_novrf()
# basic use case
log_start
run_cmd nettest -s -M ${MD5_PW} -m ${NSB_IP} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
log_test $? 0 "MD5: Single address config"
@@ -859,7 +859,7 @@ ipv4_tcp_md5_novrf()
log_start
show_hint "Should timeout due to MD5 mismatch"
run_cmd nettest -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
log_test $? 2 "MD5: Server no config, client uses password"
@@ -867,7 +867,7 @@ ipv4_tcp_md5_novrf()
log_start
show_hint "Should timeout since client uses wrong password"
run_cmd nettest -s -M ${MD5_PW} -m ${NSB_IP} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
log_test $? 2 "MD5: Client uses wrong password"
@@ -875,7 +875,7 @@ ipv4_tcp_md5_novrf()
log_start
show_hint "Should timeout due to MD5 mismatch"
run_cmd nettest -s -M ${MD5_PW} -m ${NSB_LO_IP} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
log_test $? 2 "MD5: Client address does not match address configured with password"
@@ -886,7 +886,7 @@ ipv4_tcp_md5_novrf()
# client in prefix
log_start
run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
log_test $? 0 "MD5: Prefix config"
@@ -894,7 +894,7 @@ ipv4_tcp_md5_novrf()
log_start
show_hint "Should timeout since client uses wrong password"
run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
log_test $? 2 "MD5: Prefix config, client uses wrong password"
@@ -902,7 +902,7 @@ ipv4_tcp_md5_novrf()
log_start
show_hint "Should timeout due to MD5 mismatch"
run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -c ${NSB_LO_IP} -r ${NSA_IP} -X ${MD5_PW}
log_test $? 2 "MD5: Prefix config, client address not in configured prefix"
}
@@ -919,7 +919,7 @@ ipv4_tcp_md5()
# basic use case
log_start
run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
log_test $? 0 "MD5: VRF: Single address config"
@@ -927,7 +927,7 @@ ipv4_tcp_md5()
log_start
show_hint "Should timeout since server does not have MD5 auth"
run_cmd nettest -s -I ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
log_test $? 2 "MD5: VRF: Server no config, client uses password"
@@ -935,7 +935,7 @@ ipv4_tcp_md5()
log_start
show_hint "Should timeout since client uses wrong password"
run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
log_test $? 2 "MD5: VRF: Client uses wrong password"
@@ -943,7 +943,7 @@ ipv4_tcp_md5()
log_start
show_hint "Should timeout since server config differs from client"
run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_LO_IP} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
log_test $? 2 "MD5: VRF: Client address does not match address configured with password"
@@ -954,7 +954,7 @@ ipv4_tcp_md5()
# client in prefix
log_start
run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
log_test $? 0 "MD5: VRF: Prefix config"
@@ -962,7 +962,7 @@ ipv4_tcp_md5()
log_start
show_hint "Should timeout since client uses wrong password"
run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
log_test $? 2 "MD5: VRF: Prefix config, client uses wrong password"
@@ -970,7 +970,7 @@ ipv4_tcp_md5()
log_start
show_hint "Should timeout since client address is outside of prefix"
run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -c ${NSB_LO_IP} -r ${NSA_IP} -X ${MD5_PW}
log_test $? 2 "MD5: VRF: Prefix config, client address not in configured prefix"
@@ -981,14 +981,14 @@ ipv4_tcp_md5()
log_start
run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF"
log_start
run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF"
@@ -996,7 +996,7 @@ ipv4_tcp_md5()
show_hint "Should timeout since client in default VRF uses VRF password"
run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF with VRF pw"
@@ -1004,21 +1004,21 @@ ipv4_tcp_md5()
show_hint "Should timeout since client in VRF uses default VRF password"
run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF with default VRF pw"
log_start
run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF"
log_start
run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF"
@@ -1026,7 +1026,7 @@ ipv4_tcp_md5()
show_hint "Should timeout since client in default VRF uses VRF password"
run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF with VRF pw"
@@ -1034,7 +1034,7 @@ ipv4_tcp_md5()
show_hint "Should timeout since client in VRF uses default VRF password"
run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF with default VRF pw"
@@ -1058,14 +1058,14 @@ test_ipv4_md5_vrf__vrf_server__no_bind_ifindex()
log_start
show_hint "Simulates applications using VRF without TCP_MD5SIG_FLAG_IFINDEX"
run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
log_test $? 0 "MD5: VRF: VRF-bound server, unbound key accepts connection"
log_start
show_hint "Binding both the socket and the key is not required but it works"
run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
log_test $? 0 "MD5: VRF: VRF-bound server, bound key accepts connection"
}
@@ -1079,25 +1079,25 @@ test_ipv4_md5_vrf__global_server__bind_ifindex0()
log_start
run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
log_test $? 2 "MD5: VRF: Global server, Key bound to ifindex=0 rejects VRF connection"
log_start
run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
log_test $? 0 "MD5: VRF: Global server, key bound to ifindex=0 accepts non-VRF connection"
log_start
run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts VRF connection"
log_start
run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts non-VRF connection"
@@ -1116,7 +1116,7 @@ ipv4_tcp_novrf()
do
log_start
run_cmd nettest -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${a}
log_test_addr ${a} $? 0 "Global server"
done
@@ -1124,7 +1124,7 @@ ipv4_tcp_novrf()
a=${NSA_IP}
log_start
run_cmd nettest -s -I ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${a}
log_test_addr ${a} $? 0 "Device server"
@@ -1144,13 +1144,13 @@ ipv4_tcp_novrf()
do
log_start
run_cmd_nsb nettest -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 tcp
run_cmd nettest -r ${a} -0 ${NSA_IP}
log_test_addr ${a} $? 0 "Client"
log_start
run_cmd_nsb nettest -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 tcp
run_cmd nettest -r ${a} -d ${NSA_DEV}
log_test_addr ${a} $? 0 "Client, device bind"
@@ -1172,7 +1172,7 @@ ipv4_tcp_novrf()
do
log_start
run_cmd nettest -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -r ${a} -0 ${a} -1 ${a}
log_test_addr ${a} $? 0 "Global server, local connection"
done
@@ -1180,7 +1180,7 @@ ipv4_tcp_novrf()
a=${NSA_IP}
log_start
run_cmd nettest -s -I ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -r ${a} -0 ${a}
log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
@@ -1189,7 +1189,7 @@ ipv4_tcp_novrf()
log_start
show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"
run_cmd nettest -s -I ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -r ${a}
log_test_addr ${a} $? 1 "Device server, unbound client, local connection"
done
@@ -1197,7 +1197,7 @@ ipv4_tcp_novrf()
a=${NSA_IP}
log_start
run_cmd nettest -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -r ${a} -0 ${a} -d ${NSA_DEV}
log_test_addr ${a} $? 0 "Global server, device client, local connection"
@@ -1206,7 +1206,7 @@ ipv4_tcp_novrf()
log_start
show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
run_cmd nettest -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -r ${a} -d ${NSA_DEV}
log_test_addr ${a} $? 1 "Global server, device client, local connection"
done
@@ -1214,7 +1214,7 @@ ipv4_tcp_novrf()
a=${NSA_IP}
log_start
run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -d ${NSA_DEV} -r ${a} -0 ${a}
log_test_addr ${a} $? 0 "Device server, device client, local connection"
@@ -1243,19 +1243,19 @@ ipv4_tcp_vrf()
log_start
show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
run_cmd nettest -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${a}
log_test_addr ${a} $? 1 "Global server"
log_start
run_cmd nettest -s -I ${VRF} -3 ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${a}
log_test_addr ${a} $? 0 "VRF server"
log_start
run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${a}
log_test_addr ${a} $? 0 "Device server"
@@ -1272,7 +1272,7 @@ ipv4_tcp_vrf()
log_start
show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
run_cmd nettest -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -r ${a} -d ${NSA_DEV}
log_test_addr ${a} $? 1 "Global server, local connection"
@@ -1294,14 +1294,14 @@ ipv4_tcp_vrf()
log_start
show_hint "client socket should be bound to VRF"
run_cmd nettest -s -3 ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${a}
log_test_addr ${a} $? 0 "Global server"
log_start
show_hint "client socket should be bound to VRF"
run_cmd nettest -s -I ${VRF} -3 ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${a}
log_test_addr ${a} $? 0 "VRF server"
@@ -1316,7 +1316,7 @@ ipv4_tcp_vrf()
log_start
show_hint "client socket should be bound to device"
run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${a}
log_test_addr ${a} $? 0 "Device server"
@@ -1326,7 +1326,7 @@ ipv4_tcp_vrf()
log_start
show_hint "Should fail 'Connection refused' since client is not bound to VRF"
run_cmd nettest -s -I ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -r ${a}
log_test_addr ${a} $? 1 "Global server, local connection"
done
@@ -1338,13 +1338,13 @@ ipv4_tcp_vrf()
do
log_start
run_cmd_nsb nettest -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 tcp
run_cmd nettest -r ${a} -d ${VRF}
log_test_addr ${a} $? 0 "Client, VRF bind"
log_start
run_cmd_nsb nettest -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 tcp
run_cmd nettest -r ${a} -d ${NSA_DEV}
log_test_addr ${a} $? 0 "Client, device bind"
@@ -1363,7 +1363,7 @@ ipv4_tcp_vrf()
do
log_start
run_cmd nettest -s -I ${VRF} -3 ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -r ${a} -d ${VRF} -0 ${a}
log_test_addr ${a} $? 0 "VRF server, VRF client, local connection"
done
@@ -1371,26 +1371,26 @@ ipv4_tcp_vrf()
a=${NSA_IP}
log_start
run_cmd nettest -s -I ${VRF} -3 ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -r ${a} -d ${NSA_DEV} -0 ${a}
log_test_addr ${a} $? 0 "VRF server, device client, local connection"
log_start
show_hint "Should fail 'No route to host' since client is out of VRF scope"
run_cmd nettest -s -I ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -r ${a}
log_test_addr ${a} $? 1 "VRF server, unbound client, local connection"
log_start
run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -r ${a} -d ${VRF} -0 ${a}
log_test_addr ${a} $? 0 "Device server, VRF client, local connection"
log_start
run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -r ${a} -d ${NSA_DEV} -0 ${a}
log_test_addr ${a} $? 0 "Device server, device client, local connection"
}
@@ -1429,7 +1429,7 @@ ipv4_udp_novrf()
do
log_start
run_cmd nettest -D -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd_nsb nettest -D -r ${a}
log_test_addr ${a} $? 0 "Global server"
@@ -1442,7 +1442,7 @@ ipv4_udp_novrf()
a=${NSA_IP}
log_start
run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd_nsb nettest -D -r ${a}
log_test_addr ${a} $? 0 "Device server"
@@ -1453,31 +1453,31 @@ ipv4_udp_novrf()
do
log_start
run_cmd_nsb nettest -D -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 udp
run_cmd nettest -D -r ${a} -0 ${NSA_IP}
log_test_addr ${a} $? 0 "Client"
log_start
run_cmd_nsb nettest -D -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 udp
run_cmd nettest -D -r ${a} -d ${NSA_DEV} -0 ${NSA_IP}
log_test_addr ${a} $? 0 "Client, device bind"
log_start
run_cmd_nsb nettest -D -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 udp
run_cmd nettest -D -r ${a} -d ${NSA_DEV} -C -0 ${NSA_IP}
log_test_addr ${a} $? 0 "Client, device send via cmsg"
log_start
run_cmd_nsb nettest -D -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 udp
run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP}
log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF"
log_start
run_cmd_nsb nettest -D -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 udp
run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP} -U
log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF, with connect()"
@@ -1500,7 +1500,7 @@ ipv4_udp_novrf()
do
log_start
run_cmd nettest -D -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -r ${a} -0 ${a} -1 ${a}
log_test_addr ${a} $? 0 "Global server, local connection"
done
@@ -1508,7 +1508,7 @@ ipv4_udp_novrf()
a=${NSA_IP}
log_start
run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -r ${a}
log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
@@ -1517,7 +1517,7 @@ ipv4_udp_novrf()
log_start
show_hint "Should fail 'Connection refused' since address is out of device scope"
run_cmd nettest -s -D -I ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -r ${a}
log_test_addr ${a} $? 1 "Device server, unbound client, local connection"
done
@@ -1525,25 +1525,25 @@ ipv4_udp_novrf()
a=${NSA_IP}
log_start
run_cmd nettest -s -D &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -d ${NSA_DEV} -r ${a}
log_test_addr ${a} $? 0 "Global server, device client, local connection"
log_start
run_cmd nettest -s -D &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -d ${NSA_DEV} -C -r ${a}
log_test_addr ${a} $? 0 "Global server, device send via cmsg, local connection"
log_start
run_cmd nettest -s -D &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -d ${NSA_DEV} -S -r ${a}
log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection"
log_start
run_cmd nettest -s -D &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -d ${NSA_DEV} -S -r ${a} -U
log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection, with connect()"
@@ -1556,28 +1556,28 @@ ipv4_udp_novrf()
log_start
show_hint "Should fail since addresses on loopback are out of device scope"
run_cmd nettest -D -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -r ${a} -d ${NSA_DEV}
log_test_addr ${a} $? 2 "Global server, device client, local connection"
log_start
show_hint "Should fail since addresses on loopback are out of device scope"
run_cmd nettest -D -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -r ${a} -d ${NSA_DEV} -C
log_test_addr ${a} $? 1 "Global server, device send via cmsg, local connection"
log_start
show_hint "Should fail since addresses on loopback are out of device scope"
run_cmd nettest -D -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S
log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection"
log_start
show_hint "Should fail since addresses on loopback are out of device scope"
run_cmd nettest -D -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -U
log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection, with connect()"
@@ -1587,7 +1587,7 @@ ipv4_udp_novrf()
a=${NSA_IP}
log_start
run_cmd nettest -D -s -I ${NSA_DEV} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -d ${NSA_DEV} -r ${a} -0 ${a}
log_test_addr ${a} $? 0 "Device server, device client, local conn"
@@ -1612,19 +1612,19 @@ ipv4_udp_vrf()
log_start
show_hint "Fails because ingress is in a VRF and global server is disabled"
run_cmd nettest -D -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd_nsb nettest -D -r ${a}
log_test_addr ${a} $? 1 "Global server"
log_start
run_cmd nettest -D -I ${VRF} -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd_nsb nettest -D -r ${a}
log_test_addr ${a} $? 0 "VRF server"
log_start
run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd_nsb nettest -D -r ${a}
log_test_addr ${a} $? 0 "Enslaved device server"
@@ -1636,7 +1636,7 @@ ipv4_udp_vrf()
log_start
show_hint "Should fail 'Connection refused' since global server is out of scope"
run_cmd nettest -D -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -d ${VRF} -r ${a}
log_test_addr ${a} $? 1 "Global server, VRF client, local connection"
done
@@ -1644,26 +1644,26 @@ ipv4_udp_vrf()
a=${NSA_IP}
log_start
run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -d ${VRF} -r ${a}
log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
log_start
run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -d ${NSA_DEV} -r ${a}
log_test_addr ${a} $? 0 "VRF server, enslaved device client, local connection"
a=${NSA_IP}
log_start
run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -d ${VRF} -r ${a}
log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"
log_start
run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -d ${NSA_DEV} -r ${a}
log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
@@ -1678,19 +1678,19 @@ ipv4_udp_vrf()
do
log_start
run_cmd nettest -D -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd_nsb nettest -D -r ${a}
log_test_addr ${a} $? 0 "Global server"
log_start
run_cmd nettest -D -I ${VRF} -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd_nsb nettest -D -r ${a}
log_test_addr ${a} $? 0 "VRF server"
log_start
run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd_nsb nettest -D -r ${a}
log_test_addr ${a} $? 0 "Enslaved device server"
@@ -1705,13 +1705,13 @@ ipv4_udp_vrf()
#
log_start
run_cmd_nsb nettest -D -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 udp
run_cmd nettest -d ${VRF} -D -r ${NSB_IP} -1 ${NSA_IP}
log_test $? 0 "VRF client"
log_start
run_cmd_nsb nettest -D -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 udp
run_cmd nettest -d ${NSA_DEV} -D -r ${NSB_IP} -1 ${NSA_IP}
log_test $? 0 "Enslaved device client"
@@ -1732,31 +1732,31 @@ ipv4_udp_vrf()
a=${NSA_IP}
log_start
run_cmd nettest -D -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -d ${VRF} -r ${a}
log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
log_start
run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -d ${VRF} -r ${a}
log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
log_start
run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -d ${NSA_DEV} -r ${a}
log_test_addr ${a} $? 0 "VRF server, device client, local conn"
log_start
run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -d ${VRF} -r ${a}
log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"
log_start
run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -d ${NSA_DEV} -r ${a}
log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
@@ -1764,7 +1764,7 @@ ipv4_udp_vrf()
do
log_start
run_cmd nettest -D -s -3 ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -d ${VRF} -r ${a}
log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
done
@@ -1773,7 +1773,7 @@ ipv4_udp_vrf()
do
log_start
run_cmd nettest -s -D -I ${VRF} -3 ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -D -d ${VRF} -r ${a}
log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
done
@@ -1996,7 +1996,7 @@ ipv4_rt()
do
log_start
run_cmd nettest ${varg} -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest ${varg} -r ${a} &
sleep 3
run_cmd ip link del ${VRF}
@@ -2010,7 +2010,7 @@ ipv4_rt()
do
log_start
run_cmd nettest ${varg} -s -I ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest ${varg} -r ${a} &
sleep 3
run_cmd ip link del ${VRF}
@@ -2023,7 +2023,7 @@ ipv4_rt()
a=${NSA_IP}
log_start
run_cmd nettest ${varg} -s -I ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest ${varg} -r ${a} &
sleep 3
run_cmd ip link del ${VRF}
@@ -2037,7 +2037,7 @@ ipv4_rt()
#
log_start
run_cmd_nsb nettest ${varg} -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 tcp
run_cmd nettest ${varg} -d ${VRF} -r ${NSB_IP} &
sleep 3
run_cmd ip link del ${VRF}
@@ -2048,7 +2048,7 @@ ipv4_rt()
log_start
run_cmd_nsb nettest ${varg} -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 tcp
run_cmd nettest ${varg} -d ${NSA_DEV} -r ${NSB_IP} &
sleep 3
run_cmd ip link del ${VRF}
@@ -2064,7 +2064,7 @@ ipv4_rt()
do
log_start
run_cmd nettest ${varg} -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest ${varg} -d ${VRF} -r ${a} &
sleep 3
run_cmd ip link del ${VRF}
@@ -2078,7 +2078,7 @@ ipv4_rt()
do
log_start
run_cmd nettest ${varg} -I ${VRF} -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest ${varg} -d ${VRF} -r ${a} &
sleep 3
run_cmd ip link del ${VRF}
@@ -2092,7 +2092,7 @@ ipv4_rt()
log_start
run_cmd nettest ${varg} -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
sleep 3
run_cmd ip link del ${VRF}
@@ -2103,7 +2103,7 @@ ipv4_rt()
log_start
run_cmd nettest ${varg} -I ${VRF} -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
sleep 3
run_cmd ip link del ${VRF}
@@ -2114,7 +2114,7 @@ ipv4_rt()
log_start
run_cmd nettest ${varg} -I ${NSA_DEV} -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
sleep 3
run_cmd ip link del ${VRF}
@@ -2464,7 +2464,7 @@ ipv6_tcp_md5_novrf()
# basic use case
log_start
run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_IP6} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
log_test $? 0 "MD5: Single address config"
@@ -2472,7 +2472,7 @@ ipv6_tcp_md5_novrf()
log_start
show_hint "Should timeout due to MD5 mismatch"
run_cmd nettest -6 -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
log_test $? 2 "MD5: Server no config, client uses password"
@@ -2480,7 +2480,7 @@ ipv6_tcp_md5_novrf()
log_start
show_hint "Should timeout since client uses wrong password"
run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_IP6} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
log_test $? 2 "MD5: Client uses wrong password"
@@ -2488,7 +2488,7 @@ ipv6_tcp_md5_novrf()
log_start
show_hint "Should timeout due to MD5 mismatch"
run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_LO_IP6} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
log_test $? 2 "MD5: Client address does not match address configured with password"
@@ -2499,7 +2499,7 @@ ipv6_tcp_md5_novrf()
# client in prefix
log_start
run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
log_test $? 0 "MD5: Prefix config"
@@ -2507,7 +2507,7 @@ ipv6_tcp_md5_novrf()
log_start
show_hint "Should timeout since client uses wrong password"
run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
log_test $? 2 "MD5: Prefix config, client uses wrong password"
@@ -2515,7 +2515,7 @@ ipv6_tcp_md5_novrf()
log_start
show_hint "Should timeout due to MD5 mismatch"
run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -c ${NSB_LO_IP6} -r ${NSA_IP6} -X ${MD5_PW}
log_test $? 2 "MD5: Prefix config, client address not in configured prefix"
}
@@ -2532,7 +2532,7 @@ ipv6_tcp_md5()
# basic use case
log_start
run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
log_test $? 0 "MD5: VRF: Single address config"
@@ -2540,7 +2540,7 @@ ipv6_tcp_md5()
log_start
show_hint "Should timeout since server does not have MD5 auth"
run_cmd nettest -6 -s -I ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
log_test $? 2 "MD5: VRF: Server no config, client uses password"
@@ -2548,7 +2548,7 @@ ipv6_tcp_md5()
log_start
show_hint "Should timeout since client uses wrong password"
run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
log_test $? 2 "MD5: VRF: Client uses wrong password"
@@ -2556,7 +2556,7 @@ ipv6_tcp_md5()
log_start
show_hint "Should timeout since server config differs from client"
run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_LO_IP6} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
log_test $? 2 "MD5: VRF: Client address does not match address configured with password"
@@ -2567,7 +2567,7 @@ ipv6_tcp_md5()
# client in prefix
log_start
run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
log_test $? 0 "MD5: VRF: Prefix config"
@@ -2575,7 +2575,7 @@ ipv6_tcp_md5()
log_start
show_hint "Should timeout since client uses wrong password"
run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
log_test $? 2 "MD5: VRF: Prefix config, client uses wrong password"
@@ -2583,7 +2583,7 @@ ipv6_tcp_md5()
log_start
show_hint "Should timeout since client address is outside of prefix"
run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -c ${NSB_LO_IP6} -r ${NSA_IP6} -X ${MD5_PW}
log_test $? 2 "MD5: VRF: Prefix config, client address not in configured prefix"
@@ -2594,14 +2594,14 @@ ipv6_tcp_md5()
log_start
run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF"
log_start
run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF"
@@ -2609,7 +2609,7 @@ ipv6_tcp_md5()
show_hint "Should timeout since client in default VRF uses VRF password"
run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF with VRF pw"
@@ -2617,21 +2617,21 @@ ipv6_tcp_md5()
show_hint "Should timeout since client in VRF uses default VRF password"
run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF with default VRF pw"
log_start
run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF"
log_start
run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF"
@@ -2639,7 +2639,7 @@ ipv6_tcp_md5()
show_hint "Should timeout since client in default VRF uses VRF password"
run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF with VRF pw"
@@ -2647,7 +2647,7 @@ ipv6_tcp_md5()
show_hint "Should timeout since client in VRF uses default VRF password"
run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF with default VRF pw"
@@ -2675,7 +2675,7 @@ ipv6_tcp_novrf()
do
log_start
run_cmd nettest -6 -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${a}
log_test_addr ${a} $? 0 "Global server"
done
@@ -2696,7 +2696,7 @@ ipv6_tcp_novrf()
do
log_start
run_cmd_nsb nettest -6 -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 tcp
run_cmd nettest -6 -r ${a}
log_test_addr ${a} $? 0 "Client"
done
@@ -2705,7 +2705,7 @@ ipv6_tcp_novrf()
do
log_start
run_cmd_nsb nettest -6 -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 tcp
run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
log_test_addr ${a} $? 0 "Client, device bind"
done
@@ -2725,7 +2725,7 @@ ipv6_tcp_novrf()
do
log_start
run_cmd nettest -6 -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -6 -r ${a}
log_test_addr ${a} $? 0 "Global server, local connection"
done
@@ -2733,7 +2733,7 @@ ipv6_tcp_novrf()
a=${NSA_IP6}
log_start
run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -6 -r ${a} -0 ${a}
log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
@@ -2742,7 +2742,7 @@ ipv6_tcp_novrf()
log_start
show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"
run_cmd nettest -6 -s -I ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -6 -r ${a}
log_test_addr ${a} $? 1 "Device server, unbound client, local connection"
done
@@ -2750,7 +2750,7 @@ ipv6_tcp_novrf()
a=${NSA_IP6}
log_start
run_cmd nettest -6 -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}
log_test_addr ${a} $? 0 "Global server, device client, local connection"
@@ -2759,7 +2759,7 @@ ipv6_tcp_novrf()
log_start
show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"
run_cmd nettest -6 -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
log_test_addr ${a} $? 1 "Global server, device client, local connection"
done
@@ -2768,7 +2768,7 @@ ipv6_tcp_novrf()
do
log_start
run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -6 -d ${NSA_DEV} -r ${a}
log_test_addr ${a} $? 0 "Device server, device client, local conn"
done
@@ -2801,7 +2801,7 @@ ipv6_tcp_vrf()
log_start
show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
run_cmd nettest -6 -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${a}
log_test_addr ${a} $? 1 "Global server"
done
@@ -2810,7 +2810,7 @@ ipv6_tcp_vrf()
do
log_start
run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${a}
log_test_addr ${a} $? 0 "VRF server"
done
@@ -2819,7 +2819,7 @@ ipv6_tcp_vrf()
a=${NSA_LINKIP6}%${NSB_DEV}
log_start
run_cmd nettest -6 -s -I ${VRF} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${a}
log_test_addr ${a} $? 0 "VRF server"
@@ -2827,7 +2827,7 @@ ipv6_tcp_vrf()
do
log_start
run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${a}
log_test_addr ${a} $? 0 "Device server"
done
@@ -2846,7 +2846,7 @@ ipv6_tcp_vrf()
log_start
show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
run_cmd nettest -6 -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
log_test_addr ${a} $? 1 "Global server, local connection"
@@ -2867,7 +2867,7 @@ ipv6_tcp_vrf()
do
log_start
run_cmd nettest -6 -s -3 ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${a}
log_test_addr ${a} $? 0 "Global server"
done
@@ -2876,7 +2876,7 @@ ipv6_tcp_vrf()
do
log_start
run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${a}
log_test_addr ${a} $? 0 "VRF server"
done
@@ -2885,13 +2885,13 @@ ipv6_tcp_vrf()
a=${NSA_LINKIP6}%${NSB_DEV}
log_start
run_cmd nettest -6 -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${a}
log_test_addr ${a} $? 0 "Global server"
log_start
run_cmd nettest -6 -s -I ${VRF} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${a}
log_test_addr ${a} $? 0 "VRF server"
@@ -2899,7 +2899,7 @@ ipv6_tcp_vrf()
do
log_start
run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${a}
log_test_addr ${a} $? 0 "Device server"
done
@@ -2919,7 +2919,7 @@ ipv6_tcp_vrf()
log_start
show_hint "Fails 'Connection refused' since client is not in VRF"
run_cmd nettest -6 -s -I ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -6 -r ${a}
log_test_addr ${a} $? 1 "Global server, local connection"
done
@@ -2932,7 +2932,7 @@ ipv6_tcp_vrf()
do
log_start
run_cmd_nsb nettest -6 -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 tcp
run_cmd nettest -6 -r ${a} -d ${VRF}
log_test_addr ${a} $? 0 "Client, VRF bind"
done
@@ -2941,7 +2941,7 @@ ipv6_tcp_vrf()
log_start
show_hint "Fails since VRF device does not allow linklocal addresses"
run_cmd_nsb nettest -6 -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 tcp
run_cmd nettest -6 -r ${a} -d ${VRF}
log_test_addr ${a} $? 1 "Client, VRF bind"
@@ -2949,7 +2949,7 @@ ipv6_tcp_vrf()
do
log_start
run_cmd_nsb nettest -6 -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 tcp
run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
log_test_addr ${a} $? 0 "Client, device bind"
done
@@ -2974,7 +2974,7 @@ ipv6_tcp_vrf()
do
log_start
run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -6 -r ${a} -d ${VRF} -0 ${a}
log_test_addr ${a} $? 0 "VRF server, VRF client, local connection"
done
@@ -2982,7 +2982,7 @@ ipv6_tcp_vrf()
a=${NSA_IP6}
log_start
run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}
log_test_addr ${a} $? 0 "VRF server, device client, local connection"
@@ -2990,13 +2990,13 @@ ipv6_tcp_vrf()
log_start
show_hint "Should fail since unbound client is out of VRF scope"
run_cmd nettest -6 -s -I ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -6 -r ${a}
log_test_addr ${a} $? 1 "VRF server, unbound client, local connection"
log_start
run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -6 -r ${a} -d ${VRF} -0 ${a}
log_test_addr ${a} $? 0 "Device server, VRF client, local connection"
@@ -3004,7 +3004,7 @@ ipv6_tcp_vrf()
do
log_start
run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}
log_test_addr ${a} $? 0 "Device server, device client, local connection"
done
@@ -3044,13 +3044,13 @@ ipv6_udp_novrf()
do
log_start
run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd_nsb nettest -6 -D -r ${a}
log_test_addr ${a} $? 0 "Global server"
log_start
run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd_nsb nettest -6 -D -r ${a}
log_test_addr ${a} $? 0 "Device server"
done
@@ -3058,7 +3058,7 @@ ipv6_udp_novrf()
a=${NSA_LO_IP6}
log_start
run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd_nsb nettest -6 -D -r ${a}
log_test_addr ${a} $? 0 "Global server"
@@ -3068,7 +3068,7 @@ ipv6_udp_novrf()
#log_start
#show_hint "Should fail since loopback address is out of scope"
#run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
- #sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
#run_cmd_nsb nettest -6 -D -r ${a}
#log_test_addr ${a} $? 1 "Device server"
@@ -3088,25 +3088,25 @@ ipv6_udp_novrf()
do
log_start
run_cmd_nsb nettest -6 -D -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 udp
run_cmd nettest -6 -D -r ${a} -0 ${NSA_IP6}
log_test_addr ${a} $? 0 "Client"
log_start
run_cmd_nsb nettest -6 -D -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 udp
run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -0 ${NSA_IP6}
log_test_addr ${a} $? 0 "Client, device bind"
log_start
run_cmd_nsb nettest -6 -D -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 udp
run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -C -0 ${NSA_IP6}
log_test_addr ${a} $? 0 "Client, device send via cmsg"
log_start
run_cmd_nsb nettest -6 -D -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 udp
run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP6}
log_test_addr ${a} $? 0 "Client, device bind via IPV6_UNICAST_IF"
@@ -3128,7 +3128,7 @@ ipv6_udp_novrf()
do
log_start
run_cmd nettest -6 -D -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -r ${a} -0 ${a} -1 ${a}
log_test_addr ${a} $? 0 "Global server, local connection"
done
@@ -3136,7 +3136,7 @@ ipv6_udp_novrf()
a=${NSA_IP6}
log_start
run_cmd nettest -6 -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -r ${a}
log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
@@ -3145,7 +3145,7 @@ ipv6_udp_novrf()
log_start
show_hint "Should fail 'Connection refused' since address is out of device scope"
run_cmd nettest -6 -s -D -I ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -r ${a}
log_test_addr ${a} $? 1 "Device server, local connection"
done
@@ -3153,19 +3153,19 @@ ipv6_udp_novrf()
a=${NSA_IP6}
log_start
run_cmd nettest -6 -s -D &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
log_test_addr ${a} $? 0 "Global server, device client, local connection"
log_start
run_cmd nettest -6 -s -D &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -d ${NSA_DEV} -C -r ${a}
log_test_addr ${a} $? 0 "Global server, device send via cmsg, local connection"
log_start
run_cmd nettest -6 -s -D &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -d ${NSA_DEV} -S -r ${a}
log_test_addr ${a} $? 0 "Global server, device client via IPV6_UNICAST_IF, local connection"
@@ -3174,28 +3174,28 @@ ipv6_udp_novrf()
log_start
show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
run_cmd nettest -6 -D -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV}
log_test_addr ${a} $? 1 "Global server, device client, local connection"
log_start
show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
run_cmd nettest -6 -D -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -C
log_test_addr ${a} $? 1 "Global server, device send via cmsg, local connection"
log_start
show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
run_cmd nettest -6 -D -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S
log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection"
log_start
show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
run_cmd nettest -6 -D -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S -U
log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection, with connect()"
done
@@ -3203,7 +3203,7 @@ ipv6_udp_novrf()
a=${NSA_IP6}
log_start
run_cmd nettest -6 -D -s -I ${NSA_DEV} -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} -0 ${a}
log_test_addr ${a} $? 0 "Device server, device client, local conn"
@@ -3217,7 +3217,7 @@ ipv6_udp_novrf()
run_cmd_nsb ip -6 ro add ${NSA_IP6}/128 dev ${NSB_DEV}
log_start
run_cmd nettest -6 -s -D &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd_nsb nettest -6 -D -r ${NSA_IP6}
log_test $? 0 "UDP in - LLA to GUA"
@@ -3241,7 +3241,7 @@ ipv6_udp_vrf()
log_start
show_hint "Should fail 'Connection refused' since global server is disabled"
run_cmd nettest -6 -D -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd_nsb nettest -6 -D -r ${a}
log_test_addr ${a} $? 1 "Global server"
done
@@ -3250,7 +3250,7 @@ ipv6_udp_vrf()
do
log_start
run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd_nsb nettest -6 -D -r ${a}
log_test_addr ${a} $? 0 "VRF server"
done
@@ -3259,7 +3259,7 @@ ipv6_udp_vrf()
do
log_start
run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd_nsb nettest -6 -D -r ${a}
log_test_addr ${a} $? 0 "Enslaved device server"
done
@@ -3281,7 +3281,7 @@ ipv6_udp_vrf()
log_start
show_hint "Should fail 'Connection refused' since global server is disabled"
run_cmd nettest -6 -D -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -d ${VRF} -r ${a}
log_test_addr ${a} $? 1 "Global server, VRF client, local conn"
done
@@ -3290,7 +3290,7 @@ ipv6_udp_vrf()
do
log_start
run_cmd nettest -6 -D -I ${VRF} -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -d ${VRF} -r ${a}
log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
done
@@ -3299,25 +3299,25 @@ ipv6_udp_vrf()
log_start
show_hint "Should fail 'Connection refused' since global server is disabled"
run_cmd nettest -6 -D -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
log_test_addr ${a} $? 1 "Global server, device client, local conn"
log_start
run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
log_test_addr ${a} $? 0 "VRF server, device client, local conn"
log_start
run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -d ${VRF} -r ${a}
log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"
log_start
run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
@@ -3332,7 +3332,7 @@ ipv6_udp_vrf()
do
log_start
run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd_nsb nettest -6 -D -r ${a}
log_test_addr ${a} $? 0 "Global server"
done
@@ -3341,7 +3341,7 @@ ipv6_udp_vrf()
do
log_start
run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd_nsb nettest -6 -D -r ${a}
log_test_addr ${a} $? 0 "VRF server"
done
@@ -3350,7 +3350,7 @@ ipv6_udp_vrf()
do
log_start
run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd_nsb nettest -6 -D -r ${a}
log_test_addr ${a} $? 0 "Enslaved device server"
done
@@ -3368,7 +3368,7 @@ ipv6_udp_vrf()
#
log_start
run_cmd_nsb nettest -6 -D -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 udp
run_cmd nettest -6 -D -d ${VRF} -r ${NSB_IP6}
log_test $? 0 "VRF client"
@@ -3379,7 +3379,7 @@ ipv6_udp_vrf()
log_start
run_cmd_nsb nettest -6 -D -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 udp
run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_IP6}
log_test $? 0 "Enslaved device client"
@@ -3394,13 +3394,13 @@ ipv6_udp_vrf()
a=${NSA_IP6}
log_start
run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -d ${VRF} -r ${a}
log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
#log_start
run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -d ${VRF} -r ${a}
log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
@@ -3408,13 +3408,13 @@ ipv6_udp_vrf()
a=${VRF_IP6}
log_start
run_cmd nettest -6 -D -s -3 ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -d ${VRF} -r ${a}
log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
log_start
run_cmd nettest -6 -D -I ${VRF} -s -3 ${VRF} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -d ${VRF} -r ${a}
log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
@@ -3430,25 +3430,25 @@ ipv6_udp_vrf()
a=${NSA_IP6}
log_start
run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
log_test_addr ${a} $? 0 "Global server, device client, local conn"
log_start
run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
log_test_addr ${a} $? 0 "VRF server, device client, local conn"
log_start
run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -d ${VRF} -r ${a}
log_test_addr ${a} $? 0 "Device server, VRF client, local conn"
log_start
run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
log_test_addr ${a} $? 0 "Device server, device client, local conn"
@@ -3460,7 +3460,7 @@ ipv6_udp_vrf()
# link local addresses
log_start
run_cmd nettest -6 -D -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd_nsb nettest -6 -D -d ${NSB_DEV} -r ${NSA_LINKIP6}
log_test $? 0 "Global server, linklocal IP"
@@ -3471,7 +3471,7 @@ ipv6_udp_vrf()
log_start
run_cmd_nsb nettest -6 -D -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 udp
run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_LINKIP6}
log_test $? 0 "Enslaved device client, linklocal IP"
@@ -3482,7 +3482,7 @@ ipv6_udp_vrf()
log_start
run_cmd nettest -6 -D -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSA_LINKIP6}
log_test $? 0 "Enslaved device client, local conn - linklocal IP"
@@ -3495,7 +3495,7 @@ ipv6_udp_vrf()
run_cmd_nsb ip -6 ro add ${NSA_IP6}/128 dev ${NSB_DEV}
log_start
run_cmd nettest -6 -s -D &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 udp
run_cmd_nsb nettest -6 -D -r ${NSA_IP6}
log_test $? 0 "UDP in - LLA to GUA"
@@ -3674,7 +3674,7 @@ ipv6_rt()
do
log_start
run_cmd nettest ${varg} -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest ${varg} -r ${a} &
sleep 3
run_cmd ip link del ${VRF}
@@ -3688,7 +3688,7 @@ ipv6_rt()
do
log_start
run_cmd nettest ${varg} -I ${VRF} -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest ${varg} -r ${a} &
sleep 3
run_cmd ip link del ${VRF}
@@ -3702,7 +3702,7 @@ ipv6_rt()
do
log_start
run_cmd nettest ${varg} -I ${NSA_DEV} -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest ${varg} -r ${a} &
sleep 3
run_cmd ip link del ${VRF}
@@ -3717,7 +3717,7 @@ ipv6_rt()
#
log_start
run_cmd_nsb nettest ${varg} -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 tcp
run_cmd nettest ${varg} -d ${VRF} -r ${NSB_IP6} &
sleep 3
run_cmd ip link del ${VRF}
@@ -3728,7 +3728,7 @@ ipv6_rt()
log_start
run_cmd_nsb nettest ${varg} -s &
- sleep 1
+ wait_local_port_listen ${NSB} 12345 tcp
run_cmd nettest ${varg} -d ${NSA_DEV} -r ${NSB_IP6} &
sleep 3
run_cmd ip link del ${VRF}
@@ -3745,7 +3745,7 @@ ipv6_rt()
do
log_start
run_cmd nettest ${varg} -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest ${varg} -d ${VRF} -r ${a} &
sleep 3
run_cmd ip link del ${VRF}
@@ -3759,7 +3759,7 @@ ipv6_rt()
do
log_start
run_cmd nettest ${varg} -I ${VRF} -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest ${varg} -d ${VRF} -r ${a} &
sleep 3
run_cmd ip link del ${VRF}
@@ -3772,7 +3772,7 @@ ipv6_rt()
a=${NSA_IP6}
log_start
run_cmd nettest ${varg} -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
sleep 3
run_cmd ip link del ${VRF}
@@ -3783,7 +3783,7 @@ ipv6_rt()
log_start
run_cmd nettest ${varg} -I ${VRF} -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
sleep 3
run_cmd ip link del ${VRF}
@@ -3794,7 +3794,7 @@ ipv6_rt()
log_start
run_cmd nettest ${varg} -I ${NSA_DEV} -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
sleep 3
run_cmd ip link del ${VRF}
@@ -3853,7 +3853,7 @@ netfilter_tcp_reset()
do
log_start
run_cmd nettest -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -r ${a}
log_test_addr ${a} $? 1 "Global server, reject with TCP-reset on Rx"
done
@@ -3871,7 +3871,7 @@ netfilter_icmp()
do
log_start
run_cmd nettest ${arg} -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest ${arg} -r ${a}
log_test_addr ${a} $? 1 "Global ${stype} server, Rx reject icmp-port-unreach"
done
@@ -3910,7 +3910,7 @@ netfilter_tcp6_reset()
do
log_start
run_cmd nettest -6 -s &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 -r ${a}
log_test_addr ${a} $? 1 "Global server, reject with TCP-reset on Rx"
done
@@ -3928,7 +3928,7 @@ netfilter_icmp6()
do
log_start
run_cmd nettest -6 -s ${arg} &
- sleep 1
+ wait_local_port_listen ${NSA} 12345 tcp
run_cmd_nsb nettest -6 ${arg} -r ${a}
log_test_addr ${a} $? 1 "Global ${stype} server, Rx reject icmp-port-unreach"
done
@@ -4124,12 +4124,12 @@ use_case_snat_on_vrf()
run_cmd ip6tables -t nat -A POSTROUTING -p tcp -m tcp --dport ${port} -j SNAT --to-source ${NSA_LO_IP6} -o ${VRF}
run_cmd_nsb nettest -s -l ${NSB_IP} -p ${port} &
- sleep 1
+ wait_local_port_listen ${NSB} ${port} tcp
run_cmd nettest -d ${VRF} -r ${NSB_IP} -p ${port}
log_test $? 0 "IPv4 TCP connection over VRF with SNAT"
run_cmd_nsb nettest -6 -s -l ${NSB_IP6} -p ${port} &
- sleep 1
+ wait_local_port_listen ${NSB} ${port} tcp
run_cmd nettest -6 -d ${VRF} -r ${NSB_IP6} -p ${port}
log_test $? 0 "IPv6 TCP connection over VRF with SNAT"
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 214/568] media: redrat3: use int type to store negative error codes
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 213/568] selftests: net: replace sleeps in fcnal-test with waits Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 215/568] selftests: traceroute: Use require_command() Greg Kroah-Hartman
` (360 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qianfeng Rong, Sean Young,
Hans Verkuil, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <rongqianfeng@vivo.com>
[ Upstream commit ecba852dc9f4993f4f894ea1f352564560e19a3e ]
Change "ret" from u8 to int type in redrat3_enable_detector() to store
negative error codes or zero returned by redrat3_send_cmd() and
usb_submit_urb() - this better aligns with the coding standards and
maintains code consistency.
No effect on runtime.
Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/redrat3.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index 9f2947af33aa7..880981e1c507e 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -422,7 +422,7 @@ static int redrat3_send_cmd(int cmd, struct redrat3_dev *rr3)
static int redrat3_enable_detector(struct redrat3_dev *rr3)
{
struct device *dev = rr3->dev;
- u8 ret;
+ int ret;
ret = redrat3_send_cmd(RR3_RC_DET_ENABLE, rr3);
if (ret != 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 215/568] selftests: traceroute: Use require_command()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 214/568] media: redrat3: use int type to store negative error codes Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 216/568] netfilter: nf_reject: dont reply to icmp error messages Greg Kroah-Hartman
` (359 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Machata, David Ahern,
Ido Schimmel, Paolo Abeni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <idosch@nvidia.com>
[ Upstream commit 47efbac9b768553331b9459743a29861e0acd797 ]
Use require_command() so that the test will return SKIP (4) when a
required command is not present.
Before:
# ./traceroute.sh
SKIP: Could not run IPV6 test without traceroute6
SKIP: Could not run IPV4 test without traceroute
$ echo $?
0
After:
# ./traceroute.sh
TEST: traceroute6 not installed [SKIP]
$ echo $?
4
Reviewed-by: Petr Machata <petrm@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20250908073238.119240-6-idosch@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/traceroute.sh | 13 +++----------
1 file changed, 3 insertions(+), 10 deletions(-)
diff --git a/tools/testing/selftests/net/traceroute.sh b/tools/testing/selftests/net/traceroute.sh
index de9ca97abc306..9cb5e96e64333 100755
--- a/tools/testing/selftests/net/traceroute.sh
+++ b/tools/testing/selftests/net/traceroute.sh
@@ -209,11 +209,6 @@ setup_traceroute6()
run_traceroute6()
{
- if [ ! -x "$(command -v traceroute6)" ]; then
- echo "SKIP: Could not run IPV6 test without traceroute6"
- return
- fi
-
setup_traceroute6
# traceroute6 host-2 from host-1 (expects 2000:102::2)
@@ -278,11 +273,6 @@ setup_traceroute()
run_traceroute()
{
- if [ ! -x "$(command -v traceroute)" ]; then
- echo "SKIP: Could not run IPV4 test without traceroute"
- return
- fi
-
setup_traceroute
# traceroute host-2 from host-1 (expects 1.0.1.1). Takes a while.
@@ -316,6 +306,9 @@ do
esac
done
+require_command traceroute6
+require_command traceroute
+
run_tests
printf "\nTests passed: %3d\n" ${nsuccess}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 216/568] netfilter: nf_reject: dont reply to icmp error messages
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 215/568] selftests: traceroute: Use require_command() Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 217/568] x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT Greg Kroah-Hartman
` (358 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Florian Westphal, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit db99b2f2b3e2cd8227ac9990ca4a8a31a1e95e56 ]
tcp reject code won't reply to a tcp reset.
But the icmp reject 'netdev' family versions will reply to icmp
dst-unreach errors, unlike icmp_send() and icmp6_send() which are used
by the inet family implementation (and internally by the REJECT target).
Check for the icmp(6) type and do not respond if its an unreachable error.
Without this, something like 'ip protocol icmp reject', when used
in a netdev chain attached to 'lo', cause a packet loop.
Same for two hosts that both use such a rule: each error packet
will be replied to.
Such situation persist until the (bogus) rule is amended to ratelimit or
checks the icmp type before the reject statement.
As the inet versions don't do this make the netdev ones follow along.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/netfilter/nf_reject_ipv4.c | 25 ++++++++++++++++++++++++
net/ipv6/netfilter/nf_reject_ipv6.c | 30 +++++++++++++++++++++++++++++
2 files changed, 55 insertions(+)
diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
index 2d663fe50f876..2064b40130412 100644
--- a/net/ipv4/netfilter/nf_reject_ipv4.c
+++ b/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -71,6 +71,27 @@ struct sk_buff *nf_reject_skb_v4_tcp_reset(struct net *net,
}
EXPORT_SYMBOL_GPL(nf_reject_skb_v4_tcp_reset);
+static bool nf_skb_is_icmp_unreach(const struct sk_buff *skb)
+{
+ const struct iphdr *iph = ip_hdr(skb);
+ u8 *tp, _type;
+ int thoff;
+
+ if (iph->protocol != IPPROTO_ICMP)
+ return false;
+
+ thoff = skb_network_offset(skb) + sizeof(*iph);
+
+ tp = skb_header_pointer(skb,
+ thoff + offsetof(struct icmphdr, type),
+ sizeof(_type), &_type);
+
+ if (!tp)
+ return false;
+
+ return *tp == ICMP_DEST_UNREACH;
+}
+
struct sk_buff *nf_reject_skb_v4_unreach(struct net *net,
struct sk_buff *oldskb,
const struct net_device *dev,
@@ -91,6 +112,10 @@ struct sk_buff *nf_reject_skb_v4_unreach(struct net *net,
if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
return NULL;
+ /* don't reply to ICMP_DEST_UNREACH with ICMP_DEST_UNREACH. */
+ if (nf_skb_is_icmp_unreach(oldskb))
+ return NULL;
+
/* RFC says return as much as we can without exceeding 576 bytes. */
len = min_t(unsigned int, 536, oldskb->len);
diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
index f3579bccf0a51..a19ca1907de36 100644
--- a/net/ipv6/netfilter/nf_reject_ipv6.c
+++ b/net/ipv6/netfilter/nf_reject_ipv6.c
@@ -91,6 +91,32 @@ struct sk_buff *nf_reject_skb_v6_tcp_reset(struct net *net,
}
EXPORT_SYMBOL_GPL(nf_reject_skb_v6_tcp_reset);
+static bool nf_skb_is_icmp6_unreach(const struct sk_buff *skb)
+{
+ const struct ipv6hdr *ip6h = ipv6_hdr(skb);
+ u8 proto = ip6h->nexthdr;
+ u8 _type, *tp;
+ int thoff;
+ __be16 fo;
+
+ thoff = ipv6_skip_exthdr(skb, ((u8 *)(ip6h + 1) - skb->data), &proto, &fo);
+
+ if (thoff < 0 || thoff >= skb->len || fo != 0)
+ return false;
+
+ if (proto != IPPROTO_ICMPV6)
+ return false;
+
+ tp = skb_header_pointer(skb,
+ thoff + offsetof(struct icmp6hdr, icmp6_type),
+ sizeof(_type), &_type);
+
+ if (!tp)
+ return false;
+
+ return *tp == ICMPV6_DEST_UNREACH;
+}
+
struct sk_buff *nf_reject_skb_v6_unreach(struct net *net,
struct sk_buff *oldskb,
const struct net_device *dev,
@@ -104,6 +130,10 @@ struct sk_buff *nf_reject_skb_v6_unreach(struct net *net,
if (!nf_reject_ip6hdr_validate(oldskb))
return NULL;
+ /* Don't reply to ICMPV6_DEST_UNREACH with ICMPV6_DEST_UNREACH */
+ if (nf_skb_is_icmp6_unreach(oldskb))
+ return NULL;
+
/* Include "As much of invoking packet as possible without the ICMPv6
* packet exceeding the minimum IPv6 MTU" in the ICMP payload.
*/
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 217/568] x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 216/568] netfilter: nf_reject: dont reply to icmp error messages Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 218/568] selftests: Disable dad for ipv6 in fcnal-test.sh Greg Kroah-Hartman
` (357 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li RongQing, Sean Christopherson,
Wangyang Guo, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <lirongqing@baidu.com>
[ Upstream commit 960550503965094b0babd7e8c83ec66c8a763b0b ]
The commit b2798ba0b876 ("KVM: X86: Choose qspinlock when dedicated
physical CPUs are available") states that when PV_DEDICATED=1
(vCPU has dedicated pCPU), qspinlock should be preferred regardless of
PV_UNHALT. However, the current implementation doesn't reflect this: when
PV_UNHALT=0, we still use virt_spin_lock() even with dedicated pCPUs.
This is suboptimal because:
1. Native qspinlocks should outperform virt_spin_lock() for dedicated
vCPUs irrespective of HALT exiting
2. virt_spin_lock() should only be preferred when vCPUs may be preempted
(non-dedicated case)
So reorder the PV spinlock checks to:
1. First handle dedicated pCPU case (disable virt_spin_lock_key)
2. Second check single CPU, and nopvspin configuration
3. Only then check PV_UNHALT support
This ensures we always use native qspinlock for dedicated vCPUs, delivering
pretty performance gains at high contention levels.
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Reviewed-by: Sean Christopherson <seanjc@google.com>
Tested-by: Wangyang Guo <wangyang.guo@intel.com>
Link: https://lore.kernel.org/r/20250722110005.4988-1-lirongqing@baidu.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/kvm.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index 796e2f9e87619..99e0768ccaae7 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -1072,16 +1072,6 @@ static void kvm_wait(u8 *ptr, u8 val)
*/
void __init kvm_spinlock_init(void)
{
- /*
- * In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an
- * advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is
- * preferred over native qspinlock when vCPU is preempted.
- */
- if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT)) {
- pr_info("PV spinlocks disabled, no host support\n");
- return;
- }
-
/*
* Disable PV spinlocks and use native qspinlock when dedicated pCPUs
* are available.
@@ -1101,6 +1091,16 @@ void __init kvm_spinlock_init(void)
goto out;
}
+ /*
+ * In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an
+ * advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is
+ * preferred over native qspinlock when vCPU is preempted.
+ */
+ if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT)) {
+ pr_info("PV spinlocks disabled, no host support\n");
+ return;
+ }
+
pr_info("PV spinlocks enabled\n");
__pv_init_lock_hash();
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 218/568] selftests: Disable dad for ipv6 in fcnal-test.sh
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 217/568] x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 219/568] eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP Greg Kroah-Hartman
` (356 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Ahern, Simon Horman,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ahern <dsahern@kernel.org>
[ Upstream commit 53d591730ea34f97a82f7ec6e7c987ca6e34dc21 ]
Constrained test environment; duplicate address detection is not needed
and causes races so disable it.
Signed-off-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250910025828.38900-1-dsahern@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/fcnal-test.sh | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
index 1c0dcddbe2bd1..135e19db39eb0 100755
--- a/tools/testing/selftests/net/fcnal-test.sh
+++ b/tools/testing/selftests/net/fcnal-test.sh
@@ -423,6 +423,8 @@ create_ns()
ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1
ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.forwarding=1
ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.forwarding=1
+ ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.accept_dad=0
+ ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.accept_dad=0
}
# create veth pair to connect namespaces and apply addresses.
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 219/568] eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 218/568] selftests: Disable dad for ipv6 in fcnal-test.sh Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 220/568] selftests: Replace sleep with slowwait Greg Kroah-Hartman
` (355 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Palmer, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <daniel@thingy.jp>
[ Upstream commit 43adad382e1fdecabd2c4cd2bea777ef4ce4109e ]
When 8139too is probing and 8139TOO_PIO=y it will call pci_iomap_range()
and from there __pci_ioport_map() for the PCI IO space.
If HAS_IOPORT_MAP=n and NO_GENERIC_PCI_IOPORT_MAP=n, like it is on my
m68k config, __pci_ioport_map() becomes NULL, pci_iomap_range() will
always fail and the driver will complain it couldn't map the PIO space
and return an error.
NO_IOPORT_MAP seems to cover the case where what 8139too is trying
to do cannot ever work so make 8139TOO_PIO depend on being it false
and avoid creating an unusable driver.
Signed-off-by: Daniel Palmer <daniel@thingy.jp>
Link: https://patch.msgid.link/20250907064349.3427600-1-daniel@thingy.jp
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/realtek/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/realtek/Kconfig b/drivers/net/ethernet/realtek/Kconfig
index 93d9df55b361a..01811924c4db4 100644
--- a/drivers/net/ethernet/realtek/Kconfig
+++ b/drivers/net/ethernet/realtek/Kconfig
@@ -58,7 +58,7 @@ config 8139TOO
config 8139TOO_PIO
bool "Use PIO instead of MMIO"
default y
- depends on 8139TOO
+ depends on 8139TOO && !NO_IOPORT_MAP
help
This instructs the driver to use programmed I/O ports (PIO) instead
of PCI shared memory (MMIO). This can possibly solve some problems
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 220/568] selftests: Replace sleep with slowwait
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 219/568] eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 221/568] udp_tunnel: use netdev_warn() instead of netdev_WARN() Greg Kroah-Hartman
` (354 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Ahern, Simon Horman,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ahern <dsahern@kernel.org>
[ Upstream commit 2f186dd5585c3afb415df80e52f71af16c9d3655 ]
Replace the sleep in kill_procs with slowwait.
Signed-off-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250910025828.38900-2-dsahern@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/fcnal-test.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
index 135e19db39eb0..bb20dac178698 100755
--- a/tools/testing/selftests/net/fcnal-test.sh
+++ b/tools/testing/selftests/net/fcnal-test.sh
@@ -194,7 +194,7 @@ show_hint()
kill_procs()
{
killall nettest ping ping6 >/dev/null 2>&1
- sleep 1
+ slowwait 2 sh -c 'test -z "$(pgrep '"'^(nettest|ping|ping6)$'"')"'
}
do_run_cmd()
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 221/568] udp_tunnel: use netdev_warn() instead of netdev_WARN()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 220/568] selftests: Replace sleep with slowwait Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 222/568] watchdog: s3c2410_wdt: Fix max_timeout being calculated larger Greg Kroah-Hartman
` (353 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alok Tiwari, Simon Horman,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <alok.a.tiwari@oracle.com>
[ Upstream commit dc2f650f7e6857bf384069c1a56b2937a1ee370d ]
netdev_WARN() uses WARN/WARN_ON to print a backtrace along with
file and line information. In this case, udp_tunnel_nic_register()
returning an error is just a failed operation, not a kernel bug.
udp_tunnel_nic_register() can fail due to a memory allocation
failure (kzalloc() or udp_tunnel_nic_alloc()).
This is a normal runtime error and not a kernel bug.
Replace netdev_WARN() with netdev_warn() accordingly.
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250910195031.3784748-1-alok.a.tiwari@oracle.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/udp_tunnel_nic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv4/udp_tunnel_nic.c b/net/ipv4/udp_tunnel_nic.c
index bc3a043a5d5c7..72b0210cdead7 100644
--- a/net/ipv4/udp_tunnel_nic.c
+++ b/net/ipv4/udp_tunnel_nic.c
@@ -897,7 +897,7 @@ udp_tunnel_nic_netdevice_event(struct notifier_block *unused,
err = udp_tunnel_nic_register(dev);
if (err)
- netdev_WARN(dev, "failed to register for UDP tunnel offloads: %d", err);
+ netdev_warn(dev, "failed to register for UDP tunnel offloads: %d", err);
return notifier_from_errno(err);
}
/* All other events will need the udp_tunnel_nic state */
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 222/568] watchdog: s3c2410_wdt: Fix max_timeout being calculated larger
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 221/568] udp_tunnel: use netdev_warn() instead of netdev_WARN() Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 223/568] net/cls_cgroup: Fix task_get_classid() during qdisc run Greg Kroah-Hartman
` (352 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sam Protsenko, Sangwook Shin,
Guenter Roeck, Wim Van Sebroeck, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sangwook Shin <sw617.shin@samsung.com>
[ Upstream commit df3c6e0b6d83450563d6266e1dacc7eaf25511f4 ]
Fix the issue of max_timeout being calculated larger than actual value.
The calculation result of freq / (S3C2410_WTCON_PRESCALE_MAX + 1) /
S3C2410_WTCON_MAXDIV is smaller than the actual value because the remainder
is discarded during the calculation process. This leads to a larger
calculated value for max_timeout compared to the actual settable value.
To resolve this issue, the order of calculations in the computation process
has been adjusted.
Reviewed-by: Sam Protsenko <semen.protsenko@linaro.org>
Signed-off-by: Sangwook Shin <sw617.shin@samsung.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/s3c2410_wdt.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c
index d3fc8ed886fff..3853be982cd3c 100644
--- a/drivers/watchdog/s3c2410_wdt.c
+++ b/drivers/watchdog/s3c2410_wdt.c
@@ -27,6 +27,7 @@
#include <linux/mfd/syscon.h>
#include <linux/regmap.h>
#include <linux/delay.h>
+#include <linux/math64.h>
#define S3C2410_WTCON 0x00
#define S3C2410_WTDAT 0x04
@@ -303,9 +304,14 @@ static inline unsigned long s3c2410wdt_get_freq(struct s3c2410_wdt *wdt)
static inline unsigned int s3c2410wdt_max_timeout(struct s3c2410_wdt *wdt)
{
const unsigned long freq = s3c2410wdt_get_freq(wdt);
+ const u64 n_max = (u64)(S3C2410_WTCON_PRESCALE_MAX + 1) *
+ S3C2410_WTCON_MAXDIV * S3C2410_WTCNT_MAXCNT;
+ u64 t_max = div64_ul(n_max, freq);
- return S3C2410_WTCNT_MAXCNT / (freq / (S3C2410_WTCON_PRESCALE_MAX + 1)
- / S3C2410_WTCON_MAXDIV);
+ if (t_max > UINT_MAX)
+ t_max = UINT_MAX;
+
+ return t_max;
}
static inline struct s3c2410_wdt *freq_to_wdt(struct notifier_block *nb)
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 223/568] net/cls_cgroup: Fix task_get_classid() during qdisc run
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 222/568] watchdog: s3c2410_wdt: Fix max_timeout being calculated larger Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 224/568] wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device Greg Kroah-Hartman
` (351 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yafang Shao, Daniel Borkmann,
Thomas Graf, Sebastian Andrzej Siewior, Nikolay Aleksandrov,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yafang Shao <laoar.shao@gmail.com>
[ Upstream commit 66048f8b3cc7e462953c04285183cdee43a1cb89 ]
During recent testing with the netem qdisc to inject delays into TCP
traffic, we observed that our CLS BPF program failed to function correctly
due to incorrect classid retrieval from task_get_classid(). The issue
manifests in the following call stack:
bpf_get_cgroup_classid+5
cls_bpf_classify+507
__tcf_classify+90
tcf_classify+217
__dev_queue_xmit+798
bond_dev_queue_xmit+43
__bond_start_xmit+211
bond_start_xmit+70
dev_hard_start_xmit+142
sch_direct_xmit+161
__qdisc_run+102 <<<<< Issue location
__dev_xmit_skb+1015
__dev_queue_xmit+637
neigh_hh_output+159
ip_finish_output2+461
__ip_finish_output+183
ip_finish_output+41
ip_output+120
ip_local_out+94
__ip_queue_xmit+394
ip_queue_xmit+21
__tcp_transmit_skb+2169
tcp_write_xmit+959
__tcp_push_pending_frames+55
tcp_push+264
tcp_sendmsg_locked+661
tcp_sendmsg+45
inet_sendmsg+67
sock_sendmsg+98
sock_write_iter+147
vfs_write+786
ksys_write+181
__x64_sys_write+25
do_syscall_64+56
entry_SYSCALL_64_after_hwframe+100
The problem occurs when multiple tasks share a single qdisc. In such cases,
__qdisc_run() may transmit skbs created by different tasks. Consequently,
task_get_classid() retrieves an incorrect classid since it references the
current task's context rather than the skb's originating task.
Given that dev_queue_xmit() always executes with bh disabled, we can use
softirq_count() instead to obtain the correct classid.
The simple steps to reproduce this issue:
1. Add network delay to the network interface:
such as: tc qdisc add dev bond0 root netem delay 1.5ms
2. Build two distinct net_cls cgroups, each with a network-intensive task
3. Initiate parallel TCP streams from both tasks to external servers.
Under this specific condition, the issue reliably occurs. The kernel
eventually dequeues an SKB that originated from Task-A while executing in
the context of Task-B.
It is worth noting that it will change the established behavior for a
slightly different scenario:
<sock S is created by task A>
<class ID for task A is changed>
<skb is created by sock S xmit and classified>
prior to this patch the skb will be classified with the 'new' task A
classid, now with the old/original one. The bpf_get_cgroup_classid_curr()
function is a more appropriate choice for this case.
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Thomas Graf <tgraf@suug.ch>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20250902062933.30087-1-laoar.shao@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/cls_cgroup.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/net/cls_cgroup.h b/include/net/cls_cgroup.h
index 7e78e7d6f0152..668aeee9b3f66 100644
--- a/include/net/cls_cgroup.h
+++ b/include/net/cls_cgroup.h
@@ -63,7 +63,7 @@ static inline u32 task_get_classid(const struct sk_buff *skb)
* calls by looking at the number of nested bh disable calls because
* softirqs always disables bh.
*/
- if (in_serving_softirq()) {
+ if (softirq_count()) {
struct sock *sk = skb_to_full_sk(skb);
/* If there is an sock_cgroup_classid we'll use that. */
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 224/568] wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 223/568] net/cls_cgroup: Fix task_get_classid() during qdisc run Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 225/568] ALSA: serial-generic: remove shared static buffer Greg Kroah-Hartman
` (350 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Quan Zhou, Felix Fietkau,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quan Zhou <quan.zhou@mediatek.com>
[ Upstream commit 25ef5b5d02ac03fe8dd91cf25bd011a570fbeba2 ]
Enable 160MHz beamformee support on mt7922 by updating HE capability
element configuration. Previously, only 160MHz channel width was set,
but beamformee for 160MHz was not properly advertised. This patch
adds BEAMFORMEE_MAX_STS_ABOVE_80MHZ_4 capability to allow devices
to utilize 160MHz BW for beamforming.
Tested by connecting to 160MHz-bandwidth beamforming AP and verified
HE capability.
Signed-off-by: Quan Zhou <quan.zhou@mediatek.com>
Link: https://patch.msgid.link/ae637afaffed387018fdc43709470ef65898ff0b.1756383627.git.quan.zhou@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7921/main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
index 7adda1718d6ac..fd91d2c537603 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
@@ -156,6 +156,8 @@ mt7921_init_he_caps(struct mt7921_phy *phy, enum nl80211_band band,
if (is_mt7922(phy->mt76->dev)) {
he_cap_elem->phy_cap_info[0] |=
IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
+ he_cap_elem->phy_cap_info[4] |=
+ IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_4;
he_cap_elem->phy_cap_info[8] |=
IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU |
IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 225/568] ALSA: serial-generic: remove shared static buffer
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 224/568] wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 226/568] drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl Greg Kroah-Hartman
` (349 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, John Keeping, Takashi Iwai,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <jkeeping@inmusicbrands.com>
[ Upstream commit 84973249011fda3ff292f83439a062fec81ef982 ]
If multiple instances of this driver are instantiated and try to send
concurrently then the single static buffer snd_serial_generic_tx_work()
will cause corruption in the data output.
Move the buffer into the per-instance driver data to avoid this.
Signed-off-by: John Keeping <jkeeping@inmusicbrands.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/drivers/serial-generic.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/sound/drivers/serial-generic.c b/sound/drivers/serial-generic.c
index e1f864dc7939a..3843dcc1bee58 100644
--- a/sound/drivers/serial-generic.c
+++ b/sound/drivers/serial-generic.c
@@ -37,6 +37,8 @@ MODULE_LICENSE("GPL");
#define SERIAL_TX_STATE_ACTIVE 1
#define SERIAL_TX_STATE_WAKEUP 2
+#define INTERNAL_BUF_SIZE 256
+
struct snd_serial_generic {
struct serdev_device *serdev;
@@ -51,6 +53,7 @@ struct snd_serial_generic {
struct work_struct tx_work;
unsigned long tx_state;
+ char tx_buf[INTERNAL_BUF_SIZE];
};
static void snd_serial_generic_tx_wakeup(struct snd_serial_generic *drvdata)
@@ -61,11 +64,8 @@ static void snd_serial_generic_tx_wakeup(struct snd_serial_generic *drvdata)
schedule_work(&drvdata->tx_work);
}
-#define INTERNAL_BUF_SIZE 256
-
static void snd_serial_generic_tx_work(struct work_struct *work)
{
- static char buf[INTERNAL_BUF_SIZE];
int num_bytes;
struct snd_serial_generic *drvdata = container_of(work, struct snd_serial_generic,
tx_work);
@@ -78,8 +78,10 @@ static void snd_serial_generic_tx_work(struct work_struct *work)
if (!test_bit(SERIAL_MODE_OUTPUT_OPEN, &drvdata->filemode))
break;
- num_bytes = snd_rawmidi_transmit_peek(substream, buf, INTERNAL_BUF_SIZE);
- num_bytes = serdev_device_write_buf(drvdata->serdev, buf, num_bytes);
+ num_bytes = snd_rawmidi_transmit_peek(substream, drvdata->tx_buf,
+ INTERNAL_BUF_SIZE);
+ num_bytes = serdev_device_write_buf(drvdata->serdev, drvdata->tx_buf,
+ num_bytes);
if (!num_bytes)
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 226/568] drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 225/568] ALSA: serial-generic: remove shared static buffer Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 227/568] drm/amd: Avoid evicting resources at S5 Greg Kroah-Hartman
` (348 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tvrtko Ursulin, Alex Deucher,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
[ Upstream commit dea75df7afe14d6217576dbc28cc3ec1d1f712fb ]
Replace kmalloc_array() + copy_from_user() with memdup_array_user().
This shrinks the source code and improves separation between the kernel
and userspace slabs.
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 19 +++++--------------
1 file changed, 5 insertions(+), 14 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 25cccd080d977..e0cd6a08ffb27 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -1695,30 +1695,21 @@ int amdgpu_cs_wait_fences_ioctl(struct drm_device *dev, void *data,
{
struct amdgpu_device *adev = drm_to_adev(dev);
union drm_amdgpu_wait_fences *wait = data;
- uint32_t fence_count = wait->in.fence_count;
- struct drm_amdgpu_fence *fences_user;
struct drm_amdgpu_fence *fences;
int r;
/* Get the fences from userspace */
- fences = kmalloc_array(fence_count, sizeof(struct drm_amdgpu_fence),
- GFP_KERNEL);
- if (fences == NULL)
- return -ENOMEM;
-
- fences_user = u64_to_user_ptr(wait->in.fences);
- if (copy_from_user(fences, fences_user,
- sizeof(struct drm_amdgpu_fence) * fence_count)) {
- r = -EFAULT;
- goto err_free_fences;
- }
+ fences = memdup_array_user(u64_to_user_ptr(wait->in.fences),
+ wait->in.fence_count,
+ sizeof(struct drm_amdgpu_fence));
+ if (IS_ERR(fences))
+ return PTR_ERR(fences);
if (wait->in.wait_all)
r = amdgpu_cs_wait_all_fences(adev, filp, wait, fences);
else
r = amdgpu_cs_wait_any_fence(adev, filp, wait, fences);
-err_free_fences:
kfree(fences);
return r;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 227/568] drm/amd: Avoid evicting resources at S5
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 226/568] drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 228/568] page_pool: always add GFP_NOWARN for ATOMIC allocations Greg Kroah-Hartman
` (347 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, AceLan Kao, Kai-Heng Feng,
Mark Pearson, Denis Benato, Merthan Karakaş, Eric Naim,
Alex Deucher, Mario Limonciello (AMD), Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <superm1@kernel.org>
[ Upstream commit 531df041f2a5296174abd8292d298eb62fe1ea97 ]
Normally resources are evicted on dGPUs at suspend or hibernate and
on APUs at hibernate. These steps are unnecessary when using the S4
callbacks to put the system into S5.
Cc: AceLan Kao <acelan.kao@canonical.com>
Cc: Kai-Heng Feng <kaihengf@nvidia.com>
Cc: Mark Pearson <mpearson-lenovo@squebb.ca>
Cc: Denis Benato <benato.denis96@gmail.com>
Cc: Merthan Karakaş <m3rthn.k@gmail.com>
Tested-by: Eric Naim <dnaim@cachyos.org>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 18a0802cb74dc..f18f165876043 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -4187,6 +4187,10 @@ static int amdgpu_device_evict_resources(struct amdgpu_device *adev)
if ((adev->in_s3 || adev->in_s0ix) && (adev->flags & AMD_IS_APU))
return 0;
+ /* No need to evict when going to S5 through S4 callbacks */
+ if (system_state == SYSTEM_POWER_OFF)
+ return 0;
+
ret = amdgpu_ttm_evict_resources(adev, TTM_PL_VRAM);
if (ret)
DRM_WARN("evicting device resources failed\n");
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 228/568] page_pool: always add GFP_NOWARN for ATOMIC allocations
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 227/568] drm/amd: Avoid evicting resources at S5 Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 229/568] ethernet: Extend device_get_mac_address() to use NVMEM Greg Kroah-Hartman
` (346 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mina Almasry, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit f3b52167a0cb23b27414452fbc1278da2ee884fc ]
Driver authors often forget to add GFP_NOWARN for page allocation
from the datapath. This is annoying to users as OOMs are a fact
of life, and we pretty much expect network Rx to hit page allocation
failures during OOM. Make page pool add GFP_NOWARN for ATOMIC allocations
by default.
Reviewed-by: Mina Almasry <almasrymina@google.com>
Link: https://patch.msgid.link/20250912161703.361272-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/page_pool.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/core/page_pool.c b/net/core/page_pool.c
index acc1d0d055cdd..8ce34d1c2e076 100644
--- a/net/core/page_pool.c
+++ b/net/core/page_pool.c
@@ -405,6 +405,12 @@ static struct page *__page_pool_alloc_pages_slow(struct page_pool *pool,
struct page *page;
int i, nr_pages;
+ /* Unconditionally set NOWARN if allocating from NAPI.
+ * Drivers forget to set it, and OOM reports on packet Rx are useless.
+ */
+ if ((gfp & GFP_ATOMIC) == GFP_ATOMIC)
+ gfp |= __GFP_NOWARN;
+
/* Don't support bulk alloc for high-order pages */
if (unlikely(pp_order))
return __page_pool_alloc_page_order(pool, gfp);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 229/568] ethernet: Extend device_get_mac_address() to use NVMEM
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 228/568] page_pool: always add GFP_NOWARN for ATOMIC allocations Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 230/568] drm/amdgpu: reject gang submissions under SRIOV Greg Kroah-Hartman
` (345 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Wahren, Andrew Lunn,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <wahrenst@gmx.net>
[ Upstream commit d2d3f529e7b6ff2aa432b16a2317126621c28058 ]
A lot of modern SoC have the ability to store MAC addresses in their
NVMEM. So extend the generic function device_get_mac_address() to
obtain the MAC address from an nvmem cell named 'mac-address' in
case there is no firmware node which contains the MAC address directly.
Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20250912140332.35395-3-wahrenst@gmx.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ethernet/eth.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index 5ba7b460cbf76..1ee90b52f9e06 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -615,7 +615,10 @@ EXPORT_SYMBOL(fwnode_get_mac_address);
*/
int device_get_mac_address(struct device *dev, char *addr)
{
- return fwnode_get_mac_address(dev_fwnode(dev), addr);
+ if (!fwnode_get_mac_address(dev_fwnode(dev), addr))
+ return 0;
+
+ return nvmem_get_mac_address(dev, addr);
}
EXPORT_SYMBOL(device_get_mac_address);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 230/568] drm/amdgpu: reject gang submissions under SRIOV
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 229/568] ethernet: Extend device_get_mac_address() to use NVMEM Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 231/568] selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency Greg Kroah-Hartman
` (344 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, Alex Deucher,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian König <christian.koenig@amd.com>
[ Upstream commit d7ddcf921e7d0d8ebe82e89635bc9dc26ba9540d ]
Gang submission means that the kernel driver guarantees that multiple
submissions are executed on the HW at the same time on different engines.
Background is that those submissions then depend on each other and each
can't finish stand alone.
SRIOV now uses world switch to preempt submissions on the engines to allow
sharing the HW resources between multiple VFs.
The problem is now that the SRIOV world switch can't know about such inter
dependencies and will cause a timeout if it waits for a partially running
gang submission.
To conclude SRIOV and gang submissions are fundamentally incompatible at
the moment. For now just disable them.
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index e0cd6a08ffb27..9ff6a9255c1b1 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -279,7 +279,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
}
}
- if (!p->gang_size) {
+ if (!p->gang_size || (amdgpu_sriov_vf(p->adev) && p->gang_size > 1)) {
ret = -EINVAL;
goto free_all_kdata;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 231/568] selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 230/568] drm/amdgpu: reject gang submissions under SRIOV Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 232/568] scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET Greg Kroah-Hartman
` (343 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nai-Chen Cheng, Simon Horman,
Shuah Khan, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nai-Chen Cheng <bleach1827@gmail.com>
[ Upstream commit d3f7457da7b9527a06dbcbfaf666aa51ac2eeb53 ]
The selftests 'make clean' does not clean the net/lib because it only
processes $(TARGETS) and ignores $(INSTALL_DEP_TARGETS). This leaves
compiled objects in net/lib after cleaning, requiring manual cleanup.
Include $(INSTALL_DEP_TARGETS) in clean target to ensure net/lib
dependency is properly cleaned.
Signed-off-by: Nai-Chen Cheng <bleach1827@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Simon Horman <horms@kernel.org> # build-tested
Acked-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://patch.msgid.link/20250910-selftests-makefile-clean-v1-1-29e7f496cd87@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index aae64eb2ae737..bf34fa443b233 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -250,7 +250,7 @@ gen_tar: install
@echo "Created ${TAR_PATH}"
clean:
- @for TARGET in $(TARGETS); do \
+ @for TARGET in $(TARGETS) $(INSTALL_DEP_TARGETS); do \
BUILD_TARGET=$$BUILD/$$TARGET; \
$(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET clean;\
done;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 232/568] scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 231/568] selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 233/568] scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup Greg Kroah-Hartman
` (342 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Justin Tee, Martin K. Petersen,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <justin.tee@broadcom.com>
[ Upstream commit f408dde2468b3957e92b25e7438f74c8e9fb9e73 ]
If lpfc_reset_flush_io_context fails to execute, then the wrong return
status code may be passed back to upper layers when issuing a target
reset TMF command. Fix by checking the return status from
lpfc_reset_flush_io_context() first in order to properly return FAILED
or FAST_IO_FAIL.
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Message-ID: <20250915180811.137530-7-justintee8345@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/lpfc/lpfc_scsi.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
index 6d4777a5f3d42..d09a8d583ba3c 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@ -5928,7 +5928,7 @@ lpfc_chk_tgt_mapped(struct lpfc_vport *vport, struct fc_rport *rport)
/**
* lpfc_reset_flush_io_context -
* @vport: The virtual port (scsi_host) for the flush context
- * @tgt_id: If aborting by Target contect - specifies the target id
+ * @tgt_id: If aborting by Target context - specifies the target id
* @lun_id: If aborting by Lun context - specifies the lun id
* @context: specifies the context level to flush at.
*
@@ -6102,8 +6102,14 @@ lpfc_target_reset_handler(struct scsi_cmnd *cmnd)
pnode->nlp_fcp_info &= ~NLP_FCP_2_DEVICE;
spin_unlock_irqrestore(&pnode->lock, flags);
}
- lpfc_reset_flush_io_context(vport, tgt_id, lun_id,
- LPFC_CTX_TGT);
+ status = lpfc_reset_flush_io_context(vport, tgt_id, lun_id,
+ LPFC_CTX_TGT);
+ if (status != SUCCESS) {
+ lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP,
+ "0726 Target Reset flush status x%x\n",
+ status);
+ return status;
+ }
return FAST_IO_FAIL;
}
@@ -6199,7 +6205,7 @@ lpfc_host_reset_handler(struct scsi_cmnd *cmnd)
int rc, ret = SUCCESS;
lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP,
- "3172 SCSI layer issued Host Reset Data:\n");
+ "3172 SCSI layer issued Host Reset\n");
lpfc_offline_prep(phba, LPFC_MBX_WAIT);
lpfc_offline(phba);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 233/568] scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 232/568] scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 234/568] scsi: lpfc: Define size of debugfs entry for xri rebalancing Greg Kroah-Hartman
` (341 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Justin Tee, Martin K. Petersen,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <justin.tee@broadcom.com>
[ Upstream commit a4809b98eb004fcbf7c4d45eb5a624d1c682bb73 ]
In lpfc_cleanup, there is an extraneous nlp_put for NPIV ports on the
F_Port_Ctrl ndlp object. In cases when an ABTS is issued, the
outstanding kref is needed for when a second XRI_ABORTED CQE is
received. The final kref for the ndlp is designed to be decremented in
lpfc_sli4_els_xri_aborted instead. Also, add a new log message to allow
for future diagnostics when debugging related issues.
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Message-ID: <20250915180811.137530-5-justintee8345@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/lpfc/lpfc_els.c | 6 +++++-
drivers/scsi/lpfc/lpfc_init.c | 7 -------
2 files changed, 5 insertions(+), 8 deletions(-)
diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index b4afaed5e4879..3b7e17ef9c2ec 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -11892,7 +11892,11 @@ lpfc_sli4_els_xri_aborted(struct lpfc_hba *phba,
sglq_entry->state = SGL_FREED;
spin_unlock_irqrestore(&phba->sli4_hba.sgl_list_lock,
iflag);
-
+ lpfc_printf_log(phba, KERN_INFO, LOG_ELS | LOG_SLI |
+ LOG_DISCOVERY | LOG_NODE,
+ "0732 ELS XRI ABORT on Node: ndlp=x%px "
+ "xri=x%x\n",
+ ndlp, xri);
if (ndlp) {
lpfc_set_rrq_active(phba, ndlp,
sglq_entry->sli4_lxritag,
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 97f3c5240d572..6535474fe8a7f 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -3045,13 +3045,6 @@ lpfc_cleanup(struct lpfc_vport *vport)
lpfc_vmid_vport_cleanup(vport);
list_for_each_entry_safe(ndlp, next_ndlp, &vport->fc_nodes, nlp_listp) {
- if (vport->port_type != LPFC_PHYSICAL_PORT &&
- ndlp->nlp_DID == Fabric_DID) {
- /* Just free up ndlp with Fabric_DID for vports */
- lpfc_nlp_put(ndlp);
- continue;
- }
-
if (ndlp->nlp_DID == Fabric_Cntl_DID &&
ndlp->nlp_state == NLP_STE_UNUSED_NODE) {
lpfc_nlp_put(ndlp);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 234/568] scsi: lpfc: Define size of debugfs entry for xri rebalancing
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 233/568] scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 235/568] allow finish_no_open(file, ERR_PTR(-E...)) Greg Kroah-Hartman
` (340 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Justin Tee, Martin K. Petersen,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <justin.tee@broadcom.com>
[ Upstream commit 5de09770b1c0e229d2cec93e7f634fcdc87c9bc8 ]
To assist in debugging lpfc_xri_rebalancing driver parameter, a debugfs
entry is used. The debugfs file operations for xri rebalancing have
been previously implemented, but lack definition for its information
buffer size. Similar to other pre-existing debugfs entry buffers,
define LPFC_HDWQINFO_SIZE as 8192 bytes.
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Message-ID: <20250915180811.137530-9-justintee8345@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/lpfc/lpfc_debugfs.h | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h
index 8d2e8d05bbc05..52b14671eaa94 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.h
+++ b/drivers/scsi/lpfc/lpfc_debugfs.h
@@ -44,6 +44,9 @@
/* hbqinfo output buffer size */
#define LPFC_HBQINFO_SIZE 8192
+/* hdwqinfo output buffer size */
+#define LPFC_HDWQINFO_SIZE 8192
+
/* nvmestat output buffer size */
#define LPFC_NVMESTAT_SIZE 8192
#define LPFC_IOKTIME_SIZE 8192
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 235/568] allow finish_no_open(file, ERR_PTR(-E...))
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 234/568] scsi: lpfc: Define size of debugfs entry for xri rebalancing Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 236/568] usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs Greg Kroah-Hartman
` (339 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, NeilBrown, Al Viro, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
[ Upstream commit fe91e078b60d1beabf5cef4a37c848457a6d2dfb ]
... allowing any ->lookup() return value to be passed to it.
Reviewed-by: NeilBrown <neil@brown.name>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/open.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/fs/open.c b/fs/open.c
index 2f88454887986..85466cd40c407 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -978,18 +978,20 @@ EXPORT_SYMBOL(finish_open);
* finish_no_open - finish ->atomic_open() without opening the file
*
* @file: file pointer
- * @dentry: dentry or NULL (as returned from ->lookup())
+ * @dentry: dentry, ERR_PTR(-E...) or NULL (as returned from ->lookup())
*
- * This can be used to set the result of a successful lookup in ->atomic_open().
+ * This can be used to set the result of a lookup in ->atomic_open().
*
* NB: unlike finish_open() this function does consume the dentry reference and
* the caller need not dput() it.
*
- * Returns "0" which must be the return value of ->atomic_open() after having
- * called this function.
+ * Returns 0 or -E..., which must be the return value of ->atomic_open() after
+ * having called this function.
*/
int finish_no_open(struct file *file, struct dentry *dentry)
{
+ if (IS_ERR(dentry))
+ return PTR_ERR(dentry);
file->f_path.dentry = dentry;
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 236/568] usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 235/568] allow finish_no_open(file, ERR_PTR(-E...)) Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 6.1 237/568] usb: xhci: plat: Facilitate using autosuspend for xhci plat devices Greg Kroah-Hartman
` (338 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Forest Crossman, Alan Stern,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Forest Crossman <cyrozap@gmail.com>
[ Upstream commit 368ed48a5ef52e384f54d5809f0a0b79ac567479 ]
The usbmon binary interface currently truncates captures of large
transfers from higher-speed USB devices. Because a single event capture
is limited to one-fifth of the total buffer size, the current maximum
size of a captured URB is around 240 KiB. This is insufficient when
capturing traffic from modern devices that use transfers of several
hundred kilobytes or more, as truncated URBs can make it impossible for
user-space USB analysis tools like Wireshark to properly defragment and
reassemble higher-level protocol packets in the captured data.
The root cause of this issue is the 1200 KiB BUFF_MAX limit, which has
not been changed since the binary interface was introduced in 2006.
To resolve this issue, this patch increases BUFF_MAX to 64 MiB. The
original comment for BUFF_MAX based the limit's calculation on a
saturated 480 Mbit/s bus. Applying the same logic to a modern USB 3.2
Gen 2×2 20 Gbit/s bus (~2500 MB/s over a 20ms window) indicates the
buffer should be at least 50 MB. The new limit of 64 MiB covers that,
plus a little extra for any overhead.
With this change, both users and developers should now be able to debug
and reverse engineer modern USB devices even when running unmodified
distro kernels.
Please note that this change does not affect the default buffer size. A
larger buffer is only allocated when a user explicitly requests it via
the MON_IOCT_RING_SIZE ioctl, so the change to the maximum buffer size
should not unduly increase memory usage for users that don't
deliberately request a larger buffer.
Link: https://lore.kernel.org/CAO3ALPzdUkmMr0YMrODLeDSLZqNCkWcAP8NumuPHLjNJ8wC1kQ@mail.gmail.com
Signed-off-by: Forest Crossman <cyrozap@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/CAO3ALPxU5RzcoueC454L=WZ1qGMfAcnxm+T+p+9D8O9mcrUbCQ@mail.gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/mon/mon_bin.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
index 35483217b1f6c..93998d328d9aa 100644
--- a/drivers/usb/mon/mon_bin.c
+++ b/drivers/usb/mon/mon_bin.c
@@ -68,18 +68,20 @@
* The magic limit was calculated so that it allows the monitoring
* application to pick data once in two ticks. This way, another application,
* which presumably drives the bus, gets to hog CPU, yet we collect our data.
- * If HZ is 100, a 480 mbit/s bus drives 614 KB every jiffy. USB has an
- * enormous overhead built into the bus protocol, so we need about 1000 KB.
+ *
+ * Originally, for a 480 Mbit/s bus this required a buffer of about 1 MB. For
+ * modern 20 Gbps buses, this value increases to over 50 MB. The maximum
+ * buffer size is set to 64 MiB to accommodate this.
*
* This is still too much for most cases, where we just snoop a few
* descriptor fetches for enumeration. So, the default is a "reasonable"
- * amount for systems with HZ=250 and incomplete bus saturation.
+ * amount for typical, low-throughput use cases.
*
* XXX What about multi-megabyte URBs which take minutes to transfer?
*/
-#define BUFF_MAX CHUNK_ALIGN(1200*1024)
-#define BUFF_DFL CHUNK_ALIGN(300*1024)
-#define BUFF_MIN CHUNK_ALIGN(8*1024)
+#define BUFF_MAX CHUNK_ALIGN(64*1024*1024)
+#define BUFF_DFL CHUNK_ALIGN(300*1024)
+#define BUFF_MIN CHUNK_ALIGN(8*1024)
/*
* The per-event API header (2 per URB).
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 237/568] usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 236/568] usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 238/568] ipv6: np->rxpmtu race annotation Greg Kroah-Hartman
` (337 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Krishna Kurapati, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
[ Upstream commit 41cf11946b9076383a2222bbf1ef57d64d033f66 ]
Allow autosuspend to be used by xhci plat device. For Qualcomm SoCs,
when in host mode, it is intended that the controller goes to suspend
state to save power and wait for interrupts from connected peripheral
to wake it up. This is particularly used in cases where a HID or Audio
device is connected. In such scenarios, the usb controller can enter
auto suspend and resume action after getting interrupts from the
connected device.
Signed-off-by: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250916120436.3617598-1-krishna.kurapati@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-plat.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 7ec4c38c3ceec..fe799abf252b3 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -224,6 +224,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
return ret;
pm_runtime_set_active(&pdev->dev);
+ pm_runtime_use_autosuspend(&pdev->dev);
pm_runtime_enable(&pdev->dev);
pm_runtime_get_noresume(&pdev->dev);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 238/568] ipv6: np->rxpmtu race annotation
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 6.1 237/568] usb: xhci: plat: Facilitate using autosuspend for xhci plat devices Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 239/568] jfs: Verify inode mode when loading from disk Greg Kroah-Hartman
` (336 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Willem de Bruijn,
David Ahern, Kuniyuki Iwashima, Jakub Kicinski, Paolo Abeni,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 9fba1eb39e2f74d2002c5cbcf1d4435d37a4f752 ]
Add READ_ONCE() annotations because np->rxpmtu can be changed
while udpv6_recvmsg() and rawv6_recvmsg() read it.
Since this is a very rarely used feature, and that udpv6_recvmsg()
and rawv6_recvmsg() read np->rxopt anyway, change the test order
so that np->rxpmtu does not need to be in a hot cache line.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20250916160951.541279-4-edumazet@google.com
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/raw.c | 2 +-
net/ipv6/udp.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index dc31752a7edcc..c644300680ba6 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -437,7 +437,7 @@ static int rawv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
if (flags & MSG_ERRQUEUE)
return ipv6_recv_error(sk, msg, len, addr_len);
- if (np->rxpmtu && np->rxopt.bits.rxpmtu)
+ if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
skb = skb_recv_datagram(sk, flags, &err);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 4b063aa37e389..184fc7a5e4d17 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -364,7 +364,7 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
if (flags & MSG_ERRQUEUE)
return ipv6_recv_error(sk, msg, len, addr_len);
- if (np->rxpmtu && np->rxopt.bits.rxpmtu)
+ if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
try_again:
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 239/568] jfs: Verify inode mode when loading from disk
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 238/568] ipv6: np->rxpmtu race annotation Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 240/568] jfs: fix uninitialized waitqueue in transaction manager Greg Kroah-Hartman
` (335 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Tetsuo Handa, Dave Kleikamp,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
[ Upstream commit 7a5aa54fba2bd591b22b9b624e6baa9037276986 ]
The inode mode loaded from corrupted disk can be invalid. Do like what
commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk")
does.
Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jfs/inode.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
index d41891bb617a6..1262b3602cdaf 100644
--- a/fs/jfs/inode.c
+++ b/fs/jfs/inode.c
@@ -59,9 +59,15 @@ struct inode *jfs_iget(struct super_block *sb, unsigned long ino)
*/
inode->i_link[inode->i_size] = '\0';
}
- } else {
+ } else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) ||
+ S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
inode->i_op = &jfs_file_inode_operations;
init_special_inode(inode, inode->i_mode, inode->i_rdev);
+ } else {
+ printk(KERN_DEBUG "JFS: Invalid file type 0%04o for inode %lu.\n",
+ inode->i_mode, inode->i_ino);
+ iget_failed(inode);
+ return ERR_PTR(-EIO);
}
unlock_new_inode(inode);
return inode;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 240/568] jfs: fix uninitialized waitqueue in transaction manager
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 239/568] jfs: Verify inode mode when loading from disk Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 16:29 ` syzbot
2025-12-03 15:24 ` [PATCH 6.1 241/568] ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() Greg Kroah-Hartman
` (334 subsequent siblings)
574 siblings, 1 reply; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+c4f3462d8b2ad7977bea,
Shaurya Rane, Dave Kleikamp, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
[ Upstream commit 300b072df72694ea330c4c673c035253e07827b8 ]
The transaction manager initialization in txInit() was not properly
initializing TxBlock[0].waitor waitqueue, causing a crash when
txEnd(0) is called on read-only filesystems.
When a filesystem is mounted read-only, txBegin() returns tid=0 to
indicate no transaction. However, txEnd(0) still gets called and
tries to access TxBlock[0].waitor via tid_to_tblock(0), but this
waitqueue was never initialized because the initialization loop
started at index 1 instead of 0.
This causes a 'non-static key' lockdep warning and system crash:
INFO: trying to register non-static key in txEnd
Fix by ensuring all transaction blocks including TxBlock[0] have
their waitqueues properly initialized during txInit().
Reported-by: syzbot+c4f3462d8b2ad7977bea@syzkaller.appspotmail.com
Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jfs/jfs_txnmgr.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index dccc8b3f10459..42fb833ef2834 100644
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -272,14 +272,15 @@ int txInit(void)
if (TxBlock == NULL)
return -ENOMEM;
- for (k = 1; k < nTxBlock - 1; k++) {
- TxBlock[k].next = k + 1;
+ for (k = 0; k < nTxBlock; k++) {
init_waitqueue_head(&TxBlock[k].gcwait);
init_waitqueue_head(&TxBlock[k].waitor);
}
+
+ for (k = 1; k < nTxBlock - 1; k++) {
+ TxBlock[k].next = k + 1;
+ }
TxBlock[k].next = 0;
- init_waitqueue_head(&TxBlock[k].gcwait);
- init_waitqueue_head(&TxBlock[k].waitor);
TxAnchor.freetid = 1;
init_waitqueue_head(&TxAnchor.freewait);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* Re: [PATCH 6.1 240/568] jfs: fix uninitialized waitqueue in transaction manager
2025-12-03 15:24 ` [PATCH 6.1 240/568] jfs: fix uninitialized waitqueue in transaction manager Greg Kroah-Hartman
@ 2025-12-03 16:29 ` syzbot
0 siblings, 0 replies; 588+ messages in thread
From: syzbot @ 2025-12-03 16:29 UTC (permalink / raw)
To: gregkh; +Cc: dave.kleikamp, gregkh, patches, sashal, ssrane_b23, stable
> 6.1-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
>
> [ Upstream commit 300b072df72694ea330c4c673c035253e07827b8 ]
>
> The transaction manager initialization in txInit() was not properly
> initializing TxBlock[0].waitor waitqueue, causing a crash when
> txEnd(0) is called on read-only filesystems.
>
> When a filesystem is mounted read-only, txBegin() returns tid=0 to
> indicate no transaction. However, txEnd(0) still gets called and
> tries to access TxBlock[0].waitor via tid_to_tblock(0), but this
> waitqueue was never initialized because the initialization loop
> started at index 1 instead of 0.
>
> This causes a 'non-static key' lockdep warning and system crash:
> INFO: trying to register non-static key in txEnd
>
> Fix by ensuring all transaction blocks including TxBlock[0] have
> their waitqueues properly initialized during txInit().
>
> Reported-by: syzbot+c4f3462d8b2ad7977bea@syzkaller.appspotmail.com
>
> Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
> Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> fs/jfs/jfs_txnmgr.c | 9 +++++----
> 1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
> index dccc8b3f10459..42fb833ef2834 100644
> --- a/fs/jfs/jfs_txnmgr.c
> +++ b/fs/jfs/jfs_txnmgr.c
> @@ -272,14 +272,15 @@ int txInit(void)
> if (TxBlock == NULL)
> return -ENOMEM;
>
> - for (k = 1; k < nTxBlock - 1; k++) {
> - TxBlock[k].next = k + 1;
> + for (k = 0; k < nTxBlock; k++) {
> init_waitqueue_head(&TxBlock[k].gcwait);
> init_waitqueue_head(&TxBlock[k].waitor);
> }
> +
> + for (k = 1; k < nTxBlock - 1; k++) {
> + TxBlock[k].next = k + 1;
> + }
> TxBlock[k].next = 0;
> - init_waitqueue_head(&TxBlock[k].gcwait);
> - init_waitqueue_head(&TxBlock[k].waitor);
>
> TxAnchor.freetid = 1;
> init_waitqueue_head(&TxAnchor.freewait);
> --
> 2.51.0
>
>
>
I see the command but can't find the corresponding bug.
The email is sent to syzbot+HASH@syzkaller.appspotmail.com address
but the HASH does not correspond to any known bug.
Please double check the address.
^ permalink raw reply [flat|nested] 588+ messages in thread
* [PATCH 6.1 241/568] ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 240/568] jfs: fix uninitialized waitqueue in transaction manager Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 242/568] net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X Greg Kroah-Hartman
` (333 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexey Klimov, Mark Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Klimov <alexey.klimov@linaro.org>
[ Upstream commit 9565c9d53c5b440f0dde6fa731a99c1b14d879d2 ]
Setting format to s16le is required for compressed playback on compatible
soundcards.
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
Link: https://patch.msgid.link/20250911154340.2798304-1-alexey.klimov@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/qcom/sc8280xp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/sound/soc/qcom/sc8280xp.c b/sound/soc/qcom/sc8280xp.c
index 14d9fea33d16a..8ae2fe917c370 100644
--- a/sound/soc/qcom/sc8280xp.c
+++ b/sound/soc/qcom/sc8280xp.c
@@ -7,6 +7,7 @@
#include <sound/soc.h>
#include <sound/soc-dapm.h>
#include <sound/pcm.h>
+#include <sound/pcm_params.h>
#include <linux/soundwire/sdw.h>
#include <sound/jack.h>
#include <linux/input-event-codes.h>
@@ -39,8 +40,10 @@ static int sc8280xp_be_hw_params_fixup(struct snd_soc_pcm_runtime *rtd,
SNDRV_PCM_HW_PARAM_RATE);
struct snd_interval *channels = hw_param_interval(params,
SNDRV_PCM_HW_PARAM_CHANNELS);
+ struct snd_mask *fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT);
rate->min = rate->max = 48000;
+ snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S16_LE);
channels->min = 2;
channels->max = 2;
switch (cpu_dai->id) {
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 242/568] net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 241/568] ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 243/568] iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() Greg Kroah-Hartman
` (332 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robert Marko, Daniel Machon,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Marko <robert.marko@sartura.hr>
[ Upstream commit 6287982aa54946449bccff3e6488d3a15e458392 ]
LAN969x switchdev support depends on the SparX-5 core,so make it selectable
for ARCH_LAN969X.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Reviewed-by: Daniel Machon <daniel.machon@microchip.com>
Link: https://patch.msgid.link/20250917110106.55219-1-robert.marko@sartura.hr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/microchip/sparx5/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/microchip/sparx5/Kconfig b/drivers/net/ethernet/microchip/sparx5/Kconfig
index cc5e48e1bb4c3..a66a80e297f17 100644
--- a/drivers/net/ethernet/microchip/sparx5/Kconfig
+++ b/drivers/net/ethernet/microchip/sparx5/Kconfig
@@ -3,7 +3,7 @@ config SPARX5_SWITCH
depends on NET_SWITCHDEV
depends on HAS_IOMEM
depends on OF
- depends on ARCH_SPARX5 || COMPILE_TEST
+ depends on ARCH_SPARX5 || ARCH_LAN969X || COMPILE_TEST
depends on PTP_1588_CLOCK_OPTIONAL
depends on BRIDGE || BRIDGE=n
select PHYLINK
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 243/568] iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 242/568] net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 244/568] wifi: ath10k: Fix connection after GTK rekeying Greg Kroah-Hartman
` (331 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Seyediman Seyedarab, Lu Baolu,
Joerg Roedel, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seyediman Seyedarab <ImanDevel@gmail.com>
[ Upstream commit 75c02a037609f34db17e91be195cedb33b61bae0 ]
snprintf() returns the number of bytes that would have been written, not
the number actually written. Using this for offset tracking can cause
buffer overruns if truncation occurs.
Replace snprintf() with scnprintf() to ensure the offset stays within
bounds.
Since scnprintf() never returns a negative value, and zero is not possible
in this context because 'bytes' starts at 0 and 'size - bytes' is
DEBUG_BUFFER_SIZE in the first call, which is large enough to hold the
string literals used, the return value is always positive. An integer
overflow is also completely out of reach here due to the small and fixed
buffer size. The error check in latency_show_one() is therefore
unnecessary. Remove it and make dmar_latency_snapshot() return void.
Signed-off-by: Seyediman Seyedarab <ImanDevel@gmail.com>
Link: https://lore.kernel.org/r/20250731225048.131364-1-ImanDevel@gmail.com
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/intel/debugfs.c | 10 ++--------
drivers/iommu/intel/perf.c | 10 ++++------
drivers/iommu/intel/perf.h | 5 ++---
3 files changed, 8 insertions(+), 17 deletions(-)
diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c
index 1f925285104ee..aa9cfcb6039e2 100644
--- a/drivers/iommu/intel/debugfs.c
+++ b/drivers/iommu/intel/debugfs.c
@@ -562,17 +562,11 @@ DEFINE_SHOW_ATTRIBUTE(ir_translation_struct);
static void latency_show_one(struct seq_file *m, struct intel_iommu *iommu,
struct dmar_drhd_unit *drhd)
{
- int ret;
-
seq_printf(m, "IOMMU: %s Register Base Address: %llx\n",
iommu->name, drhd->reg_base_addr);
- ret = dmar_latency_snapshot(iommu, debug_buf, DEBUG_BUFFER_SIZE);
- if (ret < 0)
- seq_puts(m, "Failed to get latency snapshot");
- else
- seq_puts(m, debug_buf);
- seq_puts(m, "\n");
+ dmar_latency_snapshot(iommu, debug_buf, DEBUG_BUFFER_SIZE);
+ seq_printf(m, "%s\n", debug_buf);
}
static int latency_show(struct seq_file *m, void *v)
diff --git a/drivers/iommu/intel/perf.c b/drivers/iommu/intel/perf.c
index 94ee70ac38e30..ae64e1123f257 100644
--- a/drivers/iommu/intel/perf.c
+++ b/drivers/iommu/intel/perf.c
@@ -113,7 +113,7 @@ static char *latency_type_names[] = {
" svm_prq"
};
-int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+void dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
{
struct latency_statistic *lstat = iommu->perf_statistic;
unsigned long flags;
@@ -122,7 +122,7 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
memset(str, 0, size);
for (i = 0; i < COUNTS_NUM; i++)
- bytes += snprintf(str + bytes, size - bytes,
+ bytes += scnprintf(str + bytes, size - bytes,
"%s", latency_counter_names[i]);
spin_lock_irqsave(&latency_lock, flags);
@@ -130,7 +130,7 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
if (!dmar_latency_enabled(iommu, i))
continue;
- bytes += snprintf(str + bytes, size - bytes,
+ bytes += scnprintf(str + bytes, size - bytes,
"\n%s", latency_type_names[i]);
for (j = 0; j < COUNTS_NUM; j++) {
@@ -156,11 +156,9 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
break;
}
- bytes += snprintf(str + bytes, size - bytes,
+ bytes += scnprintf(str + bytes, size - bytes,
"%12lld", val);
}
}
spin_unlock_irqrestore(&latency_lock, flags);
-
- return bytes;
}
diff --git a/drivers/iommu/intel/perf.h b/drivers/iommu/intel/perf.h
index fd6db8049d1a7..1e481e9e4ad04 100644
--- a/drivers/iommu/intel/perf.h
+++ b/drivers/iommu/intel/perf.h
@@ -41,7 +41,7 @@ void dmar_latency_disable(struct intel_iommu *iommu, enum latency_type type);
bool dmar_latency_enabled(struct intel_iommu *iommu, enum latency_type type);
void dmar_latency_update(struct intel_iommu *iommu, enum latency_type type,
u64 latency);
-int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size);
+void dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size);
#else
static inline int
dmar_latency_enable(struct intel_iommu *iommu, enum latency_type type)
@@ -65,9 +65,8 @@ dmar_latency_update(struct intel_iommu *iommu, enum latency_type type, u64 laten
{
}
-static inline int
+static inline void
dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
{
- return 0;
}
#endif /* CONFIG_DMAR_PERF */
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 244/568] wifi: ath10k: Fix connection after GTK rekeying
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 243/568] iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 245/568] net: intel: fm10k: Fix parameter idx set but not used Greg Kroah-Hartman
` (330 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexey Klimov, Loic Poulain,
Baochen Qiang, Vasanthakumar Thiagarajan, Jeff Johnson,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <loic.poulain@oss.qualcomm.com>
[ Upstream commit 487e8a8c3421df0af3707e54c7e069f1d89cbda7 ]
It appears that not all hardware/firmware implementations support
group key deletion correctly, which can lead to connection hangs
and deauthentication following GTK rekeying (delete and install).
To avoid this issue, instead of attempting to delete the key using
the special WMI_CIPHER_NONE value, we now replace the key with an
invalid (random) value.
This behavior has been observed with WCN39xx chipsets.
Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1
Reported-by: Alexey Klimov <alexey.klimov@linaro.org>
Closes: https://lore.kernel.org/all/DAWJQ2NIKY28.1XOG35E4A682G@linaro.org
Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Tested-by: Alexey Klimov <alexey.klimov@linaro.org> # QRB2210 RB1
Link: https://patch.msgid.link/20250902143225.837487-1-loic.poulain@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath10k/mac.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 184c722255c65..0c37b18e2ecfc 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -13,6 +13,7 @@
#include <linux/acpi.h>
#include <linux/of.h>
#include <linux/bitfield.h>
+#include <linux/random.h>
#include "hif.h"
#include "core.h"
@@ -286,8 +287,15 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
if (cmd == DISABLE_KEY) {
- arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE];
- arg.key_data = NULL;
+ if (flags & WMI_KEY_GROUP) {
+ /* Not all hardware handles group-key deletion operation
+ * correctly. Replace the key with a junk value to invalidate it.
+ */
+ get_random_bytes(key->key, key->keylen);
+ } else {
+ arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE];
+ arg.key_data = NULL;
+ }
}
return ath10k_wmi_vdev_install_key(arvif->ar, &arg);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 245/568] net: intel: fm10k: Fix parameter idx set but not used
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 244/568] wifi: ath10k: Fix connection after GTK rekeying Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 246/568] r8169: set EEE speed down ratio to 1 Greg Kroah-Hartman
` (329 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vadim Fedorenko, Brahmajit Das,
Aleksandr Loktionov, Tony Nguyen, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brahmajit Das <listout@listout.xyz>
[ Upstream commit 99e9c5ffbbee0f258a1da4eadf602b943f8c8300 ]
Variable idx is set in the loop, but is never used resulting in dead
code. Building with GCC 16, which enables
-Werror=unused-but-set-parameter= by default results in build error.
This patch removes the idx parameter, since all the callers of the
fm10k_unbind_hw_stats_q as 0 as idx anyways.
Suggested-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Signed-off-by: Brahmajit Das <listout@listout.xyz>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/fm10k/fm10k_common.c | 5 ++---
drivers/net/ethernet/intel/fm10k/fm10k_common.h | 2 +-
drivers/net/ethernet/intel/fm10k/fm10k_pf.c | 2 +-
drivers/net/ethernet/intel/fm10k/fm10k_vf.c | 2 +-
4 files changed, 5 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.c b/drivers/net/ethernet/intel/fm10k/fm10k_common.c
index f51a63fca513e..1f919a50c7653 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_common.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.c
@@ -447,17 +447,16 @@ void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,
/**
* fm10k_unbind_hw_stats_q - Unbind the queue counters from their queues
* @q: pointer to the ring of hardware statistics queue
- * @idx: index pointing to the start of the ring iteration
* @count: number of queues to iterate over
*
* Function invalidates the index values for the queues so any updates that
* may have happened are ignored and the base for the queue stats is reset.
**/
-void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 idx, u32 count)
+void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 count)
{
u32 i;
- for (i = 0; i < count; i++, idx++, q++) {
+ for (i = 0; i < count; i++, q++) {
q->rx_stats_idx = 0;
q->tx_stats_idx = 0;
}
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.h b/drivers/net/ethernet/intel/fm10k/fm10k_common.h
index 4c48fb73b3e78..13fca6a91a01b 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_common.h
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.h
@@ -43,6 +43,6 @@ u32 fm10k_read_hw_stats_32b(struct fm10k_hw *hw, u32 addr,
void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,
u32 idx, u32 count);
#define fm10k_unbind_hw_stats_32b(s) ((s)->base_h = 0)
-void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 idx, u32 count);
+void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 count);
s32 fm10k_get_host_state_generic(struct fm10k_hw *hw, bool *host_ready);
#endif /* _FM10K_COMMON_H_ */
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
index af1b0cde36703..8fb99fa7ae600 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
@@ -1509,7 +1509,7 @@ static void fm10k_rebind_hw_stats_pf(struct fm10k_hw *hw,
fm10k_unbind_hw_stats_32b(&stats->nodesc_drop);
/* Unbind Queue Statistics */
- fm10k_unbind_hw_stats_q(stats->q, 0, hw->mac.max_queues);
+ fm10k_unbind_hw_stats_q(stats->q, hw->mac.max_queues);
/* Reinitialize bases for all stats */
fm10k_update_hw_stats_pf(hw, stats);
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
index dc8ccd378ec92..6a3aebd56e6c4 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
@@ -465,7 +465,7 @@ static void fm10k_rebind_hw_stats_vf(struct fm10k_hw *hw,
struct fm10k_hw_stats *stats)
{
/* Unbind Queue Statistics */
- fm10k_unbind_hw_stats_q(stats->q, 0, hw->mac.max_queues);
+ fm10k_unbind_hw_stats_q(stats->q, hw->mac.max_queues);
/* Reinitialize bases for all stats */
fm10k_update_hw_stats_vf(hw, stats);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 246/568] r8169: set EEE speed down ratio to 1
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 245/568] net: intel: fm10k: Fix parameter idx set but not used Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 247/568] PCI: cadence: Check for the existence of cdns_pcie::ops before using it Greg Kroah-Hartman
` (328 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ChunHao Lin, Heiner Kallweit,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ChunHao Lin <hau@realtek.com>
[ Upstream commit bf7154ffb1c65a201906296a9d3eb22e9daa5ffc ]
EEE speed down means speed down MAC MCU clock. It is not from spec.
It is kind of Realtek specific power saving feature. But enable it
may cause some issues, like packet drop or interrupt loss. Different
hardware may have different issues.
EEE speed down ratio (mac ocp 0xe056[7:4]) is used to set EEE speed
down rate. The larger this value is, the more power can save. But it
actually save less power then we expected. And, as mentioned above,
will impact compatibility. So set it to 1 (mac ocp 0xe056[7:4] = 0)
, which means not to speed down, to improve compatibility.
Signed-off-by: ChunHao Lin <hau@realtek.com>
Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://patch.msgid.link/20250918023425.3463-1-hau@realtek.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/realtek/r8169_main.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index 6879660e44fad..29f4695606ca1 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -3354,7 +3354,7 @@ static void rtl_hw_start_8168h_1(struct rtl8169_private *tp)
r8168_mac_ocp_modify(tp, 0xd412, 0x0fff, sw_cnt_1ms_ini);
}
- r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0070);
+ r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
r8168_mac_ocp_modify(tp, 0xe052, 0x6000, 0x8008);
r8168_mac_ocp_modify(tp, 0xe0d6, 0x01ff, 0x017f);
r8168_mac_ocp_modify(tp, 0xd420, 0x0fff, 0x047f);
@@ -3468,7 +3468,7 @@ static void rtl_hw_start_8117(struct rtl8169_private *tp)
r8168_mac_ocp_modify(tp, 0xd412, 0x0fff, sw_cnt_1ms_ini);
}
- r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0070);
+ r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
r8168_mac_ocp_write(tp, 0xea80, 0x0003);
r8168_mac_ocp_modify(tp, 0xe052, 0x0000, 0x0009);
r8168_mac_ocp_modify(tp, 0xd420, 0x0fff, 0x047f);
@@ -3666,7 +3666,7 @@ static void rtl_hw_start_8125_common(struct rtl8169_private *tp)
r8168_mac_ocp_modify(tp, 0xc0b4, 0x0000, 0x000c);
r8168_mac_ocp_modify(tp, 0xeb6a, 0x00ff, 0x0033);
r8168_mac_ocp_modify(tp, 0xeb50, 0x03e0, 0x0040);
- r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0030);
+ r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
r8168_mac_ocp_modify(tp, 0xe040, 0x1000, 0x0000);
r8168_mac_ocp_modify(tp, 0xea1c, 0x0003, 0x0001);
r8168_mac_ocp_modify(tp, 0xe0c0, 0x4f0f, 0x4403);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 247/568] PCI: cadence: Check for the existence of cdns_pcie::ops before using it
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 246/568] r8169: set EEE speed down ratio to 1 Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 248/568] sparc/module: Add R_SPARC_UA64 relocation handling Greg Kroah-Hartman
` (327 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen Wang, Manivannan Sadhasivam,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Wang <unicorn_wang@outlook.com>
[ Upstream commit 49a6c160ad4812476f8ae1a8f4ed6d15adfa6c09 ]
cdns_pcie::ops might not be populated by all the Cadence glue drivers. This
is going to be true for the upcoming Sophgo platform which doesn't set the
ops.
Hence, add a check to prevent NULL pointer dereference.
Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
[mani: reworded subject and description]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/35182ee1d972dfcd093a964e11205efcebbdc044.1757643388.git.unicorn_wang@outlook.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/cadence/pcie-cadence-host.c | 2 +-
drivers/pci/controller/cadence/pcie-cadence.c | 4 ++--
drivers/pci/controller/cadence/pcie-cadence.h | 6 +++---
3 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
index 0a1b11d41a38a..d2c8d5e0882a5 100644
--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
+++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
@@ -452,7 +452,7 @@ static int cdns_pcie_host_init_address_translation(struct cdns_pcie_rc *rc)
cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_PCI_ADDR1(0), addr1);
cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_DESC1(0), desc1);
- if (pcie->ops->cpu_addr_fixup)
+ if (pcie->ops && pcie->ops->cpu_addr_fixup)
cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(12) |
diff --git a/drivers/pci/controller/cadence/pcie-cadence.c b/drivers/pci/controller/cadence/pcie-cadence.c
index 13c4032ca379a..ddf893fb8e164 100644
--- a/drivers/pci/controller/cadence/pcie-cadence.c
+++ b/drivers/pci/controller/cadence/pcie-cadence.c
@@ -89,7 +89,7 @@ void cdns_pcie_set_outbound_region(struct cdns_pcie *pcie, u8 busnr, u8 fn,
cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_DESC1(r), desc1);
/* Set the CPU address */
- if (pcie->ops->cpu_addr_fixup)
+ if (pcie->ops && pcie->ops->cpu_addr_fixup)
cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(nbits) |
@@ -119,7 +119,7 @@ void cdns_pcie_set_outbound_region_for_normal_msg(struct cdns_pcie *pcie,
}
/* Set the CPU address */
- if (pcie->ops->cpu_addr_fixup)
+ if (pcie->ops && pcie->ops->cpu_addr_fixup)
cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(17) |
diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h
index 2891e8c16a592..ff5ee5c787fbc 100644
--- a/drivers/pci/controller/cadence/pcie-cadence.h
+++ b/drivers/pci/controller/cadence/pcie-cadence.h
@@ -494,7 +494,7 @@ static inline u32 cdns_pcie_ep_fn_readl(struct cdns_pcie *pcie, u8 fn, u32 reg)
static inline int cdns_pcie_start_link(struct cdns_pcie *pcie)
{
- if (pcie->ops->start_link)
+ if (pcie->ops && pcie->ops->start_link)
return pcie->ops->start_link(pcie);
return 0;
@@ -502,13 +502,13 @@ static inline int cdns_pcie_start_link(struct cdns_pcie *pcie)
static inline void cdns_pcie_stop_link(struct cdns_pcie *pcie)
{
- if (pcie->ops->stop_link)
+ if (pcie->ops && pcie->ops->stop_link)
pcie->ops->stop_link(pcie);
}
static inline bool cdns_pcie_link_up(struct cdns_pcie *pcie)
{
- if (pcie->ops->link_up)
+ if (pcie->ops && pcie->ops->link_up)
return pcie->ops->link_up(pcie);
return true;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 248/568] sparc/module: Add R_SPARC_UA64 relocation handling
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 247/568] PCI: cadence: Check for the existence of cdns_pcie::ops before using it Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 249/568] sparc64: fix prototypes of reads[bwl]() Greg Kroah-Hartman
` (326 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Koakuma, Andreas Larsson,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koakuma <koachan@protonmail.com>
[ Upstream commit 05457d96175d25c976ab6241c332ae2eb5e07833 ]
This is needed so that the kernel can handle R_SPARC_UA64 relocations,
which is emitted by LLVM's IAS.
Signed-off-by: Koakuma <koachan@protonmail.com>
Reviewed-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sparc/include/asm/elf_64.h | 1 +
arch/sparc/kernel/module.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/arch/sparc/include/asm/elf_64.h b/arch/sparc/include/asm/elf_64.h
index 8fb09eec8c3e7..694ed081cf8d9 100644
--- a/arch/sparc/include/asm/elf_64.h
+++ b/arch/sparc/include/asm/elf_64.h
@@ -58,6 +58,7 @@
#define R_SPARC_7 43
#define R_SPARC_5 44
#define R_SPARC_6 45
+#define R_SPARC_UA64 54
/* Bits present in AT_HWCAP, primarily for Sparc32. */
#define HWCAP_SPARC_FLUSH 0x00000001
diff --git a/arch/sparc/kernel/module.c b/arch/sparc/kernel/module.c
index 66c45a2764bc8..a7780907fc2f9 100644
--- a/arch/sparc/kernel/module.c
+++ b/arch/sparc/kernel/module.c
@@ -117,6 +117,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs,
break;
#ifdef CONFIG_SPARC64
case R_SPARC_64:
+ case R_SPARC_UA64:
location[0] = v >> 56;
location[1] = v >> 48;
location[2] = v >> 40;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 249/568] sparc64: fix prototypes of reads[bwl]()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 248/568] sparc/module: Add R_SPARC_UA64 relocation handling Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 250/568] vfio: return -ENOTTY for unsupported device feature Greg Kroah-Hartman
` (325 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Al Viro, Andreas Larsson,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
[ Upstream commit 7205ef77dfe167df1b83aea28cf00fc02d662990 ]
Conventions for readsl() are the same as for readl() - any __iomem
pointer is acceptable, both const and volatile ones being OK. Same
for readsb() and readsw().
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Reviewed-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Andreas Larsson <andreas@gaisler.com> # Making sparc64 subject prefix
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sparc/include/asm/io_64.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/sparc/include/asm/io_64.h b/arch/sparc/include/asm/io_64.h
index 9303270b22f3c..f9d370324729e 100644
--- a/arch/sparc/include/asm/io_64.h
+++ b/arch/sparc/include/asm/io_64.h
@@ -250,19 +250,19 @@ void insl(unsigned long, void *, unsigned long);
#define insw insw
#define insl insl
-static inline void readsb(void __iomem *port, void *buf, unsigned long count)
+static inline void readsb(const volatile void __iomem *port, void *buf, unsigned long count)
{
insb((unsigned long __force)port, buf, count);
}
#define readsb readsb
-static inline void readsw(void __iomem *port, void *buf, unsigned long count)
+static inline void readsw(const volatile void __iomem *port, void *buf, unsigned long count)
{
insw((unsigned long __force)port, buf, count);
}
#define readsw readsw
-static inline void readsl(void __iomem *port, void *buf, unsigned long count)
+static inline void readsl(const volatile void __iomem *port, void *buf, unsigned long count)
{
insl((unsigned long __force)port, buf, count);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 250/568] vfio: return -ENOTTY for unsupported device feature
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 249/568] sparc64: fix prototypes of reads[bwl]() Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 251/568] PCI/PM: Skip resuming to D0 if device is disconnected Greg Kroah-Hartman
` (324 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Mastro, Alex Williamson,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Mastro <amastro@fb.com>
[ Upstream commit 16df67f2189a71a8310bcebddb87ed569e8352be ]
The two implementers of vfio_device_ops.device_feature,
vfio_cdx_ioctl_feature and vfio_pci_core_ioctl_feature, return
-ENOTTY in the fallthrough case when the feature is unsupported. For
consistency, the base case, vfio_ioctl_device_feature, should do the
same when device_feature == NULL, indicating an implementation has no
feature extensions.
Signed-off-by: Alex Mastro <amastro@fb.com>
Link: https://lore.kernel.org/r/20250908-vfio-enotty-v1-1-4428e1539e2e@fb.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vfio/vfio_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vfio/vfio_main.c b/drivers/vfio/vfio_main.c
index 6e8804fe00953..e191422e99c4c 100644
--- a/drivers/vfio/vfio_main.c
+++ b/drivers/vfio/vfio_main.c
@@ -1501,7 +1501,7 @@ static int vfio_ioctl_device_feature(struct vfio_device *device,
feature.argsz - minsz);
default:
if (unlikely(!device->ops->device_feature))
- return -EINVAL;
+ return -ENOTTY;
return device->ops->device_feature(device, feature.flags,
arg->data,
feature.argsz - minsz);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 251/568] PCI/PM: Skip resuming to D0 if device is disconnected
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 250/568] vfio: return -ENOTTY for unsupported device feature Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 252/568] remoteproc: qcom: q6v5: Avoid handling handover twice Greg Kroah-Hartman
` (323 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukas Wunner, Mario Limonciello,
Bjorn Helgaas, Ilpo Järvinen, Rafael J. Wysocki, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
[ Upstream commit 299fad4133677b845ce962f78c9cf75bded63f61 ]
When a device is surprise-removed (e.g., due to a dock unplug), the PCI
core unconfigures all downstream devices and sets their error state to
pci_channel_io_perm_failure. This marks them as disconnected via
pci_dev_is_disconnected().
During device removal, the runtime PM framework may attempt to resume the
device to D0 via pm_runtime_get_sync(), which calls into pci_power_up().
Since the device is already disconnected, this resume attempt is
unnecessary and results in a predictable errors like this, typically when
undocking from a TBT3 or USB4 dock with PCIe tunneling:
pci 0000:01:00.0: Unable to change power state from D3cold to D0, device inaccessible
Avoid powering up disconnected devices by checking their status early in
pci_power_up() and returning -EIO.
Suggested-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
[bhelgaas: add typical message]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Acked-by: Rafael J. Wysocki <rafael@kernel.org>
Link: https://patch.msgid.link/20250909031916.4143121-1-superm1@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pci.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index d0e587ab23c6b..b4692c3f98d3b 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1227,6 +1227,11 @@ int pci_power_up(struct pci_dev *dev)
return -EIO;
}
+ if (pci_dev_is_disconnected(dev)) {
+ dev->current_state = PCI_D3cold;
+ return -EIO;
+ }
+
pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr);
if (PCI_POSSIBLE_ERROR(pmcsr)) {
pci_err(dev, "Unable to change power state from %s to D0, device inaccessible\n",
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 252/568] remoteproc: qcom: q6v5: Avoid handling handover twice
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 251/568] PCI/PM: Skip resuming to D0 if device is disconnected Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 253/568] NFSv4: handle ERR_GRACE on delegation recalls Greg Kroah-Hartman
` (322 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Stephan Gerhold,
Bjorn Andersson, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan.gerhold@linaro.org>
[ Upstream commit 54898664e1eb6b5b3e6cdd9343c6eb15da776153 ]
A remoteproc could theoretically signal handover twice. This is unexpected
and would break the reference counting for the handover resources (power
domains, clocks, regulators, etc), so add a check to prevent that from
happening.
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-2-910b1a3aff71@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/qcom_q6v5.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
index 6cce6dd9fd232..76bc553da5d62 100644
--- a/drivers/remoteproc/qcom_q6v5.c
+++ b/drivers/remoteproc/qcom_q6v5.c
@@ -170,6 +170,11 @@ static irqreturn_t q6v5_handover_interrupt(int irq, void *data)
{
struct qcom_q6v5 *q6v5 = data;
+ if (q6v5->handover_issued) {
+ dev_err(q6v5->dev, "Handover signaled, but it already happened\n");
+ return IRQ_HANDLED;
+ }
+
if (q6v5->handover)
q6v5->handover(q6v5);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 253/568] NFSv4: handle ERR_GRACE on delegation recalls
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 252/568] remoteproc: qcom: q6v5: Avoid handling handover twice Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 254/568] NFSv4.1: fix mount hang after CREATE_SESSION failure Greg Kroah-Hartman
` (321 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Olga Kornievskaia, Anna Schumaker,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <okorniev@redhat.com>
[ Upstream commit be390f95242785adbf37d7b8a5101dd2f2ba891b ]
RFC7530 states that clients should be prepared for the return of
NFS4ERR_GRACE errors for non-reclaim lock and I/O requests.
Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs4proc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index cbcff4603232b..935ca3845ce53 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -7663,10 +7663,10 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state,
return err;
do {
err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW);
- if (err != -NFS4ERR_DELAY)
+ if (err != -NFS4ERR_DELAY && err != -NFS4ERR_GRACE)
break;
ssleep(1);
- } while (err == -NFS4ERR_DELAY);
+ } while (err == -NFS4ERR_DELAY || err == -NFSERR_GRACE);
return nfs4_handle_delegation_recall_error(server, state, stateid, fl, err);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 254/568] NFSv4.1: fix mount hang after CREATE_SESSION failure
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 253/568] NFSv4: handle ERR_GRACE on delegation recalls Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 255/568] nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing Greg Kroah-Hartman
` (320 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anthony Iliopoulos, Anna Schumaker,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Iliopoulos <ailiop@suse.com>
[ Upstream commit bf75ad096820fee5da40e671ebb32de725a1c417 ]
When client initialization goes through server trunking discovery, it
schedules the state manager and then sleeps waiting for nfs_client
initialization completion.
The state manager can fail during state recovery, and specifically in
lease establishment as nfs41_init_clientid() will bail out in case of
errors returned from nfs4_proc_create_session(), without ever marking
the client ready. The session creation can fail for a variety of reasons
e.g. during backchannel parameter negotiation, with status -EINVAL.
The error status will propagate all the way to the nfs4_state_manager
but the client status will not be marked, and thus the mount process
will remain blocked waiting.
Fix it by adding -EINVAL error handling to nfs4_state_manager().
Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs4state.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 80a7c5bd7a476..c30c6dbbf9254 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -2742,6 +2742,9 @@ static void nfs4_state_manager(struct nfs_client *clp)
case -ENETUNREACH:
nfs_mark_client_ready(clp, -EIO);
break;
+ case -EINVAL:
+ nfs_mark_client_ready(clp, status);
+ break;
default:
ssleep(1);
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 255/568] nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 254/568] NFSv4.1: fix mount hang after CREATE_SESSION failure Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 256/568] net: bridge: Install FDB for bridge MAC on VLAN 0 Greg Kroah-Hartman
` (319 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Al Viro, Anna Schumaker, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
[ Upstream commit a890a2e339b929dbd843328f9a92a1625404fe63 ]
Theoretically it's an oopsable race, but I don't believe one can manage
to hit it on real hardware; might become doable on a KVM, but it still
won't be easy to attack.
Anyway, it's easy to deal with - since xdr_encode_hyper() is just a call of
put_unaligned_be64(), we can put that under ->d_lock and be done with that.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs4proc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 935ca3845ce53..f387a3862ca09 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -362,7 +362,9 @@ static void nfs4_setup_readdir(u64 cookie, __be32 *verifier, struct dentry *dent
*p++ = htonl(attrs); /* bitmap */
*p++ = htonl(12); /* attribute buffer length */
*p++ = htonl(NF4DIR);
+ spin_lock(&dentry->d_lock);
p = xdr_encode_hyper(p, NFS_FILEID(d_inode(dentry->d_parent)));
+ spin_unlock(&dentry->d_lock);
readdir->pgbase = (char *)p - (char *)start;
readdir->count -= readdir->pgbase;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 256/568] net: bridge: Install FDB for bridge MAC on VLAN 0
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 255/568] nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 257/568] scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() Greg Kroah-Hartman
` (318 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Machata, Ido Schimmel,
Nikolay Aleksandrov, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Machata <petrm@nvidia.com>
[ Upstream commit cd9a9562b2559973aa1b68c3af63021a2c5fd022 ]
Currently, after the bridge is created, the FDB does not hold an FDB entry
for the bridge MAC on VLAN 0:
# ip link add name br up type bridge
# ip -br link show dev br
br UNKNOWN 92:19:8c:4e:01:ed <BROADCAST,MULTICAST,UP,LOWER_UP>
# bridge fdb show | grep 92:19:8c:4e:01:ed
92:19:8c:4e:01:ed dev br vlan 1 master br permanent
Later when the bridge MAC is changed, or in fact when the address is given
during netdevice creation, the entry appears:
# ip link add name br up address 00:11:22:33:44:55 type bridge
# bridge fdb show | grep 00:11:22:33:44:55
00:11:22:33:44:55 dev br vlan 1 master br permanent
00:11:22:33:44:55 dev br master br permanent
However when the bridge address is set by the user to the current bridge
address before the first port is enslaved, none of the address handlers
gets invoked, because the address is not actually changed. The address is
however marked as NET_ADDR_SET. Then when a port is enslaved, the address
is not changed, because it is NET_ADDR_SET. Thus the VLAN 0 entry is not
added, and it has not been added previously either:
# ip link add name br up type bridge
# ip -br link show dev br
br UNKNOWN 7e:f0:a8:1a:be:c2 <BROADCAST,MULTICAST,UP,LOWER_UP>
# ip link set dev br addr 7e:f0:a8:1a:be:c2
# ip link add name v up type veth
# ip link set dev v master br
# ip -br link show dev br
br UNKNOWN 7e:f0:a8:1a:be:c2 <BROADCAST,MULTICAST,UP,LOWER_UP>
# bridge fdb | grep 7e:f0:a8:1a:be:c2
7e:f0:a8:1a:be:c2 dev br vlan 1 master br permanent
Then when the bridge MAC is used as DMAC, and br_handle_frame_finish()
looks up an FDB entry with VLAN=0, it doesn't find any, and floods the
traffic instead of passing it up.
Fix this by simply adding the VLAN 0 FDB entry for the bridge itself always
on netdevice creation. This also makes the behavior consistent with how
ports are treated: ports always have an FDB entry for each member VLAN as
well as VLAN 0.
Signed-off-by: Petr Machata <petrm@nvidia.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/415202b2d1b9b0899479a502bbe2ba188678f192.1758550408.git.petrm@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bridge/br.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/bridge/br.c b/net/bridge/br.c
index 96e91d69a9a88..9341b5f51f0dd 100644
--- a/net/bridge/br.c
+++ b/net/bridge/br.c
@@ -37,6 +37,11 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
int err;
if (netif_is_bridge_master(dev)) {
+ struct net_bridge *br = netdev_priv(dev);
+
+ if (event == NETDEV_REGISTER)
+ br_fdb_change_mac_address(br, dev->dev_addr);
+
err = br_vlan_bridge_event(dev, event, ptr);
if (err)
return notifier_from_errno(err);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 257/568] scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 256/568] net: bridge: Install FDB for bridge MAC on VLAN 0 Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 258/568] scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate Greg Kroah-Hartman
` (317 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alok Tiwari, Martin K. Petersen,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <alok.a.tiwari@oracle.com>
[ Upstream commit 072fdd4b0be9b9051bdf75f36d0227aa705074ba ]
The fc_ct_ms_fill() helper currently formats the OS name and version
into entry->value using "%s v%s". Since init_utsname()->sysname and
->release are unbounded strings, snprintf() may attempt to write more
than FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN bytes, triggering a
-Wformat-truncation warning with W=1.
In file included from drivers/scsi/libfc/fc_elsct.c:18:
drivers/scsi/libfc/fc_encode.h: In function ‘fc_ct_ms_fill.constprop’:
drivers/scsi/libfc/fc_encode.h:359:30: error: ‘%s’ directive output may
be truncated writing up to 64 bytes into a region of size between 62
and 126 [-Werror=format-truncation=]
359 | "%s v%s",
| ^~
360 | init_utsname()->sysname,
361 | init_utsname()->release);
| ~~~~~~~~~~~~~~~~~~~~~~~
drivers/scsi/libfc/fc_encode.h:357:17: note: ‘snprintf’ output between
3 and 131 bytes into a destination of size 128
357 | snprintf((char *)&entry->value,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
358 | FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
359 | "%s v%s",
| ~~~~~~~~~
360 | init_utsname()->sysname,
| ~~~~~~~~~~~~~~~~~~~~~~~~
361 | init_utsname()->release);
| ~~~~~~~~~~~~~~~~~~~~~~~~
Fix this by using "%.62s v%.62s", which ensures sysname and release are
truncated to fit within the 128-byte field defined by
FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN.
[mkp: clarified commit description]
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/libfc/fc_encode.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/libfc/fc_encode.h b/drivers/scsi/libfc/fc_encode.h
index 7dcac3b6baa7e..992250ca8b9fd 100644
--- a/drivers/scsi/libfc/fc_encode.h
+++ b/drivers/scsi/libfc/fc_encode.h
@@ -354,7 +354,7 @@ static inline int fc_ct_ms_fill(struct fc_lport *lport,
put_unaligned_be16(len, &entry->len);
snprintf((char *)&entry->value,
FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN,
- "%s v%s",
+ "%.62s v%.62s",
init_utsname()->sysname,
init_utsname()->release);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 258/568] scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 257/568] scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 259/568] fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock Greg Kroah-Hartman
` (316 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ranjan Kumar, Martin K. Petersen,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranjan Kumar <ranjan.kumar@broadcom.com>
[ Upstream commit 4be7599d6b27bade41bfccca42901b917c01c30c ]
Add handling for MPI26_SAS_NEG_LINK_RATE_22_5 in
_transport_convert_phy_link_rate(). This maps the new 22.5 Gbps
negotiated rate to SAS_LINK_RATE_22_5_GBPS, to get correct PHY link
speeds.
Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
Message-Id: <20250922095113.281484-4-ranjan.kumar@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/mpt3sas/mpt3sas_transport.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
index 7d6e4fe31ceed..02c970575464c 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
@@ -166,6 +166,9 @@ _transport_convert_phy_link_rate(u8 link_rate)
case MPI25_SAS_NEG_LINK_RATE_12_0:
rc = SAS_LINK_RATE_12_0_GBPS;
break;
+ case MPI26_SAS_NEG_LINK_RATE_22_5:
+ rc = SAS_LINK_RATE_22_5_GBPS;
+ break;
case MPI2_SAS_NEG_LINK_RATE_PHY_DISABLED:
rc = SAS_PHY_DISABLED;
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 259/568] fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 258/568] scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 260/568] ext4: increase IO priority of fastcommit Greg Kroah-Hartman
` (315 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, chuguangqing, Theodore Tso,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: chuguangqing <chuguangqing@inspur.com>
[ Upstream commit 1534f72dc2a11ded38b0e0268fbcc0ca24e9fd4a ]
The parent function ext4_xattr_inode_lookup_create already uses GFP_NOFS for memory alloction, so the function ext4_xattr_inode_cache_find should use same gfp_flag.
Signed-off-by: chuguangqing <chuguangqing@inspur.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/xattr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index e6de83037d62f..226c48aa75b57 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -1499,7 +1499,7 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value,
WARN_ON_ONCE(ext4_handle_valid(journal_current_handle()) &&
!(current->flags & PF_MEMALLOC_NOFS));
- ea_data = kvmalloc(value_len, GFP_KERNEL);
+ ea_data = kvmalloc(value_len, GFP_NOFS);
if (!ea_data) {
mb_cache_entry_put(ea_inode_cache, ce);
return NULL;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 260/568] ext4: increase IO priority of fastcommit
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 259/568] fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 261/568] net/mlx5e: Dont query FEC statistics when FEC is disabled Greg Kroah-Hartman
` (314 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ritesh Harjani (IBM), Julian Sun,
Zhang Yi, Jan Kara, Theodore Tso, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Sun <sunjunchao@bytedance.com>
[ Upstream commit 46e75c56dfeafb6756773b71cabe187a6886859a ]
The following code paths may result in high latency or even task hangs:
1. fastcommit io is throttled by wbt.
2. jbd2_fc_wait_bufs() might wait for a long time while
JBD2_FAST_COMMIT_ONGOING is set in journal->flags, and then
jbd2_journal_commit_transaction() waits for the
JBD2_FAST_COMMIT_ONGOING bit for a long time while holding the write
lock of j_state_lock.
3. start_this_handle() waits for read lock of j_state_lock which
results in high latency or task hang.
Given the fact that ext4_fc_commit() already modifies the current
process' IO priority to match that of the jbd2 thread, it should be
reasonable to match jbd2's IO submission flags as well.
Suggested-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Julian Sun <sunjunchao@bytedance.com>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Message-ID: <20250827121812.1477634-1-sunjunchao@bytedance.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/fast_commit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ext4/fast_commit.c b/fs/ext4/fast_commit.c
index e2062cd4adadf..94f90032ca561 100644
--- a/fs/ext4/fast_commit.c
+++ b/fs/ext4/fast_commit.c
@@ -675,7 +675,7 @@ void ext4_fc_track_range(handle_t *handle, struct inode *inode, ext4_lblk_t star
static void ext4_fc_submit_bh(struct super_block *sb, bool is_tail)
{
- blk_opf_t write_flags = REQ_SYNC;
+ blk_opf_t write_flags = JBD2_JOURNAL_REQ_FLAGS;
struct buffer_head *bh = EXT4_SB(sb)->s_fc_bh;
/* Add REQ_FUA | REQ_PREFLUSH only its tail */
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 261/568] net/mlx5e: Dont query FEC statistics when FEC is disabled
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 260/568] ext4: increase IO priority of fastcommit Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 262/568] net: macb: avoid dealing with endianness in macb_set_hwaddr() Greg Kroah-Hartman
` (313 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Carolina Jubran, Dragos Tatulea,
Yael Chemla, Vadim Fedorenko, Aleksandr Loktionov, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carolina Jubran <cjubran@nvidia.com>
[ Upstream commit 6b81b8a0b1978284e007566d7a1607b47f92209f ]
Update mlx5e_stats_fec_get() to check the active FEC mode and skip
statistics collection when FEC is disabled.
Signed-off-by: Carolina Jubran <cjubran@nvidia.com>
Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Reviewed-by: Yael Chemla <ychemla@nvidia.com>
Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Link: https://patch.msgid.link/20250924124037.1508846-3-vadim.fedorenko@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
index f7f54550a8bbc..5db4fd40fe8b8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
@@ -1301,16 +1301,13 @@ static void fec_set_rs_stats(struct ethtool_fec_stats *fec_stats, u32 *ppcnt)
}
static void fec_set_block_stats(struct mlx5e_priv *priv,
+ int mode,
struct ethtool_fec_stats *fec_stats)
{
struct mlx5_core_dev *mdev = priv->mdev;
u32 out[MLX5_ST_SZ_DW(ppcnt_reg)] = {};
u32 in[MLX5_ST_SZ_DW(ppcnt_reg)] = {};
int sz = MLX5_ST_SZ_BYTES(ppcnt_reg);
- int mode = fec_active_mode(mdev);
-
- if (mode == MLX5E_FEC_NOFEC)
- return;
MLX5_SET(ppcnt_reg, in, local_port, 1);
MLX5_SET(ppcnt_reg, in, grp, MLX5_PHYSICAL_LAYER_COUNTERS_GROUP);
@@ -1351,11 +1348,14 @@ static void fec_set_corrected_bits_total(struct mlx5e_priv *priv,
void mlx5e_stats_fec_get(struct mlx5e_priv *priv,
struct ethtool_fec_stats *fec_stats)
{
- if (!MLX5_CAP_PCAM_FEATURE(priv->mdev, ppcnt_statistical_group))
+ int mode = fec_active_mode(priv->mdev);
+
+ if (mode == MLX5E_FEC_NOFEC ||
+ !MLX5_CAP_PCAM_FEATURE(priv->mdev, ppcnt_statistical_group))
return;
fec_set_corrected_bits_total(priv, fec_stats);
- fec_set_block_stats(priv, fec_stats);
+ fec_set_block_stats(priv, mode, fec_stats);
}
#define PPORT_ETH_EXT_OFF(c) \
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 262/568] net: macb: avoid dealing with endianness in macb_set_hwaddr()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 261/568] net/mlx5e: Dont query FEC statistics when FEC is disabled Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 263/568] Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames Greg Kroah-Hartman
` (312 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Anderson, Théo Lebrun,
Simon Horman, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Théo Lebrun <theo.lebrun@bootlin.com>
[ Upstream commit 70a5ce8bc94545ba0fb47b2498bfb12de2132f4d ]
bp->dev->dev_addr is of type `unsigned char *`. Casting it to a u32
pointer and dereferencing implies dealing manually with endianness,
which is error-prone.
Replace by calls to get_unaligned_le32|le16() helpers.
This was found using sparse:
⟩ make C=2 drivers/net/ethernet/cadence/macb_main.o
warning: incorrect type in assignment (different base types)
expected unsigned int [usertype] bottom
got restricted __le32 [usertype]
warning: incorrect type in assignment (different base types)
expected unsigned short [usertype] top
got restricted __le16 [usertype]
...
Reviewed-by: Sean Anderson <sean.anderson@linux.dev>
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250923-macb-fixes-v6-5-772d655cdeb6@bootlin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cadence/macb_main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index 1ea7c86f75013..a143f8214c088 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -283,9 +283,9 @@ static void macb_set_hwaddr(struct macb *bp)
u32 bottom;
u16 top;
- bottom = cpu_to_le32(*((u32 *)bp->dev->dev_addr));
+ bottom = get_unaligned_le32(bp->dev->dev_addr);
macb_or_gem_writel(bp, SA1B, bottom);
- top = cpu_to_le16(*((u16 *)(bp->dev->dev_addr + 4)));
+ top = get_unaligned_le16(bp->dev->dev_addr + 4);
macb_or_gem_writel(bp, SA1T, top);
if (gem_has_ptp(bp)) {
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 263/568] Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 262/568] net: macb: avoid dealing with endianness in macb_set_hwaddr() Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 264/568] Bluetooth: SCO: Fix UAF on sco_conn_free Greg Kroah-Hartman
` (311 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arkadiusz Bokowy,
Luiz Augusto von Dentz, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
[ Upstream commit 7722d6fb54e428a8f657fccf422095a8d7e2d72c ]
Some Barrot based USB Bluetooth dongles erroneously send one extra
random byte for the HCI_OP_READ_LOCAL_EXT_FEATURES command. The
consequence of that is that the next HCI transfer is misaligned by one
byte causing undefined behavior. In most cases the response event for
the next command fails with random error code.
Since the HCI_OP_READ_LOCAL_EXT_FEATURES command is used during HCI
controller initialization, the initialization fails rendering the USB
dongle not usable.
> [59.464099] usb 1-1.3: new full-speed USB device number 11 using xhci_hcd
> [59.561617] usb 1-1.3: New USB device found, idVendor=33fa, idProduct=0012, bcdDevice=88.91
> [59.561642] usb 1-1.3: New USB device strings: Mfr=0, Product=2, SerialNumber=0
> [59.561656] usb 1-1.3: Product: UGREEN BT6.0 Adapter
> [61.720116] Bluetooth: hci1: command 0x1005 tx timeout
> [61.720167] Bluetooth: hci1: Opcode 0x1005 failed: -110
This patch was tested with the 33fa:0012 device. The info from the
/sys/kernel/debug/usb/devices is shown below:
T: Bus=01 Lev=02 Prnt=02 Port=02 Cnt=01 Dev#= 12 Spd=12 MxCh= 0
D: Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=33fa ProdID=0012 Rev=88.91
S: Product=UGREEN BT6.0 Adapter
C:* #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
Now the device is initialized properly:
> [43.329852] usb 1-1.4: new full-speed USB device number 4 using dwc_otg
> [43.446790] usb 1-1.4: New USB device found, idVendor=33fa, idProduct=0012, bcdDevice=88.91
> [43.446813] usb 1-1.4: New USB device strings: Mfr=0, Product=2, SerialNumber=0
> [43.446821] usb 1-1.4: Product: UGREEN BT6.0 Adapter
> [43.582024] Bluetooth: hci1: Unexpected continuation: 1 bytes
> [43.703025] Bluetooth: hci1: Unexpected continuation: 1 bytes
> [43.750141] Bluetooth: MGMT ver 1.23
Link: https://github.com/bluez/bluez/issues/1326
Signed-off-by: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
Tested-by: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 8bb1162031a6a..29130160066a5 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -64,6 +64,7 @@ static struct usb_driver btusb_driver;
#define BTUSB_INTEL_BROKEN_INITIAL_NCMD BIT(25)
#define BTUSB_INTEL_NO_WBS_SUPPORT BIT(26)
#define BTUSB_ACTIONS_SEMI BIT(27)
+#define BTUSB_BARROT BIT(28)
static const struct usb_device_id btusb_table[] = {
/* Generic Bluetooth USB device */
@@ -699,6 +700,10 @@ static const struct usb_device_id blacklist_table[] = {
{ USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK |
BTUSB_WIDEBAND_SPEECH },
+ /* Barrot Technology Bluetooth devices */
+ { USB_DEVICE(0x33fa, 0x0010), .driver_info = BTUSB_BARROT },
+ { USB_DEVICE(0x33fa, 0x0012), .driver_info = BTUSB_BARROT },
+
/* Actions Semiconductor ATS2851 based devices */
{ USB_DEVICE(0x10d7, 0xb012), .driver_info = BTUSB_ACTIONS_SEMI },
@@ -991,6 +996,18 @@ static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
}
if (!hci_skb_expect(skb)) {
+ /* Each chunk should correspond to at least 1 or more
+ * events so if there are still bytes left that doesn't
+ * constitute a new event this is likely a bug in the
+ * controller.
+ */
+ if (count && count < HCI_EVENT_HDR_SIZE) {
+ bt_dev_warn(data->hdev,
+ "Unexpected continuation: %d bytes",
+ count);
+ count = 0;
+ }
+
/* Complete frame */
btusb_recv_event(data, skb);
skb = NULL;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 264/568] Bluetooth: SCO: Fix UAF on sco_conn_free
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 263/568] Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 265/568] Bluetooth: bcsp: receive data only if registered Greg Kroah-Hartman
` (310 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, cen zhang, Luiz Augusto von Dentz,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit ecb9a843be4d6fd710d7026e359f21015a062572 ]
BUG: KASAN: slab-use-after-free in sco_conn_free net/bluetooth/sco.c:87 [inline]
BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:65 [inline]
BUG: KASAN: slab-use-after-free in sco_conn_put+0xdd/0x410
net/bluetooth/sco.c:107
Write of size 8 at addr ffff88811cb96b50 by task kworker/u17:4/352
CPU: 1 UID: 0 PID: 352 Comm: kworker/u17:4 Not tainted
6.17.0-rc5-g717368f83676 #4 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: hci13 hci_cmd_sync_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x10b/0x170 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x191/0x550 mm/kasan/report.c:482
kasan_report+0xc4/0x100 mm/kasan/report.c:595
sco_conn_free net/bluetooth/sco.c:87 [inline]
kref_put include/linux/kref.h:65 [inline]
sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107
sco_connect_cfm+0xb4/0xae0 net/bluetooth/sco.c:1441
hci_connect_cfm include/net/bluetooth/hci_core.h:2082 [inline]
hci_conn_failed+0x20a/0x2e0 net/bluetooth/hci_conn.c:1313
hci_conn_unlink+0x55f/0x810 net/bluetooth/hci_conn.c:1121
hci_conn_del+0xb6/0x1110 net/bluetooth/hci_conn.c:1147
hci_abort_conn_sync+0x8c5/0xbb0 net/bluetooth/hci_sync.c:5689
hci_cmd_sync_work+0x281/0x380 net/bluetooth/hci_sync.c:332
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0x77e/0x1040 kernel/workqueue.c:3319
worker_thread+0xbee/0x1200 kernel/workqueue.c:3400
kthread+0x3c7/0x870 kernel/kthread.c:463
ret_from_fork+0x13a/0x1e0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 31370:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x30/0x70 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
__kasan_kmalloc+0x82/0x90 mm/kasan/common.c:405
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4382 [inline]
__kmalloc_noprof+0x22f/0x390 mm/slub.c:4394
kmalloc_noprof include/linux/slab.h:909 [inline]
sk_prot_alloc+0xae/0x220 net/core/sock.c:2239
sk_alloc+0x34/0x5a0 net/core/sock.c:2295
bt_sock_alloc+0x3c/0x330 net/bluetooth/af_bluetooth.c:151
sco_sock_alloc net/bluetooth/sco.c:562 [inline]
sco_sock_create+0xc0/0x350 net/bluetooth/sco.c:593
bt_sock_create+0x161/0x3b0 net/bluetooth/af_bluetooth.c:135
__sock_create+0x3ad/0x780 net/socket.c:1589
sock_create net/socket.c:1647 [inline]
__sys_socket_create net/socket.c:1684 [inline]
__sys_socket+0xd5/0x330 net/socket.c:1731
__do_sys_socket net/socket.c:1745 [inline]
__se_sys_socket net/socket.c:1743 [inline]
__x64_sys_socket+0x7a/0x90 net/socket.c:1743
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc7/0x240 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 31374:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x30/0x70 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:243 [inline]
__kasan_slab_free+0x3d/0x50 mm/kasan/common.c:275
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2428 [inline]
slab_free mm/slub.c:4701 [inline]
kfree+0x199/0x3b0 mm/slub.c:4900
sk_prot_free net/core/sock.c:2278 [inline]
__sk_destruct+0x4aa/0x630 net/core/sock.c:2373
sco_sock_release+0x2ad/0x300 net/bluetooth/sco.c:1333
__sock_release net/socket.c:649 [inline]
sock_close+0xb8/0x230 net/socket.c:1439
__fput+0x3d1/0x9e0 fs/file_table.c:468
task_work_run+0x206/0x2a0 kernel/task_work.c:227
get_signal+0x1201/0x1410 kernel/signal.c:2807
arch_do_signal_or_restart+0x34/0x740 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop+0x68/0xc0 kernel/entry/common.c:40
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x1dd/0x240 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Reported-by: cen zhang <zzzccc427@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/sco.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index fe8728041ad08..cf53d483dd071 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -434,6 +434,13 @@ static void sco_sock_kill(struct sock *sk)
BT_DBG("sk %p state %d", sk, sk->sk_state);
+ /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
+ if (sco_pi(sk)->conn) {
+ sco_conn_lock(sco_pi(sk)->conn);
+ sco_pi(sk)->conn->sk = NULL;
+ sco_conn_unlock(sco_pi(sk)->conn);
+ }
+
/* Kill poor orphan */
bt_sock_unlink(&sco_sk_list, sk);
sock_set_flag(sk, SOCK_DEAD);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 265/568] Bluetooth: bcsp: receive data only if registered
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 264/568] Bluetooth: SCO: Fix UAF on sco_conn_free Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 266/568] ALSA: usb-audio: add mono main switch to Presonus S1824c Greg Kroah-Hartman
` (309 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+4ed6852d4da4606c93da,
Ivan Pravdin, Luiz Augusto von Dentz, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Pravdin <ipravdin.official@gmail.com>
[ Upstream commit ca94b2b036c22556c3a66f1b80f490882deef7a6 ]
Currently, bcsp_recv() can be called even when the BCSP protocol has not
been registered. This leads to a NULL pointer dereference, as shown in
the following stack trace:
KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
RIP: 0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590
Call Trace:
<TASK>
hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627
tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290
tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
To prevent this, ensure that the HCI_UART_REGISTERED flag is set before
processing received data. If the protocol is not registered, return
-EUNATCH.
Reported-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4ed6852d4da4606c93da
Tested-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com
Signed-off-by: Ivan Pravdin <ipravdin.official@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/hci_bcsp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
index 8055f63603f45..8ff69111ceede 100644
--- a/drivers/bluetooth/hci_bcsp.c
+++ b/drivers/bluetooth/hci_bcsp.c
@@ -582,6 +582,9 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count)
struct bcsp_struct *bcsp = hu->priv;
const unsigned char *ptr;
+ if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
+ return -EUNATCH;
+
BT_DBG("hu %p count %d rx_state %d rx_count %ld",
hu, count, bcsp->rx_state, bcsp->rx_count);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 266/568] ALSA: usb-audio: add mono main switch to Presonus S1824c
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 265/568] Bluetooth: bcsp: receive data only if registered Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 267/568] exfat: limit log print for IO error Greg Kroah-Hartman
` (308 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Roy Vegard Ovesen, Takashi Iwai,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
[ Upstream commit 659169c4eb21f8d9646044a4f4e1bc314f6f9d0c ]
The 1824c does not have the A/B switch that the 1810c has,
but instead it has a mono main switch that sums the two
main output channels to mono.
Signed-off-by: Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_s1810c.c | 26 +++++++++++++++++++++++---
1 file changed, 23 insertions(+), 3 deletions(-)
diff --git a/sound/usb/mixer_s1810c.c b/sound/usb/mixer_s1810c.c
index 65bdda0841048..2413a6d96971c 100644
--- a/sound/usb/mixer_s1810c.c
+++ b/sound/usb/mixer_s1810c.c
@@ -93,6 +93,7 @@ struct s1810c_ctl_packet {
#define SC1810C_CTL_LINE_SW 0
#define SC1810C_CTL_MUTE_SW 1
+#define SC1824C_CTL_MONO_SW 2
#define SC1810C_CTL_AB_SW 3
#define SC1810C_CTL_48V_SW 4
@@ -123,6 +124,7 @@ struct s1810c_state_packet {
#define SC1810C_STATE_48V_SW 58
#define SC1810C_STATE_LINE_SW 59
#define SC1810C_STATE_MUTE_SW 60
+#define SC1824C_STATE_MONO_SW 61
#define SC1810C_STATE_AB_SW 62
struct s1810_mixer_state {
@@ -502,6 +504,15 @@ static const struct snd_kcontrol_new snd_s1810c_mute_sw = {
.private_value = (SC1810C_STATE_MUTE_SW | SC1810C_CTL_MUTE_SW << 8)
};
+static const struct snd_kcontrol_new snd_s1824c_mono_sw = {
+ .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+ .name = "Mono Main Out Switch",
+ .info = snd_ctl_boolean_mono_info,
+ .get = snd_s1810c_switch_get,
+ .put = snd_s1810c_switch_set,
+ .private_value = (SC1824C_STATE_MONO_SW | SC1824C_CTL_MONO_SW << 8)
+};
+
static const struct snd_kcontrol_new snd_s1810c_48v_sw = {
.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
.name = "48V Phantom Power On Mic Inputs Switch",
@@ -588,8 +599,17 @@ int snd_sc1810_init_mixer(struct usb_mixer_interface *mixer)
if (ret < 0)
return ret;
- ret = snd_s1810c_switch_init(mixer, &snd_s1810c_ab_sw);
- if (ret < 0)
- return ret;
+ // The 1824c has a Mono Main switch instead of a
+ // A/B select switch.
+ if (mixer->chip->usb_id == USB_ID(0x194f, 0x010d)) {
+ ret = snd_s1810c_switch_init(mixer, &snd_s1824c_mono_sw);
+ if (ret < 0)
+ return ret;
+ } else if (mixer->chip->usb_id == USB_ID(0x194f, 0x010c)) {
+ ret = snd_s1810c_switch_init(mixer, &snd_s1810c_ab_sw);
+ if (ret < 0)
+ return ret;
+ }
+
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 267/568] exfat: limit log print for IO error
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 266/568] ALSA: usb-audio: add mono main switch to Presonus S1824c Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 268/568] 6pack: drop redundant locking and refcounting Greg Kroah-Hartman
` (307 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chi Zhiling, Namjae Jeon,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chi Zhiling <chizhiling@kylinos.cn>
[ Upstream commit 6dfba108387bf4e71411b3da90b2d5cce48ba054 ]
For exFAT filesystems with 4MB read_ahead_size, removing the storage device
when the read operation is in progress, which cause the last read syscall
spent 150s [1]. The main reason is that exFAT generates excessive log
messages [2].
After applying this patch, approximately 300,000 lines of log messages
were suppressed, and the delay of the last read() syscall was reduced
to about 4 seconds.
[1]:
write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000120>
read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000032>
write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000119>
read(4, 0x7fccf28ae000, 131072) = -1 EIO (Input/output error) <150.186215>
[2]:
[ 333.696603] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
[ 333.697378] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
[ 333.698156] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
Signed-off-by: Chi Zhiling <chizhiling@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/exfat/fatent.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/fs/exfat/fatent.c b/fs/exfat/fatent.c
index 9fa4cffabfb67..e7e160d022566 100644
--- a/fs/exfat/fatent.c
+++ b/fs/exfat/fatent.c
@@ -89,35 +89,36 @@ int exfat_ent_get(struct super_block *sb, unsigned int loc,
int err;
if (!is_valid_cluster(sbi, loc)) {
- exfat_fs_error(sb, "invalid access to FAT (entry 0x%08x)",
+ exfat_fs_error_ratelimit(sb,
+ "invalid access to FAT (entry 0x%08x)",
loc);
return -EIO;
}
err = __exfat_ent_get(sb, loc, content);
if (err) {
- exfat_fs_error(sb,
+ exfat_fs_error_ratelimit(sb,
"failed to access to FAT (entry 0x%08x, err:%d)",
loc, err);
return err;
}
if (*content == EXFAT_FREE_CLUSTER) {
- exfat_fs_error(sb,
+ exfat_fs_error_ratelimit(sb,
"invalid access to FAT free cluster (entry 0x%08x)",
loc);
return -EIO;
}
if (*content == EXFAT_BAD_CLUSTER) {
- exfat_fs_error(sb,
+ exfat_fs_error_ratelimit(sb,
"invalid access to FAT bad cluster (entry 0x%08x)",
loc);
return -EIO;
}
if (*content != EXFAT_EOF_CLUSTER && !is_valid_cluster(sbi, *content)) {
- exfat_fs_error(sb,
+ exfat_fs_error_ratelimit(sb,
"invalid access to FAT (entry 0x%08x) bogus content (0x%08x)",
loc, *content);
return -EIO;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 268/568] 6pack: drop redundant locking and refcounting
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 267/568] exfat: limit log print for IO error Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 269/568] page_pool: Clamp pool size to max 16K pages Greg Kroah-Hartman
` (306 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+5fd749c74105b0e1b302,
Qingfang Deng, Dan Carpenter, Paolo Abeni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingfang Deng <dqfext@gmail.com>
[ Upstream commit 38b04ed7072e54086102eae2d05d03ffcdb4b695 ]
The TTY layer already serializes line discipline operations with
tty->ldisc_sem, so the extra disc_data_lock and refcnt in 6pack
are unnecessary.
Removing them simplifies the code and also resolves a lockdep warning
reported by syzbot. The warning did not indicate a real deadlock, since
the write-side lock was only taken in process context with hardirqs
disabled.
Reported-by: syzbot+5fd749c74105b0e1b302@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68c858b0.050a0220.3c6139.0d1c.GAE@google.com/
Signed-off-by: Qingfang Deng <dqfext@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/20250925051059.26876-1-dqfext@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/hamradio/6pack.c | 57 ++++--------------------------------
1 file changed, 5 insertions(+), 52 deletions(-)
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 9fb5675242207..1b007dd174794 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -121,8 +121,6 @@ struct sixpack {
struct timer_list tx_t;
struct timer_list resync_t;
- refcount_t refcnt;
- struct completion dead;
spinlock_t lock;
};
@@ -359,42 +357,13 @@ static void sp_bump(struct sixpack *sp, char cmd)
/* ----------------------------------------------------------------------- */
-/*
- * We have a potential race on dereferencing tty->disc_data, because the tty
- * layer provides no locking at all - thus one cpu could be running
- * sixpack_receive_buf while another calls sixpack_close, which zeroes
- * tty->disc_data and frees the memory that sixpack_receive_buf is using. The
- * best way to fix this is to use a rwlock in the tty struct, but for now we
- * use a single global rwlock for all ttys in ppp line discipline.
- */
-static DEFINE_RWLOCK(disc_data_lock);
-
-static struct sixpack *sp_get(struct tty_struct *tty)
-{
- struct sixpack *sp;
-
- read_lock(&disc_data_lock);
- sp = tty->disc_data;
- if (sp)
- refcount_inc(&sp->refcnt);
- read_unlock(&disc_data_lock);
-
- return sp;
-}
-
-static void sp_put(struct sixpack *sp)
-{
- if (refcount_dec_and_test(&sp->refcnt))
- complete(&sp->dead);
-}
-
/*
* Called by the TTY driver when there's room for more data. If we have
* more packets to send, we send them here.
*/
static void sixpack_write_wakeup(struct tty_struct *tty)
{
- struct sixpack *sp = sp_get(tty);
+ struct sixpack *sp = tty->disc_data;
int actual;
if (!sp)
@@ -406,7 +375,7 @@ static void sixpack_write_wakeup(struct tty_struct *tty)
clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
sp->tx_enable = 0;
netif_wake_queue(sp->dev);
- goto out;
+ return;
}
if (sp->tx_enable) {
@@ -414,9 +383,6 @@ static void sixpack_write_wakeup(struct tty_struct *tty)
sp->xleft -= actual;
sp->xhead += actual;
}
-
-out:
- sp_put(sp);
}
/* ----------------------------------------------------------------------- */
@@ -436,7 +402,7 @@ static void sixpack_receive_buf(struct tty_struct *tty,
if (!count)
return;
- sp = sp_get(tty);
+ sp = tty->disc_data;
if (!sp)
return;
@@ -452,7 +418,6 @@ static void sixpack_receive_buf(struct tty_struct *tty,
}
sixpack_decode(sp, cp, count1);
- sp_put(sp);
tty_unthrottle(tty);
}
@@ -567,8 +532,6 @@ static int sixpack_open(struct tty_struct *tty)
spin_lock_init(&sp->lock);
spin_lock_init(&sp->rxlock);
- refcount_set(&sp->refcnt, 1);
- init_completion(&sp->dead);
/* !!! length of the buffers. MTU is IP MTU, not PACLEN! */
@@ -650,19 +613,11 @@ static void sixpack_close(struct tty_struct *tty)
{
struct sixpack *sp;
- write_lock_irq(&disc_data_lock);
sp = tty->disc_data;
- tty->disc_data = NULL;
- write_unlock_irq(&disc_data_lock);
if (!sp)
return;
- /*
- * We have now ensured that nobody can start using ap from now on, but
- * we have to wait for all existing users to finish.
- */
- if (!refcount_dec_and_test(&sp->refcnt))
- wait_for_completion(&sp->dead);
+ tty->disc_data = NULL;
/* We must stop the queue to avoid potentially scribbling
* on the free buffers. The sp->dead completion is not sufficient
@@ -686,7 +641,7 @@ static void sixpack_close(struct tty_struct *tty)
static int sixpack_ioctl(struct tty_struct *tty, unsigned int cmd,
unsigned long arg)
{
- struct sixpack *sp = sp_get(tty);
+ struct sixpack *sp = tty->disc_data;
struct net_device *dev;
unsigned int tmp, err;
@@ -738,8 +693,6 @@ static int sixpack_ioctl(struct tty_struct *tty, unsigned int cmd,
err = tty_mode_ioctl(tty, cmd, arg);
}
- sp_put(sp);
-
return err;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 269/568] page_pool: Clamp pool size to max 16K pages
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 268/568] 6pack: drop redundant locking and refcounting Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 270/568] orangefs: fix xattr related buffer overflow Greg Kroah-Hartman
` (305 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dragos Tatulea, Tariq Toukan,
Paolo Abeni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragos Tatulea <dtatulea@nvidia.com>
[ Upstream commit a1b501a8c6a87c9265fd03bd004035199e2e8128 ]
page_pool_init() returns E2BIG when the page_pool size goes above 32K
pages. As some drivers are configuring the page_pool size according to
the MTU and ring size, there are cases where this limit is exceeded and
the queue creation fails.
The page_pool size doesn't have to cover a full queue, especially for
larger ring size. So clamp the size instead of returning an error. Do
this in the core to avoid having each driver do the clamping.
The current limit was deemed to high [1] so it was reduced to 16K to avoid
page waste.
[1] https://lore.kernel.org/all/1758532715-820422-3-git-send-email-tariqt@nvidia.com/
Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20250926131605.2276734-2-dtatulea@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/page_pool.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/net/core/page_pool.c b/net/core/page_pool.c
index 8ce34d1c2e076..5c66092f95801 100644
--- a/net/core/page_pool.c
+++ b/net/core/page_pool.c
@@ -168,11 +168,7 @@ static int page_pool_init(struct page_pool *pool,
return -EINVAL;
if (pool->p.pool_size)
- ring_qsize = pool->p.pool_size;
-
- /* Sanity limit mem that can be pinned down */
- if (ring_qsize > 32768)
- return -E2BIG;
+ ring_qsize = min(pool->p.pool_size, 16384);
/* DMA direction is either DMA_FROM_DEVICE or DMA_BIDIRECTIONAL.
* DMA_BIDIRECTIONAL is for allowing page used for DMA sending,
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 270/568] orangefs: fix xattr related buffer overflow...
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 269/568] page_pool: Clamp pool size to max 16K pages Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 271/568] ftrace: Fix softlockup in ftrace_module_enable Greg Kroah-Hartman
` (304 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Marshall,
Stanislav Fort of Aisle Research, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marshall <hubcap@omnibond.com>
[ Upstream commit 025e880759c279ec64d0f754fe65bf45961da864 ]
Willy Tarreau <w@1wt.eu> forwarded me a message from
Disclosure <disclosure@aisle.com> with the following
warning:
> The helper `xattr_key()` uses the pointer variable in the loop condition
> rather than dereferencing it. As `key` is incremented, it remains non-NULL
> (until it runs into unmapped memory), so the loop does not terminate on
> valid C strings and will walk memory indefinitely, consuming CPU or hanging
> the thread.
I easily reproduced this with setfattr and getfattr, causing a kernel
oops, hung user processes and corrupted orangefs files. Disclosure
sent along a diff (not a patch) with a suggested fix, which I based
this patch on.
After xattr_key started working right, xfstest generic/069 exposed an
xattr related memory leak that lead to OOM. xattr_key returns
a hashed key. When adding xattrs to the orangefs xattr cache, orangefs
used hash_add, a kernel hashing macro. hash_add also hashes the key using
hash_log which resulted in additions to the xattr cache going to the wrong
hash bucket. generic/069 tortures a single file and orangefs does a
getattr for the xattr "security.capability" every time. Orangefs
negative caches on xattrs which includes a kmalloc. Since adds to the
xattr cache were going to the wrong bucket, every getattr for
"security.capability" resulted in another kmalloc, none of which were
ever freed.
I changed the two uses of hash_add to hlist_add_head instead
and the memory leak ceased and generic/069 quit throwing furniture.
Signed-off-by: Mike Marshall <hubcap@omnibond.com>
Reported-by: Stanislav Fort of Aisle Research <stanislav.fort@aisle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/orangefs/xattr.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/fs/orangefs/xattr.c b/fs/orangefs/xattr.c
index 9a5b757fbd2f6..2d2d16caf9190 100644
--- a/fs/orangefs/xattr.c
+++ b/fs/orangefs/xattr.c
@@ -54,7 +54,9 @@ static inline int convert_to_internal_xattr_flags(int setxattr_flags)
static unsigned int xattr_key(const char *key)
{
unsigned int i = 0;
- while (key)
+ if (!key)
+ return 0;
+ while (*key)
i += *key++;
return i % 16;
}
@@ -175,8 +177,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
cx->length = -1;
cx->timeout = jiffies +
orangefs_getattr_timeout_msecs*HZ/1000;
- hash_add(orangefs_inode->xattr_cache, &cx->node,
- xattr_key(cx->key));
+ hlist_add_head( &cx->node,
+ &orangefs_inode->xattr_cache[xattr_key(cx->key)]);
}
}
goto out_release_op;
@@ -229,8 +231,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
memcpy(cx->val, buffer, length);
cx->length = length;
cx->timeout = jiffies + HZ;
- hash_add(orangefs_inode->xattr_cache, &cx->node,
- xattr_key(cx->key));
+ hlist_add_head(&cx->node,
+ &orangefs_inode->xattr_cache[xattr_key(cx->key)]);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 271/568] ftrace: Fix softlockup in ftrace_module_enable
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (269 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 270/568] orangefs: fix xattr related buffer overflow Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 272/568] ksmbd: use sock_create_kern interface to create kernel socket Greg Kroah-Hartman
` (303 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Riabchun,
Steven Rostedt (Google), Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Riabchun <ferr.lambarginio@gmail.com>
[ Upstream commit 4099b98203d6b33d990586542fa5beee408032a3 ]
A soft lockup was observed when loading amdgpu module.
If a module has a lot of tracable functions, multiple calls
to kallsyms_lookup can spend too much time in RCU critical
section and with disabled preemption, causing kernel panic.
This is the same issue that was fixed in
commit d0b24b4e91fc ("ftrace: Prevent RCU stall on PREEMPT_VOLUNTARY
kernels") and commit 42ea22e754ba ("ftrace: Add cond_resched() to
ftrace_graph_set_hash()").
Fix it the same way by adding cond_resched() in ftrace_module_enable.
Link: https://lore.kernel.org/aMQD9_lxYmphT-up@vova-pc
Signed-off-by: Vladimir Riabchun <ferr.lambarginio@gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/ftrace.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index cebed90b2e16f..a46e2f32ee5fc 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -7065,6 +7065,8 @@ void ftrace_module_enable(struct module *mod)
!within_module_init(rec->ip, mod))
break;
+ cond_resched();
+
/* Weak functions should still be ignored */
if (!test_for_valid_rec(rec)) {
/* Clear all other flags. Should not be enabled anyway */
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 272/568] ksmbd: use sock_create_kern interface to create kernel socket
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (270 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 271/568] ftrace: Fix softlockup in ftrace_module_enable Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 273/568] smb: client: transport: avoid reconnects triggered by pending task work Greg Kroah-Hartman
` (302 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Namjae Jeon, Steve French,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
[ Upstream commit 3677ca67b9791481af16d86e47c3c7d1f2442f95 ]
we should use sock_create_kern() if the socket resides in kernel space.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/transport_tcp.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/fs/smb/server/transport_tcp.c b/fs/smb/server/transport_tcp.c
index f07b9e147fe2d..e0719b70c96f8 100644
--- a/fs/smb/server/transport_tcp.c
+++ b/fs/smb/server/transport_tcp.c
@@ -469,12 +469,13 @@ static int create_socket(struct interface *iface)
struct socket *ksmbd_socket;
bool ipv4 = false;
- ret = sock_create(PF_INET6, SOCK_STREAM, IPPROTO_TCP, &ksmbd_socket);
+ ret = sock_create_kern(current->nsproxy->net_ns, PF_INET6, SOCK_STREAM,
+ IPPROTO_TCP, &ksmbd_socket);
if (ret) {
if (ret != -EAFNOSUPPORT)
pr_err("Can't create socket for ipv6, fallback to ipv4: %d\n", ret);
- ret = sock_create(PF_INET, SOCK_STREAM, IPPROTO_TCP,
- &ksmbd_socket);
+ ret = sock_create_kern(current->nsproxy->net_ns, PF_INET,
+ SOCK_STREAM, IPPROTO_TCP, &ksmbd_socket);
if (ret) {
pr_err("Can't create socket for ipv4: %d\n", ret);
goto out_clear;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 273/568] smb: client: transport: avoid reconnects triggered by pending task work
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (271 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 272/568] ksmbd: use sock_create_kern interface to create kernel socket Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 274/568] ACPICA: Update dsmethod.c to get rid of unused variable warning Greg Kroah-Hartman
` (301 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fiona Ebner, Steve French,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fiona Ebner <f.ebner@proxmox.com>
[ Upstream commit 00be6f26a2a7c671f1402d74c4d3c30a5844660a ]
When io_uring is used in the same task as CIFS, there might be
unnecessary reconnects, causing issues in user-space applications
like QEMU with a log like:
> CIFS: VFS: \\10.10.100.81 Error -512 sending data on socket to server
Certain io_uring completions might be added to task_work with
notify_method being TWA_SIGNAL and thus TIF_NOTIFY_SIGNAL is set for
the task.
In __smb_send_rqst(), signals are masked before calling
smb_send_kvec(), but the masking does not apply to TIF_NOTIFY_SIGNAL.
If sk_stream_wait_memory() is reached via sock_sendmsg() while
TIF_NOTIFY_SIGNAL is set, signal_pending(current) will evaluate to
true there, and -EINTR will be propagated all the way from
sk_stream_wait_memory() to sock_sendmsg() in smb_send_kvec().
Afterwards, __smb_send_rqst() will see that not everything was written
and reconnect.
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/transport.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c
index d2867bd263c55..8a0342bb3ebe7 100644
--- a/fs/smb/client/transport.c
+++ b/fs/smb/client/transport.c
@@ -22,6 +22,7 @@
#include <linux/mempool.h>
#include <linux/sched/signal.h>
#include <linux/task_io_accounting_ops.h>
+#include <linux/task_work.h>
#include "cifspdu.h"
#include "cifsglob.h"
#include "cifsproto.h"
@@ -211,9 +212,16 @@ smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg,
* send a packet. In most cases if we fail to send
* after the retries we will kill the socket and
* reconnect which may clear the network problem.
+ *
+ * Even if regular signals are masked, EINTR might be
+ * propagated from sk_stream_wait_memory() to here when
+ * TIF_NOTIFY_SIGNAL is used for task work. For example,
+ * certain io_uring completions will use that. Treat
+ * having EINTR with pending task work the same as EAGAIN
+ * to avoid unnecessary reconnects.
*/
rc = sock_sendmsg(ssocket, smb_msg);
- if (rc == -EAGAIN) {
+ if (rc == -EAGAIN || unlikely(rc == -EINTR && task_work_pending(current))) {
retries++;
if (retries >= 14 ||
(!server->noblocksnd && (retries > 2))) {
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 274/568] ACPICA: Update dsmethod.c to get rid of unused variable warning
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (272 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 273/568] smb: client: transport: avoid reconnects triggered by pending task work Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 275/568] RDMA/irdma: Fix SD index calculation Greg Kroah-Hartman
` (300 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Saket Dumbre, Rafael J. Wysocki,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saket Dumbre <saket.dumbre@intel.com>
[ Upstream commit 761dc71c6020d6aa68666e96373342d49a7e9d0a ]
All the 3 major C compilers (MSVC, GCC, LLVM/Clang) warn about
the unused variable i after the removal of its usage by PR #1031
addressing Issue #1027
Link: https://github.com/acpica/acpica/commit/6d235320
Signed-off-by: Saket Dumbre <saket.dumbre@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/dsmethod.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
index c5ad377558645..12efc4ac9ba64 100644
--- a/drivers/acpi/acpica/dsmethod.c
+++ b/drivers/acpi/acpica/dsmethod.c
@@ -462,7 +462,6 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
struct acpi_walk_state *next_walk_state = NULL;
union acpi_operand_object *obj_desc;
struct acpi_evaluate_info *info;
- u32 i;
ACPI_FUNCTION_TRACE_PTR(ds_call_control_method, this_walk_state);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 275/568] RDMA/irdma: Fix SD index calculation
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (273 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 274/568] ACPICA: Update dsmethod.c to get rid of unused variable warning Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 276/568] RDMA/irdma: Remove unused struct irdma_cq fields Greg Kroah-Hartman
` (299 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacob Moroni, Tatyana Nikolova,
Leon Romanovsky, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <jmoroni@google.com>
[ Upstream commit 8d158f47f1f33d8747e80c3afbea5aa337e59d41 ]
In some cases, it is possible for pble_rsrc->next_fpm_addr to be
larger than u32, so remove the u32 cast to avoid unintentional
truncation.
This fixes the following error that can be observed when registering
massive memory regions:
[ 447.227494] (NULL ib_device): cqp opcode = 0x1f maj_err_code = 0xffff min_err_code = 0x800c
[ 447.227505] (NULL ib_device): [Update PE SDs Cmd Error][op_code=21] status=-5 waiting=1 completion_err=1 maj=0xffff min=0x800c
Fixes: e8c4dbc2fcac ("RDMA/irdma: Add PBLE resource manager")
Signed-off-by: Jacob Moroni <jmoroni@google.com>
Link: https://patch.msgid.link/20250923190850.1022773-1-jmoroni@google.com
Acked-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/pble.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/irdma/pble.c b/drivers/infiniband/hw/irdma/pble.c
index cdc0b8a6ed483..8dd9e44ed2a4c 100644
--- a/drivers/infiniband/hw/irdma/pble.c
+++ b/drivers/infiniband/hw/irdma/pble.c
@@ -71,7 +71,7 @@ int irdma_hmc_init_pble(struct irdma_sc_dev *dev,
static void get_sd_pd_idx(struct irdma_hmc_pble_rsrc *pble_rsrc,
struct sd_pd_idx *idx)
{
- idx->sd_idx = (u32)pble_rsrc->next_fpm_addr / IRDMA_HMC_DIRECT_BP_SIZE;
+ idx->sd_idx = pble_rsrc->next_fpm_addr / IRDMA_HMC_DIRECT_BP_SIZE;
idx->pd_idx = (u32)(pble_rsrc->next_fpm_addr / IRDMA_HMC_PAGED_BP_SIZE);
idx->rel_pd_idx = (idx->pd_idx % IRDMA_HMC_PD_CNT_IN_SD);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 276/568] RDMA/irdma: Remove unused struct irdma_cq fields
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (274 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 275/568] RDMA/irdma: Fix SD index calculation Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 277/568] RDMA/irdma: Set irdma_cq cq_num field during CQ create Greg Kroah-Hartman
` (298 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacob Moroni, Jason Gunthorpe,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <jmoroni@google.com>
[ Upstream commit 880245fd029a8f8ee8fd557c2681d077c1b1a959 ]
These fields were set but not used anywhere, so remove them.
Link: https://patch.msgid.link/r/20250923142128.943240-1-jmoroni@google.com
Signed-off-by: Jacob Moroni <jmoroni@google.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Stable-dep-of: 5575b7646b94 ("RDMA/irdma: Set irdma_cq cq_num field during CQ create")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/verbs.c | 3 ---
drivers/infiniband/hw/irdma/verbs.h | 6 ------
2 files changed, 9 deletions(-)
diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
index baa3dff6faab1..fb02017a1aa63 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -2088,8 +2088,6 @@ static int irdma_create_cq(struct ib_cq *ibcq,
goto cq_free_rsrc;
}
- iwcq->iwpbl = iwpbl;
- iwcq->cq_mem_size = 0;
cqmr = &iwpbl->cq_mr;
if (rf->sc_dev.hw_attrs.uk_attrs.feature_flags &
@@ -2104,7 +2102,6 @@ static int irdma_create_cq(struct ib_cq *ibcq,
err_code = -EPROTO;
goto cq_free_rsrc;
}
- iwcq->iwpbl_shadow = iwpbl_shadow;
cqmr_shadow = &iwpbl_shadow->cq_mr;
info.shadow_area_pa = cqmr_shadow->cq_pbl.addr;
cqmr->split = true;
diff --git a/drivers/infiniband/hw/irdma/verbs.h b/drivers/infiniband/hw/irdma/verbs.h
index 0bc0d0faa0868..b55d30df96261 100644
--- a/drivers/infiniband/hw/irdma/verbs.h
+++ b/drivers/infiniband/hw/irdma/verbs.h
@@ -113,19 +113,13 @@ struct irdma_mr {
struct irdma_cq {
struct ib_cq ibcq;
struct irdma_sc_cq sc_cq;
- u16 cq_head;
- u16 cq_size;
u16 cq_num;
bool user_mode;
atomic_t armed;
enum irdma_cmpl_notify last_notify;
- u32 polled_cmpls;
- u32 cq_mem_size;
struct irdma_dma_mem kmem;
struct irdma_dma_mem kmem_shadow;
spinlock_t lock; /* for poll cq */
- struct irdma_pbl *iwpbl;
- struct irdma_pbl *iwpbl_shadow;
struct list_head resize_list;
struct irdma_cq_poll_info cur_cqe;
struct list_head cmpl_generated;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 277/568] RDMA/irdma: Set irdma_cq cq_num field during CQ create
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (275 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 276/568] RDMA/irdma: Remove unused struct irdma_cq fields Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 278/568] RDMA/hns: Fix the modification of max_send_sge Greg Kroah-Hartman
` (297 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacob Moroni, Tatyana Nikolova,
Leon Romanovsky, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <jmoroni@google.com>
[ Upstream commit 5575b7646b94c0afb0f4c0d86e00e13cf3397a62 ]
The driver maintains a CQ table that is used to ensure that a CQ is
still valid when processing CQ related AEs. When a CQ is destroyed,
the table entry is cleared, using irdma_cq.cq_num as the index. This
field was never being set, so it was just always clearing out entry
0.
Additionally, the cq_num field size was increased to accommodate HW
supporting more than 64K CQs.
Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
Signed-off-by: Jacob Moroni <jmoroni@google.com>
Link: https://patch.msgid.link/20250923142439.943930-1-jmoroni@google.com
Acked-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/verbs.c | 1 +
drivers/infiniband/hw/irdma/verbs.h | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
index fb02017a1aa63..6fc622e3eb07a 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -2050,6 +2050,7 @@ static int irdma_create_cq(struct ib_cq *ibcq,
spin_lock_init(&iwcq->lock);
INIT_LIST_HEAD(&iwcq->resize_list);
INIT_LIST_HEAD(&iwcq->cmpl_generated);
+ iwcq->cq_num = cq_num;
info.dev = dev;
ukinfo->cq_size = max(entries, 4);
ukinfo->cq_id = cq_num;
diff --git a/drivers/infiniband/hw/irdma/verbs.h b/drivers/infiniband/hw/irdma/verbs.h
index b55d30df96261..8809465020e13 100644
--- a/drivers/infiniband/hw/irdma/verbs.h
+++ b/drivers/infiniband/hw/irdma/verbs.h
@@ -113,7 +113,7 @@ struct irdma_mr {
struct irdma_cq {
struct ib_cq ibcq;
struct irdma_sc_cq sc_cq;
- u16 cq_num;
+ u32 cq_num;
bool user_mode;
atomic_t armed;
enum irdma_cmpl_notify last_notify;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 278/568] RDMA/hns: Fix the modification of max_send_sge
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (276 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 277/568] RDMA/irdma: Set irdma_cq cq_num field during CQ create Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 279/568] RDMA/hns: Fix wrong WQE data when QP wraps around Greg Kroah-Hartman
` (296 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, wenglianfa, Junxian Huang,
Leon Romanovsky, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: wenglianfa <wenglianfa@huawei.com>
[ Upstream commit f5a7cbea5411668d429eb4ffe96c4063fe8dac9e ]
The actual sge number may exceed the value specified in init_attr->cap
when HW needs extra sge to enable inline feature. Since these extra
sges are not expected by ULP, return the user-specified value to ULP
instead of the expanded sge number.
Fixes: 0c5e259b06a8 ("RDMA/hns: Fix incorrect sge nums calculation")
Signed-off-by: wenglianfa <wenglianfa@huawei.com>
Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
Link: https://patch.msgid.link/20251016114051.1963197-3-huangjunxian6@hisilicon.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hns/hns_roce_qp.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
index 0f0351abe9b46..72787ff924f44 100644
--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
@@ -661,7 +661,6 @@ static int set_user_sq_size(struct hns_roce_dev *hr_dev,
hr_qp->sq.wqe_shift = ucmd->log_sq_stride;
hr_qp->sq.wqe_cnt = cnt;
- cap->max_send_sge = hr_qp->sq.max_gs;
return 0;
}
@@ -743,7 +742,6 @@ static int set_kernel_sq_size(struct hns_roce_dev *hr_dev,
/* sync the parameters of kernel QP to user's configuration */
cap->max_send_wr = cnt;
- cap->max_send_sge = hr_qp->sq.max_gs;
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 279/568] RDMA/hns: Fix wrong WQE data when QP wraps around
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (277 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 278/568] RDMA/hns: Fix the modification of max_send_sge Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 280/568] btrfs: mark dirty extent range for out of bound prealloc extents Greg Kroah-Hartman
` (295 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Junxian Huang, Leon Romanovsky,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxian Huang <huangjunxian6@hisilicon.com>
[ Upstream commit fe9622011f955e35ba84d3af7b2f2fed31cf8ca1 ]
When QP wraps around, WQE data from the previous use at the same
position still remains as driver does not clear it. The WQE field
layout differs across different opcodes, causing that the fields
that are not explicitly assigned for the current opcode retain
stale values, and are issued to HW by mistake. Such fields are as
follows:
* MSG_START_SGE_IDX field in ATOMIC WQE
* BLOCK_SIZE and ZBVA fields in FRMR WQE
* DirectWQE fields when DirectWQE not used
For ATOMIC WQE, always set the latest sge index in MSG_START_SGE_IDX
as required by HW.
For FRMR WQE and DirectWQE, clear only those unassigned fields
instead of the entire WQE to avoid performance penalty.
Fixes: 68a997c5d28c ("RDMA/hns: Add FRMR support for hip08")
Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
Link: https://patch.msgid.link/20251016114051.1963197-4-huangjunxian6@hisilicon.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 72c719805af32..5fdab366fb32d 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -161,6 +161,8 @@ static void set_frmr_seg(struct hns_roce_v2_rc_send_wqe *rc_sq_wqe,
hr_reg_write(fseg, FRMR_PBL_BUF_PG_SZ,
to_hr_hw_page_shift(mr->pbl_mtr.hem_cfg.buf_pg_shift));
hr_reg_clear(fseg, FRMR_BLK_MODE);
+ hr_reg_clear(fseg, FRMR_BLOCK_SIZE);
+ hr_reg_clear(fseg, FRMR_ZBVA);
}
static void set_atomic_seg(const struct ib_send_wr *wr,
@@ -335,9 +337,6 @@ static int set_rwqe_data_seg(struct ib_qp *ibqp, const struct ib_send_wr *wr,
int j = 0;
int i;
- hr_reg_write(rc_sq_wqe, RC_SEND_WQE_MSG_START_SGE_IDX,
- (*sge_ind) & (qp->sge.sge_cnt - 1));
-
hr_reg_write(rc_sq_wqe, RC_SEND_WQE_INLINE,
!!(wr->send_flags & IB_SEND_INLINE));
if (wr->send_flags & IB_SEND_INLINE)
@@ -586,6 +585,9 @@ static inline int set_rc_wqe(struct hns_roce_qp *qp,
hr_reg_write(rc_sq_wqe, RC_SEND_WQE_CQE,
(wr->send_flags & IB_SEND_SIGNALED) ? 1 : 0);
+ hr_reg_write(rc_sq_wqe, RC_SEND_WQE_MSG_START_SGE_IDX,
+ curr_idx & (qp->sge.sge_cnt - 1));
+
if (wr->opcode == IB_WR_ATOMIC_CMP_AND_SWP ||
wr->opcode == IB_WR_ATOMIC_FETCH_AND_ADD) {
if (msg_len != ATOMIC_WR_LEN)
@@ -734,6 +736,9 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp,
owner_bit =
~(((qp->sq.head + nreq) >> ilog2(qp->sq.wqe_cnt)) & 0x1);
+ /* RC and UD share the same DirectWQE field layout */
+ ((struct hns_roce_v2_rc_send_wqe *)wqe)->byte_4 = 0;
+
/* Corresponding to the QP type, wqe process separately */
if (ibqp->qp_type == IB_QPT_RC)
ret = set_rc_wqe(qp, wr, wqe, &sge_idx, owner_bit);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 280/568] btrfs: mark dirty extent range for out of bound prealloc extents
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (278 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 279/568] RDMA/hns: Fix wrong WQE data when QP wraps around Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 281/568] fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink Greg Kroah-Hartman
` (294 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, austinchang, Filipe Manana,
David Sterba, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: austinchang <austinchang@synology.com>
[ Upstream commit 3b1a4a59a2086badab391687a6a0b86e03048393 ]
In btrfs_fallocate(), when the allocated range overlaps with a prealloc
extent and the extent starts after i_size, the range doesn't get marked
dirty in file_extent_tree. This results in persisting an incorrect
disk_i_size for the inode when not using the no-holes feature.
This is reproducible since commit 41a2ee75aab0 ("btrfs: introduce
per-inode file extent tree"), then became hidden since commit 3d7db6e8bd22
("btrfs: don't allocate file extent tree for non regular files") and then
visible again after commit 8679d2687c35 ("btrfs: initialize
inode::file_extent_tree after i_mode has been set"), which fixes the
previous commit.
The following reproducer triggers the problem:
$ cat test.sh
MNT=/mnt/test
DEV=/dev/vdb
mkdir -p $MNT
mkfs.btrfs -f -O ^no-holes $DEV
mount $DEV $MNT
touch $MNT/file1
fallocate -n -o 1M -l 2M $MNT/file1
umount $MNT
mount $DEV $MNT
len=$((1 * 1024 * 1024))
fallocate -o 1M -l $len $MNT/file1
du --bytes $MNT/file1
umount $MNT
mount $DEV $MNT
du --bytes $MNT/file1
umount $MNT
Running the reproducer gives the following result:
$ ./test.sh
(...)
2097152 /mnt/test/file1
1048576 /mnt/test/file1
The difference is exactly 1048576 as we assigned.
Fix by adding a call to btrfs_inode_set_file_extent_range() in
btrfs_fallocate_update_isize().
Fixes: 41a2ee75aab0 ("btrfs: introduce per-inode file extent tree")
Signed-off-by: austinchang <austinchang@synology.com>
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/file.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 3814f09dc4ae0..b670d5d72a382 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -2828,12 +2828,22 @@ static int btrfs_fallocate_update_isize(struct inode *inode,
{
struct btrfs_trans_handle *trans;
struct btrfs_root *root = BTRFS_I(inode)->root;
+ u64 range_start;
+ u64 range_end;
int ret;
int ret2;
if (mode & FALLOC_FL_KEEP_SIZE || end <= i_size_read(inode))
return 0;
+ range_start = round_down(i_size_read(inode), root->fs_info->sectorsize);
+ range_end = round_up(end, root->fs_info->sectorsize);
+
+ ret = btrfs_inode_set_file_extent_range(BTRFS_I(inode), range_start,
+ range_end - range_start);
+ if (ret)
+ return ret;
+
trans = btrfs_start_transaction(root, 1);
if (IS_ERR(trans))
return PTR_ERR(trans);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 281/568] fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (279 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 280/568] btrfs: mark dirty extent range for out of bound prealloc extents Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 282/568] um: Fix help message for ssl-non-raw Greg Kroah-Hartman
` (293 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yikang Yue, Mikulas Patocka,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yikang Yue <yikangy2@illinois.edu>
[ Upstream commit 32058c38d3b79a28963a59ac0353644dc24775cd ]
The function call new_inode() is a primitive for allocating an inode in memory,
rather than planning disk space for it. Therefore, -ENOMEM should be returned
as the error code rather than -ENOSPC.
To be specific, new_inode()'s call path looks like this:
new_inode
new_inode_pseudo
alloc_inode
ops->alloc_inode (hpfs_alloc_inode)
alloc_inode_sb
kmem_cache_alloc_lru
Therefore, the failure of new_inode() indicates a memory presure issue (-ENOMEM),
not a lack of disk space. However, the current implementation of
hpfs_mkdir/create/mknod/symlink incorrectly returns -ENOSPC when new_inode() fails.
This patch fix this by set err to -ENOMEM before the goto statement.
BTW, we also noticed that other nested calls within these four functions,
like hpfs_alloc_f/dnode and hpfs_add_dirent, might also fail due to memory presure.
But similarly, only -ENOSPC is returned. Addressing these will involve code
modifications in other functions, and we plan to submit dedicated patches for these
issues in the future. For this patch, we focus on new_inode().
Signed-off-by: Yikang Yue <yikangy2@illinois.edu>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/hpfs/namei.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c
index 15fc63276caae..63779d978c6db 100644
--- a/fs/hpfs/namei.c
+++ b/fs/hpfs/namei.c
@@ -53,8 +53,10 @@ static int hpfs_mkdir(struct user_namespace *mnt_userns, struct inode *dir,
dee.fnode = cpu_to_le32(fno);
dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
result = new_inode(dir->i_sb);
- if (!result)
+ if (!result) {
+ err = -ENOMEM;
goto bail2;
+ }
hpfs_init_inode(result);
result->i_ino = fno;
hpfs_i(result)->i_parent_dir = dir->i_ino;
@@ -156,9 +158,10 @@ static int hpfs_create(struct user_namespace *mnt_userns, struct inode *dir,
dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
result = new_inode(dir->i_sb);
- if (!result)
+ if (!result) {
+ err = -ENOMEM;
goto bail1;
-
+ }
hpfs_init_inode(result);
result->i_ino = fno;
result->i_mode |= S_IFREG;
@@ -244,9 +247,10 @@ static int hpfs_mknod(struct user_namespace *mnt_userns, struct inode *dir,
dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
result = new_inode(dir->i_sb);
- if (!result)
+ if (!result) {
+ err = -ENOMEM;
goto bail1;
-
+ }
hpfs_init_inode(result);
result->i_ino = fno;
hpfs_i(result)->i_parent_dir = dir->i_ino;
@@ -321,8 +325,10 @@ static int hpfs_symlink(struct user_namespace *mnt_userns, struct inode *dir,
dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
result = new_inode(dir->i_sb);
- if (!result)
+ if (!result) {
+ err = -ENOMEM;
goto bail1;
+ }
result->i_ino = fno;
hpfs_init_inode(result);
hpfs_i(result)->i_parent_dir = dir->i_ino;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 282/568] um: Fix help message for ssl-non-raw
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (280 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 281/568] fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 283/568] clk: sunxi-ng: sun6i-rtc: Add A523 specifics Greg Kroah-Hartman
` (292 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tiwei Bie, Johannes Berg,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiwei Bie <tiwei.btw@antgroup.com>
[ Upstream commit 725e9d81868fcedaeef775948e699955b01631ae ]
Add the missing option name in the help message. Additionally,
switch to __uml_help(), because this is a global option rather
than a per-channel option.
Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/um/drivers/ssl.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c
index 277cea3d30eb5..8006a5bd578c2 100644
--- a/arch/um/drivers/ssl.c
+++ b/arch/um/drivers/ssl.c
@@ -199,4 +199,7 @@ static int ssl_non_raw_setup(char *str)
return 1;
}
__setup("ssl-non-raw", ssl_non_raw_setup);
-__channel_help(ssl_non_raw_setup, "set serial lines to non-raw mode");
+__uml_help(ssl_non_raw_setup,
+"ssl-non-raw\n"
+" Set serial lines to non-raw mode.\n\n"
+);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 283/568] clk: sunxi-ng: sun6i-rtc: Add A523 specifics
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (281 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 282/568] um: Fix help message for ssl-non-raw Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 16:39 ` Chen-Yu Tsai
2025-12-03 15:24 ` [PATCH 6.1 284/568] rtc: pcf2127: clear minute/second interrupt Greg Kroah-Hartman
` (291 subsequent siblings)
574 siblings, 1 reply; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jernej Skrabec, Chen-Yu Tsai,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wens@csie.org>
[ Upstream commit 7aa8781f379c32c31bd78f1408a31765b2297c43 ]
The A523's RTC block is backward compatible with the R329's, but it also
has a calibration function for its internal oscillator, which would
allow it to provide a clock rate closer to the desired 32.768 KHz. This
is useful on the Radxa Cubie A5E, which does not have an external 32.768
KHz crystal.
Add new compatible-specific data for it.
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Link: https://patch.msgid.link/20250909170947.2221611-1-wens@kernel.org
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/sunxi-ng/ccu-sun6i-rtc.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c
index d65398497d5f6..e42348bda20f8 100644
--- a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c
+++ b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c
@@ -323,6 +323,13 @@ static const struct sun6i_rtc_match_data sun50i_r329_rtc_ccu_data = {
.osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents),
};
+static const struct sun6i_rtc_match_data sun55i_a523_rtc_ccu_data = {
+ .have_ext_osc32k = true,
+ .have_iosc_calibration = true,
+ .osc32k_fanout_parents = sun50i_r329_osc32k_fanout_parents,
+ .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents),
+};
+
static const struct of_device_id sun6i_rtc_ccu_match[] = {
{
.compatible = "allwinner,sun50i-h616-rtc",
@@ -332,6 +339,10 @@ static const struct of_device_id sun6i_rtc_ccu_match[] = {
.compatible = "allwinner,sun50i-r329-rtc",
.data = &sun50i_r329_rtc_ccu_data,
},
+ {
+ .compatible = "allwinner,sun55i-a523-rtc",
+ .data = &sun55i_a523_rtc_ccu_data,
+ },
{},
};
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* Re: [PATCH 6.1 283/568] clk: sunxi-ng: sun6i-rtc: Add A523 specifics
2025-12-03 15:24 ` [PATCH 6.1 283/568] clk: sunxi-ng: sun6i-rtc: Add A523 specifics Greg Kroah-Hartman
@ 2025-12-03 16:39 ` Chen-Yu Tsai
2025-12-04 16:18 ` Greg Kroah-Hartman
0 siblings, 1 reply; 588+ messages in thread
From: Chen-Yu Tsai @ 2025-12-03 16:39 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: stable, patches, Jernej Skrabec, Sasha Levin
On Thu, Dec 4, 2025 at 12:34 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> 6.1-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Chen-Yu Tsai <wens@csie.org>
>
> [ Upstream commit 7aa8781f379c32c31bd78f1408a31765b2297c43 ]
>
> The A523's RTC block is backward compatible with the R329's, but it also
> has a calibration function for its internal oscillator, which would
> allow it to provide a clock rate closer to the desired 32.768 KHz. This
> is useful on the Radxa Cubie A5E, which does not have an external 32.768
> KHz crystal.
>
> Add new compatible-specific data for it.
Support for the A523 SoC was added in v6.16. I don't think we need to
backport A523 specific stuff any further back.
ChenYu
> Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
> Link: https://patch.msgid.link/20250909170947.2221611-1-wens@kernel.org
> Signed-off-by: Chen-Yu Tsai <wens@csie.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/clk/sunxi-ng/ccu-sun6i-rtc.c | 11 +++++++++++
> 1 file changed, 11 insertions(+)
>
> diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c
> index d65398497d5f6..e42348bda20f8 100644
> --- a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c
> +++ b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c
> @@ -323,6 +323,13 @@ static const struct sun6i_rtc_match_data sun50i_r329_rtc_ccu_data = {
> .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents),
> };
>
> +static const struct sun6i_rtc_match_data sun55i_a523_rtc_ccu_data = {
> + .have_ext_osc32k = true,
> + .have_iosc_calibration = true,
> + .osc32k_fanout_parents = sun50i_r329_osc32k_fanout_parents,
> + .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents),
> +};
> +
> static const struct of_device_id sun6i_rtc_ccu_match[] = {
> {
> .compatible = "allwinner,sun50i-h616-rtc",
> @@ -332,6 +339,10 @@ static const struct of_device_id sun6i_rtc_ccu_match[] = {
> .compatible = "allwinner,sun50i-r329-rtc",
> .data = &sun50i_r329_rtc_ccu_data,
> },
> + {
> + .compatible = "allwinner,sun55i-a523-rtc",
> + .data = &sun55i_a523_rtc_ccu_data,
> + },
> {},
> };
>
> --
> 2.51.0
>
>
>
^ permalink raw reply [flat|nested] 588+ messages in thread* Re: [PATCH 6.1 283/568] clk: sunxi-ng: sun6i-rtc: Add A523 specifics
2025-12-03 16:39 ` Chen-Yu Tsai
@ 2025-12-04 16:18 ` Greg Kroah-Hartman
0 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-04 16:18 UTC (permalink / raw)
To: Chen-Yu Tsai; +Cc: stable, patches, Jernej Skrabec, Sasha Levin
On Thu, Dec 04, 2025 at 12:39:19AM +0800, Chen-Yu Tsai wrote:
> On Thu, Dec 4, 2025 at 12:34 AM Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > 6.1-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Chen-Yu Tsai <wens@csie.org>
> >
> > [ Upstream commit 7aa8781f379c32c31bd78f1408a31765b2297c43 ]
> >
> > The A523's RTC block is backward compatible with the R329's, but it also
> > has a calibration function for its internal oscillator, which would
> > allow it to provide a clock rate closer to the desired 32.768 KHz. This
> > is useful on the Radxa Cubie A5E, which does not have an external 32.768
> > KHz crystal.
> >
> > Add new compatible-specific data for it.
>
> Support for the A523 SoC was added in v6.16. I don't think we need to
> backport A523 specific stuff any further back.
Now dropped, thanks!
greg k-h
^ permalink raw reply [flat|nested] 588+ messages in thread
* [PATCH 6.1 284/568] rtc: pcf2127: clear minute/second interrupt
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (282 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 283/568] clk: sunxi-ng: sun6i-rtc: Add A523 specifics Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 285/568] ARM: at91: pm: save and restore ACR during PLL disable/enable Greg Kroah-Hartman
` (290 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josua Mayer, Bruno Thomsen,
Alexandre Belloni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josua Mayer <josua@solid-run.com>
[ Upstream commit a6f1a4f05970664004a9370459c6799c1b2f2dcf ]
PCF2127 can generate interrupt every full second or minute configured
from control and status register 1, bits MI (1) and SI (0).
On interrupt control register 2 bit MSF (7) is set and must be cleared
to continue normal operation.
While the driver never enables this interrupt on its own, users or
firmware may do so - e.g. as an easy way to test the interrupt.
Add preprocessor definition for MSF bit and include it in the irq
bitmask to ensure minute and second interrupts are cleared when fired.
This fixes an issue where the rtc enters a test mode and becomes
unresponsive after a second interrupt has fired and is not cleared in
time. In this state register writes to control registers have no
effect and the interrupt line is kept asserted [1]:
[1] userspace commands to put rtc into unresponsive state:
$ i2cget -f -y 2 0x51 0x00
0x04
$ i2cset -f -y 2 0x51 0x00 0x05 # set bit 0 SI
$ i2cget -f -y 2 0x51 0x00
0x84 # bit 8 EXT_TEST set
$ i2cset -f -y 2 0x51 0x00 0x05 # try overwrite control register
$ i2cget -f -y 2 0x51 0x00
0x84 # no change
Signed-off-by: Josua Mayer <josua@solid-run.com>
Reviewed-by: Bruno Thomsen <bruno.thomsen@gmail.com>
Link: https://lore.kernel.org/r/20250825-rtc-irq-v1-1-0133319406a7@solid-run.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-pcf2127.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
index 87f4fc9df68b4..ae2c52a0dab25 100644
--- a/drivers/rtc/rtc-pcf2127.c
+++ b/drivers/rtc/rtc-pcf2127.c
@@ -35,6 +35,7 @@
#define PCF2127_BIT_CTRL2_AF BIT(4)
#define PCF2127_BIT_CTRL2_TSF2 BIT(5)
#define PCF2127_BIT_CTRL2_WDTF BIT(6)
+#define PCF2127_BIT_CTRL2_MSF BIT(7)
/* Control register 3 */
#define PCF2127_REG_CTRL3 0x02
#define PCF2127_BIT_CTRL3_BLIE BIT(0)
@@ -99,7 +100,8 @@
#define PCF2127_CTRL2_IRQ_MASK ( \
PCF2127_BIT_CTRL2_AF | \
PCF2127_BIT_CTRL2_WDTF | \
- PCF2127_BIT_CTRL2_TSF2)
+ PCF2127_BIT_CTRL2_TSF2 | \
+ PCF2127_BIT_CTRL2_MSF)
struct pcf2127 {
struct rtc_device *rtc;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 285/568] ARM: at91: pm: save and restore ACR during PLL disable/enable
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (283 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 284/568] rtc: pcf2127: clear minute/second interrupt Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 286/568] clk: at91: clk-master: Add check for divide by 3 Greg Kroah-Hartman
` (289 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Ferre, Cristian Birsan,
Alexandre Belloni, Claudiu Beznea, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <nicolas.ferre@microchip.com>
[ Upstream commit 0c01fe49651d387776abed6a28541e80c8a93319 ]
Add a new word in assembly to store ACR value during the calls
to at91_plla_disable/at91_plla_enable macros and use it.
Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
[cristian.birsan@microchip.com: remove ACR_DEFAULT_PLLA loading]
Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
Link: https://lore.kernel.org/r/20250827145427.46819-4-nicolas.ferre@microchip.com
Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-at91/pm_suspend.S | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
index 0af2598899fc5..c410da92ce38b 100644
--- a/arch/arm/mach-at91/pm_suspend.S
+++ b/arch/arm/mach-at91/pm_suspend.S
@@ -685,6 +685,10 @@ sr_dis_exit:
bic tmp2, tmp2, #AT91_PMC_PLL_UPDT_ID
str tmp2, [pmc, #AT91_PMC_PLL_UPDT]
+ /* save acr */
+ ldr tmp2, [pmc, #AT91_PMC_PLL_ACR]
+ str tmp2, .saved_acr
+
/* save div. */
mov tmp1, #0
ldr tmp2, [pmc, #AT91_PMC_PLL_CTRL0]
@@ -754,7 +758,7 @@ sr_dis_exit:
str tmp1, [pmc, #AT91_PMC_PLL_UPDT]
/* step 2. */
- ldr tmp1, =AT91_PMC_PLL_ACR_DEFAULT_PLLA
+ ldr tmp1, .saved_acr
str tmp1, [pmc, #AT91_PMC_PLL_ACR]
/* step 3. */
@@ -1130,6 +1134,8 @@ ENDPROC(at91_pm_suspend_in_sram)
.word 0
.saved_mckr:
.word 0
+.saved_acr:
+ .word 0
.saved_pllar:
.word 0
.saved_sam9_lpr:
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 286/568] clk: at91: clk-master: Add check for divide by 3
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (284 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 285/568] ARM: at91: pm: save and restore ACR during PLL disable/enable Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 287/568] clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register Greg Kroah-Hartman
` (288 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ryan Wanner, Nicolas Ferre,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Wanner <Ryan.Wanner@microchip.com>
[ Upstream commit e0237f5635727d64635ec6665e1de9f4cacce35c ]
A potential divider for the master clock is div/3. The register
configuration for div/3 is MASTER_PRES_MAX. The current bit shifting
method does not work for this case. Checking for MASTER_PRES_MAX will
ensure the correct decimal value is stored in the system.
Signed-off-by: Ryan Wanner <Ryan.Wanner@microchip.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/at91/clk-master.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/clk/at91/clk-master.c b/drivers/clk/at91/clk-master.c
index b7cd1924de52a..1f07a5d292602 100644
--- a/drivers/clk/at91/clk-master.c
+++ b/drivers/clk/at91/clk-master.c
@@ -574,6 +574,9 @@ clk_sama7g5_master_recalc_rate(struct clk_hw *hw,
{
struct clk_master *master = to_clk_master(hw);
+ if (master->div == MASTER_PRES_MAX)
+ return DIV_ROUND_CLOSEST_ULL(parent_rate, 3);
+
return DIV_ROUND_CLOSEST_ULL(parent_rate, (1 << master->div));
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 287/568] clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (285 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 286/568] clk: at91: clk-master: Add check for divide by 3 Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 288/568] clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled Greg Kroah-Hartman
` (287 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Ferre, Claudiu Beznea,
Sasha Levin, Ryan Wanner
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <nicolas.ferre@microchip.com>
[ Upstream commit af98caeaa7b6ad11eb7b7c8bfaddc769df2889f3 ]
This register is important for sequencing the commands to PLLs, so
actually write the update bits with regmap_write_bits() instead of
relying on a read/modify/write regmap command that could skip the actual
hardware write if the value is identical to the one read.
It's changed when modification is needed to the PLL, when
read-only operation is done, we could keep the call to
regmap_update_bits().
Add a comment to the sam9x60_div_pll_set_div() function that uses this
PLL_UPDT register so that it's used consistently, according to the
product's datasheet.
Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Tested-by: Ryan Wanner <ryan.wanner@microchip.com> # on sama7d65 and sam9x75
Link: https://lore.kernel.org/r/20250827150811.82496-1-nicolas.ferre@microchip.com
[claudiu.beznea: fix "Alignment should match open parenthesis"
checkpatch.pl check]
Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/at91/clk-sam9x60-pll.c | 75 ++++++++++++++++--------------
1 file changed, 39 insertions(+), 36 deletions(-)
diff --git a/drivers/clk/at91/clk-sam9x60-pll.c b/drivers/clk/at91/clk-sam9x60-pll.c
index 0882ed01d5c27..a010a8fce58b2 100644
--- a/drivers/clk/at91/clk-sam9x60-pll.c
+++ b/drivers/clk/at91/clk-sam9x60-pll.c
@@ -90,8 +90,8 @@ static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core)
spin_lock_irqsave(core->lock, flags);
- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
- AT91_PMC_PLL_UPDT_ID_MSK, core->id);
+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
+ AT91_PMC_PLL_UPDT_ID_MSK, core->id);
regmap_read(regmap, AT91_PMC_PLL_CTRL1, &val);
cmul = (val & core->layout->mul_mask) >> core->layout->mul_shift;
cfrac = (val & core->layout->frac_mask) >> core->layout->frac_shift;
@@ -125,17 +125,17 @@ static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core)
udelay(10);
}
- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
- AT91_PMC_PLL_UPDT_UPDATE | core->id);
+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
+ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+ AT91_PMC_PLL_UPDT_UPDATE | core->id);
regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0,
AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL,
AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL);
- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
- AT91_PMC_PLL_UPDT_UPDATE | core->id);
+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
+ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+ AT91_PMC_PLL_UPDT_UPDATE | core->id);
while (!sam9x60_pll_ready(regmap, core->id))
cpu_relax();
@@ -161,8 +161,8 @@ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw)
spin_lock_irqsave(core->lock, flags);
- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
- AT91_PMC_PLL_UPDT_ID_MSK, core->id);
+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
+ AT91_PMC_PLL_UPDT_ID_MSK, core->id);
regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, AT91_PMC_PLL_CTRL0_ENPLL, 0);
@@ -170,9 +170,9 @@ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw)
regmap_update_bits(regmap, AT91_PMC_PLL_ACR,
AT91_PMC_PLL_ACR_UTMIBG | AT91_PMC_PLL_ACR_UTMIVR, 0);
- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
- AT91_PMC_PLL_UPDT_UPDATE | core->id);
+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
+ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+ AT91_PMC_PLL_UPDT_UPDATE | core->id);
spin_unlock_irqrestore(core->lock, flags);
}
@@ -257,8 +257,8 @@ static int sam9x60_frac_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate,
spin_lock_irqsave(core->lock, irqflags);
- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
- core->id);
+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
+ core->id);
regmap_read(regmap, AT91_PMC_PLL_CTRL1, &val);
cmul = (val & core->layout->mul_mask) >> core->layout->mul_shift;
cfrac = (val & core->layout->frac_mask) >> core->layout->frac_shift;
@@ -270,18 +270,18 @@ static int sam9x60_frac_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate,
(frac->mul << core->layout->mul_shift) |
(frac->frac << core->layout->frac_shift));
- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
- AT91_PMC_PLL_UPDT_UPDATE | core->id);
+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
+ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+ AT91_PMC_PLL_UPDT_UPDATE | core->id);
regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0,
AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL,
AT91_PMC_PLL_CTRL0_ENLOCK |
AT91_PMC_PLL_CTRL0_ENPLL);
- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
- AT91_PMC_PLL_UPDT_UPDATE | core->id);
+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
+ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+ AT91_PMC_PLL_UPDT_UPDATE | core->id);
while (!sam9x60_pll_ready(regmap, core->id))
cpu_relax();
@@ -333,7 +333,10 @@ static const struct clk_ops sam9x60_frac_pll_ops_chg = {
.restore_context = sam9x60_frac_pll_restore_context,
};
-/* This function should be called with spinlock acquired. */
+/* This function should be called with spinlock acquired.
+ * Warning: this function must be called only if the same PLL ID was set in
+ * PLL_UPDT register previously.
+ */
static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div,
bool enable)
{
@@ -345,9 +348,9 @@ static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div,
core->layout->div_mask | ena_msk,
(div << core->layout->div_shift) | ena_val);
- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
- AT91_PMC_PLL_UPDT_UPDATE | core->id);
+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
+ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+ AT91_PMC_PLL_UPDT_UPDATE | core->id);
while (!sam9x60_pll_ready(regmap, core->id))
cpu_relax();
@@ -361,8 +364,8 @@ static int sam9x60_div_pll_set(struct sam9x60_pll_core *core)
unsigned int val, cdiv;
spin_lock_irqsave(core->lock, flags);
- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
- AT91_PMC_PLL_UPDT_ID_MSK, core->id);
+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
+ AT91_PMC_PLL_UPDT_ID_MSK, core->id);
regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val);
cdiv = (val & core->layout->div_mask) >> core->layout->div_shift;
@@ -393,15 +396,15 @@ static void sam9x60_div_pll_unprepare(struct clk_hw *hw)
spin_lock_irqsave(core->lock, flags);
- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
- AT91_PMC_PLL_UPDT_ID_MSK, core->id);
+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
+ AT91_PMC_PLL_UPDT_ID_MSK, core->id);
regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0,
core->layout->endiv_mask, 0);
- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
- AT91_PMC_PLL_UPDT_UPDATE | core->id);
+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
+ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+ AT91_PMC_PLL_UPDT_UPDATE | core->id);
spin_unlock_irqrestore(core->lock, flags);
}
@@ -507,8 +510,8 @@ static int sam9x60_div_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate,
div->div = DIV_ROUND_CLOSEST(parent_rate, rate) - 1;
spin_lock_irqsave(core->lock, irqflags);
- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
- core->id);
+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
+ core->id);
regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val);
cdiv = (val & core->layout->div_mask) >> core->layout->div_shift;
@@ -563,8 +566,8 @@ static int sam9x60_div_pll_notifier_fn(struct notifier_block *notifier,
div->div = div->safe_div;
spin_lock_irqsave(core.lock, irqflags);
- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
- core.id);
+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
+ core.id);
regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val);
cdiv = (val & core.layout->div_mask) >> core.layout->div_shift;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 288/568] clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (286 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 287/568] clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 289/568] NTB: epf: Allow arbitrary BAR mapping Greg Kroah-Hartman
` (286 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthias Schiffer, Alexander Stein,
Kevin Hilman, Stephen Boyd, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Schiffer <matthias.schiffer@tq-group.com>
[ Upstream commit 1e0d75258bd09323cb452655549e03975992b29e ]
As described in AM335x Errata Advisory 1.0.42, WKUP_DEBUGSS_CLKCTRL
can't be disabled - the clock module will just be stuck in transitioning
state forever, resulting in the following warning message after the wait
loop times out:
l3-aon-clkctrl:0000:0: failed to disable
Just add the clock to enable_init_clks, so no attempt is made to disable
it.
Signed-off-by: Matthias Schiffer <matthias.schiffer@tq-group.com>
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Acked-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/ti/clk-33xx.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/clk/ti/clk-33xx.c b/drivers/clk/ti/clk-33xx.c
index 85c50ea39e6da..9269e6a0db6a4 100644
--- a/drivers/clk/ti/clk-33xx.c
+++ b/drivers/clk/ti/clk-33xx.c
@@ -258,6 +258,8 @@ static const char *enable_init_clks[] = {
"dpll_ddr_m2_ck",
"dpll_mpu_m2_ck",
"l3_gclk",
+ /* WKUP_DEBUGSS_CLKCTRL - disable fails, AM335x Errata Advisory 1.0.42 */
+ "l3-aon-clkctrl:0000:0",
/* AM3_L3_L3_MAIN_CLKCTRL, needed during suspend */
"l3-clkctrl:00bc:0",
"l4hs_gclk",
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 289/568] NTB: epf: Allow arbitrary BAR mapping
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (287 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 288/568] clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 290/568] 9p: fix /sys/fs/9p/caches overwriting itself Greg Kroah-Hartman
` (285 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jerome Brunet, Jon Mason,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <jbrunet@baylibre.com>
[ Upstream commit 5ad865862a0fd349163243e1834ed98ba9b81905 ]
The NTB epf host driver assumes the BAR number associated with a memory
window is just incremented from the BAR number associated with MW1. This
seems to have been enough so far but this is not really how the endpoint
side work and the two could easily become mis-aligned.
ntb_epf_mw_to_bar() even assumes that the BAR number is the memory window
index + 2, which means the function only returns a proper result if BAR_2
is associated with MW1.
Instead, fully describe and allow arbitrary NTB BAR mapping.
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ntb/hw/epf/ntb_hw_epf.c | 103 ++++++++++++++++----------------
1 file changed, 53 insertions(+), 50 deletions(-)
diff --git a/drivers/ntb/hw/epf/ntb_hw_epf.c b/drivers/ntb/hw/epf/ntb_hw_epf.c
index 3ece49cb18ffa..9a0745664dcc7 100644
--- a/drivers/ntb/hw/epf/ntb_hw_epf.c
+++ b/drivers/ntb/hw/epf/ntb_hw_epf.c
@@ -49,6 +49,7 @@
#define NTB_EPF_COMMAND_TIMEOUT 1000 /* 1 Sec */
enum pci_barno {
+ NO_BAR = -1,
BAR_0,
BAR_1,
BAR_2,
@@ -57,16 +58,26 @@ enum pci_barno {
BAR_5,
};
+enum epf_ntb_bar {
+ BAR_CONFIG,
+ BAR_PEER_SPAD,
+ BAR_DB,
+ BAR_MW1,
+ BAR_MW2,
+ BAR_MW3,
+ BAR_MW4,
+ NTB_BAR_NUM,
+};
+
+#define NTB_EPF_MAX_MW_COUNT (NTB_BAR_NUM - BAR_MW1)
+
struct ntb_epf_dev {
struct ntb_dev ntb;
struct device *dev;
/* Mutex to protect providing commands to NTB EPF */
struct mutex cmd_lock;
- enum pci_barno ctrl_reg_bar;
- enum pci_barno peer_spad_reg_bar;
- enum pci_barno db_reg_bar;
- enum pci_barno mw_bar;
+ const enum pci_barno *barno_map;
unsigned int mw_count;
unsigned int spad_count;
@@ -85,17 +96,6 @@ struct ntb_epf_dev {
#define ntb_ndev(__ntb) container_of(__ntb, struct ntb_epf_dev, ntb)
-struct ntb_epf_data {
- /* BAR that contains both control region and self spad region */
- enum pci_barno ctrl_reg_bar;
- /* BAR that contains peer spad region */
- enum pci_barno peer_spad_reg_bar;
- /* BAR that contains Doorbell region and Memory window '1' */
- enum pci_barno db_reg_bar;
- /* BAR that contains memory windows*/
- enum pci_barno mw_bar;
-};
-
static int ntb_epf_send_command(struct ntb_epf_dev *ndev, u32 command,
u32 argument)
{
@@ -144,7 +144,7 @@ static int ntb_epf_mw_to_bar(struct ntb_epf_dev *ndev, int idx)
return -EINVAL;
}
- return idx + 2;
+ return ndev->barno_map[BAR_MW1 + idx];
}
static int ntb_epf_mw_count(struct ntb_dev *ntb, int pidx)
@@ -413,7 +413,9 @@ static int ntb_epf_mw_set_trans(struct ntb_dev *ntb, int pidx, int idx,
return -EINVAL;
}
- bar = idx + ndev->mw_bar;
+ bar = ntb_epf_mw_to_bar(ndev, idx);
+ if (bar < 0)
+ return bar;
mw_size = pci_resource_len(ntb->pdev, bar);
@@ -455,7 +457,9 @@ static int ntb_epf_peer_mw_get_addr(struct ntb_dev *ntb, int idx,
if (idx == 0)
offset = readl(ndev->ctrl_reg + NTB_EPF_MW1_OFFSET);
- bar = idx + ndev->mw_bar;
+ bar = ntb_epf_mw_to_bar(ndev, idx);
+ if (bar < 0)
+ return bar;
if (base)
*base = pci_resource_start(ndev->ntb.pdev, bar) + offset;
@@ -560,6 +564,11 @@ static int ntb_epf_init_dev(struct ntb_epf_dev *ndev)
ndev->mw_count = readl(ndev->ctrl_reg + NTB_EPF_MW_COUNT);
ndev->spad_count = readl(ndev->ctrl_reg + NTB_EPF_SPAD_COUNT);
+ if (ndev->mw_count > NTB_EPF_MAX_MW_COUNT) {
+ dev_err(dev, "Unsupported MW count: %u\n", ndev->mw_count);
+ return -EINVAL;
+ }
+
return 0;
}
@@ -596,14 +605,15 @@ static int ntb_epf_init_pci(struct ntb_epf_dev *ndev,
dev_warn(&pdev->dev, "Cannot DMA highmem\n");
}
- ndev->ctrl_reg = pci_iomap(pdev, ndev->ctrl_reg_bar, 0);
+ ndev->ctrl_reg = pci_iomap(pdev, ndev->barno_map[BAR_CONFIG], 0);
if (!ndev->ctrl_reg) {
ret = -EIO;
goto err_dma_mask;
}
- if (ndev->peer_spad_reg_bar) {
- ndev->peer_spad_reg = pci_iomap(pdev, ndev->peer_spad_reg_bar, 0);
+ if (ndev->barno_map[BAR_PEER_SPAD] != ndev->barno_map[BAR_CONFIG]) {
+ ndev->peer_spad_reg = pci_iomap(pdev,
+ ndev->barno_map[BAR_PEER_SPAD], 0);
if (!ndev->peer_spad_reg) {
ret = -EIO;
goto err_dma_mask;
@@ -614,7 +624,7 @@ static int ntb_epf_init_pci(struct ntb_epf_dev *ndev,
ndev->peer_spad_reg = ndev->ctrl_reg + spad_off + spad_sz;
}
- ndev->db_reg = pci_iomap(pdev, ndev->db_reg_bar, 0);
+ ndev->db_reg = pci_iomap(pdev, ndev->barno_map[BAR_DB], 0);
if (!ndev->db_reg) {
ret = -EIO;
goto err_dma_mask;
@@ -663,12 +673,7 @@ static void ntb_epf_cleanup_isr(struct ntb_epf_dev *ndev)
static int ntb_epf_pci_probe(struct pci_dev *pdev,
const struct pci_device_id *id)
{
- enum pci_barno peer_spad_reg_bar = BAR_1;
- enum pci_barno ctrl_reg_bar = BAR_0;
- enum pci_barno db_reg_bar = BAR_2;
- enum pci_barno mw_bar = BAR_2;
struct device *dev = &pdev->dev;
- struct ntb_epf_data *data;
struct ntb_epf_dev *ndev;
int ret;
@@ -679,18 +684,10 @@ static int ntb_epf_pci_probe(struct pci_dev *pdev,
if (!ndev)
return -ENOMEM;
- data = (struct ntb_epf_data *)id->driver_data;
- if (data) {
- peer_spad_reg_bar = data->peer_spad_reg_bar;
- ctrl_reg_bar = data->ctrl_reg_bar;
- db_reg_bar = data->db_reg_bar;
- mw_bar = data->mw_bar;
- }
+ ndev->barno_map = (const enum pci_barno *)id->driver_data;
+ if (!ndev->barno_map)
+ return -EINVAL;
- ndev->peer_spad_reg_bar = peer_spad_reg_bar;
- ndev->ctrl_reg_bar = ctrl_reg_bar;
- ndev->db_reg_bar = db_reg_bar;
- ndev->mw_bar = mw_bar;
ndev->dev = dev;
ntb_epf_init_struct(ndev, pdev);
@@ -734,30 +731,36 @@ static void ntb_epf_pci_remove(struct pci_dev *pdev)
ntb_epf_deinit_pci(ndev);
}
-static const struct ntb_epf_data j721e_data = {
- .ctrl_reg_bar = BAR_0,
- .peer_spad_reg_bar = BAR_1,
- .db_reg_bar = BAR_2,
- .mw_bar = BAR_2,
+static const enum pci_barno j721e_map[NTB_BAR_NUM] = {
+ [BAR_CONFIG] = BAR_0,
+ [BAR_PEER_SPAD] = BAR_1,
+ [BAR_DB] = BAR_2,
+ [BAR_MW1] = BAR_2,
+ [BAR_MW2] = BAR_3,
+ [BAR_MW3] = BAR_4,
+ [BAR_MW4] = BAR_5
};
-static const struct ntb_epf_data mx8_data = {
- .ctrl_reg_bar = BAR_0,
- .peer_spad_reg_bar = BAR_0,
- .db_reg_bar = BAR_2,
- .mw_bar = BAR_4,
+static const enum pci_barno mx8_map[NTB_BAR_NUM] = {
+ [BAR_CONFIG] = BAR_0,
+ [BAR_PEER_SPAD] = BAR_0,
+ [BAR_DB] = BAR_2,
+ [BAR_MW1] = BAR_4,
+ [BAR_MW2] = BAR_5,
+ [BAR_MW3] = NO_BAR,
+ [BAR_MW4] = NO_BAR
};
static const struct pci_device_id ntb_epf_pci_tbl[] = {
{
PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_J721E),
.class = PCI_CLASS_MEMORY_RAM << 8, .class_mask = 0xffff00,
- .driver_data = (kernel_ulong_t)&j721e_data,
+ .driver_data = (kernel_ulong_t)j721e_map,
},
{
PCI_DEVICE(PCI_VENDOR_ID_FREESCALE, 0x0809),
.class = PCI_CLASS_MEMORY_RAM << 8, .class_mask = 0xffff00,
- .driver_data = (kernel_ulong_t)&mx8_data,
+ .driver_data = (kernel_ulong_t)mx8_map,
},
{ },
};
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 290/568] 9p: fix /sys/fs/9p/caches overwriting itself
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (288 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 289/568] NTB: epf: Allow arbitrary BAR mapping Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 291/568] cpufreq: tegra186: Initialize all cores to max frequencies Greg Kroah-Hartman
` (284 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randall P. Embry, Dominique Martinet,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randall P. Embry <rpembry@gmail.com>
[ Upstream commit 86db0c32f16c5538ddb740f54669ace8f3a1f3d7 ]
caches_show() overwrote its buffer on each iteration,
so only the last cache tag was visible in sysfs output.
Properly append with snprintf(buf + count, …).
Signed-off-by: Randall P. Embry <rpembry@gmail.com>
Message-ID: <20250926-v9fs_misc-v1-2-a8b3907fc04d@codewreck.org>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/9p/v9fs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index 0129de2ea31ae..fc3dadbd2e11c 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -561,7 +561,7 @@ static ssize_t caches_show(struct kobject *kobj,
spin_lock(&v9fs_sessionlist_lock);
list_for_each_entry(v9ses, &v9fs_sessionlist, slist) {
if (v9ses->cachetag) {
- n = snprintf(buf, limit, "%s\n", v9ses->cachetag);
+ n = snprintf(buf + count, limit, "%s\n", v9ses->cachetag);
if (n < 0) {
count = n;
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 291/568] cpufreq: tegra186: Initialize all cores to max frequencies
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (289 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 290/568] 9p: fix /sys/fs/9p/caches overwriting itself Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 292/568] 9p: sysfs_init: dont hardcode error to ENOMEM Greg Kroah-Hartman
` (283 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mikko Perttunen, Aaron Kling,
Viresh Kumar, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Kling <webgeek1234@gmail.com>
[ Upstream commit ba6018929165fc914c665f071f8e8cdbac844a49 ]
During initialization, the EDVD_COREx_VOLT_FREQ registers for some cores
are still at reset values and not reflecting the actual frequency. This
causes get calls to fail. Set all cores to their respective max
frequency during probe to initialize the registers to working values.
Suggested-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/tegra186-cpufreq.c | 27 +++++++++++++++++++++------
1 file changed, 21 insertions(+), 6 deletions(-)
diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c
index ee57676bbee14..db27aa0e35074 100644
--- a/drivers/cpufreq/tegra186-cpufreq.c
+++ b/drivers/cpufreq/tegra186-cpufreq.c
@@ -132,13 +132,14 @@ static struct cpufreq_driver tegra186_cpufreq_driver = {
static struct cpufreq_frequency_table *init_vhint_table(
struct platform_device *pdev, struct tegra_bpmp *bpmp,
- struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id)
+ struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id,
+ int *num_rates)
{
struct cpufreq_frequency_table *table;
struct mrq_cpu_vhint_request req;
struct tegra_bpmp_message msg;
struct cpu_vhint_data *data;
- int err, i, j, num_rates = 0;
+ int err, i, j;
dma_addr_t phys;
void *virt;
@@ -168,6 +169,7 @@ static struct cpufreq_frequency_table *init_vhint_table(
goto free;
}
+ *num_rates = 0;
for (i = data->vfloor; i <= data->vceil; i++) {
u16 ndiv = data->ndiv[i];
@@ -178,10 +180,10 @@ static struct cpufreq_frequency_table *init_vhint_table(
if (i > 0 && ndiv == data->ndiv[i - 1])
continue;
- num_rates++;
+ (*num_rates)++;
}
- table = devm_kcalloc(&pdev->dev, num_rates + 1, sizeof(*table),
+ table = devm_kcalloc(&pdev->dev, *num_rates + 1, sizeof(*table),
GFP_KERNEL);
if (!table) {
table = ERR_PTR(-ENOMEM);
@@ -223,7 +225,9 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev)
{
struct tegra186_cpufreq_data *data;
struct tegra_bpmp *bpmp;
- unsigned int i = 0, err;
+ unsigned int i = 0, err, edvd_offset;
+ int num_rates = 0;
+ u32 edvd_val, cpu;
data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
if (!data)
@@ -249,10 +253,21 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev)
for (i = 0; i < TEGRA186_NUM_CLUSTERS; i++) {
struct tegra186_cpufreq_cluster *cluster = &data->clusters[i];
- cluster->table = init_vhint_table(pdev, bpmp, cluster, i);
+ cluster->table = init_vhint_table(pdev, bpmp, cluster, i, &num_rates);
if (IS_ERR(cluster->table)) {
err = PTR_ERR(cluster->table);
goto put_bpmp;
+ } else if (!num_rates) {
+ err = -EINVAL;
+ goto put_bpmp;
+ }
+
+ for (cpu = 0; cpu < ARRAY_SIZE(tegra186_cpus); cpu++) {
+ if (data->cpus[cpu].bpmp_cluster_id == i) {
+ edvd_val = cluster->table[num_rates - 1].driver_data;
+ edvd_offset = data->cpus[cpu].edvd_offset;
+ writel(edvd_val, data->regs + edvd_offset);
+ }
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 292/568] 9p: sysfs_init: dont hardcode error to ENOMEM
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (290 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 291/568] cpufreq: tegra186: Initialize all cores to max frequencies Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 293/568] scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS Greg Kroah-Hartman
` (282 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randall P. Embry, Dominique Martinet,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randall P. Embry <rpembry@gmail.com>
[ Upstream commit 528f218b31aac4bbfc58914d43766a22ab545d48 ]
v9fs_sysfs_init() always returned -ENOMEM on failure;
return the actual sysfs_create_group() error instead.
Signed-off-by: Randall P. Embry <rpembry@gmail.com>
Message-ID: <20250926-v9fs_misc-v1-3-a8b3907fc04d@codewreck.org>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/9p/v9fs.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index fc3dadbd2e11c..2a6988db807b3 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -597,13 +597,16 @@ static const struct attribute_group v9fs_attr_group = {
static int __init v9fs_sysfs_init(void)
{
+ int ret;
+
v9fs_kobj = kobject_create_and_add("9p", fs_kobj);
if (!v9fs_kobj)
return -ENOMEM;
- if (sysfs_create_group(v9fs_kobj, &v9fs_attr_group)) {
+ ret = sysfs_create_group(v9fs_kobj, &v9fs_attr_group);
+ if (ret) {
kobject_put(v9fs_kobj);
- return -ENOMEM;
+ return ret;
}
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 293/568] scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (291 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 292/568] 9p: sysfs_init: dont hardcode error to ENOMEM Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 294/568] ACPI: property: Return present device nodes only on fwnode interface Greg Kroah-Hartman
` (281 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hoyoung Seo, Bart Van Assche,
Martin K. Petersen, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hoyoung Seo <hy50.seo@samsung.com>
[ Upstream commit 558ae4579810fa0fef011944230c65a6f3087f85 ]
When a UTP error occurs in isolation, UFS is not currently recoverable.
This is because the UTP error is not considered fatal in the error
handling code, leading to either an I/O timeout or an OCS error.
Add the UTP error flag to INT_FATAL_ERRORS so the controller will be
reset in this situation.
sd 0:0:0:0: [sda] tag#38 UNKNOWN(0x2003) Result: hostbyte=0x07
driverbyte=DRIVER_OK cmd_age=0s
sd 0:0:0:0: [sda] tag#38 CDB: opcode=0x28 28 00 00 51 24 e2 00 00 08 00
I/O error, dev sda, sector 42542864 op 0x0:(READ) flags 0x80700 phys_seg
8 prio class 2
OCS error from controller = 9 for tag 39
pa_err[1] = 0x80000010 at 2667224756 us
pa_err: total cnt=2
dl_err[0] = 0x80000002 at 2667148060 us
dl_err[1] = 0x80002000 at 2667282844 us
No record of nl_err
No record of tl_err
No record of dme_err
No record of auto_hibern8_err
fatal_err[0] = 0x804 at 2667282836 us
---------------------------------------------------
REGISTER
---------------------------------------------------
NAME OFFSET VALUE
STD HCI SFR 0xfffffff0 0x0
AHIT 0x18 0x814
INTERRUPT STATUS 0x20 0x1000
INTERRUPT ENABLE 0x24 0x70ef5
[mkp: commit desc]
Signed-off-by: Hoyoung Seo <hy50.seo@samsung.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Message-Id: <20250930061428.617955-1-hy50.seo@samsung.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/ufs/ufshci.h | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/include/ufs/ufshci.h b/include/ufs/ufshci.h
index f525566a0864d..6e80ed46e44ae 100644
--- a/include/ufs/ufshci.h
+++ b/include/ufs/ufshci.h
@@ -123,6 +123,7 @@ static inline u32 ufshci_version(u32 major, u32 minor)
#define UTP_TASK_REQ_COMPL 0x200
#define UIC_COMMAND_COMPL 0x400
#define DEVICE_FATAL_ERROR 0x800
+#define UTP_ERROR 0x1000
#define CONTROLLER_FATAL_ERROR 0x10000
#define SYSTEM_BUS_FATAL_ERROR 0x20000
#define CRYPTO_ENGINE_FATAL_ERROR 0x40000
@@ -141,7 +142,8 @@ static inline u32 ufshci_version(u32 major, u32 minor)
CONTROLLER_FATAL_ERROR |\
SYSTEM_BUS_FATAL_ERROR |\
CRYPTO_ENGINE_FATAL_ERROR |\
- UIC_LINK_LOST)
+ UIC_LINK_LOST |\
+ UTP_ERROR)
/* HCS - Host Controller Status 30h */
#define DEVICE_PRESENT 0x1
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 294/568] ACPI: property: Return present device nodes only on fwnode interface
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (292 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 293/568] scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 295/568] tools bitmap: Add missing asm-generic/bitsperlong.h include Greg Kroah-Hartman
` (280 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sakari Ailus, Laurent Pinchart,
Jonathan Cameron, Rafael J. Wysocki, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <sakari.ailus@linux.intel.com>
[ Upstream commit d9f866b2bb3eec38b3734f1fed325ec7c55ccdfa ]
fwnode_graph_get_next_subnode() may return fwnode backed by ACPI
device nodes and there has been no check these devices are present
in the system, unlike there has been on fwnode OF backend.
In order to provide consistent behaviour towards callers,
add a check for device presence by introducing
a new function acpi_get_next_present_subnode(), used as the
get_next_child_node() fwnode operation that also checks device
node presence.
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20251001102636.1272722-2-sakari.ailus@linux.intel.com
[ rjw: Kerneldoc comment and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/property.c | 24 +++++++++++++++++++++++-
1 file changed, 23 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index 46003b642b597..9f7880cc2bd8c 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -1298,6 +1298,28 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode,
return NULL;
}
+/*
+ * acpi_get_next_present_subnode - Return the next present child node handle
+ * @fwnode: Firmware node to find the next child node for.
+ * @child: Handle to one of the device's child nodes or a null handle.
+ *
+ * Like acpi_get_next_subnode(), but the device nodes returned by
+ * acpi_get_next_present_subnode() are guaranteed to be present.
+ *
+ * Returns: The fwnode handle of the next present sub-node.
+ */
+static struct fwnode_handle *
+acpi_get_next_present_subnode(const struct fwnode_handle *fwnode,
+ struct fwnode_handle *child)
+{
+ do {
+ child = acpi_get_next_subnode(fwnode, child);
+ } while (is_acpi_device_node(child) &&
+ !acpi_device_is_present(to_acpi_device_node(child)));
+
+ return child;
+}
+
/**
* acpi_node_get_parent - Return parent fwnode of this fwnode
* @fwnode: Firmware node whose parent to get
@@ -1641,7 +1663,7 @@ static int acpi_fwnode_irq_get(const struct fwnode_handle *fwnode,
.property_read_string_array = \
acpi_fwnode_property_read_string_array, \
.get_parent = acpi_node_get_parent, \
- .get_next_child_node = acpi_get_next_subnode, \
+ .get_next_child_node = acpi_get_next_present_subnode, \
.get_named_child_node = acpi_fwnode_get_named_child_node, \
.get_name = acpi_fwnode_get_name, \
.get_name_prefix = acpi_fwnode_get_name_prefix, \
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 295/568] tools bitmap: Add missing asm-generic/bitsperlong.h include
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (293 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 294/568] ACPI: property: Return present device nodes only on fwnode interface Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 296/568] tools: lib: thermal: dont preserve owner in install Greg Kroah-Hartman
` (279 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Yury Norov,
Adrian Hunter, Alexander Shishkin, André Almeida,
Daniel Borkmann, Darren Hart, David S. Miller, Davidlohr Bueso,
Ido Schimmel, Ingo Molnar, Jakub Kicinski, Jamal Hadi Salim,
Jason Xing, Jiri Olsa, Jonas Gottlieb, Kan Liang, Mark Rutland,
Maurice Lambert, Namhyung Kim, Paolo Abeni, Peter Zijlstra,
Petr Machata, Rasmus Villemoes, Thomas Gleixner, Yuyang Huang,
Arnaldo Carvalho de Melo, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit f38ce0209ab4553906b44bd1159e35c740a84161 ]
small_const_nbits is defined in asm-generic/bitsperlong.h which
bitmap.h uses but doesn't include causing build failures in some build
systems. Add the missing #include.
Note the bitmap.h in tools has diverged from that of the kernel, so no
changes are made there.
Signed-off-by: Ian Rogers <irogers@google.com>
Acked-by: Yury Norov <yury.norov@gmail.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: André Almeida <andrealmeid@igalia.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Darren Hart <dvhart@infradead.org>
Cc: David S. Miller <davem@davemloft.net>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Ido Schimmel <idosch@nvidia.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jason Xing <kerneljasonxing@gmail.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Jonas Gottlieb <jonas.gottlieb@stackit.cloud>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Maurice Lambert <mauricelambert434@gmail.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Petr Machata <petrm@nvidia.com>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Yuyang Huang <yuyanghuang@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/include/linux/bitmap.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h
index 2cbabc1dcf0fd..937e1e181775f 100644
--- a/tools/include/linux/bitmap.h
+++ b/tools/include/linux/bitmap.h
@@ -3,6 +3,7 @@
#define _TOOLS_LINUX_BITMAP_H
#include <string.h>
+#include <asm-generic/bitsperlong.h>
#include <linux/align.h>
#include <linux/bitops.h>
#include <linux/find.h>
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 296/568] tools: lib: thermal: dont preserve owner in install
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (294 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 295/568] tools bitmap: Add missing asm-generic/bitsperlong.h include Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 6.1 297/568] tools: lib: thermal: use pkg-config to locate libnl3 Greg Kroah-Hartman
` (278 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Emil Dahl Juhl, Sascha Hauer,
Daniel Lezcano, Rafael J. Wysocki, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emil Dahl Juhl <juhl.emildahl@gmail.com>
[ Upstream commit 1375152bb02ab2a8435e87ea27034482dbc95f57 ]
Instead of preserving mode, timestamp, and owner, for the object files
during installation, just preserve the mode and timestamp.
When installing as root, the installed files should be owned by root.
When installing as user, --preserve=ownership doesn't work anyway. This
makes --preserve=ownership rather pointless.
Signed-off-by: Emil Dahl Juhl <juhl.emildahl@gmail.com>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/thermal/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/lib/thermal/Makefile b/tools/lib/thermal/Makefile
index 8890fd57b110c..1694889847caf 100644
--- a/tools/lib/thermal/Makefile
+++ b/tools/lib/thermal/Makefile
@@ -147,7 +147,7 @@ endef
install_lib: libs
$(call QUIET_INSTALL, $(LIBTHERMAL_ALL)) \
$(call do_install_mkdir,$(libdir_SQ)); \
- cp -fpR $(LIBTHERMAL_ALL) $(DESTDIR)$(libdir_SQ)
+ cp -fR --preserve=mode,timestamp $(LIBTHERMAL_ALL) $(DESTDIR)$(libdir_SQ)
install_headers:
$(call QUIET_INSTALL, headers) \
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 297/568] tools: lib: thermal: use pkg-config to locate libnl3
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (295 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 296/568] tools: lib: thermal: dont preserve owner in install Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 298/568] fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Greg Kroah-Hartman
` (277 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sascha Hauer, Daniel Lezcano,
Rafael J. Wysocki, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sascha Hauer <s.hauer@pengutronix.de>
[ Upstream commit b31f7f725cd932e2c2b41f3e4b66273653953687 ]
To make libthermal more cross compile friendly use pkg-config to locate
libnl3. Only if that fails fall back to hardcoded /usr/include/libnl3.
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/thermal/Makefile | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/tools/lib/thermal/Makefile b/tools/lib/thermal/Makefile
index 1694889847caf..8d21ea1950a31 100644
--- a/tools/lib/thermal/Makefile
+++ b/tools/lib/thermal/Makefile
@@ -59,8 +59,12 @@ else
CFLAGS := -g -Wall
endif
+NL3_CFLAGS = $(shell pkg-config --cflags libnl-3.0 2>/dev/null)
+ifeq ($(NL3_CFLAGS),)
+NL3_CFLAGS = -I/usr/include/libnl3
+endif
+
INCLUDES = \
--I/usr/include/libnl3 \
-I$(srctree)/tools/lib/thermal/include \
-I$(srctree)/tools/lib/ \
-I$(srctree)/tools/include \
@@ -72,6 +76,7 @@ INCLUDES = \
override CFLAGS += $(EXTRA_WARNINGS)
override CFLAGS += -Werror -Wall
override CFLAGS += -fPIC
+override CFLAGS += $(NL3_CFLAGS)
override CFLAGS += $(INCLUDES)
override CFLAGS += -fvisibility=hidden
override CFGLAS += -Wl,-L.
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 298/568] fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (296 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 6.1 297/568] tools: lib: thermal: use pkg-config to locate libnl3 Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 299/568] kbuild: uapi: Strip comments before size type check Greg Kroah-Hartman
` (276 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+48b0652a95834717f190,
Helge Deller, Albin Babu Varghese, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
[ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ]
Add bounds checking to prevent writes past framebuffer boundaries when
rendering text near screen edges. Return early if the Y position is off-screen
and clip image height to screen boundary. Break from the rendering loop if the
X position is off-screen. When clipping image width to fit the screen, update
the character count to match the clipped width to prevent buffer size
mismatches.
Without the character count update, bit_putcs_aligned and bit_putcs_unaligned
receive mismatched parameters where the buffer is allocated for the clipped
width but cnt reflects the original larger count, causing out-of-bounds writes.
Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190
Suggested-by: Helge Deller <deller@gmx.de>
Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
Signed-off-by: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
index a4b4e1ec702e5..8563264d11fac 100644
--- a/drivers/video/fbdev/core/bitblit.c
+++ b/drivers/video/fbdev/core/bitblit.c
@@ -168,6 +168,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
image.height = vc->vc_font.height;
image.depth = 1;
+ if (image.dy >= info->var.yres)
+ return;
+
+ image.height = min(image.height, info->var.yres - image.dy);
+
if (attribute) {
buf = kmalloc(cellsize, GFP_ATOMIC);
if (!buf)
@@ -181,6 +186,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
cnt = count;
image.width = vc->vc_font.width * cnt;
+
+ if (image.dx >= info->var.xres)
+ break;
+
+ if (image.dx + image.width > info->var.xres) {
+ image.width = info->var.xres - image.dx;
+ cnt = image.width / vc->vc_font.width;
+ if (cnt == 0)
+ break;
+ image.width = cnt * vc->vc_font.width;
+ }
+
pitch = DIV_ROUND_UP(image.width, 8) + scan_align;
pitch &= ~scan_align;
size = pitch * image.height + buf_align;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 299/568] kbuild: uapi: Strip comments before size type check
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (297 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 298/568] fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 300/568] ASoC: meson: aiu-encoder-i2s: fix bit clock polarity Greg Kroah-Hartman
` (275 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven,
Thomas Weißschuh, Nathan Chancellor, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert@linux-m68k.org>
[ Upstream commit 66128f4287b04aef4d4db9bf5035985ab51487d5 ]
On m68k, check_sizetypes in headers_check reports:
./usr/include/asm/bootinfo-amiga.h:17: found __[us]{8,16,32,64} type without #include <linux/types.h>
This header file does not use any of the Linux-specific integer types,
but merely refers to them from comments, so this is a false positive.
As of commit c3a9d74ee413bdb3 ("kbuild: uapi: upgrade check_sizetypes()
warning to error"), this check was promoted to an error, breaking m68k
all{mod,yes}config builds.
Fix this by stripping simple comments before looking for Linux-specific
integer types.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Link: https://patch.msgid.link/949f096337e28d50510e970ae3ba3ec9c1342ec0.1759753998.git.geert@linux-m68k.org
[nathan: Adjust comment and remove unnecessary escaping from slashes in
regex]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
| 2 ++
1 file changed, 2 insertions(+)
--git a/usr/include/headers_check.pl b/usr/include/headers_check.pl
index b6aec5e4365f9..682980781eb37 100755
--- a/usr/include/headers_check.pl
+++ b/usr/include/headers_check.pl
@@ -160,6 +160,8 @@ sub check_sizetypes
if (my $included = ($line =~ /^\s*#\s*include\s+[<"](\S+)[>"]/)[0]) {
check_include_typesh($included);
}
+ # strip single-line comments, as types may be referenced within them
+ $line =~ s@/\*.*?\*/@@;
if ($line =~ m/__[us](8|16|32|64)\b/) {
printf STDERR "$filename:$lineno: " .
"found __[us]{8,16,32,64} type " .
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 300/568] ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (298 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 299/568] kbuild: uapi: Strip comments before size type check Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 301/568] ceph: add checking of wait_for_completion_killable() return value Greg Kroah-Hartman
` (274 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Valerio Setti, Jerome Brunet,
Mark Brown, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Valerio Setti <vsetti@baylibre.com>
[ Upstream commit 4c4ed5e073a923fb3323022e1131cb51ad8df7a0 ]
According to I2S specs audio data is sampled on the rising edge of the
clock and it can change on the falling one. When operating in normal mode
this SoC behaves the opposite so a clock polarity inversion is required
in this case.
This was tested on an OdroidC2 (Amlogic S905 SoC) board.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
Tested-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://patch.msgid.link/20251007-fix-i2s-polarity-v1-1-86704d9cda10@baylibre.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/meson/aiu-encoder-i2s.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/sound/soc/meson/aiu-encoder-i2s.c b/sound/soc/meson/aiu-encoder-i2s.c
index a0dd914c8ed13..3b4061508c180 100644
--- a/sound/soc/meson/aiu-encoder-i2s.c
+++ b/sound/soc/meson/aiu-encoder-i2s.c
@@ -236,8 +236,12 @@ static int aiu_encoder_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
inv == SND_SOC_DAIFMT_IB_IF)
val |= AIU_CLK_CTRL_LRCLK_INVERT;
- if (inv == SND_SOC_DAIFMT_IB_NF ||
- inv == SND_SOC_DAIFMT_IB_IF)
+ /*
+ * The SoC changes data on the rising edge of the bitclock
+ * so an inversion of the bitclock is required in normal mode
+ */
+ if (inv == SND_SOC_DAIFMT_NB_NF ||
+ inv == SND_SOC_DAIFMT_NB_IF)
val |= AIU_CLK_CTRL_AOCLK_INVERT;
/* Signal skew */
@@ -328,4 +332,3 @@ const struct snd_soc_dai_ops aiu_encoder_i2s_dai_ops = {
.startup = aiu_encoder_i2s_startup,
.shutdown = aiu_encoder_i2s_shutdown,
};
-
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 301/568] ceph: add checking of wait_for_completion_killable() return value
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (299 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 300/568] ASoC: meson: aiu-encoder-i2s: fix bit clock polarity Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 302/568] ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again Greg Kroah-Hartman
` (273 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Viacheslav Dubeyko, Alex Markuze,
Ilya Dryomov, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
[ Upstream commit b7ed1e29cfe773d648ca09895b92856bd3a2092d ]
The Coverity Scan service has detected the calling of
wait_for_completion_killable() without checking the return
value in ceph_lock_wait_for_completion() [1]. The CID 1636232
defect contains explanation: "If the function returns an error
value, the error value may be mistaken for a normal value.
In ceph_lock_wait_for_completion(): Value returned from
a function is not checked for errors before being used. (CWE-252)".
The patch adds the checking of wait_for_completion_killable()
return value and return the error code from
ceph_lock_wait_for_completion().
[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1636232
Signed-off-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/locks.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c
index b191426bf880c..3da9e53f80918 100644
--- a/fs/ceph/locks.c
+++ b/fs/ceph/locks.c
@@ -202,7 +202,10 @@ static int ceph_lock_wait_for_completion(struct ceph_mds_client *mdsc,
if (err && err != -ERESTARTSYS)
return err;
- wait_for_completion_killable(&req->r_safe_completion);
+ err = wait_for_completion_killable(&req->r_safe_completion);
+ if (err)
+ return err;
+
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 302/568] ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (300 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 301/568] ceph: add checking of wait_for_completion_killable() return value Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 303/568] Revert "wifi: ath10k: avoid unnecessary wait for service ready message" Greg Kroah-Hartman
` (272 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kailang Yang, Takashi Iwai,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <kailang@realtek.com>
[ Upstream commit f4b3cef55f5f96fdb4e7f9ca90b7d6213689faeb ]
There was a similar bug in the past (Bug 217440), which was fixed for
this laptop.
The same issue is occurring again as of kernel v.6.12.2. The symptoms
are very similar - initially audio works but after a warm reboot, the
audio completely disappears until the computer is powered off (there
is no audio output at all).
The issue is also related by caused by a different change now. By
bisecting different kernel versions, I found that reverting
cc3d0b5dd989 in patch_realtek.c[*] restores the sound and it works
fine after the reboot.
[*] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/sound/pci/hda/patch_realtek.c?h=v6.12.2&id=4ed7f16070a8475c088ff423b2eb11ba15eb89b6
[ patch description reformatted by tiwai ]
Fixes: cc3d0b5dd989 ("ALSA: hda/realtek: Update ALC256 depop procedure")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=220109
Signed-off-by: Kailang Yang <kailang@realtek.com>
Link: https://lore.kernel.org/5317ca723c82447a938414fcca85cbf5@realtek.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/patch_realtek.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index fcc22aa991748..ccbdb01ab6ece 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3641,6 +3641,15 @@ static void alc256_shutup(struct hda_codec *codec)
hp_pin = 0x21;
alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x1); /* Low power */
+
+ /* 3k pull low control for Headset jack. */
+ /* NOTE: call this before clearing the pin, otherwise codec stalls */
+ /* If disable 3k pulldown control for alc257, the Mic detection will not work correctly
+ * when booting with headset plugged. So skip setting it for the codec alc257
+ */
+ if (spec->en_3kpull_low)
+ alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
+
hp_pin_sense = snd_hda_jack_detect(codec, hp_pin);
if (hp_pin_sense) {
@@ -3651,14 +3660,6 @@ static void alc256_shutup(struct hda_codec *codec)
msleep(75);
- /* 3k pull low control for Headset jack. */
- /* NOTE: call this before clearing the pin, otherwise codec stalls */
- /* If disable 3k pulldown control for alc257, the Mic detection will not work correctly
- * when booting with headset plugged. So skip setting it for the codec alc257
- */
- if (spec->en_3kpull_low)
- alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
-
if (!spec->no_shutup_pins)
snd_hda_codec_write(codec, hp_pin, 0,
AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 303/568] Revert "wifi: ath10k: avoid unnecessary wait for service ready message"
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (301 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 302/568] ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 304/568] Bluetooth: hci_event: validate skb length for unknown CC opcode Greg Kroah-Hartman
` (271 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baochen Qiang,
Vasanthakumar Thiagarajan, Jeff Johnson
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
commit 2469bb6a6af944755a7d7daf66be90f3b8decbf9 upstream.
This reverts commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a.
Although this commit benefits QCA6174, it breaks QCA988x and
QCA9984 [1][2]. Since it is not likely to root cause/fix this
issue in a short time, revert it to get those chips back.
Compile tested only.
Fixes: 51a73f1b2e56 ("wifi: ath10k: avoid unnecessary wait for service ready message")
Link: https://lore.kernel.org/ath10k/6d41bc00602c33ffbf68781f563ff2e6c6915a3e.camel@gmail.com # [1]
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220671 # [2]
Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251027-ath10k-revert-polling-first-change-v1-1-89aaf3bcbfa1@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++++++-----------------
1 file changed, 20 insertions(+), 19 deletions(-)
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -1762,32 +1762,33 @@ void ath10k_wmi_put_wmi_channel(struct a
int ath10k_wmi_wait_for_service_ready(struct ath10k *ar)
{
- unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ;
unsigned long time_left, i;
- /* Sometimes the PCI HIF doesn't receive interrupt
- * for the service ready message even if the buffer
- * was completed. PCIe sniffer shows that it's
- * because the corresponding CE ring doesn't fires
- * it. Workaround here by polling CE rings. Since
- * the message could arrive at any time, continue
- * polling until timeout.
- */
- do {
+ time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
+ WMI_SERVICE_READY_TIMEOUT_HZ);
+ if (!time_left) {
+ /* Sometimes the PCI HIF doesn't receive interrupt
+ * for the service ready message even if the buffer
+ * was completed. PCIe sniffer shows that it's
+ * because the corresponding CE ring doesn't fires
+ * it. Workaround here by polling CE rings once.
+ */
+ ath10k_warn(ar, "failed to receive service ready completion, polling..\n");
+
for (i = 0; i < CE_COUNT; i++)
ath10k_hif_send_complete_check(ar, i, 1);
- /* The 100 ms granularity is a tradeoff considering scheduler
- * overhead and response latency
- */
time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
- msecs_to_jiffies(100));
- if (time_left)
- return 0;
- } while (time_before(jiffies, timeout));
+ WMI_SERVICE_READY_TIMEOUT_HZ);
+ if (!time_left) {
+ ath10k_warn(ar, "polling timed out\n");
+ return -ETIMEDOUT;
+ }
+
+ ath10k_warn(ar, "service ready completion received, continuing normally\n");
+ }
- ath10k_warn(ar, "failed to receive service ready completion\n");
- return -ETIMEDOUT;
+ return 0;
}
int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar)
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 304/568] Bluetooth: hci_event: validate skb length for unknown CC opcode
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (302 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 303/568] Revert "wifi: ath10k: avoid unnecessary wait for service ready message" Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 305/568] net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx Greg Kroah-Hartman
` (270 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+a9a4bedfca6aa9d7fa24,
Raphael Pinsonneault-Thibeault, Luiz Augusto von Dentz,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
[ Upstream commit 5c5f1f64681cc889d9b13e4a61285e9e029d6ab5 ]
In hci_cmd_complete_evt(), if the command complete event has an unknown
opcode, we assume the first byte of the remaining skb->data contains the
return status. However, parameter data has previously been pulled in
hci_event_func(), which may leave the skb empty. If so, using skb->data[0]
for the return status uses un-init memory.
The fix is to check skb->len before using skb->data.
Reported-by: syzbot+a9a4bedfca6aa9d7fa24@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a9a4bedfca6aa9d7fa24
Tested-by: syzbot+a9a4bedfca6aa9d7fa24@syzkaller.appspotmail.com
Fixes: afcb3369f46ed ("Bluetooth: hci_event: Fix vendor (unknown) opcode status handling")
Signed-off-by: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_event.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index e516b169b12fb..f713a9a27e934 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4224,6 +4224,13 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, void *data,
}
if (i == ARRAY_SIZE(hci_cc_table)) {
+ if (!skb->len) {
+ bt_dev_err(hdev, "Unexpected cc 0x%4.4x with no status",
+ *opcode);
+ *status = HCI_ERROR_UNSPECIFIED;
+ return;
+ }
+
/* Unknown opcode, assume byte 0 contains the status, so
* that e.g. __hci_cmd_sync() properly returns errors
* for vendor specific commands send by HCI drivers.
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 305/568] net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (303 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 304/568] Bluetooth: hci_event: validate skb length for unknown CC opcode Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 306/568] selftests/net: fix out-of-order delivery of FIN in gro:tcp test Greg Kroah-Hartman
` (269 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonas Gorski, Vladimir Oltean,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit 3d18a84eddde169d6dbf3c72cc5358b988c347d0 ]
The internal switch on BCM63XX SoCs will unconditionally add 802.1Q VLAN
tags on egress to CPU when 802.1Q mode is enabled. We do this
unconditionally since commit ed409f3bbaa5 ("net: dsa: b53: Configure
VLANs while not filtering").
This is fine for VLAN aware bridges, but for standalone ports and vlan
unaware bridges this means all packets are tagged with the default VID,
which is 0.
While the kernel will treat that like untagged, this can break userspace
applications processing raw packets, expecting untagged traffic, like
STP daemons.
This also breaks several bridge tests, where the tcpdump output then
does not match the expected output anymore.
Since 0 isn't a valid VID, just strip out the VLAN tag if we encounter
it, unless the priority field is set, since that would be a valid tag
again.
Fixes: 964dbf186eaa ("net: dsa: tag_brcm: add support for legacy tags")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Link: https://patch.msgid.link/20251027194621.133301-1-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/dsa/tag_brcm.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/net/dsa/tag_brcm.c b/net/dsa/tag_brcm.c
index 04b57534fe4de..cd07ae440d69d 100644
--- a/net/dsa/tag_brcm.c
+++ b/net/dsa/tag_brcm.c
@@ -251,12 +251,14 @@ static struct sk_buff *brcm_leg_tag_rcv(struct sk_buff *skb,
{
int len = BRCM_LEG_TAG_LEN;
int source_port;
+ __be16 *proto;
u8 *brcm_tag;
if (unlikely(!pskb_may_pull(skb, BRCM_LEG_TAG_LEN + VLAN_HLEN)))
return NULL;
brcm_tag = dsa_etype_header_pos_rx(skb);
+ proto = (__be16 *)(brcm_tag + BRCM_LEG_TAG_LEN);
source_port = brcm_tag[5] & BRCM_LEG_PORT_ID;
@@ -264,8 +266,12 @@ static struct sk_buff *brcm_leg_tag_rcv(struct sk_buff *skb,
if (!skb->dev)
return NULL;
- /* VLAN tag is added by BCM63xx internal switch */
- if (netdev_uses_dsa(skb->dev))
+ /* The internal switch in BCM63XX SoCs always tags on egress on the CPU
+ * port. We use VID 0 internally for untagged traffic, so strip the tag
+ * if the TCI field is all 0, and keep it otherwise to also retain
+ * e.g. 802.1p tagged packets.
+ */
+ if (proto[0] == htons(ETH_P_8021Q) && proto[1] == 0)
len += VLAN_HLEN;
/* Remove Broadcom tag and update checksum */
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 306/568] selftests/net: fix out-of-order delivery of FIN in gro:tcp test
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (304 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 305/568] net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 307/568] selftests/net: fix GRO coalesce test and add ext header coalesce tests Greg Kroah-Hartman
` (268 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Willem de Bruijn, Anubhav Singh,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anubhav Singh <anubhavsinggh@google.com>
[ Upstream commit 02d064de05b1fcca769391fa82d205bed8bb9bf0 ]
Due to the gro_sender sending data packets and FIN packets
in very quick succession, these are received almost simultaneously
by the gro_receiver. FIN packets are sometimes processed before the
data packets leading to intermittent (~1/100) test failures.
This change adds a delay of 100ms before sending FIN packets
in gro:tcp test to avoid the out-of-order delivery. The same
mitigation already exists for the gro:ip test.
Fixes: 7d1575014a63 ("selftests/net: GRO coalesce test")
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Anubhav Singh <anubhavsinggh@google.com>
Link: https://patch.msgid.link/20251030062818.1562228-1-anubhavsinggh@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/gro.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/tools/testing/selftests/net/gro.c b/tools/testing/selftests/net/gro.c
index 30024d0ed3739..ad7b07084ca24 100644
--- a/tools/testing/selftests/net/gro.c
+++ b/tools/testing/selftests/net/gro.c
@@ -802,6 +802,7 @@ static void check_recv_pkts(int fd, int *correct_payload,
static void gro_sender(void)
{
+ const int fin_delay_us = 100 * 1000;
static char fin_pkt[MAX_HDR_LEN];
struct sockaddr_ll daddr = {};
int txfd = -1;
@@ -845,15 +846,22 @@ static void gro_sender(void)
write_packet(txfd, fin_pkt, total_hdr_len, &daddr);
} else if (strcmp(testname, "tcp") == 0) {
send_changed_checksum(txfd, &daddr);
+ /* Adding sleep before sending FIN so that it is not
+ * received prior to other packets.
+ */
+ usleep(fin_delay_us);
write_packet(txfd, fin_pkt, total_hdr_len, &daddr);
send_changed_seq(txfd, &daddr);
+ usleep(fin_delay_us);
write_packet(txfd, fin_pkt, total_hdr_len, &daddr);
send_changed_ts(txfd, &daddr);
+ usleep(fin_delay_us);
write_packet(txfd, fin_pkt, total_hdr_len, &daddr);
send_diff_opt(txfd, &daddr);
+ usleep(fin_delay_us);
write_packet(txfd, fin_pkt, total_hdr_len, &daddr);
} else if (strcmp(testname, "ip") == 0) {
send_changed_ECN(txfd, &daddr);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 307/568] selftests/net: fix GRO coalesce test and add ext header coalesce tests
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (305 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 306/568] selftests/net: fix out-of-order delivery of FIN in gro:tcp test Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 308/568] selftests/net: use destination options instead of hop-by-hop Greg Kroah-Hartman
` (267 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Gobert, Willem de Bruijn,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Gobert <richardbgobert@gmail.com>
[ Upstream commit 4e321d590cec6053cb3c566413794706035ee638 ]
Currently there is no test which checks that IPv6 extension header packets
successfully coalesce. This commit adds a test, which verifies two IPv6
packets with HBH extension headers do coalesce, and another test which
checks that packets with different extension header data do not coalesce
in GRO.
I changed the receive socket filter to accept a packet with one extension
header. This change exposed a bug in the fragment test -- the old BPF did
not accept the fragment packet. I updated correct_num_packets in the
fragment test accordingly.
Signed-off-by: Richard Gobert <richardbgobert@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/r/69282fed-2415-47e8-b3d3-34939ec3eb56@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: f8e8486702ab ("selftests/net: use destination options instead of hop-by-hop")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/gro.c | 93 +++++++++++++++++++++++++++++--
1 file changed, 87 insertions(+), 6 deletions(-)
diff --git a/tools/testing/selftests/net/gro.c b/tools/testing/selftests/net/gro.c
index ad7b07084ca24..9c6f5b4033c37 100644
--- a/tools/testing/selftests/net/gro.c
+++ b/tools/testing/selftests/net/gro.c
@@ -71,6 +71,12 @@
#define MAX_PAYLOAD (IP_MAXPACKET - sizeof(struct tcphdr) - sizeof(struct ipv6hdr))
#define NUM_LARGE_PKT (MAX_PAYLOAD / MSS)
#define MAX_HDR_LEN (ETH_HLEN + sizeof(struct ipv6hdr) + sizeof(struct tcphdr))
+#define MIN_EXTHDR_SIZE 8
+#define EXT_PAYLOAD_1 "\x00\x00\x00\x00\x00\x00"
+#define EXT_PAYLOAD_2 "\x11\x11\x11\x11\x11\x11"
+
+#define ipv6_optlen(p) (((p)->hdrlen+1) << 3) /* calculate IPv6 extension header len */
+#define BUILD_BUG_ON(condition) ((void)sizeof(char[1 - 2*!!(condition)]))
static const char *addr6_src = "fdaa::2";
static const char *addr6_dst = "fdaa::1";
@@ -104,7 +110,7 @@ static void setup_sock_filter(int fd)
const int dport_off = tcp_offset + offsetof(struct tcphdr, dest);
const int ethproto_off = offsetof(struct ethhdr, h_proto);
int optlen = 0;
- int ipproto_off;
+ int ipproto_off, opt_ipproto_off;
int next_off;
if (proto == PF_INET)
@@ -116,14 +122,30 @@ static void setup_sock_filter(int fd)
if (strcmp(testname, "ip") == 0) {
if (proto == PF_INET)
optlen = sizeof(struct ip_timestamp);
- else
- optlen = sizeof(struct ip6_frag);
+ else {
+ BUILD_BUG_ON(sizeof(struct ip6_hbh) > MIN_EXTHDR_SIZE);
+ BUILD_BUG_ON(sizeof(struct ip6_dest) > MIN_EXTHDR_SIZE);
+ BUILD_BUG_ON(sizeof(struct ip6_frag) > MIN_EXTHDR_SIZE);
+
+ /* same size for HBH and Fragment extension header types */
+ optlen = MIN_EXTHDR_SIZE;
+ opt_ipproto_off = ETH_HLEN + sizeof(struct ipv6hdr)
+ + offsetof(struct ip6_ext, ip6e_nxt);
+ }
}
+ /* this filter validates the following:
+ * - packet is IPv4/IPv6 according to the running test.
+ * - packet is TCP. Also handles the case of one extension header and then TCP.
+ * - checks the packet tcp dport equals to DPORT. Also handles the case of one
+ * extension header and then TCP.
+ */
struct sock_filter filter[] = {
BPF_STMT(BPF_LD + BPF_H + BPF_ABS, ethproto_off),
- BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, ntohs(ethhdr_proto), 0, 7),
+ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, ntohs(ethhdr_proto), 0, 9),
BPF_STMT(BPF_LD + BPF_B + BPF_ABS, ipproto_off),
+ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, IPPROTO_TCP, 2, 0),
+ BPF_STMT(BPF_LD + BPF_B + BPF_ABS, opt_ipproto_off),
BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, IPPROTO_TCP, 0, 5),
BPF_STMT(BPF_LD + BPF_H + BPF_ABS, dport_off),
BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, DPORT, 2, 0),
@@ -576,6 +598,39 @@ static void add_ipv4_ts_option(void *buf, void *optpkt)
iph->check = checksum_fold(iph, sizeof(struct iphdr) + optlen, 0);
}
+static void add_ipv6_exthdr(void *buf, void *optpkt, __u8 exthdr_type, char *ext_payload)
+{
+ struct ipv6_opt_hdr *exthdr = (struct ipv6_opt_hdr *)(optpkt + tcp_offset);
+ struct ipv6hdr *iph = (struct ipv6hdr *)(optpkt + ETH_HLEN);
+ char *exthdr_payload_start = (char *)(exthdr + 1);
+
+ exthdr->hdrlen = 0;
+ exthdr->nexthdr = IPPROTO_TCP;
+
+ memcpy(exthdr_payload_start, ext_payload, MIN_EXTHDR_SIZE - sizeof(*exthdr));
+
+ memcpy(optpkt, buf, tcp_offset);
+ memcpy(optpkt + tcp_offset + MIN_EXTHDR_SIZE, buf + tcp_offset,
+ sizeof(struct tcphdr) + PAYLOAD_LEN);
+
+ iph->nexthdr = exthdr_type;
+ iph->payload_len = htons(ntohs(iph->payload_len) + MIN_EXTHDR_SIZE);
+}
+
+static void send_ipv6_exthdr(int fd, struct sockaddr_ll *daddr, char *ext_data1, char *ext_data2)
+{
+ static char buf[MAX_HDR_LEN + PAYLOAD_LEN];
+ static char exthdr_pck[sizeof(buf) + MIN_EXTHDR_SIZE];
+
+ create_packet(buf, 0, 0, PAYLOAD_LEN, 0);
+ add_ipv6_exthdr(buf, exthdr_pck, IPPROTO_HOPOPTS, ext_data1);
+ write_packet(fd, exthdr_pck, total_hdr_len + PAYLOAD_LEN + MIN_EXTHDR_SIZE, daddr);
+
+ create_packet(buf, PAYLOAD_LEN * 1, 0, PAYLOAD_LEN, 0);
+ add_ipv6_exthdr(buf, exthdr_pck, IPPROTO_HOPOPTS, ext_data2);
+ write_packet(fd, exthdr_pck, total_hdr_len + PAYLOAD_LEN + MIN_EXTHDR_SIZE, daddr);
+}
+
/* IPv4 options shouldn't coalesce */
static void send_ip_options(int fd, struct sockaddr_ll *daddr)
{
@@ -697,7 +752,7 @@ static void send_fragment6(int fd, struct sockaddr_ll *daddr)
create_packet(buf, PAYLOAD_LEN * i, 0, PAYLOAD_LEN, 0);
write_packet(fd, buf, bufpkt_len, daddr);
}
-
+ sleep(1);
create_packet(buf, PAYLOAD_LEN * 2, 0, PAYLOAD_LEN, 0);
memset(extpkt, 0, extpkt_len);
@@ -760,6 +815,7 @@ static void check_recv_pkts(int fd, int *correct_payload,
vlog("}, Total %d packets\nReceived {", correct_num_pkts);
while (1) {
+ ip_ext_len = 0;
pkt_size = recv(fd, buffer, IP_MAXPACKET + ETH_HLEN + 1, 0);
if (pkt_size < 0)
error(1, errno, "could not receive");
@@ -767,7 +823,7 @@ static void check_recv_pkts(int fd, int *correct_payload,
if (iph->version == 4)
ip_ext_len = (iph->ihl - 5) * 4;
else if (ip6h->version == 6 && ip6h->nexthdr != IPPROTO_TCP)
- ip_ext_len = sizeof(struct ip6_frag);
+ ip_ext_len = MIN_EXTHDR_SIZE;
tcph = (struct tcphdr *)(buffer + tcp_offset + ip_ext_len);
@@ -888,7 +944,21 @@ static void gro_sender(void)
sleep(1);
write_packet(txfd, fin_pkt, total_hdr_len, &daddr);
} else if (proto == PF_INET6) {
+ sleep(1);
send_fragment6(txfd, &daddr);
+ sleep(1);
+ write_packet(txfd, fin_pkt, total_hdr_len, &daddr);
+
+ sleep(1);
+ /* send IPv6 packets with ext header with same payload */
+ send_ipv6_exthdr(txfd, &daddr, EXT_PAYLOAD_1, EXT_PAYLOAD_1);
+ sleep(1);
+ write_packet(txfd, fin_pkt, total_hdr_len, &daddr);
+
+ sleep(1);
+ /* send IPv6 packets with ext header with different payload */
+ send_ipv6_exthdr(txfd, &daddr, EXT_PAYLOAD_1, EXT_PAYLOAD_2);
+ sleep(1);
write_packet(txfd, fin_pkt, total_hdr_len, &daddr);
}
} else if (strcmp(testname, "large") == 0) {
@@ -1005,6 +1075,17 @@ static void gro_receiver(void)
*/
printf("fragmented ip6 doesn't coalesce: ");
correct_payload[0] = PAYLOAD_LEN * 2;
+ correct_payload[1] = PAYLOAD_LEN;
+ correct_payload[2] = PAYLOAD_LEN;
+ check_recv_pkts(rxfd, correct_payload, 3);
+
+ printf("ipv6 with ext header does coalesce: ");
+ correct_payload[0] = PAYLOAD_LEN * 2;
+ check_recv_pkts(rxfd, correct_payload, 1);
+
+ printf("ipv6 with ext header with different payloads doesn't coalesce: ");
+ correct_payload[0] = PAYLOAD_LEN;
+ correct_payload[1] = PAYLOAD_LEN;
check_recv_pkts(rxfd, correct_payload, 2);
}
} else if (strcmp(testname, "large") == 0) {
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 308/568] selftests/net: use destination options instead of hop-by-hop
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (306 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 307/568] selftests/net: fix GRO coalesce test and add ext header coalesce tests Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 309/568] netdevsim: add Makefile for selftests Greg Kroah-Hartman
` (266 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Willem de Bruijn, Anubhav Singh,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anubhav Singh <anubhavsinggh@google.com>
[ Upstream commit f8e8486702abb05b8c734093aab1606af0eac068 ]
The GRO self-test, gro.c, currently constructs IPv6 packets containing a
Hop-by-Hop Options header (IPPROTO_HOPOPTS) to ensure the GRO path
correctly handles IPv6 extension headers.
However, network elements may be configured to drop packets with the
Hop-by-Hop Options header (HBH). This causes the self-test to fail
in environments where such network elements are present.
To improve the robustness and reliability of this test in diverse
network environments, switch from using IPPROTO_HOPOPTS to
IPPROTO_DSTOPTS (Destination Options).
The Destination Options header is less likely to be dropped by
intermediate routers and still serves the core purpose of the test:
validating GRO's handling of an IPv6 extension header. This change
ensures the test can execute successfully without being incorrectly
failed by network policies outside the kernel's control.
Fixes: 7d1575014a63 ("selftests/net: GRO coalesce test")
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Anubhav Singh <anubhavsinggh@google.com>
Link: https://patch.msgid.link/20251030060436.1556664-1-anubhavsinggh@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/gro.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/net/gro.c b/tools/testing/selftests/net/gro.c
index 9c6f5b4033c37..8dd6857e52cb5 100644
--- a/tools/testing/selftests/net/gro.c
+++ b/tools/testing/selftests/net/gro.c
@@ -623,11 +623,11 @@ static void send_ipv6_exthdr(int fd, struct sockaddr_ll *daddr, char *ext_data1,
static char exthdr_pck[sizeof(buf) + MIN_EXTHDR_SIZE];
create_packet(buf, 0, 0, PAYLOAD_LEN, 0);
- add_ipv6_exthdr(buf, exthdr_pck, IPPROTO_HOPOPTS, ext_data1);
+ add_ipv6_exthdr(buf, exthdr_pck, IPPROTO_DSTOPTS, ext_data1);
write_packet(fd, exthdr_pck, total_hdr_len + PAYLOAD_LEN + MIN_EXTHDR_SIZE, daddr);
create_packet(buf, PAYLOAD_LEN * 1, 0, PAYLOAD_LEN, 0);
- add_ipv6_exthdr(buf, exthdr_pck, IPPROTO_HOPOPTS, ext_data2);
+ add_ipv6_exthdr(buf, exthdr_pck, IPPROTO_DSTOPTS, ext_data2);
write_packet(fd, exthdr_pck, total_hdr_len + PAYLOAD_LEN + MIN_EXTHDR_SIZE, daddr);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 309/568] netdevsim: add Makefile for selftests
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (307 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 308/568] selftests/net: use destination options instead of hop-by-hop Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 310/568] selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh Greg Kroah-Hartman
` (265 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, David Wei, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Wei <dw@davidwei.uk>
[ Upstream commit 8ff25dac88f616ebebb30830e3a20f079d7a30c9 ]
Add a Makefile for netdevsim selftests and add selftests path to
MAINTAINERS
Signed-off-by: David Wei <dw@davidwei.uk>
Link: https://lore.kernel.org/r/20240130214620.3722189-5-dw@davidwei.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: d01f8136d46b ("selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
MAINTAINERS | 1 +
.../selftests/drivers/net/netdevsim/Makefile | 17 +++++++++++++++++
2 files changed, 18 insertions(+)
create mode 100644 tools/testing/selftests/drivers/net/netdevsim/Makefile
diff --git a/MAINTAINERS b/MAINTAINERS
index 428b2259225dd..9ed8ee40a2176 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -14221,6 +14221,7 @@ NETDEVSIM
M: Jakub Kicinski <kuba@kernel.org>
S: Maintained
F: drivers/net/netdevsim/*
+F: tools/testing/selftests/drivers/net/netdevsim/*
NETEM NETWORK EMULATOR
M: Stephen Hemminger <stephen@networkplumber.org>
diff --git a/tools/testing/selftests/drivers/net/netdevsim/Makefile b/tools/testing/selftests/drivers/net/netdevsim/Makefile
new file mode 100644
index 0000000000000..7a29a05bea8bc
--- /dev/null
+++ b/tools/testing/selftests/drivers/net/netdevsim/Makefile
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: GPL-2.0+ OR MIT
+
+TEST_PROGS = devlink.sh \
+ devlink_in_netns.sh \
+ devlink_trap.sh \
+ ethtool-coalesce.sh \
+ ethtool-fec.sh \
+ ethtool-pause.sh \
+ ethtool-ring.sh \
+ fib.sh \
+ hw_stats_l3.sh \
+ nexthop.sh \
+ psample.sh \
+ tc-mq-visibility.sh \
+ udp_tunnel_nic.sh \
+
+include ../../../lib.mk
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 310/568] selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (308 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 309/568] netdevsim: add Makefile for selftests Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 311/568] net: vlan: sync VLAN features with lower device Greg Kroah-Hartman
` (264 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wang Liang, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Liang <wangliang74@huawei.com>
[ Upstream commit d01f8136d46b925798abcf86b35a4021e4cfb8bb ]
The script "ethtool-common.sh" is not installed in INSTALL_PATH, and
triggers some errors when I try to run the test
'drivers/net/netdevsim/ethtool-coalesce.sh':
TAP version 13
1..1
# timeout set to 600
# selftests: drivers/net/netdevsim: ethtool-coalesce.sh
# ./ethtool-coalesce.sh: line 4: ethtool-common.sh: No such file or directory
# ./ethtool-coalesce.sh: line 25: make_netdev: command not found
# ethtool: bad command line argument(s)
# ./ethtool-coalesce.sh: line 124: check: command not found
# ./ethtool-coalesce.sh: line 126: [: -eq: unary operator expected
# FAILED /0 checks
not ok 1 selftests: drivers/net/netdevsim: ethtool-coalesce.sh # exit=1
Install this file to avoid this error. After this patch:
TAP version 13
1..1
# timeout set to 600
# selftests: drivers/net/netdevsim: ethtool-coalesce.sh
# PASSED all 22 checks
ok 1 selftests: drivers/net/netdevsim: ethtool-coalesce.sh
Fixes: fbb8531e58bd ("selftests: extract common functions in ethtool-common.sh")
Signed-off-by: Wang Liang <wangliang74@huawei.com>
Link: https://patch.msgid.link/20251030040340.3258110-1-wangliang74@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/drivers/net/netdevsim/Makefile | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/tools/testing/selftests/drivers/net/netdevsim/Makefile b/tools/testing/selftests/drivers/net/netdevsim/Makefile
index 7a29a05bea8bc..50932e13cb5a8 100644
--- a/tools/testing/selftests/drivers/net/netdevsim/Makefile
+++ b/tools/testing/selftests/drivers/net/netdevsim/Makefile
@@ -14,4 +14,8 @@ TEST_PROGS = devlink.sh \
tc-mq-visibility.sh \
udp_tunnel_nic.sh \
+TEST_FILES := \
+ ethtool-common.sh
+# end of TEST_FILES
+
include ../../../lib.mk
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 311/568] net: vlan: sync VLAN features with lower device
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (309 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 310/568] selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 312/568] net: dsa: b53: fix resetting speed and pause on forced link Greg Kroah-Hartman
` (263 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hangbin Liu, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <liuhangbin@gmail.com>
[ Upstream commit c211f5d7cbd5cb34489d526648bb9c8ecc907dee ]
After registering a VLAN device and setting its feature flags, we need to
synchronize the VLAN features with the lower device. For example, the VLAN
device does not have the NETIF_F_LRO flag, it should be synchronized with
the lower device based on the NETIF_F_UPPER_DISABLES definition.
As the dev->vlan_features has changed, we need to call
netdev_update_features(). The caller must run after netdev_upper_dev_link()
links the lower devices, so this patch adds the netdev_update_features()
call in register_vlan_dev().
Fixes: fd867d51f889 ("net/core: generic support for disabling netdev features down stack")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://patch.msgid.link/20251030073539.133779-1-liuhangbin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/8021q/vlan.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 422f726346ea5..7c77482f31594 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -194,6 +194,8 @@ int register_vlan_dev(struct net_device *dev, struct netlink_ext_ack *extack)
vlan_group_set_device(grp, vlan->vlan_proto, vlan_id, dev);
grp->nr_vlan_devs++;
+ netdev_update_features(dev);
+
return 0;
out_unregister_netdev:
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 312/568] net: dsa: b53: fix resetting speed and pause on forced link
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (310 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 311/568] net: vlan: sync VLAN features with lower device Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 313/568] net: dsa: b53: fix enabling ip multicast Greg Kroah-Hartman
` (262 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonas Gorski, Florian Fainelli,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit b6a8a5477fe9bd6be2b594a88f82f8bba41e6d54 ]
There is no guarantee that the port state override registers have their
default values, as not all switches support being reset via register or
have a reset GPIO.
So when forcing port config, we need to make sure to clear all fields,
which we currently do not do for the speed and flow control
configuration. This can cause flow control stay enabled, or in the case
of speed becoming an illegal value, e.g. configured for 1G (0x2), then
setting 100M (0x1), results in 0x3 which is invalid.
For PORT_OVERRIDE_SPEED_2000M we need to make sure to only clear it on
supported chips, as the bit can have different meanings on other chips,
e.g. for BCM5389 this controls scanning PHYs for link/speed
configuration.
Fixes: 5e004460f874 ("net: dsa: b53: Add helper to set link parameters")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20251101132807.50419-2-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/b53/b53_common.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index b0e283bc3efbc..d5a1d26e8e3de 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -1215,6 +1215,10 @@ static void b53_force_port_config(struct b53_device *dev, int port,
else
reg &= ~PORT_OVERRIDE_FULL_DUPLEX;
+ reg &= ~(0x3 << GMII_PO_SPEED_S);
+ if (is5301x(dev) || is58xx(dev))
+ reg &= ~PORT_OVERRIDE_SPEED_2000M;
+
switch (speed) {
case 2000:
reg |= PORT_OVERRIDE_SPEED_2000M;
@@ -1233,6 +1237,11 @@ static void b53_force_port_config(struct b53_device *dev, int port,
return;
}
+ if (is5325(dev))
+ reg &= ~PORT_OVERRIDE_LP_FLOW_25;
+ else
+ reg &= ~(PORT_OVERRIDE_RX_FLOW | PORT_OVERRIDE_TX_FLOW);
+
if (rx_pause) {
if (is5325(dev))
reg |= PORT_OVERRIDE_LP_FLOW_25;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 313/568] net: dsa: b53: fix enabling ip multicast
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (311 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 312/568] net: dsa: b53: fix resetting speed and pause on forced link Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 314/568] net: dsa: b53: stop reading ARL entries if search is done Greg Kroah-Hartman
` (261 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonas Gorski, Florian Fainelli,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit c264294624e956a967a9e2e5fa41e3273340b089 ]
In the New Control register bit 1 is either reserved, or has a different
function:
Out of Range Error Discard
When enabled, the ingress port discards any frames
if the Length field is between 1500 and 1536
(excluding 1500 and 1536) and with good CRC.
The actual bit for enabling IP multicast is bit 0, which was only
explicitly enabled for BCM5325 so far.
For older switch chips, this bit defaults to 0, so we want to enable it
as well, while newer switch chips default to 1, and their documentation
says "It is illegal to set this bit to zero."
So drop the wrong B53_IPMC_FWD_EN define, enable the IP multicast bit
also for other switch chips. While at it, rename it to (B53_)IP_MC as
that is how it is called in Broadcom code.
Fixes: 63cc54a6f073 ("net: dsa: b53: Fix egress flooding settings")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20251102100758.28352-2-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/b53/b53_common.c | 4 ++--
drivers/net/dsa/b53/b53_regs.h | 3 +--
2 files changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index d5a1d26e8e3de..037e1c7e9f45c 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -349,11 +349,11 @@ static void b53_set_forwarding(struct b53_device *dev, int enable)
* frames should be flooded or not.
*/
b53_read8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, &mgmt);
- mgmt |= B53_UC_FWD_EN | B53_MC_FWD_EN | B53_IPMC_FWD_EN;
+ mgmt |= B53_UC_FWD_EN | B53_MC_FWD_EN | B53_IP_MC;
b53_write8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, mgmt);
} else {
b53_read8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, &mgmt);
- mgmt |= B53_IP_MCAST_25;
+ mgmt |= B53_IP_MC;
b53_write8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, mgmt);
}
}
diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h
index 77fb7ae660b8c..95f70248c194d 100644
--- a/drivers/net/dsa/b53/b53_regs.h
+++ b/drivers/net/dsa/b53/b53_regs.h
@@ -104,8 +104,7 @@
/* IP Multicast control (8 bit) */
#define B53_IP_MULTICAST_CTRL 0x21
-#define B53_IP_MCAST_25 BIT(0)
-#define B53_IPMC_FWD_EN BIT(1)
+#define B53_IP_MC BIT(0)
#define B53_UC_FWD_EN BIT(6)
#define B53_MC_FWD_EN BIT(7)
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 314/568] net: dsa: b53: stop reading ARL entries if search is done
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (312 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 313/568] net: dsa: b53: fix enabling ip multicast Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 315/568] sctp: Hold RCU read lock while iterating over address list Greg Kroah-Hartman
` (260 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonas Gorski, Florian Fainelli,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit 0be04b5fa62a82a9929ca261f6c9f64a3d0a28da ]
The switch clears the ARL_SRCH_STDN bit when the search is done, i.e. it
finished traversing the ARL table.
This means that there will be no valid result, so we should not attempt
to read and process any further entries.
We only ever check the validity of the entries for 4 ARL bin chips, and
only after having passed the first entry to the b53_fdb_copy().
This means that we always pass an invalid entry at the end to the
b53_fdb_copy(). b53_fdb_copy() does check the validity though before
passing on the entry, so it never gets passed on.
On < 4 ARL bin chips, we will even continue reading invalid entries
until we reach the result limit.
Fixes: 1da6df85c6fb ("net: dsa: b53: Implement ARL add/del/dump operations")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20251102100758.28352-3-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/b53/b53_common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 037e1c7e9f45c..bdbb873fe6eb0 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -1785,7 +1785,7 @@ static int b53_arl_search_wait(struct b53_device *dev)
do {
b53_read8(dev, B53_ARLIO_PAGE, B53_ARL_SRCH_CTL, ®);
if (!(reg & ARL_SRCH_STDN))
- return 0;
+ return -ENOENT;
if (reg & ARL_SRCH_VLID)
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 315/568] sctp: Hold RCU read lock while iterating over address list
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (313 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 314/568] net: dsa: b53: stop reading ARL entries if search is done Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 316/568] sctp: Prevent TOCTOU out-of-bounds write Greg Kroah-Hartman
` (259 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Wiehler, Kuniyuki Iwashima,
Xin Long, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wiehler <stefan.wiehler@nokia.com>
[ Upstream commit 38f50242bf0f237cdc262308d624d333286ec3c5 ]
With CONFIG_PROVE_RCU_LIST=y and by executing
$ netcat -l --sctp &
$ netcat --sctp localhost &
$ ss --sctp
one can trigger the following Lockdep-RCU splat(s):
WARNING: suspicious RCU usage
6.18.0-rc1-00093-g7f864458e9a6 #5 Not tainted
-----------------------------
net/sctp/diag.c:76 RCU-list traversed in non-reader section!!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
2 locks held by ss/215:
#0: ffff9c740828bec0 (nlk_cb_mutex-SOCK_DIAG){+.+.}-{4:4}, at: __netlink_dump_start+0x84/0x2b0
#1: ffff9c7401d72cd0 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sctp_sock_dump+0x38/0x200
stack backtrace:
CPU: 0 UID: 0 PID: 215 Comm: ss Not tainted 6.18.0-rc1-00093-g7f864458e9a6 #5 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x5d/0x90
lockdep_rcu_suspicious.cold+0x4e/0xa3
inet_sctp_diag_fill.isra.0+0x4b1/0x5d0
sctp_sock_dump+0x131/0x200
sctp_transport_traverse_process+0x170/0x1b0
? __pfx_sctp_sock_filter+0x10/0x10
? __pfx_sctp_sock_dump+0x10/0x10
sctp_diag_dump+0x103/0x140
__inet_diag_dump+0x70/0xb0
netlink_dump+0x148/0x490
__netlink_dump_start+0x1f3/0x2b0
inet_diag_handler_cmd+0xcd/0x100
? __pfx_inet_diag_dump_start+0x10/0x10
? __pfx_inet_diag_dump+0x10/0x10
? __pfx_inet_diag_dump_done+0x10/0x10
sock_diag_rcv_msg+0x18e/0x320
? __pfx_sock_diag_rcv_msg+0x10/0x10
netlink_rcv_skb+0x4d/0x100
netlink_unicast+0x1d7/0x2b0
netlink_sendmsg+0x203/0x450
____sys_sendmsg+0x30c/0x340
___sys_sendmsg+0x94/0xf0
__sys_sendmsg+0x83/0xf0
do_syscall_64+0xbb/0x390
entry_SYSCALL_64_after_hwframe+0x77/0x7f
...
</TASK>
Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file")
Signed-off-by: Stefan Wiehler <stefan.wiehler@nokia.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20251028161506.3294376-2-stefan.wiehler@nokia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/diag.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/sctp/diag.c b/net/sctp/diag.c
index b0ce1080842d4..31cf52026202b 100644
--- a/net/sctp/diag.c
+++ b/net/sctp/diag.c
@@ -73,19 +73,23 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb,
struct nlattr *attr;
void *info = NULL;
+ rcu_read_lock();
list_for_each_entry_rcu(laddr, address_list, list)
addrcnt++;
+ rcu_read_unlock();
attr = nla_reserve(skb, INET_DIAG_LOCALS, addrlen * addrcnt);
if (!attr)
return -EMSGSIZE;
info = nla_data(attr);
+ rcu_read_lock();
list_for_each_entry_rcu(laddr, address_list, list) {
memcpy(info, &laddr->a, sizeof(laddr->a));
memset(info + sizeof(laddr->a), 0, addrlen - sizeof(laddr->a));
info += addrlen;
}
+ rcu_read_unlock();
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 316/568] sctp: Prevent TOCTOU out-of-bounds write
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (314 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 315/568] sctp: Hold RCU read lock while iterating over address list Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 317/568] sctp: Hold sock lock while iterating over address list Greg Kroah-Hartman
` (258 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Stefan Wiehler,
Xin Long, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wiehler <stefan.wiehler@nokia.com>
[ Upstream commit 95aef86ab231f047bb8085c70666059b58f53c09 ]
For the following path not holding the sock lock,
sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump()
make sure not to exceed bounds in case the address list has grown
between buffer allocation (time-of-check) and write (time-of-use).
Suggested-by: Kuniyuki Iwashima <kuniyu@google.com>
Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file")
Signed-off-by: Stefan Wiehler <stefan.wiehler@nokia.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20251028161506.3294376-3-stefan.wiehler@nokia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/diag.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/sctp/diag.c b/net/sctp/diag.c
index 31cf52026202b..3631a32d96b07 100644
--- a/net/sctp/diag.c
+++ b/net/sctp/diag.c
@@ -88,6 +88,9 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb,
memcpy(info, &laddr->a, sizeof(laddr->a));
memset(info + sizeof(laddr->a), 0, addrlen - sizeof(laddr->a));
info += addrlen;
+
+ if (!--addrcnt)
+ break;
}
rcu_read_unlock();
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 317/568] sctp: Hold sock lock while iterating over address list
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (315 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 316/568] sctp: Prevent TOCTOU out-of-bounds write Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 318/568] net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup Greg Kroah-Hartman
` (257 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xin Long, Stefan Wiehler,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wiehler <stefan.wiehler@nokia.com>
[ Upstream commit f1fc201148c7e684c10a72b6a3375597f28d1ef6 ]
Move address list traversal in inet_assoc_attr_size() under the sock
lock to avoid holding the RCU read lock.
Suggested-by: Xin Long <lucien.xin@gmail.com>
Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file")
Signed-off-by: Stefan Wiehler <stefan.wiehler@nokia.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20251028161506.3294376-4-stefan.wiehler@nokia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/diag.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/net/sctp/diag.c b/net/sctp/diag.c
index 3631a32d96b07..2cf5ee7a698e2 100644
--- a/net/sctp/diag.c
+++ b/net/sctp/diag.c
@@ -230,14 +230,15 @@ struct sctp_comm_param {
bool net_admin;
};
-static size_t inet_assoc_attr_size(struct sctp_association *asoc)
+static size_t inet_assoc_attr_size(struct sock *sk,
+ struct sctp_association *asoc)
{
int addrlen = sizeof(struct sockaddr_storage);
int addrcnt = 0;
struct sctp_sockaddr_entry *laddr;
list_for_each_entry_rcu(laddr, &asoc->base.bind_addr.address_list,
- list)
+ list, lockdep_sock_is_held(sk))
addrcnt++;
return nla_total_size(sizeof(struct sctp_info))
@@ -263,11 +264,14 @@ static int sctp_sock_dump_one(struct sctp_endpoint *ep, struct sctp_transport *t
if (err)
return err;
- rep = nlmsg_new(inet_assoc_attr_size(assoc), GFP_KERNEL);
- if (!rep)
+ lock_sock(sk);
+
+ rep = nlmsg_new(inet_assoc_attr_size(sk, assoc), GFP_KERNEL);
+ if (!rep) {
+ release_sock(sk);
return -ENOMEM;
+ }
- lock_sock(sk);
if (ep != assoc->ep) {
err = -EAGAIN;
goto out;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 318/568] net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (316 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 317/568] sctp: Hold sock lock while iterating over address list Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 319/568] bnxt_en: Fix a possible memory leak in bnxt_ptp_init Greg Kroah-Hartman
` (256 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qendrim Maxhuni, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qendrim Maxhuni <qendrim.maxhuni@garderos.com>
[ Upstream commit e120f46768d98151ece8756ebd688b0e43dc8b29 ]
Raw IP packets have no MAC header, leaving skb->mac_header uninitialized.
This can trigger kernel panics on ARM64 when xfrm or other subsystems
access the offset due to strict alignment checks.
Initialize the MAC header to prevent such crashes.
This can trigger kernel panics on ARM when running IPsec over the
qmimux0 interface.
Example trace:
Internal error: Oops: 000000009600004f [#1] SMP
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.34-gbe78e49cb433 #1
Hardware name: LS1028A RDB Board (DT)
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : xfrm_input+0xde8/0x1318
lr : xfrm_input+0x61c/0x1318
sp : ffff800080003b20
Call trace:
xfrm_input+0xde8/0x1318
xfrm6_rcv+0x38/0x44
xfrm6_esp_rcv+0x48/0xa8
ip6_protocol_deliver_rcu+0x94/0x4b0
ip6_input_finish+0x44/0x70
ip6_input+0x44/0xc0
ipv6_rcv+0x6c/0x114
__netif_receive_skb_one_core+0x5c/0x8c
__netif_receive_skb+0x18/0x60
process_backlog+0x78/0x17c
__napi_poll+0x38/0x180
net_rx_action+0x168/0x2f0
Fixes: c6adf77953bc ("net: usb: qmi_wwan: add qmap mux protocol support")
Signed-off-by: Qendrim Maxhuni <qendrim.maxhuni@garderos.com>
Link: https://patch.msgid.link/20251029075744.105113-1-qendrim.maxhuni@garderos.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/qmi_wwan.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 28fd36234311a..e4d8041861a24 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -191,6 +191,12 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
if (!skbn)
return 0;
+ /* Raw IP packets don't have a MAC header, but other subsystems
+ * (like xfrm) may still access MAC header offsets, so they must
+ * be initialized.
+ */
+ skb_reset_mac_header(skbn);
+
switch (skb->data[offset + qmimux_hdr_sz] & 0xf0) {
case 0x40:
skbn->protocol = htons(ETH_P_IP);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 319/568] bnxt_en: Fix a possible memory leak in bnxt_ptp_init
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (317 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 318/568] net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 320/568] net/mlx5e: SHAMPO, Fix skb size check for 64K pages Greg Kroah-Hartman
` (255 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pavan Chebbi, Somnath Kotur,
Kalesh AP, Michael Chan, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
[ Upstream commit deb8eb39164382f1f67ef8e8af9176baf5e10f2d ]
In bnxt_ptp_init(), when ptp_clock_register() fails, the driver is
not freeing the memory allocated for ptp_info->pin_config. Fix it
to unconditionally free ptp_info->pin_config in bnxt_ptp_free().
Fixes: caf3eedbcd8d ("bnxt_en: 1PPS support for 5750X family chips")
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Link: https://patch.msgid.link/20251104005700.542174-3-michael.chan@broadcom.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c
index ae734314f8de5..1c888d6c3aee8 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c
@@ -895,9 +895,9 @@ static void bnxt_ptp_free(struct bnxt *bp)
if (ptp->ptp_clock) {
ptp_clock_unregister(ptp->ptp_clock);
ptp->ptp_clock = NULL;
- kfree(ptp->ptp_info.pin_config);
- ptp->ptp_info.pin_config = NULL;
}
+ kfree(ptp->ptp_info.pin_config);
+ ptp->ptp_info.pin_config = NULL;
}
int bnxt_ptp_init(struct bnxt *bp, bool phc_cfg)
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 320/568] net/mlx5e: SHAMPO, Fix skb size check for 64K pages
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (318 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 319/568] bnxt_en: Fix a possible memory leak in bnxt_ptp_init Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 321/568] net: dsa: microchip: Fix reserved multicast address table programming Greg Kroah-Hartman
` (254 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dragos Tatulea, Tariq Toukan,
Simon Horman, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragos Tatulea <dtatulea@nvidia.com>
[ Upstream commit bacd8d80181ebe34b599a39aa26bf73a44c91e55 ]
mlx5e_hw_gro_skb_has_enough_space() uses a formula to check if there is
enough space in the skb frags to store more data. This formula is
incorrect for 64K page sizes and it triggers early GRO session
termination because the first fragment will blow up beyond
GRO_LEGACY_MAX_SIZE.
This patch adds a special case for page sizes >= GRO_LEGACY_MAX_SIZE
(64K) which uses the skb->len instead. Within this context,
the check is safe from fragment overflow because the hardware
will continuously fill the data up to the reservation size of 64K
and the driver will coalesce all data from the same page to the same
fragment. This means that the data will span one fragment or at most
two for such a large page size.
It is expected that the if statement will be optimized out as the
check is done with constants.
Fixes: 92552d3abd32 ("net/mlx5e: HW_GRO cqe handler implementation")
Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/1762238915-1027590-3-git-send-email-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 2768eab89eada..75934d0f144cc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -2056,7 +2056,10 @@ mlx5e_hw_gro_skb_has_enough_space(struct sk_buff *skb, u16 data_bcnt)
{
int nr_frags = skb_shinfo(skb)->nr_frags;
- return PAGE_SIZE * nr_frags + data_bcnt <= GRO_LEGACY_MAX_SIZE;
+ if (PAGE_SIZE >= GRO_LEGACY_MAX_SIZE)
+ return skb->len + data_bcnt <= GRO_LEGACY_MAX_SIZE;
+ else
+ return PAGE_SIZE * nr_frags + data_bcnt <= GRO_LEGACY_MAX_SIZE;
}
static void
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 321/568] net: dsa: microchip: Fix reserved multicast address table programming
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (319 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 320/568] net/mlx5e: SHAMPO, Fix skb size check for 64K pages Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 322/568] net: bridge: fix use-after-free due to MST port state bypass Greg Kroah-Hartman
` (253 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tristram Ha, Łukasz Majewski,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristram Ha <tristram.ha@microchip.com>
[ Upstream commit 96baf482ca1f69f0da9d10a5bd8422c87ea9039e ]
KSZ9477/KSZ9897 and LAN937X families of switches use a reserved multicast
address table for some specific forwarding with some multicast addresses,
like the one used in STP. The hardware assumes the host port is the last
port in KSZ9897 family and port 5 in LAN937X family. Most of the time
this assumption is correct but not in other cases like KSZ9477.
Originally the function just setups the first entry, but the others still
need update, especially for one common multicast address that is used by
PTP operation.
LAN937x also uses different register bits when accessing the reserved
table.
Fixes: 457c182af597 ("net: dsa: microchip: generic access to ksz9477 static and reserved table")
Signed-off-by: Tristram Ha <tristram.ha@microchip.com>
Tested-by: Łukasz Majewski <lukma@nabladev.com>
Link: https://patch.msgid.link/20251105033741.6455-1-Tristram.Ha@microchip.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/microchip/ksz9477.c | 98 +++++++++++++++++++++----
drivers/net/dsa/microchip/ksz9477_reg.h | 3 +-
drivers/net/dsa/microchip/ksz_common.c | 4 +
drivers/net/dsa/microchip/ksz_common.h | 2 +
4 files changed, 91 insertions(+), 16 deletions(-)
diff --git a/drivers/net/dsa/microchip/ksz9477.c b/drivers/net/dsa/microchip/ksz9477.c
index b854ee425fcdd..d6e459fd7a00a 100644
--- a/drivers/net/dsa/microchip/ksz9477.c
+++ b/drivers/net/dsa/microchip/ksz9477.c
@@ -1127,9 +1127,15 @@ void ksz9477_config_cpu_port(struct dsa_switch *ds)
}
}
+#define RESV_MCAST_CNT 8
+
+static u8 reserved_mcast_map[RESV_MCAST_CNT] = { 0, 1, 3, 16, 32, 33, 2, 17 };
+
int ksz9477_enable_stp_addr(struct ksz_device *dev)
{
+ u8 i, ports, update;
const u32 *masks;
+ bool override;
u32 data;
int ret;
@@ -1138,23 +1144,87 @@ int ksz9477_enable_stp_addr(struct ksz_device *dev)
/* Enable Reserved multicast table */
ksz_cfg(dev, REG_SW_LUE_CTRL_0, SW_RESV_MCAST_ENABLE, true);
- /* Set the Override bit for forwarding BPDU packet to CPU */
- ret = ksz_write32(dev, REG_SW_ALU_VAL_B,
- ALU_V_OVERRIDE | BIT(dev->cpu_port));
- if (ret < 0)
- return ret;
+ /* The reserved multicast address table has 8 entries. Each entry has
+ * a default value of which port to forward. It is assumed the host
+ * port is the last port in most of the switches, but that is not the
+ * case for KSZ9477 or maybe KSZ9897. For LAN937X family the default
+ * port is port 5, the first RGMII port. It is okay for LAN9370, a
+ * 5-port switch, but may not be correct for the other 8-port
+ * versions. It is necessary to update the whole table to forward to
+ * the right ports.
+ * Furthermore PTP messages can use a reserved multicast address and
+ * the host will not receive them if this table is not correct.
+ */
+ for (i = 0; i < RESV_MCAST_CNT; i++) {
+ data = reserved_mcast_map[i] <<
+ dev->info->shifts[ALU_STAT_INDEX];
+ data |= ALU_STAT_START |
+ masks[ALU_STAT_DIRECT] |
+ masks[ALU_RESV_MCAST_ADDR] |
+ masks[ALU_STAT_READ];
+ ret = ksz_write32(dev, REG_SW_ALU_STAT_CTRL__4, data);
+ if (ret < 0)
+ return ret;
- data = ALU_STAT_START | ALU_RESV_MCAST_ADDR | masks[ALU_STAT_WRITE];
+ /* wait to be finished */
+ ret = ksz9477_wait_alu_sta_ready(dev);
+ if (ret < 0)
+ return ret;
- ret = ksz_write32(dev, REG_SW_ALU_STAT_CTRL__4, data);
- if (ret < 0)
- return ret;
+ ret = ksz_read32(dev, REG_SW_ALU_VAL_B, &data);
+ if (ret < 0)
+ return ret;
- /* wait to be finished */
- ret = ksz9477_wait_alu_sta_ready(dev);
- if (ret < 0) {
- dev_err(dev->dev, "Failed to update Reserved Multicast table\n");
- return ret;
+ override = false;
+ ports = data & dev->port_mask;
+ switch (i) {
+ case 0:
+ case 6:
+ /* Change the host port. */
+ update = BIT(dev->cpu_port);
+ override = true;
+ break;
+ case 2:
+ /* Change the host port. */
+ update = BIT(dev->cpu_port);
+ break;
+ case 4:
+ case 5:
+ case 7:
+ /* Skip the host port. */
+ update = dev->port_mask & ~BIT(dev->cpu_port);
+ break;
+ default:
+ update = ports;
+ break;
+ }
+ if (update != ports || override) {
+ data &= ~dev->port_mask;
+ data |= update;
+ /* Set Override bit to receive frame even when port is
+ * closed.
+ */
+ if (override)
+ data |= ALU_V_OVERRIDE;
+ ret = ksz_write32(dev, REG_SW_ALU_VAL_B, data);
+ if (ret < 0)
+ return ret;
+
+ data = reserved_mcast_map[i] <<
+ dev->info->shifts[ALU_STAT_INDEX];
+ data |= ALU_STAT_START |
+ masks[ALU_STAT_DIRECT] |
+ masks[ALU_RESV_MCAST_ADDR] |
+ masks[ALU_STAT_WRITE];
+ ret = ksz_write32(dev, REG_SW_ALU_STAT_CTRL__4, data);
+ if (ret < 0)
+ return ret;
+
+ /* wait to be finished */
+ ret = ksz9477_wait_alu_sta_ready(dev);
+ if (ret < 0)
+ return ret;
+ }
}
return 0;
diff --git a/drivers/net/dsa/microchip/ksz9477_reg.h b/drivers/net/dsa/microchip/ksz9477_reg.h
index ffb9484018ed5..600dbf2ba4b1f 100644
--- a/drivers/net/dsa/microchip/ksz9477_reg.h
+++ b/drivers/net/dsa/microchip/ksz9477_reg.h
@@ -2,7 +2,7 @@
/*
* Microchip KSZ9477 register definitions
*
- * Copyright (C) 2017-2024 Microchip Technology Inc.
+ * Copyright (C) 2017-2025 Microchip Technology Inc.
*/
#ifndef __KSZ9477_REGS_H
@@ -422,7 +422,6 @@
#define ALU_RESV_MCAST_INDEX_M (BIT(6) - 1)
#define ALU_STAT_START BIT(7)
-#define ALU_RESV_MCAST_ADDR BIT(1)
#define REG_SW_ALU_VAL_A 0x0420
diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
index 9dbe188f09c3c..aa10131f80f95 100644
--- a/drivers/net/dsa/microchip/ksz_common.c
+++ b/drivers/net/dsa/microchip/ksz_common.c
@@ -392,6 +392,8 @@ static const u16 ksz9477_regs[] = {
static const u32 ksz9477_masks[] = {
[ALU_STAT_WRITE] = 0,
[ALU_STAT_READ] = 1,
+ [ALU_STAT_DIRECT] = 0,
+ [ALU_RESV_MCAST_ADDR] = BIT(1),
[P_MII_TX_FLOW_CTRL] = BIT(5),
[P_MII_RX_FLOW_CTRL] = BIT(3),
};
@@ -419,6 +421,8 @@ static const u8 ksz9477_xmii_ctrl1[] = {
static const u32 lan937x_masks[] = {
[ALU_STAT_WRITE] = 1,
[ALU_STAT_READ] = 2,
+ [ALU_STAT_DIRECT] = BIT(3),
+ [ALU_RESV_MCAST_ADDR] = BIT(2),
[P_MII_TX_FLOW_CTRL] = BIT(5),
[P_MII_RX_FLOW_CTRL] = BIT(3),
};
diff --git a/drivers/net/dsa/microchip/ksz_common.h b/drivers/net/dsa/microchip/ksz_common.h
index a3a7a90dad967..b35c98adbfcbd 100644
--- a/drivers/net/dsa/microchip/ksz_common.h
+++ b/drivers/net/dsa/microchip/ksz_common.h
@@ -225,6 +225,8 @@ enum ksz_masks {
DYNAMIC_MAC_TABLE_TIMESTAMP,
ALU_STAT_WRITE,
ALU_STAT_READ,
+ ALU_STAT_DIRECT,
+ ALU_RESV_MCAST_ADDR,
P_MII_TX_FLOW_CTRL,
P_MII_RX_FLOW_CTRL,
};
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 322/568] net: bridge: fix use-after-free due to MST port state bypass
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (320 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 321/568] net: dsa: microchip: Fix reserved multicast address table programming Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 323/568] net: bridge: fix MST static key usage Greg Kroah-Hartman
` (252 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+dd280197f0f7ab3917be,
Nikolay Aleksandrov, Ido Schimmel, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <razor@blackwall.org>
[ Upstream commit 8dca36978aa80bab9d4da130c211db75c9e00048 ]
syzbot reported[1] a use-after-free when deleting an expired fdb. It is
due to a race condition between learning still happening and a port being
deleted, after all its fdbs have been flushed. The port's state has been
toggled to disabled so no learning should happen at that time, but if we
have MST enabled, it will bypass the port's state, that together with VLAN
filtering disabled can lead to fdb learning at a time when it shouldn't
happen while the port is being deleted. VLAN filtering must be disabled
because we flush the port VLANs when it's being deleted which will stop
learning. This fix adds a check for the port's vlan group which is
initialized to NULL when the port is getting deleted, that avoids the port
state bypass. When MST is enabled there would be a minimal new overhead
in the fast-path because the port's vlan group pointer is cache-hot.
[1] https://syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be
Fixes: ec7328b59176 ("net: bridge: mst: Multiple Spanning Tree (MST) mode")
Reported-by: syzbot+dd280197f0f7ab3917be@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/69088ffa.050a0220.29fc44.003d.GAE@google.com/
Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20251105111919.1499702-2-razor@blackwall.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bridge/br_forward.c | 2 +-
net/bridge/br_input.c | 4 ++--
net/bridge/br_private.h | 8 +++++---
3 files changed, 8 insertions(+), 6 deletions(-)
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index d3257c9bfa920..9a6a6c1c4ced3 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -25,7 +25,7 @@ static inline int should_deliver(const struct net_bridge_port *p,
vg = nbp_vlan_group_rcu(p);
return ((p->flags & BR_HAIRPIN_MODE) || skb->dev != p->dev) &&
- (br_mst_is_enabled(p->br) || p->state == BR_STATE_FORWARDING) &&
+ (br_mst_is_enabled(p) || p->state == BR_STATE_FORWARDING) &&
br_allowed_egress(vg, skb) && nbp_switchdev_allowed_egress(p, skb) &&
!br_skb_isolated(p, skb);
}
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index b94a1783902ea..f11345720c275 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -93,7 +93,7 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb
br = p->br;
- if (br_mst_is_enabled(br)) {
+ if (br_mst_is_enabled(p)) {
state = BR_STATE_FORWARDING;
} else {
if (p->state == BR_STATE_DISABLED)
@@ -393,7 +393,7 @@ static rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
return RX_HANDLER_PASS;
forward:
- if (br_mst_is_enabled(p->br))
+ if (br_mst_is_enabled(p))
goto defer_stp_filtering;
switch (p->state) {
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 20c96cb406d5a..372e9664b2cb8 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -1802,10 +1802,12 @@ static inline bool br_vlan_state_allowed(u8 state, bool learn_allow)
/* br_mst.c */
#ifdef CONFIG_BRIDGE_VLAN_FILTERING
DECLARE_STATIC_KEY_FALSE(br_mst_used);
-static inline bool br_mst_is_enabled(struct net_bridge *br)
+static inline bool br_mst_is_enabled(const struct net_bridge_port *p)
{
+ /* check the port's vlan group to avoid racing with port deletion */
return static_branch_unlikely(&br_mst_used) &&
- br_opt_get(br, BROPT_MST_ENABLED);
+ br_opt_get(p->br, BROPT_MST_ENABLED) &&
+ rcu_access_pointer(p->vlgrp);
}
int br_mst_set_state(struct net_bridge_port *p, u16 msti, u8 state,
@@ -1820,7 +1822,7 @@ int br_mst_fill_info(struct sk_buff *skb,
int br_mst_process(struct net_bridge_port *p, const struct nlattr *mst_attr,
struct netlink_ext_ack *extack);
#else
-static inline bool br_mst_is_enabled(struct net_bridge *br)
+static inline bool br_mst_is_enabled(const struct net_bridge_port *p)
{
return false;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 323/568] net: bridge: fix MST static key usage
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (321 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 322/568] net: bridge: fix use-after-free due to MST port state bypass Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 324/568] tracing: Fix memory leaks in create_field_var() Greg Kroah-Hartman
` (251 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ido Schimmel, Nikolay Aleksandrov,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <razor@blackwall.org>
[ Upstream commit ee87c63f9b2a418f698d79c2991347e31a7d2c27 ]
As Ido pointed out, the static key usage in MST is buggy and should use
inc/dec instead of enable/disable because we can have multiple bridges
with MST enabled which means a single bridge can disable MST for all.
Use static_branch_inc/dec to avoid that. When destroying a bridge decrement
the key if MST was enabled.
Fixes: ec7328b59176 ("net: bridge: mst: Multiple Spanning Tree (MST) mode")
Reported-by: Ido Schimmel <idosch@nvidia.com>
Closes: https://lore.kernel.org/netdev/20251104120313.1306566-1-razor@blackwall.org/T/#m6888d87658f94ed1725433940f4f4ebb00b5a68b
Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20251105111919.1499702-3-razor@blackwall.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bridge/br_if.c | 1 +
net/bridge/br_mst.c | 10 ++++++++--
net/bridge/br_private.h | 5 +++++
3 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 0989074f316ef..42495d643a1bc 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -386,6 +386,7 @@ void br_dev_delete(struct net_device *dev, struct list_head *head)
del_nbp(p);
}
+ br_mst_uninit(br);
br_recalculate_neigh_suppress_enabled(br);
br_fdb_delete_by_port(br, NULL, 0, 1);
diff --git a/net/bridge/br_mst.c b/net/bridge/br_mst.c
index 3f24b4ee49c27..43a300ae6bfaf 100644
--- a/net/bridge/br_mst.c
+++ b/net/bridge/br_mst.c
@@ -22,6 +22,12 @@ bool br_mst_enabled(const struct net_device *dev)
}
EXPORT_SYMBOL_GPL(br_mst_enabled);
+void br_mst_uninit(struct net_bridge *br)
+{
+ if (br_opt_get(br, BROPT_MST_ENABLED))
+ static_branch_dec(&br_mst_used);
+}
+
int br_mst_get_info(const struct net_device *dev, u16 msti, unsigned long *vids)
{
const struct net_bridge_vlan_group *vg;
@@ -225,9 +231,9 @@ int br_mst_set_enabled(struct net_bridge *br, bool on,
return err;
if (on)
- static_branch_enable(&br_mst_used);
+ static_branch_inc(&br_mst_used);
else
- static_branch_disable(&br_mst_used);
+ static_branch_dec(&br_mst_used);
br_opt_toggle(br, BROPT_MST_ENABLED, on);
return 0;
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 372e9664b2cb8..901b9f609b0c7 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -1821,6 +1821,7 @@ int br_mst_fill_info(struct sk_buff *skb,
const struct net_bridge_vlan_group *vg);
int br_mst_process(struct net_bridge_port *p, const struct nlattr *mst_attr,
struct netlink_ext_ack *extack);
+void br_mst_uninit(struct net_bridge *br);
#else
static inline bool br_mst_is_enabled(const struct net_bridge_port *p)
{
@@ -1856,6 +1857,10 @@ static inline int br_mst_process(struct net_bridge_port *p,
{
return -EOPNOTSUPP;
}
+
+static inline void br_mst_uninit(struct net_bridge *br)
+{
+}
#endif
struct nf_br_ops {
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 324/568] tracing: Fix memory leaks in create_field_var()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (322 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 323/568] net: bridge: fix MST static key usage Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 325/568] Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() Greg Kroah-Hartman
` (250 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zilin Guan, Steven Rostedt (Google),
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <zilin@seu.edu.cn>
[ Upstream commit 80f0d631dcc76ee1b7755bfca1d8417d91d71414 ]
The function create_field_var() allocates memory for 'val' through
create_hist_field() inside parse_atom(), and for 'var' through
create_var(), which in turn allocates var->type and var->var.name
internally. Simply calling kfree() to release these structures will
result in memory leaks.
Use destroy_hist_field() to properly free 'val', and explicitly release
the memory of var->type and var->var.name before freeing 'var' itself.
Link: https://patch.msgid.link/20251106120132.3639920-1-zilin@seu.edu.cn
Fixes: 02205a6752f22 ("tracing: Add support for 'field variables'")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/trace_events_hist.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index c53be68bcd111..31d60758053d1 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -3210,14 +3210,16 @@ static struct field_var *create_field_var(struct hist_trigger_data *hist_data,
var = create_var(hist_data, file, field_name, val->size, val->type);
if (IS_ERR(var)) {
hist_err(tr, HIST_ERR_VAR_CREATE_FIND_FAIL, errpos(field_name));
- kfree(val);
+ destroy_hist_field(val, 0);
ret = PTR_ERR(var);
goto err;
}
field_var = kzalloc(sizeof(struct field_var), GFP_KERNEL);
if (!field_var) {
- kfree(val);
+ destroy_hist_field(val, 0);
+ kfree_const(var->type);
+ kfree(var->var.name);
kfree(var);
ret = -ENOMEM;
goto err;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 325/568] Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (323 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 324/568] tracing: Fix memory leaks in create_field_var() Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 326/568] rtc: rx8025: fix incorrect register reference Greg Kroah-Hartman
` (249 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ilia Gavrilov,
Luiz Augusto von Dentz
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
commit 8d59fba49362c65332395789fd82771f1028d87e upstream.
In the parse_adv_monitor_pattern() function, the value of
the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(251).
The size of the 'value' array in the mgmt_adv_pattern structure is 31.
If the value of 'pattern[i].length' is set in the user space
and exceeds 31, the 'patterns[i].value' array can be accessed
out of bound when copied.
Increasing the size of the 'value' array in
the 'mgmt_adv_pattern' structure will break the userspace.
Considering this, and to avoid OOB access revert the limits for 'offset'
and 'length' back to the value of HCI_MAX_AD_LENGTH.
Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.
Fixes: db08722fc7d4 ("Bluetooth: hci_core: Fix missing instances using HCI_MAX_AD_LENGTH")
Cc: stable@vger.kernel.org
Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/bluetooth/mgmt.h | 2 +-
net/bluetooth/mgmt.c | 6 +++---
2 files changed, 4 insertions(+), 4 deletions(-)
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -772,7 +772,7 @@ struct mgmt_adv_pattern {
__u8 ad_type;
__u8 offset;
__u8 length;
- __u8 value[31];
+ __u8 value[HCI_MAX_AD_LENGTH];
} __packed;
#define MGMT_OP_ADD_ADV_PATTERNS_MONITOR 0x0052
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -5436,9 +5436,9 @@ static u8 parse_adv_monitor_pattern(stru
for (i = 0; i < pattern_count; i++) {
offset = patterns[i].offset;
length = patterns[i].length;
- if (offset >= HCI_MAX_EXT_AD_LENGTH ||
- length > HCI_MAX_EXT_AD_LENGTH ||
- (offset + length) > HCI_MAX_EXT_AD_LENGTH)
+ if (offset >= HCI_MAX_AD_LENGTH ||
+ length > HCI_MAX_AD_LENGTH ||
+ (offset + length) > HCI_MAX_AD_LENGTH)
return MGMT_STATUS_INVALID_PARAMS;
p = kmalloc(sizeof(*p), GFP_KERNEL);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 326/568] rtc: rx8025: fix incorrect register reference
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (324 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 325/568] Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 327/568] smb: client: validate change notify buffer before copy Greg Kroah-Hartman
` (248 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuta Hayama, Alexandre Belloni
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuta Hayama <hayama@lineo.co.jp>
commit 162f24cbb0f6ec596e7e9f3e91610d79dc805229 upstream.
This code is intended to operate on the CTRL1 register, but ctrl[1] is
actually CTRL2. Correctly, ctrl[0] is CTRL1.
Signed-off-by: Yuta Hayama <hayama@lineo.co.jp>
Fixes: 71af91565052 ("rtc: rx8025: fix 12/24 hour mode detection on RX-8035")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/eae5f479-5d28-4a37-859d-d54794e7628c@lineo.co.jp
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rtc/rtc-rx8025.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/rtc/rtc-rx8025.c
+++ b/drivers/rtc/rtc-rx8025.c
@@ -315,7 +315,7 @@ static int rx8025_init_client(struct i2c
return hour_reg;
rx8025->is_24 = (hour_reg & RX8035_BIT_HOUR_1224);
} else {
- rx8025->is_24 = (ctrl[1] & RX8025_BIT_CTRL1_1224);
+ rx8025->is_24 = (ctrl[0] & RX8025_BIT_CTRL1_1224);
}
out:
return err;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 327/568] smb: client: validate change notify buffer before copy
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (325 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 326/568] rtc: rx8025: fix incorrect register reference Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 328/568] lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC Greg Kroah-Hartman
` (247 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joshua Rogers,
Paulo Alcantara (Red Hat), Steve French
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Rogers <linux@joshua.hu>
commit 4012abe8a78fbb8869634130024266eaef7081fe upstream.
SMB2_change_notify called smb2_validate_iov() but ignored the return
code, then kmemdup()ed using server provided OutputBufferOffset/Length.
Check the return of smb2_validate_iov() and bail out on error.
Discovered with help from the ZeroPath security tooling.
Signed-off-by: Joshua Rogers <linux@joshua.hu>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Cc: stable@vger.kernel.org
Fixes: e3e9463414f61 ("smb3: improve SMB3 change notification support")
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2pdu.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -3837,9 +3837,12 @@ SMB2_change_notify(const unsigned int xi
smb_rsp = (struct smb2_change_notify_rsp *)rsp_iov.iov_base;
- smb2_validate_iov(le16_to_cpu(smb_rsp->OutputBufferOffset),
- le32_to_cpu(smb_rsp->OutputBufferLength), &rsp_iov,
+ rc = smb2_validate_iov(le16_to_cpu(smb_rsp->OutputBufferOffset),
+ le32_to_cpu(smb_rsp->OutputBufferLength),
+ &rsp_iov,
sizeof(struct file_notify_information));
+ if (rc)
+ goto cnotify_exit;
*out_data = kmemdup((char *)smb_rsp + le16_to_cpu(smb_rsp->OutputBufferOffset),
le32_to_cpu(smb_rsp->OutputBufferLength), GFP_KERNEL);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 328/568] lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (326 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 327/568] smb: client: validate change notify buffer before copy Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 329/568] scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers Greg Kroah-Hartman
` (246 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Chancellor, Ard Biesheuvel,
Eric Biggers
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <nathan@kernel.org>
commit 2b81082ad37cc3f28355fb73a6a69b91ff7dbf20 upstream.
Commit 2f13daee2a72 ("lib/crypto/curve25519-hacl64: Disable KASAN with
clang-17 and older") inadvertently disabled KASAN in curve25519-hacl64.o
for GCC unconditionally because clang-min-version will always evaluate
to nothing for GCC. Add a check for CONFIG_CC_IS_CLANG to avoid applying
the workaround for GCC, which is only needed for clang-17 and older.
Cc: stable@vger.kernel.org
Fixes: 2f13daee2a72 ("lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20251103-curve25519-hacl64-fix-kasan-workaround-v2-1-ab581cbd8035@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/crypto/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/lib/crypto/Makefile
+++ b/lib/crypto/Makefile
@@ -26,7 +26,7 @@ libcurve25519-generic-y := curve25519
libcurve25519-generic-$(CONFIG_ARCH_SUPPORTS_INT128) := curve25519-hacl64.o
libcurve25519-generic-y += curve25519-generic.o
# clang versions prior to 18 may blow out the stack with KASAN
-ifeq ($(call clang-min-version, 180000),)
+ifeq ($(CONFIG_CC_IS_CLANG)_$(call clang-min-version, 180000),y_)
KASAN_SANITIZE_curve25519-hacl64.o := n
endif
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 329/568] scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (327 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 328/568] lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 330/568] extcon: adc-jack: Cleanup wakeup source only if it was enabled Greg Kroah-Hartman
` (245 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Bart Van Assche,
Martin K. Petersen
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <adrian.hunter@intel.com>
commit bb44826c3bdbf1fa3957008a04908f45e5666463 upstream.
Intel platforms with UFS, can support Suspend-to-Idle (S0ix) and
Suspend-to-RAM (S3). For S0ix the link state should be HIBERNATE. For
S3, state is lost, so the link state must be OFF. Driver policy,
expressed by spm_lvl, can be 3 (link HIBERNATE, device SLEEP) for S0ix
but must be changed to 5 (link OFF, device POWEROFF) for S3.
Fix support for S0ix/S3 by switching spm_lvl as needed. During suspend
->prepare(), if the suspend target state is not Suspend-to-Idle, ensure
the spm_lvl is at least 5 to ensure that resume will be possible from
deep sleep states. During suspend ->complete(), restore the spm_lvl to
its original value that is suitable for S0ix.
This fix is first needed in Intel Alder Lake based controllers.
Fixes: 7dc9fb47bc9a ("scsi: ufs: ufs-pci: Add support for Intel ADL")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20251024085918.31825-2-adrian.hunter@intel.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ufs/host/ufshcd-pci.c | 67 ++++++++++++++++++++++++++++++++++++++++--
1 file changed, 65 insertions(+), 2 deletions(-)
--- a/drivers/ufs/host/ufshcd-pci.c
+++ b/drivers/ufs/host/ufshcd-pci.c
@@ -15,6 +15,7 @@
#include <linux/pci.h>
#include <linux/pm_runtime.h>
#include <linux/pm_qos.h>
+#include <linux/suspend.h>
#include <linux/debugfs.h>
#include <linux/uuid.h>
#include <linux/acpi.h>
@@ -34,6 +35,7 @@ struct intel_host {
u32 dsm_fns;
u32 active_ltr;
u32 idle_ltr;
+ int saved_spm_lvl;
struct dentry *debugfs_root;
struct gpio_desc *reset_gpio;
};
@@ -375,6 +377,7 @@ static int ufs_intel_common_init(struct
host = devm_kzalloc(hba->dev, sizeof(*host), GFP_KERNEL);
if (!host)
return -ENOMEM;
+ host->saved_spm_lvl = -1;
ufshcd_set_variant(hba, host);
intel_dsm_init(host, hba->dev);
if (INTEL_DSM_SUPPORTED(host, RESET)) {
@@ -542,6 +545,66 @@ static int ufshcd_pci_restore(struct dev
return ufshcd_system_resume(dev);
}
+
+static int ufs_intel_suspend_prepare(struct device *dev)
+{
+ struct ufs_hba *hba = dev_get_drvdata(dev);
+ struct intel_host *host = ufshcd_get_variant(hba);
+ int err;
+
+ /*
+ * Only s2idle (S0ix) retains link state. Force power-off
+ * (UFS_PM_LVL_5) for any other case.
+ */
+ if (pm_suspend_target_state != PM_SUSPEND_TO_IDLE && hba->spm_lvl < UFS_PM_LVL_5) {
+ host->saved_spm_lvl = hba->spm_lvl;
+ hba->spm_lvl = UFS_PM_LVL_5;
+ }
+
+ err = ufshcd_suspend_prepare(dev);
+
+ if (err < 0 && host->saved_spm_lvl != -1) {
+ hba->spm_lvl = host->saved_spm_lvl;
+ host->saved_spm_lvl = -1;
+ }
+
+ return err;
+}
+
+static void ufs_intel_resume_complete(struct device *dev)
+{
+ struct ufs_hba *hba = dev_get_drvdata(dev);
+ struct intel_host *host = ufshcd_get_variant(hba);
+
+ ufshcd_resume_complete(dev);
+
+ if (host->saved_spm_lvl != -1) {
+ hba->spm_lvl = host->saved_spm_lvl;
+ host->saved_spm_lvl = -1;
+ }
+}
+
+static int ufshcd_pci_suspend_prepare(struct device *dev)
+{
+ struct ufs_hba *hba = dev_get_drvdata(dev);
+
+ if (!strcmp(hba->vops->name, "intel-pci"))
+ return ufs_intel_suspend_prepare(dev);
+
+ return ufshcd_suspend_prepare(dev);
+}
+
+static void ufshcd_pci_resume_complete(struct device *dev)
+{
+ struct ufs_hba *hba = dev_get_drvdata(dev);
+
+ if (!strcmp(hba->vops->name, "intel-pci")) {
+ ufs_intel_resume_complete(dev);
+ return;
+ }
+
+ ufshcd_resume_complete(dev);
+}
#endif
/**
@@ -633,8 +696,8 @@ static const struct dev_pm_ops ufshcd_pc
.thaw = ufshcd_system_resume,
.poweroff = ufshcd_system_suspend,
.restore = ufshcd_pci_restore,
- .prepare = ufshcd_suspend_prepare,
- .complete = ufshcd_resume_complete,
+ .prepare = ufshcd_pci_suspend_prepare,
+ .complete = ufshcd_pci_resume_complete,
#endif
};
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 330/568] extcon: adc-jack: Cleanup wakeup source only if it was enabled
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (328 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 329/568] scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 331/568] drm/amdgpu: Fix function header names in amdgpu_connectors.c Greg Kroah-Hartman
` (244 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET,
Krzysztof Kozlowski, Chanwoo Choi
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 92bac7d4de9c07933f6b76d8f1c7f8240f911f4f upstream.
Driver in the probe enables wakeup source conditionally, so the cleanup
path should do the same - do not release the wakeup source memory if it
was not allocated.
Link: https://lore.kernel.org/lkml/20250509071703.39442-2-krzysztof.kozlowski@linaro.org/
Reported-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Closes: https://lore.kernel.org/r/22aaebb7-553b-4571-8a43-58a523241082@wanadoo.fr/
Fixes: 78b6a991eb6c ("extcon: adc-jack: Fix wakeup source leaks on device unbind")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/extcon/extcon-adc-jack.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/extcon/extcon-adc-jack.c
+++ b/drivers/extcon/extcon-adc-jack.c
@@ -162,7 +162,8 @@ static int adc_jack_remove(struct platfo
{
struct adc_jack_data *data = platform_get_drvdata(pdev);
- device_init_wakeup(&pdev->dev, false);
+ if (data->wakeup_source)
+ device_init_wakeup(&pdev->dev, false);
free_irq(data->irq, data);
cancel_work_sync(&data->handler.work);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 331/568] drm/amdgpu: Fix function header names in amdgpu_connectors.c
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (329 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 330/568] extcon: adc-jack: Cleanup wakeup source only if it was enabled Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 332/568] selftests: netdevsim: set test timeout to 10 minutes Greg Kroah-Hartman
` (243 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, Alex Deucher,
Srinivasan Shanmugam
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
commit 38ab33dbea594700c8d6cc81eec0a54e95d3eb2f upstream.
Align the function headers for `amdgpu_max_hdmi_pixel_clock` and
`amdgpu_connector_dvi_mode_valid` with the function implementations so
they match the expected kdoc style.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c:1199: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
* Returns the maximum supported HDMI (TMDS) pixel clock in KHz.
drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c:1212: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
* Validates the given display mode on DVI and HDMI connectors.
Fixes: 585b2f685c56 ("drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)")
Cc: Christian König <christian.koenig@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
@@ -1166,7 +1166,10 @@ static void amdgpu_connector_dvi_force(s
}
/**
- * Returns the maximum supported HDMI (TMDS) pixel clock in KHz.
+ * amdgpu_max_hdmi_pixel_clock - Return max supported HDMI (TMDS) pixel clock
+ * @adev: pointer to amdgpu_device
+ *
+ * Return: maximum supported HDMI (TMDS) pixel clock in KHz.
*/
static int amdgpu_max_hdmi_pixel_clock(const struct amdgpu_device *adev)
{
@@ -1179,8 +1182,14 @@ static int amdgpu_max_hdmi_pixel_clock(c
}
/**
- * Validates the given display mode on DVI and HDMI connectors,
- * including analog signals on DVI-I.
+ * amdgpu_connector_dvi_mode_valid - Validate a mode on DVI/HDMI connectors
+ * @connector: DRM connector to validate the mode on
+ * @mode: display mode to validate
+ *
+ * Validate the given display mode on DVI and HDMI connectors, including
+ * analog signals on DVI-I.
+ *
+ * Return: drm_mode_status indicating whether the mode is valid.
*/
static enum drm_mode_status amdgpu_connector_dvi_mode_valid(struct drm_connector *connector,
struct drm_display_mode *mode)
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 332/568] selftests: netdevsim: set test timeout to 10 minutes
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (330 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 331/568] drm/amdgpu: Fix function header names in amdgpu_connectors.c Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 333/568] drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD Greg Kroah-Hartman
` (242 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, Simon Horman,
David S. Miller
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
commit afbf75e8da8ce8a0698212953d350697bb4355a6 upstream.
The longest running netdevsim test, nexthop.sh, currently takes
5 min to finish. Around 260s to be exact, and 310s on a debug kernel.
The default timeout in selftest is 45sec, so we need an explicit
config. Give ourselves some headroom and use 10min.
Commit under Fixes isn't really to "blame" but prior to that
netdevsim tests weren't integrated with kselftest infra
so blaming the tests themselves doesn't seem right, either.
Fixes: 8ff25dac88f6 ("netdevsim: add Makefile for selftests")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/drivers/net/netdevsim/settings | 1 +
1 file changed, 1 insertion(+)
create mode 100644 tools/testing/selftests/drivers/net/netdevsim/settings
--- /dev/null
+++ b/tools/testing/selftests/drivers/net/netdevsim/settings
@@ -0,0 +1 @@
+timeout=600
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 333/568] drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (331 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 332/568] selftests: netdevsim: set test timeout to 10 minutes Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 334/568] drm/i915: Fix conversion between clock ticks and nanoseconds Greg Kroah-Hartman
` (241 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andi Shyti, Janusz Krzysztofik,
Sebastian Brzezinka, Krzysztof Karas, Andi Shyti, Rodrigo Vivi,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
[ Upstream commit 84bbe327a5cbb060f3321c9d9d4d53936fc1ef9b ]
On completion of i915_vma_pin_ww(), a synchronous variant of
dma_fence_work_commit() is called. When pinning a VMA to GGTT address
space on a Cherry View family processor, or on a Broxton generation SoC
with VTD enabled, i.e., when stop_machine() is then called from
intel_ggtt_bind_vma(), that can potentially lead to lock inversion among
reservation_ww and cpu_hotplug locks.
[86.861179] ======================================================
[86.861193] WARNING: possible circular locking dependency detected
[86.861209] 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 Tainted: G U
[86.861226] ------------------------------------------------------
[86.861238] i915_module_loa/1432 is trying to acquire lock:
[86.861252] ffffffff83489090 (cpu_hotplug_lock){++++}-{0:0}, at: stop_machine+0x1c/0x50
[86.861290]
but task is already holding lock:
[86.861303] ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
[86.862233]
which lock already depends on the new lock.
[86.862251]
the existing dependency chain (in reverse order) is:
[86.862265]
-> #5 (reservation_ww_class_mutex){+.+.}-{3:3}:
[86.862292] dma_resv_lockdep+0x19a/0x390
[86.862315] do_one_initcall+0x60/0x3f0
[86.862334] kernel_init_freeable+0x3cd/0x680
[86.862353] kernel_init+0x1b/0x200
[86.862369] ret_from_fork+0x47/0x70
[86.862383] ret_from_fork_asm+0x1a/0x30
[86.862399]
-> #4 (reservation_ww_class_acquire){+.+.}-{0:0}:
[86.862425] dma_resv_lockdep+0x178/0x390
[86.862440] do_one_initcall+0x60/0x3f0
[86.862454] kernel_init_freeable+0x3cd/0x680
[86.862470] kernel_init+0x1b/0x200
[86.862482] ret_from_fork+0x47/0x70
[86.862495] ret_from_fork_asm+0x1a/0x30
[86.862509]
-> #3 (&mm->mmap_lock){++++}-{3:3}:
[86.862531] down_read_killable+0x46/0x1e0
[86.862546] lock_mm_and_find_vma+0xa2/0x280
[86.862561] do_user_addr_fault+0x266/0x8e0
[86.862578] exc_page_fault+0x8a/0x2f0
[86.862593] asm_exc_page_fault+0x27/0x30
[86.862607] filldir64+0xeb/0x180
[86.862620] kernfs_fop_readdir+0x118/0x480
[86.862635] iterate_dir+0xcf/0x2b0
[86.862648] __x64_sys_getdents64+0x84/0x140
[86.862661] x64_sys_call+0x1058/0x2660
[86.862675] do_syscall_64+0x91/0xe90
[86.862689] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[86.862703]
-> #2 (&root->kernfs_rwsem){++++}-{3:3}:
[86.862725] down_write+0x3e/0xf0
[86.862738] kernfs_add_one+0x30/0x3c0
[86.862751] kernfs_create_dir_ns+0x53/0xb0
[86.862765] internal_create_group+0x134/0x4c0
[86.862779] sysfs_create_group+0x13/0x20
[86.862792] topology_add_dev+0x1d/0x30
[86.862806] cpuhp_invoke_callback+0x4b5/0x850
[86.862822] cpuhp_issue_call+0xbf/0x1f0
[86.862836] __cpuhp_setup_state_cpuslocked+0x111/0x320
[86.862852] __cpuhp_setup_state+0xb0/0x220
[86.862866] topology_sysfs_init+0x30/0x50
[86.862879] do_one_initcall+0x60/0x3f0
[86.862893] kernel_init_freeable+0x3cd/0x680
[86.862908] kernel_init+0x1b/0x200
[86.862921] ret_from_fork+0x47/0x70
[86.862934] ret_from_fork_asm+0x1a/0x30
[86.862947]
-> #1 (cpuhp_state_mutex){+.+.}-{3:3}:
[86.862969] __mutex_lock+0xaa/0xed0
[86.862982] mutex_lock_nested+0x1b/0x30
[86.862995] __cpuhp_setup_state_cpuslocked+0x67/0x320
[86.863012] __cpuhp_setup_state+0xb0/0x220
[86.863026] page_alloc_init_cpuhp+0x2d/0x60
[86.863041] mm_core_init+0x22/0x2d0
[86.863054] start_kernel+0x576/0xbd0
[86.863068] x86_64_start_reservations+0x18/0x30
[86.863084] x86_64_start_kernel+0xbf/0x110
[86.863098] common_startup_64+0x13e/0x141
[86.863114]
-> #0 (cpu_hotplug_lock){++++}-{0:0}:
[86.863135] __lock_acquire+0x1635/0x2810
[86.863152] lock_acquire+0xc4/0x2f0
[86.863166] cpus_read_lock+0x41/0x100
[86.863180] stop_machine+0x1c/0x50
[86.863194] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915]
[86.863987] intel_ggtt_bind_vma+0x43/0x70 [i915]
[86.864735] __vma_bind+0x55/0x70 [i915]
[86.865510] fence_work+0x26/0xa0 [i915]
[86.866248] fence_notify+0xa1/0x140 [i915]
[86.866983] __i915_sw_fence_complete+0x8f/0x270 [i915]
[86.867719] i915_sw_fence_commit+0x39/0x60 [i915]
[86.868453] i915_vma_pin_ww+0x462/0x1360 [i915]
[86.869228] i915_vma_pin.constprop.0+0x133/0x1d0 [i915]
[86.870001] initial_plane_vma+0x307/0x840 [i915]
[86.870774] intel_initial_plane_config+0x33f/0x670 [i915]
[86.871546] intel_display_driver_probe_nogem+0x1c6/0x260 [i915]
[86.872330] i915_driver_probe+0x7fa/0xe80 [i915]
[86.873057] i915_pci_probe+0xe6/0x220 [i915]
[86.873782] local_pci_probe+0x47/0xb0
[86.873802] pci_device_probe+0xf3/0x260
[86.873817] really_probe+0xf1/0x3c0
[86.873833] __driver_probe_device+0x8c/0x180
[86.873848] driver_probe_device+0x24/0xd0
[86.873862] __driver_attach+0x10f/0x220
[86.873876] bus_for_each_dev+0x7f/0xe0
[86.873892] driver_attach+0x1e/0x30
[86.873904] bus_add_driver+0x151/0x290
[86.873917] driver_register+0x5e/0x130
[86.873931] __pci_register_driver+0x7d/0x90
[86.873945] i915_pci_register_driver+0x23/0x30 [i915]
[86.874678] i915_init+0x37/0x120 [i915]
[86.875347] do_one_initcall+0x60/0x3f0
[86.875369] do_init_module+0x97/0x2a0
[86.875385] load_module+0x2c54/0x2d80
[86.875398] init_module_from_file+0x96/0xe0
[86.875413] idempotent_init_module+0x117/0x330
[86.875426] __x64_sys_finit_module+0x77/0x100
[86.875440] x64_sys_call+0x24de/0x2660
[86.875454] do_syscall_64+0x91/0xe90
[86.875470] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[86.875486]
other info that might help us debug this:
[86.875502] Chain exists of:
cpu_hotplug_lock --> reservation_ww_class_acquire --> reservation_ww_class_mutex
[86.875539] Possible unsafe locking scenario:
[86.875552] CPU0 CPU1
[86.875563] ---- ----
[86.875573] lock(reservation_ww_class_mutex);
[86.875588] lock(reservation_ww_class_acquire);
[86.875606] lock(reservation_ww_class_mutex);
[86.875624] rlock(cpu_hotplug_lock);
[86.875637]
*** DEADLOCK ***
[86.875650] 3 locks held by i915_module_loa/1432:
[86.875663] #0: ffff888101f5c1b0 (&dev->mutex){....}-{3:3}, at: __driver_attach+0x104/0x220
[86.875699] #1: ffffc90002e0b4a0 (reservation_ww_class_acquire){+.+.}-{0:0}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
[86.876512] #2: ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
[86.877305]
stack backtrace:
[86.877326] CPU: 0 UID: 0 PID: 1432 Comm: i915_module_loa Tainted: G U 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 PREEMPT(voluntary)
[86.877334] Tainted: [U]=USER
[86.877336] Hardware name: /NUC5CPYB, BIOS PYBSWCEL.86A.0079.2020.0420.1316 04/20/2020
[86.877339] Call Trace:
[86.877344] <TASK>
[86.877353] dump_stack_lvl+0x91/0xf0
[86.877364] dump_stack+0x10/0x20
[86.877369] print_circular_bug+0x285/0x360
[86.877379] check_noncircular+0x135/0x150
[86.877390] __lock_acquire+0x1635/0x2810
[86.877403] lock_acquire+0xc4/0x2f0
[86.877408] ? stop_machine+0x1c/0x50
[86.877422] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915]
[86.878173] cpus_read_lock+0x41/0x100
[86.878182] ? stop_machine+0x1c/0x50
[86.878191] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915]
[86.878916] stop_machine+0x1c/0x50
[86.878927] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915]
[86.879652] intel_ggtt_bind_vma+0x43/0x70 [i915]
[86.880375] __vma_bind+0x55/0x70 [i915]
[86.881133] fence_work+0x26/0xa0 [i915]
[86.881851] fence_notify+0xa1/0x140 [i915]
[86.882566] __i915_sw_fence_complete+0x8f/0x270 [i915]
[86.883286] i915_sw_fence_commit+0x39/0x60 [i915]
[86.884003] i915_vma_pin_ww+0x462/0x1360 [i915]
[86.884756] ? i915_vma_pin.constprop.0+0x6c/0x1d0 [i915]
[86.885513] i915_vma_pin.constprop.0+0x133/0x1d0 [i915]
[86.886281] initial_plane_vma+0x307/0x840 [i915]
[86.887049] intel_initial_plane_config+0x33f/0x670 [i915]
[86.887819] intel_display_driver_probe_nogem+0x1c6/0x260 [i915]
[86.888587] i915_driver_probe+0x7fa/0xe80 [i915]
[86.889293] ? mutex_unlock+0x12/0x20
[86.889301] ? drm_privacy_screen_get+0x171/0x190
[86.889308] ? acpi_dev_found+0x66/0x80
[86.889321] i915_pci_probe+0xe6/0x220 [i915]
[86.890038] local_pci_probe+0x47/0xb0
[86.890049] pci_device_probe+0xf3/0x260
[86.890058] really_probe+0xf1/0x3c0
[86.890067] __driver_probe_device+0x8c/0x180
[86.890072] driver_probe_device+0x24/0xd0
[86.890078] __driver_attach+0x10f/0x220
[86.890083] ? __pfx___driver_attach+0x10/0x10
[86.890088] bus_for_each_dev+0x7f/0xe0
[86.890097] driver_attach+0x1e/0x30
[86.890101] bus_add_driver+0x151/0x290
[86.890107] driver_register+0x5e/0x130
[86.890113] __pci_register_driver+0x7d/0x90
[86.890119] i915_pci_register_driver+0x23/0x30 [i915]
[86.890833] i915_init+0x37/0x120 [i915]
[86.891482] ? __pfx_i915_init+0x10/0x10 [i915]
[86.892135] do_one_initcall+0x60/0x3f0
[86.892145] ? __kmalloc_cache_noprof+0x33f/0x470
[86.892157] do_init_module+0x97/0x2a0
[86.892164] load_module+0x2c54/0x2d80
[86.892168] ? __kernel_read+0x15c/0x300
[86.892185] ? kernel_read_file+0x2b1/0x320
[86.892195] init_module_from_file+0x96/0xe0
[86.892199] ? init_module_from_file+0x96/0xe0
[86.892211] idempotent_init_module+0x117/0x330
[86.892224] __x64_sys_finit_module+0x77/0x100
[86.892230] x64_sys_call+0x24de/0x2660
[86.892236] do_syscall_64+0x91/0xe90
[86.892243] ? irqentry_exit+0x77/0xb0
[86.892249] ? sysvec_apic_timer_interrupt+0x57/0xc0
[86.892256] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[86.892261] RIP: 0033:0x7303e1b2725d
[86.892271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8b bb 0d 00 f7 d8 64 89 01 48
[86.892276] RSP: 002b:00007ffddd1fdb38 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[86.892281] RAX: ffffffffffffffda RBX: 00005d771d88fd90 RCX: 00007303e1b2725d
[86.892285] RDX: 0000000000000000 RSI: 00005d771d893aa0 RDI: 000000000000000c
[86.892287] RBP: 00007ffddd1fdbf0 R08: 0000000000000040 R09: 00007ffddd1fdb80
[86.892289] R10: 00007303e1c03b20 R11: 0000000000000246 R12: 00005d771d893aa0
[86.892292] R13: 0000000000000000 R14: 00005d771d88f0d0 R15: 00005d771d895710
[86.892304] </TASK>
Call asynchronous variant of dma_fence_work_commit() in that case.
v3: Provide more verbose in-line comment (Andi),
- mention target environments in commit message.
Fixes: 7d1c2618eac59 ("drm/i915: Take reservation lock around i915_vma_pin.")
Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14985
Cc: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
Reviewed-by: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
Reviewed-by: Krzysztof Karas <krzysztof.karas@intel.com>
Acked-by: Andi Shyti <andi.shyti@linux.intel.com>
Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com>
Link: https://lore.kernel.org/r/20251023082925.351307-6-janusz.krzysztofik@linux.intel.com
(cherry picked from commit 648ef1324add1c2e2b6041cdf0b28d31fbca5f13)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/i915_vma.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
index 58a03da16a10f..7601e74a96de4 100644
--- a/drivers/gpu/drm/i915/i915_vma.c
+++ b/drivers/gpu/drm/i915/i915_vma.c
@@ -1548,8 +1548,20 @@ int i915_vma_pin_ww(struct i915_vma *vma, struct i915_gem_ww_ctx *ww,
err_vma_res:
i915_vma_resource_free(vma_res);
err_fence:
- if (work)
- dma_fence_work_commit_imm(&work->base);
+ if (work) {
+ /*
+ * When pinning VMA to GGTT on CHV or BXT with VTD enabled,
+ * commit VMA binding asynchronously to avoid risk of lock
+ * inversion among reservation_ww locks held here and
+ * cpu_hotplug_lock acquired from stop_machine(), which we
+ * wrap around GGTT updates when running in those environments.
+ */
+ if (i915_vma_is_ggtt(vma) &&
+ intel_vm_no_concurrent_access_wa(vma->vm->i915))
+ dma_fence_work_commit(&work->base);
+ else
+ dma_fence_work_commit_imm(&work->base);
+ }
err_rpm:
intel_runtime_pm_put(&vma->vm->i915->runtime_pm, wakeref);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 334/568] drm/i915: Fix conversion between clock ticks and nanoseconds
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (332 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 333/568] drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 335/568] smb: client: fix refcount leak in smb2_set_path_attr Greg Kroah-Hartman
` (240 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Umesh Nerlige Ramappa,
Ashutosh Dixit, Rodrigo Vivi, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
[ Upstream commit 7d44ad6b43d0be43d080180413a1b6c24cfbd266 ]
When tick values are large, the multiplication by NSEC_PER_SEC is larger
than 64 bits and results in bad conversions.
The issue is seen in PMU busyness counters that look like they have
wrapped around due to bad conversion. i915 PMU implementation returns
monotonically increasing counters. If a count is lesser than previous
one, it will only return the larger value until the smaller value
catches up. The user will see this as zero delta between two
measurements even though the engines are busy.
Fix it by using mul_u64_u32_div()
Fixes: 77cdd054dd2c ("drm/i915/pmu: Connect engine busyness stats from GuC to pmu")
Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14955
Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
Link: https://lore.kernel.org/r/20251016000350.1152382-2-umesh.nerlige.ramappa@intel.com
(cherry picked from commit 2ada9cb1df3f5405a01d013b708b1b0914efccfe)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
[Rodrigo: Added the Fixes tag while cherry-picking to fixes]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c b/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c
index 3f656d3dba9a8..8eebf41799781 100644
--- a/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c
+++ b/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c
@@ -180,7 +180,7 @@ static u64 div_u64_roundup(u64 nom, u32 den)
u64 intel_gt_clock_interval_to_ns(const struct intel_gt *gt, u64 count)
{
- return div_u64_roundup(count * NSEC_PER_SEC, gt->clock_frequency);
+ return mul_u64_u32_div(count, NSEC_PER_SEC, gt->clock_frequency);
}
u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count)
@@ -190,7 +190,7 @@ u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count)
u64 intel_gt_ns_to_clock_interval(const struct intel_gt *gt, u64 ns)
{
- return div_u64_roundup(gt->clock_frequency * ns, NSEC_PER_SEC);
+ return mul_u64_u32_div(ns, gt->clock_frequency, NSEC_PER_SEC);
}
u64 intel_gt_ns_to_pm_interval(const struct intel_gt *gt, u64 ns)
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 335/568] smb: client: fix refcount leak in smb2_set_path_attr
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (333 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 334/568] drm/i915: Fix conversion between clock ticks and nanoseconds Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 336/568] drm/amd: Fix suspend failure with secure display TA Greg Kroah-Hartman
` (239 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Henrique Carvalho, Shuhao Fu,
Steve French, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuhao Fu <sfual@cse.ust.hk>
[ Upstream commit b540de9e3b4fab3b9e10f30714a6f5c1b2a50ec3 ]
Fix refcount leak in `smb2_set_path_attr` when path conversion fails.
Function `cifs_get_writable_path` returns `cfile` with its reference
counter `cfile->count` increased on success. Function `smb2_compound_op`
would decrease the reference counter for `cfile`, as stated in its
comment. By calling `smb2_rename_path`, the reference counter of `cfile`
would leak if `cifs_convert_path_to_utf16` fails in `smb2_set_path_attr`.
Fixes: 8de9e86c67ba ("cifs: create a helper to find a writeable handle by path name")
Acked-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Shuhao Fu <sfual@cse.ust.hk>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smb2inode.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c
index 7d3685cd345fd..452a60e09cbed 100644
--- a/fs/smb/client/smb2inode.c
+++ b/fs/smb/client/smb2inode.c
@@ -721,6 +721,8 @@ smb2_set_path_attr(const unsigned int xid, struct cifs_tcon *tcon,
smb2_to_name = cifs_convert_path_to_utf16(to_name, cifs_sb);
if (smb2_to_name == NULL) {
rc = -ENOMEM;
+ if (cfile)
+ cifsFileInfo_put(cfile);
goto smb2_rename_path;
}
rc = smb2_compound_op(xid, tcon, cifs_sb, from_name, access,
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 336/568] drm/amd: Fix suspend failure with secure display TA
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (334 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 335/568] smb: client: fix refcount leak in smb2_set_path_attr Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 337/568] compiler_types: Move unused static inline functions warning to W=2 Greg Kroah-Hartman
` (238 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello, Alex Deucher,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
[ Upstream commit b09cb2996cdf50cd1ab4020e002c95d742c81313 ]
commit c760bcda83571 ("drm/amd: Check whether secure display TA loaded
successfully") attempted to fix extra messages, but failed to port the
cleanup that was in commit 5c6d52ff4b61e ("drm/amd: Don't try to enable
secure display TA multiple times") to prevent multiple tries.
Add that to the failure handling path even on a quick failure.
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4679
Fixes: c760bcda8357 ("drm/amd: Check whether secure display TA loaded successfully")
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 4104c0a454f6a4d1e0d14895d03c0e7bdd0c8240)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
index e22eaf9d450d3..9153459455910 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
@@ -1962,8 +1962,11 @@ static int psp_securedisplay_initialize(struct psp_context *psp)
if (!ret && !psp->securedisplay_context.context.resp_status) {
psp->securedisplay_context.context.initialized = true;
mutex_init(&psp->securedisplay_context.mutex);
- } else
+ } else {
+ /* don't try again */
+ psp->securedisplay_context.context.bin_desc.size_bytes = 0;
return ret;
+ }
psp_prep_securedisplay_cmd_buf(psp, &securedisplay_cmd,
TA_SECUREDISPLAY_COMMAND__QUERY_TA);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 337/568] compiler_types: Move unused static inline functions warning to W=2
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (335 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 336/568] drm/amd: Fix suspend failure with secure display TA Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 338/568] RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors Greg Kroah-Hartman
` (237 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Zijlstra, Andy Shevchenko,
Nathan Chancellor, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
[ Upstream commit 9818af18db4bfefd320d0fef41390a616365e6f7 ]
Per Nathan, clang catches unused "static inline" functions in C files
since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static
inline functions for W=1 build").
Linus said:
> So I entirely ignore W=1 issues, because I think so many of the extra
> warnings are bogus.
>
> But if this one in particular is causing more problems than most -
> some teams do seem to use W=1 as part of their test builds - it's fine
> to send me a patch that just moves bad warnings to W=2.
>
> And if anybody uses W=2 for their test builds, that's THEIR problem..
Here is the change to bump the warning from W=1 to W=2.
Fixes: 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build")
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20251106105000.2103276-1-andriy.shevchenko@linux.intel.com
[nathan: Adjust comment as well]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/compiler_types.h | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
index 8f50c589ad5f4..44767d754dff6 100644
--- a/include/linux/compiler_types.h
+++ b/include/linux/compiler_types.h
@@ -175,10 +175,9 @@ struct ftrace_likely_data {
/*
* GCC does not warn about unused static inline functions for -Wunused-function.
* Suppress the warning in clang as well by using __maybe_unused, but enable it
- * for W=1 build. This will allow clang to find unused functions. Remove the
- * __inline_maybe_unused entirely after fixing most of -Wunused-function warnings.
+ * for W=2 build. This will allow clang to find unused functions.
*/
-#ifdef KBUILD_EXTRA_WARN1
+#ifdef KBUILD_EXTRA_WARN2
#define __inline_maybe_unused
#else
#define __inline_maybe_unused __maybe_unused
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 338/568] RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (336 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 337/568] compiler_types: Move unused static inline functions warning to W=2 Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 339/568] drm/amd/pm: Disable MCLK switching on SI at high pixel clocks Greg Kroah-Hartman
` (236 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Danil Skrebenkov, Andrew Jones,
Paul Walmsley, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danil Skrebenkov <danil.skrebenkov@cloudbear.ru>
[ Upstream commit ae9e9f3d67dcef7582a4524047b01e33c5185ddb ]
openSBI v1.7 adds harts checks for ipi operations. Especially it
adds comparison between hmask passed as an argument from linux
and mask of online harts (from openSBI side). If they don't
fit each other the error occurs.
When cpu is offline, cpu_online_mask is explicitly cleared in
__cpu_disable. However, there is no explicit clearing of
mm_cpumask. mm_cpumask is used for rfence operations that
call openSBI RFENCE extension which uses ipi to remote harts.
If hart is offline there may be error if mask of linux is not
as mask of online harts in openSBI.
this patch adds explicit clearing of mm_cpumask for offline hart.
Signed-off-by: Danil Skrebenkov <danil.skrebenkov@cloudbear.ru>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Link: https://lore.kernel.org/r/20250919132849.31676-1-danil.skrebenkov@cloudbear.ru
[pjw@kernel.org: rewrote subject line for clarity]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/kernel/cpu-hotplug.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/riscv/kernel/cpu-hotplug.c b/arch/riscv/kernel/cpu-hotplug.c
index 462b3631663f9..374f334df86de 100644
--- a/arch/riscv/kernel/cpu-hotplug.c
+++ b/arch/riscv/kernel/cpu-hotplug.c
@@ -61,6 +61,7 @@ void __cpu_die(unsigned int cpu)
}
pr_notice("CPU%u: off\n", cpu);
+ clear_tasks_mm_cpumask(cpu);
/* Verify from the firmware if the cpu is really stopped*/
if (cpu_ops[cpu]->cpu_is_stopped)
ret = cpu_ops[cpu]->cpu_is_stopped(cpu);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 339/568] drm/amd/pm: Disable MCLK switching on SI at high pixel clocks
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (337 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 338/568] RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 340/568] drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices Greg Kroah-Hartman
` (235 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Timur Kristóf,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <timur.kristof@gmail.com>
[ Upstream commit 5c05bcf6ae7732da1bd4dc1958d527b5f07f216a ]
On various SI GPUs, a flickering can be observed near the bottom
edge of the screen when using a single 4K 60Hz monitor over DP.
Disabling MCLK switching works around this problem.
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index 7a85c042a6db9..2395d0a831846 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -3485,6 +3485,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
* for these GPUs to calculate bandwidth requirements.
*/
if (high_pixelclock_count) {
+ /* Work around flickering lines at the bottom edge
+ * of the screen when using a single 4K 60Hz monitor.
+ */
+ disable_mclk_switching = true;
+
/* On Oland, we observe some flickering when two 4K 60Hz
* displays are connected, possibly because voltage is too low.
* Raise the voltage by requiring a higher SCLK.
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 340/568] drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (338 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 339/568] drm/amd/pm: Disable MCLK switching on SI at high pixel clocks Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 341/568] NFS4: Fix state renewals missing after boot Greg Kroah-Hartman
` (234 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, Lijo Lazar,
Jesse Zhang, Alex Deucher, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse.Zhang <Jesse.Zhang@amd.com>
[ Upstream commit 883f309add55060233bf11c1ea6947140372920f ]
Previously, APU platforms (and other scenarios with uninitialized VRAM managers)
triggered a NULL pointer dereference in `ttm_resource_manager_usage()`. The root
cause is not that the `struct ttm_resource_manager *man` pointer itself is NULL,
but that `man->bdev` (the backing device pointer within the manager) remains
uninitialized (NULL) on APUs—since APUs lack dedicated VRAM and do not fully
set up VRAM manager structures. When `ttm_resource_manager_usage()` attempts to
acquire `man->bdev->lru_lock`, it dereferences the NULL `man->bdev`, leading to
a kernel OOPS.
1. **amdgpu_cs.c**: Extend the existing bandwidth control check in
`amdgpu_cs_get_threshold_for_moves()` to include a check for
`ttm_resource_manager_used()`. If the manager is not used (uninitialized
`bdev`), return 0 for migration thresholds immediately—skipping VRAM-specific
logic that would trigger the NULL dereference.
2. **amdgpu_kms.c**: Update the `AMDGPU_INFO_VRAM_USAGE` ioctl and memory info
reporting to use a conditional: if the manager is used, return the real VRAM
usage; otherwise, return 0. This avoids accessing `man->bdev` when it is
NULL.
3. **amdgpu_virt.c**: Modify the vf2pf (virtual function to physical function)
data write path. Use `ttm_resource_manager_used()` to check validity: if the
manager is usable, calculate `fb_usage` from VRAM usage; otherwise, set
`fb_usage` to 0 (APUs have no discrete framebuffer to report).
This approach is more robust than APU-specific checks because it:
- Works for all scenarios where the VRAM manager is uninitialized (not just APUs),
- Aligns with TTM's design by using its native helper function,
- Preserves correct behavior for discrete GPUs (which have fully initialized
`man->bdev` and pass the `ttm_resource_manager_used()` check).
v4: use ttm_resource_manager_used(&adev->mman.vram_mgr.manager) instead of checking the adev->gmc.is_app_apu flag (Christian)
Reviewed-by: Christian König <christian.koenig@amd.com>
Suggested-by: Lijo Lazar <lijo.lazar@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 7 ++++---
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 4 ++--
3 files changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 9ff6a9255c1b1..f83eff3c62e17 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -663,7 +663,7 @@ static void amdgpu_cs_get_threshold_for_moves(struct amdgpu_device *adev,
*/
const s64 us_upper_bound = 200000;
- if (!adev->mm_stats.log2_max_MBps) {
+ if ((!adev->mm_stats.log2_max_MBps) || !ttm_resource_manager_used(&adev->mman.vram_mgr.manager)) {
*max_bytes = 0;
*max_vis_bytes = 0;
return;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index 24b4bd6bb2771..345ccd721d745 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -647,7 +647,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
ui64 = atomic64_read(&adev->num_vram_cpu_page_faults);
return copy_to_user(out, &ui64, min(size, 8u)) ? -EFAULT : 0;
case AMDGPU_INFO_VRAM_USAGE:
- ui64 = ttm_resource_manager_usage(&adev->mman.vram_mgr.manager);
+ ui64 = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ?
+ ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) : 0;
return copy_to_user(out, &ui64, min(size, 8u)) ? -EFAULT : 0;
case AMDGPU_INFO_VIS_VRAM_USAGE:
ui64 = amdgpu_vram_mgr_vis_usage(&adev->mman.vram_mgr);
@@ -693,8 +694,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
mem.vram.usable_heap_size = adev->gmc.real_vram_size -
atomic64_read(&adev->vram_pin_size) -
AMDGPU_VM_RESERVED_VRAM;
- mem.vram.heap_usage =
- ttm_resource_manager_usage(vram_man);
+ mem.vram.heap_usage = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ?
+ ttm_resource_manager_usage(vram_man) : 0;
mem.vram.max_allocation = mem.vram.usable_heap_size * 3 / 4;
mem.cpu_accessible_vram.total_heap_size =
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
index 6174bef0ecb88..c626ed88e6420 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
@@ -593,8 +593,8 @@ static int amdgpu_virt_write_vf2pf_data(struct amdgpu_device *adev)
vf2pf_info->driver_cert = 0;
vf2pf_info->os_info.all = 0;
- vf2pf_info->fb_usage =
- ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) >> 20;
+ vf2pf_info->fb_usage = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ?
+ ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) >> 20 : 0;
vf2pf_info->fb_vis_usage =
amdgpu_vram_mgr_vis_usage(&adev->mman.vram_mgr) >> 20;
vf2pf_info->fb_size = adev->gmc.real_vram_size >> 20;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 341/568] NFS4: Fix state renewals missing after boot
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (339 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 340/568] drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 342/568] HID: quirks: avoid Cooler Master MM712 dongle wakeup bug Greg Kroah-Hartman
` (233 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joshua Watt, Anna Schumaker,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Watt <jpewhacker@gmail.com>
[ Upstream commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a ]
Since the last renewal time was initialized to 0 and jiffies start
counting at -5 minutes, any clients connected in the first 5 minutes
after a reboot would have their renewal timer set to a very long
interval. If the connection was idle, this would result in the client
state timing out on the server and the next call to the server would
return NFS4ERR_BADSESSION.
Fix this by initializing the last renewal time to the current jiffies
instead of 0.
Signed-off-by: Joshua Watt <jpewhacker@gmail.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs4client.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 6b14e4af25d37..4cb405e343b83 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -221,6 +221,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)
clp->cl_state = 1 << NFS4CLNT_LEASE_EXPIRED;
clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion];
clp->cl_mig_gen = 1;
+ clp->cl_last_renewal = jiffies;
#if IS_ENABLED(CONFIG_NFS_V4_1)
init_waitqueue_head(&clp->cl_lock_waitq);
#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 342/568] HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (340 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 341/568] NFS4: Fix state renewals missing after boot Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 343/568] NFS: check if suid/sgid was cleared after a write as needed Greg Kroah-Hartman
` (232 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tristan Lobb, Jiri Kosina,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Lobb <tristan.lobb@it-lobb.de>
[ Upstream commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 ]
The Cooler Master Mice Dongle includes a vendor defined HID interface
alongside its mouse interface. Not polling it will cause the mouse to
stop responding to polls on any interface once woken up again after
going into power saving mode.
Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and
the Dongle's PID.
Signed-off-by: Tristan Lobb <tristan.lobb@it-lobb.de>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-ids.h | 3 +++
drivers/hid/hid-quirks.c | 1 +
2 files changed, 4 insertions(+)
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 0bbba80d6c51c..307f921a98068 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -321,6 +321,9 @@
#define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500
#define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff
+#define USB_VENDOR_ID_COOLER_MASTER 0x2516
+#define USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE 0x01b7
+
#define USB_VENDOR_ID_CORSAIR 0x1b1c
#define USB_DEVICE_ID_CORSAIR_K90 0x1b02
#define USB_DEVICE_ID_CORSAIR_K70R 0x1b09
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index b37927f909412..b42aa9e22fcf0 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -57,6 +57,7 @@ static const struct hid_device_id hid_quirks[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET },
{ HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET },
{ HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_COOLER_MASTER, USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE), HID_QUIRK_ALWAYS_POLL },
{ HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS },
{ HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
{ HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS },
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 343/568] NFS: check if suid/sgid was cleared after a write as needed
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (341 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 342/568] HID: quirks: avoid Cooler Master MM712 dongle wakeup bug Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 344/568] smb/server: fix possible memory leak in smb2_read() Greg Kroah-Hartman
` (231 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Scott Mayhew, Anna Schumaker,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Scott Mayhew <smayhew@redhat.com>
[ Upstream commit 9ff022f3820a31507cb93be6661bf5f3ca0609a4 ]
I noticed xfstests generic/193 and generic/355 started failing against
knfsd after commit e7a8ebc305f2 ("NFSD: Offer write delegation for OPEN
with OPEN4_SHARE_ACCESS_WRITE").
I ran those same tests against ONTAP (which has had write delegation
support for a lot longer than knfsd) and they fail there too... so
while it's a new failure against knfsd, it isn't an entirely new
failure.
Add the NFS_INO_REVAL_FORCED flag so that the presence of a delegation
doesn't keep the inode from being revalidated to fetch the updated mode.
Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/write.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index eb1fc33198be8..a20a381efc5df 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1633,7 +1633,8 @@ static int nfs_writeback_done(struct rpc_task *task,
/* Deal with the suid/sgid bit corner case */
if (nfs_should_remove_suid(inode)) {
spin_lock(&inode->i_lock);
- nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE);
+ nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE
+ | NFS_INO_REVAL_FORCED);
spin_unlock(&inode->i_lock);
}
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 344/568] smb/server: fix possible memory leak in smb2_read()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (342 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 343/568] NFS: check if suid/sgid was cleared after a write as needed Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 345/568] smb/server: fix possible refcount leak in smb2_sess_setup() Greg Kroah-Hartman
` (230 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ChenXiaoSong, ZhangGuoDong,
Namjae Jeon, Steve French, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhangGuoDong <zhangguodong@kylinos.cn>
[ Upstream commit 6fced056d2cc8d01b326e6fcfabaacb9850b71a4 ]
Memory leak occurs when ksmbd_vfs_read() fails.
Fix this by adding the missing kvfree().
Co-developed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/smb2pdu.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index d2dca5d2f17cb..173135f6f7dbf 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -6405,6 +6405,7 @@ int smb2_read(struct ksmbd_work *work)
nbytes = ksmbd_vfs_read(work, fp, length, &offset, aux_payload_buf);
if (nbytes < 0) {
+ kvfree(aux_payload_buf);
err = nbytes;
goto out;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 345/568] smb/server: fix possible refcount leak in smb2_sess_setup()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (343 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 344/568] smb/server: fix possible memory leak in smb2_read() Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 346/568] ASoC: max98090/91: fixed max98091 ALSA widget powering up/down Greg Kroah-Hartman
` (229 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ChenXiaoSong, ZhangGuoDong,
Namjae Jeon, Steve French, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhangGuoDong <zhangguodong@kylinos.cn>
[ Upstream commit 379510a815cb2e64eb0a379cb62295d6ade65df0 ]
Reference count of ksmbd_session will leak when session need reconnect.
Fix this by adding the missing ksmbd_user_session_put().
Co-developed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/smb2pdu.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 173135f6f7dbf..e3ea06aab8c1b 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -1796,6 +1796,7 @@ int smb2_sess_setup(struct ksmbd_work *work)
if (ksmbd_conn_need_reconnect(conn)) {
rc = -EFAULT;
+ ksmbd_user_session_put(sess);
sess = NULL;
goto out_err;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 346/568] ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (344 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 345/568] smb/server: fix possible refcount leak in smb2_sess_setup() Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 347/568] wifi: ath11k: Add tx ack signal support for management packets Greg Kroah-Hartman
` (228 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sharique Mohammad, Mark Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sharique Mohammad <sharq0406@gmail.com>
[ Upstream commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 ]
The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM
suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they
are turned on or off, the required startup or shutdown sequences
must be taken care by the max98090_shdn_event.
Signed-off-by: Sharique Mohammad <sharq0406@gmail.com>
Link: https://patch.msgid.link/20251015134215.750001-1-sharq0406@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/max98090.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
index 06ed2a938108e..f5acf84ee20cc 100644
--- a/sound/soc/codecs/max98090.c
+++ b/sound/soc/codecs/max98090.c
@@ -1235,9 +1235,11 @@ static const struct snd_soc_dapm_widget max98091_dapm_widgets[] = {
SND_SOC_DAPM_INPUT("DMIC4"),
SND_SOC_DAPM_SUPPLY("DMIC3_ENA", M98090_REG_DIGITAL_MIC_ENABLE,
- M98090_DIGMIC3_SHIFT, 0, NULL, 0),
+ M98090_DIGMIC3_SHIFT, 0, max98090_shdn_event,
+ SND_SOC_DAPM_POST_PMU),
SND_SOC_DAPM_SUPPLY("DMIC4_ENA", M98090_REG_DIGITAL_MIC_ENABLE,
- M98090_DIGMIC4_SHIFT, 0, NULL, 0),
+ M98090_DIGMIC4_SHIFT, 0, max98090_shdn_event,
+ SND_SOC_DAPM_POST_PMU),
};
static const struct snd_soc_dapm_route max98090_dapm_routes[] = {
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 347/568] wifi: ath11k: Add tx ack signal support for management packets
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (345 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 346/568] ASoC: max98090/91: fixed max98091 ALSA widget powering up/down Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 348/568] wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() Greg Kroah-Hartman
` (227 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abinaya Kalaiselvan,
Maharaja Kennadyrajan, Kalle Valo, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abinaya Kalaiselvan <quic_akalaise@quicinc.com>
[ Upstream commit 01c6c9fccbd51c1d9eab0f5794b0271b026178df ]
Add support to notify tx ack signal values for management
packets to userspace through nl80211 interface.
Advertise NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT flag
to enable this feature and it will be used for data
packets as well.
Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
Signed-off-by: Abinaya Kalaiselvan <quic_akalaise@quicinc.com>
Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20221219053844.4084486-1-quic_mkenna@quicinc.com
Stable-dep-of: 9065b9687523 ("wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/hw.c | 1 +
drivers/net/wireless/ath/ath11k/mac.c | 5 +++++
drivers/net/wireless/ath/ath11k/wmi.c | 27 ++++++++++++++++-----------
drivers/net/wireless/ath/ath11k/wmi.h | 3 +++
4 files changed, 25 insertions(+), 11 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/hw.c b/drivers/net/wireless/ath/ath11k/hw.c
index dbcc0c4035b62..332664643c7b4 100644
--- a/drivers/net/wireless/ath/ath11k/hw.c
+++ b/drivers/net/wireless/ath/ath11k/hw.c
@@ -201,6 +201,7 @@ static void ath11k_init_wmi_config_ipq8074(struct ath11k_base *ab,
config->twt_ap_pdev_count = ab->num_radios;
config->twt_ap_sta_count = 1000;
config->flag1 |= WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64;
+ config->flag1 |= WMI_RSRC_CFG_FLAG1_ACK_RSSI;
}
static int ath11k_hw_mac_id_to_pdev_id_ipq8074(struct ath11k_hw_params *hw,
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 8be42227dd943..4cab480f85a8d 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -9045,6 +9045,11 @@ static int __ath11k_mac_register(struct ath11k *ar)
goto err_free_if_combs;
}
+ if (test_bit(WMI_TLV_SERVICE_TX_DATA_MGMT_ACK_RSSI,
+ ar->ab->wmi_ab.svc_map))
+ wiphy_ext_feature_set(ar->hw->wiphy,
+ NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
+
ar->hw->queues = ATH11K_HW_MAX_QUEUES;
ar->hw->wiphy->tx_queue_len = ATH11K_QUEUE_LEN;
ar->hw->offchannel_tx_hw_queue = ATH11K_HW_MAX_QUEUES - 1;
diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 38756ed48082c..1b58979bdfdc6 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -5221,8 +5221,8 @@ static int ath11k_pull_mgmt_rx_params_tlv(struct ath11k_base *ab,
return 0;
}
-static int wmi_process_mgmt_tx_comp(struct ath11k *ar, u32 desc_id,
- u32 status)
+static int wmi_process_mgmt_tx_comp(struct ath11k *ar,
+ struct wmi_mgmt_tx_compl_event *tx_compl_param)
{
struct sk_buff *msdu;
struct ieee80211_tx_info *info;
@@ -5230,24 +5230,29 @@ static int wmi_process_mgmt_tx_comp(struct ath11k *ar, u32 desc_id,
int num_mgmt;
spin_lock_bh(&ar->txmgmt_idr_lock);
- msdu = idr_find(&ar->txmgmt_idr, desc_id);
+ msdu = idr_find(&ar->txmgmt_idr, tx_compl_param->desc_id);
if (!msdu) {
ath11k_warn(ar->ab, "received mgmt tx compl for invalid msdu_id: %d\n",
- desc_id);
+ tx_compl_param->desc_id);
spin_unlock_bh(&ar->txmgmt_idr_lock);
return -ENOENT;
}
- idr_remove(&ar->txmgmt_idr, desc_id);
+ idr_remove(&ar->txmgmt_idr, tx_compl_param->desc_id);
spin_unlock_bh(&ar->txmgmt_idr_lock);
skb_cb = ATH11K_SKB_CB(msdu);
dma_unmap_single(ar->ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
info = IEEE80211_SKB_CB(msdu);
- if ((!(info->flags & IEEE80211_TX_CTL_NO_ACK)) && !status)
+ if ((!(info->flags & IEEE80211_TX_CTL_NO_ACK)) &&
+ !tx_compl_param->status) {
info->flags |= IEEE80211_TX_STAT_ACK;
+ if (test_bit(WMI_TLV_SERVICE_TX_DATA_MGMT_ACK_RSSI,
+ ar->ab->wmi_ab.svc_map))
+ info->status.ack_signal = tx_compl_param->ack_rssi;
+ }
ieee80211_tx_status_irqsafe(ar->hw, msdu);
@@ -5259,7 +5264,7 @@ static int wmi_process_mgmt_tx_comp(struct ath11k *ar, u32 desc_id,
ath11k_dbg(ar->ab, ATH11K_DBG_WMI,
"wmi mgmt tx comp pending %d desc id %d\n",
- num_mgmt, desc_id);
+ num_mgmt, tx_compl_param->desc_id);
if (!num_mgmt)
wake_up(&ar->txmgmt_empty_waitq);
@@ -5292,6 +5297,7 @@ static int ath11k_pull_mgmt_tx_compl_param_tlv(struct ath11k_base *ab,
param->pdev_id = ev->pdev_id;
param->desc_id = ev->desc_id;
param->status = ev->status;
+ param->ack_rssi = ev->ack_rssi;
kfree(tb);
return 0;
@@ -7062,13 +7068,12 @@ static void ath11k_mgmt_tx_compl_event(struct ath11k_base *ab, struct sk_buff *s
goto exit;
}
- wmi_process_mgmt_tx_comp(ar, tx_compl_param.desc_id,
- tx_compl_param.status);
+ wmi_process_mgmt_tx_comp(ar, &tx_compl_param);
ath11k_dbg(ab, ATH11K_DBG_MGMT,
- "mgmt tx compl ev pdev_id %d, desc_id %d, status %d",
+ "mgmt tx compl ev pdev_id %d, desc_id %d, status %d ack_rssi %d",
tx_compl_param.pdev_id, tx_compl_param.desc_id,
- tx_compl_param.status);
+ tx_compl_param.status, tx_compl_param.ack_rssi);
exit:
rcu_read_unlock();
diff --git a/drivers/net/wireless/ath/ath11k/wmi.h b/drivers/net/wireless/ath/ath11k/wmi.h
index 8f2c07d70a4a2..31d14e15ebc1d 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.h
+++ b/drivers/net/wireless/ath/ath11k/wmi.h
@@ -2309,6 +2309,7 @@ struct wmi_init_cmd {
} __packed;
#define WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64 BIT(5)
+#define WMI_RSRC_CFG_FLAG1_ACK_RSSI BIT(18)
struct wmi_resource_config {
u32 tlv_header;
@@ -4541,6 +4542,8 @@ struct wmi_mgmt_tx_compl_event {
u32 desc_id;
u32 status;
u32 pdev_id;
+ u32 ppdu_id;
+ u32 ack_rssi;
} __packed;
struct wmi_scan_event {
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 348/568] wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (346 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 347/568] wifi: ath11k: Add tx ack signal support for management packets Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 349/568] selftests: net: local_termination: Wait for interfaces to come up Greg Kroah-Hartman
` (226 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Escande,
Vasanthakumar Thiagarajan, Baochen Qiang, Jeff Johnson,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Escande <nico.escande@gmail.com>
[ Upstream commit 9065b968752334f972e0d48e50c4463a172fc2a7 ]
When reporting tx completion using ieee80211_tx_status_xxx() family of
functions, the status part of the struct ieee80211_tx_info nested in the
skb is used to report things like transmit rates & retry count to mac80211
On the TX data path, this is correctly memset to 0 before calling
ieee80211_tx_status_ext(), but on the tx mgmt path this was not done.
This leads to mac80211 treating garbage values as valid transmit counters
(like tx retries for example) and accounting them as real statistics that
makes their way to userland via station dump.
The same issue was resolved in ath12k by commit 9903c0986f78 ("wifi:
ath12k: Add memset and update default rate value in wmi tx completion")
Tested-on: QCN9074 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Nicolas Escande <nico.escande@gmail.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20251104083957.717825-1-nico.escande@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/wmi.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 1b58979bdfdc6..ed12bbb11fe89 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -5246,6 +5246,9 @@ static int wmi_process_mgmt_tx_comp(struct ath11k *ar,
dma_unmap_single(ar->ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
info = IEEE80211_SKB_CB(msdu);
+ memset(&info->status, 0, sizeof(info->status));
+ info->status.rates[0].idx = -1;
+
if ((!(info->flags & IEEE80211_TX_CTL_NO_ACK)) &&
!tx_compl_param->status) {
info->flags |= IEEE80211_TX_STAT_ACK;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 349/568] selftests: net: local_termination: Wait for interfaces to come up
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (347 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 348/568] wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 350/568] net: fec: correct rx_bytes statistic for the case SHIFT16 is set Greg Kroah-Hartman
` (225 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Oltean, Alexander Sverdlin,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <alexander.sverdlin@siemens.com>
[ Upstream commit 57531b3416448d1ced36a2a974a4085ec43d57b0 ]
It seems that most of the tests prepare the interfaces once before the test
run (setup_prepare()), rely on setup_wait() to wait for link and only then
run the test(s).
local_termination brings the physical interfaces down and up during test
run but never wait for them to come up. If the auto-negotiation takes
some seconds, first test packets are being lost, which leads to
false-negative test results.
Use setup_wait() in run_test() to make sure auto-negotiation has been
completed after all simple_if_init() calls on physical interfaces and test
packets will not be lost because of the race against link establishment.
Fixes: 90b9566aa5cd3f ("selftests: forwarding: add a test for local_termination.sh")
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
Link: https://patch.msgid.link/20251106161213.459501-1-alexander.sverdlin@siemens.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/forwarding/local_termination.sh | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/testing/selftests/net/forwarding/local_termination.sh b/tools/testing/selftests/net/forwarding/local_termination.sh
index 9b5a63519b949..6cde61f10fd0e 100755
--- a/tools/testing/selftests/net/forwarding/local_termination.sh
+++ b/tools/testing/selftests/net/forwarding/local_termination.sh
@@ -108,6 +108,8 @@ run_test()
local smac=$(mac_get $h1)
local rcv_dmac=$(mac_get $rcv_if_name)
+ setup_wait
+
tcpdump_start $rcv_if_name
mc_route_prepare $h1
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 350/568] net: fec: correct rx_bytes statistic for the case SHIFT16 is set
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (348 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 349/568] selftests: net: local_termination: Wait for interfaces to come up Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 351/568] Bluetooth: MGMT: cancel mesh send timer when hdev removed Greg Kroah-Hartman
` (224 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Fang, Frank Li, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <wei.fang@nxp.com>
[ Upstream commit ad17e7e92a7c52ce70bb764813fcf99464f96903 ]
Two additional bytes in front of each frame received into the RX FIFO if
SHIFT16 is set, so we need to subtract the extra two bytes from pkt_len
to correct the statistic of rx_bytes.
Fixes: 3ac72b7b63d5 ("net: fec: align IP header in hardware")
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20251106021421.2096585-1-wei.fang@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/freescale/fec_main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index ca271d7a388b4..c8f897afb30a6 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1681,6 +1681,8 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
ndev->stats.rx_packets++;
pkt_len = fec16_to_cpu(bdp->cbd_datlen);
ndev->stats.rx_bytes += pkt_len;
+ if (fep->quirks & FEC_QUIRK_HAS_RACC)
+ ndev->stats.rx_bytes -= 2;
index = fec_enet_get_bd_index(bdp, &rxq->bd);
page = rxq->rx_skb_info[index].page;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 351/568] Bluetooth: MGMT: cancel mesh send timer when hdev removed
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (349 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 350/568] net: fec: correct rx_bytes statistic for the case SHIFT16 is set Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 352/568] Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF Greg Kroah-Hartman
` (223 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pauli Virtanen,
Luiz Augusto von Dentz, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <pav@iki.fi>
[ Upstream commit 55fb52ffdd62850d667ebed842815e072d3c9961 ]
mesh_send_done timer is not canceled when hdev is removed, which causes
crash if the timer triggers after hdev is gone.
Cancel the timer when MGMT removes the hdev, like other MGMT timers.
Should fix the BUG: sporadically seen by BlueZ test bot
(in "Mesh - Send cancel - 1" test).
Log:
------
BUG: KASAN: slab-use-after-free in run_timer_softirq+0x76b/0x7d0
...
Freed by task 36:
kasan_save_stack+0x24/0x50
kasan_save_track+0x14/0x30
__kasan_save_free_info+0x3a/0x60
__kasan_slab_free+0x43/0x70
kfree+0x103/0x500
device_release+0x9a/0x210
kobject_put+0x100/0x1e0
vhci_release+0x18b/0x240
------
Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh")
Link: https://lore.kernel.org/linux-bluetooth/67364c09.0c0a0220.113cba.39ff@mx.google.com/
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/mgmt.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 9bd4d5bc84db1..b89c3fc364b83 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -9501,6 +9501,7 @@ void mgmt_index_removed(struct hci_dev *hdev)
cancel_delayed_work_sync(&hdev->discov_off);
cancel_delayed_work_sync(&hdev->service_cache);
cancel_delayed_work_sync(&hdev->rpa_expired);
+ cancel_delayed_work_sync(&hdev->mesh_send_done);
}
void mgmt_power_on(struct hci_dev *hdev, int err)
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 352/568] Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (350 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 351/568] Bluetooth: MGMT: cancel mesh send timer when hdev removed Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 353/568] Bluetooth: 6lowpan: reset link-local header on ipv6 recv path Greg Kroah-Hartman
` (222 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+2fc81b50a4f8263a159b,
Raphael Pinsonneault-Thibeault, Luiz Augusto von Dentz,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
[ Upstream commit 23d22f2f71768034d6ef86168213843fc49bf550 ]
There is a KASAN: slab-use-after-free read in btusb_disconnect().
Calling "usb_driver_release_interface(&btusb_driver, data->intf)" will
free the btusb data associated with the interface. The same data is
then used later in the function, hence the UAF.
Fix by moving the accesses to btusb data to before the data is free'd.
Reported-by: syzbot+2fc81b50a4f8263a159b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2fc81b50a4f8263a159b
Tested-by: syzbot+2fc81b50a4f8263a159b@syzkaller.appspotmail.com
Fixes: fd913ef7ce619 ("Bluetooth: btusb: Add out-of-band wakeup support")
Signed-off-by: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 29130160066a5..70cdcef684138 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -4204,6 +4204,11 @@ static void btusb_disconnect(struct usb_interface *intf)
hci_unregister_dev(hdev);
+ if (data->oob_wake_irq)
+ device_init_wakeup(&data->udev->dev, false);
+ if (data->reset_gpio)
+ gpiod_put(data->reset_gpio);
+
if (intf == data->intf) {
if (data->isoc)
usb_driver_release_interface(&btusb_driver, data->isoc);
@@ -4214,17 +4219,11 @@ static void btusb_disconnect(struct usb_interface *intf)
usb_driver_release_interface(&btusb_driver, data->diag);
usb_driver_release_interface(&btusb_driver, data->intf);
} else if (intf == data->diag) {
- usb_driver_release_interface(&btusb_driver, data->intf);
if (data->isoc)
usb_driver_release_interface(&btusb_driver, data->isoc);
+ usb_driver_release_interface(&btusb_driver, data->intf);
}
- if (data->oob_wake_irq)
- device_init_wakeup(&data->udev->dev, false);
-
- if (data->reset_gpio)
- gpiod_put(data->reset_gpio);
-
hci_free_dev(hdev);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 353/568] Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (351 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 352/568] Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 354/568] Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion Greg Kroah-Hartman
` (221 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Menzel, Pauli Virtanen,
Luiz Augusto von Dentz, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <pav@iki.fi>
[ Upstream commit 3b78f50918276ab28fb22eac9aa49401ac436a3b ]
Bluetooth 6lowpan.c netdev has header_ops, so it must set link-local
header for RX skb, otherwise things crash, eg. with AF_PACKET SOCK_RAW
Add missing skb_reset_mac_header() for uncompressed ipv6 RX path.
For the compressed one, it is done in lowpan_header_decompress().
Log: (BlueZ 6lowpan-tester Client Recv Raw - Success)
------
kernel BUG at net/core/skbuff.c:212!
Call Trace:
<IRQ>
...
packet_rcv (net/packet/af_packet.c:2152)
...
<TASK>
__local_bh_enable_ip (kernel/softirq.c:407)
netif_rx (net/core/dev.c:5648)
chan_recv_cb (net/bluetooth/6lowpan.c:294 net/bluetooth/6lowpan.c:359)
------
Fixes: 18722c247023 ("Bluetooth: Enable 6LoWPAN support for BT LE devices")
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/6lowpan.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index db119071a0ea0..003c8ae104f29 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -288,6 +288,7 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
local_skb->pkt_type = PACKET_HOST;
local_skb->dev = dev;
+ skb_reset_mac_header(local_skb);
skb_set_transport_header(local_skb, sizeof(struct ipv6hdr));
if (give_skb_to_upper(local_skb, dev) != NET_RX_SUCCESS) {
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 354/568] Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (352 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 353/568] Bluetooth: 6lowpan: reset link-local header on ipv6 recv path Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 355/568] Bluetooth: 6lowpan: Dont hold spin lock over sleeping functions Greg Kroah-Hartman
` (220 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Menzel, Pauli Virtanen,
Luiz Augusto von Dentz, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <pav@iki.fi>
[ Upstream commit b454505bf57a2e4f5d49951d4deb03730a9348d9 ]
Bluetooth 6lowpan.c confuses BDADDR_LE and ADDR_LE_DEV address types,
e.g. debugfs "connect" command takes the former, and "disconnect" and
"connect" to already connected device take the latter. This is due to
using same value both for l2cap_chan_connect and hci_conn_hash_lookup_le
which take different dst_type values.
Fix address type passed to hci_conn_hash_lookup_le().
Retain the debugfs API difference between "connect" and "disconnect"
commands since it's been like this since 2015 and nobody apparently
complained.
Fixes: f5ad4ffceba0 ("Bluetooth: 6lowpan: Use hci_conn_hash_lookup_le() when possible")
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/6lowpan.c | 28 ++++++++++++++++++++++++----
1 file changed, 24 insertions(+), 4 deletions(-)
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 003c8ae104f29..57553abde4180 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -956,10 +956,11 @@ static struct l2cap_chan *bt_6lowpan_listen(void)
}
static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type,
- struct l2cap_conn **conn)
+ struct l2cap_conn **conn, bool disconnect)
{
struct hci_conn *hcon;
struct hci_dev *hdev;
+ int le_addr_type;
int n;
n = sscanf(buf, "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx %hhu",
@@ -970,13 +971,32 @@ static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type,
if (n < 7)
return -EINVAL;
+ if (disconnect) {
+ /* The "disconnect" debugfs command has used different address
+ * type constants than "connect" since 2015. Let's retain that
+ * for now even though it's obviously buggy...
+ */
+ *addr_type += 1;
+ }
+
+ switch (*addr_type) {
+ case BDADDR_LE_PUBLIC:
+ le_addr_type = ADDR_LE_DEV_PUBLIC;
+ break;
+ case BDADDR_LE_RANDOM:
+ le_addr_type = ADDR_LE_DEV_RANDOM;
+ break;
+ default:
+ return -EINVAL;
+ }
+
/* The LE_PUBLIC address type is ignored because of BDADDR_ANY */
hdev = hci_get_route(addr, BDADDR_ANY, BDADDR_LE_PUBLIC);
if (!hdev)
return -ENOENT;
hci_dev_lock(hdev);
- hcon = hci_conn_hash_lookup_le(hdev, addr, *addr_type);
+ hcon = hci_conn_hash_lookup_le(hdev, addr, le_addr_type);
hci_dev_unlock(hdev);
hci_dev_put(hdev);
@@ -1103,7 +1123,7 @@ static ssize_t lowpan_control_write(struct file *fp,
buf[buf_size] = '\0';
if (memcmp(buf, "connect ", 8) == 0) {
- ret = get_l2cap_conn(&buf[8], &addr, &addr_type, &conn);
+ ret = get_l2cap_conn(&buf[8], &addr, &addr_type, &conn, false);
if (ret == -EINVAL)
return ret;
@@ -1140,7 +1160,7 @@ static ssize_t lowpan_control_write(struct file *fp,
}
if (memcmp(buf, "disconnect ", 11) == 0) {
- ret = get_l2cap_conn(&buf[11], &addr, &addr_type, &conn);
+ ret = get_l2cap_conn(&buf[11], &addr, &addr_type, &conn, true);
if (ret < 0)
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 355/568] Bluetooth: 6lowpan: Dont hold spin lock over sleeping functions
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (353 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 354/568] Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 356/568] sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto Greg Kroah-Hartman
` (219 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pauli Virtanen,
Luiz Augusto von Dentz, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <pav@iki.fi>
[ Upstream commit 98454bc812f3611551e4b1f81732da4aa7b9597e ]
disconnect_all_peers() calls sleeping function (l2cap_chan_close) under
spinlock. Holding the lock doesn't actually do any good -- we work on a
local copy of the list, and the lock doesn't protect against peer->chan
having already been freed.
Fix by taking refcounts of peer->chan instead. Clean up the code and
old comments a bit.
Take devices_lock instead of RCU, because the kfree_rcu();
l2cap_chan_put(); construct in chan_close_cb() does not guarantee
peer->chan is necessarily valid in RCU.
Also take l2cap_chan_lock() which is required for l2cap_chan_close().
Log: (bluez 6lowpan-tester Client Connect - Disable)
------
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:575
...
<TASK>
...
l2cap_send_disconn_req (net/bluetooth/l2cap_core.c:938 net/bluetooth/l2cap_core.c:1495)
...
? __pfx_l2cap_chan_close (net/bluetooth/l2cap_core.c:809)
do_enable_set (net/bluetooth/6lowpan.c:1048 net/bluetooth/6lowpan.c:1068)
------
Fixes: 90305829635d ("Bluetooth: 6lowpan: Converting rwlocks to use RCU")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/6lowpan.c | 68 ++++++++++++++++++++++++++---------------
1 file changed, 43 insertions(+), 25 deletions(-)
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 57553abde4180..347361ff0cc87 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -52,6 +52,11 @@ static bool enable_6lowpan;
static struct l2cap_chan *listen_chan;
static DEFINE_MUTEX(set_lock);
+enum {
+ LOWPAN_PEER_CLOSING,
+ LOWPAN_PEER_MAXBITS
+};
+
struct lowpan_peer {
struct list_head list;
struct rcu_head rcu;
@@ -60,6 +65,8 @@ struct lowpan_peer {
/* peer addresses in various formats */
unsigned char lladdr[ETH_ALEN];
struct in6_addr peer_addr;
+
+ DECLARE_BITMAP(flags, LOWPAN_PEER_MAXBITS);
};
struct lowpan_btle_dev {
@@ -1013,41 +1020,52 @@ static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type,
static void disconnect_all_peers(void)
{
struct lowpan_btle_dev *entry;
- struct lowpan_peer *peer, *tmp_peer, *new_peer;
- struct list_head peers;
-
- INIT_LIST_HEAD(&peers);
+ struct lowpan_peer *peer;
+ int nchans;
- /* We make a separate list of peers as the close_cb() will
- * modify the device peers list so it is better not to mess
- * with the same list at the same time.
+ /* l2cap_chan_close() cannot be called from RCU, and lock ordering
+ * chan->lock > devices_lock prevents taking write side lock, so copy
+ * then close.
*/
rcu_read_lock();
+ list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list)
+ list_for_each_entry_rcu(peer, &entry->peers, list)
+ clear_bit(LOWPAN_PEER_CLOSING, peer->flags);
+ rcu_read_unlock();
- list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) {
- list_for_each_entry_rcu(peer, &entry->peers, list) {
- new_peer = kmalloc(sizeof(*new_peer), GFP_ATOMIC);
- if (!new_peer)
- break;
+ do {
+ struct l2cap_chan *chans[32];
+ int i;
- new_peer->chan = peer->chan;
- INIT_LIST_HEAD(&new_peer->list);
+ nchans = 0;
- list_add(&new_peer->list, &peers);
- }
- }
+ spin_lock(&devices_lock);
- rcu_read_unlock();
+ list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) {
+ list_for_each_entry_rcu(peer, &entry->peers, list) {
+ if (test_and_set_bit(LOWPAN_PEER_CLOSING,
+ peer->flags))
+ continue;
- spin_lock(&devices_lock);
- list_for_each_entry_safe(peer, tmp_peer, &peers, list) {
- l2cap_chan_close(peer->chan, ENOENT);
+ l2cap_chan_hold(peer->chan);
+ chans[nchans++] = peer->chan;
- list_del_rcu(&peer->list);
- kfree_rcu(peer, rcu);
- }
- spin_unlock(&devices_lock);
+ if (nchans >= ARRAY_SIZE(chans))
+ goto done;
+ }
+ }
+
+done:
+ spin_unlock(&devices_lock);
+
+ for (i = 0; i < nchans; ++i) {
+ l2cap_chan_lock(chans[i]);
+ l2cap_chan_close(chans[i], ENOENT);
+ l2cap_chan_unlock(chans[i]);
+ l2cap_chan_put(chans[i]);
+ }
+ } while (nchans);
}
struct set_enable {
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 356/568] sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (354 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 355/568] Bluetooth: 6lowpan: Dont hold spin lock over sleeping functions Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 6.1 357/568] net/smc: fix mismatch between CLC header and proposal Greg Kroah-Hartman
` (218 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+f8c46c8b2b7f6e076e99,
Eric Dumazet, Daniel Borkmann, Xin Long, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 1534ff77757e44bcc4b98d0196bc5c0052fce5fa ]
syzbot reported a possible shift-out-of-bounds [1]
Blamed commit added rto_alpha_max and rto_beta_max set to 1000.
It is unclear if some sctp users are setting very large rto_alpha
and/or rto_beta.
In order to prevent user regression, perform the test at run time.
Also add READ_ONCE() annotations as sysctl values can change under us.
[1]
UBSAN: shift-out-of-bounds in net/sctp/transport.c:509:41
shift exponent 64 is too large for 32-bit type 'unsigned int'
CPU: 0 UID: 0 PID: 16704 Comm: syz.2.2320 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
ubsan_epilogue lib/ubsan.c:233 [inline]
__ubsan_handle_shift_out_of_bounds+0x27f/0x420 lib/ubsan.c:494
sctp_transport_update_rto.cold+0x1c/0x34b net/sctp/transport.c:509
sctp_check_transmitted+0x11c4/0x1c30 net/sctp/outqueue.c:1502
sctp_outq_sack+0x4ef/0x1b20 net/sctp/outqueue.c:1338
sctp_cmd_process_sack net/sctp/sm_sideeffect.c:840 [inline]
sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1372 [inline]
Fixes: b58537a1f562 ("net: sctp: fix permissions for rto_alpha and rto_beta knobs")
Reported-by: syzbot+f8c46c8b2b7f6e076e99@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/690c81ae.050a0220.3d0d33.014e.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20251106111054.3288127-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/transport.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 87ed33b9db1b3..52c872839f234 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -495,6 +495,7 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)
if (tp->rttvar || tp->srtt) {
struct net *net = tp->asoc->base.net;
+ unsigned int rto_beta, rto_alpha;
/* 6.3.1 C3) When a new RTT measurement R' is made, set
* RTTVAR <- (1 - RTO.Beta) * RTTVAR + RTO.Beta * |SRTT - R'|
* SRTT <- (1 - RTO.Alpha) * SRTT + RTO.Alpha * R'
@@ -506,10 +507,14 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)
* For example, assuming the default value of RTO.Alpha of
* 1/8, rto_alpha would be expressed as 3.
*/
- tp->rttvar = tp->rttvar - (tp->rttvar >> net->sctp.rto_beta)
- + (((__u32)abs((__s64)tp->srtt - (__s64)rtt)) >> net->sctp.rto_beta);
- tp->srtt = tp->srtt - (tp->srtt >> net->sctp.rto_alpha)
- + (rtt >> net->sctp.rto_alpha);
+ rto_beta = READ_ONCE(net->sctp.rto_beta);
+ if (rto_beta < 32)
+ tp->rttvar = tp->rttvar - (tp->rttvar >> rto_beta)
+ + (((__u32)abs((__s64)tp->srtt - (__s64)rtt)) >> rto_beta);
+ rto_alpha = READ_ONCE(net->sctp.rto_alpha);
+ if (rto_alpha < 32)
+ tp->srtt = tp->srtt - (tp->srtt >> rto_alpha)
+ + (rtt >> rto_alpha);
} else {
/* 6.3.1 C2) When the first RTT measurement R is made, set
* SRTT <- R, RTTVAR <- R/2.
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 357/568] net/smc: fix mismatch between CLC header and proposal
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (355 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 356/568] sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 358/568] tipc: Fix use-after-free in tipc_mon_reinit_self() Greg Kroah-Hartman
` (217 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, D. Wythe, Alexandra Winter,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: D. Wythe <alibuda@linux.alibaba.com>
[ Upstream commit ec33f2e5a2d0dbbfd71435209aee812fdc9369b8 ]
The current CLC proposal message construction uses a mix of
`ini->smc_type_v1/v2` and `pclc_base->hdr.typev1/v2` to decide whether
to include optional extensions (IPv6 prefix extension for v1, and v2
extension). This leads to a critical inconsistency: when
`smc_clc_prfx_set()` fails - for example, in IPv6-only environments with
only link-local addresses, or when the local IP address and the outgoing
interface’s network address are not in the same subnet.
As a result, the proposal message is assembled using the stale
`ini->smc_type_v1` value—causing the IPv6 prefix extension to be
included even though the header indicates v1 is not supported.
The peer then receives a malformed CLC proposal where the header type
does not match the payload, and immediately resets the connection.
The fix ensures consistency between the CLC header flags and the actual
payload by synchronizing `ini->smc_type_v1` with `pclc_base->hdr.typev1`
when prefix setup fails.
Fixes: 8c3dca341aea ("net/smc: build and send V2 CLC proposal")
Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Link: https://patch.msgid.link/20251107024029.88753-1-alibuda@linux.alibaba.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/smc/smc_clc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
index 6ed77f02ceac0..4a9a7ecf973ca 100644
--- a/net/smc/smc_clc.c
+++ b/net/smc/smc_clc.c
@@ -862,6 +862,7 @@ int smc_clc_send_proposal(struct smc_sock *smc, struct smc_init_info *ini)
return SMC_CLC_DECL_CNFERR;
}
pclc_base->hdr.typev1 = SMC_TYPE_N;
+ ini->smc_type_v1 = SMC_TYPE_N;
} else {
pclc_base->iparea_offset = htons(sizeof(*pclc_smcd));
plen += sizeof(*pclc_prfx) +
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 358/568] tipc: Fix use-after-free in tipc_mon_reinit_self().
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (356 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 6.1 357/568] net/smc: fix mismatch between CLC header and proposal Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 359/568] net: mdio: fix resource leak in mdiobus_register_device() Greg Kroah-Hartman
` (216 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+d7dad7fd4b3921104957,
Kuniyuki Iwashima, Simon Horman, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 0725e6afb55128be21a2ca36e9674f573ccec173 ]
syzbot reported use-after-free of tipc_net(net)->monitors[]
in tipc_mon_reinit_self(). [0]
The array is protected by RTNL, but tipc_mon_reinit_self()
iterates over it without RTNL.
tipc_mon_reinit_self() is called from tipc_net_finalize(),
which is always under RTNL except for tipc_net_finalize_work().
Let's hold RTNL in tipc_net_finalize_work().
[0]:
BUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162
Read of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989
CPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: events tipc_net_finalize_work
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
__kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568
kasan_check_byte include/linux/kasan.h:399 [inline]
lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162
rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline]
rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline]
rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244
rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243
write_lock_bh include/linux/rwlock_rt.h:99 [inline]
tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718
tipc_net_finalize+0x115/0x190 net/tipc/net.c:140
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:463
ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 6089:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657
tipc_enable_bearer net/tipc/bearer.c:357 [inline]
__tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047
__tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline]
tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393
tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline]
tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321
genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896
sock_sendmsg_nosec net/socket.c:714 [inline]
__sock_sendmsg+0x21c/0x270 net/socket.c:729
____sys_sendmsg+0x508/0x820 net/socket.c:2614
___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668
__sys_sendmsg net/socket.c:2700 [inline]
__do_sys_sendmsg net/socket.c:2705 [inline]
__se_sys_sendmsg net/socket.c:2703 [inline]
__x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6088:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:243 [inline]
__kasan_slab_free+0x5b/0x80 mm/kasan/common.c:275
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2422 [inline]
slab_free mm/slub.c:4695 [inline]
kfree+0x195/0x550 mm/slub.c:4894
tipc_l2_device_event+0x380/0x650 net/tipc/bearer.c:-1
notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2267 [inline]
call_netdevice_notifiers net/core/dev.c:2281 [inline]
unregister_netdevice_many_notify+0x14d7/0x1fe0 net/core/dev.c:12166
unregister_netdevice_many net/core/dev.c:12229 [inline]
unregister_netdevice_queue+0x33c/0x380 net/core/dev.c:12073
unregister_netdevice include/linux/netdevice.h:3385 [inline]
__tun_detach+0xe4d/0x1620 drivers/net/tun.c:621
tun_detach drivers/net/tun.c:637 [inline]
tun_chr_close+0x10d/0x1c0 drivers/net/tun.c:3433
__fput+0x458/0xa80 fs/file_table.c:468
task_work_run+0x1d4/0x260 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Fixes: 46cb01eeeb86 ("tipc: update mon's self addr when node addr generated")
Reported-by: syzbot+d7dad7fd4b3921104957@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/690c323a.050a0220.baf87.007f.GAE@google.com/
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251107064038.2361188-1-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tipc/net.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 0e95572e56b41..7e65d0b0c4a8d 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -145,7 +145,9 @@ void tipc_net_finalize_work(struct work_struct *work)
{
struct tipc_net *tn = container_of(work, struct tipc_net, work);
+ rtnl_lock();
tipc_net_finalize(tipc_link_net(tn->bcl), tn->trial_addr);
+ rtnl_unlock();
}
void tipc_net_stop(struct net *net)
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 359/568] net: mdio: fix resource leak in mdiobus_register_device()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (357 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 358/568] tipc: Fix use-after-free in tipc_mon_reinit_self() Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 360/568] wifi: mac80211: skip rate verification for not captured PSDUs Greg Kroah-Hartman
` (215 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Buday Csaba, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Buday Csaba <buday.csaba@prolan.hu>
[ Upstream commit e6ca8f533ed41129fcf052297718f417f021cc7d ]
Fix a possible leak in mdiobus_register_device() when both a
reset-gpio and a reset-controller are present.
Clean up the already claimed reset-gpio, when the registration of
the reset-controller fails, so when an error code is returned, the
device retains its state before the registration attempt.
Link: https://lore.kernel.org/all/20251106144603.39053c81@kernel.org/
Fixes: 71dd6c0dff51 ("net: phy: add support for reset-controller")
Signed-off-by: Buday Csaba <buday.csaba@prolan.hu>
Link: https://patch.msgid.link/4b419377f8dd7d2f63f919d0f74a336c734f8fff.1762584481.git.buday.csaba@prolan.hu
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/mdio_bus.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 7a2dce8d12433..726799b1e7faf 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -80,8 +80,11 @@ int mdiobus_register_device(struct mdio_device *mdiodev)
return err;
err = mdiobus_register_reset(mdiodev);
- if (err)
+ if (err) {
+ gpiod_put(mdiodev->reset_gpio);
+ mdiodev->reset_gpio = NULL;
return err;
+ }
/* Assert the reset signal */
mdio_device_reset(mdiodev, 1);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 360/568] wifi: mac80211: skip rate verification for not captured PSDUs
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (358 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 359/568] net: mdio: fix resource leak in mdiobus_register_device() Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 361/568] af_unix: Initialise scc_index in unix_add_edge() Greg Kroah-Hartman
` (214 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Berg, Miri Korenblit,
Johannes Berg, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <benjamin.berg@intel.com>
[ Upstream commit 7fe0d21f5633af8c3fab9f0ef0706c6156623484 ]
If for example the sniffer did not follow any AIDs in an MU frame, then
some of the information may not be filled in or is even expected to be
invalid. As an example, in that case it is expected that Nss is zero.
Fixes: 2ff5e52e7836 ("radiotap: add 0-length PSDU "not captured" type")
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20251110142554.83a2858ee15b.I9f78ce7984872f474722f9278691ae16378f0a3e@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/rx.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 776f9fcf05abe..1cd75c200cfe6 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -5228,10 +5228,14 @@ void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
if (WARN_ON(!local->started))
goto drop;
- if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
+ if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC) &&
+ !(status->flag & RX_FLAG_NO_PSDU &&
+ status->zero_length_psdu_type ==
+ IEEE80211_RADIOTAP_ZERO_LEN_PSDU_NOT_CAPTURED))) {
/*
- * Validate the rate, unless a PLCP error means that
- * we probably can't have a valid rate here anyway.
+ * Validate the rate, unless there was a PLCP error which may
+ * have an invalid rate or the PSDU was not capture and may be
+ * missing rate information.
*/
switch (status->encoding) {
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 361/568] af_unix: Initialise scc_index in unix_add_edge().
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (359 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 360/568] wifi: mac80211: skip rate verification for not captured PSDUs Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 362/568] net/sched: act_connmark: transition to percpu stats and rcu Greg Kroah-Hartman
` (213 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Quang Le, Kuniyuki Iwashima,
Paolo Abeni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 60e6489f8e3b086bd1130ad4450a2c112e863791 ]
Quang Le reported that the AF_UNIX GC could garbage-collect a
receive queue of an alive in-flight socket, with a nice repro.
The repro consists of three stages.
1)
1-a. Create a single cyclic reference with many sockets
1-b. close() all sockets
1-c. Trigger GC
2)
2-a. Pass sk-A to an embryo sk-B
2-b. Pass sk-X to sk-X
2-c. Trigger GC
3)
3-a. accept() the embryo sk-B
3-b. Pass sk-B to sk-C
3-c. close() the in-flight sk-A
3-d. Trigger GC
As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices,
and unix_walk_scc() groups them into two different SCCs:
unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START)
unix_sk(sk-X)->vertex->scc_index = 3
Once GC completes, unix_graph_grouped is set to true.
Also, unix_graph_maybe_cyclic is set to true due to sk-X's
cyclic self-reference, which makes close() trigger GC.
At 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex and
links it to unix_unvisited_vertices.
unix_update_graph() is called at 3-a. and 3-b., but neither
unix_graph_grouped nor unix_graph_maybe_cyclic is changed
because both sk-B's listener and sk-C are not in-flight.
3-c decrements sk-A's file refcnt to 1.
Since unix_graph_grouped is true at 3-d, unix_walk_scc_fast()
is finally called and iterates 3 sockets sk-A, sk-B, and sk-X:
sk-A -> sk-B (-> sk-C)
sk-X -> sk-X
This is totally fine. All of them are not yet close()d and
should be grouped into different SCCs.
However, unix_vertex_dead() misjudges that sk-A and sk-B are
in the same SCC and sk-A is dead.
unix_sk(sk-A)->scc_index == unix_sk(sk-B)->scc_index <-- Wrong!
&&
sk-A's file refcnt == unix_sk(sk-A)->vertex->out_degree
^-- 1 in-flight count for sk-B
-> sk-A is dead !?
The problem is that unix_add_edge() does not initialise scc_index.
Stage 1) is used for heap spraying, making a newly allocated
vertex have vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START)
set by unix_walk_scc() at 1-c.
Let's track the max SCC index from the previous unix_walk_scc()
call and assign the max + 1 to a new vertex's scc_index.
This way, we can continue to avoid Tarjan's algorithm while
preventing misjudgments.
Fixes: ad081928a8b0 ("af_unix: Avoid Tarjan's algorithm if unnecessary.")
Reported-by: Quang Le <quanglex97@gmail.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20251109025233.3659187-1-kuniyu@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/unix/garbage.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 0068e758be4dd..66fd606c43f45 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -136,6 +136,7 @@ enum unix_vertex_index {
};
static unsigned long unix_vertex_unvisited_index = UNIX_VERTEX_INDEX_MARK1;
+static unsigned long unix_vertex_max_scc_index = UNIX_VERTEX_INDEX_START;
static void unix_add_edge(struct scm_fp_list *fpl, struct unix_edge *edge)
{
@@ -144,6 +145,7 @@ static void unix_add_edge(struct scm_fp_list *fpl, struct unix_edge *edge)
if (!vertex) {
vertex = list_first_entry(&fpl->vertices, typeof(*vertex), entry);
vertex->index = unix_vertex_unvisited_index;
+ vertex->scc_index = ++unix_vertex_max_scc_index;
vertex->out_degree = 0;
INIT_LIST_HEAD(&vertex->edges);
INIT_LIST_HEAD(&vertex->scc_entry);
@@ -480,10 +482,15 @@ static void __unix_walk_scc(struct unix_vertex *vertex, unsigned long *last_inde
scc_dead = unix_vertex_dead(v);
}
- if (scc_dead)
+ if (scc_dead) {
unix_collect_skb(&scc, hitlist);
- else if (!unix_graph_maybe_cyclic)
- unix_graph_maybe_cyclic = unix_scc_cyclic(&scc);
+ } else {
+ if (unix_vertex_max_scc_index < vertex->scc_index)
+ unix_vertex_max_scc_index = vertex->scc_index;
+
+ if (!unix_graph_maybe_cyclic)
+ unix_graph_maybe_cyclic = unix_scc_cyclic(&scc);
+ }
list_del(&scc);
}
@@ -498,6 +505,7 @@ static void unix_walk_scc(struct sk_buff_head *hitlist)
unsigned long last_index = UNIX_VERTEX_INDEX_START;
unix_graph_maybe_cyclic = false;
+ unix_vertex_max_scc_index = UNIX_VERTEX_INDEX_START;
/* Visit every vertex exactly once.
* __unix_walk_scc() moves visited vertices to unix_visited_vertices.
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 362/568] net/sched: act_connmark: transition to percpu stats and rcu
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (360 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 361/568] af_unix: Initialise scc_index in unix_add_edge() Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 363/568] net_sched: act_connmark: use RCU in tcf_connmark_dump() Greg Kroah-Hartman
` (212 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jamal Hadi Salim, Pedro Tammela,
Paolo Abeni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pedro Tammela <pctammela@mojatatu.com>
[ Upstream commit 288864effe33885988d53faf7830b35cb9a84c7a ]
The tc action act_connmark was using shared stats and taking the per
action lock in the datapath. Improve it by using percpu stats and rcu.
perf before:
- 13.55% tcf_connmark_act
- 81.18% _raw_spin_lock
80.46% native_queued_spin_lock_slowpath
perf after:
- 2.85% tcf_connmark_act
tdc results:
1..15
ok 1 2002 - Add valid connmark action with defaults
ok 2 56a5 - Add valid connmark action with control pass
ok 3 7c66 - Add valid connmark action with control drop
ok 4 a913 - Add valid connmark action with control pipe
ok 5 bdd8 - Add valid connmark action with control reclassify
ok 6 b8be - Add valid connmark action with control continue
ok 7 d8a6 - Add valid connmark action with control jump
ok 8 aae8 - Add valid connmark action with zone argument
ok 9 2f0b - Add valid connmark action with invalid zone argument
ok 10 9305 - Add connmark action with unsupported argument
ok 11 71ca - Add valid connmark action and replace it
ok 12 5f8f - Add valid connmark action with cookie
ok 13 c506 - Replace connmark with invalid goto chain control
ok 14 6571 - Delete connmark action with valid index
ok 15 3426 - Delete connmark action with invalid index
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Stable-dep-of: 62b656e43eae ("net: sched: act_connmark: initialize struct tc_ife to fix kernel leak")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/tc_act/tc_connmark.h | 9 ++-
net/sched/act_connmark.c | 107 ++++++++++++++++++++-----------
2 files changed, 75 insertions(+), 41 deletions(-)
diff --git a/include/net/tc_act/tc_connmark.h b/include/net/tc_act/tc_connmark.h
index 1f4cb477bb5d6..e8dd77a967480 100644
--- a/include/net/tc_act/tc_connmark.h
+++ b/include/net/tc_act/tc_connmark.h
@@ -4,10 +4,15 @@
#include <net/act_api.h>
-struct tcf_connmark_info {
- struct tc_action common;
+struct tcf_connmark_parms {
struct net *net;
u16 zone;
+ struct rcu_head rcu;
+};
+
+struct tcf_connmark_info {
+ struct tc_action common;
+ struct tcf_connmark_parms __rcu *parms;
};
#define to_connmark(a) ((struct tcf_connmark_info *)a)
diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c
index d41002e4613ff..418d60435b9d4 100644
--- a/net/sched/act_connmark.c
+++ b/net/sched/act_connmark.c
@@ -34,13 +34,15 @@ static int tcf_connmark_act(struct sk_buff *skb, const struct tc_action *a,
struct nf_conntrack_tuple tuple;
enum ip_conntrack_info ctinfo;
struct tcf_connmark_info *ca = to_connmark(a);
+ struct tcf_connmark_parms *parms;
struct nf_conntrack_zone zone;
struct nf_conn *c;
int proto;
- spin_lock(&ca->tcf_lock);
tcf_lastuse_update(&ca->tcf_tm);
- bstats_update(&ca->tcf_bstats, skb);
+ tcf_action_update_bstats(&ca->common, skb);
+
+ parms = rcu_dereference_bh(ca->parms);
switch (skb_protocol(skb, true)) {
case htons(ETH_P_IP):
@@ -62,31 +64,29 @@ static int tcf_connmark_act(struct sk_buff *skb, const struct tc_action *a,
c = nf_ct_get(skb, &ctinfo);
if (c) {
skb->mark = READ_ONCE(c->mark);
- /* using overlimits stats to count how many packets marked */
- ca->tcf_qstats.overlimits++;
- goto out;
+ goto count;
}
- if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
- proto, ca->net, &tuple))
+ if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), proto, parms->net,
+ &tuple))
goto out;
- zone.id = ca->zone;
+ zone.id = parms->zone;
zone.dir = NF_CT_DEFAULT_ZONE_DIR;
- thash = nf_conntrack_find_get(ca->net, &zone, &tuple);
+ thash = nf_conntrack_find_get(parms->net, &zone, &tuple);
if (!thash)
goto out;
c = nf_ct_tuplehash_to_ctrack(thash);
- /* using overlimits stats to count how many packets marked */
- ca->tcf_qstats.overlimits++;
skb->mark = READ_ONCE(c->mark);
nf_ct_put(c);
+count:
+ /* using overlimits stats to count how many packets marked */
+ tcf_action_inc_overlimit_qstats(&ca->common);
out:
- spin_unlock(&ca->tcf_lock);
- return ca->tcf_action;
+ return READ_ONCE(ca->tcf_action);
}
static const struct nla_policy connmark_policy[TCA_CONNMARK_MAX + 1] = {
@@ -99,6 +99,7 @@ static int tcf_connmark_init(struct net *net, struct nlattr *nla,
struct netlink_ext_ack *extack)
{
struct tc_action_net *tn = net_generic(net, act_connmark_ops.net_id);
+ struct tcf_connmark_parms *nparms, *oparms;
struct nlattr *tb[TCA_CONNMARK_MAX + 1];
bool bind = flags & TCA_ACT_FLAGS_BIND;
struct tcf_chain *goto_ch = NULL;
@@ -118,52 +119,66 @@ static int tcf_connmark_init(struct net *net, struct nlattr *nla,
if (!tb[TCA_CONNMARK_PARMS])
return -EINVAL;
+ nparms = kzalloc(sizeof(*nparms), GFP_KERNEL);
+ if (!nparms)
+ return -ENOMEM;
+
parm = nla_data(tb[TCA_CONNMARK_PARMS]);
index = parm->index;
ret = tcf_idr_check_alloc(tn, &index, a, bind);
if (!ret) {
- ret = tcf_idr_create(tn, index, est, a,
- &act_connmark_ops, bind, false, flags);
+ ret = tcf_idr_create_from_flags(tn, index, est, a,
+ &act_connmark_ops, bind, flags);
if (ret) {
tcf_idr_cleanup(tn, index);
- return ret;
+ err = ret;
+ goto out_free;
}
ci = to_connmark(*a);
- err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch,
- extack);
- if (err < 0)
- goto release_idr;
- tcf_action_set_ctrlact(*a, parm->action, goto_ch);
- ci->net = net;
- ci->zone = parm->zone;
+
+ nparms->net = net;
+ nparms->zone = parm->zone;
ret = ACT_P_CREATED;
} else if (ret > 0) {
ci = to_connmark(*a);
- if (bind)
- return 0;
- if (!(flags & TCA_ACT_FLAGS_REPLACE)) {
- tcf_idr_release(*a, bind);
- return -EEXIST;
+ if (bind) {
+ err = 0;
+ goto out_free;
}
- err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch,
- extack);
- if (err < 0)
+ if (!(flags & TCA_ACT_FLAGS_REPLACE)) {
+ err = -EEXIST;
goto release_idr;
- /* replacing action and zone */
- spin_lock_bh(&ci->tcf_lock);
- goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch);
- ci->zone = parm->zone;
- spin_unlock_bh(&ci->tcf_lock);
- if (goto_ch)
- tcf_chain_put_by_act(goto_ch);
+ }
+
+ nparms->net = rtnl_dereference(ci->parms)->net;
+ nparms->zone = parm->zone;
+
ret = 0;
}
+ err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch, extack);
+ if (err < 0)
+ goto release_idr;
+
+ spin_lock_bh(&ci->tcf_lock);
+ goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch);
+ oparms = rcu_replace_pointer(ci->parms, nparms, lockdep_is_held(&ci->tcf_lock));
+ spin_unlock_bh(&ci->tcf_lock);
+
+ if (goto_ch)
+ tcf_chain_put_by_act(goto_ch);
+
+ if (oparms)
+ kfree_rcu(oparms, rcu);
+
return ret;
+
release_idr:
tcf_idr_release(*a, bind);
+out_free:
+ kfree(nparms);
return err;
}
@@ -177,11 +192,14 @@ static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a,
.refcnt = refcount_read(&ci->tcf_refcnt) - ref,
.bindcnt = atomic_read(&ci->tcf_bindcnt) - bind,
};
+ struct tcf_connmark_parms *parms;
struct tcf_t t;
spin_lock_bh(&ci->tcf_lock);
+ parms = rcu_dereference_protected(ci->parms, lockdep_is_held(&ci->tcf_lock));
+
opt.action = ci->tcf_action;
- opt.zone = ci->zone;
+ opt.zone = parms->zone;
if (nla_put(skb, TCA_CONNMARK_PARMS, sizeof(opt), &opt))
goto nla_put_failure;
@@ -199,6 +217,16 @@ static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a,
return -1;
}
+static void tcf_connmark_cleanup(struct tc_action *a)
+{
+ struct tcf_connmark_info *ci = to_connmark(a);
+ struct tcf_connmark_parms *parms;
+
+ parms = rcu_dereference_protected(ci->parms, 1);
+ if (parms)
+ kfree_rcu(parms, rcu);
+}
+
static struct tc_action_ops act_connmark_ops = {
.kind = "connmark",
.id = TCA_ID_CONNMARK,
@@ -206,6 +234,7 @@ static struct tc_action_ops act_connmark_ops = {
.act = tcf_connmark_act,
.dump = tcf_connmark_dump,
.init = tcf_connmark_init,
+ .cleanup = tcf_connmark_cleanup,
.size = sizeof(struct tcf_connmark_info),
};
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 363/568] net_sched: act_connmark: use RCU in tcf_connmark_dump()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (361 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 362/568] net/sched: act_connmark: transition to percpu stats and rcu Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 364/568] net: sched: act_connmark: initialize struct tc_ife to fix kernel leak Greg Kroah-Hartman
` (211 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 0d752877705c0252ef2726e4c63c5573f048951c ]
Also storing tcf_action into struct tcf_connmark_parms
makes sure there is no discrepancy in tcf_connmark_act().
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250709090204.797558-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 62b656e43eae ("net: sched: act_connmark: initialize struct tc_ife to fix kernel leak")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/tc_act/tc_connmark.h | 1 +
net/sched/act_connmark.c | 18 ++++++++++--------
2 files changed, 11 insertions(+), 8 deletions(-)
diff --git a/include/net/tc_act/tc_connmark.h b/include/net/tc_act/tc_connmark.h
index e8dd77a967480..a5ce83f3eea4b 100644
--- a/include/net/tc_act/tc_connmark.h
+++ b/include/net/tc_act/tc_connmark.h
@@ -7,6 +7,7 @@
struct tcf_connmark_parms {
struct net *net;
u16 zone;
+ int action;
struct rcu_head rcu;
};
diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c
index 418d60435b9d4..79cfe51a09e74 100644
--- a/net/sched/act_connmark.c
+++ b/net/sched/act_connmark.c
@@ -86,7 +86,7 @@ static int tcf_connmark_act(struct sk_buff *skb, const struct tc_action *a,
/* using overlimits stats to count how many packets marked */
tcf_action_inc_overlimit_qstats(&ca->common);
out:
- return READ_ONCE(ca->tcf_action);
+ return parms->action;
}
static const struct nla_policy connmark_policy[TCA_CONNMARK_MAX + 1] = {
@@ -162,6 +162,8 @@ static int tcf_connmark_init(struct net *net, struct nlattr *nla,
if (err < 0)
goto release_idr;
+ nparms->action = parm->action;
+
spin_lock_bh(&ci->tcf_lock);
goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch);
oparms = rcu_replace_pointer(ci->parms, nparms, lockdep_is_held(&ci->tcf_lock));
@@ -185,20 +187,20 @@ static int tcf_connmark_init(struct net *net, struct nlattr *nla,
static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a,
int bind, int ref)
{
+ const struct tcf_connmark_info *ci = to_connmark(a);
unsigned char *b = skb_tail_pointer(skb);
- struct tcf_connmark_info *ci = to_connmark(a);
+ const struct tcf_connmark_parms *parms;
struct tc_connmark opt = {
.index = ci->tcf_index,
.refcnt = refcount_read(&ci->tcf_refcnt) - ref,
.bindcnt = atomic_read(&ci->tcf_bindcnt) - bind,
};
- struct tcf_connmark_parms *parms;
struct tcf_t t;
- spin_lock_bh(&ci->tcf_lock);
- parms = rcu_dereference_protected(ci->parms, lockdep_is_held(&ci->tcf_lock));
+ rcu_read_lock();
+ parms = rcu_dereference(ci->parms);
- opt.action = ci->tcf_action;
+ opt.action = parms->action;
opt.zone = parms->zone;
if (nla_put(skb, TCA_CONNMARK_PARMS, sizeof(opt), &opt))
goto nla_put_failure;
@@ -207,12 +209,12 @@ static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a,
if (nla_put_64bit(skb, TCA_CONNMARK_TM, sizeof(t), &t,
TCA_CONNMARK_PAD))
goto nla_put_failure;
- spin_unlock_bh(&ci->tcf_lock);
+ rcu_read_unlock();
return skb->len;
nla_put_failure:
- spin_unlock_bh(&ci->tcf_lock);
+ rcu_read_unlock();
nlmsg_trim(skb, b);
return -1;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 364/568] net: sched: act_connmark: initialize struct tc_ife to fix kernel leak
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (362 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 363/568] net_sched: act_connmark: use RCU in tcf_connmark_dump() Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 365/568] net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak Greg Kroah-Hartman
` (210 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+0c85cae3350b7d486aee,
Ranganath V N, Eric Dumazet, Cong Wang, Paolo Abeni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranganath V N <vnranganath.20@gmail.com>
[ Upstream commit 62b656e43eaeae445a39cd8021a4f47065af4389 ]
In tcf_connmark_dump(), the variable 'opt' was partially initialized using a
designatied initializer. While the padding bytes are reamined
uninitialized. nla_put() copies the entire structure into a
netlink message, these uninitialized bytes leaked to userspace.
Initialize the structure with memset before assigning its fields
to ensure all members and padding are cleared prior to beign copied.
Reported-by: syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0c85cae3350b7d486aee
Tested-by: syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com
Fixes: 22a5dc0e5e3e ("net: sched: Introduce connmark action")
Signed-off-by: Ranganath V N <vnranganath.20@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20251109091336.9277-2-vnranganath.20@gmail.com
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/act_connmark.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c
index 79cfe51a09e74..4d75d2ae0d8ce 100644
--- a/net/sched/act_connmark.c
+++ b/net/sched/act_connmark.c
@@ -190,13 +190,15 @@ static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a,
const struct tcf_connmark_info *ci = to_connmark(a);
unsigned char *b = skb_tail_pointer(skb);
const struct tcf_connmark_parms *parms;
- struct tc_connmark opt = {
- .index = ci->tcf_index,
- .refcnt = refcount_read(&ci->tcf_refcnt) - ref,
- .bindcnt = atomic_read(&ci->tcf_bindcnt) - bind,
- };
+ struct tc_connmark opt;
struct tcf_t t;
+ memset(&opt, 0, sizeof(opt));
+
+ opt.index = ci->tcf_index;
+ opt.refcnt = refcount_read(&ci->tcf_refcnt) - ref;
+ opt.bindcnt = atomic_read(&ci->tcf_bindcnt) - bind;
+
rcu_read_lock();
parms = rcu_dereference(ci->parms);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 365/568] net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (363 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 364/568] net: sched: act_connmark: initialize struct tc_ife to fix kernel leak Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 366/568] net/mlx5e: Fix maxrate wraparound in threshold between units Greg Kroah-Hartman
` (209 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+0c85cae3350b7d486aee,
Ranganath V N, Eric Dumazet, Cong Wang, Paolo Abeni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranganath V N <vnranganath.20@gmail.com>
[ Upstream commit ce50039be49eea9b4cd8873ca6eccded1b4a130a ]
Fix a KMSAN kernel-infoleak detected by the syzbot .
[net?] KMSAN: kernel-infoleak in __skb_datagram_iter
In tcf_ife_dump(), the variable 'opt' was partially initialized using a
designatied initializer. While the padding bytes are reamined
uninitialized. nla_put() copies the entire structure into a
netlink message, these uninitialized bytes leaked to userspace.
Initialize the structure with memset before assigning its fields
to ensure all members and padding are cleared prior to beign copied.
This change silences the KMSAN report and prevents potential information
leaks from the kernel memory.
This fix has been tested and validated by syzbot. This patch closes the
bug reported at the following syzkaller link and ensures no infoleak.
Reported-by: syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0c85cae3350b7d486aee
Tested-by: syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com
Fixes: ef6980b6becb ("introduce IFE action")
Signed-off-by: Ranganath V N <vnranganath.20@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20251109091336.9277-3-vnranganath.20@gmail.com
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/act_ife.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 41d63b33461dc..a4505b926a1e4 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -643,13 +643,15 @@ static int tcf_ife_dump(struct sk_buff *skb, struct tc_action *a, int bind,
unsigned char *b = skb_tail_pointer(skb);
struct tcf_ife_info *ife = to_ife(a);
struct tcf_ife_params *p;
- struct tc_ife opt = {
- .index = ife->tcf_index,
- .refcnt = refcount_read(&ife->tcf_refcnt) - ref,
- .bindcnt = atomic_read(&ife->tcf_bindcnt) - bind,
- };
+ struct tc_ife opt;
struct tcf_t t;
+ memset(&opt, 0, sizeof(opt));
+
+ opt.index = ife->tcf_index,
+ opt.refcnt = refcount_read(&ife->tcf_refcnt) - ref,
+ opt.bindcnt = atomic_read(&ife->tcf_bindcnt) - bind,
+
spin_lock_bh(&ife->tcf_lock);
opt.action = ife->tcf_action;
p = rcu_dereference_protected(ife->params,
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 366/568] net/mlx5e: Fix maxrate wraparound in threshold between units
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (364 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 365/568] net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 367/568] net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps Greg Kroah-Hartman
` (208 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gal Pressman, Nimrod Oren,
Tariq Toukan, Paolo Abeni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <gal@nvidia.com>
[ Upstream commit a7bf4d5063c7837096aab2853224eb23628514d9 ]
The previous calculation used roundup() which caused an overflow for
rates between 25.5Gbps and 26Gbps.
For example, a rate of 25.6Gbps would result in using 100Mbps units with
value of 256, which would overflow the 8 bits field.
Simplify the upper_limit_mbps calculation by removing the
unnecessary roundup, and adjust the comparison to use <= to correctly
handle the boundary condition.
Fixes: d8880795dabf ("net/mlx5e: Implement DCBNL IEEE max rate")
Signed-off-by: Gal Pressman <gal@nvidia.com>
Reviewed-by: Nimrod Oren <noren@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/1762681073-1084058-4-git-send-email-tariqt@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index 89de92d064836..cfbf39f0f8727 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -587,18 +587,19 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev,
struct mlx5_core_dev *mdev = priv->mdev;
u8 max_bw_value[IEEE_8021QAZ_MAX_TCS];
u8 max_bw_unit[IEEE_8021QAZ_MAX_TCS];
- __u64 upper_limit_mbps = roundup(255 * MLX5E_100MB, MLX5E_1GB);
+ __u64 upper_limit_mbps;
int i;
memset(max_bw_value, 0, sizeof(max_bw_value));
memset(max_bw_unit, 0, sizeof(max_bw_unit));
+ upper_limit_mbps = 255 * MLX5E_100MB;
for (i = 0; i <= mlx5_max_tc(mdev); i++) {
if (!maxrate->tc_maxrate[i]) {
max_bw_unit[i] = MLX5_BW_NO_LIMIT;
continue;
}
- if (maxrate->tc_maxrate[i] < upper_limit_mbps) {
+ if (maxrate->tc_maxrate[i] <= upper_limit_mbps) {
max_bw_value[i] = div_u64(maxrate->tc_maxrate[i],
MLX5E_100MB);
max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] : 1;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 367/568] net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (365 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 366/568] net/mlx5e: Fix maxrate wraparound in threshold between units Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 368/568] net/mlx5: Expose shared buffer registers bits and structs Greg Kroah-Hartman
` (207 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gal Pressman, Nimrod Oren,
Tariq Toukan, Paolo Abeni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <gal@nvidia.com>
[ Upstream commit 43b27d1bd88a4bce34ec2437d103acfae9655f9e ]
Add validation to reject rates exceeding 255 Gbps that would overflow
the 8 bits max bandwidth field.
Fixes: d8880795dabf ("net/mlx5e: Implement DCBNL IEEE max rate")
Signed-off-by: Gal Pressman <gal@nvidia.com>
Reviewed-by: Nimrod Oren <noren@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/1762681073-1084058-5-git-send-email-tariqt@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index cfbf39f0f8727..2d20e2ff29677 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -588,11 +588,13 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev,
u8 max_bw_value[IEEE_8021QAZ_MAX_TCS];
u8 max_bw_unit[IEEE_8021QAZ_MAX_TCS];
__u64 upper_limit_mbps;
+ __u64 upper_limit_gbps;
int i;
memset(max_bw_value, 0, sizeof(max_bw_value));
memset(max_bw_unit, 0, sizeof(max_bw_unit));
upper_limit_mbps = 255 * MLX5E_100MB;
+ upper_limit_gbps = 255 * MLX5E_1GB;
for (i = 0; i <= mlx5_max_tc(mdev); i++) {
if (!maxrate->tc_maxrate[i]) {
@@ -604,10 +606,16 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev,
MLX5E_100MB);
max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] : 1;
max_bw_unit[i] = MLX5_100_MBPS_UNIT;
- } else {
+ } else if (max_bw_value[i] <= upper_limit_gbps) {
max_bw_value[i] = div_u64(maxrate->tc_maxrate[i],
MLX5E_1GB);
max_bw_unit[i] = MLX5_GBPS_UNIT;
+ } else {
+ netdev_err(netdev,
+ "tc_%d maxrate %llu Kbps exceeds limit %llu\n",
+ i, maxrate->tc_maxrate[i],
+ upper_limit_gbps);
+ return -EINVAL;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 368/568] net/mlx5: Expose shared buffer registers bits and structs
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (366 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 367/568] net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 369/568] net/mlx5e: Add API to query/modify SBPR and SBCM registers Greg Kroah-Hartman
` (206 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maher Sanalla, Moshe Shemesh,
Saeed Mahameed, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maher Sanalla <msanalla@nvidia.com>
[ Upstream commit 8d231dbc3b10155727bcfa9e543d397ad357f14f ]
Add the shared receive buffer management and configuration registers:
1. SBPR - Shared Buffer Pools Register
2. SBCM - Shared Buffer Class Management Register
Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Stable-dep-of: 9fcc2b6c1052 ("net/mlx5e: Fix potentially misleading debug message")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/mlx5/driver.h | 2 ++
include/linux/mlx5/mlx5_ifc.h | 61 +++++++++++++++++++++++++++++++++++
2 files changed, 63 insertions(+)
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index b05f69a8306c9..9af7180eac9e3 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -100,6 +100,8 @@ enum {
};
enum {
+ MLX5_REG_SBPR = 0xb001,
+ MLX5_REG_SBCM = 0xb002,
MLX5_REG_QPTS = 0x4002,
MLX5_REG_QETCR = 0x4005,
MLX5_REG_QTCT = 0x400a,
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index 271c5a87751fe..4df7b3d358607 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -10930,6 +10930,67 @@ struct mlx5_ifc_pbmc_reg_bits {
u8 reserved_at_2e0[0x80];
};
+struct mlx5_ifc_sbpr_reg_bits {
+ u8 desc[0x1];
+ u8 snap[0x1];
+ u8 reserved_at_2[0x4];
+ u8 dir[0x2];
+ u8 reserved_at_8[0x14];
+ u8 pool[0x4];
+
+ u8 infi_size[0x1];
+ u8 reserved_at_21[0x7];
+ u8 size[0x18];
+
+ u8 reserved_at_40[0x1c];
+ u8 mode[0x4];
+
+ u8 reserved_at_60[0x8];
+ u8 buff_occupancy[0x18];
+
+ u8 clr[0x1];
+ u8 reserved_at_81[0x7];
+ u8 max_buff_occupancy[0x18];
+
+ u8 reserved_at_a0[0x8];
+ u8 ext_buff_occupancy[0x18];
+};
+
+struct mlx5_ifc_sbcm_reg_bits {
+ u8 desc[0x1];
+ u8 snap[0x1];
+ u8 reserved_at_2[0x6];
+ u8 local_port[0x8];
+ u8 pnat[0x2];
+ u8 pg_buff[0x6];
+ u8 reserved_at_18[0x6];
+ u8 dir[0x2];
+
+ u8 reserved_at_20[0x1f];
+ u8 exc[0x1];
+
+ u8 reserved_at_40[0x40];
+
+ u8 reserved_at_80[0x8];
+ u8 buff_occupancy[0x18];
+
+ u8 clr[0x1];
+ u8 reserved_at_a1[0x7];
+ u8 max_buff_occupancy[0x18];
+
+ u8 reserved_at_c0[0x8];
+ u8 min_buff[0x18];
+
+ u8 infi_max[0x1];
+ u8 reserved_at_e1[0x7];
+ u8 max_buff[0x18];
+
+ u8 reserved_at_100[0x20];
+
+ u8 reserved_at_120[0x1c];
+ u8 pool[0x4];
+};
+
struct mlx5_ifc_qtct_reg_bits {
u8 reserved_at_0[0x8];
u8 port_number[0x8];
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 369/568] net/mlx5e: Add API to query/modify SBPR and SBCM registers
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (367 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 368/568] net/mlx5: Expose shared buffer registers bits and structs Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 370/568] net/mlx5e: Update shared buffer along with device buffer changes Greg Kroah-Hartman
` (205 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maher Sanalla, Moshe Shemesh,
Saeed Mahameed, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maher Sanalla <msanalla@nvidia.com>
[ Upstream commit 11f0996d5c6023f4889882c8d088ec76a050d704 ]
To allow users to configure shared receive buffer parameters through
dcbnl callbacks, expose an API to query and modify SBPR and SBCM registers,
which will be used in the upcoming patch.
Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Stable-dep-of: 9fcc2b6c1052 ("net/mlx5e: Fix potentially misleading debug message")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/mellanox/mlx5/core/en/port.c | 72 +++++++++++++++++++
.../net/ethernet/mellanox/mlx5/core/en/port.h | 6 ++
2 files changed, 78 insertions(+)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
index 89510cac46c22..505ba41195b93 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
@@ -287,6 +287,78 @@ int mlx5e_port_set_pbmc(struct mlx5_core_dev *mdev, void *in)
return err;
}
+int mlx5e_port_query_sbpr(struct mlx5_core_dev *mdev, u32 desc, u8 dir,
+ u8 pool_idx, void *out, int size_out)
+{
+ u32 in[MLX5_ST_SZ_DW(sbpr_reg)] = {};
+
+ MLX5_SET(sbpr_reg, in, desc, desc);
+ MLX5_SET(sbpr_reg, in, dir, dir);
+ MLX5_SET(sbpr_reg, in, pool, pool_idx);
+
+ return mlx5_core_access_reg(mdev, in, sizeof(in), out, size_out, MLX5_REG_SBPR, 0, 0);
+}
+
+int mlx5e_port_set_sbpr(struct mlx5_core_dev *mdev, u32 desc, u8 dir,
+ u8 pool_idx, u32 infi_size, u32 size)
+{
+ u32 out[MLX5_ST_SZ_DW(sbpr_reg)] = {};
+ u32 in[MLX5_ST_SZ_DW(sbpr_reg)] = {};
+
+ MLX5_SET(sbpr_reg, in, desc, desc);
+ MLX5_SET(sbpr_reg, in, dir, dir);
+ MLX5_SET(sbpr_reg, in, pool, pool_idx);
+ MLX5_SET(sbpr_reg, in, infi_size, infi_size);
+ MLX5_SET(sbpr_reg, in, size, size);
+ MLX5_SET(sbpr_reg, in, mode, 1);
+
+ return mlx5_core_access_reg(mdev, in, sizeof(in), out, sizeof(out), MLX5_REG_SBPR, 0, 1);
+}
+
+static int mlx5e_port_query_sbcm(struct mlx5_core_dev *mdev, u32 desc,
+ u8 pg_buff_idx, u8 dir, void *out,
+ int size_out)
+{
+ u32 in[MLX5_ST_SZ_DW(sbcm_reg)] = {};
+
+ MLX5_SET(sbcm_reg, in, desc, desc);
+ MLX5_SET(sbcm_reg, in, local_port, 1);
+ MLX5_SET(sbcm_reg, in, pg_buff, pg_buff_idx);
+ MLX5_SET(sbcm_reg, in, dir, dir);
+
+ return mlx5_core_access_reg(mdev, in, sizeof(in), out, size_out, MLX5_REG_SBCM, 0, 0);
+}
+
+int mlx5e_port_set_sbcm(struct mlx5_core_dev *mdev, u32 desc, u8 pg_buff_idx,
+ u8 dir, u8 infi_size, u32 max_buff, u8 pool_idx)
+{
+ u32 out[MLX5_ST_SZ_DW(sbcm_reg)] = {};
+ u32 in[MLX5_ST_SZ_DW(sbcm_reg)] = {};
+ u32 min_buff;
+ int err;
+ u8 exc;
+
+ err = mlx5e_port_query_sbcm(mdev, desc, pg_buff_idx, dir, out,
+ sizeof(out));
+ if (err)
+ return err;
+
+ exc = MLX5_GET(sbcm_reg, out, exc);
+ min_buff = MLX5_GET(sbcm_reg, out, min_buff);
+
+ MLX5_SET(sbcm_reg, in, desc, desc);
+ MLX5_SET(sbcm_reg, in, local_port, 1);
+ MLX5_SET(sbcm_reg, in, pg_buff, pg_buff_idx);
+ MLX5_SET(sbcm_reg, in, dir, dir);
+ MLX5_SET(sbcm_reg, in, exc, exc);
+ MLX5_SET(sbcm_reg, in, min_buff, min_buff);
+ MLX5_SET(sbcm_reg, in, infi_max, infi_size);
+ MLX5_SET(sbcm_reg, in, max_buff, max_buff);
+ MLX5_SET(sbcm_reg, in, pool, pool_idx);
+
+ return mlx5_core_access_reg(mdev, in, sizeof(in), out, sizeof(out), MLX5_REG_SBCM, 0, 1);
+}
+
/* buffer[i]: buffer that priority i mapped to */
int mlx5e_port_query_priority2buffer(struct mlx5_core_dev *mdev, u8 *buffer)
{
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port.h
index 7a7defe607926..3f474e370828d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port.h
@@ -57,6 +57,12 @@ u32 mlx5e_port_speed2linkmodes(struct mlx5_core_dev *mdev, u32 speed,
bool mlx5e_ptys_ext_supported(struct mlx5_core_dev *mdev);
int mlx5e_port_query_pbmc(struct mlx5_core_dev *mdev, void *out);
int mlx5e_port_set_pbmc(struct mlx5_core_dev *mdev, void *in);
+int mlx5e_port_query_sbpr(struct mlx5_core_dev *mdev, u32 desc, u8 dir,
+ u8 pool_idx, void *out, int size_out);
+int mlx5e_port_set_sbpr(struct mlx5_core_dev *mdev, u32 desc, u8 dir,
+ u8 pool_idx, u32 infi_size, u32 size);
+int mlx5e_port_set_sbcm(struct mlx5_core_dev *mdev, u32 desc, u8 pg_buff_idx,
+ u8 dir, u8 infi_size, u32 max_buff, u8 pool_idx);
int mlx5e_port_query_priority2buffer(struct mlx5_core_dev *mdev, u8 *buffer);
int mlx5e_port_set_priority2buffer(struct mlx5_core_dev *mdev, u8 *buffer);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 370/568] net/mlx5e: Update shared buffer along with device buffer changes
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (368 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 369/568] net/mlx5e: Add API to query/modify SBPR and SBCM registers Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 371/568] net/mlx5e: Consider internal buffers size in port buffer calculations Greg Kroah-Hartman
` (204 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maher Sanalla, Moshe Shemesh,
Saeed Mahameed, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maher Sanalla <msanalla@nvidia.com>
[ Upstream commit a440030d8946bfe3fd44b6da685e33ffe0ecd1ff ]
Currently, the user can modify device's receive buffer size, modify the
mapping between QoS priority groups to buffers and change the buffer
state to become lossy/lossless via pfc command.
However, the shared receive buffer pool alignments, as a result of
such commands, is performed only when the shared buffer is in FW ownership.
When a user changes the mapping of priority groups or buffer size,
the shared buffer is moved to SW ownership.
Therefore, for devices that support shared buffer, handle the shared buffer
alignments in accordance to user's desired configurations.
Meaning, the following will be performed:
1. For every change of buffer's headroom, recalculate the size of shared
buffer to be equal to "total_buffer_size" - "new_headroom_size".
The new shared buffer size will be split in ratio of 3:1 between
lossy and lossless pools, respectively.
2. For each port buffer change, count the number of lossless buffers.
If there is only one lossless buffer, then set its lossless pool
usage threshold to be infinite. Otherwise, if there is more than
one lossless buffer, set a usage threshold for each lossless buffer.
While at it, add more verbosity to debug prints when handling user
commands, to assist in future debug.
Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Stable-dep-of: 9fcc2b6c1052 ("net/mlx5e: Fix potentially misleading debug message")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../mellanox/mlx5/core/en/port_buffer.c | 222 +++++++++++++++++-
.../mellanox/mlx5/core/en/port_buffer.h | 1 +
2 files changed, 219 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
index 7899a7230299d..e846417a8ca94 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
@@ -73,6 +73,7 @@ int mlx5e_port_query_buffer(struct mlx5e_priv *priv,
port_buffer->buffer[i].lossy);
}
+ port_buffer->headroom_size = total_used;
port_buffer->port_buffer_size =
MLX5_GET(pbmc_reg, out, port_buffer_size) * port_buff_cell_sz;
port_buffer->spare_buffer_size =
@@ -86,16 +87,204 @@ int mlx5e_port_query_buffer(struct mlx5e_priv *priv,
return err;
}
+struct mlx5e_buffer_pool {
+ u32 infi_size;
+ u32 size;
+ u32 buff_occupancy;
+};
+
+static int mlx5e_port_query_pool(struct mlx5_core_dev *mdev,
+ struct mlx5e_buffer_pool *buffer_pool,
+ u32 desc, u8 dir, u8 pool_idx)
+{
+ u32 out[MLX5_ST_SZ_DW(sbpr_reg)] = {};
+ int err;
+
+ err = mlx5e_port_query_sbpr(mdev, desc, dir, pool_idx, out,
+ sizeof(out));
+ if (err)
+ return err;
+
+ buffer_pool->size = MLX5_GET(sbpr_reg, out, size);
+ buffer_pool->infi_size = MLX5_GET(sbpr_reg, out, infi_size);
+ buffer_pool->buff_occupancy = MLX5_GET(sbpr_reg, out, buff_occupancy);
+
+ return err;
+}
+
+enum {
+ MLX5_INGRESS_DIR = 0,
+ MLX5_EGRESS_DIR = 1,
+};
+
+enum {
+ MLX5_LOSSY_POOL = 0,
+ MLX5_LOSSLESS_POOL = 1,
+};
+
+/* No limit on usage of shared buffer pool (max_buff=0) */
+#define MLX5_SB_POOL_NO_THRESHOLD 0
+/* Shared buffer pool usage threshold when calculated
+ * dynamically in alpha units. alpha=13 is equivalent to
+ * HW_alpha of [(1/128) * 2 ^ (alpha-1)] = 32, where HW_alpha
+ * equates to the following portion of the shared buffer pool:
+ * [32 / (1 + n * 32)] While *n* is the number of buffers
+ * that are using the shared buffer pool.
+ */
+#define MLX5_SB_POOL_THRESHOLD 13
+
+/* Shared buffer class management parameters */
+struct mlx5_sbcm_params {
+ u8 pool_idx;
+ u8 max_buff;
+ u8 infi_size;
+};
+
+static const struct mlx5_sbcm_params sbcm_default = {
+ .pool_idx = MLX5_LOSSY_POOL,
+ .max_buff = MLX5_SB_POOL_NO_THRESHOLD,
+ .infi_size = 0,
+};
+
+static const struct mlx5_sbcm_params sbcm_lossy = {
+ .pool_idx = MLX5_LOSSY_POOL,
+ .max_buff = MLX5_SB_POOL_NO_THRESHOLD,
+ .infi_size = 1,
+};
+
+static const struct mlx5_sbcm_params sbcm_lossless = {
+ .pool_idx = MLX5_LOSSLESS_POOL,
+ .max_buff = MLX5_SB_POOL_THRESHOLD,
+ .infi_size = 0,
+};
+
+static const struct mlx5_sbcm_params sbcm_lossless_no_threshold = {
+ .pool_idx = MLX5_LOSSLESS_POOL,
+ .max_buff = MLX5_SB_POOL_NO_THRESHOLD,
+ .infi_size = 1,
+};
+
+/**
+ * select_sbcm_params() - selects the shared buffer pool configuration
+ *
+ * @buffer: <input> port buffer to retrieve params of
+ * @lossless_buff_count: <input> number of lossless buffers in total
+ *
+ * The selection is based on the following rules:
+ * 1. If buffer size is 0, no shared buffer pool is used.
+ * 2. If buffer is lossy, use lossy shared buffer pool.
+ * 3. If there are more than 1 lossless buffers, use lossless shared buffer pool
+ * with threshold.
+ * 4. If there is only 1 lossless buffer, use lossless shared buffer pool
+ * without threshold.
+ *
+ * @return const struct mlx5_sbcm_params* selected values
+ */
+static const struct mlx5_sbcm_params *
+select_sbcm_params(struct mlx5e_bufferx_reg *buffer, u8 lossless_buff_count)
+{
+ if (buffer->size == 0)
+ return &sbcm_default;
+
+ if (buffer->lossy)
+ return &sbcm_lossy;
+
+ if (lossless_buff_count > 1)
+ return &sbcm_lossless;
+
+ return &sbcm_lossless_no_threshold;
+}
+
+static int port_update_pool_cfg(struct mlx5_core_dev *mdev,
+ struct mlx5e_port_buffer *port_buffer)
+{
+ const struct mlx5_sbcm_params *p;
+ u8 lossless_buff_count = 0;
+ int err;
+ int i;
+
+ if (!MLX5_CAP_GEN(mdev, sbcam_reg))
+ return 0;
+
+ for (i = 0; i < MLX5E_MAX_BUFFER; i++)
+ lossless_buff_count += ((port_buffer->buffer[i].size) &&
+ (!(port_buffer->buffer[i].lossy)));
+
+ for (i = 0; i < MLX5E_MAX_BUFFER; i++) {
+ p = select_sbcm_params(&port_buffer->buffer[i], lossless_buff_count);
+ err = mlx5e_port_set_sbcm(mdev, 0, i,
+ MLX5_INGRESS_DIR,
+ p->infi_size,
+ p->max_buff,
+ p->pool_idx);
+ if (err)
+ return err;
+ }
+
+ return 0;
+}
+
+static int port_update_shared_buffer(struct mlx5_core_dev *mdev,
+ u32 current_headroom_size,
+ u32 new_headroom_size)
+{
+ struct mlx5e_buffer_pool lossless_ipool;
+ struct mlx5e_buffer_pool lossy_epool;
+ u32 lossless_ipool_size;
+ u32 shared_buffer_size;
+ u32 total_buffer_size;
+ u32 lossy_epool_size;
+ int err;
+
+ if (!MLX5_CAP_GEN(mdev, sbcam_reg))
+ return 0;
+
+ err = mlx5e_port_query_pool(mdev, &lossy_epool, 0, MLX5_EGRESS_DIR,
+ MLX5_LOSSY_POOL);
+ if (err)
+ return err;
+
+ err = mlx5e_port_query_pool(mdev, &lossless_ipool, 0, MLX5_INGRESS_DIR,
+ MLX5_LOSSLESS_POOL);
+ if (err)
+ return err;
+
+ total_buffer_size = current_headroom_size + lossy_epool.size +
+ lossless_ipool.size;
+ shared_buffer_size = total_buffer_size - new_headroom_size;
+
+ if (shared_buffer_size < 4) {
+ pr_err("Requested port buffer is too large, not enough space left for shared buffer\n");
+ return -EINVAL;
+ }
+
+ /* Total shared buffer size is split in a ratio of 3:1 between
+ * lossy and lossless pools respectively.
+ */
+ lossy_epool_size = (shared_buffer_size / 4) * 3;
+ lossless_ipool_size = shared_buffer_size / 4;
+
+ mlx5e_port_set_sbpr(mdev, 0, MLX5_EGRESS_DIR, MLX5_LOSSY_POOL, 0,
+ lossy_epool_size);
+ mlx5e_port_set_sbpr(mdev, 0, MLX5_INGRESS_DIR, MLX5_LOSSLESS_POOL, 0,
+ lossless_ipool_size);
+ return 0;
+}
+
static int port_set_buffer(struct mlx5e_priv *priv,
struct mlx5e_port_buffer *port_buffer)
{
u16 port_buff_cell_sz = priv->dcbx.port_buff_cell_sz;
struct mlx5_core_dev *mdev = priv->mdev;
int sz = MLX5_ST_SZ_BYTES(pbmc_reg);
+ u32 new_headroom_size = 0;
+ u32 current_headroom_size;
void *in;
int err;
int i;
+ current_headroom_size = port_buffer->headroom_size;
+
in = kzalloc(sz, GFP_KERNEL);
if (!in)
return -ENOMEM;
@@ -110,6 +299,7 @@ static int port_set_buffer(struct mlx5e_priv *priv,
u64 xoff = port_buffer->buffer[i].xoff;
u64 xon = port_buffer->buffer[i].xon;
+ new_headroom_size += size;
do_div(size, port_buff_cell_sz);
do_div(xoff, port_buff_cell_sz);
do_div(xon, port_buff_cell_sz);
@@ -119,6 +309,17 @@ static int port_set_buffer(struct mlx5e_priv *priv,
MLX5_SET(bufferx_reg, buffer, xon_threshold, xon);
}
+ new_headroom_size /= port_buff_cell_sz;
+ current_headroom_size /= port_buff_cell_sz;
+ err = port_update_shared_buffer(priv->mdev, current_headroom_size,
+ new_headroom_size);
+ if (err)
+ return err;
+
+ err = port_update_pool_cfg(priv->mdev, port_buffer);
+ if (err)
+ return err;
+
err = mlx5e_port_set_pbmc(mdev, in);
out:
kfree(in);
@@ -174,6 +375,7 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
/**
* update_buffer_lossy - Update buffer configuration based on pfc
+ * @mdev: port function core device
* @max_mtu: netdev's max_mtu
* @pfc_en: <input> current pfc configuration
* @buffer: <input> current prio to buffer mapping
@@ -192,7 +394,8 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
* @return: 0 if no error,
* sets change to true if buffer configuration was modified.
*/
-static int update_buffer_lossy(unsigned int max_mtu,
+static int update_buffer_lossy(struct mlx5_core_dev *mdev,
+ unsigned int max_mtu,
u8 pfc_en, u8 *buffer, u32 xoff, u16 port_buff_cell_sz,
struct mlx5e_port_buffer *port_buffer,
bool *change)
@@ -229,6 +432,10 @@ static int update_buffer_lossy(unsigned int max_mtu,
}
if (changed) {
+ err = port_update_pool_cfg(mdev, port_buffer);
+ if (err)
+ return err;
+
err = update_xoff_threshold(port_buffer, xoff, max_mtu, port_buff_cell_sz);
if (err)
return err;
@@ -293,23 +500,30 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
}
if (change & MLX5E_PORT_BUFFER_PFC) {
+ mlx5e_dbg(HW, priv, "%s: requested PFC per priority bitmask: 0x%x\n",
+ __func__, pfc->pfc_en);
err = mlx5e_port_query_priority2buffer(priv->mdev, buffer);
if (err)
return err;
- err = update_buffer_lossy(max_mtu, pfc->pfc_en, buffer, xoff, port_buff_cell_sz,
- &port_buffer, &update_buffer);
+ err = update_buffer_lossy(priv->mdev, max_mtu, pfc->pfc_en, buffer, xoff,
+ port_buff_cell_sz, &port_buffer,
+ &update_buffer);
if (err)
return err;
}
if (change & MLX5E_PORT_BUFFER_PRIO2BUFFER) {
update_prio2buffer = true;
+ for (i = 0; i < MLX5E_MAX_BUFFER; i++)
+ mlx5e_dbg(HW, priv, "%s: requested to map prio[%d] to buffer %d\n",
+ __func__, i, prio2buffer[i]);
+
err = fill_pfc_en(priv->mdev, &curr_pfc_en);
if (err)
return err;
- err = update_buffer_lossy(max_mtu, curr_pfc_en, prio2buffer, xoff,
+ err = update_buffer_lossy(priv->mdev, max_mtu, curr_pfc_en, prio2buffer, xoff,
port_buff_cell_sz, &port_buffer, &update_buffer);
if (err)
return err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
index 80af7a5ac6046..a6ef118de758f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
@@ -60,6 +60,7 @@ struct mlx5e_bufferx_reg {
struct mlx5e_port_buffer {
u32 port_buffer_size;
u32 spare_buffer_size;
+ u32 headroom_size;
struct mlx5e_bufferx_reg buffer[MLX5E_MAX_BUFFER];
};
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 371/568] net/mlx5e: Consider internal buffers size in port buffer calculations
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (369 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 370/568] net/mlx5e: Update shared buffer along with device buffer changes Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 372/568] net/mlx5e: Remove mlx5e_dbg() and msglvl support Greg Kroah-Hartman
` (203 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maher Sanalla, Moshe Shemesh,
Saeed Mahameed, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maher Sanalla <msanalla@nvidia.com>
[ Upstream commit 81fe2be062915e2a2fdc494c3cd90e946e946c25 ]
Currently, when a user triggers a change in port buffer headroom
(buffers 0-7), the driver checks that the requested headroom does
not exceed the total port buffer size. However, this check does not
take into account the internal buffers (buffers 8-9), which are also
part of the total port buffer. This can result in treating invalid port
buffer change requests as valid, causing unintended changes to the shared
buffer.
To address this, include the internal buffers size in the calculation of
available port buffer space which ensures that port buffer requests do not
exceed the correct limit.
Furthermore, remove internal buffers (8-9) size from the total_size
calculation as these buffers are reserved for internal use and are not
exposed to the user.
While at it, add verbosity to the debug prints in
mlx5e_port_query_buffer() function to ease future debugging.
Fixes: ecdf2dadee8e ("net/mlx5e: Receive buffer support for DCBX")
Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Stable-dep-of: 9fcc2b6c1052 ("net/mlx5e: Fix potentially misleading debug message")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../mellanox/mlx5/core/en/port_buffer.c | 42 ++++++++++++-------
.../mellanox/mlx5/core/en/port_buffer.h | 8 ++--
.../ethernet/mellanox/mlx5/core/en_dcbnl.c | 7 ++--
3 files changed, 36 insertions(+), 21 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
index e846417a8ca94..b02cba086b366 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
@@ -51,7 +51,7 @@ int mlx5e_port_query_buffer(struct mlx5e_priv *priv,
if (err)
goto out;
- for (i = 0; i < MLX5E_MAX_BUFFER; i++) {
+ for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++) {
buffer = MLX5_ADDR_OF(pbmc_reg, out, buffer[i]);
port_buffer->buffer[i].lossy =
MLX5_GET(bufferx_reg, buffer, lossy);
@@ -73,14 +73,24 @@ int mlx5e_port_query_buffer(struct mlx5e_priv *priv,
port_buffer->buffer[i].lossy);
}
- port_buffer->headroom_size = total_used;
+ port_buffer->internal_buffers_size = 0;
+ for (i = MLX5E_MAX_NETWORK_BUFFER; i < MLX5E_TOTAL_BUFFERS; i++) {
+ buffer = MLX5_ADDR_OF(pbmc_reg, out, buffer[i]);
+ port_buffer->internal_buffers_size +=
+ MLX5_GET(bufferx_reg, buffer, size) * port_buff_cell_sz;
+ }
+
port_buffer->port_buffer_size =
MLX5_GET(pbmc_reg, out, port_buffer_size) * port_buff_cell_sz;
- port_buffer->spare_buffer_size =
- port_buffer->port_buffer_size - total_used;
-
- mlx5e_dbg(HW, priv, "total buffer size=%d, spare buffer size=%d\n",
- port_buffer->port_buffer_size,
+ port_buffer->headroom_size = total_used;
+ port_buffer->spare_buffer_size = port_buffer->port_buffer_size -
+ port_buffer->internal_buffers_size -
+ port_buffer->headroom_size;
+
+ mlx5e_dbg(HW, priv,
+ "total buffer size=%u, headroom buffer size=%u, internal buffers size=%u, spare buffer size=%u\n",
+ port_buffer->port_buffer_size, port_buffer->headroom_size,
+ port_buffer->internal_buffers_size,
port_buffer->spare_buffer_size);
out:
kfree(out);
@@ -206,11 +216,11 @@ static int port_update_pool_cfg(struct mlx5_core_dev *mdev,
if (!MLX5_CAP_GEN(mdev, sbcam_reg))
return 0;
- for (i = 0; i < MLX5E_MAX_BUFFER; i++)
+ for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++)
lossless_buff_count += ((port_buffer->buffer[i].size) &&
(!(port_buffer->buffer[i].lossy)));
- for (i = 0; i < MLX5E_MAX_BUFFER; i++) {
+ for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++) {
p = select_sbcm_params(&port_buffer->buffer[i], lossless_buff_count);
err = mlx5e_port_set_sbcm(mdev, 0, i,
MLX5_INGRESS_DIR,
@@ -293,7 +303,7 @@ static int port_set_buffer(struct mlx5e_priv *priv,
if (err)
goto out;
- for (i = 0; i < MLX5E_MAX_BUFFER; i++) {
+ for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++) {
void *buffer = MLX5_ADDR_OF(pbmc_reg, in, buffer[i]);
u64 size = port_buffer->buffer[i].size;
u64 xoff = port_buffer->buffer[i].xoff;
@@ -351,7 +361,7 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
{
int i;
- for (i = 0; i < MLX5E_MAX_BUFFER; i++) {
+ for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++) {
if (port_buffer->buffer[i].lossy) {
port_buffer->buffer[i].xoff = 0;
port_buffer->buffer[i].xon = 0;
@@ -408,7 +418,7 @@ static int update_buffer_lossy(struct mlx5_core_dev *mdev,
int err;
int i;
- for (i = 0; i < MLX5E_MAX_BUFFER; i++) {
+ for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++) {
prio_count = 0;
lossy_count = 0;
@@ -515,7 +525,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
if (change & MLX5E_PORT_BUFFER_PRIO2BUFFER) {
update_prio2buffer = true;
- for (i = 0; i < MLX5E_MAX_BUFFER; i++)
+ for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++)
mlx5e_dbg(HW, priv, "%s: requested to map prio[%d] to buffer %d\n",
__func__, i, prio2buffer[i]);
@@ -530,7 +540,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
}
if (change & MLX5E_PORT_BUFFER_SIZE) {
- for (i = 0; i < MLX5E_MAX_BUFFER; i++) {
+ for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++) {
mlx5e_dbg(HW, priv, "%s: buffer[%d]=%d\n", __func__, i, buffer_size[i]);
if (!port_buffer.buffer[i].lossy && !buffer_size[i]) {
mlx5e_dbg(HW, priv, "%s: lossless buffer[%d] size cannot be zero\n",
@@ -544,7 +554,9 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
mlx5e_dbg(HW, priv, "%s: total buffer requested=%d\n", __func__, total_used);
- if (total_used > port_buffer.port_buffer_size)
+ if (total_used > port_buffer.headroom_size &&
+ (total_used - port_buffer.headroom_size) >
+ port_buffer.spare_buffer_size)
return -EINVAL;
update_buffer = true;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
index a6ef118de758f..f4a19ffbb641c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
@@ -35,7 +35,8 @@
#include "en.h"
#include "port.h"
-#define MLX5E_MAX_BUFFER 8
+#define MLX5E_MAX_NETWORK_BUFFER 8
+#define MLX5E_TOTAL_BUFFERS 10
#define MLX5E_DEFAULT_CABLE_LEN 7 /* 7 meters */
#define MLX5_BUFFER_SUPPORTED(mdev) (MLX5_CAP_GEN(mdev, pcam_reg) && \
@@ -60,8 +61,9 @@ struct mlx5e_bufferx_reg {
struct mlx5e_port_buffer {
u32 port_buffer_size;
u32 spare_buffer_size;
- u32 headroom_size;
- struct mlx5e_bufferx_reg buffer[MLX5E_MAX_BUFFER];
+ u32 headroom_size; /* Buffers 0-7 */
+ u32 internal_buffers_size; /* Buffers 8-9 */
+ struct mlx5e_bufferx_reg buffer[MLX5E_MAX_NETWORK_BUFFER];
};
int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index 2d20e2ff29677..55ceb6740291d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -935,9 +935,10 @@ static int mlx5e_dcbnl_getbuffer(struct net_device *dev,
if (err)
return err;
- for (i = 0; i < MLX5E_MAX_BUFFER; i++)
+ for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++)
dcb_buffer->buffer_size[i] = port_buffer.buffer[i].size;
- dcb_buffer->total_size = port_buffer.port_buffer_size;
+ dcb_buffer->total_size = port_buffer.port_buffer_size -
+ port_buffer.internal_buffers_size;
return 0;
}
@@ -979,7 +980,7 @@ static int mlx5e_dcbnl_setbuffer(struct net_device *dev,
if (err)
return err;
- for (i = 0; i < MLX5E_MAX_BUFFER; i++) {
+ for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++) {
if (port_buffer.buffer[i].size != dcb_buffer->buffer_size[i]) {
changed |= MLX5E_PORT_BUFFER_SIZE;
buffer_size = dcb_buffer->buffer_size;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 372/568] net/mlx5e: Remove mlx5e_dbg() and msglvl support
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (370 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 371/568] net/mlx5e: Consider internal buffers size in port buffer calculations Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 373/568] net/mlx5e: Fix potentially misleading debug message Greg Kroah-Hartman
` (202 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gal Pressman, Tariq Toukan,
Saeed Mahameed, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <gal@nvidia.com>
[ Upstream commit 559f4c32ebff40a25199b5178d58c9283ac5eb9c ]
The msglvl support was implemented using the mlx5e_dbg() macro which is
rarely used in the driver, and is not very useful when you can just use
dynamic debug instead.
Remove mlx5e_dbg() and convert its usages to netdev_dbg().
Signed-off-by: Gal Pressman <gal@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Stable-dep-of: 9fcc2b6c1052 ("net/mlx5e: Fix potentially misleading debug message")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en.h | 10 -----
.../mellanox/mlx5/core/en/port_buffer.c | 44 ++++++++++---------
.../net/ethernet/mellanox/mlx5/core/en_arfs.c | 8 ++--
.../ethernet/mellanox/mlx5/core/en_dcbnl.c | 26 +++++------
.../ethernet/mellanox/mlx5/core/en_ethtool.c | 18 ++------
.../net/ethernet/mellanox/mlx5/core/en_main.c | 5 +--
6 files changed, 45 insertions(+), 66 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 0ee456480a488..906bf327cdef8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -165,15 +165,6 @@ struct page_pool;
#define MLX5E_MAX_KLM_PER_WQE(mdev) \
MLX5E_KLM_ENTRIES_PER_WQE(MLX5_SEND_WQE_BB * mlx5e_get_max_sq_aligned_wqebbs(mdev))
-#define MLX5E_MSG_LEVEL NETIF_MSG_LINK
-
-#define mlx5e_dbg(mlevel, priv, format, ...) \
-do { \
- if (NETIF_MSG_##mlevel & (priv)->msglevel) \
- netdev_warn(priv->netdev, format, \
- ##__VA_ARGS__); \
-} while (0)
-
#define mlx5e_state_dereference(priv, p) \
rcu_dereference_protected((p), lockdep_is_held(&(priv)->state_lock))
@@ -901,7 +892,6 @@ struct mlx5e_priv {
#endif
/* priv data path fields - end */
- u32 msglevel;
unsigned long state;
struct mutex state_lock; /* Protects Interface state */
struct mlx5e_rq drop_rq;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
index b02cba086b366..9be06df2d6e82 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
@@ -65,12 +65,13 @@ int mlx5e_port_query_buffer(struct mlx5e_priv *priv,
MLX5_GET(bufferx_reg, buffer, xoff_threshold) * port_buff_cell_sz;
total_used += port_buffer->buffer[i].size;
- mlx5e_dbg(HW, priv, "buffer %d: size=%d, xon=%d, xoff=%d, epsb=%d, lossy=%d\n", i,
- port_buffer->buffer[i].size,
- port_buffer->buffer[i].xon,
- port_buffer->buffer[i].xoff,
- port_buffer->buffer[i].epsb,
- port_buffer->buffer[i].lossy);
+ netdev_dbg(priv->netdev, "buffer %d: size=%d, xon=%d, xoff=%d, epsb=%d, lossy=%d\n",
+ i,
+ port_buffer->buffer[i].size,
+ port_buffer->buffer[i].xon,
+ port_buffer->buffer[i].xoff,
+ port_buffer->buffer[i].epsb,
+ port_buffer->buffer[i].lossy);
}
port_buffer->internal_buffers_size = 0;
@@ -87,11 +88,11 @@ int mlx5e_port_query_buffer(struct mlx5e_priv *priv,
port_buffer->internal_buffers_size -
port_buffer->headroom_size;
- mlx5e_dbg(HW, priv,
- "total buffer size=%u, headroom buffer size=%u, internal buffers size=%u, spare buffer size=%u\n",
- port_buffer->port_buffer_size, port_buffer->headroom_size,
- port_buffer->internal_buffers_size,
- port_buffer->spare_buffer_size);
+ netdev_dbg(priv->netdev,
+ "total buffer size=%u, headroom buffer size=%u, internal buffers size=%u, spare buffer size=%u\n",
+ port_buffer->port_buffer_size, port_buffer->headroom_size,
+ port_buffer->internal_buffers_size,
+ port_buffer->spare_buffer_size);
out:
kfree(out);
return err;
@@ -352,7 +353,7 @@ static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu)
xoff = (301 + 216 * priv->dcbx.cable_len / 100) * speed / 1000 + 272 * mtu / 100;
- mlx5e_dbg(HW, priv, "%s: xoff=%d\n", __func__, xoff);
+ netdev_dbg(priv->netdev, "%s: xoff=%d\n", __func__, xoff);
return xoff;
}
@@ -484,6 +485,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
u8 *prio2buffer)
{
u16 port_buff_cell_sz = priv->dcbx.port_buff_cell_sz;
+ struct net_device *netdev = priv->netdev;
struct mlx5e_port_buffer port_buffer;
u32 xoff = calculate_xoff(priv, mtu);
bool update_prio2buffer = false;
@@ -495,7 +497,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
int err;
int i;
- mlx5e_dbg(HW, priv, "%s: change=%x\n", __func__, change);
+ netdev_dbg(netdev, "%s: change=%x\n", __func__, change);
max_mtu = max_t(unsigned int, priv->netdev->max_mtu, MINIMUM_MAX_MTU);
err = mlx5e_port_query_buffer(priv, &port_buffer);
@@ -510,8 +512,8 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
}
if (change & MLX5E_PORT_BUFFER_PFC) {
- mlx5e_dbg(HW, priv, "%s: requested PFC per priority bitmask: 0x%x\n",
- __func__, pfc->pfc_en);
+ netdev_dbg(netdev, "%s: requested PFC per priority bitmask: 0x%x\n",
+ __func__, pfc->pfc_en);
err = mlx5e_port_query_priority2buffer(priv->mdev, buffer);
if (err)
return err;
@@ -526,8 +528,8 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
if (change & MLX5E_PORT_BUFFER_PRIO2BUFFER) {
update_prio2buffer = true;
for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++)
- mlx5e_dbg(HW, priv, "%s: requested to map prio[%d] to buffer %d\n",
- __func__, i, prio2buffer[i]);
+ netdev_dbg(priv->netdev, "%s: requested to map prio[%d] to buffer %d\n",
+ __func__, i, prio2buffer[i]);
err = fill_pfc_en(priv->mdev, &curr_pfc_en);
if (err)
@@ -541,10 +543,10 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
if (change & MLX5E_PORT_BUFFER_SIZE) {
for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++) {
- mlx5e_dbg(HW, priv, "%s: buffer[%d]=%d\n", __func__, i, buffer_size[i]);
+ netdev_dbg(priv->netdev, "%s: buffer[%d]=%d\n", __func__, i, buffer_size[i]);
if (!port_buffer.buffer[i].lossy && !buffer_size[i]) {
- mlx5e_dbg(HW, priv, "%s: lossless buffer[%d] size cannot be zero\n",
- __func__, i);
+ netdev_dbg(priv->netdev, "%s: lossless buffer[%d] size cannot be zero\n",
+ __func__, i);
return -EINVAL;
}
@@ -552,7 +554,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
total_used += buffer_size[i];
}
- mlx5e_dbg(HW, priv, "%s: total buffer requested=%d\n", __func__, total_used);
+ netdev_dbg(priv->netdev, "%s: total buffer requested=%d\n", __func__, total_used);
if (total_used > port_buffer.headroom_size &&
(total_used - port_buffer.headroom_size) >
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
index ad51edf553185..16fade5b2d7ea 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
@@ -595,10 +595,10 @@ static struct mlx5_flow_handle *arfs_add_rule(struct mlx5e_priv *priv,
if (IS_ERR(rule)) {
err = PTR_ERR(rule);
priv->channel_stats[arfs_rule->rxq]->rq.arfs_err++;
- mlx5e_dbg(HW, priv,
- "%s: add rule(filter id=%d, rq idx=%d, ip proto=0x%x) failed,err=%d\n",
- __func__, arfs_rule->filter_id, arfs_rule->rxq,
- tuple->ip_proto, err);
+ netdev_dbg(priv->netdev,
+ "%s: add rule(filter id=%d, rq idx=%d, ip proto=0x%x) failed,err=%d\n",
+ __func__, arfs_rule->filter_id, arfs_rule->rxq,
+ tuple->ip_proto, err);
}
out:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index 55ceb6740291d..ca096d8bcca60 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -275,10 +275,10 @@ static int mlx5e_dcbnl_ieee_setets_core(struct mlx5e_priv *priv, struct ieee_ets
memcpy(priv->dcbx.tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa));
for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
- mlx5e_dbg(HW, priv, "%s: prio_%d <=> tc_%d\n",
- __func__, i, ets->prio_tc[i]);
- mlx5e_dbg(HW, priv, "%s: tc_%d <=> tx_bw_%d%%, group_%d\n",
- __func__, i, tc_tx_bw[i], tc_group[i]);
+ netdev_dbg(priv->netdev, "%s: prio_%d <=> tc_%d\n",
+ __func__, i, ets->prio_tc[i]);
+ netdev_dbg(priv->netdev, "%s: tc_%d <=> tx_bw_%d%%, group_%d\n",
+ __func__, i, tc_tx_bw[i], tc_group[i]);
}
return err;
@@ -399,9 +399,9 @@ static int mlx5e_dcbnl_ieee_setpfc(struct net_device *dev,
}
if (!ret) {
- mlx5e_dbg(HW, priv,
- "%s: PFC per priority bit mask: 0x%x\n",
- __func__, pfc->pfc_en);
+ netdev_dbg(dev,
+ "%s: PFC per priority bit mask: 0x%x\n",
+ __func__, pfc->pfc_en);
}
return ret;
}
@@ -620,8 +620,8 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev,
}
for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
- mlx5e_dbg(HW, priv, "%s: tc_%d <=> max_bw %d Gbps\n",
- __func__, i, max_bw_value[i]);
+ netdev_dbg(netdev, "%s: tc_%d <=> max_bw %d Gbps\n",
+ __func__, i, max_bw_value[i]);
}
return mlx5_modify_port_ets_rate_limit(mdev, max_bw_value, max_bw_unit);
@@ -649,10 +649,10 @@ static u8 mlx5e_dcbnl_setall(struct net_device *netdev)
ets.tc_rx_bw[i] = cee_cfg->pg_bw_pct[i];
ets.tc_tsa[i] = IEEE_8021QAZ_TSA_ETS;
ets.prio_tc[i] = cee_cfg->prio_to_pg_map[i];
- mlx5e_dbg(HW, priv,
- "%s: Priority group %d: tx_bw %d, rx_bw %d, prio_tc %d\n",
- __func__, i, ets.tc_tx_bw[i], ets.tc_rx_bw[i],
- ets.prio_tc[i]);
+ netdev_dbg(netdev,
+ "%s: Priority group %d: tx_bw %d, rx_bw %d, prio_tc %d\n",
+ __func__, i, ets.tc_tx_bw[i], ets.tc_rx_bw[i],
+ ets.prio_tc[i]);
}
err = mlx5e_dbcnl_validate_ets(netdev, &ets, true);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 8cb127a6fabfe..35f33feee4dec 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -1703,16 +1703,6 @@ static int mlx5e_set_fecparam(struct net_device *netdev,
return 0;
}
-static u32 mlx5e_get_msglevel(struct net_device *dev)
-{
- return ((struct mlx5e_priv *)netdev_priv(dev))->msglevel;
-}
-
-static void mlx5e_set_msglevel(struct net_device *dev, u32 val)
-{
- ((struct mlx5e_priv *)netdev_priv(dev))->msglevel = val;
-}
-
static int mlx5e_set_phys_id(struct net_device *dev,
enum ethtool_phys_id_state state)
{
@@ -1966,9 +1956,9 @@ int mlx5e_modify_rx_cqe_compression_locked(struct mlx5e_priv *priv, bool new_val
if (err)
return err;
- mlx5e_dbg(DRV, priv, "MLX5E: RxCqeCmprss was turned %s\n",
- MLX5E_GET_PFLAG(&priv->channels.params,
- MLX5E_PFLAG_RX_CQE_COMPRESS) ? "ON" : "OFF");
+ netdev_dbg(priv->netdev, "MLX5E: RxCqeCmprss was turned %s\n",
+ MLX5E_GET_PFLAG(&priv->channels.params,
+ MLX5E_PFLAG_RX_CQE_COMPRESS) ? "ON" : "OFF");
return 0;
}
@@ -2450,8 +2440,6 @@ const struct ethtool_ops mlx5e_ethtool_ops = {
.get_priv_flags = mlx5e_get_priv_flags,
.set_priv_flags = mlx5e_set_priv_flags,
.self_test = mlx5e_self_test,
- .get_msglevel = mlx5e_get_msglevel,
- .set_msglevel = mlx5e_set_msglevel,
.get_fec_stats = mlx5e_get_fec_stats,
.get_fecparam = mlx5e_get_fecparam,
.set_fecparam = mlx5e_set_fecparam,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 887d446354006..0c1f89196f6c1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -2339,7 +2339,7 @@ static int mlx5e_channel_stats_alloc(struct mlx5e_priv *priv, int ix, int cpu)
/* Asymmetric dynamic memory allocation.
* Freed in mlx5e_priv_arrays_free, not on channel closure.
*/
- mlx5e_dbg(DRV, priv, "Creating channel stats %d\n", ix);
+ netdev_dbg(priv->netdev, "Creating channel stats %d\n", ix);
priv->channel_stats[ix] = kvzalloc_node(sizeof(**priv->channel_stats),
GFP_KERNEL, cpu_to_node(cpu));
if (!priv->channel_stats[ix])
@@ -2714,7 +2714,7 @@ int mlx5e_update_tx_netdev_queues(struct mlx5e_priv *priv)
if (MLX5E_GET_PFLAG(&priv->channels.params, MLX5E_PFLAG_TX_PORT_TS))
num_txqs += ntc;
- mlx5e_dbg(DRV, priv, "Setting num_txqs %d\n", num_txqs);
+ netdev_dbg(priv->netdev, "Setting num_txqs %d\n", num_txqs);
err = netif_set_real_num_tx_queues(priv->netdev, num_txqs);
if (err)
netdev_warn(priv->netdev, "netif_set_real_num_tx_queues failed, %d\n", err);
@@ -5515,7 +5515,6 @@ int mlx5e_priv_init(struct mlx5e_priv *priv,
/* priv init */
priv->mdev = mdev;
priv->netdev = netdev;
- priv->msglevel = MLX5E_MSG_LEVEL;
priv->max_nch = nch;
priv->max_opened_tc = 1;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 373/568] net/mlx5e: Fix potentially misleading debug message
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (371 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 372/568] net/mlx5e: Remove mlx5e_dbg() and msglvl support Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 374/568] net_sched: limit try_bulk_dequeue_skb() batches Greg Kroah-Hartman
` (201 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gal Pressman, Nimrod Oren,
Tariq Toukan, Paolo Abeni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <gal@nvidia.com>
[ Upstream commit 9fcc2b6c10523f7e75db6387946c86fcf19dc97e ]
Change the debug message to print the correct units instead of always
assuming Gbps, as the value can be in either 100 Mbps or 1 Gbps units.
Fixes: 5da8bc3effb6 ("net/mlx5e: DCBNL, Add debug messages log")
Signed-off-by: Gal Pressman <gal@nvidia.com>
Reviewed-by: Nimrod Oren <noren@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/1762681073-1084058-6-git-send-email-tariqt@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index ca096d8bcca60..29e633e6dd3f0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -590,6 +590,19 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev,
__u64 upper_limit_mbps;
__u64 upper_limit_gbps;
int i;
+ struct {
+ int scale;
+ const char *units_str;
+ } units[] = {
+ [MLX5_100_MBPS_UNIT] = {
+ .scale = 100,
+ .units_str = "Mbps",
+ },
+ [MLX5_GBPS_UNIT] = {
+ .scale = 1,
+ .units_str = "Gbps",
+ },
+ };
memset(max_bw_value, 0, sizeof(max_bw_value));
memset(max_bw_unit, 0, sizeof(max_bw_unit));
@@ -620,8 +633,9 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev,
}
for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
- netdev_dbg(netdev, "%s: tc_%d <=> max_bw %d Gbps\n",
- __func__, i, max_bw_value[i]);
+ netdev_dbg(netdev, "%s: tc_%d <=> max_bw %u %s\n", __func__, i,
+ max_bw_value[i] * units[max_bw_unit[i]].scale,
+ units[max_bw_unit[i]].units_str);
}
return mlx5_modify_port_ets_rate_limit(mdev, max_bw_value, max_bw_unit);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 374/568] net_sched: limit try_bulk_dequeue_skb() batches
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (372 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 373/568] net/mlx5e: Fix potentially misleading debug message Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 375/568] hsr: Fix supervision frame sending on HSRv0 Greg Kroah-Hartman
` (200 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet,
Toke Høiland-Jørgensen, Jesper Dangaard Brouer,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 0345552a653ce5542affeb69ac5aa52177a5199b ]
After commit 100dfa74cad9 ("inet: dev_queue_xmit() llist adoption")
I started seeing many qdisc requeues on IDPF under high TX workload.
$ tc -s qd sh dev eth1 handle 1: ; sleep 1; tc -s qd sh dev eth1 handle 1:
qdisc mq 1: root
Sent 43534617319319 bytes 268186451819 pkt (dropped 0, overlimits 0 requeues 3532840114)
backlog 1056Kb 6675p requeues 3532840114
qdisc mq 1: root
Sent 43554665866695 bytes 268309964788 pkt (dropped 0, overlimits 0 requeues 3537737653)
backlog 781164b 4822p requeues 3537737653
This is caused by try_bulk_dequeue_skb() being only limited by BQL budget.
perf record -C120-239 -e qdisc:qdisc_dequeue sleep 1 ; perf script
...
netperf 75332 [146] 2711.138269: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1292 skbaddr=0xff378005a1e9f200
netperf 75332 [146] 2711.138953: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1213 skbaddr=0xff378004d607a500
netperf 75330 [144] 2711.139631: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1233 skbaddr=0xff3780046be20100
netperf 75333 [147] 2711.140356: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1093 skbaddr=0xff37800514845b00
netperf 75337 [151] 2711.141037: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1353 skbaddr=0xff37800460753300
netperf 75337 [151] 2711.141877: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1367 skbaddr=0xff378004e72c7b00
netperf 75330 [144] 2711.142643: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1202 skbaddr=0xff3780045bd60000
...
This is bad because :
1) Large batches hold one victim cpu for a very long time.
2) Driver often hit their own TX ring limit (all slots are used).
3) We call dev_requeue_skb()
4) Requeues are using a FIFO (q->gso_skb), breaking qdisc ability to
implement FQ or priority scheduling.
5) dequeue_skb() gets packets from q->gso_skb one skb at a time
with no xmit_more support. This is causing many spinlock games
between the qdisc and the device driver.
Requeues were supposed to be very rare, lets keep them this way.
Limit batch sizes to /proc/sys/net/core/dev_weight (default 64) as
__qdisc_run() was designed to use.
Fixes: 5772e9a3463b ("qdisc: bulk dequeue support for qdiscs with TCQ_F_ONETXQUEUE")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Acked-by: Jesper Dangaard Brouer <hawk@kernel.org>
Link: https://patch.msgid.link/20251109161215.2574081-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_generic.c | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index b51af871a621c..1b51b3038b4bd 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -178,9 +178,10 @@ static inline void dev_requeue_skb(struct sk_buff *skb, struct Qdisc *q)
static void try_bulk_dequeue_skb(struct Qdisc *q,
struct sk_buff *skb,
const struct netdev_queue *txq,
- int *packets)
+ int *packets, int budget)
{
int bytelimit = qdisc_avail_bulklimit(txq) - skb->len;
+ int cnt = 0;
while (bytelimit > 0) {
struct sk_buff *nskb = q->dequeue(q);
@@ -191,8 +192,10 @@ static void try_bulk_dequeue_skb(struct Qdisc *q,
bytelimit -= nskb->len; /* covers GSO len */
skb->next = nskb;
skb = nskb;
- (*packets)++; /* GSO counts as one pkt */
+ if (++cnt >= budget)
+ break;
}
+ (*packets) += cnt;
skb_mark_not_on_list(skb);
}
@@ -226,7 +229,7 @@ static void try_bulk_dequeue_skb_slow(struct Qdisc *q,
* A requeued skb (via q->gso_skb) can also be a SKB list.
*/
static struct sk_buff *dequeue_skb(struct Qdisc *q, bool *validate,
- int *packets)
+ int *packets, int budget)
{
const struct netdev_queue *txq = q->dev_queue;
struct sk_buff *skb = NULL;
@@ -293,7 +296,7 @@ static struct sk_buff *dequeue_skb(struct Qdisc *q, bool *validate,
if (skb) {
bulk:
if (qdisc_may_bulk(q))
- try_bulk_dequeue_skb(q, skb, txq, packets);
+ try_bulk_dequeue_skb(q, skb, txq, packets, budget);
else
try_bulk_dequeue_skb_slow(q, skb, packets);
}
@@ -385,7 +388,7 @@ bool sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q,
* >0 - queue is not empty.
*
*/
-static inline bool qdisc_restart(struct Qdisc *q, int *packets)
+static inline bool qdisc_restart(struct Qdisc *q, int *packets, int budget)
{
spinlock_t *root_lock = NULL;
struct netdev_queue *txq;
@@ -394,7 +397,7 @@ static inline bool qdisc_restart(struct Qdisc *q, int *packets)
bool validate;
/* Dequeue packet */
- skb = dequeue_skb(q, &validate, packets);
+ skb = dequeue_skb(q, &validate, packets, budget);
if (unlikely(!skb))
return false;
@@ -412,7 +415,7 @@ void __qdisc_run(struct Qdisc *q)
int quota = READ_ONCE(dev_tx_weight);
int packets;
- while (qdisc_restart(q, &packets)) {
+ while (qdisc_restart(q, &packets, quota)) {
quota -= packets;
if (quota <= 0) {
if (q->flags & TCQ_F_NOLOCK)
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 375/568] hsr: Fix supervision frame sending on HSRv0
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (373 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 374/568] net_sched: limit try_bulk_dequeue_skb() batches Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 376/568] ACPI: CPPC: Check _CPC validity for only the online CPUs Greg Kroah-Hartman
` (199 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hangbin Liu, Felix Maurer,
Sebastian Andrzej Siewior, Paolo Abeni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Maurer <fmaurer@redhat.com>
[ Upstream commit 96a3a03abf3d8cc38cd9cb0d280235fbcf7c3f7f ]
On HSRv0, no supervision frames were sent. The supervison frames were
generated successfully, but failed the check for a sufficiently long mac
header, i.e., at least sizeof(struct hsr_ethhdr), in hsr_fill_frame_info()
because the mac header only contained the ethernet header.
Fix this by including the HSR header in the mac header when generating HSR
supervision frames. Note that the mac header now also includes the TLV
fields. This matches how we set the headers on rx and also the size of
struct hsrv0_ethhdr_sp.
Reported-by: Hangbin Liu <liuhangbin@gmail.com>
Closes: https://lore.kernel.org/netdev/aMONxDXkzBZZRfE5@fedora/
Fixes: 9cfb5e7f0ded ("net: hsr: fix hsr_init_sk() vs network/transport headers.")
Signed-off-by: Felix Maurer <fmaurer@redhat.com>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://patch.msgid.link/4354114fea9a642fe71f49aeeb6c6159d1d61840.1762876095.git.fmaurer@redhat.com
Tested-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/hsr/hsr_device.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
index 0b23d52b8d87a..81eaae4c19da1 100644
--- a/net/hsr/hsr_device.c
+++ b/net/hsr/hsr_device.c
@@ -313,6 +313,9 @@ static void send_hsr_supervision_frame(struct hsr_port *master,
}
hsr_stag = skb_put(skb, sizeof(struct hsr_sup_tag));
+ skb_set_network_header(skb, ETH_HLEN + HSR_HLEN);
+ skb_reset_mac_len(skb);
+
set_hsr_stag_path(hsr_stag, (hsr->prot_version ? 0x0 : 0xf));
set_hsr_stag_HSR_ver(hsr_stag, hsr->prot_version);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 376/568] ACPI: CPPC: Check _CPC validity for only the online CPUs
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (374 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 375/568] hsr: Fix supervision frame sending on HSRv0 Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 377/568] ACPI: CPPC: Perform fast check switch only for " Greg Kroah-Hartman
` (198 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christopher Harris,
Mario Limonciello, Mario Limonciello (AMD) (kernel.org),
Gautham R. Shenoy, Rafael J. Wysocki, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gautham R. Shenoy <gautham.shenoy@amd.com>
[ Upstream commit 6dd3b8a709a130a4d55c866af9804c81b8486d28 ]
per_cpu(cpc_desc_ptr, cpu) object is initialized for only the online
CPUs via acpi_soft_cpu_online() --> __acpi_processor_start() -->
acpi_cppc_processor_probe().
However the function acpi_cpc_valid() checks for the validity of the
_CPC object for all the present CPUs. This breaks when the kernel is
booted with "nosmt=force".
Hence check the validity of the _CPC objects of only the online CPUs.
Fixes: 2aeca6bd0277 ("ACPI: CPPC: Check present CPUs for determining _CPC is valid")
Reported-by: Christopher Harris <chris.harris79@gmail.com>
Closes: https://lore.kernel.org/lkml/CAM+eXpdDT7KjLV0AxEwOLkSJ2QtrsvGvjA2cCHvt1d0k2_C4Cw@mail.gmail.com/
Suggested-by: Mario Limonciello <mario.limonciello@amd.com>
Reviewed-by: "Mario Limonciello (AMD) (kernel.org)" <superm1@kernel.org>
Tested-by: Chrisopher Harris <chris.harris79@gmail.com>
Signed-off-by: Gautham R. Shenoy <gautham.shenoy@amd.com>
Link: https://patch.msgid.link/20251107074145.2340-3-gautham.shenoy@amd.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/cppc_acpi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
index 504fe14c566e3..6d89299af3bbe 100644
--- a/drivers/acpi/cppc_acpi.c
+++ b/drivers/acpi/cppc_acpi.c
@@ -440,7 +440,7 @@ bool acpi_cpc_valid(void)
if (acpi_disabled)
return false;
- for_each_present_cpu(cpu) {
+ for_each_online_cpu(cpu) {
cpc_ptr = per_cpu(cpc_desc_ptr, cpu);
if (!cpc_ptr)
return false;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 377/568] ACPI: CPPC: Perform fast check switch only for online CPUs
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (375 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 376/568] ACPI: CPPC: Check _CPC validity for only the online CPUs Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 378/568] ACPI: CPPC: Limit perf ctrs in PCC check only to " Greg Kroah-Hartman
` (197 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello (AMD) (kernel.org),
Gautham R. Shenoy, Rafael J. Wysocki, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gautham R. Shenoy <gautham.shenoy@amd.com>
[ Upstream commit 8821c8e80a65bc4eb73daf63b34aac6b8ad69461 ]
per_cpu(cpc_desc_ptr, cpu) object is initialized for only the online
CPUs via acpi_soft_cpu_online() --> __acpi_processor_start() -->
acpi_cppc_processor_probe().
However the function cppc_allow_fast_switch() checks for the validity
of the _CPC object for all the present CPUs. This breaks when the
kernel is booted with "nosmt=force".
Check fast_switch capability only on online CPUs
Fixes: 15eece6c5b05 ("ACPI: CPPC: Fix NULL pointer dereference when nosmp is used")
Reviewed-by: "Mario Limonciello (AMD) (kernel.org)" <superm1@kernel.org>
Signed-off-by: Gautham R. Shenoy <gautham.shenoy@amd.com>
Link: https://patch.msgid.link/20251107074145.2340-4-gautham.shenoy@amd.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/cppc_acpi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
index 6d89299af3bbe..3aa4c489ca5bc 100644
--- a/drivers/acpi/cppc_acpi.c
+++ b/drivers/acpi/cppc_acpi.c
@@ -456,7 +456,7 @@ bool cppc_allow_fast_switch(void)
struct cpc_desc *cpc_ptr;
int cpu;
- for_each_present_cpu(cpu) {
+ for_each_online_cpu(cpu) {
cpc_ptr = per_cpu(cpc_desc_ptr, cpu);
desired_reg = &cpc_ptr->cpc_regs[DESIRED_PERF];
if (!CPC_IN_SYSTEM_MEMORY(desired_reg) &&
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 378/568] ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (376 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 377/568] ACPI: CPPC: Perform fast check switch only for " Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 379/568] Bluetooth: L2CAP: export l2cap_chan_hold for modules Greg Kroah-Hartman
` (196 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello (AMD) (kernel.org),
Gautham R. Shenoy, Rafael J. Wysocki, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gautham R. Shenoy <gautham.shenoy@amd.com>
[ Upstream commit 0fce75870666b46b700cfbd3216380b422f975da ]
per_cpu(cpc_desc_ptr, cpu) object is initialized for only the online
CPU via acpi_soft_cpu_online() --> __acpi_processor_start() -->
acpi_cppc_processor_probe().
However the function cppc_perf_ctrs_in_pcc() checks if the CPPC
perf-ctrs are in a PCC region for all the present CPUs, which breaks
when the kernel is booted with "nosmt=force".
Hence, limit the check only to the online CPUs.
Fixes: ae2df912d1a5 ("ACPI: CPPC: Disable FIE if registers in PCC regions")
Reviewed-by: "Mario Limonciello (AMD) (kernel.org)" <superm1@kernel.org>
Signed-off-by: Gautham R. Shenoy <gautham.shenoy@amd.com>
Link: https://patch.msgid.link/20251107074145.2340-5-gautham.shenoy@amd.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/cppc_acpi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
index 3aa4c489ca5bc..27729a1f34cb0 100644
--- a/drivers/acpi/cppc_acpi.c
+++ b/drivers/acpi/cppc_acpi.c
@@ -1336,7 +1336,7 @@ bool cppc_perf_ctrs_in_pcc(void)
{
int cpu;
- for_each_present_cpu(cpu) {
+ for_each_online_cpu(cpu) {
struct cpc_register_resource *ref_perf_reg;
struct cpc_desc *cpc_desc;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 379/568] Bluetooth: L2CAP: export l2cap_chan_hold for modules
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (377 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 378/568] ACPI: CPPC: Limit perf ctrs in PCC check only to " Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 380/568] acpi,srat: Fix incorrect device handle check for Generic Initiator Greg Kroah-Hartman
` (195 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pauli Virtanen, Paul Menzel,
Luiz Augusto von Dentz, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <pav@iki.fi>
[ Upstream commit e060088db0bdf7932e0e3c2d24b7371c4c5b867c ]
l2cap_chan_put() is exported, so export also l2cap_chan_hold() for
modules.
l2cap_chan_hold() has use case in net/bluetooth/6lowpan.c
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 8bb6d2690e2b9..ea82a468b314a 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -521,6 +521,7 @@ void l2cap_chan_hold(struct l2cap_chan *c)
kref_get(&c->kref);
}
+EXPORT_SYMBOL_GPL(l2cap_chan_hold);
struct l2cap_chan *l2cap_chan_hold_unless_zero(struct l2cap_chan *c)
{
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 380/568] acpi,srat: Fix incorrect device handle check for Generic Initiator
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (378 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 379/568] Bluetooth: L2CAP: export l2cap_chan_hold for modules Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 381/568] regulator: fixed: fix GPIO descriptor leak on register failure Greg Kroah-Hartman
` (194 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wu Zongyong, Shuai Xue,
Jonathan Cameron, Dave Jiang, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <xueshuai@linux.alibaba.com>
[ Upstream commit 7c3643f204edf1c5edb12b36b34838683ee5f8dc ]
The Generic Initiator Affinity Structure in SRAT table uses device
handle type field to indicate the device type. According to ACPI
specification, the device handle type value of 1 represents PCI device,
not 0.
Fixes: 894c26a1c274 ("ACPI: Support Generic Initiator only domains")
Reported-by: Wu Zongyong <wuzongyong@linux.alibaba.com>
Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20250913023224.39281-1-xueshuai@linux.alibaba.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/numa/srat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/numa/srat.c b/drivers/acpi/numa/srat.c
index a44c0761fd1c0..848942bf883cb 100644
--- a/drivers/acpi/numa/srat.c
+++ b/drivers/acpi/numa/srat.c
@@ -140,7 +140,7 @@ acpi_table_print_srat_entry(struct acpi_subtable_header *header)
struct acpi_srat_generic_affinity *p =
(struct acpi_srat_generic_affinity *)header;
- if (p->device_handle_type == 0) {
+ if (p->device_handle_type == 1) {
/*
* For pci devices this may be the only place they
* are assigned a proximity domain
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 381/568] regulator: fixed: fix GPIO descriptor leak on register failure
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (379 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 380/568] acpi,srat: Fix incorrect device handle check for Generic Initiator Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 382/568] ASoC: cs4271: Fix regulator leak on probe failure Greg Kroah-Hartman
` (193 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Mark Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 636f4618b1cd96f6b5a2b8c7c4f665c8533ecf13 ]
In the commit referenced by the Fixes tag,
devm_gpiod_get_optional() was replaced by manual
GPIO management, relying on the regulator core to release the
GPIO descriptor. However, this approach does not account for the
error path: when regulator registration fails, the core never
takes over the GPIO, resulting in a resource leak.
Add gpiod_put() before returning on regulator registration failure.
Fixes: 5e6f3ae5c13b ("regulator: fixed: Let core handle GPIO descriptor")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20251028172828.625-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/fixed.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c
index e6724a229d237..e273275e60259 100644
--- a/drivers/regulator/fixed.c
+++ b/drivers/regulator/fixed.c
@@ -287,6 +287,7 @@ static int reg_fixed_voltage_probe(struct platform_device *pdev)
ret = dev_err_probe(&pdev->dev, PTR_ERR(drvdata->dev),
"Failed to register regulator: %ld\n",
PTR_ERR(drvdata->dev));
+ gpiod_put(cfg.ena_gpiod);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 382/568] ASoC: cs4271: Fix regulator leak on probe failure
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (380 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 381/568] regulator: fixed: fix GPIO descriptor leak on register failure Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 383/568] ASoC: codecs: va-macro: fix resource leak in probe error path Greg Kroah-Hartman
` (192 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Charles Keepax,
Mark Brown, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 6b6eddc63ce871897d3a5bc4f8f593e698aef104 ]
The probe function enables regulators at the beginning
but fails to disable them in its error handling path.
If any operation after enabling the regulators fails,
the probe will exit with an error, leaving the regulators
permanently enabled, which could lead to a resource leak.
Add a proper error handling path to call regulator_bulk_disable()
before returning an error.
Fixes: 9a397f473657 ("ASoC: cs4271: add regulator consumer support")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20251105062246.1955-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/cs4271.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
index 2021cf4426061..f6c9430612f53 100644
--- a/sound/soc/codecs/cs4271.c
+++ b/sound/soc/codecs/cs4271.c
@@ -594,17 +594,17 @@ static int cs4271_component_probe(struct snd_soc_component *component)
ret = regcache_sync(cs4271->regmap);
if (ret < 0)
- return ret;
+ goto err_disable_regulator;
ret = regmap_update_bits(cs4271->regmap, CS4271_MODE2,
CS4271_MODE2_PDN | CS4271_MODE2_CPEN,
CS4271_MODE2_PDN | CS4271_MODE2_CPEN);
if (ret < 0)
- return ret;
+ goto err_disable_regulator;
ret = regmap_update_bits(cs4271->regmap, CS4271_MODE2,
CS4271_MODE2_PDN, 0);
if (ret < 0)
- return ret;
+ goto err_disable_regulator;
/* Power-up sequence requires 85 uS */
udelay(85);
@@ -614,6 +614,10 @@ static int cs4271_component_probe(struct snd_soc_component *component)
CS4271_MODE2_MUTECAEQUB);
return 0;
+
+err_disable_regulator:
+ regulator_bulk_disable(ARRAY_SIZE(cs4271->supplies), cs4271->supplies);
+ return ret;
}
static void cs4271_component_remove(struct snd_soc_component *component)
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 383/568] ASoC: codecs: va-macro: fix resource leak in probe error path
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (381 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 382/568] ASoC: cs4271: Fix regulator leak on probe failure Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 384/568] drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE Greg Kroah-Hartman
` (191 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Haotian Zhang,
Mark Brown, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 3dc8c73365d3ca25c99e7e1a0f493039d7291df5 ]
In the commit referenced by the Fixes tag, clk_hw_get_clk()
was added in va_macro_probe() to get the fsgen clock,
but forgot to add the corresponding clk_put() in va_macro_remove().
This leads to a clock reference leak when the driver is unloaded.
Switch to devm_clk_hw_get_clk() to automatically manage the
clock resource.
Fixes: 30097967e056 ("ASoC: codecs: va-macro: use fsgen as clock")
Suggested-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20251106143114.729-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/lpass-va-macro.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/codecs/lpass-va-macro.c b/sound/soc/codecs/lpass-va-macro.c
index 1623ba78ddb3d..1f6e27d6a2276 100644
--- a/sound/soc/codecs/lpass-va-macro.c
+++ b/sound/soc/codecs/lpass-va-macro.c
@@ -1554,7 +1554,7 @@ static int va_macro_probe(struct platform_device *pdev)
if (ret)
goto err_clkout;
- va->fsgen = clk_hw_get_clk(&va->hw, "fsgen");
+ va->fsgen = devm_clk_hw_get_clk(dev, &va->hw, "fsgen");
if (IS_ERR(va->fsgen)) {
ret = PTR_ERR(va->fsgen);
goto err_clkout;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 384/568] drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (382 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 383/568] ASoC: codecs: va-macro: fix resource leak in probe error path Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 385/568] NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() Greg Kroah-Hartman
` (190 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rohit Keshri, Ian Forbes,
Maaz Mombasawala, Zack Rusin, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <ian.forbes@broadcom.com>
[ Upstream commit 32b415a9dc2c212e809b7ebc2b14bc3fbda2b9af ]
This data originates from userspace and is used in buffer offset
calculations which could potentially overflow causing an out-of-bounds
access.
Fixes: 8ce75f8ab904 ("drm/vmwgfx: Update device includes for DX device functionality")
Reported-by: Rohit Keshri <rkeshri@redhat.com>
Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
Reviewed-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Link: https://patch.msgid.link/20251021190128.13014-1-ian.forbes@broadcom.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 0d12d6af67c09..247ef293bf845 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -3669,6 +3669,11 @@ static int vmw_cmd_check(struct vmw_private *dev_priv,
cmd_id = header->id;
+ if (header->size > SVGA_CMD_MAX_DATASIZE) {
+ VMW_DEBUG_USER("SVGA3D command: %d is too big.\n",
+ cmd_id + SVGA_3D_CMD_BASE);
+ return -E2BIG;
+ }
*size = header->size + sizeof(SVGA3dCmdHeader);
cmd_id -= SVGA_3D_CMD_BASE;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 385/568] NFSv4: Fix an incorrect parameter when calling nfs4_call_sync()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (383 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 384/568] drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 386/568] ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd Greg Kroah-Hartman
` (189 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Harshit Mogalapalli,
Trond Myklebust, Anna Schumaker, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@hammerspace.com>
[ Upstream commit 1f214e9c3aef2d0936be971072e991d78a174d71 ]
The Smatch static checker noted that in _nfs4_proc_lookupp(), the flag
RPC_TASK_TIMEOUT is being passed as an argument to nfs4_init_sequence(),
which is clearly incorrect.
Since LOOKUPP is an idempotent operation, nfs4_init_sequence() should
not ask the server to cache the result. The RPC_TASK_TIMEOUT flag needs
to be passed down to the RPC layer.
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Reported-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Fixes: 76998ebb9158 ("NFSv4: Observe the NFS_MOUNT_SOFTREVAL flag in _nfs4_proc_lookupp")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs4proc.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index f387a3862ca09..d4ae2ce56af4a 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -4584,16 +4584,19 @@ static int _nfs4_proc_lookupp(struct inode *inode,
};
unsigned short task_flags = 0;
- if (NFS_SERVER(inode)->flags & NFS_MOUNT_SOFTREVAL)
+ if (server->flags & NFS_MOUNT_SOFTREVAL)
task_flags |= RPC_TASK_TIMEOUT;
+ if (server->caps & NFS_CAP_MOVEABLE)
+ task_flags |= RPC_TASK_MOVEABLE;
args.bitmask = nfs4_bitmask(server, fattr->label);
nfs_fattr_init(fattr);
+ nfs4_init_sequence(&args.seq_args, &res.seq_res, 0, 0);
dprintk("NFS call lookupp ino=0x%lx\n", inode->i_ino);
- status = nfs4_call_sync(clnt, server, &msg, &args.seq_args,
- &res.seq_res, task_flags);
+ status = nfs4_do_call_sync(clnt, server, &msg, &args.seq_args,
+ &res.seq_res, task_flags);
dprintk("NFS reply lookupp: %d\n", status);
return status;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 386/568] ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (384 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 385/568] NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 387/568] bpf: Add bpf_prog_run_data_pointers() Greg Kroah-Hartman
` (188 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haein Lee, Takashi Iwai, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haein Lee <lhi0729@kaist.ac.kr>
[ Upstream commit 632108ec072ad64c8c83db6e16a7efee29ebfb74 ]
In snd_usb_create_streams(), for UAC version 3 devices, the Interface
Association Descriptor (IAD) is retrieved via usb_ifnum_to_if(). If this
call fails, a fallback routine attempts to obtain the IAD from the next
interface and sets a BADD profile. However, snd_usb_mixer_controls_badd()
assumes that the IAD retrieved from usb_ifnum_to_if() is always valid,
without performing a NULL check. This can lead to a NULL pointer
dereference when usb_ifnum_to_if() fails to find the interface descriptor.
This patch adds a NULL pointer check after calling usb_ifnum_to_if() in
snd_usb_mixer_controls_badd() to prevent the dereference.
This issue was discovered by syzkaller, which triggered the bug by sending
a crafted USB device descriptor.
Fixes: 17156f23e93c ("ALSA: usb: add UAC3 BADD profiles support")
Signed-off-by: Haein Lee <lhi0729@kaist.ac.kr>
Link: https://patch.msgid.link/vwhzmoba9j2f.vwhzmob9u9e2.g6@dooray.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index d258c7324fcc7..9b34004e67131 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -3081,6 +3081,8 @@ static int snd_usb_mixer_controls_badd(struct usb_mixer_interface *mixer,
int i;
assoc = usb_ifnum_to_if(dev, ctrlif)->intf_assoc;
+ if (!assoc)
+ return -EINVAL;
/* Detect BADD capture/playback channels from AS EP descriptors */
for (i = 0; i < assoc->bInterfaceCount; i++) {
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 387/568] bpf: Add bpf_prog_run_data_pointers()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (385 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 386/568] ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 388/568] softirq: Add trace points for tasklet entry/exit Greg Kroah-Hartman
` (187 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet,
Martin KaFai Lau, Victor Nogueira, Jamal Hadi Salim, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 4ef92743625818932b9c320152b58274c05e5053 ]
syzbot found that cls_bpf_classify() is able to change
tc_skb_cb(skb)->drop_reason triggering a warning in sk_skb_reason_drop().
WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_reason_drop net/core/skbuff.c:1189 [inline]
WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 sk_skb_reason_drop+0x76/0x170 net/core/skbuff.c:1214
struct tc_skb_cb has been added in commit ec624fe740b4 ("net/sched:
Extend qdisc control block with tc control block"), which added a wrong
interaction with db58ba459202 ("bpf: wire in data and data_end for
cls_act_bpf").
drop_reason was added later.
Add bpf_prog_run_data_pointers() helper to save/restore the net_sched
storage colliding with BPF data_meta/data_end.
Fixes: ec624fe740b4 ("net/sched: Extend qdisc control block with tc control block")
Reported-by: syzbot <syzkaller@googlegroups.com>
Closes: https://lore.kernel.org/netdev/6913437c.a70a0220.22f260.013b.GAE@google.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20251112125516.1563021-1-edumazet@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/filter.h | 20 ++++++++++++++++++++
net/sched/act_bpf.c | 6 ++----
net/sched/cls_bpf.c | 6 ++----
3 files changed, 24 insertions(+), 8 deletions(-)
diff --git a/include/linux/filter.h b/include/linux/filter.h
index bbdae97d50c42..502cab01e9e97 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -676,6 +676,26 @@ static inline void bpf_compute_data_pointers(struct sk_buff *skb)
cb->data_end = skb->data + skb_headlen(skb);
}
+static inline int bpf_prog_run_data_pointers(
+ const struct bpf_prog *prog,
+ struct sk_buff *skb)
+{
+ struct bpf_skb_data_end *cb = (struct bpf_skb_data_end *)skb->cb;
+ void *save_data_meta, *save_data_end;
+ int res;
+
+ save_data_meta = cb->data_meta;
+ save_data_end = cb->data_end;
+
+ bpf_compute_data_pointers(skb);
+ res = bpf_prog_run(prog, skb);
+
+ cb->data_meta = save_data_meta;
+ cb->data_end = save_data_end;
+
+ return res;
+}
+
/* Similar to bpf_compute_data_pointers(), except that save orginal
* data in cb->data and cb->meta_data for restore.
*/
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index b79eee44e24eb..e33a6be877def 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -45,12 +45,10 @@ static int tcf_bpf_act(struct sk_buff *skb, const struct tc_action *act,
filter = rcu_dereference(prog->filter);
if (at_ingress) {
__skb_push(skb, skb->mac_len);
- bpf_compute_data_pointers(skb);
- filter_res = bpf_prog_run(filter, skb);
+ filter_res = bpf_prog_run_data_pointers(filter, skb);
__skb_pull(skb, skb->mac_len);
} else {
- bpf_compute_data_pointers(skb);
- filter_res = bpf_prog_run(filter, skb);
+ filter_res = bpf_prog_run_data_pointers(filter, skb);
}
if (unlikely(!skb->tstamp && skb->mono_delivery_time))
skb->mono_delivery_time = 0;
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index 0320e11eb248b..5820ee95fa36e 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -95,12 +95,10 @@ static int cls_bpf_classify(struct sk_buff *skb, const struct tcf_proto *tp,
} else if (at_ingress) {
/* It is safe to push/pull even if skb_shared() */
__skb_push(skb, skb->mac_len);
- bpf_compute_data_pointers(skb);
- filter_res = bpf_prog_run(prog->filter, skb);
+ filter_res = bpf_prog_run_data_pointers(prog->filter, skb);
__skb_pull(skb, skb->mac_len);
} else {
- bpf_compute_data_pointers(skb);
- filter_res = bpf_prog_run(prog->filter, skb);
+ filter_res = bpf_prog_run_data_pointers(prog->filter, skb);
}
if (unlikely(!skb->tstamp && skb->mono_delivery_time))
skb->mono_delivery_time = 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 388/568] softirq: Add trace points for tasklet entry/exit
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (386 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 387/568] bpf: Add bpf_prog_run_data_pointers() Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 389/568] Bluetooth: hci_sync: fix double free in hci_discovery_filter_clear() Greg Kroah-Hartman
` (186 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lingutla Chandrasekhar, J. Avila,
John Stultz, Thomas Gleixner, Steven Rostedt (Google),
Sumanth Gavini, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumanth Gavini <sumanth.gavini@yahoo.com>
commit f4bf3ca2e5cba655824b6e0893a98dfb33ed24e5 upstream.
Tasklets are supposed to finish their work quickly and should not block the
current running process, but it is not guaranteed that they do so.
Currently softirq_entry/exit can be used to analyse the total tasklets
execution time, but that's not helpful to track individual tasklets
execution time. That makes it hard to identify tasklet functions, which
take more time than expected.
Add tasklet_entry/exit trace point support to track individual tasklet
execution.
Trivial usage example:
# echo 1 > /sys/kernel/debug/tracing/events/irq/tasklet_entry/enable
# echo 1 > /sys/kernel/debug/tracing/events/irq/tasklet_exit/enable
# cat /sys/kernel/debug/tracing/trace
# tracer: nop
#
# entries-in-buffer/entries-written: 4/4 #P:4
#
# _-----=> irqs-off/BH-disabled
# / _----=> need-resched
# | / _---=> hardirq/softirq
# || / _--=> preempt-depth
# ||| / _-=> migrate-disable
# |||| / delay
# TASK-PID CPU# ||||| TIMESTAMP FUNCTION
# | | | ||||| | |
<idle>-0 [003] ..s1. 314.011428: tasklet_entry: tasklet=0xffffa01ef8db2740 function=tcp_tasklet_func
<idle>-0 [003] ..s1. 314.011432: tasklet_exit: tasklet=0xffffa01ef8db2740 function=tcp_tasklet_func
<idle>-0 [003] ..s1. 314.017369: tasklet_entry: tasklet=0xffffa01ef8db2740 function=tcp_tasklet_func
<idle>-0 [003] ..s1. 314.017371: tasklet_exit: tasklet=0xffffa01ef8db2740 function=tcp_tasklet_func
Signed-off-by: Lingutla Chandrasekhar <clingutla@codeaurora.org>
Signed-off-by: J. Avila <elavila@google.com>
Signed-off-by: John Stultz <jstultz@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Link: https://lore.kernel.org/r/20230407230526.1685443-1-jstultz@google.com
[elavila: Port to android-mainline]
[jstultz: Rebased to upstream, cut unused trace points, added
comments for the tracepoints, reworded commit]
The intention is to keep the stable branch in sync with upstream fixes
and improve observability without introducing new functionality.
Signed-off-by: Sumanth Gavini <sumanth.gavini@yahoo.com>
Changes in V2:
- No code changes
- Link to V1: https://lore.kernel.org/all/20250812161755.609600-1-sumanth.gavini@yahoo.com/
- Updated the comment msg before the signed-off-by
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/trace/events/irq.h | 47 ++++++++++++++++++++++++++++++++++++++
kernel/softirq.c | 9 ++++++--
2 files changed, 54 insertions(+), 2 deletions(-)
diff --git a/include/trace/events/irq.h b/include/trace/events/irq.h
index eeceafaaea4c1..a07b4607b6635 100644
--- a/include/trace/events/irq.h
+++ b/include/trace/events/irq.h
@@ -160,6 +160,53 @@ DEFINE_EVENT(softirq, softirq_raise,
TP_ARGS(vec_nr)
);
+DECLARE_EVENT_CLASS(tasklet,
+
+ TP_PROTO(struct tasklet_struct *t, void *func),
+
+ TP_ARGS(t, func),
+
+ TP_STRUCT__entry(
+ __field( void *, tasklet)
+ __field( void *, func)
+ ),
+
+ TP_fast_assign(
+ __entry->tasklet = t;
+ __entry->func = func;
+ ),
+
+ TP_printk("tasklet=%ps function=%ps", __entry->tasklet, __entry->func)
+);
+
+/**
+ * tasklet_entry - called immediately before the tasklet is run
+ * @t: tasklet pointer
+ * @func: tasklet callback or function being run
+ *
+ * Used to find individual tasklet execution time
+ */
+DEFINE_EVENT(tasklet, tasklet_entry,
+
+ TP_PROTO(struct tasklet_struct *t, void *func),
+
+ TP_ARGS(t, func)
+);
+
+/**
+ * tasklet_exit - called immediately after the tasklet is run
+ * @t: tasklet pointer
+ * @func: tasklet callback or function being run
+ *
+ * Used to find individual tasklet execution time
+ */
+DEFINE_EVENT(tasklet, tasklet_exit,
+
+ TP_PROTO(struct tasklet_struct *t, void *func),
+
+ TP_ARGS(t, func)
+);
+
#endif /* _TRACE_IRQ_H */
/* This part must be outside protection */
diff --git a/kernel/softirq.c b/kernel/softirq.c
index 9ab5ca399a990..fadc6bbda27b1 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -822,10 +822,15 @@ static void tasklet_action_common(struct softirq_action *a,
if (tasklet_trylock(t)) {
if (!atomic_read(&t->count)) {
if (tasklet_clear_sched(t)) {
- if (t->use_callback)
+ if (t->use_callback) {
+ trace_tasklet_entry(t, t->callback);
t->callback(t);
- else
+ trace_tasklet_exit(t, t->callback);
+ } else {
+ trace_tasklet_entry(t, t->func);
t->func(t->data);
+ trace_tasklet_exit(t, t->func);
+ }
}
tasklet_unlock(t);
continue;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 389/568] Bluetooth: hci_sync: fix double free in hci_discovery_filter_clear()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (387 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 388/568] softirq: Add trace points for tasklet entry/exit Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 390/568] espintcp: fix skb leaks Greg Kroah-Hartman
` (185 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arseniy Krasnov,
Luiz Augusto von Dentz, Alva Lan, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arseniy Krasnov <avkrasnov@salutedevices.com>
[ Upstream commit 2935e556850e9c94d7a00adf14d3cd7fe406ac03 ]
Function 'hci_discovery_filter_clear()' frees 'uuids' array and then
sets it to NULL. There is a tiny chance of the following race:
'hci_cmd_sync_work()'
'update_passive_scan_sync()'
'hci_update_passive_scan_sync()'
'hci_discovery_filter_clear()'
kfree(uuids);
<-------------------------preempted-------------------------------->
'start_service_discovery()'
'hci_discovery_filter_clear()'
kfree(uuids); // DOUBLE FREE
<-------------------------preempted-------------------------------->
uuids = NULL;
To fix it let's add locking around 'kfree()' call and NULL pointer
assignment. Otherwise the following backtrace fires:
[ ] ------------[ cut here ]------------
[ ] kernel BUG at mm/slub.c:547!
[ ] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
[ ] CPU: 3 UID: 0 PID: 246 Comm: bluetoothd Tainted: G O 6.12.19-kernel #1
[ ] Tainted: [O]=OOT_MODULE
[ ] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ ] pc : __slab_free+0xf8/0x348
[ ] lr : __slab_free+0x48/0x348
...
[ ] Call trace:
[ ] __slab_free+0xf8/0x348
[ ] kfree+0x164/0x27c
[ ] start_service_discovery+0x1d0/0x2c0
[ ] hci_sock_sendmsg+0x518/0x924
[ ] __sock_sendmsg+0x54/0x60
[ ] sock_write_iter+0x98/0xf8
[ ] do_iter_readv_writev+0xe4/0x1c8
[ ] vfs_writev+0x128/0x2b0
[ ] do_writev+0xfc/0x118
[ ] __arm64_sys_writev+0x20/0x2c
[ ] invoke_syscall+0x68/0xf0
[ ] el0_svc_common.constprop.0+0x40/0xe0
[ ] do_el0_svc+0x1c/0x28
[ ] el0_svc+0x30/0xd0
[ ] el0t_64_sync_handler+0x100/0x12c
[ ] el0t_64_sync+0x194/0x198
[ ] Code: 8b0002e6 eb17031f 54fffbe1 d503201f (d4210000)
[ ] ---[ end trace 0000000000000000 ]---
Fixes: ad383c2c65a5 ("Bluetooth: hci_sync: Enable advertising when LL privacy is enabled")
Signed-off-by: Arseniy Krasnov <avkrasnov@salutedevices.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Minor context change fixed. ]
Signed-off-by: Alva Lan <alvalan9@foxmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/bluetooth/hci_core.h | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 4a1faf11785f4..b0a7ceb99eec0 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -28,7 +28,7 @@
#include <linux/idr.h>
#include <linux/leds.h>
#include <linux/rculist.h>
-
+#include <linux/spinlock.h>
#include <net/bluetooth/hci.h>
#include <net/bluetooth/hci_sync.h>
#include <net/bluetooth/hci_sock.h>
@@ -92,6 +92,7 @@ struct discovery_state {
unsigned long scan_start;
unsigned long scan_duration;
unsigned long name_resolve_timeout;
+ spinlock_t lock;
};
#define SUSPEND_NOTIFIER_TIMEOUT msecs_to_jiffies(2000) /* 2 seconds */
@@ -881,6 +882,7 @@ static inline void iso_recv(struct hci_conn *hcon, struct sk_buff *skb,
static inline void discovery_init(struct hci_dev *hdev)
{
+ spin_lock_init(&hdev->discovery.lock);
hdev->discovery.state = DISCOVERY_STOPPED;
INIT_LIST_HEAD(&hdev->discovery.all);
INIT_LIST_HEAD(&hdev->discovery.unknown);
@@ -895,8 +897,12 @@ static inline void hci_discovery_filter_clear(struct hci_dev *hdev)
hdev->discovery.report_invalid_rssi = true;
hdev->discovery.rssi = HCI_RSSI_INVALID;
hdev->discovery.uuid_count = 0;
+
+ spin_lock(&hdev->discovery.lock);
kfree(hdev->discovery.uuids);
hdev->discovery.uuids = NULL;
+ spin_unlock(&hdev->discovery.lock);
+
hdev->discovery.scan_start = 0;
hdev->discovery.scan_duration = 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 390/568] espintcp: fix skb leaks
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (388 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 389/568] Bluetooth: hci_sync: fix double free in hci_discovery_filter_clear() Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 391/568] lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN Greg Kroah-Hartman
` (184 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sabrina Dubroca, Simon Horman,
Steffen Klassert, Ruohan Lan, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <sd@queasysnail.net>
[ Upstream commit 63c1f19a3be3169e51a5812d22a6d0c879414076 ]
A few error paths are missing a kfree_skb.
Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
[ Minor context change fixed. ]
Signed-off-by: Ruohan Lan <ruohanlan@aliyun.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/esp4.c | 4 +++-
net/ipv6/esp6.c | 4 +++-
net/xfrm/espintcp.c | 4 +++-
3 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 8f5417ff355d7..a40f78a6474c6 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -152,8 +152,10 @@ static int esp_output_tcp_finish(struct xfrm_state *x, struct sk_buff *skb)
sk = esp_find_tcp_sk(x);
err = PTR_ERR_OR_ZERO(sk);
- if (err)
+ if (err) {
+ kfree_skb(skb);
goto out;
+ }
bh_lock_sock(sk);
if (sock_owned_by_user(sk))
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 085a83b807afd..48963fc9057bc 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -169,8 +169,10 @@ static int esp_output_tcp_finish(struct xfrm_state *x, struct sk_buff *skb)
sk = esp6_find_tcp_sk(x);
err = PTR_ERR_OR_ZERO(sk);
- if (err)
+ if (err) {
+ kfree_skb(skb);
goto out;
+ }
bh_lock_sock(sk);
if (sock_owned_by_user(sk))
diff --git a/net/xfrm/espintcp.c b/net/xfrm/espintcp.c
index d6fece1ed982d..b26fbaead7a55 100644
--- a/net/xfrm/espintcp.c
+++ b/net/xfrm/espintcp.c
@@ -168,8 +168,10 @@ int espintcp_queue_out(struct sock *sk, struct sk_buff *skb)
{
struct espintcp_ctx *ctx = espintcp_getctx(sk);
- if (skb_queue_len(&ctx->out_queue) >= READ_ONCE(netdev_max_backlog))
+ if (skb_queue_len(&ctx->out_queue) >= READ_ONCE(netdev_max_backlog)) {
+ kfree_skb(skb);
return -ENOBUFS;
+ }
__skb_queue_tail(&ctx->out_queue, skb);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 391/568] lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (389 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 390/568] espintcp: fix skb leaks Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 392/568] asm-generic: Unify uapi bitsperlong.h for arm64, riscv and loongarch Greg Kroah-Hartman
` (183 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ard Biesheuvel, Eric Biggers,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit 44e8241c51f762aafa50ed116da68fd6ecdcc954 upstream.
On big endian arm kernels, the arm optimized Curve25519 code produces
incorrect outputs and fails the Curve25519 test. This has been true
ever since this code was added.
It seems that hardly anyone (or even no one?) actually uses big endian
arm kernels. But as long as they're ostensibly supported, we should
disable this code on them so that it's not accidentally used.
Note: for future-proofing, use !CPU_BIG_ENDIAN instead of
CPU_LITTLE_ENDIAN. Both of these are arch-specific options that could
get removed in the future if big endian support gets dropped.
Fixes: d8f1308a025f ("crypto: arm/curve25519 - wire up NEON implementation")
Cc: stable@vger.kernel.org
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20251104054906.716914-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/crypto/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/crypto/Kconfig b/arch/arm/crypto/Kconfig
index 3858c4d4cb988..f6323b84631ff 100644
--- a/arch/arm/crypto/Kconfig
+++ b/arch/arm/crypto/Kconfig
@@ -4,7 +4,7 @@ menu "Accelerated Cryptographic Algorithms for CPU (arm)"
config CRYPTO_CURVE25519_NEON
tristate "Public key crypto: Curve25519 (NEON)"
- depends on KERNEL_MODE_NEON
+ depends on KERNEL_MODE_NEON && !CPU_BIG_ENDIAN
select CRYPTO_LIB_CURVE25519_GENERIC
select CRYPTO_ARCH_HAVE_LIB_CURVE25519
help
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 392/568] asm-generic: Unify uapi bitsperlong.h for arm64, riscv and loongarch
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (390 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 391/568] lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 393/568] mtd: onenand: Pass correct pointer to IRQ handler Greg Kroah-Hartman
` (182 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xi Ruoyao, Arnd Bergmann,
Tiezhu Yang, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit 8386f58f8deda81110283798a387fb53ec21957c ]
Now we specify the minimal version of GCC as 5.1 and Clang/LLVM as 11.0.0
in Documentation/process/changes.rst, __CHAR_BIT__ and __SIZEOF_LONG__ are
usable, it is probably fine to unify the definition of __BITS_PER_LONG as
(__CHAR_BIT__ * __SIZEOF_LONG__) in asm-generic uapi bitsperlong.h.
In order to keep safe and avoid regression, only unify uapi bitsperlong.h
for some archs such as arm64, riscv and loongarch which are using newer
toolchains that have the definitions of __CHAR_BIT__ and __SIZEOF_LONG__.
Suggested-by: Xi Ruoyao <xry111@xry111.site>
Link: https://lore.kernel.org/all/d3e255e4746de44c9903c4433616d44ffcf18d1b.camel@xry111.site/
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/linux-arch/a3a4f48a-07d4-4ed9-bc53-5d383428bdd2@app.fastmail.com/
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/uapi/asm/bitsperlong.h | 24 -------------------
arch/loongarch/include/uapi/asm/bitsperlong.h | 9 -------
arch/riscv/include/uapi/asm/bitsperlong.h | 14 -----------
include/uapi/asm-generic/bitsperlong.h | 13 +++++++++-
.../arch/arm64/include/uapi/asm/bitsperlong.h | 24 -------------------
.../arch/riscv/include/uapi/asm/bitsperlong.h | 14 -----------
tools/include/uapi/asm-generic/bitsperlong.h | 14 ++++++++++-
tools/include/uapi/asm/bitsperlong.h | 6 -----
8 files changed, 25 insertions(+), 93 deletions(-)
delete mode 100644 arch/arm64/include/uapi/asm/bitsperlong.h
delete mode 100644 arch/loongarch/include/uapi/asm/bitsperlong.h
delete mode 100644 arch/riscv/include/uapi/asm/bitsperlong.h
delete mode 100644 tools/arch/arm64/include/uapi/asm/bitsperlong.h
delete mode 100644 tools/arch/riscv/include/uapi/asm/bitsperlong.h
diff --git a/arch/arm64/include/uapi/asm/bitsperlong.h b/arch/arm64/include/uapi/asm/bitsperlong.h
deleted file mode 100644
index 485d60bee26ca..0000000000000
--- a/arch/arm64/include/uapi/asm/bitsperlong.h
+++ /dev/null
@@ -1,24 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/*
- * Copyright (C) 2012 ARM Ltd.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
- */
-#ifndef __ASM_BITSPERLONG_H
-#define __ASM_BITSPERLONG_H
-
-#define __BITS_PER_LONG 64
-
-#include <asm-generic/bitsperlong.h>
-
-#endif /* __ASM_BITSPERLONG_H */
diff --git a/arch/loongarch/include/uapi/asm/bitsperlong.h b/arch/loongarch/include/uapi/asm/bitsperlong.h
deleted file mode 100644
index 00b4ba1e5cdf0..0000000000000
--- a/arch/loongarch/include/uapi/asm/bitsperlong.h
+++ /dev/null
@@ -1,9 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-#ifndef __ASM_LOONGARCH_BITSPERLONG_H
-#define __ASM_LOONGARCH_BITSPERLONG_H
-
-#define __BITS_PER_LONG (__SIZEOF_LONG__ * 8)
-
-#include <asm-generic/bitsperlong.h>
-
-#endif /* __ASM_LOONGARCH_BITSPERLONG_H */
diff --git a/arch/riscv/include/uapi/asm/bitsperlong.h b/arch/riscv/include/uapi/asm/bitsperlong.h
deleted file mode 100644
index 7d0b32e3b7017..0000000000000
--- a/arch/riscv/include/uapi/asm/bitsperlong.h
+++ /dev/null
@@ -1,14 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
-/*
- * Copyright (C) 2012 ARM Ltd.
- * Copyright (C) 2015 Regents of the University of California
- */
-
-#ifndef _UAPI_ASM_RISCV_BITSPERLONG_H
-#define _UAPI_ASM_RISCV_BITSPERLONG_H
-
-#define __BITS_PER_LONG (__SIZEOF_POINTER__ * 8)
-
-#include <asm-generic/bitsperlong.h>
-
-#endif /* _UAPI_ASM_RISCV_BITSPERLONG_H */
diff --git a/include/uapi/asm-generic/bitsperlong.h b/include/uapi/asm-generic/bitsperlong.h
index 693d9a40eb7b0..352cb81947b87 100644
--- a/include/uapi/asm-generic/bitsperlong.h
+++ b/include/uapi/asm-generic/bitsperlong.h
@@ -2,6 +2,17 @@
#ifndef _UAPI__ASM_GENERIC_BITS_PER_LONG
#define _UAPI__ASM_GENERIC_BITS_PER_LONG
+#ifndef __BITS_PER_LONG
+/*
+ * In order to keep safe and avoid regression, only unify uapi
+ * bitsperlong.h for some archs which are using newer toolchains
+ * that have the definitions of __CHAR_BIT__ and __SIZEOF_LONG__.
+ * See the following link for more info:
+ * https://lore.kernel.org/linux-arch/b9624545-2c80-49a1-ac3c-39264a591f7b@app.fastmail.com/
+ */
+#if defined(__CHAR_BIT__) && defined(__SIZEOF_LONG__)
+#define __BITS_PER_LONG (__CHAR_BIT__ * __SIZEOF_LONG__)
+#else
/*
* There seems to be no way of detecting this automatically from user
* space, so 64 bit architectures should override this in their
@@ -9,8 +20,8 @@
* both 32 and 64 bit user space must not rely on CONFIG_64BIT
* to decide it, but rather check a compiler provided macro.
*/
-#ifndef __BITS_PER_LONG
#define __BITS_PER_LONG 32
#endif
+#endif
#endif /* _UAPI__ASM_GENERIC_BITS_PER_LONG */
diff --git a/tools/arch/arm64/include/uapi/asm/bitsperlong.h b/tools/arch/arm64/include/uapi/asm/bitsperlong.h
deleted file mode 100644
index 485d60bee26ca..0000000000000
--- a/tools/arch/arm64/include/uapi/asm/bitsperlong.h
+++ /dev/null
@@ -1,24 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/*
- * Copyright (C) 2012 ARM Ltd.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
- */
-#ifndef __ASM_BITSPERLONG_H
-#define __ASM_BITSPERLONG_H
-
-#define __BITS_PER_LONG 64
-
-#include <asm-generic/bitsperlong.h>
-
-#endif /* __ASM_BITSPERLONG_H */
diff --git a/tools/arch/riscv/include/uapi/asm/bitsperlong.h b/tools/arch/riscv/include/uapi/asm/bitsperlong.h
deleted file mode 100644
index 0b9b58b57ff6e..0000000000000
--- a/tools/arch/riscv/include/uapi/asm/bitsperlong.h
+++ /dev/null
@@ -1,14 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
-/*
- * Copyright (C) 2012 ARM Ltd.
- * Copyright (C) 2015 Regents of the University of California
- */
-
-#ifndef _UAPI_ASM_RISCV_BITSPERLONG_H
-#define _UAPI_ASM_RISCV_BITSPERLONG_H
-
-#define __BITS_PER_LONG (__SIZEOF_POINTER__ * 8)
-
-#include <asm-generic/bitsperlong.h>
-
-#endif /* _UAPI_ASM_RISCV_BITSPERLONG_H */
diff --git a/tools/include/uapi/asm-generic/bitsperlong.h b/tools/include/uapi/asm-generic/bitsperlong.h
index 23e6c416b85fc..352cb81947b87 100644
--- a/tools/include/uapi/asm-generic/bitsperlong.h
+++ b/tools/include/uapi/asm-generic/bitsperlong.h
@@ -1,6 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
#ifndef _UAPI__ASM_GENERIC_BITS_PER_LONG
#define _UAPI__ASM_GENERIC_BITS_PER_LONG
+#ifndef __BITS_PER_LONG
+/*
+ * In order to keep safe and avoid regression, only unify uapi
+ * bitsperlong.h for some archs which are using newer toolchains
+ * that have the definitions of __CHAR_BIT__ and __SIZEOF_LONG__.
+ * See the following link for more info:
+ * https://lore.kernel.org/linux-arch/b9624545-2c80-49a1-ac3c-39264a591f7b@app.fastmail.com/
+ */
+#if defined(__CHAR_BIT__) && defined(__SIZEOF_LONG__)
+#define __BITS_PER_LONG (__CHAR_BIT__ * __SIZEOF_LONG__)
+#else
/*
* There seems to be no way of detecting this automatically from user
* space, so 64 bit architectures should override this in their
@@ -8,8 +20,8 @@
* both 32 and 64 bit user space must not rely on CONFIG_64BIT
* to decide it, but rather check a compiler provided macro.
*/
-#ifndef __BITS_PER_LONG
#define __BITS_PER_LONG 32
#endif
+#endif
#endif /* _UAPI__ASM_GENERIC_BITS_PER_LONG */
diff --git a/tools/include/uapi/asm/bitsperlong.h b/tools/include/uapi/asm/bitsperlong.h
index da52065171581..c65267afc3415 100644
--- a/tools/include/uapi/asm/bitsperlong.h
+++ b/tools/include/uapi/asm/bitsperlong.h
@@ -1,8 +1,6 @@
/* SPDX-License-Identifier: GPL-2.0 */
#if defined(__i386__) || defined(__x86_64__)
#include "../../../arch/x86/include/uapi/asm/bitsperlong.h"
-#elif defined(__aarch64__)
-#include "../../../arch/arm64/include/uapi/asm/bitsperlong.h"
#elif defined(__powerpc__)
#include "../../../arch/powerpc/include/uapi/asm/bitsperlong.h"
#elif defined(__s390__)
@@ -13,12 +11,8 @@
#include "../../../arch/mips/include/uapi/asm/bitsperlong.h"
#elif defined(__ia64__)
#include "../../../arch/ia64/include/uapi/asm/bitsperlong.h"
-#elif defined(__riscv)
-#include "../../../arch/riscv/include/uapi/asm/bitsperlong.h"
#elif defined(__alpha__)
#include "../../../arch/alpha/include/uapi/asm/bitsperlong.h"
-#elif defined(__loongarch__)
-#include "../../../arch/loongarch/include/uapi/asm/bitsperlong.h"
#else
#include <asm-generic/bitsperlong.h>
#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 393/568] mtd: onenand: Pass correct pointer to IRQ handler
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (391 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 392/568] asm-generic: Unify uapi bitsperlong.h for arm64, riscv and loongarch Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 394/568] netfilter: nf_tables: reject duplicate device on updates Greg Kroah-Hartman
` (181 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Miquel Raynal,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 97315e7c901a1de60e8ca9b11e0e96d0f9253e18 ]
This was supposed to pass "onenand" instead of "&onenand" with the
ampersand. Passing a random stack address which will be gone when the
function ends makes no sense. However the good thing is that the pointer
is never used, so this doesn't cause a problem at run time.
Fixes: e23abf4b7743 ("mtd: OneNAND: S5PC110: Implement DMA interrupt method")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/onenand/onenand_samsung.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/onenand/onenand_samsung.c b/drivers/mtd/nand/onenand/onenand_samsung.c
index b64895573515e..48608632280c5 100644
--- a/drivers/mtd/nand/onenand/onenand_samsung.c
+++ b/drivers/mtd/nand/onenand/onenand_samsung.c
@@ -909,7 +909,7 @@ static int s3c_onenand_probe(struct platform_device *pdev)
err = devm_request_irq(&pdev->dev, r->start,
s5pc110_onenand_irq,
IRQF_SHARED, "onenand",
- &onenand);
+ onenand);
if (err) {
dev_err(&pdev->dev, "failed to get irq\n");
return err;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 394/568] netfilter: nf_tables: reject duplicate device on updates
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (392 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 393/568] mtd: onenand: Pass correct pointer to IRQ handler Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 395/568] HID: hid-ntrig: Prevent memory leak in ntrig_report_version() Greg Kroah-Hartman
` (180 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Florian Westphal,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
commit cf5fb87fcdaaaafec55dcc0dc5a9e15ead343973 upstream.
A chain/flowtable update with duplicated devices in the same batch is
possible. Unfortunately, netdev event path only removes the first
device that is found, leaving unregistered the hook of the duplicated
device.
Check if a duplicated device exists in the transaction batch, bail out
with EEXIST in such case.
WARNING is hit when unregistering the hook:
[49042.221275] WARNING: CPU: 4 PID: 8425 at net/netfilter/core.c:340 nf_hook_entry_head+0xaa/0x150
[49042.221375] CPU: 4 UID: 0 PID: 8425 Comm: nft Tainted: G S 6.16.0+ #170 PREEMPT(full)
[...]
[49042.221382] RIP: 0010:nf_hook_entry_head+0xaa/0x150
Fixes: 78d9f48f7f44 ("netfilter: nf_tables: add devices to existing flowtable")
Fixes: b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_tables_api.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index df83224bef06c..b278f493cc93c 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -8078,6 +8078,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,
{
const struct nlattr * const *nla = ctx->nla;
struct nft_flowtable_hook flowtable_hook;
+ struct nftables_pernet *nft_net;
struct nft_hook *hook, *next;
struct nft_trans *trans;
bool unregister = false;
@@ -8093,6 +8094,20 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,
if (nft_hook_list_find(&flowtable->hook_list, hook)) {
list_del(&hook->list);
kfree(hook);
+ continue;
+ }
+
+ nft_net = nft_pernet(ctx->net);
+ list_for_each_entry(trans, &nft_net->commit_list, list) {
+ if (trans->msg_type != NFT_MSG_NEWFLOWTABLE ||
+ trans->ctx.table != ctx->table ||
+ !nft_trans_flowtable_update(trans))
+ continue;
+
+ if (nft_hook_list_find(&nft_trans_flowtable_hooks(trans), hook)) {
+ err = -EEXIST;
+ goto err_flowtable_update_hook;
+ }
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 395/568] HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (393 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 394/568] netfilter: nf_tables: reject duplicate device on updates Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 396/568] NFSD: free copynotify stateid in nfs4_free_ol_stateid() Greg Kroah-Hartman
` (179 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Ichikawa, Jiri Kosina,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Ichikawa <masami256@gmail.com>
[ Upstream commit 53f731f5bba0cf03b751ccceb98b82fadc9ccd1e ]
Use a scope-based cleanup helper for the buffer allocated with kmalloc()
in ntrig_report_version() to simplify the cleanup logic and prevent
memory leaks (specifically the !hid_is_usb()-case one).
[jkosina@suse.com: elaborate on the actual existing leak]
Fixes: 185c926283da ("HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()")
Signed-off-by: Masami Ichikawa <masami256@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-ntrig.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
index a1128c5315fff..3c41f6841f775 100644
--- a/drivers/hid/hid-ntrig.c
+++ b/drivers/hid/hid-ntrig.c
@@ -142,13 +142,13 @@ static void ntrig_report_version(struct hid_device *hdev)
int ret;
char buf[20];
struct usb_device *usb_dev = hid_to_usb_dev(hdev);
- unsigned char *data = kmalloc(8, GFP_KERNEL);
+ unsigned char *data __free(kfree) = kmalloc(8, GFP_KERNEL);
if (!hid_is_usb(hdev))
return;
if (!data)
- goto err_free;
+ return;
ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0),
USB_REQ_CLEAR_FEATURE,
@@ -163,9 +163,6 @@ static void ntrig_report_version(struct hid_device *hdev)
hid_info(hdev, "Firmware version: %s (%02x%02x %02x%02x)\n",
buf, data[2], data[3], data[4], data[5]);
}
-
-err_free:
- kfree(data);
}
static ssize_t show_phys_width(struct device *dev,
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 396/568] NFSD: free copynotify stateid in nfs4_free_ol_stateid()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (394 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 395/568] HID: hid-ntrig: Prevent memory leak in ntrig_report_version() Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 397/568] gcov: add support for GCC 15 Greg Kroah-Hartman
` (178 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, rtm, Olga Kornievskaia, Chuck Lever
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <okorniev@redhat.com>
commit 4aa17144d5abc3c756883e3a010246f0dba8b468 upstream.
Typically copynotify stateid is freed either when parent's stateid
is being close/freed or in nfsd4_laundromat if the stateid hasn't
been used in a lease period.
However, in case when the server got an OPEN (which created
a parent stateid), followed by a COPY_NOTIFY using that stateid,
followed by a client reboot. New client instance while doing
CREATE_SESSION would force expire previous state of this client.
It leads to the open state being freed thru release_openowner->
nfs4_free_ol_stateid() and it finds that it still has copynotify
stateid associated with it. We currently print a warning and is
triggerred
WARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd]
This patch, instead, frees the associated copynotify stateid here.
If the parent stateid is freed (without freeing the copynotify
stateids associated with it), it leads to the list corruption
when laundromat ends up freeing the copynotify state later.
[ 1626.839430] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
[ 1626.842828] Modules linked in: nfnetlink_queue nfnetlink_log bluetooth cfg80211 rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd nfs_acl lockd grace nfs_localio ext4 crc16 mbcache jbd2 overlay uinput snd_seq_dummy snd_hrtimer qrtr rfkill vfat fat uvcvideo snd_hda_codec_generic videobuf2_vmalloc videobuf2_memops snd_hda_intel uvc snd_intel_dspcfg videobuf2_v4l2 videobuf2_common snd_hda_codec snd_hda_core videodev snd_hwdep snd_seq mc snd_seq_device snd_pcm snd_timer snd soundcore sg loop auth_rpcgss vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs 8021q garp stp llc mrp nvme ghash_ce e1000e nvme_core sr_mod nvme_keyring nvme_auth cdrom vmwgfx drm_ttm_helper ttm sunrpc dm_mirror dm_region_hash dm_log iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse dm_multipath dm_mod nfnetlink
[ 1626.855594] CPU: 2 UID: 0 PID: 199 Comm: kworker/u24:33 Kdump: loaded Tainted: G B W 6.17.0-rc7+ #22 PREEMPT(voluntary)
[ 1626.857075] Tainted: [B]=BAD_PAGE, [W]=WARN
[ 1626.857573] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024
[ 1626.858724] Workqueue: nfsd4 laundromat_main [nfsd]
[ 1626.859304] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
[ 1626.860010] pc : __list_del_entry_valid_or_report+0x148/0x200
[ 1626.860601] lr : __list_del_entry_valid_or_report+0x148/0x200
[ 1626.861182] sp : ffff8000881d7a40
[ 1626.861521] x29: ffff8000881d7a40 x28: 0000000000000018 x27: ffff0000c2a98200
[ 1626.862260] x26: 0000000000000600 x25: 0000000000000000 x24: ffff8000881d7b20
[ 1626.862986] x23: ffff0000c2a981e8 x22: 1fffe00012410e7d x21: ffff0000920873e8
[ 1626.863701] x20: ffff0000920873e8 x19: ffff000086f22998 x18: 0000000000000000
[ 1626.864421] x17: 20747562202c3839 x16: 3932326636383030 x15: 3030666666662065
[ 1626.865092] x14: 6220646c756f6873 x13: 0000000000000001 x12: ffff60004fd9e4a3
[ 1626.865713] x11: 1fffe0004fd9e4a2 x10: ffff60004fd9e4a2 x9 : dfff800000000000
[ 1626.866320] x8 : 00009fffb0261b5e x7 : ffff00027ecf2513 x6 : 0000000000000001
[ 1626.866938] x5 : ffff00027ecf2510 x4 : ffff60004fd9e4a3 x3 : 0000000000000000
[ 1626.867553] x2 : 0000000000000000 x1 : ffff000096069640 x0 : 000000000000006d
[ 1626.868167] Call trace:
[ 1626.868382] __list_del_entry_valid_or_report+0x148/0x200 (P)
[ 1626.868876] _free_cpntf_state_locked+0xd0/0x268 [nfsd]
[ 1626.869368] nfs4_laundromat+0x6f8/0x1058 [nfsd]
[ 1626.869813] laundromat_main+0x24/0x60 [nfsd]
[ 1626.870231] process_one_work+0x584/0x1050
[ 1626.870595] worker_thread+0x4c4/0xc60
[ 1626.870893] kthread+0x2f8/0x398
[ 1626.871146] ret_from_fork+0x10/0x20
[ 1626.871422] Code: aa1303e1 aa1403e3 910e8000 97bc55d7 (d4210000)
[ 1626.871892] SMP: stopping secondary CPUs
Reported-by: rtm@csail.mit.edu
Closes: https://lore.kernel.org/linux-nfs/d8f064c1-a26f-4eed-b4f0-1f7f608f415f@oracle.com/T/#t
Fixes: 624322f1adc5 ("NFSD add COPY_NOTIFY operation")
Cc: stable@vger.kernel.org
Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1499,7 +1499,8 @@ static void nfs4_free_ol_stateid(struct
release_all_access(stp);
if (stp->st_stateowner)
nfs4_put_stateowner(stp->st_stateowner);
- WARN_ON(!list_empty(&stid->sc_cp_list));
+ if (!list_empty(&stid->sc_cp_list))
+ nfs4_free_cpntf_statelist(stid->sc_client->net, stid);
kmem_cache_free(stateid_slab, stid);
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 397/568] gcov: add support for GCC 15
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (395 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 396/568] NFSD: free copynotify stateid in nfs4_free_ol_stateid() Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 398/568] ksmbd: close accepted socket when per-IP limit rejects connection Greg Kroah-Hartman
` (177 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Oberparleiter, Matthieu Baerts,
Andrew Morton
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Oberparleiter <oberpar@linux.ibm.com>
commit ec4d11fc4b2dd4a2fa8c9d801ee9753b74623554 upstream.
Using gcov on kernels compiled with GCC 15 results in truncated 16-byte
long .gcda files with no usable data. To fix this, update GCOV_COUNTERS
to match the value defined by GCC 15.
Tested with GCC 14.3.0 and GCC 15.2.0.
Link: https://lkml.kernel.org/r/20251028115125.1319410-1-oberpar@linux.ibm.com
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reported-by: Matthieu Baerts <matttbe@kernel.org>
Closes: https://github.com/linux-test-project/lcov/issues/445
Tested-by: Matthieu Baerts <matttbe@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/gcov/gcc_4_7.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/kernel/gcov/gcc_4_7.c
+++ b/kernel/gcov/gcc_4_7.c
@@ -18,7 +18,9 @@
#include <linux/mm.h>
#include "gcov.h"
-#if (__GNUC__ >= 14)
+#if (__GNUC__ >= 15)
+#define GCOV_COUNTERS 10
+#elif (__GNUC__ >= 14)
#define GCOV_COUNTERS 9
#elif (__GNUC__ >= 10)
#define GCOV_COUNTERS 8
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 398/568] ksmbd: close accepted socket when per-IP limit rejects connection
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (396 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 397/568] gcov: add support for GCC 15 Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 399/568] strparser: Fix signed/unsigned mismatch bug Greg Kroah-Hartman
` (176 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joshua Rogers, Namjae Jeon,
Steve French
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Rogers <linux@joshua.hu>
commit 98a5fd31cbf72d46bf18e50b3ab0ce86d5f319a9 upstream.
When the per-IP connection limit is exceeded in ksmbd_kthread_fn(),
the code sets ret = -EAGAIN and continues the accept loop without
closing the just-accepted socket. That leaks one socket per rejected
attempt from a single IP and enables a trivial remote DoS.
Release client_sk before continuing.
This bug was found with ZeroPath.
Cc: stable@vger.kernel.org
Signed-off-by: Joshua Rogers <linux@joshua.hu>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/transport_tcp.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/smb/server/transport_tcp.c
+++ b/fs/smb/server/transport_tcp.c
@@ -282,8 +282,11 @@ static int ksmbd_kthread_fn(void *p)
}
}
up_read(&conn_list_lock);
- if (ret == -EAGAIN)
+ if (ret == -EAGAIN) {
+ /* Per-IP limit hit: release the just-accepted socket. */
+ sock_release(client_sk);
continue;
+ }
skip_max_ip_conns_limit:
if (server_conf.max_connections &&
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 399/568] strparser: Fix signed/unsigned mismatch bug
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (397 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 398/568] ksmbd: close accepted socket when per-IP limit rejects connection Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 400/568] dma-mapping: benchmark: Restore padding to ensure uABI remained consistent Greg Kroah-Hartman
` (175 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nate Karstens, Jacob Keller,
Sabrina Dubroca, Jakub Kicinski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nate Karstens <nate.karstens@garmin.com>
commit 4da4e4bde1c453ac5cc2dce5def81d504ae257ee upstream.
The `len` member of the sk_buff is an unsigned int. This is cast to
`ssize_t` (a signed type) for the first sk_buff in the comparison,
but not the second sk_buff. On 32-bit systems, this can result in
an integer underflow for certain values because unsigned arithmetic
is being used.
This appears to be an oversight: if the intention was to use unsigned
arithmetic, then the first cast would have been omitted. The change
ensures both len values are cast to `ssize_t`.
The underflow causes an issue with ktls when multiple TLS PDUs are
included in a single TCP segment. The mainline kernel does not use
strparser for ktls anymore, but this is still useful for other
features that still use strparser, and for backporting.
Signed-off-by: Nate Karstens <nate.karstens@garmin.com>
Cc: stable@vger.kernel.org
Fixes: 43a0c6751a32 ("strparser: Stream parser for messages")
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/20251106222835.1871628-1-nate.karstens@garmin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/strparser/strparser.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/strparser/strparser.c
+++ b/net/strparser/strparser.c
@@ -238,7 +238,7 @@ static int __strp_recv(read_descriptor_t
strp_parser_err(strp, -EMSGSIZE, desc);
break;
} else if (len <= (ssize_t)head->len -
- skb->len - stm->strp.offset) {
+ (ssize_t)skb->len - stm->strp.offset) {
/* Length must be into new skb (and also
* greater than zero)
*/
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 400/568] dma-mapping: benchmark: Restore padding to ensure uABI remained consistent
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (398 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 399/568] strparser: Fix signed/unsigned mismatch bug Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 401/568] LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY Greg Kroah-Hartman
` (174 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Barry Song, Qinxin Xia,
Jonathan Cameron, Marek Szyprowski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qinxin Xia <xiaqinxin@huawei.com>
commit 23ee8a2563a0f24cf4964685ced23c32be444ab8 upstream.
The padding field in the structure was previously reserved to
maintain a stable interface for potential new fields, ensuring
compatibility with user-space shared data structures.
However,it was accidentally removed by tiantao in a prior commit,
which may lead to incompatibility between user space and the kernel.
This patch reinstates the padding to restore the original structure
layout and preserve compatibility.
Fixes: 8ddde07a3d28 ("dma-mapping: benchmark: extract a common header file for map_benchmark definition")
Cc: stable@vger.kernel.org
Acked-by: Barry Song <baohua@kernel.org>
Signed-off-by: Qinxin Xia <xiaqinxin@huawei.com>
Reported-by: Barry Song <baohua@kernel.org>
Closes: https://lore.kernel.org/lkml/CAGsJ_4waiZ2+NBJG+SCnbNk+nQ_ZF13_Q5FHJqZyxyJTcEop2A@mail.gmail.com/
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20251028120900.2265511-2-xiaqinxin@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/map_benchmark.h | 1 +
1 file changed, 1 insertion(+)
--- a/include/linux/map_benchmark.h
+++ b/include/linux/map_benchmark.h
@@ -27,5 +27,6 @@ struct map_benchmark {
__u32 dma_dir; /* DMA data direction */
__u32 dma_trans_ns; /* time for DMA transmission in ns */
__u32 granule; /* how many PAGE_SIZE will do map/unmap once a time */
+ __u8 expansion[76]; /* For future use */
};
#endif /* _KERNEL_DMA_BENCHMARK_H */
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 401/568] LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (399 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 400/568] dma-mapping: benchmark: Restore padding to ensure uABI remained consistent Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 402/568] ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe Greg Kroah-Hartman
` (173 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Liupu Wang, Tianyang Zhang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tianyang Zhang <zhangtianyang@loongson.cn>
commit a073d637c8cfbfbab39b7272226a3fbf3b887580 upstream.
Now if the PTE/PMD is dirty with _PAGE_DIRTY but without _PAGE_MODIFIED,
after {pte,pmd}_modify() we lose _PAGE_DIRTY, then {pte,pmd}_dirty()
return false and lead to data loss. This can happen in certain scenarios
such as HW PTW doesn't set _PAGE_MODIFIED automatically, so here we need
_PAGE_MODIFIED to record the dirty status (_PAGE_DIRTY).
The new modification involves checking whether the original PTE/PMD has
the _PAGE_DIRTY flag. If it exists, the _PAGE_MODIFIED bit is also set,
ensuring that the {pte,pmd}_dirty() interface can always return accurate
information.
Cc: stable@vger.kernel.org
Co-developed-by: Liupu Wang <wangliupu@loongson.cn>
Signed-off-by: Liupu Wang <wangliupu@loongson.cn>
Signed-off-by: Tianyang Zhang <zhangtianyang@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/include/asm/pgtable.h | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/arch/loongarch/include/asm/pgtable.h
+++ b/arch/loongarch/include/asm/pgtable.h
@@ -403,6 +403,9 @@ static inline unsigned long pte_accessib
static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
{
+ if (pte_val(pte) & _PAGE_DIRTY)
+ pte_val(pte) |= _PAGE_MODIFIED;
+
return __pte((pte_val(pte) & _PAGE_CHG_MASK) |
(pgprot_val(newprot) & ~_PAGE_CHG_MASK));
}
@@ -516,9 +519,11 @@ static inline struct page *pmd_page(pmd_
static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot)
{
- pmd_val(pmd) = (pmd_val(pmd) & _HPAGE_CHG_MASK) |
- (pgprot_val(newprot) & ~_HPAGE_CHG_MASK);
- return pmd;
+ if (pmd_val(pmd) & _PAGE_DIRTY)
+ pmd_val(pmd) |= _PAGE_MODIFIED;
+
+ return __pmd((pmd_val(pmd) & _HPAGE_CHG_MASK) |
+ (pgprot_val(newprot) & ~_HPAGE_CHG_MASK));
}
static inline pmd_t pmd_mkinvalid(pmd_t pmd)
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 402/568] ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (400 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 401/568] LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 403/568] wifi: mac80211: reject address change while connecting Greg Kroah-Hartman
` (172 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuang Wang, Ido Schimmel,
Eric Dumazet, Jakub Kicinski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuang Wang <nashuiliang@gmail.com>
commit ac1499fcd40fe06479e9b933347b837ccabc2a40 upstream.
The sit driver's packet transmission path calls: sit_tunnel_xmit() ->
update_or_create_fnhe(), which lead to fnhe_remove_oldest() being called
to delete entries exceeding FNHE_RECLAIM_DEPTH+random.
The race window is between fnhe_remove_oldest() selecting fnheX for
deletion and the subsequent kfree_rcu(). During this time, the
concurrent path's __mkroute_output() -> find_exception() can fetch the
soon-to-be-deleted fnheX, and rt_bind_exception() then binds it with a
new dst using a dst_hold(). When the original fnheX is freed via RCU,
the dst reference remains permanently leaked.
CPU 0 CPU 1
__mkroute_output()
find_exception() [fnheX]
update_or_create_fnhe()
fnhe_remove_oldest() [fnheX]
rt_bind_exception() [bind dst]
RCU callback [fnheX freed, dst leak]
This issue manifests as a device reference count leak and a warning in
dmesg when unregistering the net device:
unregister_netdevice: waiting for sitX to become free. Usage count = N
Ido Schimmel provided the simple test validation method [1].
The fix clears 'oldest->fnhe_daddr' before calling fnhe_flush_routes().
Since rt_bind_exception() checks this field, setting it to zero prevents
the stale fnhe from being reused and bound to a new dst just before it
is freed.
[1]
ip netns add ns1
ip -n ns1 link set dev lo up
ip -n ns1 address add 192.0.2.1/32 dev lo
ip -n ns1 link add name dummy1 up type dummy
ip -n ns1 route add 192.0.2.2/32 dev dummy1
ip -n ns1 link add name gretap1 up arp off type gretap \
local 192.0.2.1 remote 192.0.2.2
ip -n ns1 route add 198.51.0.0/16 dev gretap1
taskset -c 0 ip netns exec ns1 mausezahn gretap1 \
-A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q &
taskset -c 2 ip netns exec ns1 mausezahn gretap1 \
-A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q &
sleep 10
ip netns pids ns1 | xargs kill
ip netns del ns1
Cc: stable@vger.kernel.org
Fixes: 67d6d681e15b ("ipv4: make exception cache less predictible")
Signed-off-by: Chuang Wang <nashuiliang@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20251111064328.24440-1-nashuiliang@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/route.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -617,6 +617,11 @@ static void fnhe_remove_oldest(struct fn
oldest_p = fnhe_p;
}
}
+
+ /* Clear oldest->fnhe_daddr to prevent this fnhe from being
+ * rebound with new dsts in rt_bind_exception().
+ */
+ oldest->fnhe_daddr = 0;
fnhe_flush_routes(oldest);
*oldest_p = oldest->fnhe_next;
kfree_rcu(oldest, rcu);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 403/568] wifi: mac80211: reject address change while connecting
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (401 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 402/568] ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 404/568] fs/proc: fix uaf in proc_readdir_de() Greg Kroah-Hartman
` (171 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johannes Berg
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit a9da90e618cd0669a22bcc06a96209db5dd96e9b upstream.
While connecting, the MAC address can already no longer be
changed. The change is already rejected if netif_carrier_ok(),
but of course that's not true yet while connecting. Check for
auth_data or assoc_data, so the MAC address cannot be changed.
Also more comprehensively check that there are no stations on
the interface being changed - if any peer station is added it
will know about our address already, so we cannot change it.
Cc: stable@vger.kernel.org
Fixes: 3c06e91b40db ("wifi: mac80211: Support POWERED_ADDR_CHANGE feature")
Link: https://patch.msgid.link/20251105154119.f9f6c1df81bb.I9bb3760ede650fb96588be0d09a5a7bdec21b217@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/iface.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -216,6 +216,10 @@ static int ieee80211_can_powered_addr_ch
mutex_lock(&local->mtx);
+ /* if any stations are set known (so they know this vif too), reject */
+ if (sta_info_get_by_idx(sdata, 0))
+ return -EBUSY;
+
/* First check no ROC work is happening on this iface */
list_for_each_entry(roc, &local->roc_list, list) {
if (roc->sdata != sdata)
@@ -235,12 +239,16 @@ static int ieee80211_can_powered_addr_ch
ret = -EBUSY;
}
+ /*
+ * More interface types could be added here but changing the
+ * address while powered makes the most sense in client modes.
+ */
switch (sdata->vif.type) {
case NL80211_IFTYPE_STATION:
case NL80211_IFTYPE_P2P_CLIENT:
- /* More interface types could be added here but changing the
- * address while powered makes the most sense in client modes.
- */
+ /* refuse while connecting */
+ if (sdata->u.mgd.auth_data || sdata->u.mgd.assoc_data)
+ return -EBUSY;
break;
default:
ret = -EOPNOTSUPP;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 404/568] fs/proc: fix uaf in proc_readdir_de()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (402 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 403/568] wifi: mac80211: reject address change while connecting Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 405/568] mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 Greg Kroah-Hartman
` (170 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Yang, Al Viro, Christian Brauner,
wangzijie, Alexey Dobriyan, Andrew Morton
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yang <albinwyang@tencent.com>
commit 895b4c0c79b092d732544011c3cecaf7322c36a1 upstream.
Pde is erased from subdir rbtree through rb_erase(), but not set the node
to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE()
set the erased node to EMPTY, then pde_subdir_next() will return NULL to
avoid uaf access.
We found an uaf issue while using stress-ng testing, need to run testcase
getdent and tun in the same time. The steps of the issue is as follows:
1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current
pde is tun3;
2) in the [time windows] unregister netdevice tun3 and tun2, and erase
them from rbtree. erase tun3 first, and then erase tun2. the
pde(tun2) will be released to slab;
3) continue to getdent process, then pde_subdir_next() will return
pde(tun2) which is released, it will case uaf access.
CPU 0 | CPU 1
-------------------------------------------------------------------------
traverse dir /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2
sys_getdents64() |
iterate_dir() |
proc_readdir() |
proc_readdir_de() | snmp6_unregister_dev()
pde_get(de); | proc_remove()
read_unlock(&proc_subdir_lock); | remove_proc_subtree()
| write_lock(&proc_subdir_lock);
[time window] | rb_erase(&root->subdir_node, &parent->subdir);
| write_unlock(&proc_subdir_lock);
read_lock(&proc_subdir_lock); |
next = pde_subdir_next(de); |
pde_put(de); |
de = next; //UAF |
rbtree of dev_snmp6
|
pde(tun3)
/ \
NULL pde(tun2)
Link: https://lkml.kernel.org/r/20251025024233.158363-1-albin_yang@163.com
Signed-off-by: Wei Yang <albinwyang@tencent.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: wangzijie <wangzijie1@honor.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/proc/generic.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -695,6 +695,12 @@ void pde_put(struct proc_dir_entry *pde)
}
}
+static void pde_erase(struct proc_dir_entry *pde, struct proc_dir_entry *parent)
+{
+ rb_erase(&pde->subdir_node, &parent->subdir);
+ RB_CLEAR_NODE(&pde->subdir_node);
+}
+
/*
* Remove a /proc entry and free it if it's not currently in use.
*/
@@ -717,7 +723,7 @@ void remove_proc_entry(const char *name,
WARN(1, "removing permanent /proc entry '%s'", de->name);
de = NULL;
} else {
- rb_erase(&de->subdir_node, &parent->subdir);
+ pde_erase(de, parent);
if (S_ISDIR(de->mode))
parent->nlink--;
}
@@ -761,7 +767,7 @@ int remove_proc_subtree(const char *name
root->parent->name, root->name);
return -EINVAL;
}
- rb_erase(&root->subdir_node, &parent->subdir);
+ pde_erase(root, parent);
de = root;
while (1) {
@@ -773,7 +779,7 @@ int remove_proc_subtree(const char *name
next->parent->name, next->name);
return -EINVAL;
}
- rb_erase(&next->subdir_node, &de->subdir);
+ pde_erase(next, de);
de = next;
continue;
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 405/568] mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (403 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 404/568] fs/proc: fix uaf in proc_readdir_de() Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 406/568] ALSA: usb-audio: Fix potential overflow of PCM transfer buffer Greg Kroah-Hartman
` (169 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shawn Lin, Alexey Charkov,
Hugh Cole-Baker, Ulf Hansson
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <shawn.lin@rock-chips.com>
commit a28352cf2d2f8380e7aca8cb61682396dca7a991 upstream.
strbin signal delay under 0x8 configuration is not stable after massive
test. The recommandation of it should be 0x4.
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Tested-by: Alexey Charkov <alchark@gmail.com>
Tested-by: Hugh Cole-Baker <sigmaris@gmail.com>
Fixes: 08f3dff799d4 ("mmc: sdhci-of-dwcmshc: add rockchip platform support")
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/sdhci-of-dwcmshc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mmc/host/sdhci-of-dwcmshc.c
+++ b/drivers/mmc/host/sdhci-of-dwcmshc.c
@@ -52,7 +52,7 @@
#define DLL_TXCLK_TAPNUM_DEFAULT 0x10
#define DLL_TXCLK_TAPNUM_90_DEGREES 0xA
#define DLL_TXCLK_TAPNUM_FROM_SW BIT(24)
-#define DLL_STRBIN_TAPNUM_DEFAULT 0x8
+#define DLL_STRBIN_TAPNUM_DEFAULT 0x4
#define DLL_STRBIN_TAPNUM_FROM_SW BIT(24)
#define DLL_STRBIN_DELAY_NUM_SEL BIT(26)
#define DLL_STRBIN_DELAY_NUM_OFFSET 16
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 406/568] ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (404 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 405/568] mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 16:48 ` Takashi Iwai
2025-12-03 15:26 ` [PATCH 6.1 407/568] spi: Try to get ACPI GPIO IRQ earlier Greg Kroah-Hartman
` (168 subsequent siblings)
574 siblings, 1 reply; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+bfd77469c8966de076f7,
Lizhi Xu, Takashi Iwai
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 05a1fc5efdd8560f34a3af39c9cf1e1526cc3ddf upstream.
The PCM stream data in USB-audio driver is transferred over USB URB
packet buffers, and each packet size is determined dynamically. The
packet sizes are limited by some factors such as wMaxPacketSize USB
descriptor. OTOH, in the current code, the actually used packet sizes
are determined only by the rate and the PPS, which may be bigger than
the size limit above. This results in a buffer overflow, as reported
by syzbot.
Basically when the limit is smaller than the calculated packet size,
it implies that something is wrong, most likely a weird USB
descriptor. So the best option would be just to return an error at
the parameter setup time before doing any further operations.
This patch introduces such a sanity check, and returns -EINVAL when
the packet size is greater than maxpacksize. The comparison with
ep->packsize[1] alone should suffice since it's always equal or
greater than ep->packsize[0].
Reported-by: syzbot+bfd77469c8966de076f7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=bfd77469c8966de076f7
Link: https://lore.kernel.org/690b6b46.050a0220.3d0d33.0054.GAE@google.com
Cc: Lizhi Xu <lizhi.xu@windriver.com>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20251109091211.12739-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/endpoint.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -1379,6 +1379,11 @@ int snd_usb_endpoint_set_params(struct s
ep->sample_rem = ep->cur_rate % ep->pps;
ep->packsize[0] = ep->cur_rate / ep->pps;
ep->packsize[1] = (ep->cur_rate + (ep->pps - 1)) / ep->pps;
+ if (ep->packsize[1] > ep->maxpacksize) {
+ usb_audio_dbg(chip, "Too small maxpacksize %u for rate %u / pps %u\n",
+ ep->maxpacksize, ep->cur_rate, ep->pps);
+ return -EINVAL;
+ }
/* calculate the frequency in 16.16 format */
ep->freqm = ep->freqn;
^ permalink raw reply [flat|nested] 588+ messages in thread* Re: [PATCH 6.1 406/568] ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
2025-12-03 15:26 ` [PATCH 6.1 406/568] ALSA: usb-audio: Fix potential overflow of PCM transfer buffer Greg Kroah-Hartman
@ 2025-12-03 16:48 ` Takashi Iwai
0 siblings, 0 replies; 588+ messages in thread
From: Takashi Iwai @ 2025-12-03 16:48 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, syzbot+bfd77469c8966de076f7, Lizhi Xu,
Takashi Iwai
On Wed, 03 Dec 2025 16:26:48 +0100,
Greg Kroah-Hartman wrote:
>
> 6.1-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Takashi Iwai <tiwai@suse.de>
>
> commit 05a1fc5efdd8560f34a3af39c9cf1e1526cc3ddf upstream.
>
> The PCM stream data in USB-audio driver is transferred over USB URB
> packet buffers, and each packet size is determined dynamically. The
> packet sizes are limited by some factors such as wMaxPacketSize USB
> descriptor. OTOH, in the current code, the actually used packet sizes
> are determined only by the rate and the PPS, which may be bigger than
> the size limit above. This results in a buffer overflow, as reported
> by syzbot.
>
> Basically when the limit is smaller than the calculated packet size,
> it implies that something is wrong, most likely a weird USB
> descriptor. So the best option would be just to return an error at
> the parameter setup time before doing any further operations.
>
> This patch introduces such a sanity check, and returns -EINVAL when
> the packet size is greater than maxpacksize. The comparison with
> ep->packsize[1] alone should suffice since it's always equal or
> greater than ep->packsize[0].
>
> Reported-by: syzbot+bfd77469c8966de076f7@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=bfd77469c8966de076f7
> Link: https://lore.kernel.org/690b6b46.050a0220.3d0d33.0054.GAE@google.com
> Cc: Lizhi Xu <lizhi.xu@windriver.com>
> Cc: <stable@vger.kernel.org>
> Link: https://patch.msgid.link/20251109091211.12739-1-tiwai@suse.de
> Signed-off-by: Takashi Iwai <tiwai@suse.de>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> sound/usb/endpoint.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> --- a/sound/usb/endpoint.c
> +++ b/sound/usb/endpoint.c
> @@ -1379,6 +1379,11 @@ int snd_usb_endpoint_set_params(struct s
> ep->sample_rem = ep->cur_rate % ep->pps;
> ep->packsize[0] = ep->cur_rate / ep->pps;
> ep->packsize[1] = (ep->cur_rate + (ep->pps - 1)) / ep->pps;
> + if (ep->packsize[1] > ep->maxpacksize) {
> + usb_audio_dbg(chip, "Too small maxpacksize %u for rate %u / pps %u\n",
> + ep->maxpacksize, ep->cur_rate, ep->pps);
> + return -EINVAL;
> + }
>
> /* calculate the frequency in 16.16 format */
> ep->freqm = ep->freqn;
This one requires the same workaround again, just as mentioned for
5.15.y:
https://lore.kernel.org/87ecpbsfbj.wl-tiwai@suse.de
thanks,
Takashi
^ permalink raw reply [flat|nested] 588+ messages in thread
* [PATCH 6.1 407/568] spi: Try to get ACPI GPIO IRQ earlier
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (405 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 406/568] ALSA: usb-audio: Fix potential overflow of PCM transfer buffer Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 408/568] LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY Greg Kroah-Hartman
` (167 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hans de Goede, Mark Brown
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hansg@kernel.org>
commit 3cd2018e15b3d66d2187d92867e265f45ad79e6f upstream.
Since commit d24cfee7f63d ("spi: Fix acpi deferred irq probe"), the
acpi_dev_gpio_irq_get() call gets delayed till spi_probe() is called
on the SPI device.
If there is no driver for the SPI device then the move to spi_probe()
results in acpi_dev_gpio_irq_get() never getting called. This may
cause problems by leaving the GPIO pin floating because this call is
responsible for setting up the GPIO pin direction and/or bias according
to the values from the ACPI tables.
Re-add the removed acpi_dev_gpio_irq_get() in acpi_register_spi_device()
to ensure the GPIO pin is always correctly setup, while keeping the
acpi_dev_gpio_irq_get() call added to spi_probe() to deal with
-EPROBE_DEFER returns caused by the GPIO controller not having a driver
yet.
Link: https://bbs.archlinux.org/viewtopic.php?id=302348
Fixes: d24cfee7f63d ("spi: Fix acpi deferred irq probe")
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hansg@kernel.org>
Link: https://patch.msgid.link/20251102190921.30068-1-hansg@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -2707,6 +2707,16 @@ static acpi_status acpi_register_spi_dev
acpi_set_modalias(adev, acpi_device_hid(adev), spi->modalias,
sizeof(spi->modalias));
+ /*
+ * This gets re-tried in spi_probe() for -EPROBE_DEFER handling in case
+ * the GPIO controller does not have a driver yet. This needs to be done
+ * here too, because this call sets the GPIO direction and/or bias.
+ * Setting these needs to be done even if there is no driver, in which
+ * case spi_probe() will never get called.
+ */
+ if (spi->irq < 0)
+ spi->irq = acpi_dev_gpio_irq_get(adev, 0);
+
acpi_device_set_enumerated(adev);
adev->power.flags.ignore_parent = true;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 408/568] LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (406 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 407/568] spi: Try to get ACPI GPIO IRQ earlier Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 409/568] EDAC/altera: Handle OCRAM ECC enable after warm reset Greg Kroah-Hartman
` (166 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Huacai Chen
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhuacai@loongson.cn>
commit 4e67526840fc55917581b90f6a4b65849a616dd8 upstream.
Now we use virtual addresses to fill CSR_MERRENTRY/CSR_TLBRENTRY, but
hardware hope physical addresses. Now it works well because the high
bits are ignored above PA_BITS (48 bits), but explicitly use physical
addresses can avoid potential bugs. So fix it.
Cc: stable@vger.kernel.org
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/kernel/traps.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/loongarch/kernel/traps.c
+++ b/arch/loongarch/kernel/traps.c
@@ -657,8 +657,8 @@ static void configure_exception_vector(v
tlbrentry = (unsigned long)exception_handlers + 80*VECSIZE;
csr_write64(eentry, LOONGARCH_CSR_EENTRY);
- csr_write64(eentry, LOONGARCH_CSR_MERRENTRY);
- csr_write64(tlbrentry, LOONGARCH_CSR_TLBRENTRY);
+ csr_write64(__pa(eentry), LOONGARCH_CSR_MERRENTRY);
+ csr_write64(__pa(tlbrentry), LOONGARCH_CSR_TLBRENTRY);
}
void per_cpu_trap_init(int cpu)
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 409/568] EDAC/altera: Handle OCRAM ECC enable after warm reset
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (407 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 408/568] LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 410/568] EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection Greg Kroah-Hartman
` (165 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niravkumar L Rabara,
Borislav Petkov (AMD), Dinh Nguyen
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
commit fd3ecda38fe0cb713d167b5477d25f6b350f0514 upstream.
The OCRAM ECC is always enabled either by the BootROM or by the Secure Device
Manager (SDM) during a power-on reset on SoCFPGA.
However, during a warm reset, the OCRAM content is retained to preserve data,
while the control and status registers are reset to their default values. As
a result, ECC must be explicitly re-enabled after a warm reset.
Fixes: 17e47dc6db4f ("EDAC/altera: Add Stratix10 OCRAM ECC support")
Signed-off-by: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Dinh Nguyen <dinguyen@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251111080801.1279401-1-niravkumarlaxmidas.rabara@altera.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/edac/altera_edac.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
--- a/drivers/edac/altera_edac.c
+++ b/drivers/edac/altera_edac.c
@@ -1194,10 +1194,22 @@ altr_check_ocram_deps_init(struct altr_e
if (ret)
return ret;
- /* Verify OCRAM has been initialized */
+ /*
+ * Verify that OCRAM has been initialized.
+ * During a warm reset, OCRAM contents are retained, but the control
+ * and status registers are reset to their default values. Therefore,
+ * ECC must be explicitly re-enabled in the control register.
+ * Error condition: if INITCOMPLETEA is clear and ECC_EN is already set.
+ */
if (!ecc_test_bits(ALTR_A10_ECC_INITCOMPLETEA,
- (base + ALTR_A10_ECC_INITSTAT_OFST)))
- return -ENODEV;
+ (base + ALTR_A10_ECC_INITSTAT_OFST))) {
+ if (!ecc_test_bits(ALTR_A10_ECC_EN,
+ (base + ALTR_A10_ECC_CTRL_OFST)))
+ ecc_set_bits(ALTR_A10_ECC_EN,
+ (base + ALTR_A10_ECC_CTRL_OFST));
+ else
+ return -ENODEV;
+ }
/* Enable IRQ on Single Bit Error */
writel(ALTR_A10_ECC_SERRINTEN, (base + ALTR_A10_ECC_ERRINTENS_OFST));
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 410/568] EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (408 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 409/568] EDAC/altera: Handle OCRAM ECC enable after warm reset Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 411/568] btrfs: do not update last_log_commit when logging inode due to a new name Greg Kroah-Hartman
` (164 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niravkumar L Rabara,
Borislav Petkov (AMD), Dinh Nguyen
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
commit 281326be67252ac5794d1383f67526606b1d6b13 upstream.
The current single-bit error injection mechanism flips bits directly in ECC RAM
by performing write and read operations. When the ECC RAM is actively used by
the Ethernet or USB controller, this approach sometimes trigger a false
double-bit error.
Switch both Ethernet and USB EDAC devices to use the INTTEST register
(altr_edac_a10_device_inject_fops) for single-bit error injection, similar to
the existing double-bit error injection method.
Fixes: 064acbd4f4ab ("EDAC, altera: Add Stratix10 peripheral support")
Signed-off-by: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Dinh Nguyen <dinguyen@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251111081333.1279635-1-niravkumarlaxmidas.rabara@altera.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/edac/altera_edac.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/edac/altera_edac.c
+++ b/drivers/edac/altera_edac.c
@@ -1379,7 +1379,7 @@ static const struct edac_device_prv_data
.ue_set_mask = ALTR_A10_ECC_TDERRA,
.set_err_ofst = ALTR_A10_ECC_INTTEST_OFST,
.ecc_irq_handler = altr_edac_a10_ecc_irq,
- .inject_fops = &altr_edac_a10_device_inject2_fops,
+ .inject_fops = &altr_edac_a10_device_inject_fops,
};
#endif /* CONFIG_EDAC_ALTERA_ETHERNET */
@@ -1469,7 +1469,7 @@ static const struct edac_device_prv_data
.ue_set_mask = ALTR_A10_ECC_TDERRA,
.set_err_ofst = ALTR_A10_ECC_INTTEST_OFST,
.ecc_irq_handler = altr_edac_a10_ecc_irq,
- .inject_fops = &altr_edac_a10_device_inject2_fops,
+ .inject_fops = &altr_edac_a10_device_inject_fops,
};
#endif /* CONFIG_EDAC_ALTERA_USB */
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 411/568] btrfs: do not update last_log_commit when logging inode due to a new name
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (409 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 410/568] EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 412/568] selftests: mptcp: connect: trunc: read all recv data Greg Kroah-Hartman
` (163 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vyacheslav Kovalevsky, Filipe Manana,
David Sterba
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
commit bfe3d755ef7cec71aac6ecda34a107624735aac7 upstream.
When logging that a new name exists, we skip updating the inode's
last_log_commit field to prevent a later explicit fsync against the inode
from doing nothing (as updating last_log_commit makes btrfs_inode_in_log()
return true). We are detecting, at btrfs_log_inode(), that logging a new
name is happening by checking the logging mode is not LOG_INODE_EXISTS,
but that is not enough because we may log parent directories when logging
a new name of a file in LOG_INODE_ALL mode - we need to check that the
logging_new_name field of the log context too.
An example scenario where this results in an explicit fsync against a
directory not persisting changes to the directory is the following:
$ mkfs.btrfs -f /dev/sdc
$ mount /dev/sdc /mnt
$ touch /mnt/foo
$ sync
$ mkdir /mnt/dir
# Write some data to our file and fsync it.
$ xfs_io -c "pwrite -S 0xab 0 64K" -c "fsync" /mnt/foo
# Add a new link to our file. Since the file was logged before, we
# update it in the log tree by calling btrfs_log_new_name().
$ ln /mnt/foo /mnt/dir/bar
# fsync the root directory - we expect it to persist the dentry for
# the new directory "dir".
$ xfs_io -c "fsync" /mnt
<power fail>
After mounting the fs the entry for directory "dir" does not exists,
despite the explicit fsync on the root directory.
Here's why this happens:
1) When we fsync the file we log the inode, so that it's present in the
log tree;
2) When adding the new link we enter btrfs_log_new_name(), and since the
inode is in the log tree we proceed to updating the inode in the log
tree;
3) We first set the inode's last_unlink_trans to the current transaction
(early in btrfs_log_new_name());
4) We then eventually enter btrfs_log_inode_parent(), and after logging
the file's inode, we call btrfs_log_all_parents() because the inode's
last_unlink_trans matches the current transaction's ID (updated in the
previous step);
5) So btrfs_log_all_parents() logs the root directory by calling
btrfs_log_inode() for the root's inode with a log mode of LOG_INODE_ALL
so that new dentries are logged;
6) At btrfs_log_inode(), because the log mode is LOG_INODE_ALL, we
update root inode's last_log_commit to the last transaction that
changed the inode (->last_sub_trans field of the inode), which
corresponds to the current transaction's ID;
7) Then later when user space explicitly calls fsync against the root
directory, we enter btrfs_sync_file(), which calls skip_inode_logging()
and that returns true, since its call to btrfs_inode_in_log() returns
true and there are no ordered extents (it's a directory, never has
ordered extents). This results in btrfs_sync_file() returning without
syncing the log or committing the current transaction, so all the
updates we did when logging the new name, including logging the root
directory, are not persisted.
So fix this by but updating the inode's last_log_commit if we are sure
we are not logging a new name (if ctx->logging_new_name is false).
A test case for fstests will follow soon.
Reported-by: Vyacheslav Kovalevsky <slava.kovalevskiy.2014@gmail.com>
Link: https://lore.kernel.org/linux-btrfs/03c5d7ec-5b3d-49d1-95bc-8970a7f82d87@gmail.com/
Fixes: 130341be7ffa ("btrfs: always update the logged transaction when logging new names")
CC: stable@vger.kernel.org # 6.1+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/tree-log.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -6705,7 +6705,7 @@ log_extents:
* a power failure unless the log was synced as part of an fsync
* against any other unrelated inode.
*/
- if (inode_only != LOG_INODE_EXISTS)
+ if (!ctx->logging_new_name && inode_only != LOG_INODE_EXISTS)
inode->last_log_commit = inode->last_sub_trans;
spin_unlock(&inode->lock);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 412/568] selftests: mptcp: connect: trunc: read all recv data
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (410 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 411/568] btrfs: do not update last_log_commit when logging inode due to a new name Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 413/568] virtio-net: fix received length check in big packets Greg Kroah-Hartman
` (162 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geliang Tang, Matthieu Baerts (NGI0),
Jakub Kicinski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
commit ee79980f7a428ec299f6261bea4c1084dcbc9631 upstream.
MPTCP Join "fastclose server" selftest is sometimes failing because the
client output file doesn't have the expected size, e.g. 296B instead of
1024B.
When looking at a packet trace when this happens, the server sent the
expected 1024B in two parts -- 100B, then 924B -- then the MP_FASTCLOSE.
It is then strange to see the client only receiving 296B, which would
mean it only got a part of the second packet. The problem is then not on
the networking side, but rather on the data reception side.
When mptcp_connect is launched with '-f -1', it means the connection
might stop before having sent everything, because a reset has been
received. When this happens, the program was directly stopped. But it is
also possible there are still some data to read, simply because the
previous 'read' step was done with a buffer smaller than the pending
data, see do_rnd_read(). In this case, it is important to read what's
left in the kernel buffers before stopping without error like before.
SIGPIPE is now ignored, not to quit the app before having read
everything.
Fixes: 6bf41020b72b ("selftests: mptcp: update and extend fastclose test-cases")
Cc: stable@vger.kernel.org
Reviewed-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-5-a4332c714e10@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/mptcp/mptcp_connect.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
--- a/tools/testing/selftests/net/mptcp/mptcp_connect.c
+++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c
@@ -655,8 +655,14 @@ static int copyfd_io_poll(int infd, int
bw = do_rnd_write(peerfd, wbuf + woff, wlen);
if (bw < 0) {
- if (cfg_rcv_trunc)
- return 0;
+ /* expected reset, continue to read */
+ if (cfg_rcv_trunc &&
+ (errno == ECONNRESET ||
+ errno == EPIPE)) {
+ fds.events &= ~POLLOUT;
+ continue;
+ }
+
perror("write");
return 111;
}
@@ -682,8 +688,10 @@ static int copyfd_io_poll(int infd, int
}
if (fds.revents & (POLLERR | POLLNVAL)) {
- if (cfg_rcv_trunc)
- return 0;
+ if (cfg_rcv_trunc) {
+ fds.events &= ~(POLLERR | POLLNVAL);
+ continue;
+ }
fprintf(stderr, "Unexpected revents: "
"POLLERR/POLLNVAL(%x)\n", fds.revents);
return 5;
@@ -1332,7 +1340,7 @@ static void parse_opts(int argc, char **
*/
if (cfg_truncate < 0) {
cfg_rcv_trunc = true;
- signal(SIGPIPE, handle_signal);
+ signal(SIGPIPE, SIG_IGN);
}
break;
case 'j':
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 413/568] virtio-net: fix received length check in big packets
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (411 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 412/568] selftests: mptcp: connect: trunc: read all recv data Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 414/568] scsi: ufs: core: Add a quirk to suppress link_startup_again Greg Kroah-Hartman
` (161 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bui Quang Minh, Xuan Zhuo, Lei Yang,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Quang Minh <minhquangbui99@gmail.com>
[ Upstream commit 0c716703965ffc5ef4311b65cb5d84a703784717 ]
Since commit 4959aebba8c0 ("virtio-net: use mtu size as buffer length
for big packets"), when guest gso is off, the allocated size for big
packets is not MAX_SKB_FRAGS * PAGE_SIZE anymore but depends on
negotiated MTU. The number of allocated frags for big packets is stored
in vi->big_packets_num_skbfrags.
Because the host announced buffer length can be malicious (e.g. the host
vhost_net driver's get_rx_bufs is modified to announce incorrect
length), we need a check in virtio_net receive path. Currently, the
check is not adapted to the new change which can lead to NULL page
pointer dereference in the below while loop when receiving length that
is larger than the allocated one.
This commit fixes the received length check corresponding to the new
change.
Fixes: 4959aebba8c0 ("virtio-net: use mtu size as buffer length for big packets")
Cc: stable@vger.kernel.org
Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com>
Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Link: https://patch.msgid.link/20251030144438.7582-1-minhquangbui99@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ adapted page_to_skb() call ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/virtio_net.c | 26 +++++++++++++-------------
1 file changed, 13 insertions(+), 13 deletions(-)
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -542,17 +542,6 @@ static struct sk_buff *page_to_skb(struc
goto ok;
}
- /*
- * Verify that we can indeed put this data into a skb.
- * This is here to handle cases when the device erroneously
- * tries to receive more than is possible. This is usually
- * the case of a broken device.
- */
- if (unlikely(len > MAX_SKB_FRAGS * PAGE_SIZE)) {
- net_dbg_ratelimited("%s: too much data\n", skb->dev->name);
- dev_kfree_skb(skb);
- return NULL;
- }
BUG_ON(offset >= PAGE_SIZE);
while (len) {
unsigned int frag_size = min((unsigned)PAGE_SIZE - offset, len);
@@ -955,8 +944,19 @@ static struct sk_buff *receive_big(struc
struct virtnet_rq_stats *stats)
{
struct page *page = buf;
- struct sk_buff *skb =
- page_to_skb(vi, rq, page, 0, len, PAGE_SIZE, true, 0, 0);
+ struct sk_buff *skb;
+
+ /* Make sure that len does not exceed the size allocated in
+ * add_recvbuf_big.
+ */
+ if (unlikely(len > (vi->big_packets_num_skbfrags + 1) * PAGE_SIZE)) {
+ pr_debug("%s: rx error: len %u exceeds allocated size %lu\n",
+ dev->name, len,
+ (vi->big_packets_num_skbfrags + 1) * PAGE_SIZE);
+ goto err;
+ }
+
+ skb = page_to_skb(vi, rq, page, 0, len, PAGE_SIZE, true, 0, 0);
stats->bytes += len - vi->hdr_len;
if (unlikely(!skb))
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 414/568] scsi: ufs: core: Add a quirk to suppress link_startup_again
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (412 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 413/568] virtio-net: fix received length check in big packets Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-04 16:53 ` Barry K. Nathan
2025-12-03 15:26 ` [PATCH 6.1 415/568] scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL Greg Kroah-Hartman
` (160 subsequent siblings)
574 siblings, 1 reply; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Bart Van Assche,
Martin K. Petersen
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <adrian.hunter@intel.com>
ufshcd_link_startup() has a facility (link_startup_again) to issue
DME_LINKSTARTUP a 2nd time even though the 1st time was successful.
Some older hardware benefits from that, however the behaviour is
non-standard, and has been found to cause link startup to be unreliable
for some Intel Alder Lake based host controllers.
Add UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE to suppress
link_startup_again, in preparation for setting the quirk for affected
controllers.
Fixes: 7dc9fb47bc9a ("scsi: ufs: ufs-pci: Add support for Intel ADL")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20251024085918.31825-3-adrian.hunter@intel.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ufs/core/ufshcd.c | 3 ++-
include/ufs/ufshcd.h | 7 +++++++
2 files changed, 9 insertions(+), 1 deletion(-)
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -4778,7 +4778,8 @@ static int ufshcd_link_startup(struct uf
* If UFS device isn't active then we will have to issue link startup
* 2 times to make sure the device state move to active.
*/
- if (!ufshcd_is_ufs_dev_active(hba))
+ if (!(hba->quirks & UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE) &&
+ !ufshcd_is_ufs_dev_active(hba))
link_startup_again = true;
link_startup:
--- a/include/ufs/ufshcd.h
+++ b/include/ufs/ufshcd.h
@@ -592,6 +592,13 @@ enum ufshcd_quirks {
* auto-hibernate capability but it's FASTAUTO only.
*/
UFSHCD_QUIRK_HIBERN_FASTAUTO = 1 << 18,
+
+ /*
+ * This quirk indicates that DME_LINKSTARTUP should not be issued a 2nd
+ * time (refer link_startup_again) after the 1st time was successful,
+ * because it causes link startup to become unreliable.
+ */
+ UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE = 1 << 19,
};
enum ufshcd_caps {
^ permalink raw reply [flat|nested] 588+ messages in thread* Re: [PATCH 6.1 414/568] scsi: ufs: core: Add a quirk to suppress link_startup_again
2025-12-03 15:26 ` [PATCH 6.1 414/568] scsi: ufs: core: Add a quirk to suppress link_startup_again Greg Kroah-Hartman
@ 2025-12-04 16:53 ` Barry K. Nathan
2025-12-06 21:11 ` Greg Kroah-Hartman
0 siblings, 1 reply; 588+ messages in thread
From: Barry K. Nathan @ 2025-12-04 16:53 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, Adrian Hunter, Bart Van Assche, Martin K. Petersen
On 12/3/25 07:26, Greg Kroah-Hartman wrote:
> 6.1-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Adrian Hunter <adrian.hunter@intel.com>
>
> ufshcd_link_startup() has a facility (link_startup_again) to issue
> DME_LINKSTARTUP a 2nd time even though the 1st time was successful.
>
> Some older hardware benefits from that, however the behaviour is
> non-standard, and has been found to cause link startup to be unreliable
> for some Intel Alder Lake based host controllers.
>
> Add UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE to suppress
> link_startup_again, in preparation for setting the quirk for affected
> controllers.
>
> Fixes: 7dc9fb47bc9a ("scsi: ufs: ufs-pci: Add support for Intel ADL")
> Cc: stable@vger.kernel.org
> Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
> Reviewed-by: Bart Van Assche <bvanassche@acm.org>
> Link: https://patch.msgid.link/20251024085918.31825-3-adrian.hunter@intel.com
> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
This backport's commit message is missing the corresponding upstream
commit (which is d34caa89a132cd69efc48361d4772251546fdb88).
--
-Barry K. Nathan <barryn@pobox.com>
^ permalink raw reply [flat|nested] 588+ messages in thread* Re: [PATCH 6.1 414/568] scsi: ufs: core: Add a quirk to suppress link_startup_again
2025-12-04 16:53 ` Barry K. Nathan
@ 2025-12-06 21:11 ` Greg Kroah-Hartman
0 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-06 21:11 UTC (permalink / raw)
To: Barry K. Nathan
Cc: stable, patches, Adrian Hunter, Bart Van Assche,
Martin K. Petersen
On Thu, Dec 04, 2025 at 08:53:12AM -0800, Barry K. Nathan wrote:
> On 12/3/25 07:26, Greg Kroah-Hartman wrote:
> > 6.1-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Adrian Hunter <adrian.hunter@intel.com>
> >
> > ufshcd_link_startup() has a facility (link_startup_again) to issue
> > DME_LINKSTARTUP a 2nd time even though the 1st time was successful.
> >
> > Some older hardware benefits from that, however the behaviour is
> > non-standard, and has been found to cause link startup to be unreliable
> > for some Intel Alder Lake based host controllers.
> >
> > Add UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE to suppress
> > link_startup_again, in preparation for setting the quirk for affected
> > controllers.
> >
> > Fixes: 7dc9fb47bc9a ("scsi: ufs: ufs-pci: Add support for Intel ADL")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
> > Reviewed-by: Bart Van Assche <bvanassche@acm.org>
> > Link: https://patch.msgid.link/20251024085918.31825-3-adrian.hunter@intel.com
> > Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > ---
>
> This backport's commit message is missing the corresponding upstream commit
> (which is d34caa89a132cd69efc48361d4772251546fdb88).
Ah, good catch, don't know how I missed that, thanks!
greg k-h
^ permalink raw reply [flat|nested] 588+ messages in thread
* [PATCH 6.1 415/568] scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (413 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 414/568] scsi: ufs: core: Add a quirk to suppress link_startup_again Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 416/568] iommufd: Dont overflow during division for dirty tracking Greg Kroah-Hartman
` (159 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Bart Van Assche,
Martin K. Petersen, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <adrian.hunter@intel.com>
[ Upstream commit d968e99488c4b08259a324a89e4ed17bf36561a4 ]
Link startup becomes unreliable for Intel Alder Lake based host
controllers when a 2nd DME_LINKSTARTUP is issued unnecessarily. Employ
UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE to suppress that from happening.
Fixes: 7dc9fb47bc9a ("scsi: ufs: ufs-pci: Add support for Intel ADL")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20251024085918.31825-4-adrian.hunter@intel.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
[ adjusted patch context line numbers from 428 to 460 due to prerequisite backport ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ufs/host/ufshcd-pci.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/ufs/host/ufshcd-pci.c
+++ b/drivers/ufs/host/ufshcd-pci.c
@@ -463,7 +463,8 @@ static int ufs_intel_lkf_init(struct ufs
static int ufs_intel_adl_init(struct ufs_hba *hba)
{
hba->nop_out_timeout = 200;
- hba->quirks |= UFSHCD_QUIRK_BROKEN_AUTO_HIBERN8;
+ hba->quirks |= UFSHCD_QUIRK_BROKEN_AUTO_HIBERN8 |
+ UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE;
hba->caps |= UFSHCD_CAP_WB_EN;
return ufs_intel_common_init(hba);
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 416/568] iommufd: Dont overflow during division for dirty tracking
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (414 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 415/568] scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 6.1 417/568] KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated Greg Kroah-Hartman
` (158 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joao Martins, Nicolin Chen,
Kevin Tian, syzbot+093a8a8b859472e6c257, Jason Gunthorpe,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <jgg@ziepe.ca>
[ Upstream commit cb30dfa75d55eced379a42fd67bd5fb7ec38555e ]
If pgshift is 63 then BITS_PER_TYPE(*bitmap->bitmap) * pgsize will overflow
to 0 and this triggers divide by 0.
In this case the index should just be 0, so reorganize things to divide
by shift and avoid hitting any overflows.
Link: https://patch.msgid.link/r/0-v1-663679b57226+172-iommufd_dirty_div0_jgg@nvidia.com
Cc: stable@vger.kernel.org
Fixes: 58ccf0190d19 ("vfio: Add an IOVA bitmap support")
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reported-by: syzbot+093a8a8b859472e6c257@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=093a8a8b859472e6c257
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
[ drivers/iommu/iommufd/iova_bitmap.c => drivers/vfio/iova_bitmap.c ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vfio/iova_bitmap.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/vfio/iova_bitmap.c
+++ b/drivers/vfio/iova_bitmap.c
@@ -126,9 +126,8 @@ struct iova_bitmap {
static unsigned long iova_bitmap_offset_to_index(struct iova_bitmap *bitmap,
unsigned long iova)
{
- unsigned long pgsize = 1UL << bitmap->mapped.pgshift;
-
- return iova / (BITS_PER_TYPE(*bitmap->bitmap) * pgsize);
+ return (iova >> bitmap->mapped.pgshift) /
+ BITS_PER_TYPE(*bitmap->bitmap);
}
/*
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 417/568] KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (415 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 416/568] iommufd: Dont overflow during division for dirty tracking Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 418/568] net: netpoll: fix incorrect refcount handling causing incorrect cleanup Greg Kroah-Hartman
` (157 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matteo Rizzo, evn, Jim Mattson,
Yosry Ahmed, Paolo Bonzini, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yosry Ahmed <yosry.ahmed@linux.dev>
[ Upstream commit dc55b3c3f61246e483e50c85d8d5366f9567e188 ]
The APM lists the DbgCtlMsr field as being tracked by the VMCB_LBR clean
bit. Always clear the bit when MSR_IA32_DEBUGCTLMSR is updated.
The history is complicated, it was correctly cleared for L1 before
commit 1d5a1b5860ed ("KVM: x86: nSVM: correctly virtualize LBR msrs when
L2 is running"). At that point svm_set_msr() started to rely on
svm_update_lbrv() to clear the bit, but when nested virtualization
is enabled the latter does not always clear it even if MSR_IA32_DEBUGCTLMSR
changed. Go back to clearing it directly in svm_set_msr().
Fixes: 1d5a1b5860ed ("KVM: x86: nSVM: correctly virtualize LBR msrs when L2 is running")
Reported-by: Matteo Rizzo <matteorizzo@google.com>
Reported-by: evn@google.com
Co-developed-by: Jim Mattson <jmattson@google.com>
Signed-off-by: Jim Mattson <jmattson@google.com>
Signed-off-by: Yosry Ahmed <yosry.ahmed@linux.dev>
Link: https://patch.msgid.link/20251108004524.1600006-2-yosry.ahmed@linux.dev
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[ Open coded svm_get_lbr_vmcb() call ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/svm/svm.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -3053,11 +3053,17 @@ static int svm_set_msr(struct kvm_vcpu *
if (data & DEBUGCTL_RESERVED_BITS)
return 1;
- if (svm->vmcb->control.virt_ext & LBR_CTL_ENABLE_MASK)
+ if (svm->vmcb->control.virt_ext & LBR_CTL_ENABLE_MASK) {
+ if (svm->vmcb->save.dbgctl == data)
+ break;
svm->vmcb->save.dbgctl = data;
- else
+ } else {
+ if (svm->vmcb01.ptr->save.dbgctl == data)
+ break;
svm->vmcb01.ptr->save.dbgctl = data;
+ }
+ vmcb_mark_dirty(svm->vmcb, VMCB_LBR);
svm_update_lbrv(vcpu);
break;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 418/568] net: netpoll: fix incorrect refcount handling causing incorrect cleanup
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (416 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 6.1 417/568] KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 419/568] eventpoll: Replace rwlock with spinlock Greg Kroah-Hartman
` (156 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jay Vosburgh, Breno Leitao,
Simon Horman, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
[ Upstream commit 49c8d2c1f94cc2f4d1a108530d7ba52614b874c2 ]
commit efa95b01da18 ("netpoll: fix use after free") incorrectly
ignored the refcount and prematurely set dev->npinfo to NULL during
netpoll cleanup, leading to improper behavior and memory leaks.
Scenario causing lack of proper cleanup:
1) A netpoll is associated with a NIC (e.g., eth0) and netdev->npinfo is
allocated, and refcnt = 1
- Keep in mind that npinfo is shared among all netpoll instances. In
this case, there is just one.
2) Another netpoll is also associated with the same NIC and
npinfo->refcnt += 1.
- Now dev->npinfo->refcnt = 2;
- There is just one npinfo associated to the netdev.
3) When the first netpolls goes to clean up:
- The first cleanup succeeds and clears np->dev->npinfo, ignoring
refcnt.
- It basically calls `RCU_INIT_POINTER(np->dev->npinfo, NULL);`
- Set dev->npinfo = NULL, without proper cleanup
- No ->ndo_netpoll_cleanup() is either called
4) Now the second target tries to clean up
- The second cleanup fails because np->dev->npinfo is already NULL.
* In this case, ops->ndo_netpoll_cleanup() was never called, and
the skb pool is not cleaned as well (for the second netpoll
instance)
- This leaks npinfo and skbpool skbs, which is clearly reported by
kmemleak.
Revert commit efa95b01da18 ("netpoll: fix use after free") and adds
clarifying comments emphasizing that npinfo cleanup should only happen
once the refcount reaches zero, ensuring stable and correct netpoll
behavior.
Cc: <stable@vger.kernel.org> # 3.17.x
Cc: Jay Vosburgh <jv@jvosburgh.net>
Fixes: efa95b01da18 ("netpoll: fix use after free")
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251107-netconsole_torture-v10-1-749227b55f63@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ Adjust context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/netpoll.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -851,6 +851,10 @@ void __netpoll_cleanup(struct netpoll *n
synchronize_srcu(&netpoll_srcu);
+ /* At this point, there is a single npinfo instance per netdevice, and
+ * its refcnt tracks how many netpoll structures are linked to it. We
+ * only perform npinfo cleanup when the refcnt decrements to zero.
+ */
if (refcount_dec_and_test(&npinfo->refcnt)) {
const struct net_device_ops *ops;
@@ -860,8 +864,7 @@ void __netpoll_cleanup(struct netpoll *n
RCU_INIT_POINTER(np->dev->npinfo, NULL);
call_rcu(&npinfo->rcu, rcu_cleanup_netpoll_info);
- } else
- RCU_INIT_POINTER(np->dev->npinfo, NULL);
+ }
}
EXPORT_SYMBOL_GPL(__netpoll_cleanup);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 419/568] eventpoll: Replace rwlock with spinlock
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (417 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 418/568] net: netpoll: fix incorrect refcount handling causing incorrect cleanup Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 420/568] mm, percpu: do not consider sleepable allocations atomic Greg Kroah-Hartman
` (155 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nam Cao, K Prateek Nayak,
Frederic Weisbecker, Valentin Schneider, Christian Brauner,
Florian Bezdeka
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <namcao@linutronix.de>
[ Upstream commit 0c43094f8cc9d3d99d835c0ac9c4fe1ccc62babd ]
The ready event list of an epoll object is protected by read-write
semaphore:
- The consumer (waiter) acquires the write lock and takes items.
- the producer (waker) takes the read lock and adds items.
The point of this design is enabling epoll to scale well with large number
of producers, as multiple producers can hold the read lock at the same
time.
Unfortunately, this implementation may cause scheduling priority inversion
problem. Suppose the consumer has higher scheduling priority than the
producer. The consumer needs to acquire the write lock, but may be blocked
by the producer holding the read lock. Since read-write semaphore does not
support priority-boosting for the readers (even with CONFIG_PREEMPT_RT=y),
we have a case of priority inversion: a higher priority consumer is blocked
by a lower priority producer. This problem was reported in [1].
Furthermore, this could also cause stall problem, as described in [2].
Fix this problem by replacing rwlock with spinlock.
This reduces the event bandwidth, as the producers now have to contend with
each other for the spinlock. According to the benchmark from
https://github.com/rouming/test-tools/blob/master/stress-epoll.c:
On 12 x86 CPUs:
Before After Diff
threads events/ms events/ms
8 7162 4956 -31%
16 8733 5383 -38%
32 7968 5572 -30%
64 10652 5739 -46%
128 11236 5931 -47%
On 4 riscv CPUs:
Before After Diff
threads events/ms events/ms
8 2958 2833 -4%
16 3323 3097 -7%
32 3451 3240 -6%
64 3554 3178 -11%
128 3601 3235 -10%
Although the numbers look bad, it should be noted that this benchmark
creates multiple threads who do nothing except constantly generating new
epoll events, thus contention on the spinlock is high. For real workload,
the event rate is likely much lower, and the performance drop is not as
bad.
Using another benchmark (perf bench epoll wait) where spinlock contention
is lower, improvement is even observed on x86:
On 12 x86 CPUs:
Before: Averaged 110279 operations/sec (+- 1.09%), total secs = 8
After: Averaged 114577 operations/sec (+- 2.25%), total secs = 8
On 4 riscv CPUs:
Before: Averaged 175767 operations/sec (+- 0.62%), total secs = 8
After: Averaged 167396 operations/sec (+- 0.23%), total secs = 8
In conclusion, no one is likely to be upset over this change. After all,
spinlock was used originally for years, and the commit which converted to
rwlock didn't mention a real workload, just that the benchmark numbers are
nice.
This patch is not exactly the revert of commit a218cc491420 ("epoll: use
rwlock in order to reduce ep_poll_callback() contention"), because git
revert conflicts in some places which are not obvious on the resolution.
This patch is intended to be backported, therefore go with the obvious
approach:
- Replace rwlock_t with spinlock_t one to one
- Delete list_add_tail_lockless() and chain_epi_lockless(). These were
introduced to allow producers to concurrently add items to the list.
But now that spinlock no longer allows producers to touch the event
list concurrently, these two functions are not necessary anymore.
Fixes: a218cc491420 ("epoll: use rwlock in order to reduce ep_poll_callback() contention")
Signed-off-by: Nam Cao <namcao@linutronix.de>
Link: https://lore.kernel.org/ec92458ea357ec503c737ead0f10b2c6e4c37d47.1752581388.git.namcao@linutronix.de
Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
Cc: stable@vger.kernel.org
Reported-by: Frederic Weisbecker <frederic@kernel.org>
Closes: https://lore.kernel.org/linux-rt-users/20210825132754.GA895675@lothringen/ [1]
Reported-by: Valentin Schneider <vschneid@redhat.com>
Closes: https://lore.kernel.org/linux-rt-users/xhsmhttqvnall.mognet@vschneid.remote.csb/ [2]
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Florian Bezdeka <florian.bezdeka@siemens.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/eventpoll.c | 139 ++++++++++-----------------------------------------------
1 file changed, 26 insertions(+), 113 deletions(-)
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -45,10 +45,10 @@
*
* 1) epmutex (mutex)
* 2) ep->mtx (mutex)
- * 3) ep->lock (rwlock)
+ * 3) ep->lock (spinlock)
*
* The acquire order is the one listed above, from 1 to 3.
- * We need a rwlock (ep->lock) because we manipulate objects
+ * We need a spinlock (ep->lock) because we manipulate objects
* from inside the poll callback, that might be triggered from
* a wake_up() that in turn might be called from IRQ context.
* So we can't sleep inside the poll callback and hence we need
@@ -193,7 +193,7 @@ struct eventpoll {
struct list_head rdllist;
/* Lock which protects rdllist and ovflist */
- rwlock_t lock;
+ spinlock_t lock;
/* RB tree root used to store monitored fd structs */
struct rb_root_cached rbr;
@@ -621,10 +621,10 @@ static void ep_start_scan(struct eventpo
* in a lockless way.
*/
lockdep_assert_irqs_enabled();
- write_lock_irq(&ep->lock);
+ spin_lock_irq(&ep->lock);
list_splice_init(&ep->rdllist, txlist);
WRITE_ONCE(ep->ovflist, NULL);
- write_unlock_irq(&ep->lock);
+ spin_unlock_irq(&ep->lock);
}
static void ep_done_scan(struct eventpoll *ep,
@@ -632,7 +632,7 @@ static void ep_done_scan(struct eventpol
{
struct epitem *epi, *nepi;
- write_lock_irq(&ep->lock);
+ spin_lock_irq(&ep->lock);
/*
* During the time we spent inside the "sproc" callback, some
* other events might have been queued by the poll callback.
@@ -673,7 +673,7 @@ static void ep_done_scan(struct eventpol
wake_up(&ep->wq);
}
- write_unlock_irq(&ep->lock);
+ spin_unlock_irq(&ep->lock);
}
static void epi_rcu_free(struct rcu_head *head)
@@ -719,10 +719,10 @@ static int ep_remove(struct eventpoll *e
rb_erase_cached(&epi->rbn, &ep->rbr);
- write_lock_irq(&ep->lock);
+ spin_lock_irq(&ep->lock);
if (ep_is_linked(epi))
list_del_init(&epi->rdllink);
- write_unlock_irq(&ep->lock);
+ spin_unlock_irq(&ep->lock);
wakeup_source_unregister(ep_wakeup_source(epi));
/*
@@ -986,7 +986,7 @@ static int ep_alloc(struct eventpoll **p
goto free_uid;
mutex_init(&ep->mtx);
- rwlock_init(&ep->lock);
+ spin_lock_init(&ep->lock);
init_waitqueue_head(&ep->wq);
init_waitqueue_head(&ep->poll_wait);
INIT_LIST_HEAD(&ep->rdllist);
@@ -1077,99 +1077,9 @@ struct file *get_epoll_tfile_raw_ptr(str
#endif /* CONFIG_KCMP */
/*
- * Adds a new entry to the tail of the list in a lockless way, i.e.
- * multiple CPUs are allowed to call this function concurrently.
- *
- * Beware: it is necessary to prevent any other modifications of the
- * existing list until all changes are completed, in other words
- * concurrent list_add_tail_lockless() calls should be protected
- * with a read lock, where write lock acts as a barrier which
- * makes sure all list_add_tail_lockless() calls are fully
- * completed.
- *
- * Also an element can be locklessly added to the list only in one
- * direction i.e. either to the tail or to the head, otherwise
- * concurrent access will corrupt the list.
- *
- * Return: %false if element has been already added to the list, %true
- * otherwise.
- */
-static inline bool list_add_tail_lockless(struct list_head *new,
- struct list_head *head)
-{
- struct list_head *prev;
-
- /*
- * This is simple 'new->next = head' operation, but cmpxchg()
- * is used in order to detect that same element has been just
- * added to the list from another CPU: the winner observes
- * new->next == new.
- */
- if (!try_cmpxchg(&new->next, &new, head))
- return false;
-
- /*
- * Initially ->next of a new element must be updated with the head
- * (we are inserting to the tail) and only then pointers are atomically
- * exchanged. XCHG guarantees memory ordering, thus ->next should be
- * updated before pointers are actually swapped and pointers are
- * swapped before prev->next is updated.
- */
-
- prev = xchg(&head->prev, new);
-
- /*
- * It is safe to modify prev->next and new->prev, because a new element
- * is added only to the tail and new->next is updated before XCHG.
- */
-
- prev->next = new;
- new->prev = prev;
-
- return true;
-}
-
-/*
- * Chains a new epi entry to the tail of the ep->ovflist in a lockless way,
- * i.e. multiple CPUs are allowed to call this function concurrently.
- *
- * Return: %false if epi element has been already chained, %true otherwise.
- */
-static inline bool chain_epi_lockless(struct epitem *epi)
-{
- struct eventpoll *ep = epi->ep;
-
- /* Fast preliminary check */
- if (epi->next != EP_UNACTIVE_PTR)
- return false;
-
- /* Check that the same epi has not been just chained from another CPU */
- if (cmpxchg(&epi->next, EP_UNACTIVE_PTR, NULL) != EP_UNACTIVE_PTR)
- return false;
-
- /* Atomically exchange tail */
- epi->next = xchg(&ep->ovflist, epi);
-
- return true;
-}
-
-/*
* This is the callback that is passed to the wait queue wakeup
* mechanism. It is called by the stored file descriptors when they
* have events to report.
- *
- * This callback takes a read lock in order not to contend with concurrent
- * events from another file descriptor, thus all modifications to ->rdllist
- * or ->ovflist are lockless. Read lock is paired with the write lock from
- * ep_scan_ready_list(), which stops all list modifications and guarantees
- * that lists state is seen correctly.
- *
- * Another thing worth to mention is that ep_poll_callback() can be called
- * concurrently for the same @epi from different CPUs if poll table was inited
- * with several wait queues entries. Plural wakeup from different CPUs of a
- * single wait queue is serialized by wq.lock, but the case when multiple wait
- * queues are used should be detected accordingly. This is detected using
- * cmpxchg() operation.
*/
static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, void *key)
{
@@ -1180,7 +1090,7 @@ static int ep_poll_callback(wait_queue_e
unsigned long flags;
int ewake = 0;
- read_lock_irqsave(&ep->lock, flags);
+ spin_lock_irqsave(&ep->lock, flags);
ep_set_busy_poll_napi_id(epi);
@@ -1209,12 +1119,15 @@ static int ep_poll_callback(wait_queue_e
* chained in ep->ovflist and requeued later on.
*/
if (READ_ONCE(ep->ovflist) != EP_UNACTIVE_PTR) {
- if (chain_epi_lockless(epi))
+ if (epi->next == EP_UNACTIVE_PTR) {
+ epi->next = READ_ONCE(ep->ovflist);
+ WRITE_ONCE(ep->ovflist, epi);
ep_pm_stay_awake_rcu(epi);
+ }
} else if (!ep_is_linked(epi)) {
/* In the usual case, add event to ready list. */
- if (list_add_tail_lockless(&epi->rdllink, &ep->rdllist))
- ep_pm_stay_awake_rcu(epi);
+ list_add_tail(&epi->rdllink, &ep->rdllist);
+ ep_pm_stay_awake_rcu(epi);
}
/*
@@ -1247,7 +1160,7 @@ static int ep_poll_callback(wait_queue_e
pwake++;
out_unlock:
- read_unlock_irqrestore(&ep->lock, flags);
+ spin_unlock_irqrestore(&ep->lock, flags);
/* We have to call this outside the lock */
if (pwake)
@@ -1576,7 +1489,7 @@ static int ep_insert(struct eventpoll *e
}
/* We have to drop the new item inside our item list to keep track of it */
- write_lock_irq(&ep->lock);
+ spin_lock_irq(&ep->lock);
/* record NAPI ID of new item if present */
ep_set_busy_poll_napi_id(epi);
@@ -1593,7 +1506,7 @@ static int ep_insert(struct eventpoll *e
pwake++;
}
- write_unlock_irq(&ep->lock);
+ spin_unlock_irq(&ep->lock);
/* We have to call this outside the lock */
if (pwake)
@@ -1657,7 +1570,7 @@ static int ep_modify(struct eventpoll *e
* list, push it inside.
*/
if (ep_item_poll(epi, &pt, 1)) {
- write_lock_irq(&ep->lock);
+ spin_lock_irq(&ep->lock);
if (!ep_is_linked(epi)) {
list_add_tail(&epi->rdllink, &ep->rdllist);
ep_pm_stay_awake(epi);
@@ -1668,7 +1581,7 @@ static int ep_modify(struct eventpoll *e
if (waitqueue_active(&ep->poll_wait))
pwake++;
}
- write_unlock_irq(&ep->lock);
+ spin_unlock_irq(&ep->lock);
}
/* We have to call this outside the lock */
@@ -1901,7 +1814,7 @@ static int ep_poll(struct eventpoll *ep,
init_wait(&wait);
wait.func = ep_autoremove_wake_function;
- write_lock_irq(&ep->lock);
+ spin_lock_irq(&ep->lock);
/*
* Barrierless variant, waitqueue_active() is called under
* the same lock on wakeup ep_poll_callback() side, so it
@@ -1920,7 +1833,7 @@ static int ep_poll(struct eventpoll *ep,
if (!eavail)
__add_wait_queue_exclusive(&ep->wq, &wait);
- write_unlock_irq(&ep->lock);
+ spin_unlock_irq(&ep->lock);
if (!eavail)
timed_out = !schedule_hrtimeout_range(to, slack,
@@ -1935,7 +1848,7 @@ static int ep_poll(struct eventpoll *ep,
eavail = 1;
if (!list_empty_careful(&wait.entry)) {
- write_lock_irq(&ep->lock);
+ spin_lock_irq(&ep->lock);
/*
* If the thread timed out and is not on the wait queue,
* it means that the thread was woken up after its
@@ -1946,7 +1859,7 @@ static int ep_poll(struct eventpoll *ep,
if (timed_out)
eavail = list_empty(&wait.entry);
__remove_wait_queue(&ep->wq, &wait);
- write_unlock_irq(&ep->lock);
+ spin_unlock_irq(&ep->lock);
}
}
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 420/568] mm, percpu: do not consider sleepable allocations atomic
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (418 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 419/568] eventpoll: Replace rwlock with spinlock Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 421/568] isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() Greg Kroah-Hartman
` (154 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michal Hocko, Vlastimil Babka,
Dennis Zhou, Filipe David Manana, Tejun Heo, Andrew Morton,
chenxin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Hocko <mhocko@suse.com>
[ Upstream commit 9a5b183941b52f84c0f9e5f27ce44e99318c9e0f ]
28307d938fb2 ("percpu: make pcpu_alloc() aware of current gfp context")
has fixed a reclaim recursion for scoped GFP_NOFS context. It has done
that by avoiding taking pcpu_alloc_mutex. This is a correct solution as
the worker context with full GFP_KERNEL allocation/reclaim power and which
is using the same lock cannot block the NOFS pcpu_alloc caller.
On the other hand this is a very conservative approach that could lead to
failures because pcpu_alloc lockless implementation is quite limited.
We have a bug report about premature failures when scsi array of 193
devices is scanned. Sometimes (not consistently) the scanning aborts
because the iscsid daemon fails to create the queue for a random scsi
device during the scan. iscsid itself is running with PR_SET_IO_FLUSHER
set so all allocations from this process context are GFP_NOIO. This in
turn makes any pcpu_alloc lockless (without pcpu_alloc_mutex) which leads
to pre-mature failures.
It has turned out that iscsid has worked around this by dropping
PR_SET_IO_FLUSHER (https://github.com/open-iscsi/open-iscsi/pull/382) when
scanning host. But we can do better in this case on the kernel side and
use pcpu_alloc_mutex for NOIO resp. NOFS constrained allocation scopes
too. We just need the WQ worker to never trigger IO/FS reclaim. Achieve
that by enforcing scoped GFP_NOIO for the whole execution of
pcpu_balance_workfn (this will imply NOFS constrain as well). This will
remove the dependency chain and preserve the full allocation power of the
pcpu_alloc call.
While at it make is_atomic really test for blockable allocations.
Link: https://lkml.kernel.org/r/20250206122633.167896-1-mhocko@kernel.org
Fixes: 28307d938fb2 ("percpu: make pcpu_alloc() aware of current gfp context")
Signed-off-by: Michal Hocko <mhocko@suse.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Dennis Zhou <dennis@kernel.org>
Cc: Filipe David Manana <fdmanana@suse.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: chenxin <chenxinxin@xiaomi.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/percpu.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -1737,7 +1737,7 @@ static void __percpu *pcpu_alloc(size_t
gfp = current_gfp_context(gfp);
/* whitelisted flags that can be passed to the backing allocators */
pcpu_gfp = gfp & (GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN);
- is_atomic = (gfp & GFP_KERNEL) != GFP_KERNEL;
+ is_atomic = !gfpflags_allow_blocking(gfp);
do_warn = !(gfp & __GFP_NOWARN);
/*
@@ -2237,7 +2237,12 @@ static void pcpu_balance_workfn(struct w
* to grow other chunks. This then gives pcpu_reclaim_populated() time
* to move fully free chunks to the active list to be freed if
* appropriate.
+ *
+ * Enforce GFP_NOIO allocations because we have pcpu_alloc users
+ * constrained to GFP_NOIO/NOFS contexts and they could form lock
+ * dependency through pcpu_alloc_mutex
*/
+ unsigned int flags = memalloc_noio_save();
mutex_lock(&pcpu_alloc_mutex);
spin_lock_irq(&pcpu_lock);
@@ -2248,6 +2253,7 @@ static void pcpu_balance_workfn(struct w
spin_unlock_irq(&pcpu_lock);
mutex_unlock(&pcpu_alloc_mutex);
+ memalloc_noio_restore(flags);
}
/**
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 421/568] isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (419 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 420/568] mm, percpu: do not consider sleepable allocations atomic Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 422/568] asm-generic: partially revert "Unify uapi bitsperlong.h for arm64, riscv and loongarch" Greg Kroah-Hartman
` (153 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Jakub Kicinski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 3f978e3f1570155a1327ffa25f60968bc7b9398f upstream.
In hfcsusb_probe(), the memory allocated for ctrl_urb gets leaked when
setup_instance() fails with an error code. Fix that by freeing the urb
before freeing the hw structure. Also change the error paths to use the
goto ladder style.
Compile tested only. Issue found using a prototype static analysis tool.
Fixes: 69f52adb2d53 ("mISDN: Add HFC USB driver")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Link: https://patch.msgid.link/20251030042524.194812-1-nihaal@cse.iitm.ac.in
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/isdn/hardware/mISDN/hfcsusb.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
+++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
@@ -1903,13 +1903,13 @@ out:
mISDN_freebchannel(&hw->bch[1]);
mISDN_freebchannel(&hw->bch[0]);
mISDN_freedchannel(&hw->dch);
- kfree(hw);
return err;
}
static int
hfcsusb_probe(struct usb_interface *intf, const struct usb_device_id *id)
{
+ int err;
struct hfcsusb *hw;
struct usb_device *dev = interface_to_usbdev(intf);
struct usb_host_interface *iface = intf->cur_altsetting;
@@ -2100,20 +2100,28 @@ hfcsusb_probe(struct usb_interface *intf
if (!hw->ctrl_urb) {
pr_warn("%s: No memory for control urb\n",
driver_info->vend_name);
- kfree(hw);
- return -ENOMEM;
+ err = -ENOMEM;
+ goto err_free_hw;
}
pr_info("%s: %s: detected \"%s\" (%s, if=%d alt=%d)\n",
hw->name, __func__, driver_info->vend_name,
conf_str[small_match], ifnum, alt_used);
- if (setup_instance(hw, dev->dev.parent))
- return -EIO;
+ if (setup_instance(hw, dev->dev.parent)) {
+ err = -EIO;
+ goto err_free_urb;
+ }
hw->intf = intf;
usb_set_intfdata(hw->intf, hw);
return 0;
+
+err_free_urb:
+ usb_free_urb(hw->ctrl_urb);
+err_free_hw:
+ kfree(hw);
+ return err;
}
/* function called when an active device is removed */
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 422/568] asm-generic: partially revert "Unify uapi bitsperlong.h for arm64, riscv and loongarch"
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (420 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 421/568] isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 423/568] net/mlx5: Fix memory leak in error flow of port set buffer Greg Kroah-Hartman
` (152 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Chancellor, Catalin Marinas,
Palmer Dabbelt, Arnd Bergmann
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 6e8d96909a23c8078ee965bd48bb31cbef2de943 upstream.
Unifying the asm-generic headers across 32-bit and 64-bit architectures
based on the compiler provided macros was a good idea and appears to work
with all user space, but it caused a regression when building old kernels
on systems that have the new headers installed in /usr/include, as this
combination trips an inconsistency in the kernel's own tools/include
headers that are a mix of userspace and kernel-internal headers.
This affects kernel builds on arm64, riscv64 and loongarch64 systems that
might end up using the "#define __BITS_PER_LONG 32" default from the old
tools headers. Backporting the commit into stable kernels would address
this, but it would still break building kernels without that backport,
and waste time for developers trying to understand the problem.
arm64 build machines are rather common, and on riscv64 this can also
happen in practice, but loongarch64 is probably new enough to not
be used much for building old kernels, so only revert the bits
for arm64 and riscv.
Link: https://lore.kernel.org/all/20230731160402.GB1823389@dev-arch.thelio-3990X/
Reported-by: Nathan Chancellor <nathan@kernel.org>
Fixes: 8386f58f8deda ("asm-generic: Unify uapi bitsperlong.h for arm64, riscv and loongarch")
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Acked-by: Palmer Dabbelt <palmer@rivosinc.com>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/uapi/asm/bitsperlong.h | 24 ++++++++++++++++++++++++
arch/riscv/include/uapi/asm/bitsperlong.h | 14 ++++++++++++++
tools/arch/arm64/include/uapi/asm/bitsperlong.h | 24 ++++++++++++++++++++++++
tools/arch/riscv/include/uapi/asm/bitsperlong.h | 14 ++++++++++++++
4 files changed, 76 insertions(+)
create mode 100644 arch/arm64/include/uapi/asm/bitsperlong.h
create mode 100644 arch/riscv/include/uapi/asm/bitsperlong.h
create mode 100644 tools/arch/arm64/include/uapi/asm/bitsperlong.h
create mode 100644 tools/arch/riscv/include/uapi/asm/bitsperlong.h
--- /dev/null
+++ b/arch/arm64/include/uapi/asm/bitsperlong.h
@@ -0,0 +1,24 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (C) 2012 ARM Ltd.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef __ASM_BITSPERLONG_H
+#define __ASM_BITSPERLONG_H
+
+#define __BITS_PER_LONG 64
+
+#include <asm-generic/bitsperlong.h>
+
+#endif /* __ASM_BITSPERLONG_H */
--- /dev/null
+++ b/arch/riscv/include/uapi/asm/bitsperlong.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (C) 2012 ARM Ltd.
+ * Copyright (C) 2015 Regents of the University of California
+ */
+
+#ifndef _UAPI_ASM_RISCV_BITSPERLONG_H
+#define _UAPI_ASM_RISCV_BITSPERLONG_H
+
+#define __BITS_PER_LONG (__SIZEOF_POINTER__ * 8)
+
+#include <asm-generic/bitsperlong.h>
+
+#endif /* _UAPI_ASM_RISCV_BITSPERLONG_H */
--- /dev/null
+++ b/tools/arch/arm64/include/uapi/asm/bitsperlong.h
@@ -0,0 +1,24 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (C) 2012 ARM Ltd.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef __ASM_BITSPERLONG_H
+#define __ASM_BITSPERLONG_H
+
+#define __BITS_PER_LONG 64
+
+#include <asm-generic/bitsperlong.h>
+
+#endif /* __ASM_BITSPERLONG_H */
--- /dev/null
+++ b/tools/arch/riscv/include/uapi/asm/bitsperlong.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2012 ARM Ltd.
+ * Copyright (C) 2015 Regents of the University of California
+ */
+
+#ifndef _UAPI_ASM_RISCV_BITSPERLONG_H
+#define _UAPI_ASM_RISCV_BITSPERLONG_H
+
+#define __BITS_PER_LONG (__SIZEOF_POINTER__ * 8)
+
+#include <asm-generic/bitsperlong.h>
+
+#endif /* _UAPI_ASM_RISCV_BITSPERLONG_H */
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 423/568] net/mlx5: Fix memory leak in error flow of port set buffer
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (421 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 422/568] asm-generic: partially revert "Unify uapi bitsperlong.h for arm64, riscv and loongarch" Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 424/568] net/sched: act_connmark: handle errno on tcf_idr_check_alloc Greg Kroah-Hartman
` (151 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maher Sanalla, Moshe Shemesh,
Saeed Mahameed
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maher Sanalla <msanalla@nvidia.com>
commit e3e01c1c15986f9531b854634eec8381e72cb605 upstream.
In the cited commit, shared buffer updates were added whenever
port buffer gets updated.
However, in case the shared buffer update fails, exiting early from
port_set_buffer() is performed without freeing previously-allocated memory.
Fix it by jumping to out label where memory is freed before returning
with error.
Fixes: a440030d8946 ("net/mlx5e: Update shared buffer along with device buffer changes")
Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
@@ -325,11 +325,11 @@ static int port_set_buffer(struct mlx5e_
err = port_update_shared_buffer(priv->mdev, current_headroom_size,
new_headroom_size);
if (err)
- return err;
+ goto out;
err = port_update_pool_cfg(priv->mdev, port_buffer);
if (err)
- return err;
+ goto out;
err = mlx5e_port_set_pbmc(mdev, in);
out:
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 424/568] net/sched: act_connmark: handle errno on tcf_idr_check_alloc
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (422 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 423/568] net/mlx5: Fix memory leak in error flow of port set buffer Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 425/568] net/mlx5e: Do not update SBCM when prio2buffer command is invalid Greg Kroah-Hartman
` (150 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jamal Hadi Salim, Pedro Tammela,
Simon Horman, David S. Miller
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pedro Tammela <pctammela@mojatatu.com>
commit fb07390463c95e6eef254044d6dde050bfb9807a upstream.
Smatch reports that 'ci' can be used uninitialized.
The current code ignores errno coming from tcf_idr_check_alloc, which
will lead to the incorrect usage of 'ci'. Handle the errno as it should.
Fixes: 288864effe33 ("net/sched: act_connmark: transition to percpu stats and rcu")
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/act_connmark.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/sched/act_connmark.c
+++ b/net/sched/act_connmark.c
@@ -156,6 +156,9 @@ static int tcf_connmark_init(struct net
nparms->zone = parm->zone;
ret = 0;
+ } else {
+ err = ret;
+ goto out_free;
}
err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch, extack);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 425/568] net/mlx5e: Do not update SBCM when prio2buffer command is invalid
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (423 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 424/568] net/sched: act_connmark: handle errno on tcf_idr_check_alloc Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 426/568] net/mlx5e: Preserve shared buffer capacity during headroom updates Greg Kroah-Hartman
` (149 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maher Sanalla, Moshe Shemesh,
Saeed Mahameed
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maher Sanalla <msanalla@nvidia.com>
commit 623efc4cbd6115db36716e31037cb6d1f3ce6754 upstream.
The shared buffer pools configuration which are stored in the SBCM
register are updated when the user changes the prio2buffer mapping.
However, in case the user desired prio2buffer change is invalid,
which can occur due to mapping a lossless priority to a not large enough
buffer, the SBCM update should not be performed, as the user command is
failed.
Thus, Perform the SBCM update only after xoff threshold calculation is
performed and the user prio2buffer mapping is validated.
Fixes: a440030d8946 ("net/mlx5e: Update shared buffer along with device buffer changes")
Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
@@ -443,11 +443,11 @@ static int update_buffer_lossy(struct ml
}
if (changed) {
- err = port_update_pool_cfg(mdev, port_buffer);
+ err = update_xoff_threshold(port_buffer, xoff, max_mtu, port_buff_cell_sz);
if (err)
return err;
- err = update_xoff_threshold(port_buffer, xoff, max_mtu, port_buff_cell_sz);
+ err = port_update_pool_cfg(mdev, port_buffer);
if (err)
return err;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 426/568] net/mlx5e: Preserve shared buffer capacity during headroom updates
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (424 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 425/568] net/mlx5e: Do not update SBCM when prio2buffer command is invalid Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 427/568] timers: Fix NULL function pointer race in timer_shutdown_sync() Greg Kroah-Hartman
` (148 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Armen Ratner, Maher Sanalla,
Tariq Toukan, Alexei Lazar, Mark Bloch, Przemek Kitszel,
Jakub Kicinski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armen Ratner <armeng@nvidia.com>
commit 8b0587a885fdb34fd6090a3f8625cb7ac1444826 upstream.
When port buffer headroom changes, port_update_shared_buffer()
recalculates the shared buffer size and splits it in a 3:1 ratio
(lossy:lossless) - Currently, the calculation is:
lossless = shared / 4;
lossy = (shared / 4) * 3;
Meaning, the calculation dropped the remainder of shared % 4 due to
integer division, unintentionally reducing the total shared buffer
by up to three cells on each update. Over time, this could shrink
the buffer below usable size.
Fix it by changing the calculation to:
lossless = shared / 4;
lossy = shared - lossless;
This retains all buffer cells while still approximating the
intended 3:1 split, preventing capacity loss over time.
While at it, perform headroom calculations in units of cells rather than
in bytes for more accurate calculations avoiding extra divisions.
Fixes: a440030d8946 ("net/mlx5e: Update shared buffer along with device buffer changes")
Signed-off-by: Armen Ratner <armeng@nvidia.com>
Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: Alexei Lazar <alazar@nvidia.com>
Signed-off-by: Mark Bloch <mbloch@nvidia.com>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Link: https://patch.msgid.link/20250820133209.389065-9-mbloch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c | 18 ++++++---------
1 file changed, 8 insertions(+), 10 deletions(-)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
@@ -272,8 +272,8 @@ static int port_update_shared_buffer(str
/* Total shared buffer size is split in a ratio of 3:1 between
* lossy and lossless pools respectively.
*/
- lossy_epool_size = (shared_buffer_size / 4) * 3;
lossless_ipool_size = shared_buffer_size / 4;
+ lossy_epool_size = shared_buffer_size - lossless_ipool_size;
mlx5e_port_set_sbpr(mdev, 0, MLX5_EGRESS_DIR, MLX5_LOSSY_POOL, 0,
lossy_epool_size);
@@ -288,14 +288,12 @@ static int port_set_buffer(struct mlx5e_
u16 port_buff_cell_sz = priv->dcbx.port_buff_cell_sz;
struct mlx5_core_dev *mdev = priv->mdev;
int sz = MLX5_ST_SZ_BYTES(pbmc_reg);
- u32 new_headroom_size = 0;
- u32 current_headroom_size;
+ u32 current_headroom_cells = 0;
+ u32 new_headroom_cells = 0;
void *in;
int err;
int i;
- current_headroom_size = port_buffer->headroom_size;
-
in = kzalloc(sz, GFP_KERNEL);
if (!in)
return -ENOMEM;
@@ -306,12 +304,14 @@ static int port_set_buffer(struct mlx5e_
for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++) {
void *buffer = MLX5_ADDR_OF(pbmc_reg, in, buffer[i]);
+ current_headroom_cells += MLX5_GET(bufferx_reg, buffer, size);
+
u64 size = port_buffer->buffer[i].size;
u64 xoff = port_buffer->buffer[i].xoff;
u64 xon = port_buffer->buffer[i].xon;
- new_headroom_size += size;
do_div(size, port_buff_cell_sz);
+ new_headroom_cells += size;
do_div(xoff, port_buff_cell_sz);
do_div(xon, port_buff_cell_sz);
MLX5_SET(bufferx_reg, buffer, size, size);
@@ -320,10 +320,8 @@ static int port_set_buffer(struct mlx5e_
MLX5_SET(bufferx_reg, buffer, xon_threshold, xon);
}
- new_headroom_size /= port_buff_cell_sz;
- current_headroom_size /= port_buff_cell_sz;
- err = port_update_shared_buffer(priv->mdev, current_headroom_size,
- new_headroom_size);
+ err = port_update_shared_buffer(priv->mdev, current_headroom_cells,
+ new_headroom_cells);
if (err)
goto out;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 427/568] timers: Fix NULL function pointer race in timer_shutdown_sync()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (425 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 426/568] net/mlx5e: Preserve shared buffer capacity during headroom updates Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 428/568] HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 Greg Kroah-Hartman
` (147 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yipeng Zou, Thomas Gleixner
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yipeng Zou <zouyipeng@huawei.com>
commit 20739af07383e6eb1ec59dcd70b72ebfa9ac362c upstream.
There is a race condition between timer_shutdown_sync() and timer
expiration that can lead to hitting a WARN_ON in expire_timers().
The issue occurs when timer_shutdown_sync() clears the timer function
to NULL while the timer is still running on another CPU. The race
scenario looks like this:
CPU0 CPU1
<SOFTIRQ>
lock_timer_base()
expire_timers()
base->running_timer = timer;
unlock_timer_base()
[call_timer_fn enter]
mod_timer()
...
timer_shutdown_sync()
lock_timer_base()
// For now, will not detach the timer but only clear its function to NULL
if (base->running_timer != timer)
ret = detach_if_pending(timer, base, true);
if (shutdown)
timer->function = NULL;
unlock_timer_base()
[call_timer_fn exit]
lock_timer_base()
base->running_timer = NULL;
unlock_timer_base()
...
// Now timer is pending while its function set to NULL.
// next timer trigger
<SOFTIRQ>
expire_timers()
WARN_ON_ONCE(!fn) // hit
...
lock_timer_base()
// Now timer will detach
if (base->running_timer != timer)
ret = detach_if_pending(timer, base, true);
if (shutdown)
timer->function = NULL;
unlock_timer_base()
The problem is that timer_shutdown_sync() clears the timer function
regardless of whether the timer is currently running. This can leave a
pending timer with a NULL function pointer, which triggers the
WARN_ON_ONCE(!fn) check in expire_timers().
Fix this by only clearing the timer function when actually detaching the
timer. If the timer is running, leave the function pointer intact, which is
safe because the timer will be properly detached when it finishes running.
Fixes: 0cc04e80458a ("timers: Add shutdown mechanism to the internal functions")
Signed-off-by: Yipeng Zou <zouyipeng@huawei.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251122093942.301559-1-zouyipeng@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/timer.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -1413,10 +1413,11 @@ static int __try_to_del_timer_sync(struc
base = lock_timer_base(timer, &flags);
- if (base->running_timer != timer)
+ if (base->running_timer != timer) {
ret = detach_if_pending(timer, base, true);
- if (shutdown)
- timer->function = NULL;
+ if (shutdown)
+ timer->function = NULL;
+ }
raw_spin_unlock_irqrestore(&base->lock, flags);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 428/568] HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (426 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 427/568] timers: Fix NULL function pointer race in timer_shutdown_sync() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 429/568] mtd: rawnand: cadence: fix DMA device NULL pointer dereference Greg Kroah-Hartman
` (146 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, staffan.melin, Terry Junge,
Zhang Heng, Jiri Kosina
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Heng <zhangheng@kylinos.cn>
commit beab067dbcff642243291fd528355d64c41dc3b2 upstream.
Based on available evidence, the USB ID 4c4a:4155 used by multiple
devices has been attributed to Jieli. The commit 1a8953f4f774
("HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY") affected touchscreen
functionality. Added checks for manufacturer and serial number to
maintain microphone compatibility, enabling both devices to function
properly.
[jkosina@suse.com: edit shortlog]
Fixes: 1a8953f4f774 ("HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY")
Cc: stable@vger.kernel.org
Tested-by: staffan.melin@oscillator.se
Reviewed-by: Terry Junge <linuxhid@cosmicgizmosystems.com>
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-ids.h | 4 ++--
drivers/hid/hid-quirks.c | 13 ++++++++++++-
2 files changed, 14 insertions(+), 3 deletions(-)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -1460,7 +1460,7 @@
#define USB_VENDOR_ID_SIGNOTEC 0x2133
#define USB_DEVICE_ID_SIGNOTEC_VIEWSONIC_PD1011 0x0018
-#define USB_VENDOR_ID_SMARTLINKTECHNOLOGY 0x4c4a
-#define USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155 0x4155
+#define USB_VENDOR_ID_JIELI_SDK_DEFAULT 0x4c4a
+#define USB_DEVICE_ID_JIELI_SDK_4155 0x4155
#endif
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -888,7 +888,6 @@ static const struct hid_device_id hid_ig
#endif
{ HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) },
{ HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473) },
- { HID_USB_DEVICE(USB_VENDOR_ID_SMARTLINKTECHNOLOGY, USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155) },
{ }
};
@@ -1045,6 +1044,18 @@ bool hid_ignore(struct hid_device *hdev)
strlen(elan_acpi_id[i].id)))
return true;
break;
+ case USB_VENDOR_ID_JIELI_SDK_DEFAULT:
+ /*
+ * Multiple USB devices with identical IDs (mic & touchscreen).
+ * The touch screen requires hid core processing, but the
+ * microphone does not. They can be distinguished by manufacturer
+ * and serial number.
+ */
+ if (hdev->product == USB_DEVICE_ID_JIELI_SDK_4155 &&
+ strncmp(hdev->name, "SmartlinkTechnology", 19) == 0 &&
+ strncmp(hdev->uniq, "20201111000001", 14) == 0)
+ return true;
+ break;
}
if (hdev->type == HID_TYPE_USBMOUSE &&
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 429/568] mtd: rawnand: cadence: fix DMA device NULL pointer dereference
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (427 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 428/568] HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 430/568] mtdchar: fix integer overflow in read/write ioctls Greg Kroah-Hartman
` (145 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Niravkumar L Rabara, Miquel Raynal
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
commit 5c56bf214af85ca042bf97f8584aab2151035840 upstream.
The DMA device pointer `dma_dev` was being dereferenced before ensuring
that `cdns_ctrl->dmac` is properly initialized.
Move the assignment of `dma_dev` after successfully acquiring the DMA
channel to ensure the pointer is valid before use.
Fixes: d76d22b5096c ("mtd: rawnand: cadence: use dma_map_resource for sdma address")
Cc: stable@vger.kernel.org
Signed-off-by: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/cadence-nand-controller.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/mtd/nand/raw/cadence-nand-controller.c
+++ b/drivers/mtd/nand/raw/cadence-nand-controller.c
@@ -2830,7 +2830,7 @@ cadence_nand_irq_cleanup(int irqnum, str
static int cadence_nand_init(struct cdns_nand_ctrl *cdns_ctrl)
{
dma_cap_mask_t mask;
- struct dma_device *dma_dev = cdns_ctrl->dmac->device;
+ struct dma_device *dma_dev;
int ret;
cdns_ctrl->cdma_desc = dma_alloc_coherent(cdns_ctrl->dev,
@@ -2874,6 +2874,7 @@ static int cadence_nand_init(struct cdns
}
}
+ dma_dev = cdns_ctrl->dmac->device;
cdns_ctrl->io.iova_dma = dma_map_resource(dma_dev->dev, cdns_ctrl->io.dma,
cdns_ctrl->io.size,
DMA_BIDIRECTIONAL, 0);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 430/568] mtdchar: fix integer overflow in read/write ioctls
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (428 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 429/568] mtd: rawnand: cadence: fix DMA device NULL pointer dereference Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 431/568] exfat: check return value of sb_min_blocksize in exfat_read_boot_sector Greg Kroah-Hartman
` (144 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Miquel Raynal
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
commit e4185bed738da755b191aa3f2e16e8b48450e1b8 upstream.
The "req.start" and "req.len" variables are u64 values that come from the
user at the start of the function. We mask away the high 32 bits of
"req.len" so that's capped at U32_MAX but the "req.start" variable can go
up to U64_MAX which means that the addition can still integer overflow.
Use check_add_overflow() to fix this bug.
Fixes: 095bb6e44eb1 ("mtdchar: add MEMREAD ioctl")
Fixes: 6420ac0af95d ("mtdchar: prevent unbounded allocation in MEMWRITE ioctl")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/mtdchar.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -599,6 +599,7 @@ mtdchar_write_ioctl(struct mtd_info *mtd
uint8_t *datbuf = NULL, *oobbuf = NULL;
size_t datbuf_len, oobbuf_len;
int ret = 0;
+ u64 end;
if (copy_from_user(&req, argp, sizeof(req)))
return -EFAULT;
@@ -618,7 +619,7 @@ mtdchar_write_ioctl(struct mtd_info *mtd
req.len &= 0xffffffff;
req.ooblen &= 0xffffffff;
- if (req.start + req.len > mtd->size)
+ if (check_add_overflow(req.start, req.len, &end) || end > mtd->size)
return -EINVAL;
datbuf_len = min_t(size_t, req.len, mtd->erasesize);
@@ -698,6 +699,7 @@ mtdchar_read_ioctl(struct mtd_info *mtd,
size_t datbuf_len, oobbuf_len;
size_t orig_len, orig_ooblen;
int ret = 0;
+ u64 end;
if (copy_from_user(&req, argp, sizeof(req)))
return -EFAULT;
@@ -724,7 +726,7 @@ mtdchar_read_ioctl(struct mtd_info *mtd,
req.len &= 0xffffffff;
req.ooblen &= 0xffffffff;
- if (req.start + req.len > mtd->size) {
+ if (check_add_overflow(req.start, req.len, &end) || end > mtd->size) {
ret = -EINVAL;
goto out;
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 431/568] exfat: check return value of sb_min_blocksize in exfat_read_boot_sector
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (429 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 430/568] mtdchar: fix integer overflow in read/write ioctls Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 432/568] mptcp: Disallow MPTCP subflows from sockmap Greg Kroah-Hartman
` (143 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Yongpeng Yang,
Christian Brauner
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongpeng Yang <yangyongpeng@xiaomi.com>
commit f2c1f631630e01821fe4c3fdf6077bc7a8284f82 upstream.
sb_min_blocksize() may return 0. Check its return value to avoid
accessing the filesystem super block when sb->s_blocksize is 0.
Cc: stable@vger.kernel.org # v6.15
Fixes: 719c1e1829166d ("exfat: add super block operations")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Yongpeng Yang <yangyongpeng@xiaomi.com>
Link: https://patch.msgid.link/20251104125009.2111925-3-yangyongpeng.storage@gmail.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/exfat/super.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/exfat/super.c
+++ b/fs/exfat/super.c
@@ -425,7 +425,10 @@ static int exfat_read_boot_sector(struct
struct exfat_sb_info *sbi = EXFAT_SB(sb);
/* set block size to read super block */
- sb_min_blocksize(sb, 512);
+ if (!sb_min_blocksize(sb, 512)) {
+ exfat_err(sb, "unable to set blocksize");
+ return -EINVAL;
+ }
/* read boot sector */
sbi->boot_bh = sb_bread(sb, 0);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 432/568] mptcp: Disallow MPTCP subflows from sockmap
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (430 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 431/568] exfat: check return value of sb_min_blocksize in exfat_read_boot_sector Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 433/568] ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() Greg Kroah-Hartman
` (142 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiayuan Chen, Martin KaFai Lau,
Matthieu Baerts (NGI0)
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <jiayuan.chen@linux.dev>
commit fbade4bd08ba52cbc74a71c4e86e736f059f99f7 upstream.
The sockmap feature allows bpf syscall from userspace, or based on bpf
sockops, replacing the sk_prot of sockets during protocol stack processing
with sockmap's custom read/write interfaces.
'''
tcp_rcv_state_process()
subflow_syn_recv_sock()
tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB)
bpf_skops_established <== sockops
bpf_sock_map_update(sk) <== call bpf helper
tcp_bpf_update_proto() <== update sk_prot
'''
Consider two scenarios:
1. When the server has MPTCP enabled and the client also requests MPTCP,
the sk passed to the BPF program is a subflow sk. Since subflows only
handle partial data, replacing their sk_prot is meaningless and will
cause traffic disruption.
2. When the server has MPTCP enabled but the client sends a TCP SYN
without MPTCP, subflow_syn_recv_sock() performs a fallback on the
subflow, replacing the subflow sk's sk_prot with the native sk_prot.
'''
subflow_ulp_fallback()
subflow_drop_ctx()
mptcp_subflow_ops_undo_override()
'''
Subsequently, accept::mptcp_stream_accept::mptcp_fallback_tcp_ops()
converts the subflow to plain TCP.
For the first case, we should prevent it from being combined with sockmap
by setting sk_prot->psock_update_sk_prot to NULL, which will be blocked by
sockmap's own flow.
For the second case, since subflow_syn_recv_sock() has already restored
sk_prot to native tcp_prot/tcpv6_prot, no further action is needed.
Fixes: cec37a6e41aa ("mptcp: Handle MP_CAPABLE options for outgoing connections")
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20251111060307.194196-2-jiayuan.chen@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/subflow.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -1997,6 +1997,10 @@ void __init mptcp_subflow_init(void)
tcp_prot_override = tcp_prot;
tcp_prot_override.release_cb = tcp_release_cb_override;
tcp_prot_override.diag_destroy = tcp_abort_override;
+#ifdef CONFIG_BPF_SYSCALL
+ /* Disable sockmap processing for subflows */
+ tcp_prot_override.psock_update_sk_prot = NULL;
+#endif
#if IS_ENABLED(CONFIG_MPTCP_IPV6)
/* In struct mptcp_subflow_request_sock, we assume the TCP request sock
@@ -2033,6 +2037,10 @@ void __init mptcp_subflow_init(void)
tcpv6_prot_override = tcpv6_prot;
tcpv6_prot_override.release_cb = tcp_release_cb_override;
tcpv6_prot_override.diag_destroy = tcp_abort_override;
+#ifdef CONFIG_BPF_SYSCALL
+ /* Disable sockmap processing for subflows */
+ tcpv6_prot_override.psock_update_sk_prot = NULL;
+#endif
#endif
mptcp_diag_subflow_init(&subflow_ulp_ops);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 433/568] ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (431 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 432/568] mptcp: Disallow MPTCP subflows from sockmap Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 434/568] be2net: pass wrb_params in case of OS2BMC Greg Kroah-Hartman
` (141 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yihang Li, Damien Le Moal,
Niklas Cassel
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <liyihang9@h-partners.com>
commit b32cc17d607e8ae7af037303fe101368cb4dc44c upstream.
Call scsi_device_put() in ata_scsi_dev_rescan() if the device or its
queue are not running.
Fixes: 0c76106cb975 ("scsi: sd: Fix TCG OPAL unlock on system resume")
Cc: stable@vger.kernel.org
Signed-off-by: Yihang Li <liyihang9@h-partners.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libata-scsi.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -4683,8 +4683,10 @@ void ata_scsi_dev_rescan(struct work_str
spin_unlock_irqrestore(ap->lock, flags);
if (do_resume) {
ret = scsi_resume_device(sdev);
- if (ret == -EWOULDBLOCK)
+ if (ret == -EWOULDBLOCK) {
+ scsi_device_put(sdev);
goto unlock_scan;
+ }
dev->flags &= ~ATA_DFLAG_RESUMING;
}
ret = scsi_rescan_device(sdev);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 434/568] be2net: pass wrb_params in case of OS2BMC
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (432 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 433/568] ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 435/568] net: dsa: microchip: lan937x: Fix RGMII delay tuning Greg Kroah-Hartman
` (140 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andrey Vatoropin, Jakub Kicinski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Vatoropin <a.vatoropin@crpt.ru>
commit 7d277a7a58578dd62fd546ddaef459ec24ccae36 upstream.
be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL
at be_send_pkt_to_bmc() call site. This may lead to dereferencing a NULL
pointer when processing a workaround for specific packet, as commit
bc0c3405abbb ("be2net: fix a Tx stall bug caused by a specific ipv6
packet") states.
The correct way would be to pass the wrb_params from be_xmit().
Fixes: 760c295e0e8d ("be2net: Support for OS2BMC.")
Cc: stable@vger.kernel.org
Signed-off-by: Andrey Vatoropin <a.vatoropin@crpt.ru>
Link: https://patch.msgid.link/20251119105015.194501-1-a.vatoropin@crpt.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/emulex/benet/be_main.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1297,7 +1297,8 @@ static void be_xmit_flush(struct be_adap
(adapter->bmc_filt_mask & BMC_FILT_MULTICAST)
static bool be_send_pkt_to_bmc(struct be_adapter *adapter,
- struct sk_buff **skb)
+ struct sk_buff **skb,
+ struct be_wrb_params *wrb_params)
{
struct ethhdr *eh = (struct ethhdr *)(*skb)->data;
bool os2bmc = false;
@@ -1361,7 +1362,7 @@ done:
* to BMC, asic expects the vlan to be inline in the packet.
*/
if (os2bmc)
- *skb = be_insert_vlan_in_pkt(adapter, *skb, NULL);
+ *skb = be_insert_vlan_in_pkt(adapter, *skb, wrb_params);
return os2bmc;
}
@@ -1388,7 +1389,7 @@ static netdev_tx_t be_xmit(struct sk_buf
/* if os2bmc is enabled and if the pkt is destined to bmc,
* enqueue the pkt a 2nd time with mgmt bit set.
*/
- if (be_send_pkt_to_bmc(adapter, &skb)) {
+ if (be_send_pkt_to_bmc(adapter, &skb, &wrb_params)) {
BE_WRB_F_SET(wrb_params.features, OS2BMC, 1);
wrb_cnt = be_xmit_enqueue(adapter, txo, skb, &wrb_params);
if (unlikely(!wrb_cnt))
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 435/568] net: dsa: microchip: lan937x: Fix RGMII delay tuning
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (433 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 434/568] be2net: pass wrb_params in case of OS2BMC Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 436/568] Input: cros_ec_keyb - fix an invalid memory access Greg Kroah-Hartman
` (139 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oleksij Rempel, Paolo Abeni
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <o.rempel@pengutronix.de>
commit 3ceb6ac2116ecda1c5d779bb73271479e70fccb4 upstream.
Correct RGMII delay application logic in lan937x_set_tune_adj().
The function was missing `data16 &= ~PORT_TUNE_ADJ` before setting the
new delay value. This caused the new value to be bitwise-OR'd with the
existing PORT_TUNE_ADJ field instead of replacing it.
For example, when setting the RGMII 2 TX delay on port 4, the
intended TUNE_ADJUST value of 0 (RGMII_2_TX_DELAY_2NS) was
incorrectly OR'd with the default 0x1B (from register value 0xDA3),
leaving the delay at the wrong setting.
This patch adds the missing mask to clear the field, ensuring the
correct delay value is written. Physical measurements on the RGMII TX
lines confirm the fix, showing the delay changing from ~1ns (before
change) to ~2ns.
While testing on i.MX 8MP showed this was within the platform's timing
tolerance, it did not match the intended hardware-characterized value.
Fixes: b19ac41faa3f ("net: dsa: microchip: apply rgmii tx and rx delay in phylink mac config")
Cc: stable@vger.kernel.org
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://patch.msgid.link/20251114090951.4057261-1-o.rempel@pengutronix.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/dsa/microchip/lan937x_main.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/dsa/microchip/lan937x_main.c
+++ b/drivers/net/dsa/microchip/lan937x_main.c
@@ -328,6 +328,7 @@ static void lan937x_set_tune_adj(struct
ksz_pread16(dev, port, reg, &data16);
/* Update tune Adjust */
+ data16 &= ~PORT_TUNE_ADJ;
data16 |= FIELD_PREP(PORT_TUNE_ADJ, val);
ksz_pwrite16(dev, port, reg, data16);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 436/568] Input: cros_ec_keyb - fix an invalid memory access
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (434 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 435/568] net: dsa: microchip: lan937x: Fix RGMII delay tuning Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 437/568] Input: imx_sc_key - fix memory corruption on unload Greg Kroah-Hartman
` (138 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tzung-Bi Shih, Dmitry Torokhov
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <tzungbi@kernel.org>
commit e08969c4d65ac31297fcb4d31d4808c789152f68 upstream.
If cros_ec_keyb_register_matrix() isn't called (due to
`buttons_switches_only`) in cros_ec_keyb_probe(), `ckdev->idev` remains
NULL. An invalid memory access is observed in cros_ec_keyb_process()
when receiving an EC_MKBP_EVENT_KEY_MATRIX event in cros_ec_keyb_work()
in such case.
Unable to handle kernel read from unreadable memory at virtual address 0000000000000028
...
x3 : 0000000000000000 x2 : 0000000000000000
x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
input_event
cros_ec_keyb_work
blocking_notifier_call_chain
ec_irq_thread
It's still unknown about why the kernel receives such malformed event,
in any cases, the kernel shouldn't access `ckdev->idev` and friends if
the driver doesn't intend to initialize them.
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Link: https://patch.msgid.link/20251104070310.3212712-1-tzungbi@kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/keyboard/cros_ec_keyb.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/input/keyboard/cros_ec_keyb.c
+++ b/drivers/input/keyboard/cros_ec_keyb.c
@@ -248,6 +248,12 @@ static int cros_ec_keyb_work(struct noti
case EC_MKBP_EVENT_KEY_MATRIX:
pm_wakeup_event(ckdev->dev, 0);
+ if (!ckdev->idev) {
+ dev_warn_once(ckdev->dev,
+ "Unexpected key matrix event\n");
+ return NOTIFY_OK;
+ }
+
if (ckdev->ec->event_size != ckdev->cols) {
dev_err(ckdev->dev,
"Discarded incomplete key matrix event.\n");
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 437/568] Input: imx_sc_key - fix memory corruption on unload
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (435 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 436/568] Input: cros_ec_keyb - fix an invalid memory access Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 438/568] Input: pegasus-notetaker - fix potential out-of-bounds access Greg Kroah-Hartman
` (137 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Peng Fan, Frank Li,
Dmitry Torokhov
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
commit d83f1512758f4ef6fc5e83219fe7eeeb6b428ea4 upstream.
This is supposed to be "priv" but we accidentally pass "&priv" which is
an address in the stack and so it will lead to memory corruption when
the imx_sc_key_action() function is called. Remove the &.
Fixes: 768062fd1284 ("Input: imx_sc_key - use devm_add_action_or_reset() to handle all cleanups")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/aQYKR75r2VMFJutT@stanley.mountain
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/keyboard/imx_sc_key.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/input/keyboard/imx_sc_key.c
+++ b/drivers/input/keyboard/imx_sc_key.c
@@ -158,7 +158,7 @@ static int imx_sc_key_probe(struct platf
return error;
}
- error = devm_add_action_or_reset(&pdev->dev, imx_sc_key_action, &priv);
+ error = devm_add_action_or_reset(&pdev->dev, imx_sc_key_action, priv);
if (error)
return error;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 438/568] Input: pegasus-notetaker - fix potential out-of-bounds access
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (436 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 437/568] Input: imx_sc_key - fix memory corruption on unload Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 439/568] nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() Greg Kroah-Hartman
` (136 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Seungjin Bae, Dmitry Torokhov
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <eeodqql09@gmail.com>
commit 69aeb507312306f73495598a055293fa749d454e upstream.
In the pegasus_notetaker driver, the pegasus_probe() function allocates
the URB transfer buffer using the wMaxPacketSize value from
the endpoint descriptor. An attacker can use a malicious USB descriptor
to force the allocation of a very small buffer.
Subsequently, if the device sends an interrupt packet with a specific
pattern (e.g., where the first byte is 0x80 or 0x42),
the pegasus_parse_packet() function parses the packet without checking
the allocated buffer size. This leads to an out-of-bounds memory access.
Fixes: 1afca2b66aac ("Input: add Pegasus Notetaker tablet driver")
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Link: https://lore.kernel.org/r/20251007214131.3737115-2-eeodqql09@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/tablet/pegasus_notetaker.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/input/tablet/pegasus_notetaker.c
+++ b/drivers/input/tablet/pegasus_notetaker.c
@@ -63,6 +63,9 @@
#define BUTTON_PRESSED 0xb5
#define COMMAND_VERSION 0xa9
+/* 1 Status + 1 Color + 2 X + 2 Y = 6 bytes */
+#define NOTETAKER_PACKET_SIZE 6
+
/* in xy data packet */
#define BATTERY_NO_REPORT 0x40
#define BATTERY_LOW 0x41
@@ -303,6 +306,12 @@ static int pegasus_probe(struct usb_inte
}
pegasus->data_len = usb_maxpacket(dev, pipe);
+ if (pegasus->data_len < NOTETAKER_PACKET_SIZE) {
+ dev_err(&intf->dev, "packet size is too small (%d)\n",
+ pegasus->data_len);
+ error = -EINVAL;
+ goto err_free_mem;
+ }
pegasus->data = usb_alloc_coherent(dev, pegasus->data_len, GFP_KERNEL,
&pegasus->data_dma);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 439/568] nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (437 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 438/568] Input: pegasus-notetaker - fix potential out-of-bounds access Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 440/568] scsi: sg: Do not sleep in atomic context Greg Kroah-Hartman
` (135 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marco Patalano, Justin Tee,
Ewan D. Milne, Keith Busch
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ewan D. Milne <emilne@redhat.com>
commit 0a2c5495b6d1ecb0fa18ef6631450f391a888256 upstream.
nvme_fc_delete_assocation() waits for pending I/O to complete before
returning, and an error can cause ->ioerr_work to be queued after
cancel_work_sync() had been called. Move the call to cancel_work_sync() to
be after nvme_fc_delete_association() to ensure ->ioerr_work is not running
when the nvme_fc_ctrl object is freed. Otherwise the following can occur:
[ 1135.911754] list_del corruption, ff2d24c8093f31f8->next is NULL
[ 1135.917705] ------------[ cut here ]------------
[ 1135.922336] kernel BUG at lib/list_debug.c:52!
[ 1135.926784] Oops: invalid opcode: 0000 [#1] SMP NOPTI
[ 1135.931851] CPU: 48 UID: 0 PID: 726 Comm: kworker/u449:23 Kdump: loaded Not tainted 6.12.0 #1 PREEMPT(voluntary)
[ 1135.943490] Hardware name: Dell Inc. PowerEdge R660/0HGTK9, BIOS 2.5.4 01/16/2025
[ 1135.950969] Workqueue: 0x0 (nvme-wq)
[ 1135.954673] RIP: 0010:__list_del_entry_valid_or_report.cold+0xf/0x6f
[ 1135.961041] Code: c7 c7 98 68 72 94 e8 26 45 fe ff 0f 0b 48 c7 c7 70 68 72 94 e8 18 45 fe ff 0f 0b 48 89 fe 48 c7 c7 80 69 72 94 e8 07 45 fe ff <0f> 0b 48 89 d1 48 c7 c7 a0 6a 72 94 48 89 c2 e8 f3 44 fe ff 0f 0b
[ 1135.979788] RSP: 0018:ff579b19482d3e50 EFLAGS: 00010046
[ 1135.985015] RAX: 0000000000000033 RBX: ff2d24c8093f31f0 RCX: 0000000000000000
[ 1135.992148] RDX: 0000000000000000 RSI: ff2d24d6bfa1d0c0 RDI: ff2d24d6bfa1d0c0
[ 1135.999278] RBP: ff2d24c8093f31f8 R08: 0000000000000000 R09: ffffffff951e2b08
[ 1136.006413] R10: ffffffff95122ac8 R11: 0000000000000003 R12: ff2d24c78697c100
[ 1136.013546] R13: fffffffffffffff8 R14: 0000000000000000 R15: ff2d24c78697c0c0
[ 1136.020677] FS: 0000000000000000(0000) GS:ff2d24d6bfa00000(0000) knlGS:0000000000000000
[ 1136.028765] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1136.034510] CR2: 00007fd207f90b80 CR3: 000000163ea22003 CR4: 0000000000f73ef0
[ 1136.041641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1136.048776] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
[ 1136.055910] PKRU: 55555554
[ 1136.058623] Call Trace:
[ 1136.061074] <TASK>
[ 1136.063179] ? show_trace_log_lvl+0x1b0/0x2f0
[ 1136.067540] ? show_trace_log_lvl+0x1b0/0x2f0
[ 1136.071898] ? move_linked_works+0x4a/0xa0
[ 1136.075998] ? __list_del_entry_valid_or_report.cold+0xf/0x6f
[ 1136.081744] ? __die_body.cold+0x8/0x12
[ 1136.085584] ? die+0x2e/0x50
[ 1136.088469] ? do_trap+0xca/0x110
[ 1136.091789] ? do_error_trap+0x65/0x80
[ 1136.095543] ? __list_del_entry_valid_or_report.cold+0xf/0x6f
[ 1136.101289] ? exc_invalid_op+0x50/0x70
[ 1136.105127] ? __list_del_entry_valid_or_report.cold+0xf/0x6f
[ 1136.110874] ? asm_exc_invalid_op+0x1a/0x20
[ 1136.115059] ? __list_del_entry_valid_or_report.cold+0xf/0x6f
[ 1136.120806] move_linked_works+0x4a/0xa0
[ 1136.124733] worker_thread+0x216/0x3a0
[ 1136.128485] ? __pfx_worker_thread+0x10/0x10
[ 1136.132758] kthread+0xfa/0x240
[ 1136.135904] ? __pfx_kthread+0x10/0x10
[ 1136.139657] ret_from_fork+0x31/0x50
[ 1136.143236] ? __pfx_kthread+0x10/0x10
[ 1136.146988] ret_from_fork_asm+0x1a/0x30
[ 1136.150915] </TASK>
Fixes: 19fce0470f05 ("nvme-fc: avoid calling _nvme_fc_abort_outstanding_ios from interrupt context")
Cc: stable@vger.kernel.org
Tested-by: Marco Patalano <mpatalan@redhat.com>
Reviewed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Ewan D. Milne <emilne@redhat.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/fc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -3262,7 +3262,6 @@ nvme_fc_delete_ctrl(struct nvme_ctrl *nc
{
struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
- cancel_work_sync(&ctrl->ioerr_work);
cancel_delayed_work_sync(&ctrl->connect_work);
/*
* kill the association on the link side. this will block
@@ -3333,6 +3332,7 @@ nvme_fc_reset_ctrl_work(struct work_stru
/* will block will waiting for io to terminate */
nvme_fc_delete_association(ctrl);
+ cancel_work_sync(&ctrl->ioerr_work);
if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING))
dev_err(ctrl->ctrl.device,
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 440/568] scsi: sg: Do not sleep in atomic context
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (438 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 439/568] nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 441/568] scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() Greg Kroah-Hartman
` (134 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+c01f8e6e73f20459912e,
Hannes Reinecke, Bart Van Assche, Martin K. Petersen
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
commit 90449f2d1e1f020835cba5417234636937dd657e upstream.
sg_finish_rem_req() calls blk_rq_unmap_user(). The latter function may
sleep. Hence, call sg_finish_rem_req() with interrupts enabled instead
of disabled.
Reported-by: syzbot+c01f8e6e73f20459912e@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-scsi/691560c4.a70a0220.3124cb.001a.GAE@google.com/
Cc: Hannes Reinecke <hare@suse.de>
Cc: stable@vger.kernel.org
Fixes: 97d27b0dd015 ("scsi: sg: close race condition in sg_remove_sfp_usercontext()")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20251113181643.1108973-1-bvanassche@acm.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/sg.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -2204,9 +2204,17 @@ sg_remove_sfp_usercontext(struct work_st
write_lock_irqsave(&sfp->rq_list_lock, iflags);
while (!list_empty(&sfp->rq_list)) {
srp = list_first_entry(&sfp->rq_list, Sg_request, entry);
- sg_finish_rem_req(srp);
list_del(&srp->entry);
+ write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
+
+ sg_finish_rem_req(srp);
+ /*
+ * sg_rq_end_io() uses srp->parentfp. Hence, only clear
+ * srp->parentfp after blk_mq_free_request() has been called.
+ */
srp->parentfp = NULL;
+
+ write_lock_irqsave(&sfp->rq_list_lock, iflags);
}
write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 441/568] scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (439 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 440/568] scsi: sg: Do not sleep in atomic context Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 442/568] MIPS: Malta: Fix !EVA SOC-it PCI MMIO Greg Kroah-Hartman
` (133 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hamza Mahfooz, Chaitanya Kulkarni,
Allen Pais, Martin K. Petersen
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
commit e6965188f84a7883e6a0d3448e86b0cf29b24dfc upstream.
If the allocation of tl_hba->sh fails in tcm_loop_driver_probe() and we
attempt to dereference it in tcm_loop_tpg_address_show() we will get a
segfault, see below for an example. So, check tl_hba->sh before
dereferencing it.
Unable to allocate struct scsi_host
BUG: kernel NULL pointer dereference, address: 0000000000000194
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 1 PID: 8356 Comm: tokio-runtime-w Not tainted 6.6.104.2-4.azl3 #1
Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/28/2024
RIP: 0010:tcm_loop_tpg_address_show+0x2e/0x50 [tcm_loop]
...
Call Trace:
<TASK>
configfs_read_iter+0x12d/0x1d0 [configfs]
vfs_read+0x1b5/0x300
ksys_read+0x6f/0xf0
...
Cc: stable@vger.kernel.org
Fixes: 2628b352c3d4 ("tcm_loop: Show address of tpg in configfs")
Signed-off-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Allen Pais <apais@linux.microsoft.com>
Link: https://patch.msgid.link/1762370746-6304-1-git-send-email-hamzamahfooz@linux.microsoft.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/loopback/tcm_loop.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -934,6 +934,9 @@ static ssize_t tcm_loop_tpg_address_show
struct tcm_loop_tpg, tl_se_tpg);
struct tcm_loop_hba *tl_hba = tl_tpg->tl_hba;
+ if (!tl_hba->sh)
+ return -ENODEV;
+
return snprintf(page, PAGE_SIZE, "%d:0:%d\n",
tl_hba->sh->host_no, tl_tpg->tl_tpgt);
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 442/568] MIPS: Malta: Fix !EVA SOC-it PCI MMIO
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (440 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 441/568] scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 443/568] LoongArch: Dont panic if no valid cache info for PCI Greg Kroah-Hartman
` (132 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Maciej W. Rozycki,
Thomas Bogendoerfer
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <macro@orcam.me.uk>
commit ebd729fef31620e0bf74cbf8a4c7fda73a2a4e7e upstream.
Fix a regression that has caused accesses to the PCI MMIO window to
complete unclaimed in non-EVA configurations with the SOC-it family of
system controllers, preventing PCI devices from working that use MMIO.
In the non-EVA case PHYS_OFFSET is set to 0, meaning that PCI_BAR0 is
set with an empty mask (and PCI_HEAD4 matches addresses starting from 0
accordingly). Consequently all addresses are matched for incoming DMA
accesses from PCI. This seems to confuse the system controller's logic
and outgoing bus cycles targeting the PCI MMIO window seem not to make
it to the intended devices.
This happens as well when a wider mask is used with PCI_BAR0, such as
0x80000000 or 0xe0000000, that makes addresses match that overlap with
the PCI MMIO window, which starts at 0x10000000 in our configuration.
Set the mask in PCI_BAR0 to 0xf0000000 for non-EVA then, covering the
non-EVA maximum 256 MiB of RAM, which is what YAMON does and which used
to work correctly up to the offending commit. Set PCI_P2SCMSKL to match
PCI_BAR0 as required by the system controller's specification, and match
PCI_P2SCMAPL to PCI_HEAD4 for identity mapping.
Verified with:
Core board type/revision = 0x0d (Core74K) / 0x01
System controller/revision = MIPS SOC-it 101 OCP / 1.3 SDR-FW-4:1
Processor Company ID/options = 0x01 (MIPS Technologies, Inc.) / 0x1c
Processor ID/revision = 0x97 (MIPS 74Kf) / 0x4c
for non-EVA and with:
Core board type/revision = 0x0c (CoreFPGA-5) / 0x00
System controller/revision = MIPS ROC-it2 / 0.0 FW-1:1 (CLK_unknown) GIC
Processor Company ID/options = 0x01 (MIPS Technologies, Inc.) / 0x00
Processor ID/revision = 0xa0 (MIPS interAptiv UP) / 0x20
for EVA/non-EVA, fixing:
defxx 0000:00:12.0: assign IRQ: got 10
defxx: v1.12 2021/03/10 Lawrence V. Stefani and others
0000:00:12.0: Could not read adapter factory MAC address!
vs:
defxx 0000:00:12.0: assign IRQ: got 10
defxx: v1.12 2021/03/10 Lawrence V. Stefani and others
0000:00:12.0: DEFPA at MMIO addr = 0x10142000, IRQ = 10, Hardware addr = 00-00-f8-xx-xx-xx
0000:00:12.0: registered as fddi0
for non-EVA and causing no change for EVA.
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 422dd256642b ("MIPS: Malta: Allow PCI devices DMA to lower 2GB physical")
Cc: stable@vger.kernel.org # v4.9+
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/mti-malta/malta-init.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
--- a/arch/mips/mti-malta/malta-init.c
+++ b/arch/mips/mti-malta/malta-init.c
@@ -241,16 +241,22 @@ mips_pci_controller:
#endif
/*
- * Setup the Malta max (2GB) memory for PCI DMA in host bridge
- * in transparent addressing mode.
+ * Set up memory mapping in host bridge for PCI DMA masters,
+ * in transparent addressing mode. For EVA use the Malta
+ * maximum of 2 GiB memory in the alias space at 0x80000000
+ * as per PHYS_OFFSET. Otherwise use 256 MiB of memory in
+ * the regular space, avoiding mapping the PCI MMIO window
+ * for DMA as it seems to confuse the system controller's
+ * logic, causing PCI MMIO to stop working.
*/
- mask = PHYS_OFFSET | PCI_BASE_ADDRESS_MEM_PREFETCH;
- MSC_WRITE(MSC01_PCI_BAR0, mask);
- MSC_WRITE(MSC01_PCI_HEAD4, mask);
+ mask = PHYS_OFFSET ? PHYS_OFFSET : 0xf0000000;
+ MSC_WRITE(MSC01_PCI_BAR0,
+ mask | PCI_BASE_ADDRESS_MEM_PREFETCH);
+ MSC_WRITE(MSC01_PCI_HEAD4,
+ PHYS_OFFSET | PCI_BASE_ADDRESS_MEM_PREFETCH);
- mask &= MSC01_PCI_BAR0_SIZE_MSK;
MSC_WRITE(MSC01_PCI_P2SCMSKL, mask);
- MSC_WRITE(MSC01_PCI_P2SCMAPL, mask);
+ MSC_WRITE(MSC01_PCI_P2SCMAPL, PHYS_OFFSET);
/* Don't handle target retries indefinitely. */
if ((data & MSC01_PCI_CFG_MAXRTRY_MSK) ==
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 443/568] LoongArch: Dont panic if no valid cache info for PCI
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (441 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 442/568] MIPS: Malta: Fix !EVA SOC-it PCI MMIO Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 444/568] mptcp: fix race condition in mptcp_schedule_work() Greg Kroah-Hartman
` (131 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiaxun Yang, Huacai Chen
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhuacai@loongson.cn>
commit a6b533adfc05ba15360631e019d3e18275080275 upstream.
If there is no valid cache info detected (may happen in virtual machine)
for pci_dfl_cache_line_size, kernel shouldn't panic. Because in the PCI
core it will be evaluated to (L1_CACHE_BYTES >> 2).
Cc: <stable@vger.kernel.org>
Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/pci/pci.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/arch/loongarch/pci/pci.c
+++ b/arch/loongarch/pci/pci.c
@@ -51,11 +51,11 @@ static int __init pcibios_init(void)
*/
lsize = cpu_last_level_cache_line_size();
- BUG_ON(!lsize);
+ if (lsize) {
+ pci_dfl_cache_line_size = lsize >> 2;
- pci_dfl_cache_line_size = lsize >> 2;
-
- pr_debug("PCI: pci_cache_line_size set to %d bytes\n", lsize);
+ pr_debug("PCI: pci_cache_line_size set to %d bytes\n", lsize);
+ }
return 0;
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 444/568] mptcp: fix race condition in mptcp_schedule_work()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (442 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 443/568] LoongArch: Dont panic if no valid cache info for PCI Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 445/568] mptcp: fix ack generation for fallback msk Greg Kroah-Hartman
` (130 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+355158e7e301548a1424,
Eric Dumazet, Matthieu Baerts (NGI0), Jakub Kicinski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 035bca3f017ee9dea3a5a756e77a6f7138cc6eea upstream.
syzbot reported use-after-free in mptcp_schedule_work() [1]
Issue here is that mptcp_schedule_work() schedules a work,
then gets a refcount on sk->sk_refcnt if the work was scheduled.
This refcount will be released by mptcp_worker().
[A] if (schedule_work(...)) {
[B] sock_hold(sk);
return true;
}
Problem is that mptcp_worker() can run immediately and complete before [B]
We need instead :
sock_hold(sk);
if (schedule_work(...))
return true;
sock_put(sk);
[1]
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25
Call Trace:
<TASK>
__refcount_add include/linux/refcount.h:-1 [inline]
__refcount_inc include/linux/refcount.h:366 [inline]
refcount_inc include/linux/refcount.h:383 [inline]
sock_hold include/net/sock.h:816 [inline]
mptcp_schedule_work+0x164/0x1a0 net/mptcp/protocol.c:943
mptcp_tout_timer+0x21/0xa0 net/mptcp/protocol.c:2316
call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1798 [inline]
__run_timers kernel/time/timer.c:2372 [inline]
__run_timer_base+0x648/0x970 kernel/time/timer.c:2384
run_timer_base kernel/time/timer.c:2393 [inline]
run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
handle_softirqs+0x22f/0x710 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
run_ktimerd+0xcf/0x190 kernel/softirq.c:1138
smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Cc: stable@vger.kernel.org
Fixes: 3b1d6210a957 ("mptcp: implement and use MPTCP-level retransmission")
Reported-by: syzbot+355158e7e301548a1424@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6915b46f.050a0220.3565dc.0028.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251113103924.3737425-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/protocol.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -966,14 +966,19 @@ static void mptcp_reset_rtx_timer(struct
bool mptcp_schedule_work(struct sock *sk)
{
- if (inet_sk_state_load(sk) != TCP_CLOSE &&
- schedule_work(&mptcp_sk(sk)->work)) {
- /* each subflow already holds a reference to the sk, and the
- * workqueue is invoked by a subflow, so sk can't go away here.
- */
- sock_hold(sk);
+ if (inet_sk_state_load(sk) == TCP_CLOSE)
+ return false;
+
+ /* Get a reference on this socket, mptcp_worker() will release it.
+ * As mptcp_worker() might complete before us, we can not avoid
+ * a sock_hold()/sock_put() if schedule_work() returns false.
+ */
+ sock_hold(sk);
+
+ if (schedule_work(&mptcp_sk(sk)->work))
return true;
- }
+
+ sock_put(sk);
return false;
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 445/568] mptcp: fix ack generation for fallback msk
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (443 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 444/568] mptcp: fix race condition in mptcp_schedule_work() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 446/568] mptcp: fix premature close in case of fallback Greg Kroah-Hartman
` (129 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Geliang Tang,
Matthieu Baerts (NGI0), Jakub Kicinski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <pabeni@redhat.com>
commit 5e15395f6d9ec07395866c5511f4b4ac566c0c9b upstream.
mptcp_cleanup_rbuf() needs to know the last most recent, mptcp-level
rcv_wnd sent, and such information is tracked into the msk->old_wspace
field, updated at ack transmission time by mptcp_write_options().
Fallback socket do not add any mptcp options, such helper is never
invoked, and msk->old_wspace value remain stale. That in turn makes
ack generation at recvmsg() time quite random.
Address the issue ensuring mptcp_write_options() is invoked even for
fallback sockets, and just update the needed info in such a case.
The issue went unnoticed for a long time, as mptcp currently overshots
the fallback socket receive buffer autotune significantly. It is going
to change in the near future.
Fixes: e3859603ba13 ("mptcp: better msk receive window updates")
Cc: stable@vger.kernel.org
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/594
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Geliang Tang <geliang@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-1-806d3781c95f@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/options.c | 23 ++++++++++++++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -834,8 +834,11 @@ bool mptcp_established_options(struct so
opts->suboptions = 0;
+ /* Force later mptcp_write_options(), but do not use any actual
+ * option space.
+ */
if (unlikely(__mptcp_check_fallback(msk) && !mptcp_check_infinite_map(skb)))
- return false;
+ return true;
if (unlikely(skb && TCP_SKB_CB(skb)->tcp_flags & TCPHDR_RST)) {
if (mptcp_established_options_fastclose(sk, &opt_size, remaining, opts) ||
@@ -1296,6 +1299,20 @@ update_wspace:
WRITE_ONCE(msk->old_wspace, tp->rcv_wnd);
}
+static void mptcp_track_rwin(struct tcp_sock *tp)
+{
+ const struct sock *ssk = (const struct sock *)tp;
+ struct mptcp_subflow_context *subflow;
+ struct mptcp_sock *msk;
+
+ if (!ssk)
+ return;
+
+ subflow = mptcp_subflow_ctx(ssk);
+ msk = mptcp_sk(subflow->conn);
+ WRITE_ONCE(msk->old_wspace, tp->rcv_wnd);
+}
+
__sum16 __mptcp_make_csum(u64 data_seq, u32 subflow_seq, u16 data_len, __wsum sum)
{
struct csum_pseudo_header header;
@@ -1588,6 +1605,10 @@ mp_rst:
opts->reset_transient,
opts->reset_reason);
return;
+ } else if (unlikely(!opts->suboptions)) {
+ /* Fallback to TCP */
+ mptcp_track_rwin(tp);
+ return;
}
if (OPTION_MPTCP_PRIO & opts->suboptions) {
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 446/568] mptcp: fix premature close in case of fallback
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (444 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 445/568] mptcp: fix ack generation for fallback msk Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 447/568] mptcp: avoid unneeded subflow-level drops Greg Kroah-Hartman
` (128 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Matthieu Baerts (NGI0),
Jakub Kicinski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <pabeni@redhat.com>
commit 17393fa7b7086664be519e7230cb6ed7ec7d9462 upstream.
I'm observing very frequent self-tests failures in case of fallback when
running on a CONFIG_PREEMPT kernel.
The root cause is that subflow_sched_work_if_closed() closes any subflow
as soon as it is half-closed and has no incoming data pending.
That works well for regular subflows - MPTCP needs bi-directional
connectivity to operate on a given subflow - but for fallback socket is
race prone.
When TCP peer closes the connection before the MPTCP one,
subflow_sched_work_if_closed() will schedule the MPTCP worker to
gracefully close the subflow, and shortly after will do another schedule
to inject and process a dummy incoming DATA_FIN.
On CONFIG_PREEMPT kernel, the MPTCP worker can kick-in and close the
fallback subflow before subflow_sched_work_if_closed() is able to create
the dummy DATA_FIN, unexpectedly interrupting the transfer.
Address the issue explicitly avoiding closing fallback subflows on when
the peer is only half-closed.
Note that, when the subflow is able to create the DATA_FIN before the
worker invocation, the worker will change the msk state before trying to
close the subflow and will skip the latter operation as the msk will not
match anymore the precondition in __mptcp_close_subflow().
Fixes: f09b0ad55a11 ("mptcp: close subflow when receiving TCP+FIN")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-3-806d3781c95f@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/protocol.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -2598,7 +2598,8 @@ static void __mptcp_close_subflow(struct
if (ssk_state != TCP_CLOSE &&
(ssk_state != TCP_CLOSE_WAIT ||
- inet_sk_state_load(sk) != TCP_ESTABLISHED))
+ inet_sk_state_load(sk) != TCP_ESTABLISHED ||
+ __mptcp_check_fallback(msk)))
continue;
/* 'subflow_data_ready' will re-sched once rx queue is empty */
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 447/568] mptcp: avoid unneeded subflow-level drops
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (445 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 446/568] mptcp: fix premature close in case of fallback Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 448/568] mptcp: do not fallback when OoO is present Greg Kroah-Hartman
` (127 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Matthieu Baerts (NGI0),
Jakub Kicinski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <pabeni@redhat.com>
commit 4f102d747cadd8f595f2b25882eed9bec1675fb1 upstream.
The rcv window is shared among all the subflows. Currently, MPTCP sync
the TCP-level rcv window with the MPTCP one at tcp_transmit_skb() time.
The above means that incoming data may sporadically observe outdated
TCP-level rcv window and being wrongly dropped by TCP.
Address the issue checking for the edge condition before queuing the
data at TCP level, and eventually syncing the rcv window as needed.
Note that the issue is actually present from the very first MPTCP
implementation, but backports older than the blamed commit below will
range from impossible to useless.
Before:
$ nstat -n; sleep 1; nstat -z TcpExtBeyondWindow
TcpExtBeyondWindow 14 0.0
After:
$ nstat -n; sleep 1; nstat -z TcpExtBeyondWindow
TcpExtBeyondWindow 0 0.0
Fixes: fa3fe2b15031 ("mptcp: track window announced to peer")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-2-806d3781c95f@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/options.c | 31 +++++++++++++++++++++++++++++++
net/mptcp/protocol.h | 1 +
2 files changed, 32 insertions(+)
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -1028,6 +1028,31 @@ u64 __mptcp_expand_seq(u64 old_seq, u64
return cur_seq;
}
+static void rwin_update(struct mptcp_sock *msk, struct sock *ssk,
+ struct sk_buff *skb)
+{
+ struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk);
+ struct tcp_sock *tp = tcp_sk(ssk);
+ u64 mptcp_rcv_wnd;
+
+ /* Avoid touching extra cachelines if TCP is going to accept this
+ * skb without filling the TCP-level window even with a possibly
+ * outdated mptcp-level rwin.
+ */
+ if (!skb->len || skb->len < tcp_receive_window(tp))
+ return;
+
+ mptcp_rcv_wnd = atomic64_read(&msk->rcv_wnd_sent);
+ if (!after64(mptcp_rcv_wnd, subflow->rcv_wnd_sent))
+ return;
+
+ /* Some other subflow grew the mptcp-level rwin since rcv_wup,
+ * resync.
+ */
+ tp->rcv_wnd += mptcp_rcv_wnd - subflow->rcv_wnd_sent;
+ subflow->rcv_wnd_sent = mptcp_rcv_wnd;
+}
+
static void ack_update_msk(struct mptcp_sock *msk,
struct sock *ssk,
struct mptcp_options_received *mp_opt)
@@ -1188,6 +1213,7 @@ bool mptcp_incoming_options(struct sock
*/
if (mp_opt.use_ack)
ack_update_msk(msk, sk, &mp_opt);
+ rwin_update(msk, sk, skb);
/* Zero-data-length packets are dropped by the caller and not
* propagated to the MPTCP layer, so the skb extension does not
@@ -1274,6 +1300,10 @@ static void mptcp_set_rwin(struct tcp_so
if (rcv_wnd_new != rcv_wnd_old) {
raise_win:
+ /* The msk-level rcv wnd is after the tcp level one,
+ * sync the latter.
+ */
+ rcv_wnd_new = rcv_wnd_old;
win = rcv_wnd_old - ack_seq;
tp->rcv_wnd = min_t(u64, win, U32_MAX);
new_win = tp->rcv_wnd;
@@ -1297,6 +1327,7 @@ raise_win:
update_wspace:
WRITE_ONCE(msk->old_wspace, tp->rcv_wnd);
+ subflow->rcv_wnd_sent = rcv_wnd_new;
}
static void mptcp_track_rwin(struct tcp_sock *tp)
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -458,6 +458,7 @@ struct mptcp_subflow_context {
u64 remote_key;
u64 idsn;
u64 map_seq;
+ u64 rcv_wnd_sent;
u32 snd_isn;
u32 token;
u32 rel_write_seq;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 448/568] mptcp: do not fallback when OoO is present
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (446 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 447/568] mptcp: avoid unneeded subflow-level drops Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 449/568] drm/tegra: dc: Fix reference leak in tegra_dc_couple() Greg Kroah-Hartman
` (126 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Matthieu Baerts (NGI0),
Jakub Kicinski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <pabeni@redhat.com>
commit 1bba3f219c5e8c29e63afa3c1fc24f875ebec119 upstream.
In case of DSS corruption, the MPTCP protocol tries to avoid the subflow
reset if fallback is possible. Such corruptions happen in the receive
path; to ensure fallback is possible the stack additionally needs to
check for OoO data, otherwise the fallback will break the data stream.
Fixes: e32d262c89e2 ("mptcp: handle consistently DSS corruption")
Cc: stable@vger.kernel.org
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/598
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-4-806d3781c95f@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/protocol.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -911,6 +911,13 @@ static bool __mptcp_finish_join(struct m
if (sk->sk_state != TCP_ESTABLISHED)
return false;
+ /* The caller possibly is not holding the msk socket lock, but
+ * in the fallback case only the current subflow is touching
+ * the OoO queue.
+ */
+ if (!RB_EMPTY_ROOT(&msk->out_of_order_queue))
+ return false;
+
spin_lock_bh(&msk->fallback_lock);
if (!msk->allow_subflows) {
spin_unlock_bh(&msk->fallback_lock);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 449/568] drm/tegra: dc: Fix reference leak in tegra_dc_couple()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (447 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 448/568] mptcp: do not fallback when OoO is present Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 450/568] drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled Greg Kroah-Hartman
` (125 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ma Ke, Mikko Perttunen,
Thierry Reding
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make24@iscas.ac.cn>
commit 4c5376b4b143c4834ebd392aef2215847752b16a upstream.
driver_find_device() calls get_device() to increment the reference
count once a matching device is found, but there is no put_device() to
balance the reference count. To avoid reference count leakage, add
put_device() to decrease the reference count.
Found by code review.
Cc: stable@vger.kernel.org
Fixes: a31500fe7055 ("drm/tegra: dc: Restore coupling of display controllers")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Acked-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20251022114720.24937-1-make24@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/tegra/dc.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -3141,6 +3141,7 @@ static int tegra_dc_couple(struct tegra_
dc->client.parent = &parent->client;
dev_dbg(dc->dev, "coupled to %s\n", dev_name(companion));
+ put_device(companion);
}
return 0;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 450/568] drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (448 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 449/568] drm/tegra: dc: Fix reference leak in tegra_dc_couple() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 451/568] xfrm: Determine inner GSO type from packet inner protocol Greg Kroah-Hartman
` (124 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yifan Zha, Alex Deucher
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yifan Zha <Yifan.Zha@amd.com>
commit 80d8a9ad1587b64c545d515ab6cb7ecb9908e1b3 upstream.
[Why]
Accoreding to CP updated to RS64 on gfx11,
WRITE_DATA with PREEMPTION_META_MEMORY(dst_sel=8) is illegal for CP FW.
That packet is used for MCBP on F32 based system.
So it would lead to incorrect GRBM write and FW is not handling that
extra case correctly.
[How]
With gfx11 rs64 enabled, skip emit de meta data.
Signed-off-by: Yifan Zha <Yifan.Zha@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 8366cd442d226463e673bed5d199df916f4ecbcf)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
@@ -5392,9 +5392,9 @@ static void gfx_v11_0_ring_emit_ib_gfx(s
if (flags & AMDGPU_IB_PREEMPTED)
control |= INDIRECT_BUFFER_PRE_RESUME(1);
- if (vmid)
+ if (vmid && !ring->adev->gfx.rs64_enable)
gfx_v11_0_ring_emit_de_meta(ring,
- (!amdgpu_sriov_vf(ring->adev) && flags & AMDGPU_IB_PREEMPTED) ? true : false);
+ !amdgpu_sriov_vf(ring->adev) && (flags & AMDGPU_IB_PREEMPTED));
}
if (ring->is_mes_queue)
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 451/568] xfrm: Determine inner GSO type from packet inner protocol
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (449 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 450/568] drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 452/568] mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() Greg Kroah-Hartman
` (123 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jianbo Liu, Cosmin Ratiu,
Sabrina Dubroca, Steffen Klassert, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <jianbol@nvidia.com>
[ Upstream commit 61fafbee6cfed283c02a320896089f658fa67e56 ]
The GSO segmentation functions for ESP tunnel mode
(xfrm4_tunnel_gso_segment and xfrm6_tunnel_gso_segment) were
determining the inner packet's L2 protocol type by checking the static
x->inner_mode.family field from the xfrm state.
This is unreliable. In tunnel mode, the state's actual inner family
could be defined by x->inner_mode.family or by
x->inner_mode_iaf.family. Checking only the former can lead to a
mismatch with the actual packet being processed, causing GSO to create
segments with the wrong L2 header type.
This patch fixes the bug by deriving the inner mode directly from the
packet's inner protocol stored in XFRM_MODE_SKB_CB(skb)->protocol.
Instead of replicating the code, this patch modifies the
xfrm_ip2inner_mode helper function. It now correctly returns
&x->inner_mode if the selector family (x->sel.family) is already
specified, thereby handling both specific and AF_UNSPEC cases
appropriately.
With this change, ESP GSO can use xfrm_ip2inner_mode to get the
correct inner mode. It doesn't affect existing callers, as the updated
logic now mirrors the checks they were already performing externally.
Fixes: 26dbd66eab80 ("esp: choose the correct inner protocol for GSO on inter address family tunnels")
Signed-off-by: Jianbo Liu <jianbol@nvidia.com>
Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/xfrm.h | 3 ++-
net/ipv4/esp4_offload.c | 6 ++++--
net/ipv6/esp6_offload.c | 6 ++++--
3 files changed, 10 insertions(+), 5 deletions(-)
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 64911162ab5f4..ac5db167370c9 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -446,7 +446,8 @@ static inline int xfrm_af2proto(unsigned int family)
static inline const struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
{
- if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
+ if ((x->sel.family != AF_UNSPEC) ||
+ (ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
(ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
return &x->inner_mode;
else
diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c
index ee848be59e65a..cbfc8b5b15bd2 100644
--- a/net/ipv4/esp4_offload.c
+++ b/net/ipv4/esp4_offload.c
@@ -110,8 +110,10 @@ static struct sk_buff *xfrm4_tunnel_gso_segment(struct xfrm_state *x,
struct sk_buff *skb,
netdev_features_t features)
{
- __be16 type = x->inner_mode.family == AF_INET6 ? htons(ETH_P_IPV6)
- : htons(ETH_P_IP);
+ const struct xfrm_mode *inner_mode = xfrm_ip2inner_mode(x,
+ XFRM_MODE_SKB_CB(skb)->protocol);
+ __be16 type = inner_mode->family == AF_INET6 ? htons(ETH_P_IPV6)
+ : htons(ETH_P_IP);
return skb_eth_gso_segment(skb, features, type);
}
diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c
index fc6a5be732634..65d628e500059 100644
--- a/net/ipv6/esp6_offload.c
+++ b/net/ipv6/esp6_offload.c
@@ -145,8 +145,10 @@ static struct sk_buff *xfrm6_tunnel_gso_segment(struct xfrm_state *x,
struct sk_buff *skb,
netdev_features_t features)
{
- __be16 type = x->inner_mode.family == AF_INET ? htons(ETH_P_IP)
- : htons(ETH_P_IPV6);
+ const struct xfrm_mode *inner_mode = xfrm_ip2inner_mode(x,
+ XFRM_MODE_SKB_CB(skb)->protocol);
+ __be16 type = inner_mode->family == AF_INET ? htons(ETH_P_IP)
+ : htons(ETH_P_IPV6);
return skb_eth_gso_segment(skb, features, type);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 452/568] mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (450 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 451/568] xfrm: Determine inner GSO type from packet inner protocol Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 453/568] gpu: host1x: Select context device based on attached IOMMU Greg Kroah-Hartman
` (122 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zilin Guan, Ido Schimmel,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <zilin@seu.edu.cn>
[ Upstream commit 407a06507c2358554958e8164dc97176feddcafc ]
The function mlxsw_sp_flower_stats() calls mlxsw_sp_acl_ruleset_get() to
obtain a ruleset reference. If the subsequent call to
mlxsw_sp_acl_rule_lookup() fails to find a rule, the function returns
an error without releasing the ruleset reference, causing a memory leak.
Fix this by using a goto to the existing error handling label, which
calls mlxsw_sp_acl_ruleset_put() to properly release the reference.
Fixes: 7c1b8eb175b69 ("mlxsw: spectrum: Add support for TC flower offload statistics")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20251112052114.1591695-1-zilin@seu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
index e91fb205e0b4c..66e95918bdf6e 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
@@ -719,8 +719,10 @@ int mlxsw_sp_flower_stats(struct mlxsw_sp *mlxsw_sp,
return -EINVAL;
rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
- if (!rule)
- return -EINVAL;
+ if (!rule) {
+ err = -EINVAL;
+ goto err_rule_get_stats;
+ }
err = mlxsw_sp_acl_rule_get_stats(mlxsw_sp, rule, &packets, &bytes,
&drops, &lastuse, &used_hw_stats);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 453/568] gpu: host1x: Select context device based on attached IOMMU
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (451 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 452/568] mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 454/568] drm/tegra: Add call to put_pid() Greg Kroah-Hartman
` (121 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mikko Perttunen, Thierry Reding,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Perttunen <mperttunen@nvidia.com>
[ Upstream commit 8935002fc37fce1ad211d98a70f2fd42083c0594 ]
On Tegra234, engines that are programmed through Host1x channels can
be attached to either the NISO0 or NISO1 SMMU. Because of that, when
selecting a context device to use with an engine, we need to select
one that is also attached to the same SMMU.
Add a parameter to host1x_memory_context_alloc to specify which device
we are allocating a context for, and use it to pick an appropriate
context device.
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
[treding@nvidia.com: update !IOMMU_API stub signature]
Signed-off-by: Thierry Reding <treding@nvidia.com>
Stable-dep-of: 6cbab9f0da72 ("drm/tegra: Add call to put_pid()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tegra/uapi.c | 2 +-
drivers/gpu/host1x/context.c | 4 ++++
include/linux/host1x.h | 2 ++
3 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/tegra/uapi.c b/drivers/gpu/drm/tegra/uapi.c
index a98239cb0e29a..5adab6b229164 100644
--- a/drivers/gpu/drm/tegra/uapi.c
+++ b/drivers/gpu/drm/tegra/uapi.c
@@ -116,7 +116,7 @@ int tegra_drm_ioctl_channel_open(struct drm_device *drm, void *data, struct drm_
if (supported)
context->memory_context = host1x_memory_context_alloc(
- host, get_task_pid(current, PIDTYPE_TGID));
+ host, client->base.dev, get_task_pid(current, PIDTYPE_TGID));
if (IS_ERR(context->memory_context)) {
if (PTR_ERR(context->memory_context) != -EOPNOTSUPP) {
diff --git a/drivers/gpu/host1x/context.c b/drivers/gpu/host1x/context.c
index 93c0c532fe5af..9c0db178fade9 100644
--- a/drivers/gpu/host1x/context.c
+++ b/drivers/gpu/host1x/context.c
@@ -112,6 +112,7 @@ void host1x_memory_context_list_free(struct host1x_memory_context_list *cdl)
}
struct host1x_memory_context *host1x_memory_context_alloc(struct host1x *host1x,
+ struct device *dev,
struct pid *pid)
{
struct host1x_memory_context_list *cdl = &host1x->context_list;
@@ -126,6 +127,9 @@ struct host1x_memory_context *host1x_memory_context_alloc(struct host1x *host1x,
for (i = 0; i < cdl->len; i++) {
struct host1x_memory_context *cd = &cdl->devs[i];
+ if (cd->dev.iommu->iommu_dev != dev->iommu->iommu_dev)
+ continue;
+
if (cd->owner == pid) {
refcount_inc(&cd->ref);
mutex_unlock(&cdl->lock);
diff --git a/include/linux/host1x.h b/include/linux/host1x.h
index cb2100d9b0ffe..dc55d9d3b94f0 100644
--- a/include/linux/host1x.h
+++ b/include/linux/host1x.h
@@ -469,11 +469,13 @@ struct host1x_memory_context {
#ifdef CONFIG_IOMMU_API
struct host1x_memory_context *host1x_memory_context_alloc(struct host1x *host1x,
+ struct device *dev,
struct pid *pid);
void host1x_memory_context_get(struct host1x_memory_context *cd);
void host1x_memory_context_put(struct host1x_memory_context *cd);
#else
static inline struct host1x_memory_context *host1x_memory_context_alloc(struct host1x *host1x,
+ struct device *dev,
struct pid *pid)
{
return NULL;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 454/568] drm/tegra: Add call to put_pid()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (452 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 453/568] gpu: host1x: Select context device based on attached IOMMU Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 455/568] net: dsa: hellcreek: fix missing error handling in LED registration Greg Kroah-Hartman
` (120 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Prateek Agarwal, Mikko Perttunen,
Thierry Reding, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prateek Agarwal <praagarwal@nvidia.com>
[ Upstream commit 6cbab9f0da72b4dc3c3f9161197aa3b9daa1fa3a ]
Add a call to put_pid() corresponding to get_task_pid().
host1x_memory_context_alloc() does not take ownership of the PID so we
need to free it here to avoid leaking.
Signed-off-by: Prateek Agarwal <praagarwal@nvidia.com>
Fixes: e09db97889ec ("drm/tegra: Support context isolation")
[mperttunen@nvidia.com: reword commit message]
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20250919-host1x-put-pid-v1-1-19c2163dfa87@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tegra/uapi.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/tegra/uapi.c b/drivers/gpu/drm/tegra/uapi.c
index 5adab6b229164..d0b6a1fa6efad 100644
--- a/drivers/gpu/drm/tegra/uapi.c
+++ b/drivers/gpu/drm/tegra/uapi.c
@@ -114,9 +114,12 @@ int tegra_drm_ioctl_channel_open(struct drm_device *drm, void *data, struct drm_
if (err)
goto put_channel;
- if (supported)
+ if (supported) {
+ struct pid *pid = get_task_pid(current, PIDTYPE_TGID);
context->memory_context = host1x_memory_context_alloc(
- host, client->base.dev, get_task_pid(current, PIDTYPE_TGID));
+ host, client->base.dev, pid);
+ put_pid(pid);
+ }
if (IS_ERR(context->memory_context)) {
if (PTR_ERR(context->memory_context) != -EOPNOTSUPP) {
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 455/568] net: dsa: hellcreek: fix missing error handling in LED registration
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (453 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 454/568] drm/tegra: Add call to put_pid() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 456/568] net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() Greg Kroah-Hartman
` (119 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pavel Zhigulin, Andrew Lunn,
Kurt Kanzenbach, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
[ Upstream commit e6751b0b19a6baab219a62e1e302b8aa6b5a55b2 ]
The LED setup routine registered both led_sync_good
and led_is_gm devices without checking the return
values of led_classdev_register(). If either registration
failed, the function continued silently, leaving the
driver in a partially-initialized state and leaking
a registered LED classdev.
Add proper error handling
Fixes: 7d9ee2e8ff15 ("net: dsa: hellcreek: Add PTP status LEDs")
Signed-off-by: Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Acked-by: Kurt Kanzenbach <kurt@linutronix.de>
Link: https://patch.msgid.link/20251113135745.92375-1-Pavel.Zhigulin@kaspersky.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/hirschmann/hellcreek_ptp.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/drivers/net/dsa/hirschmann/hellcreek_ptp.c b/drivers/net/dsa/hirschmann/hellcreek_ptp.c
index b28baab6d56a1..763666480a8a8 100644
--- a/drivers/net/dsa/hirschmann/hellcreek_ptp.c
+++ b/drivers/net/dsa/hirschmann/hellcreek_ptp.c
@@ -367,8 +367,18 @@ static int hellcreek_led_setup(struct hellcreek *hellcreek)
hellcreek_set_brightness(hellcreek, STATUS_OUT_IS_GM, 1);
/* Register both leds */
- led_classdev_register(hellcreek->dev, &hellcreek->led_sync_good);
- led_classdev_register(hellcreek->dev, &hellcreek->led_is_gm);
+ ret = led_classdev_register(hellcreek->dev, &hellcreek->led_sync_good);
+ if (ret) {
+ dev_err(hellcreek->dev, "Failed to register sync_good LED\n");
+ goto out;
+ }
+
+ ret = led_classdev_register(hellcreek->dev, &hellcreek->led_is_gm);
+ if (ret) {
+ dev_err(hellcreek->dev, "Failed to register is_gm LED\n");
+ led_classdev_unregister(&hellcreek->led_sync_good);
+ goto out;
+ }
ret = 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 456/568] net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (454 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 455/568] net: dsa: hellcreek: fix missing error handling in LED registration Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 457/568] net: openvswitch: remove never-working support for setting nsh fields Greg Kroah-Hartman
` (118 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pavel Zhigulin, Ido Schimmel,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
[ Upstream commit b0c959fec18f4595a6a6317ffc30615cfa37bf69 ]
The call to devlink_info_version_fixed_put() in
mlxsw_linecard_devlink_info_get() did not check for errors,
although it is checked everywhere in the code.
Add missed 'err' check to the mlxsw_linecard_devlink_info_get()
Fixes: 3fc0c51905fb ("mlxsw: core_linecards: Expose device PSID over device info")
Signed-off-by: Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20251113161922.813828-1-Pavel.Zhigulin@kaspersky.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlxsw/core_linecards.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c b/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c
index 99196333d1324..525973da7abc9 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c
@@ -601,6 +601,8 @@ int mlxsw_linecard_devlink_info_get(struct mlxsw_linecard *linecard,
err = devlink_info_version_fixed_put(req,
DEVLINK_INFO_VERSION_GENERIC_FW_PSID,
info->psid);
+ if (err)
+ goto unlock;
sprintf(buf, "%u.%u.%u", info->fw_major, info->fw_minor,
info->fw_sub_minor);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 457/568] net: openvswitch: remove never-working support for setting nsh fields
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (455 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 456/568] net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 458/568] nvme-multipath: fix lockdep WARN due to partition scan work Greg Kroah-Hartman
` (117 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Junvy Yang, Ilya Maximets,
Eelco Chaudron, Aaron Conole, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Maximets <i.maximets@ovn.org>
[ Upstream commit dfe28c4167a9259fc0c372d9f9473e1ac95cff67 ]
The validation of the set(nsh(...)) action is completely wrong.
It runs through the nsh_key_put_from_nlattr() function that is the
same function that validates NSH keys for the flow match and the
push_nsh() action. However, the set(nsh(...)) has a very different
memory layout. Nested attributes in there are doubled in size in
case of the masked set(). That makes proper validation impossible.
There is also confusion in the code between the 'masked' flag, that
says that the nested attributes are doubled in size containing both
the value and the mask, and the 'is_mask' that says that the value
we're parsing is the mask. This is causing kernel crash on trying to
write into mask part of the match with SW_FLOW_KEY_PUT() during
validation, while validate_nsh() doesn't allocate any memory for it:
BUG: kernel NULL pointer dereference, address: 0000000000000018
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1c2383067 P4D 1c2383067 PUD 20b703067 PMD 0
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 8 UID: 0 Kdump: loaded Not tainted 6.17.0-rc4+ #107 PREEMPT(voluntary)
RIP: 0010:nsh_key_put_from_nlattr+0x19d/0x610 [openvswitch]
Call Trace:
<TASK>
validate_nsh+0x60/0x90 [openvswitch]
validate_set.constprop.0+0x270/0x3c0 [openvswitch]
__ovs_nla_copy_actions+0x477/0x860 [openvswitch]
ovs_nla_copy_actions+0x8d/0x100 [openvswitch]
ovs_packet_cmd_execute+0x1cc/0x310 [openvswitch]
genl_family_rcv_msg_doit+0xdb/0x130
genl_family_rcv_msg+0x14b/0x220
genl_rcv_msg+0x47/0xa0
netlink_rcv_skb+0x53/0x100
genl_rcv+0x24/0x40
netlink_unicast+0x280/0x3b0
netlink_sendmsg+0x1f7/0x430
____sys_sendmsg+0x36b/0x3a0
___sys_sendmsg+0x87/0xd0
__sys_sendmsg+0x6d/0xd0
do_syscall_64+0x7b/0x2c0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
The third issue with this process is that while trying to convert
the non-masked set into masked one, validate_set() copies and doubles
the size of the OVS_KEY_ATTR_NSH as if it didn't have any nested
attributes. It should be copying each nested attribute and doubling
them in size independently. And the process must be properly reversed
during the conversion back from masked to a non-masked variant during
the flow dump.
In the end, the only two outcomes of trying to use this action are
either validation failure or a kernel crash. And if somehow someone
manages to install a flow with such an action, it will most definitely
not do what it is supposed to, since all the keys and the masks are
mixed up.
Fixing all the issues is a complex task as it requires re-writing
most of the validation code.
Given that and the fact that this functionality never worked since
introduction, let's just remove it altogether. It's better to
re-introduce it later with a proper implementation instead of trying
to fix it in stable releases.
Fixes: b2d0f5d5dc53 ("openvswitch: enable NSH support")
Reported-by: Junvy Yang <zhuque@tencent.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Acked-by: Eelco Chaudron <echaudro@redhat.com>
Reviewed-by: Aaron Conole <aconole@redhat.com>
Link: https://patch.msgid.link/20251112112246.95064-1-i.maximets@ovn.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/openvswitch/actions.c | 68 +---------------------------------
net/openvswitch/flow_netlink.c | 64 ++++----------------------------
net/openvswitch/flow_netlink.h | 2 -
3 files changed, 9 insertions(+), 125 deletions(-)
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index a87c25e06bafd..f7cc87e67d3c8 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -595,69 +595,6 @@ static int set_ipv6(struct sk_buff *skb, struct sw_flow_key *flow_key,
return 0;
}
-static int set_nsh(struct sk_buff *skb, struct sw_flow_key *flow_key,
- const struct nlattr *a)
-{
- struct nshhdr *nh;
- size_t length;
- int err;
- u8 flags;
- u8 ttl;
- int i;
-
- struct ovs_key_nsh key;
- struct ovs_key_nsh mask;
-
- err = nsh_key_from_nlattr(a, &key, &mask);
- if (err)
- return err;
-
- /* Make sure the NSH base header is there */
- if (!pskb_may_pull(skb, skb_network_offset(skb) + NSH_BASE_HDR_LEN))
- return -ENOMEM;
-
- nh = nsh_hdr(skb);
- length = nsh_hdr_len(nh);
-
- /* Make sure the whole NSH header is there */
- err = skb_ensure_writable(skb, skb_network_offset(skb) +
- length);
- if (unlikely(err))
- return err;
-
- nh = nsh_hdr(skb);
- skb_postpull_rcsum(skb, nh, length);
- flags = nsh_get_flags(nh);
- flags = OVS_MASKED(flags, key.base.flags, mask.base.flags);
- flow_key->nsh.base.flags = flags;
- ttl = nsh_get_ttl(nh);
- ttl = OVS_MASKED(ttl, key.base.ttl, mask.base.ttl);
- flow_key->nsh.base.ttl = ttl;
- nsh_set_flags_and_ttl(nh, flags, ttl);
- nh->path_hdr = OVS_MASKED(nh->path_hdr, key.base.path_hdr,
- mask.base.path_hdr);
- flow_key->nsh.base.path_hdr = nh->path_hdr;
- switch (nh->mdtype) {
- case NSH_M_TYPE1:
- for (i = 0; i < NSH_MD1_CONTEXT_SIZE; i++) {
- nh->md1.context[i] =
- OVS_MASKED(nh->md1.context[i], key.context[i],
- mask.context[i]);
- }
- memcpy(flow_key->nsh.context, nh->md1.context,
- sizeof(nh->md1.context));
- break;
- case NSH_M_TYPE2:
- memset(flow_key->nsh.context, 0,
- sizeof(flow_key->nsh.context));
- break;
- default:
- return -EINVAL;
- }
- skb_postpush_rcsum(skb, nh, length);
- return 0;
-}
-
/* Must follow skb_ensure_writable() since that can move the skb data. */
static void set_tp_port(struct sk_buff *skb, __be16 *port,
__be16 new_port, __sum16 *check)
@@ -1130,10 +1067,6 @@ static int execute_masked_set_action(struct sk_buff *skb,
get_mask(a, struct ovs_key_ethernet *));
break;
- case OVS_KEY_ATTR_NSH:
- err = set_nsh(skb, flow_key, a);
- break;
-
case OVS_KEY_ATTR_IPV4:
err = set_ipv4(skb, flow_key, nla_data(a),
get_mask(a, struct ovs_key_ipv4 *));
@@ -1170,6 +1103,7 @@ static int execute_masked_set_action(struct sk_buff *skb,
case OVS_KEY_ATTR_CT_LABELS:
case OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4:
case OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6:
+ case OVS_KEY_ATTR_NSH:
err = -EINVAL;
break;
}
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 0ed3953dbe529..d0b6e58720816 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -1290,6 +1290,11 @@ static int metadata_from_nlattrs(struct net *net, struct sw_flow_match *match,
return 0;
}
+/*
+ * Constructs NSH header 'nh' from attributes of OVS_ACTION_ATTR_PUSH_NSH,
+ * where 'nh' points to a memory block of 'size' bytes. It's assumed that
+ * attributes were previously validated with validate_push_nsh().
+ */
int nsh_hdr_from_nlattr(const struct nlattr *attr,
struct nshhdr *nh, size_t size)
{
@@ -1299,8 +1304,6 @@ int nsh_hdr_from_nlattr(const struct nlattr *attr,
u8 ttl = 0;
int mdlen = 0;
- /* validate_nsh has check this, so we needn't do duplicate check here
- */
if (size < NSH_BASE_HDR_LEN)
return -ENOBUFS;
@@ -1344,46 +1347,6 @@ int nsh_hdr_from_nlattr(const struct nlattr *attr,
return 0;
}
-int nsh_key_from_nlattr(const struct nlattr *attr,
- struct ovs_key_nsh *nsh, struct ovs_key_nsh *nsh_mask)
-{
- struct nlattr *a;
- int rem;
-
- /* validate_nsh has check this, so we needn't do duplicate check here
- */
- nla_for_each_nested(a, attr, rem) {
- int type = nla_type(a);
-
- switch (type) {
- case OVS_NSH_KEY_ATTR_BASE: {
- const struct ovs_nsh_key_base *base = nla_data(a);
- const struct ovs_nsh_key_base *base_mask = base + 1;
-
- nsh->base = *base;
- nsh_mask->base = *base_mask;
- break;
- }
- case OVS_NSH_KEY_ATTR_MD1: {
- const struct ovs_nsh_key_md1 *md1 = nla_data(a);
- const struct ovs_nsh_key_md1 *md1_mask = md1 + 1;
-
- memcpy(nsh->context, md1->context, sizeof(*md1));
- memcpy(nsh_mask->context, md1_mask->context,
- sizeof(*md1_mask));
- break;
- }
- case OVS_NSH_KEY_ATTR_MD2:
- /* Not supported yet */
- return -ENOTSUPP;
- default:
- return -EINVAL;
- }
- }
-
- return 0;
-}
-
static int nsh_key_put_from_nlattr(const struct nlattr *attr,
struct sw_flow_match *match, bool is_mask,
bool is_push_nsh, bool log)
@@ -2823,17 +2786,13 @@ static int validate_and_copy_set_tun(const struct nlattr *attr,
return err;
}
-static bool validate_nsh(const struct nlattr *attr, bool is_mask,
- bool is_push_nsh, bool log)
+static bool validate_push_nsh(const struct nlattr *attr, bool log)
{
struct sw_flow_match match;
struct sw_flow_key key;
- int ret = 0;
ovs_match_init(&match, &key, true, NULL);
- ret = nsh_key_put_from_nlattr(attr, &match, is_mask,
- is_push_nsh, log);
- return !ret;
+ return !nsh_key_put_from_nlattr(attr, &match, false, true, log);
}
/* Return false if there are any non-masked bits set.
@@ -2981,13 +2940,6 @@ static int validate_set(const struct nlattr *a,
break;
- case OVS_KEY_ATTR_NSH:
- if (eth_type != htons(ETH_P_NSH))
- return -EINVAL;
- if (!validate_nsh(nla_data(a), masked, false, log))
- return -EINVAL;
- break;
-
default:
return -EINVAL;
}
@@ -3394,7 +3346,7 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
return -EINVAL;
}
mac_proto = MAC_PROTO_NONE;
- if (!validate_nsh(nla_data(a), false, true, true))
+ if (!validate_push_nsh(nla_data(a), log))
return -EINVAL;
break;
diff --git a/net/openvswitch/flow_netlink.h b/net/openvswitch/flow_netlink.h
index fe7f77fc5f189..ff8cdecbe3465 100644
--- a/net/openvswitch/flow_netlink.h
+++ b/net/openvswitch/flow_netlink.h
@@ -65,8 +65,6 @@ int ovs_nla_put_actions(const struct nlattr *attr,
void ovs_nla_free_flow_actions(struct sw_flow_actions *);
void ovs_nla_free_flow_actions_rcu(struct sw_flow_actions *);
-int nsh_key_from_nlattr(const struct nlattr *attr, struct ovs_key_nsh *nsh,
- struct ovs_key_nsh *nsh_mask);
int nsh_hdr_from_nlattr(const struct nlattr *attr, struct nshhdr *nh,
size_t size);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 458/568] nvme-multipath: fix lockdep WARN due to partition scan work
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (456 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 457/568] net: openvswitch: remove never-working support for setting nsh fields Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 459/568] s390/ctcm: Fix double-kfree Greg Kroah-Hartman
` (116 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yi Zhang, Shinichiro Kawasaki,
Christoph Hellwig, Hannes Reinecke, Keith Busch, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
[ Upstream commit 6d87cd5335784351280f82c47cc8a657271929c3 ]
Blktests test cases nvme/014, 057 and 058 fail occasionally due to a
lockdep WARN. As reported in the Closes tag URL, the WARN indicates that
a deadlock can happen due to the dependency among disk->open_mutex,
kblockd workqueue completion and partition_scan_work completion.
To avoid the lockdep WARN and the potential deadlock, cut the dependency
by running the partition_scan_work not by kblockd workqueue but by
nvme_wq.
Reported-by: Yi Zhang <yi.zhang@redhat.com>
Closes: https://lore.kernel.org/linux-block/CAHj4cs8mJ+R_GmQm9R8ebResKAWUE8kF5+_WVg0v8zndmqd6BQ@mail.gmail.com/
Link: https://lore.kernel.org/linux-block/oeyzci6ffshpukpfqgztsdeke5ost5hzsuz4rrsjfmvpqcevax@5nhnwbkzbrpa/
Fixes: 1f021341eef4 ("nvme-multipath: defer partition scanning")
Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/multipath.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index 43b89c7d585f0..a3e225bb4b88f 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -577,7 +577,7 @@ static void nvme_mpath_set_live(struct nvme_ns *ns)
return;
}
nvme_add_ns_head_cdev(head);
- kblockd_schedule_work(&head->partition_scan_work);
+ queue_work(nvme_wq, &head->partition_scan_work);
}
mutex_lock(&head->lock);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 459/568] s390/ctcm: Fix double-kfree
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (457 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 458/568] nvme-multipath: fix lockdep WARN due to partition scan work Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 460/568] platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos Greg Kroah-Hartman
` (115 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aswin Karuvally, Aleksei Nikiforov,
Simon Horman, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksei Nikiforov <aleksei.nikiforov@linux.ibm.com>
[ Upstream commit da02a1824884d6c84c5e5b5ac373b0c9e3288ec2 ]
The function 'mpc_rcvd_sweep_req(mpcginfo)' is called conditionally
from function 'ctcmpc_unpack_skb'. It frees passed mpcginfo.
After that a call to function 'kfree' in function 'ctcmpc_unpack_skb'
frees it again.
Remove 'kfree' call in function 'mpc_rcvd_sweep_req(mpcginfo)'.
Bug detected by the clang static analyzer.
Fixes: 0c0b20587b9f25a2 ("s390/ctcm: fix potential memory leak")
Reviewed-by: Aswin Karuvally <aswin@linux.ibm.com>
Signed-off-by: Aleksei Nikiforov <aleksei.nikiforov@linux.ibm.com>
Signed-off-by: Aswin Karuvally <aswin@linux.ibm.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251112182724.1109474-1-aswin@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/net/ctcm_mpc.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/s390/net/ctcm_mpc.c b/drivers/s390/net/ctcm_mpc.c
index 8ac213a551418..55216d2fbea0b 100644
--- a/drivers/s390/net/ctcm_mpc.c
+++ b/drivers/s390/net/ctcm_mpc.c
@@ -698,7 +698,6 @@ static void mpc_rcvd_sweep_req(struct mpcg_info *mpcginfo)
grp->sweep_req_pend_num--;
ctcmpc_send_sweep_resp(ch);
- kfree(mpcginfo);
return;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 460/568] platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (458 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 459/568] s390/ctcm: Fix double-kfree Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 461/568] kernel.h: Move ARRAY_SIZE() to a separate header Greg Kroah-Hartman
` (114 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Srinivas Pandruvada,
Ilpo Järvinen, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit d8bb447efc5622577994287dc77c684fa8840b30 ]
isst_if_probe() uses pci_read_config_dword() that returns PCIBIOS_*
codes. The return code is returned from the probe function as is but
probe functions should return normal errnos. A proper implementation
can be found in drivers/leds/leds-ss4200.c.
Convert PCIBIOS_* return codes using pcibios_err_to_errno() into
normal errno before returning.
Fixes: d3a23584294c ("platform/x86: ISST: Add Intel Speed Select mmio interface")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/20251117033354.132-1-vulab@iscas.ac.cn
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel/speed_select_if/isst_if_mmio.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/platform/x86/intel/speed_select_if/isst_if_mmio.c b/drivers/platform/x86/intel/speed_select_if/isst_if_mmio.c
index ff49025ec0856..bb38e5f021a80 100644
--- a/drivers/platform/x86/intel/speed_select_if/isst_if_mmio.c
+++ b/drivers/platform/x86/intel/speed_select_if/isst_if_mmio.c
@@ -106,11 +106,11 @@ static int isst_if_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
ret = pci_read_config_dword(pdev, 0xD0, &mmio_base);
if (ret)
- return ret;
+ return pcibios_err_to_errno(ret);
ret = pci_read_config_dword(pdev, 0xFC, &pcu_base);
if (ret)
- return ret;
+ return pcibios_err_to_errno(ret);
pcu_base &= GENMASK(10, 0);
base_addr = (u64)mmio_base << 23 | (u64) pcu_base << 12;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 461/568] kernel.h: Move ARRAY_SIZE() to a separate header
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (459 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 460/568] platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 462/568] net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() Greg Kroah-Hartman
` (113 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alejandro Colomar, Giovanni Cabiddu,
Andy Shevchenko, Andy Shevchenko, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alejandro Colomar <alx@kernel.org>
[ Upstream commit 3cd39bc3b11b8d34b7d7c961a35fdfd18b0ebf75 ]
Touching files so used for the kernel,
forces 'make' to recompile most of the kernel.
Having those definitions in more granular files
helps avoid recompiling so much of the kernel.
Signed-off-by: Alejandro Colomar <alx@kernel.org>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Link: https://lore.kernel.org/r/20230817143352.132583-2-lucas.segarra.fernandez@intel.com
[andy: reduced to cover only string.h for now]
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Stable-dep-of: 896f1a2493b5 ("net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/array_size.h | 13 +++++++++++++
include/linux/kernel.h | 7 +------
include/linux/string.h | 1 +
3 files changed, 15 insertions(+), 6 deletions(-)
create mode 100644 include/linux/array_size.h
diff --git a/include/linux/array_size.h b/include/linux/array_size.h
new file mode 100644
index 0000000000000..06d7d83196ca3
--- /dev/null
+++ b/include/linux/array_size.h
@@ -0,0 +1,13 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _LINUX_ARRAY_SIZE_H
+#define _LINUX_ARRAY_SIZE_H
+
+#include <linux/compiler.h>
+
+/**
+ * ARRAY_SIZE - get the number of elements in array @arr
+ * @arr: array to be sized
+ */
+#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
+
+#endif /* _LINUX_ARRAY_SIZE_H */
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index fe6efb24d151a..50254bb6b7a98 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -13,6 +13,7 @@
#include <linux/stdarg.h>
#include <linux/align.h>
+#include <linux/array_size.h>
#include <linux/limits.h>
#include <linux/linkage.h>
#include <linux/stddef.h>
@@ -48,12 +49,6 @@
#define READ 0
#define WRITE 1
-/**
- * ARRAY_SIZE - get the number of elements in array @arr
- * @arr: array to be sized
- */
-#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
-
#define PTR_IF(cond, ptr) ((cond) ? (ptr) : NULL)
#define u64_to_user_ptr(x) ( \
diff --git a/include/linux/string.h b/include/linux/string.h
index 422606e98cc42..e7ade5223d422 100644
--- a/include/linux/string.h
+++ b/include/linux/string.h
@@ -2,6 +2,7 @@
#ifndef _LINUX_STRING_H_
#define _LINUX_STRING_H_
+#include <linux/array_size.h>
#include <linux/compiler.h> /* for inline */
#include <linux/types.h> /* for size_t */
#include <linux/stddef.h> /* for NULL */
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 462/568] net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (460 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 461/568] kernel.h: Move ARRAY_SIZE() to a separate header Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 463/568] vsock: Ignore signal/timeout on connect() if already established Greg Kroah-Hartman
` (112 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pavel Zhigulin, Paolo Abeni,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
[ Upstream commit 896f1a2493b59beb2b5ccdf990503dbb16cb2256 ]
The loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate
over 'cqe->len_list[]' using only a zero-length terminator as
the stopping condition. If the terminator was missing or
malformed, the loop could run past the end of the fixed-size array.
Add an explicit bound check using ARRAY_SIZE() in both loops to prevent
a potential out-of-bounds access.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 55482edc25f0 ("qede: Add slowpath/fastpath support and enable hardware GRO")
Signed-off-by: Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
Link: https://patch.msgid.link/20251113112757.4166625-1-Pavel.Zhigulin@kaspersky.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/qlogic/qede/qede_fp.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c
index cb1746bc0e0c5..273dae622c411 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
@@ -4,6 +4,7 @@
* Copyright (c) 2019-2020 Marvell International Ltd.
*/
+#include <linux/array_size.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
#include <linux/skbuff.h>
@@ -960,7 +961,7 @@ static inline void qede_tpa_cont(struct qede_dev *edev,
{
int i;
- for (i = 0; cqe->len_list[i]; i++)
+ for (i = 0; cqe->len_list[i] && i < ARRAY_SIZE(cqe->len_list); i++)
qede_fill_frag_skb(edev, rxq, cqe->tpa_agg_index,
le16_to_cpu(cqe->len_list[i]));
@@ -985,7 +986,7 @@ static int qede_tpa_end(struct qede_dev *edev,
dma_unmap_page(rxq->dev, tpa_info->buffer.mapping,
PAGE_SIZE, rxq->data_direction);
- for (i = 0; cqe->len_list[i]; i++)
+ for (i = 0; cqe->len_list[i] && i < ARRAY_SIZE(cqe->len_list); i++)
qede_fill_frag_skb(edev, rxq, cqe->tpa_agg_index,
le16_to_cpu(cqe->len_list[i]));
if (unlikely(i > 1))
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 463/568] vsock: Ignore signal/timeout on connect() if already established
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (461 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 462/568] net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 464/568] bcma: dont register devices disabled in OF Greg Kroah-Hartman
` (111 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michal Luczaj, Stefano Garzarella,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <mhal@rbox.co>
[ Upstream commit 002541ef650b742a198e4be363881439bb9d86b4 ]
During connect(), acting on a signal/timeout by disconnecting an already
established socket leads to several issues:
1. connect() invoking vsock_transport_cancel_pkt() ->
virtio_transport_purge_skbs() may race with sendmsg() invoking
virtio_transport_get_credit(). This results in a permanently elevated
`vvs->bytes_unsent`. Which, in turn, confuses the SOCK_LINGER handling.
2. connect() resetting a connected socket's state may race with socket
being placed in a sockmap. A disconnected socket remaining in a sockmap
breaks sockmap's assumptions. And gives rise to WARNs.
3. connect() transitioning SS_CONNECTED -> SS_UNCONNECTED allows for a
transport change/drop after TCP_ESTABLISHED. Which poses a problem for
any simultaneous sendmsg() or connect() and may result in a
use-after-free/null-ptr-deref.
Do not disconnect socket on signal/timeout. Keep the logic for unconnected
sockets: they don't linger, can't be placed in a sockmap, are rejected by
sendmsg().
[1]: https://lore.kernel.org/netdev/e07fd95c-9a38-4eea-9638-133e38c2ec9b@rbox.co/
[2]: https://lore.kernel.org/netdev/20250317-vsock-trans-signal-race-v4-0-fc8837f3f1d4@rbox.co/
[3]: https://lore.kernel.org/netdev/60f1b7db-3099-4f6a-875e-af9f6ef194f6@rbox.co/
Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
Signed-off-by: Michal Luczaj <mhal@rbox.co>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://patch.msgid.link/20251119-vsock-interrupted-connect-v2-1-70734cf1233f@rbox.co
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/vmw_vsock/af_vsock.c | 40 +++++++++++++++++++++++++++++++---------
1 file changed, 31 insertions(+), 9 deletions(-)
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 6de321a6e43cf..95441466d90dd 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1502,18 +1502,40 @@ static int vsock_connect(struct socket *sock, struct sockaddr *addr,
timeout = schedule_timeout(timeout);
lock_sock(sk);
- if (signal_pending(current)) {
- err = sock_intr_errno(timeout);
- sk->sk_state = sk->sk_state == TCP_ESTABLISHED ? TCP_CLOSING : TCP_CLOSE;
- sock->state = SS_UNCONNECTED;
- vsock_transport_cancel_pkt(vsk);
- vsock_remove_connected(vsk);
- goto out_wait;
- } else if ((sk->sk_state != TCP_ESTABLISHED) && (timeout == 0)) {
- err = -ETIMEDOUT;
+ /* Connection established. Whatever happens to socket once we
+ * release it, that's not connect()'s concern. No need to go
+ * into signal and timeout handling. Call it a day.
+ *
+ * Note that allowing to "reset" an already established socket
+ * here is racy and insecure.
+ */
+ if (sk->sk_state == TCP_ESTABLISHED)
+ break;
+
+ /* If connection was _not_ established and a signal/timeout came
+ * to be, we want the socket's state reset. User space may want
+ * to retry.
+ *
+ * sk_state != TCP_ESTABLISHED implies that socket is not on
+ * vsock_connected_table. We keep the binding and the transport
+ * assigned.
+ */
+ if (signal_pending(current) || timeout == 0) {
+ err = timeout == 0 ? -ETIMEDOUT : sock_intr_errno(timeout);
+
+ /* Listener might have already responded with
+ * VIRTIO_VSOCK_OP_RESPONSE. Its handling expects our
+ * sk_state == TCP_SYN_SENT, which hereby we break.
+ * In such case VIRTIO_VSOCK_OP_RST will follow.
+ */
sk->sk_state = TCP_CLOSE;
sock->state = SS_UNCONNECTED;
+
+ /* Try to cancel VIRTIO_VSOCK_OP_REQUEST skb sent out by
+ * transport->connect().
+ */
vsock_transport_cancel_pkt(vsk);
+
goto out_wait;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 464/568] bcma: dont register devices disabled in OF
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (462 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 463/568] vsock: Ignore signal/timeout on connect() if already established Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 465/568] cifs: fix typo in enable_gcm_256 module parameter Greg Kroah-Hartman
` (110 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafał Miłecki,
Florian Fainelli, Johannes Berg, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <rafal@milecki.pl>
[ Upstream commit a2a69add80411dd295c9088c1bcf925b1f4e53d7 ]
Some bus devices can be marked as disabled for specific SoCs or models.
Those should not be registered to avoid probing them.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20251003125126.27950-1-zajec5@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bcma/main.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index 44392b624b200..11fbae15a7884 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -293,6 +293,8 @@ static int bcma_register_devices(struct bcma_bus *bus)
int err;
list_for_each_entry(core, &bus->cores, list) {
+ struct device_node *np;
+
/* We support that core ourselves */
switch (core->id.id) {
case BCMA_CORE_4706_CHIPCOMMON:
@@ -310,6 +312,10 @@ static int bcma_register_devices(struct bcma_bus *bus)
if (bcma_is_core_needed_early(core->id.id))
continue;
+ np = core->dev.of_node;
+ if (np && !of_device_is_available(np))
+ continue;
+
/* Only first GMAC core on BCM4706 is connected and working */
if (core->id.id == BCMA_CORE_4706_MAC_GBIT &&
core->core_unit > 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 465/568] cifs: fix typo in enable_gcm_256 module parameter
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (463 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 464/568] bcma: dont register devices disabled in OF Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 466/568] scsi: core: Fix a regression triggered by scsi_host_busy() Greg Kroah-Hartman
` (109 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thomas Spear, Steve French,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <stfrench@microsoft.com>
[ Upstream commit f765fdfcd8b5bce92c6aa1a517ff549529ddf590 ]
Fix typo in description of enable_gcm_256 module parameter
Suggested-by: Thomas Spear <speeddymon@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/cifsfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c
index 32b008bc99a09..74e4beb351946 100644
--- a/fs/smb/client/cifsfs.c
+++ b/fs/smb/client/cifsfs.c
@@ -128,7 +128,7 @@ module_param(enable_oplocks, bool, 0644);
MODULE_PARM_DESC(enable_oplocks, "Enable or disable oplocks. Default: y/Y/1");
module_param(enable_gcm_256, bool, 0644);
-MODULE_PARM_DESC(enable_gcm_256, "Enable requesting strongest (256 bit) GCM encryption. Default: y/Y/0");
+MODULE_PARM_DESC(enable_gcm_256, "Enable requesting strongest (256 bit) GCM encryption. Default: y/Y/1");
module_param(require_gcm_256, bool, 0644);
MODULE_PARM_DESC(require_gcm_256, "Require strongest (256 bit) GCM encryption. Default: n/N/0");
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 466/568] scsi: core: Fix a regression triggered by scsi_host_busy()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (464 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 465/568] cifs: fix typo in enable_gcm_256 module parameter Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 467/568] selftests: net: use BASH for bareudp testing Greg Kroah-Hartman
` (108 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Reichel, Ming Lei,
Jens Axboe, Bart Van Assche, Martin K. Petersen, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
[ Upstream commit a0b7780602b1b196f47e527fec82166a7e67c4d0 ]
Commit 995412e23bb2 ("blk-mq: Replace tags->lock with SRCU for tag
iterators") introduced the following regression:
Call trace:
__srcu_read_lock+0x30/0x80 (P)
blk_mq_tagset_busy_iter+0x44/0x300
scsi_host_busy+0x38/0x70
ufshcd_print_host_state+0x34/0x1bc
ufshcd_link_startup.constprop.0+0xe4/0x2e0
ufshcd_init+0x944/0xf80
ufshcd_pltfrm_init+0x504/0x820
ufs_rockchip_probe+0x2c/0x88
platform_probe+0x5c/0xa4
really_probe+0xc0/0x38c
__driver_probe_device+0x7c/0x150
driver_probe_device+0x40/0x120
__driver_attach+0xc8/0x1e0
bus_for_each_dev+0x7c/0xdc
driver_attach+0x24/0x30
bus_add_driver+0x110/0x230
driver_register+0x68/0x130
__platform_driver_register+0x20/0x2c
ufs_rockchip_pltform_init+0x1c/0x28
do_one_initcall+0x60/0x1e0
kernel_init_freeable+0x248/0x2c4
kernel_init+0x20/0x140
ret_from_fork+0x10/0x20
Fix this regression by making scsi_host_busy() check whether the SCSI
host tag set has already been initialized. tag_set->ops is set by
scsi_mq_setup_tags() just before blk_mq_alloc_tag_set() is called. This
fix is based on the assumption that scsi_host_busy() and
scsi_mq_setup_tags() calls are serialized. This is the case in the UFS
driver.
Reported-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Closes: https://lore.kernel.org/linux-block/pnezafputodmqlpumwfbn644ohjybouveehcjhz2hmhtcf2rka@sdhoiivync4y/
Cc: Ming Lei <ming.lei@redhat.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Tested-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Link: https://patch.msgid.link/20251007214800.1678255-1-bvanassche@acm.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/hosts.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index c785493b105c0..28cf473fcf96d 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -600,8 +600,9 @@ int scsi_host_busy(struct Scsi_Host *shost)
{
int cnt = 0;
- blk_mq_tagset_busy_iter(&shost->tag_set,
- scsi_host_check_in_flight, &cnt);
+ if (shost->tag_set.ops)
+ blk_mq_tagset_busy_iter(&shost->tag_set,
+ scsi_host_check_in_flight, &cnt);
return cnt;
}
EXPORT_SYMBOL(scsi_host_busy);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 467/568] selftests: net: use BASH for bareudp testing
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (465 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 466/568] scsi: core: Fix a regression triggered by scsi_host_busy() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 468/568] net: tls: Cancel RX async resync request on rcd_delta overflow Greg Kroah-Hartman
` (107 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Edoardo Canepa, Po-Hsu Lin,
Przemek Kitszel, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Po-Hsu Lin <po-hsu.lin@canonical.com>
[ Upstream commit 9311e9540a8b406d9f028aa87fb072a3819d4c82 ]
In bareudp.sh, this script uses /bin/sh and it will load another lib.sh
BASH script at the very beginning.
But on some operating systems like Ubuntu, /bin/sh is actually pointed to
DASH, thus it will try to run BASH commands with DASH and consequently
leads to syntax issues:
# ./bareudp.sh: 4: ./lib.sh: Bad substitution
# ./bareudp.sh: 5: ./lib.sh: source: not found
# ./bareudp.sh: 24: ./lib.sh: Syntax error: "(" unexpected
Fix this by explicitly using BASH for bareudp.sh. This fixes test
execution failures on systems where /bin/sh is not BASH.
Reported-by: Edoardo Canepa <edoardo.canepa@canonical.com>
Link: https://bugs.launchpad.net/bugs/2129812
Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Link: https://patch.msgid.link/20251027095710.2036108-2-po-hsu.lin@canonical.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/bareudp.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/net/bareudp.sh b/tools/testing/selftests/net/bareudp.sh
index f366cadbc5e86..ff4308b48e65d 100755
--- a/tools/testing/selftests/net/bareudp.sh
+++ b/tools/testing/selftests/net/bareudp.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
# SPDX-License-Identifier: GPL-2.0
# Test various bareudp tunnel configurations.
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 468/568] net: tls: Cancel RX async resync request on rcd_delta overflow
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (466 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 467/568] selftests: net: use BASH for bareudp testing Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 469/568] kconfig/mconf: Initialize the default locale at startup Greg Kroah-Hartman
` (106 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shahar Shitrit, Sabrina Dubroca,
Tariq Toukan, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shahar Shitrit <shshitrit@nvidia.com>
[ Upstream commit c15d5c62ab313c19121f10e25d4fec852bd1c40c ]
When a netdev issues a RX async resync request for a TLS connection,
the TLS module handles it by logging record headers and attempting to
match them to the tcp_sn provided by the device. If a match is found,
the TLS module approves the tcp_sn for resynchronization.
While waiting for a device response, the TLS module also increments
rcd_delta each time a new TLS record is received, tracking the distance
from the original resync request.
However, if the device response is delayed or fails (e.g due to
unstable connection and device getting out of tracking, hardware
errors, resource exhaustion etc.), the TLS module keeps logging and
incrementing, which can lead to a WARN() when rcd_delta exceeds the
threshold.
To address this, introduce tls_offload_rx_resync_async_request_cancel()
to explicitly cancel resync requests when a device response failure is
detected. Call this helper also as a final safeguard when rcd_delta
crosses its threshold, as reaching this point implies that earlier
cancellation did not occur.
Signed-off-by: Shahar Shitrit <shshitrit@nvidia.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/1761508983-937977-3-git-send-email-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/tls.h | 6 ++++++
net/tls/tls_device.c | 4 +++-
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/include/net/tls.h b/include/net/tls.h
index 899c863aba02c..037049def8a7f 100644
--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -475,6 +475,12 @@ tls_offload_rx_resync_async_request_end(struct sock *sk, __be32 seq)
((u64)ntohl(seq) << 32) | RESYNC_REQ);
}
+static inline void
+tls_offload_rx_resync_async_request_cancel(struct tls_offload_resync_async *resync_async)
+{
+ atomic64_set(&resync_async->req, 0);
+}
+
static inline void
tls_offload_rx_resync_set_type(struct sock *sk, enum tls_offload_sync_type type)
{
diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
index 1849827884735..c51377a159bec 100644
--- a/net/tls/tls_device.c
+++ b/net/tls/tls_device.c
@@ -739,8 +739,10 @@ tls_device_rx_resync_async(struct tls_offload_resync_async *resync_async,
/* shouldn't get to wraparound:
* too long in async stage, something bad happened
*/
- if (WARN_ON_ONCE(resync_async->rcd_delta == USHRT_MAX))
+ if (WARN_ON_ONCE(resync_async->rcd_delta == USHRT_MAX)) {
+ tls_offload_rx_resync_async_request_cancel(resync_async);
return false;
+ }
/* asynchronous stage: log all headers seq such that
* req_seq <= seq <= end_seq, and wait for real resync request
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 469/568] kconfig/mconf: Initialize the default locale at startup
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (467 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 468/568] net: tls: Cancel RX async resync request on rcd_delta overflow Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 470/568] kconfig/nconf: " Greg Kroah-Hartman
` (105 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Horký, Nathan Chancellor,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Horký <jakub.git@horky.net>
[ Upstream commit 3927c4a1084c48ef97f11281a0a43ecb2cb4d6f1 ]
Fix bug where make menuconfig doesn't initialize the default locale, which
causes ncurses menu borders to be displayed incorrectly (lqqqqk) in
UTF-8 terminals that don't support VT100 ACS by default, such as PuTTY.
Signed-off-by: Jakub Horký <jakub.git@horky.net>
Link: https://patch.msgid.link/20251014154933.3990990-1-jakub.git@horky.net
[nathan: Alphabetize locale.h include]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/kconfig/mconf.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/scripts/kconfig/mconf.c b/scripts/kconfig/mconf.c
index 9d3cf510562f8..0649ff35ec5c0 100644
--- a/scripts/kconfig/mconf.c
+++ b/scripts/kconfig/mconf.c
@@ -12,6 +12,7 @@
#include <errno.h>
#include <fcntl.h>
#include <limits.h>
+#include <locale.h>
#include <stdarg.h>
#include <stdlib.h>
#include <string.h>
@@ -1005,6 +1006,8 @@ int main(int ac, char **av)
signal(SIGINT, sig_handler);
+ setlocale(LC_ALL, "");
+
if (ac > 1 && strcmp(av[1], "-s") == 0) {
silent = 1;
/* Silence conf_read() until the real callback is set up */
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 470/568] kconfig/nconf: Initialize the default locale at startup
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (468 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 469/568] kconfig/mconf: Initialize the default locale at startup Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 471/568] mm/secretmem: fix use-after-free race in fault handler Greg Kroah-Hartman
` (104 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Horký, Nathan Chancellor,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Horký <jakub.git@horky.net>
[ Upstream commit 43c2931a95e6b295bfe9e3b90dbe0f7596933e91 ]
Fix bug where make nconfig doesn't initialize the default locale, which
causes ncurses menu borders to be displayed incorrectly (lqqqqk) in
UTF-8 terminals that don't support VT100 ACS by default, such as PuTTY.
Signed-off-by: Jakub Horký <jakub.git@horky.net>
Link: https://patch.msgid.link/20251014144405.3975275-2-jakub.git@horky.net
[nathan: Alphabetize locale.h include]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/kconfig/nconf.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/scripts/kconfig/nconf.c b/scripts/kconfig/nconf.c
index 16a2db59432a5..e9ae03d056b09 100644
--- a/scripts/kconfig/nconf.c
+++ b/scripts/kconfig/nconf.c
@@ -7,6 +7,7 @@
#ifndef _GNU_SOURCE
#define _GNU_SOURCE
#endif
+#include <locale.h>
#include <string.h>
#include <strings.h>
#include <stdlib.h>
@@ -1476,6 +1477,8 @@ int main(int ac, char **av)
int lines, columns;
char *mode;
+ setlocale(LC_ALL, "");
+
if (ac > 1 && strcmp(av[1], "-s") == 0) {
/* Silence conf_read() until the real callback is set up */
conf_set_message_callback(NULL);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 471/568] mm/secretmem: fix use-after-free race in fault handler
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (469 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 470/568] kconfig/nconf: " Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 472/568] mm/mm_init: fix hash table order logging in alloc_large_system_hash() Greg Kroah-Hartman
` (103 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lance Yang, Google Big Sleep,
David Hildenbrand, Mike Rapoport (Microsoft), Lorenzo Stoakes,
Matthew Wilcox (Oracle), Andrew Morton, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lance Yang <lance.yang@linux.dev>
[ Upstream commit 6f86d0534fddfbd08687fa0f01479d4226bc3c3d ]
When a page fault occurs in a secret memory file created with
`memfd_secret(2)`, the kernel will allocate a new page for it, mark the
underlying page as not-present in the direct map, and add it to the file
mapping.
If two tasks cause a fault in the same page concurrently, both could end
up allocating a page and removing the page from the direct map, but only
one would succeed in adding the page to the file mapping. The task that
failed undoes the effects of its attempt by (a) freeing the page again
and (b) putting the page back into the direct map. However, by doing
these two operations in this order, the page becomes available to the
allocator again before it is placed back in the direct mapping.
If another task attempts to allocate the page between (a) and (b), and the
kernel tries to access it via the direct map, it would result in a
supervisor not-present page fault.
Fix the ordering to restore the direct map before the page is freed.
Link: https://lkml.kernel.org/r/20251031120955.92116-1-lance.yang@linux.dev
Fixes: 1507f51255c9 ("mm: introduce memfd_secret system call to create "secret" memory areas")
Signed-off-by: Lance Yang <lance.yang@linux.dev>
Reported-by: Google Big Sleep <big-sleep-vuln-reports@google.com>
Closes: https://lore.kernel.org/linux-mm/CAEXGt5QeDpiHTu3K9tvjUTPqo+d-=wuCNYPa+6sWKrdQJ-ATdg@mail.gmail.com/
Acked-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
[rppt: replaced folio with page in the patch and in the changelog]
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/secretmem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/secretmem.c b/mm/secretmem.c
index 18954eae995fc..b570a6e25b6be 100644
--- a/mm/secretmem.c
+++ b/mm/secretmem.c
@@ -82,13 +82,13 @@ static vm_fault_t secretmem_fault(struct vm_fault *vmf)
__SetPageUptodate(page);
err = add_to_page_cache_lru(page, mapping, offset, gfp);
if (unlikely(err)) {
- put_page(page);
/*
* If a split of large page was required, it
* already happened when we marked the page invalid
* which guarantees that this call won't fail
*/
set_direct_map_default_noflush(page);
+ put_page(page);
if (err == -EEXIST)
goto retry;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 472/568] mm/mm_init: fix hash table order logging in alloc_large_system_hash()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (470 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 471/568] mm/secretmem: fix use-after-free race in fault handler Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 473/568] ALSA: usb-audio: fix uac2 clock source at terminal parser Greg Kroah-Hartman
` (102 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Isaac J. Manjarres,
Mike Rapoport (Microsoft), David Hildenbrand, Andrew Morton,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Isaac J. Manjarres <isaacmanjarres@google.com>
[ Upstream commit 0d6c356dd6547adac2b06b461528e3573f52d953 ]
When emitting the order of the allocation for a hash table,
alloc_large_system_hash() unconditionally subtracts PAGE_SHIFT from log
base 2 of the allocation size. This is not correct if the allocation size
is smaller than a page, and yields a negative value for the order as seen
below:
TCP established hash table entries: 32 (order: -4, 256 bytes, linear) TCP
bind hash table entries: 32 (order: -2, 1024 bytes, linear)
Use get_order() to compute the order when emitting the hash table
information to correctly handle cases where the allocation size is smaller
than a page:
TCP established hash table entries: 32 (order: 0, 256 bytes, linear) TCP
bind hash table entries: 32 (order: 0, 1024 bytes, linear)
Link: https://lkml.kernel.org/r/20251028191020.413002-1-isaacmanjarres@google.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 0d6c356dd6547adac2b06b461528e3573f52d953)
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/page_alloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 86066a2cf258a..d760b96604eca 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -9225,7 +9225,7 @@ void *__init alloc_large_system_hash(const char *tablename,
panic("Failed to allocate %s hash table\n", tablename);
pr_info("%s hash table entries: %ld (order: %d, %lu bytes, %s)\n",
- tablename, 1UL << log2qty, ilog2(size) - PAGE_SHIFT, size,
+ tablename, 1UL << log2qty, get_order(size), size,
virt ? (huge ? "vmalloc hugepage" : "vmalloc") : "linear");
if (_hash_shift)
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 473/568] ALSA: usb-audio: fix uac2 clock source at terminal parser
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (471 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 472/568] mm/mm_init: fix hash table order logging in alloc_large_system_hash() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 474/568] net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error Greg Kroah-Hartman
` (101 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, René Rebe, Takashi Iwai,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: René Rebe <rene@exactco.de>
[ Upstream commit d26e9f669cc0a6a85cf17180c09a6686db9f4002 ]
Since 8b3a087f7f65 ("ALSA: usb-audio: Unify virtual type units type to
UAC3 values") usb-audio is using UAC3_CLOCK_SOURCE instead of
bDescriptorSubtype, later refactored with e0ccdef9265 ("ALSA: usb-audio:
Clean up check_input_term()") into parse_term_uac2_clock_source().
This breaks the clock source selection for at least my
1397:0003 BEHRINGER International GmbH FCA610 Pro.
Fix by using UAC2_CLOCK_SOURCE in parse_term_uac2_clock_source().
Fixes: 8b3a087f7f65 ("ALSA: usb-audio: Unify virtual type units type to UAC3 values")
Signed-off-by: René Rebe <rene@exactco.de>
Link: https://patch.msgid.link/20251125.154149.1121389544970412061.rene@exactco.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 9b34004e67131..1540e9f1c2e3f 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -930,7 +930,7 @@ static int parse_term_uac2_clock_source(struct mixer_build *state,
{
struct uac_clock_source_descriptor *d = p1;
- term->type = UAC3_CLOCK_SOURCE << 16; /* virtual type */
+ term->type = UAC2_CLOCK_SOURCE << 16; /* virtual type */
term->id = id;
term->name = d->iClockSource;
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 474/568] net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (472 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 473/568] ALSA: usb-audio: fix uac2 clock source at terminal parser Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 475/568] tracing/tools: Fix incorrcet short option in usage text for --threads Greg Kroah-Hartman
` (100 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Simon Horman, Jacob Keller,
Nishanth Menon, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Menon <nm@ti.com>
[ Upstream commit 90a88306eb874fe4bbdd860e6c9787f5bbc588b5 ]
Make knav_dma_open_channel consistently return NULL on error instead
of ERR_PTR. Currently the header include/linux/soc/ti/knav_dma.h
returns NULL when the driver is disabled, but the driver
implementation does not even return NULL or ERR_PTR on failure,
causing inconsistency in the users. This results in a crash in
netcp_free_navigator_resources as followed (trimmed):
Unhandled fault: alignment exception (0x221) at 0xfffffff2
[fffffff2] *pgd=80000800207003, *pmd=82ffda003, *pte=00000000
Internal error: : 221 [#1] SMP ARM
Modules linked in:
CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.0-rc7 #1 NONE
Hardware name: Keystone
PC is at knav_dma_close_channel+0x30/0x19c
LR is at netcp_free_navigator_resources+0x2c/0x28c
[... TRIM...]
Call trace:
knav_dma_close_channel from netcp_free_navigator_resources+0x2c/0x28c
netcp_free_navigator_resources from netcp_ndo_open+0x430/0x46c
netcp_ndo_open from __dev_open+0x114/0x29c
__dev_open from __dev_change_flags+0x190/0x208
__dev_change_flags from netif_change_flags+0x1c/0x58
netif_change_flags from dev_change_flags+0x38/0xa0
dev_change_flags from ip_auto_config+0x2c4/0x11f0
ip_auto_config from do_one_initcall+0x58/0x200
do_one_initcall from kernel_init_freeable+0x1cc/0x238
kernel_init_freeable from kernel_init+0x1c/0x12c
kernel_init from ret_from_fork+0x14/0x38
[... TRIM...]
Standardize the error handling by making the function return NULL on
all error conditions. The API is used in just the netcp_core.c so the
impact is limited.
Note, this change, in effect reverts commit 5b6cb43b4d62 ("net:
ethernet: ti: netcp_core: return error while dma channel open issue"),
but provides a less error prone implementation.
Suggested-by: Simon Horman <horms@kernel.org>
Suggested-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Nishanth Menon <nm@ti.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20251103162811.3730055-1-nm@ti.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ti/netcp_core.c | 10 +++++-----
drivers/soc/ti/knav_dma.c | 14 +++++++-------
2 files changed, 12 insertions(+), 12 deletions(-)
diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c
index 9eb9eaff4dc90..6c0c9b795c8fe 100644
--- a/drivers/net/ethernet/ti/netcp_core.c
+++ b/drivers/net/ethernet/ti/netcp_core.c
@@ -1338,10 +1338,10 @@ int netcp_txpipe_open(struct netcp_tx_pipe *tx_pipe)
tx_pipe->dma_channel = knav_dma_open_channel(dev,
tx_pipe->dma_chan_name, &config);
- if (IS_ERR(tx_pipe->dma_channel)) {
+ if (!tx_pipe->dma_channel) {
dev_err(dev, "failed opening tx chan(%s)\n",
tx_pipe->dma_chan_name);
- ret = PTR_ERR(tx_pipe->dma_channel);
+ ret = -EINVAL;
goto err;
}
@@ -1359,7 +1359,7 @@ int netcp_txpipe_open(struct netcp_tx_pipe *tx_pipe)
return 0;
err:
- if (!IS_ERR_OR_NULL(tx_pipe->dma_channel))
+ if (tx_pipe->dma_channel)
knav_dma_close_channel(tx_pipe->dma_channel);
tx_pipe->dma_channel = NULL;
return ret;
@@ -1678,10 +1678,10 @@ static int netcp_setup_navigator_resources(struct net_device *ndev)
netcp->rx_channel = knav_dma_open_channel(netcp->netcp_device->device,
netcp->dma_chan_name, &config);
- if (IS_ERR(netcp->rx_channel)) {
+ if (!netcp->rx_channel) {
dev_err(netcp->ndev_dev, "failed opening rx chan(%s\n",
netcp->dma_chan_name);
- ret = PTR_ERR(netcp->rx_channel);
+ ret = -EINVAL;
goto fail;
}
diff --git a/drivers/soc/ti/knav_dma.c b/drivers/soc/ti/knav_dma.c
index 84afebd355bef..10014ffca829a 100644
--- a/drivers/soc/ti/knav_dma.c
+++ b/drivers/soc/ti/knav_dma.c
@@ -402,7 +402,7 @@ static int of_channel_match_helper(struct device_node *np, const char *name,
* @name: slave channel name
* @config: dma configuration parameters
*
- * Returns pointer to appropriate DMA channel on success or error.
+ * Return: Pointer to appropriate DMA channel on success or NULL on error.
*/
void *knav_dma_open_channel(struct device *dev, const char *name,
struct knav_dma_cfg *config)
@@ -414,13 +414,13 @@ void *knav_dma_open_channel(struct device *dev, const char *name,
if (!kdev) {
pr_err("keystone-navigator-dma driver not registered\n");
- return (void *)-EINVAL;
+ return NULL;
}
chan_num = of_channel_match_helper(dev->of_node, name, &instance);
if (chan_num < 0) {
dev_err(kdev->dev, "No DMA instance with name %s\n", name);
- return (void *)-EINVAL;
+ return NULL;
}
dev_dbg(kdev->dev, "initializing %s channel %d from DMA %s\n",
@@ -431,7 +431,7 @@ void *knav_dma_open_channel(struct device *dev, const char *name,
if (config->direction != DMA_MEM_TO_DEV &&
config->direction != DMA_DEV_TO_MEM) {
dev_err(kdev->dev, "bad direction\n");
- return (void *)-EINVAL;
+ return NULL;
}
/* Look for correct dma instance */
@@ -443,7 +443,7 @@ void *knav_dma_open_channel(struct device *dev, const char *name,
}
if (!dma) {
dev_err(kdev->dev, "No DMA instance with name %s\n", instance);
- return (void *)-EINVAL;
+ return NULL;
}
/* Look for correct dma channel from dma instance */
@@ -463,14 +463,14 @@ void *knav_dma_open_channel(struct device *dev, const char *name,
if (!chan) {
dev_err(kdev->dev, "channel %d is not in DMA %s\n",
chan_num, instance);
- return (void *)-EINVAL;
+ return NULL;
}
if (atomic_read(&chan->ref_count) >= 1) {
if (!check_config(chan, config)) {
dev_err(kdev->dev, "channel %d config miss-match\n",
chan_num);
- return (void *)-EINVAL;
+ return NULL;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 475/568] tracing/tools: Fix incorrcet short option in usage text for --threads
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (473 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 474/568] net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 476/568] uio_hv_generic: Set event for all channels on the device Greg Kroah-Hartman
` (99 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Chujun,
Steven Rostedt (Google), Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Chujun <zhangchujun@cmss.chinamobile.com>
[ Upstream commit 53afec2c8fb2a562222948cb1c2aac48598578c9 ]
The help message incorrectly listed '-t' as the short option for
--threads, but the actual getopt_long configuration uses '-e'.
This mismatch can confuse users and lead to incorrect command-line
usage. This patch updates the usage string to correctly show:
"-e, --threads NRTHR"
to match the implementation.
Note: checkpatch.pl reports a false-positive spelling warning on
'Run', which is intentional.
Link: https://patch.msgid.link/20251106031040.1869-1-zhangchujun@cmss.chinamobile.com
Signed-off-by: Zhang Chujun <zhangchujun@cmss.chinamobile.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/tracing/latency/latency-collector.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/tracing/latency/latency-collector.c b/tools/tracing/latency/latency-collector.c
index f7ed8084e16ad..ec95b94f80e1f 100644
--- a/tools/tracing/latency/latency-collector.c
+++ b/tools/tracing/latency/latency-collector.c
@@ -1725,7 +1725,7 @@ static void show_usage(void)
"-n, --notrace\t\tIf latency is detected, do not print out the content of\n"
"\t\t\tthe trace file to standard output\n\n"
-"-t, --threads NRTHR\tRun NRTHR threads for printing. Default is %d.\n\n"
+"-e, --threads NRTHR\tRun NRTHR threads for printing. Default is %d.\n\n"
"-r, --random\t\tArbitrarily sleep a certain amount of time, default\n"
"\t\t\t%ld ms, before reading the trace file. The\n"
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 476/568] uio_hv_generic: Set event for all channels on the device
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (474 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 475/568] tracing/tools: Fix incorrcet short option in usage text for --threads Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 6.1 477/568] mm/truncate: unmap large folio on split failure Greg Kroah-Hartman
` (98 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Long Li, Michael Kelley,
Saurabh Sengar, Naman Jain
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <longli@microsoft.com>
commit d062463edf1770427dc2d637df4088df4835aa47 upstream.
Hyper-V may offer a non latency sensitive device with subchannels without
monitor bit enabled. The decision is entirely on the Hyper-V host not
configurable within guest.
When a device has subchannels, also signal events for the subchannel
if its monitor bit is disabled.
This patch also removes the memory barrier when monitor bit is enabled
as it is not necessary. The memory barrier is only needed between
setting up interrupt mask and calling vmbus_set_event() when monitor
bit is disabled.
Signed-off-by: Long Li <longli@microsoft.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Saurabh Sengar <ssengar@linux.microsoft.com>
Link: https://lore.kernel.org/r/1741644721-20389-1-git-send-email-longli@linuxonhyperv.com
Fixes: b15b7d2a1b09 ("uio_hv_generic: Let userspace take care of interrupt mask")
Closes: https://bugs.debian.org/1120602
Signed-off-by: Naman Jain <namjain@linux.microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/uio/uio_hv_generic.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
--- a/drivers/uio/uio_hv_generic.c
+++ b/drivers/uio/uio_hv_generic.c
@@ -80,9 +80,15 @@ hv_uio_irqcontrol(struct uio_info *info,
{
struct hv_uio_private_data *pdata = info->priv;
struct hv_device *dev = pdata->device;
+ struct vmbus_channel *primary, *sc;
- dev->channel->inbound.ring_buffer->interrupt_mask = !irq_state;
- virt_mb();
+ primary = dev->channel;
+ primary->inbound.ring_buffer->interrupt_mask = !irq_state;
+
+ mutex_lock(&vmbus_connection.channel_mutex);
+ list_for_each_entry(sc, &primary->sc_list, sc_list)
+ sc->inbound.ring_buffer->interrupt_mask = !irq_state;
+ mutex_unlock(&vmbus_connection.channel_mutex);
return 0;
}
@@ -93,11 +99,18 @@ hv_uio_irqcontrol(struct uio_info *info,
static void hv_uio_channel_cb(void *context)
{
struct vmbus_channel *chan = context;
- struct hv_device *hv_dev = chan->device_obj;
- struct hv_uio_private_data *pdata = hv_get_drvdata(hv_dev);
+ struct hv_device *hv_dev;
+ struct hv_uio_private_data *pdata;
virt_mb();
+ /*
+ * The callback may come from a subchannel, in which case look
+ * for the hv device in the primary channel
+ */
+ hv_dev = chan->primary_channel ?
+ chan->primary_channel->device_obj : chan->device_obj;
+ pdata = hv_get_drvdata(hv_dev);
uio_event_notify(&pdata->info);
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 477/568] mm/truncate: unmap large folio on split failure
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (475 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 476/568] uio_hv_generic: Set event for all channels on the device Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 478/568] maple_tree: fix tracepoint string pointers Greg Kroah-Hartman
` (97 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kiryl Shutsemau, Al Viro,
Baolin Wang, Christian Brauner, Darrick J. Wong, Dave Chinner,
David Hildenbrand, Hugh Dickins, Johannes Weiner, Liam Howlett,
Lorenzo Stoakes, Matthew Wilcox (Oracle), Michal Hocko,
Mike Rapoport, Rik van Riel, Shakeel Butt, Suren Baghdasaryan,
Vlastimil Babka, Andrew Morton
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiryl Shutsemau <kas@kernel.org>
commit fa04f5b60fda62c98a53a60de3a1e763f11feb41 upstream.
Accesses within VMA, but beyond i_size rounded up to PAGE_SIZE are
supposed to generate SIGBUS.
This behavior might not be respected on truncation.
During truncation, the kernel splits a large folio in order to reclaim
memory. As a side effect, it unmaps the folio and destroys PMD mappings
of the folio. The folio will be refaulted as PTEs and SIGBUS semantics
are preserved.
However, if the split fails, PMD mappings are preserved and the user will
not receive SIGBUS on any accesses within the PMD.
Unmap the folio on split failure. It will lead to refault as PTEs and
preserve SIGBUS semantics.
Make an exception for shmem/tmpfs that for long time intentionally mapped
with PMDs across i_size.
Link: https://lkml.kernel.org/r/20251027115636.82382-3-kirill@shutemov.name
Fixes: b9a8a4195c7d ("truncate,shmem: Handle truncates that split large folios")
Signed-off-by: Kiryl Shutsemau <kas@kernel.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: "Darrick J. Wong" <djwong@kernel.org>
Cc: Dave Chinner <david@fromorbit.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Kiryl Shutsemau <kas@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/truncate.c | 27 ++++++++++++++++++++++++++-
1 file changed, 26 insertions(+), 1 deletion(-)
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -196,6 +196,31 @@ int truncate_inode_folio(struct address_
return 0;
}
+static int try_folio_split_or_unmap(struct folio *folio)
+{
+ enum ttu_flags ttu_flags =
+ TTU_SYNC |
+ TTU_SPLIT_HUGE_PMD |
+ TTU_IGNORE_MLOCK;
+ int ret;
+
+ ret = split_folio(folio);
+
+ /*
+ * If the split fails, unmap the folio, so it will be refaulted
+ * with PTEs to respect SIGBUS semantics.
+ *
+ * Make an exception for shmem/tmpfs that for long time
+ * intentionally mapped with PMDs across i_size.
+ */
+ if (ret && !shmem_mapping(folio->mapping)) {
+ try_to_unmap(folio, ttu_flags);
+ WARN_ON(folio_mapped(folio));
+ }
+
+ return ret;
+}
+
/*
* Handle partial folios. The folio may be entirely within the
* range if a split has raced with us. If not, we zero the part of the
@@ -239,7 +264,7 @@ bool truncate_inode_partial_folio(struct
folio_invalidate(folio, offset, length);
if (!folio_test_large(folio))
return true;
- if (split_folio(folio) == 0)
+ if (try_folio_split_or_unmap(folio) == 0)
return true;
if (folio_test_dirty(folio))
return false;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 478/568] maple_tree: fix tracepoint string pointers
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (476 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 6.1 477/568] mm/truncate: unmap large folio on split failure Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 479/568] mptcp: decouple mptcp fastclose from tcp close Greg Kroah-Hartman
` (96 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Kaiser, Liam R. Howlett,
Andrew Morton
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kaiser <martin@kaiser.cx>
commit 91a54090026f84ceffaa12ac53c99b9f162946f6 upstream.
maple_tree tracepoints contain pointers to function names. Such a pointer
is saved when a tracepoint logs an event. There's no guarantee that it's
still valid when the event is parsed later and the pointer is dereferenced.
The kernel warns about these unsafe pointers.
event 'ma_read' has unsafe pointer field 'fn'
WARNING: kernel/trace/trace.c:3779 at ignore_event+0x1da/0x1e4
Mark the function names as tracepoint_string() to fix the events.
One case that doesn't work without my patch would be trace-cmd record
to save the binary ringbuffer and trace-cmd report to parse it in
userspace. The address of __func__ can't be dereferenced from
userspace but tracepoint_string will add an entry to
/sys/kernel/tracing/printk_formats
Link: https://lkml.kernel.org/r/20251030155537.87972-1-martin@kaiser.cx
Fixes: 54a611b60590 ("Maple Tree: add new data structure")
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Acked-by: Liam R. Howlett <Liam.Howlett@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/maple_tree.c | 30 ++++++++++++++++--------------
1 file changed, 16 insertions(+), 14 deletions(-)
--- a/lib/maple_tree.c
+++ b/lib/maple_tree.c
@@ -62,6 +62,8 @@
#define CREATE_TRACE_POINTS
#include <trace/events/maple_tree.h>
+#define TP_FCT tracepoint_string(__func__)
+
#define MA_ROOT_PARENT 1
/*
@@ -3165,7 +3167,7 @@ static inline int mas_rebalance(struct m
MA_STATE(l_mas, mas->tree, mas->index, mas->last);
MA_STATE(r_mas, mas->tree, mas->index, mas->last);
- trace_ma_op(__func__, mas);
+ trace_ma_op(TP_FCT, mas);
/*
* Rebalancing occurs if a node is insufficient. Data is rebalanced
@@ -3542,7 +3544,7 @@ static int mas_split(struct ma_state *ma
MA_STATE(prev_r_mas, mas->tree, mas->index, mas->last);
MA_TOPIARY(mat, mas->tree);
- trace_ma_op(__func__, mas);
+ trace_ma_op(TP_FCT, mas);
mas->depth = mas_mt_height(mas);
/* Allocation failures will happen early. */
mas_node_count(mas, 1 + mas->depth * 2);
@@ -3786,7 +3788,7 @@ static bool mas_is_span_wr(struct ma_wr_
return false;
}
- trace_ma_write(__func__, wr_mas->mas, piv, entry);
+ trace_ma_write(TP_FCT, wr_mas->mas, piv, entry);
return true;
}
@@ -4035,7 +4037,7 @@ static inline int mas_wr_spanning_store(
* of data may happen.
*/
mas = wr_mas->mas;
- trace_ma_op(__func__, mas);
+ trace_ma_op(TP_FCT, mas);
if (unlikely(!mas->index && mas->last == ULONG_MAX))
return mas_new_root(mas, wr_mas->entry);
@@ -4221,7 +4223,7 @@ done:
} else {
memcpy(wr_mas->node, newnode, sizeof(struct maple_node));
}
- trace_ma_write(__func__, mas, 0, wr_mas->entry);
+ trace_ma_write(TP_FCT, mas, 0, wr_mas->entry);
mas_update_gap(mas);
return true;
}
@@ -4276,7 +4278,7 @@ static inline bool mas_wr_slot_store(str
mas->offset++; /* Keep mas accurate. */
done:
- trace_ma_write(__func__, mas, 0, wr_mas->entry);
+ trace_ma_write(TP_FCT, mas, 0, wr_mas->entry);
mas_update_gap(mas);
return true;
}
@@ -4377,7 +4379,7 @@ static void mas_wr_bnode(struct ma_wr_st
{
struct maple_big_node b_node;
- trace_ma_write(__func__, wr_mas->mas, 0, wr_mas->entry);
+ trace_ma_write(TP_FCT, wr_mas->mas, 0, wr_mas->entry);
memset(&b_node, 0, sizeof(struct maple_big_node));
mas_store_b_node(wr_mas, &b_node, wr_mas->offset_end);
mas_commit_b_node(wr_mas, &b_node, wr_mas->node_end);
@@ -5722,7 +5724,7 @@ void *mas_store(struct ma_state *mas, vo
{
MA_WR_STATE(wr_mas, mas, entry);
- trace_ma_write(__func__, mas, 0, entry);
+ trace_ma_write(TP_FCT, mas, 0, entry);
#ifdef CONFIG_DEBUG_MAPLE_TREE
if (mas->index > mas->last)
pr_err("Error %lu > %lu %p\n", mas->index, mas->last, entry);
@@ -5760,7 +5762,7 @@ int mas_store_gfp(struct ma_state *mas,
MA_WR_STATE(wr_mas, mas, entry);
mas_wr_store_setup(&wr_mas);
- trace_ma_write(__func__, mas, 0, entry);
+ trace_ma_write(TP_FCT, mas, 0, entry);
retry:
mas_wr_store_entry(&wr_mas);
if (unlikely(mas_nomem(mas, gfp)))
@@ -5784,7 +5786,7 @@ void mas_store_prealloc(struct ma_state
MA_WR_STATE(wr_mas, mas, entry);
mas_wr_store_setup(&wr_mas);
- trace_ma_write(__func__, mas, 0, entry);
+ trace_ma_write(TP_FCT, mas, 0, entry);
mas_wr_store_entry(&wr_mas);
BUG_ON(mas_is_err(mas));
mas_destroy(mas);
@@ -6249,7 +6251,7 @@ void *mtree_load(struct maple_tree *mt,
MA_STATE(mas, mt, index, index);
void *entry;
- trace_ma_read(__func__, &mas);
+ trace_ma_read(TP_FCT, &mas);
rcu_read_lock();
retry:
entry = mas_start(&mas);
@@ -6292,7 +6294,7 @@ int mtree_store_range(struct maple_tree
MA_STATE(mas, mt, index, last);
MA_WR_STATE(wr_mas, &mas, entry);
- trace_ma_write(__func__, &mas, 0, entry);
+ trace_ma_write(TP_FCT, &mas, 0, entry);
if (WARN_ON_ONCE(xa_is_advanced(entry)))
return -EINVAL;
@@ -6467,7 +6469,7 @@ void *mtree_erase(struct maple_tree *mt,
void *entry = NULL;
MA_STATE(mas, mt, index, index);
- trace_ma_op(__func__, &mas);
+ trace_ma_op(TP_FCT, &mas);
mtree_lock(mt);
entry = mas_erase(&mas);
@@ -6527,7 +6529,7 @@ void *mt_find(struct maple_tree *mt, uns
unsigned long copy = *index;
#endif
- trace_ma_read(__func__, &mas);
+ trace_ma_read(TP_FCT, &mas);
if ((*index) > max)
return NULL;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 479/568] mptcp: decouple mptcp fastclose from tcp close
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (477 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 478/568] maple_tree: fix tracepoint string pointers Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 480/568] mptcp: fix a race in mptcp_pm_del_add_timer() Greg Kroah-Hartman
` (95 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Geliang Tang,
Matthieu Baerts (NGI0), Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <pabeni@redhat.com>
[ Upstream commit fff0c87996672816a84c3386797a5e69751c5888 ]
With the current fastclose implementation, the mptcp_do_fastclose()
helper is in charge of two distinct actions: send the fastclose reset
and cleanup the subflows.
Formally decouple the two steps, ensuring that mptcp explicitly closes
all the subflows after the mentioned helper.
This will make the upcoming fix simpler, and allows dropping the 2nd
argument from mptcp_destroy_common(). The Fixes tag is then the same as
in the next commit to help with the backports.
Fixes: d21f83485518 ("mptcp: use fastclose on more edge scenarios")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Geliang Tang <geliang@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-5-806d3781c95f@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ Adjust context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/protocol.c | 13 +++++++++----
net/mptcp/protocol.h | 2 +-
2 files changed, 10 insertions(+), 5 deletions(-)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -2826,8 +2826,12 @@ static void mptcp_worker(struct work_str
__mptcp_close_subflow(sk);
if (mptcp_close_tout_expired(sk)) {
+ struct mptcp_subflow_context *subflow, *tmp;
+
inet_sk_state_store(sk, TCP_CLOSE);
mptcp_do_fastclose(sk);
+ mptcp_for_each_subflow_safe(msk, subflow, tmp)
+ __mptcp_close_ssk(sk, subflow->tcp_sock, subflow, 0);
mptcp_close_wake_up(sk);
}
@@ -3233,7 +3237,8 @@ static int mptcp_disconnect(struct sock
/* msk->subflow is still intact, the following will not free the first
* subflow
*/
- mptcp_destroy_common(msk, MPTCP_CF_FASTCLOSE);
+ mptcp_do_fastclose(sk);
+ mptcp_destroy_common(msk);
msk->last_snd = NULL;
/* The first subflow is already in TCP_CLOSE status, the following
@@ -3456,7 +3461,7 @@ out:
return newsk;
}
-void mptcp_destroy_common(struct mptcp_sock *msk, unsigned int flags)
+void mptcp_destroy_common(struct mptcp_sock *msk)
{
struct mptcp_subflow_context *subflow, *tmp;
struct sock *sk = (struct sock *)msk;
@@ -3465,7 +3470,7 @@ void mptcp_destroy_common(struct mptcp_s
/* join list will be eventually flushed (with rst) at sock lock release time */
mptcp_for_each_subflow_safe(msk, subflow, tmp)
- __mptcp_close_ssk(sk, mptcp_subflow_tcp_sock(subflow), subflow, flags);
+ __mptcp_close_ssk(sk, mptcp_subflow_tcp_sock(subflow), subflow, 0);
/* move to sk_receive_queue, sk_stream_kill_queues will purge it */
mptcp_data_lock(sk);
@@ -3492,7 +3497,7 @@ static void mptcp_destroy(struct sock *s
/* allow the following to close even the initial subflow */
msk->free_first = 1;
- mptcp_destroy_common(msk, 0);
+ mptcp_destroy_common(msk);
sk_sockets_allocated_dec(sk);
}
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -762,7 +762,7 @@ static inline void mptcp_write_space(str
}
}
-void mptcp_destroy_common(struct mptcp_sock *msk, unsigned int flags);
+void mptcp_destroy_common(struct mptcp_sock *msk);
#define MPTCP_TOKEN_MAX_RETRIES 4
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 480/568] mptcp: fix a race in mptcp_pm_del_add_timer()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (478 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 479/568] mptcp: decouple mptcp fastclose from tcp close Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 481/568] mm/mempool: replace kmap_atomic() with kmap_local_page() Greg Kroah-Hartman
` (94 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+2a6fbf0f0530375968df,
Eric Dumazet, Geliang Tang, Matthieu Baerts (NGI0),
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 426358d9be7ce3518966422f87b96f1bad27295f ]
mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer)
while another might have free entry already, as reported by syzbot.
Add RCU protection to fix this issue.
Also change confusing add_timer variable with stop_timer boolean.
syzbot report:
BUG: KASAN: slab-use-after-free in __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616
Read of size 4 at addr ffff8880311e4150 by task kworker/1:1/44
CPU: 1 UID: 0 PID: 44 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: events mptcp_worker
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
__timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616
sk_stop_timer_sync+0x1b/0x90 net/core/sock.c:3631
mptcp_pm_del_add_timer+0x283/0x310 net/mptcp/pm.c:362
mptcp_incoming_options+0x1357/0x1f60 net/mptcp/options.c:1174
tcp_data_queue+0xca/0x6450 net/ipv4/tcp_input.c:5361
tcp_rcv_established+0x1335/0x2670 net/ipv4/tcp_input.c:6441
tcp_v4_do_rcv+0x98b/0xbf0 net/ipv4/tcp_ipv4.c:1931
tcp_v4_rcv+0x252a/0x2dc0 net/ipv4/tcp_ipv4.c:2374
ip_protocol_deliver_rcu+0x221/0x440 net/ipv4/ip_input.c:205
ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:239
NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318
NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318
__netif_receive_skb_one_core net/core/dev.c:6079 [inline]
__netif_receive_skb+0x143/0x380 net/core/dev.c:6192
process_backlog+0x31e/0x900 net/core/dev.c:6544
__napi_poll+0xb6/0x540 net/core/dev.c:7594
napi_poll net/core/dev.c:7657 [inline]
net_rx_action+0x5f7/0xda0 net/core/dev.c:7784
handle_softirqs+0x22f/0x710 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
__local_bh_enable_ip+0x1a0/0x2e0 kernel/softirq.c:302
mptcp_pm_send_ack net/mptcp/pm.c:210 [inline]
mptcp_pm_addr_send_ack+0x41f/0x500 net/mptcp/pm.c:-1
mptcp_pm_worker+0x174/0x320 net/mptcp/pm.c:1002
mptcp_worker+0xd5/0x1170 net/mptcp/protocol.c:2762
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 44:
kasan_save_stack mm/kasan/common.c:56 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
poison_kmalloc_redzone mm/kasan/common.c:400 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:417
kasan_kmalloc include/linux/kasan.h:262 [inline]
__kmalloc_cache_noprof+0x1ef/0x6c0 mm/slub.c:5748
kmalloc_noprof include/linux/slab.h:957 [inline]
mptcp_pm_alloc_anno_list+0x104/0x460 net/mptcp/pm.c:385
mptcp_pm_create_subflow_or_signal_addr+0xf9d/0x1360 net/mptcp/pm_kernel.c:355
mptcp_pm_nl_fully_established net/mptcp/pm_kernel.c:409 [inline]
__mptcp_pm_kernel_worker+0x417/0x1ef0 net/mptcp/pm_kernel.c:1529
mptcp_pm_worker+0x1ee/0x320 net/mptcp/pm.c:1008
mptcp_worker+0xd5/0x1170 net/mptcp/protocol.c:2762
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Freed by task 6630:
kasan_save_stack mm/kasan/common.c:56 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
__kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587
kasan_save_free_info mm/kasan/kasan.h:406 [inline]
poison_slab_object mm/kasan/common.c:252 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:284
kasan_slab_free include/linux/kasan.h:234 [inline]
slab_free_hook mm/slub.c:2523 [inline]
slab_free mm/slub.c:6611 [inline]
kfree+0x197/0x950 mm/slub.c:6818
mptcp_remove_anno_list_by_saddr+0x2d/0x40 net/mptcp/pm.c:158
mptcp_pm_flush_addrs_and_subflows net/mptcp/pm_kernel.c:1209 [inline]
mptcp_nl_flush_addrs_list net/mptcp/pm_kernel.c:1240 [inline]
mptcp_pm_nl_flush_addrs_doit+0x593/0xbb0 net/mptcp/pm_kernel.c:1281
genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg+0x21c/0x270 net/socket.c:742
____sys_sendmsg+0x508/0x820 net/socket.c:2630
___sys_sendmsg+0x21f/0x2a0 net/socket.c:2684
__sys_sendmsg net/socket.c:2716 [inline]
__do_sys_sendmsg net/socket.c:2721 [inline]
__se_sys_sendmsg net/socket.c:2719 [inline]
__x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2719
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Cc: stable@vger.kernel.org
Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout")
Reported-by: syzbot+2a6fbf0f0530375968df@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/691ad3c3.a70a0220.f6df1.0004.GAE@google.com
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Geliang Tang <geliang@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251117100745.1913963-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ applied changes to pm_netlink.c instead of pm.c ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/pm_netlink.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
--- a/net/mptcp/pm_netlink.c
+++ b/net/mptcp/pm_netlink.c
@@ -28,6 +28,7 @@ struct mptcp_pm_add_entry {
struct timer_list add_timer;
struct mptcp_sock *sock;
u8 retrans_times;
+ struct rcu_head rcu;
};
struct pm_nl_pernet {
@@ -354,22 +355,27 @@ mptcp_pm_del_add_timer(struct mptcp_sock
{
struct mptcp_pm_add_entry *entry;
struct sock *sk = (struct sock *)msk;
- struct timer_list *add_timer = NULL;
+ bool stop_timer = false;
+
+ rcu_read_lock();
spin_lock_bh(&msk->pm.lock);
entry = mptcp_lookup_anno_list_by_saddr(msk, addr);
if (entry && (!check_id || entry->addr.id == addr->id)) {
entry->retrans_times = ADD_ADDR_RETRANS_MAX;
- add_timer = &entry->add_timer;
+ stop_timer = true;
}
if (!check_id && entry)
list_del(&entry->list);
spin_unlock_bh(&msk->pm.lock);
- /* no lock, because sk_stop_timer_sync() is calling del_timer_sync() */
- if (add_timer)
- sk_stop_timer_sync(sk, add_timer);
+ /* Note: entry might have been removed by another thread.
+ * We hold rcu_read_lock() to ensure it is not freed under us.
+ */
+ if (stop_timer)
+ sk_stop_timer_sync(sk, &entry->add_timer);
+ rcu_read_unlock();
return entry;
}
@@ -425,7 +431,7 @@ void mptcp_pm_free_anno_list(struct mptc
list_for_each_entry_safe(entry, tmp, &free_list, list) {
sk_stop_timer_sync(sk, &entry->add_timer);
- kfree(entry);
+ kfree_rcu(entry, rcu);
}
}
@@ -1569,7 +1575,7 @@ static bool remove_anno_list_by_saddr(st
entry = mptcp_pm_del_add_timer(msk, addr, false);
if (entry) {
- kfree(entry);
+ kfree_rcu(entry, rcu);
return true;
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 481/568] mm/mempool: replace kmap_atomic() with kmap_local_page()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (479 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 480/568] mptcp: fix a race in mptcp_pm_del_add_timer() Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 482/568] mm/mempool: fix poisoning order>0 pages with HIGHMEM Greg Kroah-Hartman
` (93 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fabio M. De Francesco, Ira Weiny,
Andrew Morton, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Fabio M. De Francesco" <fabio.maria.de.francesco@linux.intel.com>
[ Upstream commit f2bcc99a5e901a13b754648d1dbab60f4adf9375 ]
kmap_atomic() has been deprecated in favor of kmap_local_page().
Therefore, replace kmap_atomic() with kmap_local_page().
kmap_atomic() is implemented like a kmap_local_page() which also disables
page-faults and preemption (the latter only in !PREEMPT_RT kernels). The
kernel virtual addresses returned by these two API are only valid in the
context of the callers (i.e., they cannot be handed to other threads).
With kmap_local_page() the mappings are per thread and CPU local like in
kmap_atomic(); however, they can handle page-faults and can be called from
any context (including interrupts). The tasks that call kmap_local_page()
can be preempted and, when they are scheduled to run again, the kernel
virtual addresses are restored and are still valid.
The code blocks between the mappings and un-mappings don't rely on the
above-mentioned side effects of kmap_atomic(), so that mere replacements
of the old API with the new one is all that they require (i.e., there is
no need to explicitly call pagefault_disable() and/or preempt_disable()).
Link: https://lkml.kernel.org/r/20231120142640.7077-1-fabio.maria.de.francesco@linux.intel.com
Signed-off-by: Fabio M. De Francesco <fabio.maria.de.francesco@linux.intel.com>
Cc: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: ec33b59542d9 ("mm/mempool: fix poisoning order>0 pages with HIGHMEM")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/mempool.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/mm/mempool.c
+++ b/mm/mempool.c
@@ -62,10 +62,10 @@ static void check_element(mempool_t *poo
} else if (pool->free == mempool_free_pages) {
/* Mempools backed by page allocator */
int order = (int)(long)pool->pool_data;
- void *addr = kmap_atomic((struct page *)element);
+ void *addr = kmap_local_page((struct page *)element);
__check_element(pool, addr, 1UL << (PAGE_SHIFT + order));
- kunmap_atomic(addr);
+ kunmap_local(addr);
}
}
@@ -85,10 +85,10 @@ static void poison_element(mempool_t *po
} else if (pool->alloc == mempool_alloc_pages) {
/* Mempools backed by page allocator */
int order = (int)(long)pool->pool_data;
- void *addr = kmap_atomic((struct page *)element);
+ void *addr = kmap_local_page((struct page *)element);
__poison_element(addr, 1UL << (PAGE_SHIFT + order));
- kunmap_atomic(addr);
+ kunmap_local(addr);
}
}
#else /* CONFIG_DEBUG_SLAB || CONFIG_SLUB_DEBUG_ON */
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 482/568] mm/mempool: fix poisoning order>0 pages with HIGHMEM
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (480 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 481/568] mm/mempool: replace kmap_atomic() with kmap_local_page() Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 483/568] dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups Greg Kroah-Hartman
` (92 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Christoph Hellwig,
Vlastimil Babka, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlastimil Babka <vbabka@suse.cz>
[ Upstream commit ec33b59542d96830e3c89845ff833cf7b25ef172 ]
The kernel test has reported:
BUG: unable to handle page fault for address: fffba000
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
*pde = 03171067 *pte = 00000000
Oops: Oops: 0002 [#1]
CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G T 6.18.0-rc2-00031-gec7f31b2a2d3 #1 NONE a1d066dfe789f54bc7645c7989957d2bdee593ca
Tainted: [T]=RANDSTRUCT
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
EIP: memset (arch/x86/include/asm/string_32.h:168 arch/x86/lib/memcpy_32.c:17)
Code: a5 8b 4d f4 83 e1 03 74 02 f3 a4 83 c4 04 5e 5f 5d 2e e9 73 41 01 00 90 90 90 3e 8d 74 26 00 55 89 e5 57 56 89 c6 89 d0 89 f7 <f3> aa 89 f0 5e 5f 5d 2e e9 53 41 01 00 cc cc cc 55 89 e5 53 57 56
EAX: 0000006b EBX: 00000015 ECX: 001fefff EDX: 0000006b
ESI: fffb9000 EDI: fffba000 EBP: c611fbf0 ESP: c611fbe8
DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00010287
CR0: 80050033 CR2: fffba000 CR3: 0316e000 CR4: 00040690
Call Trace:
poison_element (mm/mempool.c:83 mm/mempool.c:102)
mempool_init_node (mm/mempool.c:142 mm/mempool.c:226)
mempool_init_noprof (mm/mempool.c:250 (discriminator 1))
? mempool_alloc_pages (mm/mempool.c:640)
bio_integrity_initfn (block/bio-integrity.c:483 (discriminator 8))
? mempool_alloc_pages (mm/mempool.c:640)
do_one_initcall (init/main.c:1283)
Christoph found out this is due to the poisoning code not dealing
properly with CONFIG_HIGHMEM because only the first page is mapped but
then the whole potentially high-order page is accessed.
We could give up on HIGHMEM here, but it's straightforward to fix this
with a loop that's mapping, poisoning or checking and unmapping
individual pages.
Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202511111411.9ebfa1ba-lkp@intel.com
Analyzed-by: Christoph Hellwig <hch@lst.de>
Fixes: bdfedb76f4f5 ("mm, mempool: poison elements backed by slab allocator")
Cc: stable@vger.kernel.org
Tested-by: kernel test robot <oliver.sang@intel.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20251113-mempool-poison-v1-1-233b3ef984c3@suse.cz
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/mempool.c | 32 ++++++++++++++++++++++++++------
1 file changed, 26 insertions(+), 6 deletions(-)
--- a/mm/mempool.c
+++ b/mm/mempool.c
@@ -62,10 +62,20 @@ static void check_element(mempool_t *poo
} else if (pool->free == mempool_free_pages) {
/* Mempools backed by page allocator */
int order = (int)(long)pool->pool_data;
- void *addr = kmap_local_page((struct page *)element);
- __check_element(pool, addr, 1UL << (PAGE_SHIFT + order));
- kunmap_local(addr);
+#ifdef CONFIG_HIGHMEM
+ for (int i = 0; i < (1 << order); i++) {
+ struct page *page = (struct page *)element;
+ void *addr = kmap_local_page(page + i);
+
+ __check_element(pool, addr, PAGE_SIZE);
+ kunmap_local(addr);
+ }
+#else
+ void *addr = page_address((struct page *)element);
+
+ __check_element(pool, addr, PAGE_SIZE << order);
+#endif
}
}
@@ -85,10 +95,20 @@ static void poison_element(mempool_t *po
} else if (pool->alloc == mempool_alloc_pages) {
/* Mempools backed by page allocator */
int order = (int)(long)pool->pool_data;
- void *addr = kmap_local_page((struct page *)element);
- __poison_element(addr, 1UL << (PAGE_SHIFT + order));
- kunmap_local(addr);
+#ifdef CONFIG_HIGHMEM
+ for (int i = 0; i < (1 << order); i++) {
+ struct page *page = (struct page *)element;
+ void *addr = kmap_local_page(page + i);
+
+ __poison_element(addr, PAGE_SIZE);
+ kunmap_local(addr);
+ }
+#else
+ void *addr = page_address((struct page *)element);
+
+ __poison_element(addr, PAGE_SIZE << order);
+#endif
}
}
#else /* CONFIG_DEBUG_SLAB || CONFIG_SLUB_DEBUG_ON */
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 483/568] dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (481 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 482/568] mm/mempool: fix poisoning order>0 pages with HIGHMEM Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 484/568] ata: libata-scsi: Fix system suspend for a security locked drive Greg Kroah-Hartman
` (91 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Conor Dooley,
Linus Walleij, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 316e361b5d2cdeb8d778983794a1c6eadcb26814 ]
The "groups" property can hold multiple entries (e.g.
toshiba/tmpv7708-rm-mbrc.dts file), so allow that by dropping incorrect
type (pinmux-node.yaml schema already defines that as string-array) and
adding constraints for items. This fixes dtbs_check warnings like:
toshiba/tmpv7708-rm-mbrc.dtb: pinctrl@24190000 (toshiba,tmpv7708-pinctrl):
pwm-pins:groups: ['pwm0_gpio16_grp', 'pwm1_gpio17_grp', 'pwm2_gpio18_grp', 'pwm3_gpio19_grp'] is too long
Fixes: 1825c1fe0057 ("pinctrl: Add DT bindings for Toshiba Visconti TMPV7700 SoC")
Cc: stable@vger.kernel.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
[ adjusted $ref context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/devicetree/bindings/pinctrl/toshiba,visconti-pinctrl.yaml | 26 +++++-----
1 file changed, 14 insertions(+), 12 deletions(-)
--- a/Documentation/devicetree/bindings/pinctrl/toshiba,visconti-pinctrl.yaml
+++ b/Documentation/devicetree/bindings/pinctrl/toshiba,visconti-pinctrl.yaml
@@ -50,18 +50,20 @@ patternProperties:
groups:
description:
Name of the pin group to use for the functions.
- $ref: "/schemas/types.yaml#/definitions/string"
- enum: [i2c0_grp, i2c1_grp, i2c2_grp, i2c3_grp, i2c4_grp,
- i2c5_grp, i2c6_grp, i2c7_grp, i2c8_grp,
- spi0_grp, spi0_cs0_grp, spi0_cs1_grp, spi0_cs2_grp,
- spi1_grp, spi2_grp, spi3_grp, spi4_grp, spi5_grp, spi6_grp,
- uart0_grp, uart1_grp, uart2_grp, uart3_grp,
- pwm0_gpio4_grp, pwm0_gpio8_grp, pwm0_gpio12_grp,
- pwm0_gpio16_grp, pwm1_gpio5_grp, pwm1_gpio9_grp,
- pwm1_gpio13_grp, pwm1_gpio17_grp, pwm2_gpio6_grp,
- pwm2_gpio10_grp, pwm2_gpio14_grp, pwm2_gpio18_grp,
- pwm3_gpio7_grp, pwm3_gpio11_grp, pwm3_gpio15_grp,
- pwm3_gpio19_grp, pcmif_out_grp, pcmif_in_grp]
+ items:
+ enum: [i2c0_grp, i2c1_grp, i2c2_grp, i2c3_grp, i2c4_grp,
+ i2c5_grp, i2c6_grp, i2c7_grp, i2c8_grp,
+ spi0_grp, spi0_cs0_grp, spi0_cs1_grp, spi0_cs2_grp,
+ spi1_grp, spi2_grp, spi3_grp, spi4_grp, spi5_grp, spi6_grp,
+ uart0_grp, uart1_grp, uart2_grp, uart3_grp,
+ pwm0_gpio4_grp, pwm0_gpio8_grp, pwm0_gpio12_grp,
+ pwm0_gpio16_grp, pwm1_gpio5_grp, pwm1_gpio9_grp,
+ pwm1_gpio13_grp, pwm1_gpio17_grp, pwm2_gpio6_grp,
+ pwm2_gpio10_grp, pwm2_gpio14_grp, pwm2_gpio18_grp,
+ pwm3_gpio7_grp, pwm3_gpio11_grp, pwm3_gpio15_grp,
+ pwm3_gpio19_grp, pcmif_out_grp, pcmif_in_grp]
+ minItems: 1
+ maxItems: 8
drive-strength:
enum: [2, 4, 6, 8, 16, 24, 32]
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 484/568] ata: libata-scsi: Fix system suspend for a security locked drive
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (482 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 483/568] dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 485/568] HID: amd_sfh: Stop sensor before starting Greg Kroah-Hartman
` (90 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilia Baryshnikov, Hannes Reinecke,
Martin K. Petersen, Damien Le Moal, Niklas Cassel, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit b11890683380a36b8488229f818d5e76e8204587 ]
Commit cf3fc037623c ("ata: libata-scsi: Fix ata_to_sense_error() status
handling") fixed ata_to_sense_error() to properly generate sense key
ABORTED COMMAND (without any additional sense code), instead of the
previous bogus sense key ILLEGAL REQUEST with the additional sense code
UNALIGNED WRITE COMMAND, for a failed command.
However, this broke suspend for Security locked drives (drives that have
Security enabled, and have not been Security unlocked by boot firmware).
The reason for this is that the SCSI disk driver, for the Synchronize
Cache command only, treats any sense data with sense key ILLEGAL REQUEST
as a successful command (regardless of ASC / ASCQ).
After commit cf3fc037623c ("ata: libata-scsi: Fix ata_to_sense_error()
status handling") the code that treats any sense data with sense key
ILLEGAL REQUEST as a successful command is no longer applicable, so the
command fails, which causes the system suspend to be aborted:
sd 1:0:0:0: PM: dpm_run_callback(): scsi_bus_suspend returns -5
sd 1:0:0:0: PM: failed to suspend async: error -5
PM: Some devices failed to suspend, or early wake event detected
To make suspend work once again, for a Security locked device only,
return sense data LOGICAL UNIT ACCESS NOT AUTHORIZED, the actual sense
data which a real SCSI device would have returned if locked.
The SCSI disk driver treats this sense data as a successful command.
Cc: stable@vger.kernel.org
Reported-by: Ilia Baryshnikov <qwelias@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220704
Fixes: cf3fc037623c ("ata: libata-scsi: Fix ata_to_sense_error() status handling")
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
[ Adjust context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libata-scsi.c | 8 ++++++++
include/linux/ata.h | 1 +
2 files changed, 9 insertions(+)
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -996,6 +996,14 @@ static void ata_gen_ata_sense(struct ata
ata_scsi_set_sense(dev, cmd, NOT_READY, 0x04, 0x21);
return;
}
+
+ if (ata_id_is_locked(dev->id)) {
+ /* Security locked */
+ /* LOGICAL UNIT ACCESS NOT AUTHORIZED */
+ ata_scsi_set_sense(dev, cmd, DATA_PROTECT, 0x74, 0x71);
+ return;
+ }
+
/* Use ata_to_sense_error() to map status register bits
* onto sense key, asc & ascq.
*/
--- a/include/linux/ata.h
+++ b/include/linux/ata.h
@@ -558,6 +558,7 @@ struct ata_bmdma_prd {
#define ata_id_has_ncq(id) ((id)[ATA_ID_SATA_CAPABILITY] & (1 << 8))
#define ata_id_queue_depth(id) (((id)[ATA_ID_QUEUE_DEPTH] & 0x1f) + 1)
#define ata_id_removable(id) ((id)[ATA_ID_CONFIG] & (1 << 7))
+#define ata_id_is_locked(id) (((id)[ATA_ID_DLF] & 0x7) == 0x7)
#define ata_id_has_atapi_AN(id) \
((((id)[ATA_ID_SATA_CAPABILITY] != 0x0000) && \
((id)[ATA_ID_SATA_CAPABILITY] != 0xffff)) && \
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 485/568] HID: amd_sfh: Stop sensor before starting
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (483 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 484/568] ata: libata-scsi: Fix system suspend for a security locked drive Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 486/568] selftests: mptcp: join: rm: set backup flag Greg Kroah-Hartman
` (89 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Titas, Mario Limonciello (AMD),
Jiri Kosina, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Mario Limonciello (AMD)" <superm1@kernel.org>
[ Upstream commit 4d3a13afa8b64dc49293b3eab3e7beac11072c12 ]
Titas reports that the accelerometer sensor on their laptop only
works after a warm boot or unloading/reloading the amd-sfh kernel
module.
Presumably the sensor is in a bad state on cold boot and failing to
start, so explicitly stop it before starting.
Cc: stable@vger.kernel.org
Fixes: 93ce5e0231d79 ("HID: amd_sfh: Implement SFH1.1 functionality")
Reported-by: Titas <novatitas366@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220670
Tested-by: Titas <novatitas366@gmail.com>
Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
[ Adjust context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c
+++ b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c
@@ -163,6 +163,8 @@ static int amd_sfh1_1_hid_client_init(st
if (rc)
goto cleanup;
+ mp2_ops->stop(privdata, cl_data->sensor_idx[i]);
+ amd_sfh_wait_for_response(privdata, cl_data->sensor_idx[i], DISABLE_SENSOR);
writel(0, privdata->mmio + AMD_P2C_MSG(0));
mp2_ops->start(privdata, info);
status = amd_sfh_wait_for_response
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 486/568] selftests: mptcp: join: rm: set backup flag
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (484 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 485/568] HID: amd_sfh: Stop sensor before starting Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 487/568] selftests: mptcp: connect: fix fallback note due to OoO Greg Kroah-Hartman
` (88 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geliang Tang, Matthieu Baerts (NGI0),
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
[ Upstream commit aea73bae662a0e184393d6d7d0feb18d2577b9b9 ]
Some of these 'remove' tests rarely fail because a subflow has been
reset instead of cleanly removed. This can happen when one extra subflow
which has never carried data is being closed (FIN) on one side, while
the other is sending data for the first time.
To avoid such subflows to be used right at the end, the backup flag has
been added. With that, data will be only carried on the initial subflow.
Fixes: d2c4333a801c ("selftests: mptcp: add testcases for removing addrs")
Cc: stable@vger.kernel.org
Reviewed-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-2-a4332c714e10@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ Adjust context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/mptcp/mptcp_join.sh | 54 ++++++++++++------------
1 file changed, 27 insertions(+), 27 deletions(-)
--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
@@ -2332,7 +2332,7 @@ remove_tests()
if reset "remove single subflow"; then
pm_nl_set_limits $ns1 0 1
pm_nl_set_limits $ns2 0 1
- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow
+ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup
run_tests $ns1 $ns2 10.0.1.1 0 0 -1 slow
chk_join_nr 1 1 1
chk_rm_nr 1 1
@@ -2343,8 +2343,8 @@ remove_tests()
if reset "remove multiple subflows"; then
pm_nl_set_limits $ns1 0 2
pm_nl_set_limits $ns2 0 2
- pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow
- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow
+ pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow,backup
+ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup
run_tests $ns1 $ns2 10.0.1.1 0 0 -2 slow
chk_join_nr 2 2 2
chk_rm_nr 2 2
@@ -2354,7 +2354,7 @@ remove_tests()
# single address, remove
if reset "remove single address"; then
pm_nl_set_limits $ns1 0 1
- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal
+ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup
pm_nl_set_limits $ns2 1 1
run_tests $ns1 $ns2 10.0.1.1 0 -1 0 slow
chk_join_nr 1 1 1
@@ -2366,9 +2366,9 @@ remove_tests()
# subflow and signal, remove
if reset "remove subflow and signal"; then
pm_nl_set_limits $ns1 0 2
- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal
+ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup
pm_nl_set_limits $ns2 1 2
- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow
+ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup
run_tests $ns1 $ns2 10.0.1.1 0 -1 -1 slow
chk_join_nr 2 2 2
chk_add_nr 1 1
@@ -2379,10 +2379,10 @@ remove_tests()
# subflows and signal, remove
if reset "remove subflows and signal"; then
pm_nl_set_limits $ns1 0 3
- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal
+ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup
pm_nl_set_limits $ns2 1 3
- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow
- pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow
+ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup
+ pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow,backup
run_tests $ns1 $ns2 10.0.1.1 0 -1 -2 speed_10
chk_join_nr 3 3 3
chk_add_nr 1 1
@@ -2393,9 +2393,9 @@ remove_tests()
# addresses remove
if reset "remove addresses"; then
pm_nl_set_limits $ns1 3 3
- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal id 250
- pm_nl_add_endpoint $ns1 10.0.3.1 flags signal
- pm_nl_add_endpoint $ns1 10.0.4.1 flags signal
+ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup id 250
+ pm_nl_add_endpoint $ns1 10.0.3.1 flags signal,backup
+ pm_nl_add_endpoint $ns1 10.0.4.1 flags signal,backup
pm_nl_set_limits $ns2 3 3
run_tests $ns1 $ns2 10.0.1.1 0 -3 0 speed_10
chk_join_nr 3 3 3
@@ -2407,10 +2407,10 @@ remove_tests()
# invalid addresses remove
if reset "remove invalid addresses"; then
pm_nl_set_limits $ns1 3 3
- pm_nl_add_endpoint $ns1 10.0.12.1 flags signal
+ pm_nl_add_endpoint $ns1 10.0.12.1 flags signal,backup
# broadcast IP: no packet for this address will be received on ns1
- pm_nl_add_endpoint $ns1 224.0.0.1 flags signal
- pm_nl_add_endpoint $ns1 10.0.3.1 flags signal
+ pm_nl_add_endpoint $ns1 224.0.0.1 flags signal,backup
+ pm_nl_add_endpoint $ns1 10.0.3.1 flags signal,backup
pm_nl_set_limits $ns2 2 2
run_tests $ns1 $ns2 10.0.1.1 0 -3 0 speed_10
chk_join_nr 1 1 1
@@ -2422,10 +2422,10 @@ remove_tests()
# subflows and signal, flush
if reset "flush subflows and signal"; then
pm_nl_set_limits $ns1 0 3
- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal
+ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup
pm_nl_set_limits $ns2 1 3
- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow
- pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow
+ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup
+ pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow,backup
run_tests $ns1 $ns2 10.0.1.1 0 -8 -8 slow
chk_join_nr 3 3 3
chk_add_nr 1 1
@@ -2437,9 +2437,9 @@ remove_tests()
if reset "flush subflows"; then
pm_nl_set_limits $ns1 3 3
pm_nl_set_limits $ns2 3 3
- pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow id 150
- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow
- pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow
+ pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow,backup id 150
+ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup
+ pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow,backup
run_tests $ns1 $ns2 10.0.1.1 0 -8 -8 slow
chk_join_nr 3 3 3
@@ -2454,9 +2454,9 @@ remove_tests()
# addresses flush
if reset "flush addresses"; then
pm_nl_set_limits $ns1 3 3
- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal id 250
- pm_nl_add_endpoint $ns1 10.0.3.1 flags signal
- pm_nl_add_endpoint $ns1 10.0.4.1 flags signal
+ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup id 250
+ pm_nl_add_endpoint $ns1 10.0.3.1 flags signal,backup
+ pm_nl_add_endpoint $ns1 10.0.4.1 flags signal,backup
pm_nl_set_limits $ns2 3 3
run_tests $ns1 $ns2 10.0.1.1 0 -8 -8 slow
chk_join_nr 3 3 3
@@ -2468,9 +2468,9 @@ remove_tests()
# invalid addresses flush
if reset "flush invalid addresses"; then
pm_nl_set_limits $ns1 3 3
- pm_nl_add_endpoint $ns1 10.0.12.1 flags signal
- pm_nl_add_endpoint $ns1 10.0.3.1 flags signal
- pm_nl_add_endpoint $ns1 10.0.14.1 flags signal
+ pm_nl_add_endpoint $ns1 10.0.12.1 flags signal,backup
+ pm_nl_add_endpoint $ns1 10.0.3.1 flags signal,backup
+ pm_nl_add_endpoint $ns1 10.0.14.1 flags signal,backup
pm_nl_set_limits $ns2 3 3
run_tests $ns1 $ns2 10.0.1.1 0 -8 0 slow
chk_join_nr 1 1 1
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 487/568] selftests: mptcp: connect: fix fallback note due to OoO
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (485 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 486/568] selftests: mptcp: join: rm: set backup flag Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 488/568] pmdomain: samsung: plug potential memleak during probe Greg Kroah-Hartman
` (87 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geliang Tang, Matthieu Baerts (NGI0),
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
[ Upstream commit 63c643aa7b7287fdbb0167063785f89ece3f000f ]
The "fallback due to TCP OoO" was never printed because the stat_ooo_now
variable was checked twice: once in the parent if-statement, and one in
the child one. The second condition was then always true then, and the
'else' branch was never taken.
The idea is that when there are more ACK + MP_CAPABLE than expected, the
test either fails if there was no out of order packets, or a notice is
printed.
Fixes: 69ca3d29a755 ("mptcp: update selftest for fallback due to OoO")
Cc: stable@vger.kernel.org
Reviewed-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-1-a4332c714e10@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ Different operators used ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/mptcp/mptcp_connect.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/net/mptcp/mptcp_connect.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_connect.sh
@@ -523,7 +523,7 @@ do_transfer()
"${stat_synrx_now_l}" "${expect_synrx}" 1>&2
retc=1
fi
- if [ ${stat_ackrx_now_l} -lt ${expect_ackrx} -a ${stat_ooo_now} -eq 0 ]; then
+ if [ ${stat_ackrx_now_l} -lt ${expect_ackrx} ]; then
if [ ${stat_ooo_now} -eq 0 ]; then
printf "[ FAIL ] lower MPC ACK rx (%d) than expected (%d)\n" \
"${stat_ackrx_now_l}" "${expect_ackrx}" 1>&2
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 488/568] pmdomain: samsung: plug potential memleak during probe
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (486 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 487/568] selftests: mptcp: connect: fix fallback note due to OoO Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 489/568] pmdomain: arm: scmi: Fix genpd leak on provider registration failure Greg Kroah-Hartman
` (86 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Griffin, Krzysztof Kozlowski,
André Draszik, Marek Szyprowski, Ulf Hansson, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Draszik <andre.draszik@linaro.org>
[ Upstream commit 90c82941adf1986364e0f82c35cf59f2bf5f6a1d ]
of_genpd_add_provider_simple() could fail, in which case this code
leaks the domain name, pd->pd.name.
Use devm_kstrdup_const() to plug this leak. As a side-effect, we can
simplify existing error handling.
Fixes: c09a3e6c97f0 ("soc: samsung: pm_domains: Convert to regular platform driver")
Cc: stable@vger.kernel.org
Reviewed-by: Peter Griffin <peter.griffin@linaro.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: André Draszik <andre.draszik@linaro.org>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
[ drivers/pmdomain/samsung/exynos-pm-domains.c -> drivers/soc/samsung/pm_domains.c ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/samsung/pm_domains.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
--- a/drivers/soc/samsung/pm_domains.c
+++ b/drivers/soc/samsung/pm_domains.c
@@ -91,13 +91,14 @@ static const struct of_device_id exynos_
{ },
};
-static const char *exynos_get_domain_name(struct device_node *node)
+static const char *exynos_get_domain_name(struct device *dev,
+ struct device_node *node)
{
const char *name;
if (of_property_read_string(node, "label", &name) < 0)
name = kbasename(node->full_name);
- return kstrdup_const(name, GFP_KERNEL);
+ return devm_kstrdup_const(dev, name, GFP_KERNEL);
}
static int exynos_pd_probe(struct platform_device *pdev)
@@ -114,15 +115,13 @@ static int exynos_pd_probe(struct platfo
if (!pd)
return -ENOMEM;
- pd->pd.name = exynos_get_domain_name(np);
+ pd->pd.name = exynos_get_domain_name(dev, np);
if (!pd->pd.name)
return -ENOMEM;
pd->base = of_iomap(np, 0);
- if (!pd->base) {
- kfree_const(pd->pd.name);
+ if (!pd->base)
return -ENODEV;
- }
pd->pd.power_off = exynos_pd_power_off;
pd->pd.power_on = exynos_pd_power_on;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 489/568] pmdomain: arm: scmi: Fix genpd leak on provider registration failure
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (487 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 488/568] pmdomain: samsung: plug potential memleak during probe Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 490/568] pmdomain: imx: Fix reference count leak in imx_gpc_remove Greg Kroah-Hartman
` (85 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sudeep Holla, Peng Fan, Ulf Hansson,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@arm.com>
[ Upstream commit 7458f72cc28f9eb0de811effcb5376d0ec19094a ]
If of_genpd_add_provider_onecell() fails during probe, the previously
created generic power domains are not removed, leading to a memory leak
and potential kernel crash later in genpd_debug_add().
Add proper error handling to unwind the initialized domains before
returning from probe to ensure all resources are correctly released on
failure.
Example crash trace observed without this fix:
| Unable to handle kernel paging request at virtual address fffffffffffffc70
| CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.0-rc1 #405 PREEMPT
| Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform
| pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
| pc : genpd_debug_add+0x2c/0x160
| lr : genpd_debug_init+0x74/0x98
| Call trace:
| genpd_debug_add+0x2c/0x160 (P)
| genpd_debug_init+0x74/0x98
| do_one_initcall+0xd0/0x2d8
| do_initcall_level+0xa0/0x140
| do_initcalls+0x60/0xa8
| do_basic_setup+0x28/0x40
| kernel_init_freeable+0xe8/0x170
| kernel_init+0x2c/0x140
| ret_from_fork+0x10/0x20
Fixes: 898216c97ed2 ("firmware: arm_scmi: add device power domain support using genpd")
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
[ drivers/pmdomain/arm/scmi_pm_domain.c -> drivers/firmware/arm_scmi/scmi_pm_domain.c ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/arm_scmi/scmi_pm_domain.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--- a/drivers/firmware/arm_scmi/scmi_pm_domain.c
+++ b/drivers/firmware/arm_scmi/scmi_pm_domain.c
@@ -54,7 +54,7 @@ static int scmi_pd_power_off(struct gene
static int scmi_pm_domain_probe(struct scmi_device *sdev)
{
- int num_domains, i;
+ int num_domains, i, ret;
struct device *dev = &sdev->dev;
struct device_node *np = dev->of_node;
struct scmi_pm_domain *scmi_pd;
@@ -112,9 +112,18 @@ static int scmi_pm_domain_probe(struct s
scmi_pd_data->domains = domains;
scmi_pd_data->num_domains = num_domains;
+ ret = of_genpd_add_provider_onecell(np, scmi_pd_data);
+ if (ret)
+ goto err_rm_genpds;
+
dev_set_drvdata(dev, scmi_pd_data);
- return of_genpd_add_provider_onecell(np, scmi_pd_data);
+ return 0;
+err_rm_genpds:
+ for (i = num_domains - 1; i >= 0; i--)
+ pm_genpd_remove(domains[i]);
+
+ return ret;
}
static void scmi_pm_domain_remove(struct scmi_device *sdev)
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 490/568] pmdomain: imx: Fix reference count leak in imx_gpc_remove
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (488 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 489/568] pmdomain: arm: scmi: Fix genpd leak on provider registration failure Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 491/568] filemap: cap PTE range to be created to allowed zero fill in folio_map_range() Greg Kroah-Hartman
` (84 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Miaoqian Lin, Ulf Hansson,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <linmq006@gmail.com>
[ Upstream commit bbde14682eba21d86f5f3d6fe2d371b1f97f1e61 ]
of_get_child_by_name() returns a node pointer with refcount incremented, we
should use of_node_put() on it when not needed anymore. Add the missing
of_node_put() to avoid refcount leak.
Fixes: 721cabf6c660 ("soc: imx: move PGC handling to a new GPC driver")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
[ drivers/pmdomain/imx/gpc.c -> drivers/soc/imx/gpc.c ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/imx/gpc.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/soc/imx/gpc.c
+++ b/drivers/soc/imx/gpc.c
@@ -541,6 +541,8 @@ static int imx_gpc_remove(struct platfor
return ret;
}
+ of_node_put(pgc_node);
+
return 0;
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 491/568] filemap: cap PTE range to be created to allowed zero fill in folio_map_range()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (489 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 490/568] pmdomain: imx: Fix reference count leak in imx_gpc_remove Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 492/568] mm/memory: do not populate page table entries beyond i_size Greg Kroah-Hartman
` (83 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luis Chamberlain, Pankaj Raghav,
David Howells, Darrick J. Wong, Hannes Reinecke,
Matthew Wilcox (Oracle), Daniel Gomez, Dave Chinner,
Christian Brauner, Kiryl Shutsemau, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pankaj Raghav <p.raghav@samsung.com>
[ Upstream commit 743a2753a02e805347969f6f89f38b736850d808 ]
Usually the page cache does not extend beyond the size of the inode,
therefore, no PTEs are created for folios that extend beyond the size.
But with LBS support, we might extend page cache beyond the size of the
inode as we need to guarantee folios of minimum order. While doing a
read, do_fault_around() can create PTEs for pages that lie beyond the
EOF leading to incorrect error return when accessing a page beyond the
mapped file.
Cap the PTE range to be created for the page cache up to the end of
file(EOF) in filemap_map_pages() so that return error codes are consistent
with POSIX[1] for LBS configurations.
generic/749 has been created to trigger this edge case. This also fixes
generic/749 for tmpfs with huge=always on systems with 4k base page size.
[1](from mmap(2)) SIGBUS
Attempted access to a page of the buffer that lies beyond the end
of the mapped file. For an explanation of the treatment of the
bytes in the page that corresponds to the end of a mapped file
that is not a multiple of the page size, see NOTES.
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Pankaj Raghav <p.raghav@samsung.com>
Link: https://lore.kernel.org/r/20240822135018.1931258-6-kernel@pankajraghav.com
Tested-by: David Howells <dhowells@redhat.com>
Acked-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Daniel Gomez <da.gomez@samsung.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Kiryl Shutsemau <kas@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/filemap.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/mm/filemap.c b/mm/filemap.c
index b77f534dfad35..40c186c7210bf 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -3460,7 +3460,7 @@ vm_fault_t filemap_map_pages(struct vm_fault *vmf,
struct vm_area_struct *vma = vmf->vma;
struct file *file = vma->vm_file;
struct address_space *mapping = file->f_mapping;
- pgoff_t last_pgoff = start_pgoff;
+ pgoff_t file_end, last_pgoff = start_pgoff;
unsigned long addr;
XA_STATE(xas, &mapping->i_pages, start_pgoff);
struct folio *folio;
@@ -3480,6 +3480,11 @@ vm_fault_t filemap_map_pages(struct vm_fault *vmf,
addr = vma->vm_start + ((start_pgoff - vma->vm_pgoff) << PAGE_SHIFT);
vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd, addr, &vmf->ptl);
+
+ file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1;
+ if (end_pgoff > file_end)
+ end_pgoff = file_end;
+
do {
again:
page = folio_file_page(folio, xas.xa_index);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 492/568] mm/memory: do not populate page table entries beyond i_size
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (490 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 491/568] filemap: cap PTE range to be created to allowed zero fill in folio_map_range() Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 493/568] can: kvaser_usb: leaf: Fix potential infinite loop in command parsers Greg Kroah-Hartman
` (82 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kiryl Shutsemau, Darrick J. Wong,
Al Viro, Baolin Wang, Christian Brauner, Dave Chinner,
David Hildenbrand, Hugh Dickins, Johannes Weiner, Liam Howlett,
Lorenzo Stoakes, Matthew Wilcox (Oracle), Michal Hocko,
Mike Rapoport, Rik van Riel, Shakeel Butt, Suren Baghdasaryan,
Vlastimil Babka, Andrew Morton, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiryl Shutsemau <kas@kernel.org>
[ Upstream commit 74207de2ba10c2973334906822dc94d2e859ffc5 ]
Patch series "Fix SIGBUS semantics with large folios", v3.
Accessing memory within a VMA, but beyond i_size rounded up to the next
page size, is supposed to generate SIGBUS.
Darrick reported[1] an xfstests regression in v6.18-rc1. generic/749
failed due to missing SIGBUS. This was caused by my recent changes that
try to fault in the whole folio where possible:
19773df031bc ("mm/fault: try to map the entire file folio in finish_fault()")
357b92761d94 ("mm/filemap: map entire large folio faultaround")
These changes did not consider i_size when setting up PTEs, leading to
xfstest breakage.
However, the problem has been present in the kernel for a long time -
since huge tmpfs was introduced in 2016. The kernel happily maps
PMD-sized folios as PMD without checking i_size. And huge=always tmpfs
allocates PMD-size folios on any writes.
I considered this corner case when I implemented a large tmpfs, and my
conclusion was that no one in their right mind should rely on receiving a
SIGBUS signal when accessing beyond i_size. I cannot imagine how it could
be useful for the workload.
But apparently filesystem folks care a lot about preserving strict SIGBUS
semantics.
Generic/749 was introduced last year with reference to POSIX, but no real
workloads were mentioned. It also acknowledged the tmpfs deviation from
the test case.
POSIX indeed says[3]:
References within the address range starting at pa and
continuing for len bytes to whole pages following the end of an
object shall result in delivery of a SIGBUS signal.
The patchset fixes the regression introduced by recent changes as well as
more subtle SIGBUS breakage due to split failure on truncation.
This patch (of 2):
Accesses within VMA, but beyond i_size rounded up to PAGE_SIZE are
supposed to generate SIGBUS.
Recent changes attempted to fault in full folio where possible. They did
not respect i_size, which led to populating PTEs beyond i_size and
breaking SIGBUS semantics.
Darrick reported generic/749 breakage because of this.
However, the problem existed before the recent changes. With huge=always
tmpfs, any write to a file leads to PMD-size allocation. Following the
fault-in of the folio will install PMD mapping regardless of i_size.
Fix filemap_map_pages() and finish_fault() to not install:
- PTEs beyond i_size;
- PMD mappings across i_size;
Make an exception for shmem/tmpfs that for long time intentionally
mapped with PMDs across i_size.
Link: https://lkml.kernel.org/r/20251027115636.82382-1-kirill@shutemov.name
Link: https://lkml.kernel.org/r/20251027115636.82382-2-kirill@shutemov.name
Signed-off-by: Kiryl Shutsemau <kas@kernel.org>
Fixes: 6795801366da ("xfs: Support large folios")
Reported-by: "Darrick J. Wong" <djwong@kernel.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Dave Chinner <david@fromorbit.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Kiryl Shutsemau <kas@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/filemap.c | 20 +++++++++++++++-----
mm/memory.c | 24 +++++++++++++++++++++++-
2 files changed, 38 insertions(+), 6 deletions(-)
diff --git a/mm/filemap.c b/mm/filemap.c
index 40c186c7210bf..4088d1a5360fa 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -3467,13 +3467,27 @@ vm_fault_t filemap_map_pages(struct vm_fault *vmf,
struct page *page;
unsigned int mmap_miss = READ_ONCE(file->f_ra.mmap_miss);
vm_fault_t ret = 0;
+ bool can_map_large;
rcu_read_lock();
folio = first_map_page(mapping, &xas, end_pgoff);
if (!folio)
goto out;
- if (filemap_map_pmd(vmf, &folio->page)) {
+ file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1;
+ end_pgoff = min(end_pgoff, file_end);
+
+ /*
+ * Do not allow to map with PTEs beyond i_size and with PMD
+ * across i_size to preserve SIGBUS semantics.
+ *
+ * Make an exception for shmem/tmpfs that for long time
+ * intentionally mapped with PMDs across i_size.
+ */
+ can_map_large = shmem_mapping(mapping) ||
+ file_end >= folio_next_index(folio);
+
+ if (can_map_large && filemap_map_pmd(vmf, &folio->page)) {
ret = VM_FAULT_NOPAGE;
goto out;
}
@@ -3481,10 +3495,6 @@ vm_fault_t filemap_map_pages(struct vm_fault *vmf,
addr = vma->vm_start + ((start_pgoff - vma->vm_pgoff) << PAGE_SHIFT);
vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd, addr, &vmf->ptl);
- file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1;
- if (end_pgoff > file_end)
- end_pgoff = file_end;
-
do {
again:
page = folio_file_page(folio, xas.xa_index);
diff --git a/mm/memory.c b/mm/memory.c
index 454d918449b3a..f0b506acfcc5d 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -67,6 +67,7 @@
#include <linux/gfp.h>
#include <linux/migrate.h>
#include <linux/string.h>
+#include <linux/shmem_fs.h>
#include <linux/memory-tiers.h>
#include <linux/debugfs.h>
#include <linux/userfaultfd_k.h>
@@ -4452,6 +4453,8 @@ static bool vmf_pte_changed(struct vm_fault *vmf)
vm_fault_t finish_fault(struct vm_fault *vmf)
{
struct vm_area_struct *vma = vmf->vma;
+ bool needs_fallback = false;
+ struct folio *folio;
struct page *page;
vm_fault_t ret;
@@ -4461,6 +4464,8 @@ vm_fault_t finish_fault(struct vm_fault *vmf)
else
page = vmf->page;
+ folio = page_folio(page);
+
/*
* check even for read faults because we might have lost our CoWed
* page
@@ -4471,8 +4476,25 @@ vm_fault_t finish_fault(struct vm_fault *vmf)
return ret;
}
+ if (!needs_fallback && vma->vm_file) {
+ struct address_space *mapping = vma->vm_file->f_mapping;
+ pgoff_t file_end;
+
+ file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE);
+
+ /*
+ * Do not allow to map with PTEs beyond i_size and with PMD
+ * across i_size to preserve SIGBUS semantics.
+ *
+ * Make an exception for shmem/tmpfs that for long time
+ * intentionally mapped with PMDs across i_size.
+ */
+ needs_fallback = !shmem_mapping(mapping) &&
+ file_end < folio_next_index(folio);
+ }
+
if (pmd_none(*vmf->pmd)) {
- if (PageTransCompound(page)) {
+ if (!needs_fallback && PageTransCompound(page)) {
ret = do_set_pmd(vmf, page);
if (ret != VM_FAULT_FALLBACK)
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 493/568] can: kvaser_usb: leaf: Fix potential infinite loop in command parsers
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (491 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 492/568] mm/memory: do not populate page table entries beyond i_size Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 494/568] can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs Greg Kroah-Hartman
` (81 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Seungjin Bae, Jimmy Assarsson,
Marc Kleine-Budde, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <eeodqql09@gmail.com>
[ Upstream commit 0c73772cd2b8cc108d5f5334de89ad648d89b9ec ]
The `kvaser_usb_leaf_wait_cmd()` and `kvaser_usb_leaf_read_bulk_callback`
functions contain logic to zero-length commands. These commands are used
to align data to the USB endpoint's wMaxPacketSize boundary.
The driver attempts to skip these placeholders by aligning the buffer
position `pos` to the next packet boundary using `round_up()` function.
However, if zero-length command is found exactly on a packet boundary
(i.e., `pos` is a multiple of wMaxPacketSize, including 0), `round_up`
function will return the unchanged value of `pos`. This prevents `pos`
to be increased, causing an infinite loop in the parsing logic.
This patch fixes this in the function by using `pos + 1` instead.
This ensures that even if `pos` is on a boundary, the calculation is
based on `pos + 1`, forcing `round_up()` to always return the next
aligned boundary.
Fixes: 7259124eac7d ("can: kvaser_usb: Split driver into kvaser_usb_core.c and kvaser_usb_leaf.c")
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Reviewed-by: Jimmy Assarsson <extja@kvaser.com>
Tested-by: Jimmy Assarsson <extja@kvaser.com>
Link: https://patch.msgid.link/20251023162709.348240-1-eeodqql09@gmail.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
index b423fd4c79890..57c68bc926d8d 100644
--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
@@ -608,7 +608,7 @@ static int kvaser_usb_leaf_wait_cmd(const struct kvaser_usb *dev, u8 id,
* for further details.
*/
if (tmp->len == 0) {
- pos = round_up(pos,
+ pos = round_up(pos + 1,
le16_to_cpu
(dev->bulk_in->wMaxPacketSize));
continue;
@@ -1567,7 +1567,7 @@ static void kvaser_usb_leaf_read_bulk_callback(struct kvaser_usb *dev,
* number of events in case of a heavy rx load on the bus.
*/
if (cmd->len == 0) {
- pos = round_up(pos, le16_to_cpu
+ pos = round_up(pos + 1, le16_to_cpu
(dev->bulk_in->wMaxPacketSize));
continue;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 494/568] can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (492 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 493/568] can: kvaser_usb: leaf: Fix potential infinite loop in command parsers Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 495/568] can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header Greg Kroah-Hartman
` (80 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marc Kleine-Budde, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <mkl@pengutronix.de>
[ Upstream commit 516a0cd1c03fa266bb67dd87940a209fd4e53ce7 ]
The driver lacks the cleanup of failed transfers of URBs. This reduces the
number of available URBs per error by 1. This leads to reduced performance
and ultimately to a complete stop of the transmission.
If the sending of a bulk URB fails do proper cleanup:
- increase netdev stats
- mark the echo_sbk as free
- free the driver's context and do accounting
- wake the send queue
Closes: https://github.com/candle-usb/candleLight_fw/issues/187
Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
Link: https://patch.msgid.link/20251114-gs_usb-fix-usb-callbacks-v1-1-a29b42eacada@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/usb/gs_usb.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index 2cacea6b00f80..7fe9d497491d1 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -707,8 +707,21 @@ static void gs_usb_xmit_callback(struct urb *urb)
struct gs_can *dev = txc->dev;
struct net_device *netdev = dev->netdev;
- if (urb->status)
- netdev_info(netdev, "usb xmit fail %u\n", txc->echo_id);
+ if (!urb->status)
+ return;
+
+ if (urb->status != -ESHUTDOWN && net_ratelimit())
+ netdev_info(netdev, "failed to xmit URB %u: %pe\n",
+ txc->echo_id, ERR_PTR(urb->status));
+
+ netdev->stats.tx_dropped++;
+ netdev->stats.tx_errors++;
+
+ can_free_echo_skb(netdev, txc->echo_id, NULL);
+ gs_free_tx_context(txc);
+ atomic_dec(&dev->active_tx_urbs);
+
+ netif_wake_queue(netdev);
}
static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb,
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 495/568] can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (493 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 494/568] can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 496/568] Bluetooth: SMP: Fix not generating mackey and ltk when repairing Greg Kroah-Hartman
` (79 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marc Kleine-Budde, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <mkl@pengutronix.de>
[ Upstream commit 6fe9f3279f7d2518439a7962c5870c6e9ecbadcf ]
The driver expects to receive a struct gs_host_frame in
gs_usb_receive_bulk_callback().
Use struct_group to describe the header of the struct gs_host_frame and
check that we have at least received the header before accessing any
members of it.
To resubmit the URB, do not dereference the pointer chain
"dev->parent->hf_size_rx" but use "parent->hf_size_rx" instead. Since
"urb->context" contains "parent", it is always defined, while "dev" is not
defined if the URB it too short.
Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
Link: https://patch.msgid.link/20251114-gs_usb-fix-usb-callbacks-v1-2-a29b42eacada@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/usb/gs_usb.c | 26 +++++++++++++++++++-------
1 file changed, 19 insertions(+), 7 deletions(-)
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index 7fe9d497491d1..5d0cee57ab970 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -252,13 +252,15 @@ struct canfd_quirk {
} __packed;
struct gs_host_frame {
- u32 echo_id;
- __le32 can_id;
+ struct_group(header,
+ u32 echo_id;
+ __le32 can_id;
- u8 can_dlc;
- u8 channel;
- u8 flags;
- u8 reserved;
+ u8 can_dlc;
+ u8 channel;
+ u8 flags;
+ u8 reserved;
+ );
union {
DECLARE_FLEX_ARRAY(struct classic_can, classic_can);
@@ -528,6 +530,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
int rc;
struct net_device_stats *stats;
struct gs_host_frame *hf = urb->transfer_buffer;
+ unsigned int minimum_length;
struct gs_tx_context *txc;
struct can_frame *cf;
struct canfd_frame *cfd;
@@ -546,6 +549,15 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
return;
}
+ minimum_length = sizeof(hf->header);
+ if (urb->actual_length < minimum_length) {
+ dev_err_ratelimited(&parent->udev->dev,
+ "short read (actual_length=%u, minimum_length=%u)\n",
+ urb->actual_length, minimum_length);
+
+ goto resubmit_urb;
+ }
+
/* device reports out of range channel id */
if (hf->channel >= parent->channel_cnt)
goto device_detach;
@@ -642,7 +654,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
resubmit_urb:
usb_fill_bulk_urb(urb, parent->udev,
parent->pipe_in,
- hf, dev->parent->hf_size_rx,
+ hf, parent->hf_size_rx,
gs_usb_receive_bulk_callback, parent);
rc = usb_submit_urb(urb, GFP_ATOMIC);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 496/568] Bluetooth: SMP: Fix not generating mackey and ltk when repairing
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (494 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 495/568] can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 497/568] platform/x86: intel: punit_ipc: fix memory corruption Greg Kroah-Hartman
` (78 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit 545d7827b2cd5de5eb85580cebeda6b35b3ff443 ]
The change eed467b517e8 ("Bluetooth: fix passkey uninitialized when used")
introduced a goto that bypasses the creation of temporary mackey and ltk
which are later used by the likes of DHKey Check step.
Later ffee202a78c2 ("Bluetooth: Always request for user confirmation for
Just Works (LE SC)") which means confirm_hint is always set in case
JUST_WORKS so the branch checking for an existing LTK becomes pointless
as confirm_hint will always be set, so this just merge both cases of
malicious or legitimate devices to be confirmed before continuing with the
pairing procedure.
Link: https://github.com/bluez/bluez/issues/1622
Fixes: eed467b517e8 ("Bluetooth: fix passkey uninitialized when used")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/smp.c | 31 +++++++------------------------
1 file changed, 7 insertions(+), 24 deletions(-)
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index a03920fe44d94..d8a77bfe65a62 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2130,7 +2130,7 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
struct smp_chan *smp = chan->data;
struct hci_conn *hcon = conn->hcon;
u8 *pkax, *pkbx, *na, *nb, confirm_hint;
- u32 passkey;
+ u32 passkey = 0;
int err;
bt_dev_dbg(hcon->hdev, "conn %p", conn);
@@ -2182,24 +2182,6 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
smp->prnd);
SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
-
- /* Only Just-Works pairing requires extra checks */
- if (smp->method != JUST_WORKS)
- goto mackey_and_ltk;
-
- /* If there already exists long term key in local host, leave
- * the decision to user space since the remote device could
- * be legitimate or malicious.
- */
- if (hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
- hcon->role)) {
- /* Set passkey to 0. The value can be any number since
- * it'll be ignored anyway.
- */
- passkey = 0;
- confirm_hint = 1;
- goto confirm;
- }
}
mackey_and_ltk:
@@ -2220,11 +2202,12 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
if (err)
return SMP_UNSPECIFIED;
- confirm_hint = 0;
-
-confirm:
- if (smp->method == JUST_WORKS)
- confirm_hint = 1;
+ /* Always require user confirmation for Just-Works pairing to prevent
+ * impersonation attacks, or in case of a legitimate device that is
+ * repairing use the confirmation as acknowledgment to proceed with the
+ * creation of new keys.
+ */
+ confirm_hint = smp->method == JUST_WORKS ? 1 : 0;
err = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, hcon->type,
hcon->dst_type, passkey, confirm_hint);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 497/568] platform/x86: intel: punit_ipc: fix memory corruption
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (495 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 496/568] Bluetooth: SMP: Fix not generating mackey and ltk when repairing Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 498/568] net: aquantia: Add missing descriptor cache invalidation on ATL2 Greg Kroah-Hartman
` (77 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Ilpo Järvinen,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 9b9c0adbc3f8a524d291baccc9d0c04097fb4869 ]
This passes the address of the pointer "&punit_ipcdev" when the intent
was to pass the pointer itself "punit_ipcdev" (without the ampersand).
This means that the:
complete(&ipcdev->cmd_complete);
in intel_punit_ioc() will write to a wrong memory address corrupting it.
Fixes: fdca4f16f57d ("platform:x86: add Intel P-Unit mailbox IPC driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/aSCmoBipSQ_tlD-D@stanley.mountain
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel/punit_ipc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/x86/intel/punit_ipc.c b/drivers/platform/x86/intel/punit_ipc.c
index 66bb39fd0ef90..8602f4175f123 100644
--- a/drivers/platform/x86/intel/punit_ipc.c
+++ b/drivers/platform/x86/intel/punit_ipc.c
@@ -283,7 +283,7 @@ static int intel_punit_ipc_probe(struct platform_device *pdev)
} else {
ret = devm_request_irq(&pdev->dev, irq, intel_punit_ioc,
IRQF_NO_SUSPEND, "intel_punit_ipc",
- &punit_ipcdev);
+ punit_ipcdev);
if (ret) {
dev_err(&pdev->dev, "Failed to request irq: %d\n", irq);
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 498/568] net: aquantia: Add missing descriptor cache invalidation on ATL2
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (496 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 497/568] platform/x86: intel: punit_ipc: fix memory corruption Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 499/568] net: lan966x: Fix the initialization of taprio Greg Kroah-Hartman
` (76 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Carol Soto, Kai-Heng Feng,
Simon Horman, Paolo Abeni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <kaihengf@nvidia.com>
[ Upstream commit 7526183cfdbe352c51c285762f0e15b7c428ea06 ]
ATL2 hardware was missing descriptor cache invalidation in hw_stop(),
causing SMMU translation faults during device shutdown and module removal:
[ 70.355743] arm-smmu-v3 arm-smmu-v3.5.auto: event 0x10 received:
[ 70.361893] arm-smmu-v3 arm-smmu-v3.5.auto: 0x0002060000000010
[ 70.367948] arm-smmu-v3 arm-smmu-v3.5.auto: 0x0000020000000000
[ 70.374002] arm-smmu-v3 arm-smmu-v3.5.auto: 0x00000000ff9bc000
[ 70.380055] arm-smmu-v3 arm-smmu-v3.5.auto: 0x0000000000000000
[ 70.386109] arm-smmu-v3 arm-smmu-v3.5.auto: event: F_TRANSLATION client: 0001:06:00.0 sid: 0x20600 ssid: 0x0 iova: 0xff9bc000 ipa: 0x0
[ 70.398531] arm-smmu-v3 arm-smmu-v3.5.auto: unpriv data write s1 "Input address caused fault" stag: 0x0
Commit 7a1bb49461b1 ("net: aquantia: fix potential IOMMU fault after
driver unbind") and commit ed4d81c4b3f2 ("net: aquantia: when cleaning
hw cache it should be toggled") fixed cache invalidation for ATL B0, but
ATL2 was left with only interrupt disabling. This allowed hardware to
write to cached descriptors after DMA memory was unmapped, triggering
SMMU faults. Once cache invalidation is applied to ATL2, the translation
fault can't be observed anymore.
Add shared aq_hw_invalidate_descriptor_cache() helper and use it in both
ATL B0 and ATL2 hw_stop() implementations for consistent behavior.
Fixes: e54dcf4bba3e ("net: atlantic: basic A2 init/deinit hw_ops")
Tested-by: Carol Soto <csoto@nvidia.com>
Signed-off-by: Kai-Heng Feng <kaihengf@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251120041537.62184-1-kaihengf@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/aquantia/atlantic/aq_hw_utils.c | 22 +++++++++++++++++++
.../ethernet/aquantia/atlantic/aq_hw_utils.h | 1 +
.../aquantia/atlantic/hw_atl/hw_atl_b0.c | 19 +---------------
.../aquantia/atlantic/hw_atl2/hw_atl2.c | 2 +-
4 files changed, 25 insertions(+), 19 deletions(-)
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.c b/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.c
index 1921741f7311d..18b08277d2e1a 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.c
@@ -15,6 +15,7 @@
#include "aq_hw.h"
#include "aq_nic.h"
+#include "hw_atl/hw_atl_llh.h"
void aq_hw_write_reg_bit(struct aq_hw_s *aq_hw, u32 addr, u32 msk,
u32 shift, u32 val)
@@ -81,6 +82,27 @@ void aq_hw_write_reg64(struct aq_hw_s *hw, u32 reg, u64 value)
lo_hi_writeq(value, hw->mmio + reg);
}
+int aq_hw_invalidate_descriptor_cache(struct aq_hw_s *hw)
+{
+ int err;
+ u32 val;
+
+ /* Invalidate Descriptor Cache to prevent writing to the cached
+ * descriptors and to the data pointer of those descriptors
+ */
+ hw_atl_rdm_rx_dma_desc_cache_init_tgl(hw);
+
+ err = aq_hw_err_from_flags(hw);
+ if (err)
+ goto err_exit;
+
+ readx_poll_timeout_atomic(hw_atl_rdm_rx_dma_desc_cache_init_done_get,
+ hw, val, val == 1, 1000U, 10000U);
+
+err_exit:
+ return err;
+}
+
int aq_hw_err_from_flags(struct aq_hw_s *hw)
{
int err = 0;
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.h b/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.h
index ffa6e4067c211..d89c63d88e4a4 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.h
@@ -35,6 +35,7 @@ u32 aq_hw_read_reg(struct aq_hw_s *hw, u32 reg);
void aq_hw_write_reg(struct aq_hw_s *hw, u32 reg, u32 value);
u64 aq_hw_read_reg64(struct aq_hw_s *hw, u32 reg);
void aq_hw_write_reg64(struct aq_hw_s *hw, u32 reg, u64 value);
+int aq_hw_invalidate_descriptor_cache(struct aq_hw_s *hw);
int aq_hw_err_from_flags(struct aq_hw_s *hw);
int aq_hw_num_tcs(struct aq_hw_s *hw);
int aq_hw_q_per_tc(struct aq_hw_s *hw);
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index 54e70f07b5734..7b4814b3ba442 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -1198,26 +1198,9 @@ static int hw_atl_b0_hw_interrupt_moderation_set(struct aq_hw_s *self)
static int hw_atl_b0_hw_stop(struct aq_hw_s *self)
{
- int err;
- u32 val;
-
hw_atl_b0_hw_irq_disable(self, HW_ATL_B0_INT_MASK);
- /* Invalidate Descriptor Cache to prevent writing to the cached
- * descriptors and to the data pointer of those descriptors
- */
- hw_atl_rdm_rx_dma_desc_cache_init_tgl(self);
-
- err = aq_hw_err_from_flags(self);
-
- if (err)
- goto err_exit;
-
- readx_poll_timeout_atomic(hw_atl_rdm_rx_dma_desc_cache_init_done_get,
- self, val, val == 1, 1000U, 10000U);
-
-err_exit:
- return err;
+ return aq_hw_invalidate_descriptor_cache(self);
}
int hw_atl_b0_hw_ring_tx_stop(struct aq_hw_s *self, struct aq_ring_s *ring)
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c
index 5dfc751572edc..bc4e1b6035e08 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c
@@ -759,7 +759,7 @@ static int hw_atl2_hw_stop(struct aq_hw_s *self)
{
hw_atl_b0_hw_irq_disable(self, HW_ATL2_INT_MASK);
- return 0;
+ return aq_hw_invalidate_descriptor_cache(self);
}
static struct aq_stats_s *hw_atl2_utils_get_hw_stats(struct aq_hw_s *self)
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 499/568] net: lan966x: Fix the initialization of taprio
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (497 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 498/568] net: aquantia: Add missing descriptor cache invalidation on ATL2 Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 500/568] net/mlx5e: Fix validation logic in rate limiting Greg Kroah-Hartman
` (75 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Horatiu Vultur, Simon Horman,
Paolo Abeni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horatiu Vultur <horatiu.vultur@microchip.com>
[ Upstream commit 9780f535f8e0f20b4632b5a173ead71aa8f095d2 ]
To initialize the taprio block in lan966x, it is required to configure
the register REVISIT_DLY. The purpose of this register is to set the
delay before revisit the next gate and the value of this register depends
on the system clock. The problem is that the we calculated wrong the value
of the system clock period in picoseconds. The actual system clock is
~165.617754MHZ and this correspond to a period of 6038 pico seconds and
not 15125 as currently set.
Fixes: e462b2717380b4 ("net: lan966x: Add offload support for taprio")
Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251121061411.810571-1-horatiu.vultur@microchip.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c b/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c
index 0a0e233f36ab0..667f2651ee309 100644
--- a/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c
+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c
@@ -1,9 +1,12 @@
// SPDX-License-Identifier: GPL-2.0+
#include <linux/ptp_classify.h>
+#include <linux/units.h>
#include "lan966x_main.h"
+#define LAN9X66_CLOCK_RATE 165617754
+
#define LAN966X_MAX_PTP_ID 512
/* Represents 1ppm adjustment in 2^59 format with 6.037735849ns as reference
@@ -896,5 +899,5 @@ void lan966x_ptp_rxtstamp(struct lan966x *lan966x, struct sk_buff *skb,
u32 lan966x_ptp_get_period_ps(void)
{
/* This represents the system clock period in picoseconds */
- return 15125;
+ return PICO / LAN9X66_CLOCK_RATE;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 500/568] net/mlx5e: Fix validation logic in rate limiting
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (498 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 499/568] net: lan966x: Fix the initialization of taprio Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 501/568] net: sxgbe: fix potential NULL dereference in sxgbe_rx() Greg Kroah-Hartman
` (74 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Danielle Costantino, Gal Pressman,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danielle Costantino <dcostantino@meta.com>
[ Upstream commit d2099d9f16dbfa1c5266d4230ff7860047bb0b68 ]
The rate limiting validation condition currently checks the output
variable max_bw_value[i] instead of the input value
maxrate->tc_maxrate[i]. This causes the validation to compare an
uninitialized or stale value rather than the actual requested rate.
The condition should check the input rate to properly validate against
the upper limit:
} else if (maxrate->tc_maxrate[i] <= upper_limit_gbps) {
This aligns with the pattern used in the first branch, which correctly
checks maxrate->tc_maxrate[i] against upper_limit_mbps.
The current implementation can lead to unreliable validation behavior:
- For rates between 25.5 Gbps and 255 Gbps, if max_bw_value[i] is 0
from initialization, the GBPS path may be taken regardless of whether
the actual rate is within bounds
- When processing multiple TCs (i > 0), max_bw_value[i] contains the
value computed for the previous TC, affecting the validation logic
- The overflow check for rates exceeding 255 Gbps may not trigger
consistently depending on previous array values
This patch ensures the validation correctly examines the requested rate
value for proper bounds checking.
Fixes: 43b27d1bd88a ("net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps")
Signed-off-by: Danielle Costantino <dcostantino@meta.com>
Reviewed-by: Gal Pressman <gal@nvidia.com>
Link: https://patch.msgid.link/20251124180043.2314428-1-dcostantino@meta.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index 29e633e6dd3f0..e29a8ed7e7ac1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -619,7 +619,7 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev,
MLX5E_100MB);
max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] : 1;
max_bw_unit[i] = MLX5_100_MBPS_UNIT;
- } else if (max_bw_value[i] <= upper_limit_gbps) {
+ } else if (maxrate->tc_maxrate[i] <= upper_limit_gbps) {
max_bw_value[i] = div_u64(maxrate->tc_maxrate[i],
MLX5E_1GB);
max_bw_unit[i] = MLX5_GBPS_UNIT;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 501/568] net: sxgbe: fix potential NULL dereference in sxgbe_rx()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (499 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 500/568] net/mlx5e: Fix validation logic in rate limiting Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 502/568] drm/amdgpu: fix cyan_skillfish2 gpu info fw handling Greg Kroah-Hartman
` (73 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexey Kodanev, Simon Horman,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
[ Upstream commit f5bce28f6b9125502abec4a67d68eabcd24b3b17 ]
Currently, when skb is null, the driver prints an error and then
dereferences skb on the next line.
To fix this, let's add a 'break' after the error message to switch
to sxgbe_rx_refill(), which is similar to the approach taken by the
other drivers in this particular case, e.g. calxeda with xgmac_rx().
Found during a code review.
Fixes: 1edb9ca69e8a ("net: sxgbe: add basic framework for Samsung 10Gb ethernet driver")
Signed-off-by: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251121123834.97748-1-aleksei.kodanev@bell-sw.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
index 9664f029fa161..f6f99712d562e 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
@@ -1521,8 +1521,10 @@ static int sxgbe_rx(struct sxgbe_priv_data *priv, int limit)
skb = priv->rxq[qnum]->rx_skbuff[entry];
- if (unlikely(!skb))
+ if (unlikely(!skb)) {
netdev_err(priv->dev, "rx descriptor is not consistent\n");
+ break;
+ }
prefetch(skb->data - NET_IP_ALIGN);
priv->rxq[qnum]->rx_skbuff[entry] = NULL;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 502/568] drm/amdgpu: fix cyan_skillfish2 gpu info fw handling
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (500 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 501/568] net: sxgbe: fix potential NULL dereference in sxgbe_rx() Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 503/568] net: dsa: sja1105: simplify static configuration reload Greg Kroah-Hartman
` (72 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alex Deucher, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
[ Upstream commit 7fa666ab07ba9e08f52f357cb8e1aad753e83ac6 ]
If the board supports IP discovery, we don't need to
parse the gpu info firmware.
Backport to 6.18.
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4721
Fixes: fa819e3a7c1e ("drm/amdgpu: add support for cyan skillfish gpu_info")
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 5427e32fa3a0ba9a016db83877851ed277b065fb)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index f18f165876043..38b81ae236cb3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -2021,6 +2021,8 @@ static int amdgpu_device_parse_gpu_info_fw(struct amdgpu_device *adev)
chip_name = "navi12";
break;
case CHIP_CYAN_SKILLFISH:
+ if (adev->mman.discovery_bin)
+ return 0;
chip_name = "cyan_skillfish";
break;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 503/568] net: dsa: sja1105: simplify static configuration reload
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (501 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 502/568] drm/amdgpu: fix cyan_skillfish2 gpu info fw handling Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 504/568] net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic Greg Kroah-Hartman
` (71 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Russell King (Oracle),
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
[ Upstream commit a18891b55703a45b700618ef40edd5e9aaecc345 ]
The static configuration reload saves the port speed in the static
configuration tables by first converting it from the internal
respresentation to the SPEED_xxx ethtool representation, and then
converts it back to restore the setting. This is because
sja1105_adjust_port_config() takes the speed as SPEED_xxx.
However, this is unnecessarily complex. If we split
sja1105_adjust_port_config() up, we can simply save and restore the
mac[port].speed member in the static configuration tables.
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Link: https://patch.msgid.link/E1svfMa-005ZIX-If@rmk-PC.armlinux.org.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: da62abaaa268 ("net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/sja1105/sja1105_main.c | 65 ++++++++++++++------------
1 file changed, 34 insertions(+), 31 deletions(-)
diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
index d51d982c4bc01..8350696bdda5b 100644
--- a/drivers/net/dsa/sja1105/sja1105_main.c
+++ b/drivers/net/dsa/sja1105/sja1105_main.c
@@ -1262,29 +1262,11 @@ static int sja1105_parse_dt(struct sja1105_private *priv)
return rc;
}
-/* Convert link speed from SJA1105 to ethtool encoding */
-static int sja1105_port_speed_to_ethtool(struct sja1105_private *priv,
- u64 speed)
-{
- if (speed == priv->info->port_speed[SJA1105_SPEED_10MBPS])
- return SPEED_10;
- if (speed == priv->info->port_speed[SJA1105_SPEED_100MBPS])
- return SPEED_100;
- if (speed == priv->info->port_speed[SJA1105_SPEED_1000MBPS])
- return SPEED_1000;
- if (speed == priv->info->port_speed[SJA1105_SPEED_2500MBPS])
- return SPEED_2500;
- return SPEED_UNKNOWN;
-}
-
-/* Set link speed in the MAC configuration for a specific port. */
-static int sja1105_adjust_port_config(struct sja1105_private *priv, int port,
- int speed_mbps)
+static int sja1105_set_port_speed(struct sja1105_private *priv, int port,
+ int speed_mbps)
{
struct sja1105_mac_config_entry *mac;
- struct device *dev = priv->ds->dev;
u64 speed;
- int rc;
/* On P/Q/R/S, one can read from the device via the MAC reconfiguration
* tables. On E/T, MAC reconfig tables are not readable, only writable.
@@ -1318,7 +1300,7 @@ static int sja1105_adjust_port_config(struct sja1105_private *priv, int port,
speed = priv->info->port_speed[SJA1105_SPEED_2500MBPS];
break;
default:
- dev_err(dev, "Invalid speed %iMbps\n", speed_mbps);
+ dev_err(priv->ds->dev, "Invalid speed %iMbps\n", speed_mbps);
return -EINVAL;
}
@@ -1330,11 +1312,31 @@ static int sja1105_adjust_port_config(struct sja1105_private *priv, int port,
* we need to configure the PCS only (if even that).
*/
if (priv->phy_mode[port] == PHY_INTERFACE_MODE_SGMII)
- mac[port].speed = priv->info->port_speed[SJA1105_SPEED_1000MBPS];
+ speed = priv->info->port_speed[SJA1105_SPEED_1000MBPS];
else if (priv->phy_mode[port] == PHY_INTERFACE_MODE_2500BASEX)
- mac[port].speed = priv->info->port_speed[SJA1105_SPEED_2500MBPS];
- else
- mac[port].speed = speed;
+ speed = priv->info->port_speed[SJA1105_SPEED_2500MBPS];
+
+ mac[port].speed = speed;
+
+ return 0;
+}
+
+/* Write the MAC Configuration Table entry and, if necessary, the CGU settings,
+ * after a link speedchange for this port.
+ */
+static int sja1105_set_port_config(struct sja1105_private *priv, int port)
+{
+ struct sja1105_mac_config_entry *mac;
+ struct device *dev = priv->ds->dev;
+ int rc;
+
+ /* On P/Q/R/S, one can read from the device via the MAC reconfiguration
+ * tables. On E/T, MAC reconfig tables are not readable, only writable.
+ * We have to *know* what the MAC looks like. For the sake of keeping
+ * the code common, we'll use the static configuration tables as a
+ * reasonable approximation for both E/T and P/Q/R/S.
+ */
+ mac = priv->static_config.tables[BLK_IDX_MAC_CONFIG].entries;
/* Write to the dynamic reconfiguration tables */
rc = sja1105_dynamic_config_write(priv, BLK_IDX_MAC_CONFIG, port,
@@ -1384,7 +1386,8 @@ static void sja1105_mac_link_up(struct dsa_switch *ds, int port,
{
struct sja1105_private *priv = ds->priv;
- sja1105_adjust_port_config(priv, port, speed);
+ if (!sja1105_set_port_speed(priv, port, speed))
+ sja1105_set_port_config(priv, port);
sja1105_inhibit_tx(priv, BIT(port), false);
}
@@ -2291,8 +2294,8 @@ int sja1105_static_config_reload(struct sja1105_private *priv,
{
struct ptp_system_timestamp ptp_sts_before;
struct ptp_system_timestamp ptp_sts_after;
- int speed_mbps[SJA1105_MAX_NUM_PORTS];
u16 bmcr[SJA1105_MAX_NUM_PORTS] = {0};
+ u64 mac_speed[SJA1105_MAX_NUM_PORTS];
struct sja1105_mac_config_entry *mac;
struct dsa_switch *ds = priv->ds;
s64 t1, t2, t3, t4;
@@ -2305,14 +2308,13 @@ int sja1105_static_config_reload(struct sja1105_private *priv,
mac = priv->static_config.tables[BLK_IDX_MAC_CONFIG].entries;
- /* Back up the dynamic link speed changed by sja1105_adjust_port_config
+ /* Back up the dynamic link speed changed by sja1105_set_port_speed()
* in order to temporarily restore it to SJA1105_SPEED_AUTO - which the
* switch wants to see in the static config in order to allow us to
* change it through the dynamic interface later.
*/
for (i = 0; i < ds->num_ports; i++) {
- speed_mbps[i] = sja1105_port_speed_to_ethtool(priv,
- mac[i].speed);
+ mac_speed[i] = mac[i].speed;
mac[i].speed = priv->info->port_speed[SJA1105_SPEED_AUTO];
if (priv->xpcs[i])
@@ -2375,7 +2377,8 @@ int sja1105_static_config_reload(struct sja1105_private *priv,
struct dw_xpcs *xpcs = priv->xpcs[i];
unsigned int mode;
- rc = sja1105_adjust_port_config(priv, i, speed_mbps[i]);
+ mac[i].speed = mac_speed[i];
+ rc = sja1105_set_port_config(priv, i);
if (rc < 0)
goto out;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 504/568] net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (502 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 503/568] net: dsa: sja1105: simplify static configuration reload Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 505/568] net: atlantic: fix fragment overflow handling in RX path Greg Kroah-Hartman
` (70 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Oltean, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit da62abaaa268357b1aa66b372ace562189a05df1 ]
When using the SGMII PCS as a fixed-link chip-to-chip connection, it is
easy to miss the fact that traffic passes only at 1G, since that's what
any normal such connection would use.
When using the SGMII PCS connected towards an on-board PHY or an SFP
module, it is immediately noticeable that when the link resolves to a
speed other than 1G, traffic from the MAC fails to pass: TX counters
increase, but nothing gets decoded by the other end, and no local RX
counters increase either.
Artificially lowering a fixed-link rate to speed = <100> makes us able
to see the same issue as in the case of having an SGMII PHY.
Some debugging shows that the XPCS configuration is A-OK, but that the
MAC Configuration Table entry for the port has the SPEED bits still set
to 1000Mbps, due to a special condition in the driver. Deleting that
condition, and letting the resolved link speed be programmed directly
into the MAC speed field, results in a functional link at all 3 speeds.
This piece of evidence, based on testing on both generations with SGMII
support (SJA1105S and SJA1110A) directly contradicts the statement from
the blamed commit that "the MAC is fixed at 1 Gbps and we need to
configure the PCS only (if even that)". Worse, that statement is not
backed by any documentation, and no one from NXP knows what it might
refer to.
I am unable to recall sufficient context regarding my testing from March
2020 to understand what led me to draw such a braindead and factually
incorrect conclusion. Yet, there is nothing of value regarding forcing
the MAC speed, either for SGMII or 2500Base-X (introduced at a later
stage), so remove all such logic.
Fixes: ffe10e679cec ("net: dsa: sja1105: Add support for the SGMII port")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20251122111324.136761-1-vladimir.oltean@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/sja1105/sja1105_main.c | 7 -------
1 file changed, 7 deletions(-)
diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
index 8350696bdda5b..cb6f924b92ac0 100644
--- a/drivers/net/dsa/sja1105/sja1105_main.c
+++ b/drivers/net/dsa/sja1105/sja1105_main.c
@@ -1308,14 +1308,7 @@ static int sja1105_set_port_speed(struct sja1105_private *priv, int port,
* table, since this will be used for the clocking setup, and we no
* longer need to store it in the static config (already told hardware
* we want auto during upload phase).
- * Actually for the SGMII port, the MAC is fixed at 1 Gbps and
- * we need to configure the PCS only (if even that).
*/
- if (priv->phy_mode[port] == PHY_INTERFACE_MODE_SGMII)
- speed = priv->info->port_speed[SJA1105_SPEED_1000MBPS];
- else if (priv->phy_mode[port] == PHY_INTERFACE_MODE_2500BASEX)
- speed = priv->info->port_speed[SJA1105_SPEED_2500MBPS];
-
mac[port].speed = speed;
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 505/568] net: atlantic: fix fragment overflow handling in RX path
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (503 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 504/568] net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 506/568] mailbox: mailbox-test: Fix debugfs_create_dir error checking Greg Kroah-Hartman
` (69 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiefeng Zhang, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiefeng Zhang <jiefeng.z.zhang@gmail.com>
[ Upstream commit 5ffcb7b890f61541201461580bb6622ace405aec ]
The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17)
fragments when handling large multi-descriptor packets. This causes an
out-of-bounds write in skb_add_rx_frag_netmem() leading to kernel panic.
The issue occurs because the driver doesn't check the total number of
fragments before calling skb_add_rx_frag(). When a packet requires more
than MAX_SKB_FRAGS fragments, the fragment index exceeds the array bounds.
Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE,
then all fragments are accounted for. And reusing the existing check to
prevent the overflow earlier in the code path.
This crash occurred in production with an Aquantia AQC113 10G NIC.
Stack trace from production environment:
```
RIP: 0010:skb_add_rx_frag_netmem+0x29/0xd0
Code: 90 f3 0f 1e fa 0f 1f 44 00 00 48 89 f8 41 89
ca 48 89 d7 48 63 ce 8b 90 c0 00 00 00 48 c1 e1 04 48 01 ca 48 03 90
c8 00 00 00 <48> 89 7a 30 44 89 52 3c 44 89 42 38 40 f6 c7 01 75 74 48
89 fa 83
RSP: 0018:ffffa9bec02a8d50 EFLAGS: 00010287
RAX: ffff925b22e80a00 RBX: ffff925ad38d2700 RCX:
fffffffe0a0c8000
RDX: ffff9258ea95bac0 RSI: ffff925ae0a0c800 RDI:
0000000000037a40
RBP: 0000000000000024 R08: 0000000000000000 R09:
0000000000000021
R10: 0000000000000848 R11: 0000000000000000 R12:
ffffa9bec02a8e24
R13: ffff925ad8615570 R14: 0000000000000000 R15:
ffff925b22e80a00
FS: 0000000000000000(0000)
GS:ffff925e47880000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff9258ea95baf0 CR3: 0000000166022004 CR4:
0000000000f72ef0
PKRU: 55555554
Call Trace:
<IRQ>
aq_ring_rx_clean+0x175/0xe60 [atlantic]
? aq_ring_rx_clean+0x14d/0xe60 [atlantic]
? aq_ring_tx_clean+0xdf/0x190 [atlantic]
? kmem_cache_free+0x348/0x450
? aq_vec_poll+0x81/0x1d0 [atlantic]
? __napi_poll+0x28/0x1c0
? net_rx_action+0x337/0x420
```
Fixes: 6aecbba12b5c ("net: atlantic: add check for MAX_SKB_FRAGS")
Changes in v4:
- Add Fixes: tag to satisfy patch validation requirements.
Changes in v3:
- Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE,
then all fragments are accounted for.
Signed-off-by: Jiefeng Zhang <jiefeng.z.zhang@gmail.com>
Link: https://patch.msgid.link/20251126032249.69358-1-jiefeng.z.zhang@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
index 0eaaba3a18ee0..c8466ebd4a031 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
@@ -547,6 +547,11 @@ static int __aq_ring_rx_clean(struct aq_ring_s *self, struct napi_struct *napi,
if (!buff->is_eop) {
unsigned int frag_cnt = 0U;
+
+ /* There will be an extra fragment */
+ if (buff->len > AQ_CFG_RX_HDR_SIZE)
+ frag_cnt++;
+
buff_ = buff;
do {
bool is_rsc_completed = true;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 506/568] mailbox: mailbox-test: Fix debugfs_create_dir error checking
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (504 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 505/568] net: atlantic: fix fragment overflow handling in RX path Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 507/568] mailbox: Allow direct registration to a channel Greg Kroah-Hartman
` (68 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Jassi Brar,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 3acf1028f5003731977f750a7070f3321a9cb740 ]
The debugfs_create_dir() function returns ERR_PTR() on error, not NULL.
The current null-check fails to catch errors.
Use IS_ERR() to correctly check for errors.
Fixes: 8ea4484d0c2b ("mailbox: Add generic mechanism for testing Mailbox Controllers")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/mailbox-test.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c
index abcee58e851c2..29c04157b5e88 100644
--- a/drivers/mailbox/mailbox-test.c
+++ b/drivers/mailbox/mailbox-test.c
@@ -267,7 +267,7 @@ static int mbox_test_add_debugfs(struct platform_device *pdev,
return 0;
tdev->root_debugfs_dir = debugfs_create_dir(dev_name(&pdev->dev), NULL);
- if (!tdev->root_debugfs_dir) {
+ if (IS_ERR(tdev->root_debugfs_dir)) {
dev_err(&pdev->dev, "Failed to create Mailbox debugfs\n");
return -EINVAL;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 507/568] mailbox: Allow direct registration to a channel
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (505 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 506/568] mailbox: mailbox-test: Fix debugfs_create_dir error checking Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 508/568] mailbox: pcc: Use mbox_bind_client Greg Kroah-Hartman
` (67 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Elliot Berman, Jassi Brar,
Sasha Levin, Sudeep Holla
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Elliot Berman <quic_eberman@quicinc.com>
[ Upstream commit 85a953806557dbf25d16e8c132b5b9b100d16496 ]
Support virtual mailbox controllers and clients which are not platform
devices or come from the devicetree by allowing them to match client to
channel via some other mechanism.
Tested-by: Sudeep Holla <sudeep.holla@arm.com> (pcc)
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Stable-dep-of: ff0e4d4c97c9 ("mailbox: pcc: don't zero error register")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/mailbox.c | 96 ++++++++++++++++++++++++----------
include/linux/mailbox_client.h | 1 +
2 files changed, 69 insertions(+), 28 deletions(-)
diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c
index cb31ad917b352..f4cfbdfe4111c 100644
--- a/drivers/mailbox/mailbox.c
+++ b/drivers/mailbox/mailbox.c
@@ -317,6 +317,71 @@ int mbox_flush(struct mbox_chan *chan, unsigned long timeout)
}
EXPORT_SYMBOL_GPL(mbox_flush);
+static int __mbox_bind_client(struct mbox_chan *chan, struct mbox_client *cl)
+{
+ struct device *dev = cl->dev;
+ unsigned long flags;
+ int ret;
+
+ if (chan->cl || !try_module_get(chan->mbox->dev->driver->owner)) {
+ dev_dbg(dev, "%s: mailbox not free\n", __func__);
+ return -EBUSY;
+ }
+
+ spin_lock_irqsave(&chan->lock, flags);
+ chan->msg_free = 0;
+ chan->msg_count = 0;
+ chan->active_req = NULL;
+ chan->cl = cl;
+ init_completion(&chan->tx_complete);
+
+ if (chan->txdone_method == TXDONE_BY_POLL && cl->knows_txdone)
+ chan->txdone_method = TXDONE_BY_ACK;
+
+ spin_unlock_irqrestore(&chan->lock, flags);
+
+ if (chan->mbox->ops->startup) {
+ ret = chan->mbox->ops->startup(chan);
+
+ if (ret) {
+ dev_err(dev, "Unable to startup the chan (%d)\n", ret);
+ mbox_free_channel(chan);
+ return ret;
+ }
+ }
+
+ return 0;
+}
+
+/**
+ * mbox_bind_client - Request a mailbox channel.
+ * @chan: The mailbox channel to bind the client to.
+ * @cl: Identity of the client requesting the channel.
+ *
+ * The Client specifies its requirements and capabilities while asking for
+ * a mailbox channel. It can't be called from atomic context.
+ * The channel is exclusively allocated and can't be used by another
+ * client before the owner calls mbox_free_channel.
+ * After assignment, any packet received on this channel will be
+ * handed over to the client via the 'rx_callback'.
+ * The framework holds reference to the client, so the mbox_client
+ * structure shouldn't be modified until the mbox_free_channel returns.
+ *
+ * Return: 0 if the channel was assigned to the client successfully.
+ * <0 for request failure.
+ */
+int mbox_bind_client(struct mbox_chan *chan, struct mbox_client *cl)
+{
+ int ret;
+
+ mutex_lock(&con_mutex);
+ ret = __mbox_bind_client(chan, cl);
+ mutex_unlock(&con_mutex);
+
+ return ret;
+}
+EXPORT_SYMBOL_GPL(mbox_bind_client);
+
/**
* mbox_request_channel - Request a mailbox channel.
* @cl: Identity of the client requesting the channel.
@@ -340,7 +405,6 @@ struct mbox_chan *mbox_request_channel(struct mbox_client *cl, int index)
struct mbox_controller *mbox;
struct of_phandle_args spec;
struct mbox_chan *chan;
- unsigned long flags;
int ret;
if (!dev || !dev->of_node) {
@@ -373,33 +437,9 @@ struct mbox_chan *mbox_request_channel(struct mbox_client *cl, int index)
return chan;
}
- if (chan->cl || !try_module_get(mbox->dev->driver->owner)) {
- dev_dbg(dev, "%s: mailbox not free\n", __func__);
- mutex_unlock(&con_mutex);
- return ERR_PTR(-EBUSY);
- }
-
- spin_lock_irqsave(&chan->lock, flags);
- chan->msg_free = 0;
- chan->msg_count = 0;
- chan->active_req = NULL;
- chan->cl = cl;
- init_completion(&chan->tx_complete);
-
- if (chan->txdone_method == TXDONE_BY_POLL && cl->knows_txdone)
- chan->txdone_method = TXDONE_BY_ACK;
-
- spin_unlock_irqrestore(&chan->lock, flags);
-
- if (chan->mbox->ops->startup) {
- ret = chan->mbox->ops->startup(chan);
-
- if (ret) {
- dev_err(dev, "Unable to startup the chan (%d)\n", ret);
- mbox_free_channel(chan);
- chan = ERR_PTR(ret);
- }
- }
+ ret = __mbox_bind_client(chan, cl);
+ if (ret)
+ chan = ERR_PTR(ret);
mutex_unlock(&con_mutex);
return chan;
diff --git a/include/linux/mailbox_client.h b/include/linux/mailbox_client.h
index 65229a45590f1..734694912ef74 100644
--- a/include/linux/mailbox_client.h
+++ b/include/linux/mailbox_client.h
@@ -37,6 +37,7 @@ struct mbox_client {
void (*tx_done)(struct mbox_client *cl, void *mssg, int r);
};
+int mbox_bind_client(struct mbox_chan *chan, struct mbox_client *cl);
struct mbox_chan *mbox_request_channel_byname(struct mbox_client *cl,
const char *name);
struct mbox_chan *mbox_request_channel(struct mbox_client *cl, int index);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 508/568] mailbox: pcc: Use mbox_bind_client
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (506 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 507/568] mailbox: Allow direct registration to a channel Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 509/568] mailbox: pcc: Add support for platform notification handling Greg Kroah-Hartman
` (66 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sudeep Holla, Elliot Berman,
Jassi Brar, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Elliot Berman <quic_eberman@quicinc.com>
[ Upstream commit 76d4adacd52e78bea2e393081f2a5766261d1e3a ]
Use generic mbox_bind_client() to bind omap mailbox channel to a client.
mbox_bind_client is identical to the replaced lines, except that it:
- Does the operation under con_mutex which prevents possible races in
removal path
- Sets TXDONE_BY_ACK if pcc uses TXDONE_BY_POLL and the client knows
when tx is done. TXDONE_BY_ACK is already set if there's no interrupt,
so this is not applicable.
- Calls chan->mbox->ops->startup. This is usecase for requesting irq:
move the devm_request_irq into the startup callback and unregister it
in the shutdown path.
Tested-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Stable-dep-of: ff0e4d4c97c9 ("mailbox: pcc: don't zero error register")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/pcc.c | 84 +++++++++++++++++++++++--------------------
1 file changed, 45 insertions(+), 39 deletions(-)
diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
index 105d46c9801ba..a44d4b3e5beb2 100644
--- a/drivers/mailbox/pcc.c
+++ b/drivers/mailbox/pcc.c
@@ -282,8 +282,7 @@ pcc_mbox_request_channel(struct mbox_client *cl, int subspace_id)
{
struct pcc_chan_info *pchan;
struct mbox_chan *chan;
- struct device *dev;
- unsigned long flags;
+ int rc;
if (subspace_id < 0 || subspace_id >= pcc_chan_count)
return ERR_PTR(-ENOENT);
@@ -294,32 +293,10 @@ pcc_mbox_request_channel(struct mbox_client *cl, int subspace_id)
pr_err("Channel not found for idx: %d\n", subspace_id);
return ERR_PTR(-EBUSY);
}
- dev = chan->mbox->dev;
- spin_lock_irqsave(&chan->lock, flags);
- chan->msg_free = 0;
- chan->msg_count = 0;
- chan->active_req = NULL;
- chan->cl = cl;
- init_completion(&chan->tx_complete);
-
- if (chan->txdone_method == TXDONE_BY_POLL && cl->knows_txdone)
- chan->txdone_method = TXDONE_BY_ACK;
-
- spin_unlock_irqrestore(&chan->lock, flags);
-
- if (pchan->plat_irq > 0) {
- int rc;
-
- rc = devm_request_irq(dev, pchan->plat_irq, pcc_mbox_irq, 0,
- MBOX_IRQ_NAME, chan);
- if (unlikely(rc)) {
- dev_err(dev, "failed to register PCC interrupt %d\n",
- pchan->plat_irq);
- pcc_mbox_free_channel(&pchan->chan);
- return ERR_PTR(rc);
- }
- }
+ rc = mbox_bind_client(chan, cl);
+ if (rc)
+ return ERR_PTR(rc);
return &pchan->chan;
}
@@ -333,23 +310,12 @@ EXPORT_SYMBOL_GPL(pcc_mbox_request_channel);
*/
void pcc_mbox_free_channel(struct pcc_mbox_chan *pchan)
{
- struct pcc_chan_info *pchan_info = to_pcc_chan_info(pchan);
struct mbox_chan *chan = pchan->mchan;
- unsigned long flags;
if (!chan || !chan->cl)
return;
- if (pchan_info->plat_irq > 0)
- devm_free_irq(chan->mbox->dev, pchan_info->plat_irq, chan);
-
- spin_lock_irqsave(&chan->lock, flags);
- chan->cl = NULL;
- chan->active_req = NULL;
- if (chan->txdone_method == TXDONE_BY_ACK)
- chan->txdone_method = TXDONE_BY_POLL;
-
- spin_unlock_irqrestore(&chan->lock, flags);
+ mbox_free_channel(chan);
}
EXPORT_SYMBOL_GPL(pcc_mbox_free_channel);
@@ -377,8 +343,48 @@ static int pcc_send_data(struct mbox_chan *chan, void *data)
return pcc_chan_reg_read_modify_write(&pchan->db);
}
+/**
+ * pcc_startup - Called from Mailbox Controller code. Used here
+ * to request the interrupt.
+ * @chan: Pointer to Mailbox channel to startup.
+ *
+ * Return: Err if something failed else 0 for success.
+ */
+static int pcc_startup(struct mbox_chan *chan)
+{
+ struct pcc_chan_info *pchan = chan->con_priv;
+ int rc;
+
+ if (pchan->plat_irq > 0) {
+ rc = devm_request_irq(chan->mbox->dev, pchan->plat_irq, pcc_mbox_irq, 0,
+ MBOX_IRQ_NAME, chan);
+ if (unlikely(rc)) {
+ dev_err(chan->mbox->dev, "failed to register PCC interrupt %d\n",
+ pchan->plat_irq);
+ return rc;
+ }
+ }
+
+ return 0;
+}
+
+/**
+ * pcc_shutdown - Called from Mailbox Controller code. Used here
+ * to free the interrupt.
+ * @chan: Pointer to Mailbox channel to shutdown.
+ */
+static void pcc_shutdown(struct mbox_chan *chan)
+{
+ struct pcc_chan_info *pchan = chan->con_priv;
+
+ if (pchan->plat_irq > 0)
+ devm_free_irq(chan->mbox->dev, pchan->plat_irq, chan);
+}
+
static const struct mbox_chan_ops pcc_chan_ops = {
.send_data = pcc_send_data,
+ .startup = pcc_startup,
+ .shutdown = pcc_shutdown,
};
/**
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 509/568] mailbox: pcc: Add support for platform notification handling
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (507 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 508/568] mailbox: pcc: Use mbox_bind_client Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 510/568] mailbox: pcc: Support shared interrupt for multiple subspaces Greg Kroah-Hartman
` (65 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Huisong Li, Hanjun Guo, Sudeep Holla,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huisong Li <lihuisong@huawei.com>
[ Upstream commit 60c40b06fa68694dd08a1a0038ea8b9de3f3b1ca ]
Currently, PCC driver doesn't support the processing of platform
notification for type 4 PCC subspaces.
According to ACPI specification, if platform sends a notification
to OSPM, it must clear the command complete bit and trigger platform
interrupt. OSPM needs to check whether the command complete bit is
cleared, clear platform interrupt, process command, and then set the
command complete and ring doorbell to the Platform.
Let us stash the value of the pcc type and use the same while processing
the interrupt of the channel. We also need to set the command complete
bit and ring doorbell in the interrupt handler for the type 4 channel to
complete the communication flow after processing the notification from
the Platform.
Signed-off-by: Huisong Li <lihuisong@huawei.com>
Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
Link: https://lore.kernel.org/r/20230801063827.25336-2-lihuisong@huawei.com
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Stable-dep-of: ff0e4d4c97c9 ("mailbox: pcc: don't zero error register")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/pcc.c | 50 +++++++++++++++++++++++++++++++++++--------
1 file changed, 41 insertions(+), 9 deletions(-)
diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
index a44d4b3e5beb2..80310b48bfb6a 100644
--- a/drivers/mailbox/pcc.c
+++ b/drivers/mailbox/pcc.c
@@ -91,6 +91,7 @@ struct pcc_chan_reg {
* @cmd_update: PCC register bundle for the command complete update register
* @error: PCC register bundle for the error status register
* @plat_irq: platform interrupt
+ * @type: PCC subspace type
*/
struct pcc_chan_info {
struct pcc_mbox_chan chan;
@@ -100,12 +101,15 @@ struct pcc_chan_info {
struct pcc_chan_reg cmd_update;
struct pcc_chan_reg error;
int plat_irq;
+ u8 type;
};
#define to_pcc_chan_info(c) container_of(c, struct pcc_chan_info, chan)
static struct pcc_chan_info *chan_info;
static int pcc_chan_count;
+static int pcc_send_data(struct mbox_chan *chan, void *data);
+
/*
* PCC can be used with perf critical drivers such as CPPC
* So it makes sense to locally cache the virtual address and
@@ -221,6 +225,34 @@ static int pcc_map_interrupt(u32 interrupt, u32 flags)
return acpi_register_gsi(NULL, interrupt, trigger, polarity);
}
+static bool pcc_mbox_cmd_complete_check(struct pcc_chan_info *pchan)
+{
+ u64 val;
+ int ret;
+
+ ret = pcc_chan_reg_read(&pchan->cmd_complete, &val);
+ if (ret)
+ return false;
+
+ if (!pchan->cmd_complete.gas)
+ return true;
+
+ /*
+ * Judge if the channel respond the interrupt based on the value of
+ * command complete.
+ */
+ val &= pchan->cmd_complete.status_mask;
+ /*
+ * If this is PCC slave subspace channel, and the command complete
+ * bit 0 indicates that Platform is sending a notification and OSPM
+ * needs to respond this interrupt to process this command.
+ */
+ if (pchan->type == ACPI_PCCT_TYPE_EXT_PCC_SLAVE_SUBSPACE)
+ return !val;
+
+ return !!val;
+}
+
/**
* pcc_mbox_irq - PCC mailbox interrupt handler
* @irq: interrupt number
@@ -236,17 +268,9 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p)
int ret;
pchan = chan->con_priv;
-
- ret = pcc_chan_reg_read(&pchan->cmd_complete, &val);
- if (ret)
+ if (!pcc_mbox_cmd_complete_check(pchan))
return IRQ_NONE;
- if (val) { /* Ensure GAS exists and value is non-zero */
- val &= pchan->cmd_complete.status_mask;
- if (!val)
- return IRQ_NONE;
- }
-
ret = pcc_chan_reg_read(&pchan->error, &val);
if (ret)
return IRQ_NONE;
@@ -262,6 +286,13 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p)
mbox_chan_received_data(chan, NULL);
+ /*
+ * The PCC slave subspace channel needs to set the command complete bit
+ * and ring doorbell after processing message.
+ */
+ if (pchan->type == ACPI_PCCT_TYPE_EXT_PCC_SLAVE_SUBSPACE)
+ pcc_send_data(chan, NULL);
+
return IRQ_HANDLED;
}
@@ -698,6 +729,7 @@ static int pcc_mbox_probe(struct platform_device *pdev)
pcc_parse_subspace_shmem(pchan, pcct_entry);
+ pchan->type = pcct_entry->type;
pcct_entry = (struct acpi_subtable_header *)
((unsigned long) pcct_entry + pcct_entry->length);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 510/568] mailbox: pcc: Support shared interrupt for multiple subspaces
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (508 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 509/568] mailbox: pcc: Add support for platform notification handling Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 511/568] ACPI: PCC: Add PCC shared memory region command and status bitfields Greg Kroah-Hartman
` (64 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Huisong Li, Hanjun Guo, Sudeep Holla,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huisong Li <lihuisong@huawei.com>
[ Upstream commit 3db174e478cb0bb34888c20a531608b70aec9c1f ]
If the platform acknowledge interrupt is level triggered, then it can
be shared by multiple subspaces provided each one has a unique platform
interrupt ack preserve and ack set masks.
If it can be shared, then we can request the irq with IRQF_SHARED and
IRQF_ONESHOT flags. The first one indicating it can be shared and the
latter one to keep the interrupt disabled until the hardirq handler
finished.
Further, since there is no way to detect if the interrupt is for a given
channel as the interrupt ack preserve and ack set masks are for clearing
the interrupt and not for reading the status(in case Irq Ack register
may be write-only on some platforms), we need a way to identify if the
given channel is in use and expecting the interrupt.
PCC type0, type1 and type5 do not support shared level triggered interrupt.
The methods of determining whether a given channel for remaining types
should respond to an interrupt are as follows:
- type2: Whether the interrupt belongs to a given channel is only
determined by the status field in Generic Communications Channel
Shared Memory Region, which is done in rx_callback of PCC client.
- type3: This channel checks chan_in_use flag first and then checks the
command complete bit(value '1' indicates that the command has
been completed).
- type4: Platform ensure that the default value of the command complete
bit corresponding to the type4 channel is '1'. This command
complete bit is '0' when receive a platform notification.
The new field, 'chan_in_use' is used by the type only support the
communication from OSPM to Platform (like type3) and should be completely
ignored by other types so as to avoid too many type unnecessary checks in
IRQ handler.
Signed-off-by: Huisong Li <lihuisong@huawei.com>
Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
Link: https://lore.kernel.org/r/20230801063827.25336-3-lihuisong@huawei.com
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Stable-dep-of: ff0e4d4c97c9 ("mailbox: pcc: don't zero error register")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/pcc.c | 43 ++++++++++++++++++++++++++++++++++++++++---
1 file changed, 40 insertions(+), 3 deletions(-)
diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
index 80310b48bfb6a..94885e411085a 100644
--- a/drivers/mailbox/pcc.c
+++ b/drivers/mailbox/pcc.c
@@ -92,6 +92,13 @@ struct pcc_chan_reg {
* @error: PCC register bundle for the error status register
* @plat_irq: platform interrupt
* @type: PCC subspace type
+ * @plat_irq_flags: platform interrupt flags
+ * @chan_in_use: this flag is used just to check if the interrupt needs
+ * handling when it is shared. Since only one transfer can occur
+ * at a time and mailbox takes care of locking, this flag can be
+ * accessed without a lock. Note: the type only support the
+ * communication from OSPM to Platform, like type3, use it, and
+ * other types completely ignore it.
*/
struct pcc_chan_info {
struct pcc_mbox_chan chan;
@@ -102,6 +109,8 @@ struct pcc_chan_info {
struct pcc_chan_reg error;
int plat_irq;
u8 type;
+ unsigned int plat_irq_flags;
+ bool chan_in_use;
};
#define to_pcc_chan_info(c) container_of(c, struct pcc_chan_info, chan)
@@ -225,6 +234,12 @@ static int pcc_map_interrupt(u32 interrupt, u32 flags)
return acpi_register_gsi(NULL, interrupt, trigger, polarity);
}
+static bool pcc_chan_plat_irq_can_be_shared(struct pcc_chan_info *pchan)
+{
+ return (pchan->plat_irq_flags & ACPI_PCCT_INTERRUPT_MODE) ==
+ ACPI_LEVEL_SENSITIVE;
+}
+
static bool pcc_mbox_cmd_complete_check(struct pcc_chan_info *pchan)
{
u64 val;
@@ -242,6 +257,7 @@ static bool pcc_mbox_cmd_complete_check(struct pcc_chan_info *pchan)
* command complete.
*/
val &= pchan->cmd_complete.status_mask;
+
/*
* If this is PCC slave subspace channel, and the command complete
* bit 0 indicates that Platform is sending a notification and OSPM
@@ -268,6 +284,10 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p)
int ret;
pchan = chan->con_priv;
+ if (pchan->type == ACPI_PCCT_TYPE_EXT_PCC_MASTER_SUBSPACE &&
+ !pchan->chan_in_use)
+ return IRQ_NONE;
+
if (!pcc_mbox_cmd_complete_check(pchan))
return IRQ_NONE;
@@ -289,9 +309,12 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p)
/*
* The PCC slave subspace channel needs to set the command complete bit
* and ring doorbell after processing message.
+ *
+ * The PCC master subspace channel clears chan_in_use to free channel.
*/
if (pchan->type == ACPI_PCCT_TYPE_EXT_PCC_SLAVE_SUBSPACE)
pcc_send_data(chan, NULL);
+ pchan->chan_in_use = false;
return IRQ_HANDLED;
}
@@ -371,7 +394,11 @@ static int pcc_send_data(struct mbox_chan *chan, void *data)
if (ret)
return ret;
- return pcc_chan_reg_read_modify_write(&pchan->db);
+ ret = pcc_chan_reg_read_modify_write(&pchan->db);
+ if (!ret && pchan->plat_irq > 0)
+ pchan->chan_in_use = true;
+
+ return ret;
}
/**
@@ -384,11 +411,14 @@ static int pcc_send_data(struct mbox_chan *chan, void *data)
static int pcc_startup(struct mbox_chan *chan)
{
struct pcc_chan_info *pchan = chan->con_priv;
+ unsigned long irqflags;
int rc;
if (pchan->plat_irq > 0) {
- rc = devm_request_irq(chan->mbox->dev, pchan->plat_irq, pcc_mbox_irq, 0,
- MBOX_IRQ_NAME, chan);
+ irqflags = pcc_chan_plat_irq_can_be_shared(pchan) ?
+ IRQF_SHARED | IRQF_ONESHOT : 0;
+ rc = devm_request_irq(chan->mbox->dev, pchan->plat_irq, pcc_mbox_irq,
+ irqflags, MBOX_IRQ_NAME, chan);
if (unlikely(rc)) {
dev_err(chan->mbox->dev, "failed to register PCC interrupt %d\n",
pchan->plat_irq);
@@ -494,6 +524,7 @@ static int pcc_parse_subspace_irq(struct pcc_chan_info *pchan,
pcct_ss->platform_interrupt);
return -EINVAL;
}
+ pchan->plat_irq_flags = pcct_ss->flags;
if (pcct_ss->header.type == ACPI_PCCT_TYPE_HW_REDUCED_SUBSPACE_TYPE2) {
struct acpi_pcct_hw_reduced_type2 *pcct2_ss = (void *)pcct_ss;
@@ -515,6 +546,12 @@ static int pcc_parse_subspace_irq(struct pcc_chan_info *pchan,
"PLAT IRQ ACK");
}
+ if (pcc_chan_plat_irq_can_be_shared(pchan) &&
+ !pchan->plat_irq_ack.gas) {
+ pr_err("PCC subspace has level IRQ with no ACK register\n");
+ return -EINVAL;
+ }
+
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 511/568] ACPI: PCC: Add PCC shared memory region command and status bitfields
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (509 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 510/568] mailbox: pcc: Support shared interrupt for multiple subspaces Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 512/568] mailbox: pcc: Check before sending MCTP PCC response ACK Greg Kroah-Hartman
` (63 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki, Sudeep Holla,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@arm.com>
[ Upstream commit 55d235ebb684b993b3247740c1c8e273f8af4a54 ]
Define the common macros to use when referring to various bitfields in
the PCC generic communications channel command and status fields.
Currently different drivers that need to use these bitfields have defined
these locally. This common macro is intended to consolidate and replace
those.
Cc: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
Link: https://lore.kernel.org/r/20230927-pcc_defines-v2-1-0b8ffeaef2e5@arm.com
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Stable-dep-of: ff0e4d4c97c9 ("mailbox: pcc: don't zero error register")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/acpi/pcc.h | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/include/acpi/pcc.h b/include/acpi/pcc.h
index 73e806fe7ce70..9b373d172a776 100644
--- a/include/acpi/pcc.h
+++ b/include/acpi/pcc.h
@@ -18,7 +18,20 @@ struct pcc_mbox_chan {
u16 min_turnaround_time;
};
+/* Generic Communications Channel Shared Memory Region */
+#define PCC_SIGNATURE 0x50434300
+/* Generic Communications Channel Command Field */
+#define PCC_CMD_GENERATE_DB_INTR BIT(15)
+/* Generic Communications Channel Status Field */
+#define PCC_STATUS_CMD_COMPLETE BIT(0)
+#define PCC_STATUS_SCI_DOORBELL BIT(1)
+#define PCC_STATUS_ERROR BIT(2)
+#define PCC_STATUS_PLATFORM_NOTIFY BIT(3)
+/* Initiator Responder Communications Channel Flags */
+#define PCC_CMD_COMPLETION_NOTIFY BIT(0)
+
#define MAX_PCC_SUBSPACES 256
+
#ifdef CONFIG_PCC
extern struct pcc_mbox_chan *
pcc_mbox_request_channel(struct mbox_client *cl, int subspace_id);
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 512/568] mailbox: pcc: Check before sending MCTP PCC response ACK
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (510 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 511/568] ACPI: PCC: Add PCC shared memory region command and status bitfields Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 513/568] mailbox: pcc: Refactor error handling in irq handler into separate function Greg Kroah-Hartman
` (62 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adam Young, Sudeep Holla, Jassi Brar,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Young <admiyo@os.amperecomputing.com>
[ Upstream commit 7f9e19f207be0c534d517d65e01417ba968cdd34 ]
Type 4 PCC channels have an option to send back a response
to the platform when they are done processing the request.
The flag to indicate whether or not to respond is inside
the message body, and thus is not available to the pcc
mailbox.
If the flag is not set, still set command completion
bit after processing message.
In order to read the flag, this patch maps the shared
buffer to virtual memory. To avoid duplication of mapping
the shared buffer is then made available to be used by
the driver that uses the mailbox.
Signed-off-by: Adam Young <admiyo@os.amperecomputing.com>
Cc: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Stable-dep-of: ff0e4d4c97c9 ("mailbox: pcc: don't zero error register")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/pcc.c | 61 +++++++++++++++++++++++++++++++++++++------
include/acpi/pcc.h | 7 +++++
2 files changed, 60 insertions(+), 8 deletions(-)
diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
index 94885e411085a..82102a4c5d688 100644
--- a/drivers/mailbox/pcc.c
+++ b/drivers/mailbox/pcc.c
@@ -269,6 +269,35 @@ static bool pcc_mbox_cmd_complete_check(struct pcc_chan_info *pchan)
return !!val;
}
+static void check_and_ack(struct pcc_chan_info *pchan, struct mbox_chan *chan)
+{
+ struct acpi_pcct_ext_pcc_shared_memory pcc_hdr;
+
+ if (pchan->type != ACPI_PCCT_TYPE_EXT_PCC_SLAVE_SUBSPACE)
+ return;
+ /* If the memory region has not been mapped, we cannot
+ * determine if we need to send the message, but we still
+ * need to set the cmd_update flag before returning.
+ */
+ if (pchan->chan.shmem == NULL) {
+ pcc_chan_reg_read_modify_write(&pchan->cmd_update);
+ return;
+ }
+ memcpy_fromio(&pcc_hdr, pchan->chan.shmem,
+ sizeof(struct acpi_pcct_ext_pcc_shared_memory));
+ /*
+ * The PCC slave subspace channel needs to set the command complete bit
+ * after processing message. If the PCC_ACK_FLAG is set, it should also
+ * ring the doorbell.
+ *
+ * The PCC master subspace channel clears chan_in_use to free channel.
+ */
+ if (le32_to_cpup(&pcc_hdr.flags) & PCC_ACK_FLAG_MASK)
+ pcc_send_data(chan, NULL);
+ else
+ pcc_chan_reg_read_modify_write(&pchan->cmd_update);
+}
+
/**
* pcc_mbox_irq - PCC mailbox interrupt handler
* @irq: interrupt number
@@ -306,14 +335,7 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p)
mbox_chan_received_data(chan, NULL);
- /*
- * The PCC slave subspace channel needs to set the command complete bit
- * and ring doorbell after processing message.
- *
- * The PCC master subspace channel clears chan_in_use to free channel.
- */
- if (pchan->type == ACPI_PCCT_TYPE_EXT_PCC_SLAVE_SUBSPACE)
- pcc_send_data(chan, NULL);
+ check_and_ack(pchan, chan);
pchan->chan_in_use = false;
return IRQ_HANDLED;
@@ -365,14 +387,37 @@ EXPORT_SYMBOL_GPL(pcc_mbox_request_channel);
void pcc_mbox_free_channel(struct pcc_mbox_chan *pchan)
{
struct mbox_chan *chan = pchan->mchan;
+ struct pcc_chan_info *pchan_info;
+ struct pcc_mbox_chan *pcc_mbox_chan;
if (!chan || !chan->cl)
return;
+ pchan_info = chan->con_priv;
+ pcc_mbox_chan = &pchan_info->chan;
+ if (pcc_mbox_chan->shmem) {
+ iounmap(pcc_mbox_chan->shmem);
+ pcc_mbox_chan->shmem = NULL;
+ }
mbox_free_channel(chan);
}
EXPORT_SYMBOL_GPL(pcc_mbox_free_channel);
+int pcc_mbox_ioremap(struct mbox_chan *chan)
+{
+ struct pcc_chan_info *pchan_info;
+ struct pcc_mbox_chan *pcc_mbox_chan;
+
+ if (!chan || !chan->cl)
+ return -1;
+ pchan_info = chan->con_priv;
+ pcc_mbox_chan = &pchan_info->chan;
+ pcc_mbox_chan->shmem = ioremap(pcc_mbox_chan->shmem_base_addr,
+ pcc_mbox_chan->shmem_size);
+ return 0;
+}
+EXPORT_SYMBOL_GPL(pcc_mbox_ioremap);
+
/**
* pcc_send_data - Called from Mailbox Controller code. Used
* here only to ring the channel doorbell. The PCC client
diff --git a/include/acpi/pcc.h b/include/acpi/pcc.h
index 9b373d172a776..699c1a37b8e78 100644
--- a/include/acpi/pcc.h
+++ b/include/acpi/pcc.h
@@ -12,6 +12,7 @@
struct pcc_mbox_chan {
struct mbox_chan *mchan;
u64 shmem_base_addr;
+ void __iomem *shmem;
u64 shmem_size;
u32 latency;
u32 max_access_rate;
@@ -31,11 +32,13 @@ struct pcc_mbox_chan {
#define PCC_CMD_COMPLETION_NOTIFY BIT(0)
#define MAX_PCC_SUBSPACES 256
+#define PCC_ACK_FLAG_MASK 0x1
#ifdef CONFIG_PCC
extern struct pcc_mbox_chan *
pcc_mbox_request_channel(struct mbox_client *cl, int subspace_id);
extern void pcc_mbox_free_channel(struct pcc_mbox_chan *chan);
+extern int pcc_mbox_ioremap(struct mbox_chan *chan);
#else
static inline struct pcc_mbox_chan *
pcc_mbox_request_channel(struct mbox_client *cl, int subspace_id)
@@ -43,6 +46,10 @@ pcc_mbox_request_channel(struct mbox_client *cl, int subspace_id)
return ERR_PTR(-ENODEV);
}
static inline void pcc_mbox_free_channel(struct pcc_mbox_chan *chan) { }
+static inline int pcc_mbox_ioremap(struct mbox_chan *chan)
+{
+ return 0;
+};
#endif
#endif /* _PCC_H */
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 513/568] mailbox: pcc: Refactor error handling in irq handler into separate function
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (511 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 512/568] mailbox: pcc: Check before sending MCTP PCC response ACK Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 514/568] mailbox: pcc: dont zero error register Greg Kroah-Hartman
` (61 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Huisong Li, Adam Young, Sudeep Holla,
Jassi Brar, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@arm.com>
[ Upstream commit 3a675f50415b95f2ae10bfd932e2154ba1a08ee7 ]
The existing error handling logic in pcc_mbox_irq() is intermixed with the
main flow of the function. The command complete check and the complete
complete update/acknowledgment are nicely factored into separate functions.
Moves error detection and clearing logic into a separate function called:
pcc_mbox_error_check_and_clear() by extracting error-handling logic from
pcc_mbox_irq().
This ensures error checking and clearing are handled separately and it
improves maintainability by keeping the IRQ handler focused on processing
events.
Acked-by: Huisong Li <lihuisong@huawei.com>
Tested-by: Huisong Li <lihuisong@huawei.com>
Tested-by: Adam Young <admiyo@os.amperecomputing.com>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Stable-dep-of: ff0e4d4c97c9 ("mailbox: pcc: don't zero error register")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/pcc.c | 30 ++++++++++++++++++++----------
1 file changed, 20 insertions(+), 10 deletions(-)
diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
index 82102a4c5d688..94e99b87496d2 100644
--- a/drivers/mailbox/pcc.c
+++ b/drivers/mailbox/pcc.c
@@ -269,6 +269,25 @@ static bool pcc_mbox_cmd_complete_check(struct pcc_chan_info *pchan)
return !!val;
}
+static int pcc_mbox_error_check_and_clear(struct pcc_chan_info *pchan)
+{
+ u64 val;
+ int ret;
+
+ ret = pcc_chan_reg_read(&pchan->error, &val);
+ if (ret)
+ return ret;
+
+ val &= pchan->error.status_mask;
+ if (val) {
+ val &= ~pchan->error.status_mask;
+ pcc_chan_reg_write(&pchan->error, val);
+ return -EIO;
+ }
+
+ return 0;
+}
+
static void check_and_ack(struct pcc_chan_info *pchan, struct mbox_chan *chan)
{
struct acpi_pcct_ext_pcc_shared_memory pcc_hdr;
@@ -309,8 +328,6 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p)
{
struct pcc_chan_info *pchan;
struct mbox_chan *chan = p;
- u64 val;
- int ret;
pchan = chan->con_priv;
if (pchan->type == ACPI_PCCT_TYPE_EXT_PCC_MASTER_SUBSPACE &&
@@ -320,15 +337,8 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p)
if (!pcc_mbox_cmd_complete_check(pchan))
return IRQ_NONE;
- ret = pcc_chan_reg_read(&pchan->error, &val);
- if (ret)
+ if (pcc_mbox_error_check_and_clear(pchan))
return IRQ_NONE;
- val &= pchan->error.status_mask;
- if (val) {
- val &= ~pchan->error.status_mask;
- pcc_chan_reg_write(&pchan->error, val);
- return IRQ_NONE;
- }
if (pcc_chan_reg_read_modify_write(&pchan->plat_irq_ack))
return IRQ_NONE;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 514/568] mailbox: pcc: dont zero error register
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (512 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 513/568] mailbox: pcc: Refactor error handling in irq handler into separate function Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 515/568] spi: bcm63xx: fix premature CS deassertion on RX-only transactions Greg Kroah-Hartman
` (60 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jamie Iles, Punit Agrawal,
Jassi Brar, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamie Iles <jamie.iles@oss.qualcomm.com>
[ Upstream commit ff0e4d4c97c94af34cc9cad37b5a5cdbe597a3b0 ]
The error status mask for a type 3/4 subspace is used for reading the
error status, and the bitwise inverse is used for clearing the error
with the intent being to preserve any of the non-error bits. However,
we were previously applying the mask to extract the status and then
applying the inverse to the result which ended up clearing all bits.
Instead, store the inverse mask in the preserve mask and then use that
on the original value read from the error status so that only the error
is cleared.
Fixes: c45ded7e1135 ("mailbox: pcc: Add support for PCCT extended PCC subspaces(type 3/4)")
Signed-off-by: Jamie Iles <jamie.iles@oss.qualcomm.com>
Signed-off-by: Punit Agrawal <punit.agrawal@oss.qualcomm.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/pcc.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
index 94e99b87496d2..0729988467554 100644
--- a/drivers/mailbox/pcc.c
+++ b/drivers/mailbox/pcc.c
@@ -278,9 +278,8 @@ static int pcc_mbox_error_check_and_clear(struct pcc_chan_info *pchan)
if (ret)
return ret;
- val &= pchan->error.status_mask;
- if (val) {
- val &= ~pchan->error.status_mask;
+ if (val & pchan->error.status_mask) {
+ val &= pchan->error.preserve_mask;
pcc_chan_reg_write(&pchan->error, val);
return -EIO;
}
@@ -662,7 +661,8 @@ static int pcc_parse_subspace_db_reg(struct pcc_chan_info *pchan,
ret = pcc_chan_reg_init(&pchan->error,
&pcct_ext->error_status_register,
- 0, 0, pcct_ext->error_status_mask,
+ ~pcct_ext->error_status_mask, 0,
+ pcct_ext->error_status_mask,
"Error Status");
}
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 515/568] spi: bcm63xx: fix premature CS deassertion on RX-only transactions
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (513 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 514/568] mailbox: pcc: dont zero error register Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 516/568] Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" Greg Kroah-Hartman
` (59 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hang Zhou, Mark Brown, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hang Zhou <929513338@qq.com>
[ Upstream commit fd9862f726aedbc2f29a29916cabed7bcf5cadb6 ]
On BCM6358 (and also observed on BCM6368) the controller appears to
only generate as many SPI clocks as bytes that have been written into
the TX FIFO. For RX-only transfers the driver programs the transfer
length in SPI_MSG_CTL but does not write anything into the FIFO, so
chip select is deasserted early and the RX transfer segment is never
fully clocked in.
A concrete failing case is a three-transfer MAC address read from
SPI-NOR:
- TX 0x03 (read command)
- TX 3-byte address
- RX 6 bytes (MAC)
In contrast, a two-transfer JEDEC-ID read (0x9f + 6-byte RX) works
because the driver uses prepend_len and writes dummy bytes into the
TX FIFO for the RX part.
Fix this by writing 0xff dummy bytes into the TX FIFO for RX-only
segments so that the number of bytes written to the FIFO matches the
total message length seen by the controller.
Fixes: b17de076062a ("spi/bcm63xx: work around inability to keep CS up")
Signed-off-by: Hang Zhou <929513338@qq.com>
Link: https://patch.msgid.link/tencent_7AC88FCB3076489A4A7E6C2163DF1ACF8D06@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-bcm63xx.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c
index 2f2a130464651..e57e1f75cd9f9 100644
--- a/drivers/spi/spi-bcm63xx.c
+++ b/drivers/spi/spi-bcm63xx.c
@@ -257,6 +257,20 @@ static int bcm63xx_txrx_bufs(struct spi_device *spi, struct spi_transfer *first,
if (t->rx_buf) {
do_rx = true;
+
+ /*
+ * In certain hardware implementations, there appears to be a
+ * hidden accumulator that tracks the number of bytes written into
+ * the hardware FIFO, and this accumulator overrides the length in
+ * the SPI_MSG_CTL register.
+ *
+ * Therefore, for read-only transfers, we need to write some dummy
+ * value into the FIFO to keep the accumulator tracking the correct
+ * length.
+ */
+ if (!t->tx_buf)
+ memset_io(bs->tx_io + len, 0xFF, t->len);
+
/* prepend is half-duplex write only */
if (t == first)
prepend_len = 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 588+ messages in thread* [PATCH 6.1 516/568] Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (514 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 515/568] spi: bcm63xx: fix premature CS deassertion on RX-only transactions Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 517/568] iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields Greg Kroah-Hartman
` (58 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Song Liu, Jiri Olsa,
Alexei Starovoitov, Steven Rostedt (Google)
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <jolsa@kernel.org>
commit 6d08340d1e354787d6c65a8c3cdd4d41ffb8a5ed upstream.
This reverts commit 83f44ae0f8afcc9da659799db8693f74847e66b3.
Currently we store initial stacktrace entry twice for non-HW ot_regs, which
means callers that fail perf_hw_regs(regs) condition in perf_callchain_kernel.
It's easy to reproduce this bpftrace:
# bpftrace -e 'tracepoint:sched:sched_process_exec { print(kstack()); }'
Attaching 1 probe...
bprm_execve+1767
bprm_execve+1767
do_execveat_common.isra.0+425
__x64_sys_execve+56
do_syscall_64+133
entry_SYSCALL_64_after_hwframe+118
When perf_callchain_kernel calls unwind_start with first_frame, AFAICS
we do not skip regs->ip, but it's added as part of the unwind process.
Hence reverting the extra perf_callchain_store for non-hw regs leg.
I was not able to bisect this, so I'm not really sure why this was needed
in v5.2 and why it's not working anymore, but I could see double entries
as far as v5.10.
I did the test for both ORC and framepointer unwind with and without the
this fix and except for the initial entry the stacktraces are the same.
Acked-by: Song Liu <song@kernel.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/r/20251104215405.168643-2-jolsa@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/events/core.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2794,13 +2794,13 @@ perf_callchain_kernel(struct perf_callch
return;
}
- if (perf_callchain_store(entry, regs->ip))
- return;
-
- if (perf_hw_regs(regs))
+ if (perf_hw_regs(regs)) {
+ if (perf_callchain_store(entry, regs->ip))
+ return;
unwind_start(&state, current, regs, NULL);
- else
+ } else {
unwind_start(&state, current, NULL, (void *)regs->sp);
+ }
for (; !unwind_done(&state); unwind_next_frame(&state)) {
addr = unwind_get_return_address(&state);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 517/568] iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (515 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 516/568] Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 518/568] iio:common:ssp_sensors: Fix an error handling path ssp_probe() Greg Kroah-Hartman
` (57 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Lavra, Lorenzo Bianconi,
Stable, Jonathan Cameron
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Lavra <flavra@baylibre.com>
commit 3af0c1fb1cdc351b64ff1a4bc06d491490c1f10a upstream.
The `decimator` and `batch` fields of struct st_lsm6dsx_settings
are arrays indexed by sensor type, not by sensor hardware
identifier; moreover, the `batch` field is only used for the
accelerometer and gyroscope.
Change the array size for `decimator` from ST_LSM6DSX_MAX_ID to
ST_LSM6DSX_ID_MAX, and change the array size for `batch` from
ST_LSM6DSX_MAX_ID to 2; move the enum st_lsm6dsx_sensor_id
definition so that the ST_LSM6DSX_ID_MAX value is usable within
the struct st_lsm6dsx_settings definition.
Fixes: 801a6e0af0c6c ("iio: imu: st_lsm6dsx: add support to LSM6DSO")
Signed-off-by: Francesco Lavra <flavra@baylibre.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h
+++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h
@@ -232,6 +232,15 @@ struct st_lsm6dsx_event_settings {
u8 wakeup_src_x_mask;
};
+enum st_lsm6dsx_sensor_id {
+ ST_LSM6DSX_ID_GYRO,
+ ST_LSM6DSX_ID_ACC,
+ ST_LSM6DSX_ID_EXT0,
+ ST_LSM6DSX_ID_EXT1,
+ ST_LSM6DSX_ID_EXT2,
+ ST_LSM6DSX_ID_MAX
+};
+
enum st_lsm6dsx_ext_sensor_id {
ST_LSM6DSX_ID_MAGN,
};
@@ -315,23 +324,14 @@ struct st_lsm6dsx_settings {
struct st_lsm6dsx_reg drdy_mask;
struct st_lsm6dsx_odr_table_entry odr_table[2];
struct st_lsm6dsx_fs_table_entry fs_table[2];
- struct st_lsm6dsx_reg decimator[ST_LSM6DSX_MAX_ID];
- struct st_lsm6dsx_reg batch[ST_LSM6DSX_MAX_ID];
+ struct st_lsm6dsx_reg decimator[ST_LSM6DSX_ID_MAX];
+ struct st_lsm6dsx_reg batch[2];
struct st_lsm6dsx_fifo_ops fifo_ops;
struct st_lsm6dsx_hw_ts_settings ts_settings;
struct st_lsm6dsx_shub_settings shub_settings;
struct st_lsm6dsx_event_settings event_settings;
};
-enum st_lsm6dsx_sensor_id {
- ST_LSM6DSX_ID_GYRO,
- ST_LSM6DSX_ID_ACC,
- ST_LSM6DSX_ID_EXT0,
- ST_LSM6DSX_ID_EXT1,
- ST_LSM6DSX_ID_EXT2,
- ST_LSM6DSX_ID_MAX,
-};
-
enum st_lsm6dsx_fifo_mode {
ST_LSM6DSX_FIFO_BYPASS = 0x0,
ST_LSM6DSX_FIFO_CONT = 0x6,
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 518/568] iio:common:ssp_sensors: Fix an error handling path ssp_probe()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (516 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 517/568] iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 519/568] iio: accel: bmc150: Fix irq assumption regression Greg Kroah-Hartman
` (56 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Nuno Sá,
Stable, Jonathan Cameron
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
commit 21553258b94861a73d7f2cf15469d69240e1170d upstream.
If an error occurs after a successful mfd_add_devices() call, it should be
undone by a corresponding mfd_remove_devices() call, as already done in the
remove function.
Fixes: 50dd64d57eee ("iio: common: ssp_sensors: Add sensorhub driver")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/common/ssp_sensors/ssp_dev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/iio/common/ssp_sensors/ssp_dev.c
+++ b/drivers/iio/common/ssp_sensors/ssp_dev.c
@@ -503,7 +503,7 @@ static int ssp_probe(struct spi_device *
ret = spi_setup(spi);
if (ret < 0) {
dev_err(&spi->dev, "Failed to setup spi\n");
- return ret;
+ goto err_setup_spi;
}
data->fw_dl_state = SSP_FW_DL_STATE_NONE;
@@ -568,6 +568,8 @@ err_read_reg:
err_setup_irq:
mutex_destroy(&data->pending_lock);
mutex_destroy(&data->comm_lock);
+err_setup_spi:
+ mfd_remove_devices(&spi->dev);
dev_err(&spi->dev, "Probe failed!\n");
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 519/568] iio: accel: bmc150: Fix irq assumption regression
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (517 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 518/568] iio:common:ssp_sensors: Fix an error handling path ssp_probe() Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 520/568] iio: accel: fix ADXL355 startup race condition Greg Kroah-Hartman
` (55 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linus Walleij, Andy Shevchenko,
Nuno Sá, Jonathan Cameron
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <linus.walleij@linaro.org>
commit 3aa385a9c75c09b59dcab2ff76423439d23673ab upstream.
The code in bmc150-accel-core.c unconditionally calls
bmc150_accel_set_interrupt() in the iio_buffer_setup_ops,
such as on the runtime PM resume path giving a kernel
splat like this if the device has no interrupts:
Unable to handle kernel NULL pointer dereference at virtual
address 00000001 when read
PC is at bmc150_accel_set_interrupt+0x98/0x194
LR is at __pm_runtime_resume+0x5c/0x64
(...)
Call trace:
bmc150_accel_set_interrupt from bmc150_accel_buffer_postenable+0x40/0x108
bmc150_accel_buffer_postenable from __iio_update_buffers+0xbe0/0xcbc
__iio_update_buffers from enable_store+0x84/0xc8
enable_store from kernfs_fop_write_iter+0x154/0x1b4
This bug seems to have been in the driver since the beginning,
but it only manifests recently, I do not know why.
Store the IRQ number in the state struct, as this is a common
pattern in other drivers, then use this to determine if we have
IRQ support or not.
Cc: stable@vger.kernel.org
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/accel/bmc150-accel-core.c | 5 +++++
drivers/iio/accel/bmc150-accel.h | 1 +
2 files changed, 6 insertions(+)
--- a/drivers/iio/accel/bmc150-accel-core.c
+++ b/drivers/iio/accel/bmc150-accel-core.c
@@ -569,6 +569,10 @@ static int bmc150_accel_set_interrupt(st
const struct bmc150_accel_interrupt_info *info = intr->info;
int ret;
+ /* We do not always have an IRQ */
+ if (data->irq <= 0)
+ return 0;
+
if (state) {
if (atomic_inc_return(&intr->users) > 1)
return 0;
@@ -1756,6 +1760,7 @@ int bmc150_accel_core_probe(struct devic
}
if (irq > 0) {
+ data->irq = irq;
ret = devm_request_threaded_irq(dev, irq,
bmc150_accel_irq_handler,
bmc150_accel_irq_thread_handler,
--- a/drivers/iio/accel/bmc150-accel.h
+++ b/drivers/iio/accel/bmc150-accel.h
@@ -57,6 +57,7 @@ enum bmc150_accel_trigger_id {
struct bmc150_accel_data {
struct regmap *regmap;
+ int irq;
struct regulator_bulk_data regulators[2];
struct bmc150_accel_interrupt interrupts[BMC150_ACCEL_INTERRUPTS];
struct bmc150_accel_trigger triggers[BMC150_ACCEL_TRIGGERS];
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 520/568] iio: accel: fix ADXL355 startup race condition
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (518 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 519/568] iio: accel: bmc150: Fix irq assumption regression Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 521/568] iio: adc: ad7280a: fix ad7280_store_balance_timer() Greg Kroah-Hartman
` (54 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Valek Andrej, Kessler Markus, Stable,
Jonathan Cameron
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Valek Andrej <andrej.v@skyrain.eu>
commit c92c1bc408e9e11ae3c7011b062fdd74c09283a3 upstream.
There is an race-condition where device is not full working after SW reset.
Therefore it's necessary to wait some time after reset and verify shadow
registers values by reading and comparing the values before/after reset.
This mechanism is described in datasheet at least from revision D.
Fixes: 12ed27863ea3 ("iio: accel: Add driver support for ADXL355")
Signed-off-by: Valek Andrej <andrej.v@skyrain.eu>
Signed-off-by: Kessler Markus <markus.kessler@hilti.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/accel/adxl355_core.c | 44 ++++++++++++++++++++++++++++++++++-----
1 file changed, 39 insertions(+), 5 deletions(-)
--- a/drivers/iio/accel/adxl355_core.c
+++ b/drivers/iio/accel/adxl355_core.c
@@ -56,6 +56,8 @@
#define ADXL355_POWER_CTL_DRDY_MSK BIT(2)
#define ADXL355_SELF_TEST_REG 0x2E
#define ADXL355_RESET_REG 0x2F
+#define ADXL355_BASE_ADDR_SHADOW_REG 0x50
+#define ADXL355_SHADOW_REG_COUNT 5
#define ADXL355_DEVID_AD_VAL 0xAD
#define ADXL355_DEVID_MST_VAL 0x1D
@@ -238,7 +240,12 @@ static void adxl355_fill_3db_frequency_t
static int adxl355_setup(struct adxl355_data *data)
{
unsigned int regval;
+ int retries = 5; /* the number is chosen based on empirical reasons */
int ret;
+ u8 *shadow_regs __free(kfree) = kzalloc(ADXL355_SHADOW_REG_COUNT, GFP_KERNEL);
+
+ if (!shadow_regs)
+ return -ENOMEM;
ret = regmap_read(data->regmap, ADXL355_DEVID_AD_REG, ®val);
if (ret)
@@ -267,14 +274,41 @@ static int adxl355_setup(struct adxl355_
return -ENODEV;
}
- /*
- * Perform a software reset to make sure the device is in a consistent
- * state after start-up.
- */
- ret = regmap_write(data->regmap, ADXL355_RESET_REG, ADXL355_RESET_CODE);
+ /* Read shadow registers to be compared after reset */
+ ret = regmap_bulk_read(data->regmap,
+ ADXL355_BASE_ADDR_SHADOW_REG,
+ shadow_regs, ADXL355_SHADOW_REG_COUNT);
if (ret)
return ret;
+ do {
+ if (--retries == 0) {
+ dev_err(data->dev, "Shadow registers mismatch\n");
+ return -EIO;
+ }
+
+ /*
+ * Perform a software reset to make sure the device is in a consistent
+ * state after start-up.
+ */
+ ret = regmap_write(data->regmap, ADXL355_RESET_REG,
+ ADXL355_RESET_CODE);
+ if (ret)
+ return ret;
+
+ /* Wait at least 5ms after software reset */
+ usleep_range(5000, 10000);
+
+ /* Read shadow registers for comparison */
+ ret = regmap_bulk_read(data->regmap,
+ ADXL355_BASE_ADDR_SHADOW_REG,
+ data->buffer.buf,
+ ADXL355_SHADOW_REG_COUNT);
+ if (ret)
+ return ret;
+ } while (memcmp(shadow_regs, data->buffer.buf,
+ ADXL355_SHADOW_REG_COUNT));
+
ret = regmap_update_bits(data->regmap, ADXL355_POWER_CTL_REG,
ADXL355_POWER_CTL_DRDY_MSK,
FIELD_PREP(ADXL355_POWER_CTL_DRDY_MSK, 1));
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 521/568] iio: adc: ad7280a: fix ad7280_store_balance_timer()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (519 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 520/568] iio: accel: fix ADXL355 startup race condition Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 522/568] MIPS: mm: Prevent a TLB shutdown on initial uniquification Greg Kroah-Hartman
` (53 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Lechner, Nuno Sá, Stable,
Jonathan Cameron
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <dlechner@baylibre.com>
commit bd886cdcbf9e746f61c74035a3acd42e9108e115 upstream.
Use correct argument to iio_str_to_fixpoint() to parse 3 decimal places.
iio_str_to_fixpoint() has a bit of an unintuitive API where the
fract_mult parameter is the multiplier of the first decimal place as if
it was already an integer. So to get 3 decimal places, fract_mult must
be 100 rather than 1000.
Fixes: 96ccdbc07a74 ("staging:iio:adc:ad7280a: Standardize extended ABI naming")
Signed-off-by: David Lechner <dlechner@baylibre.com>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/ad7280a.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/adc/ad7280a.c
+++ b/drivers/iio/adc/ad7280a.c
@@ -540,7 +540,7 @@ static ssize_t ad7280_store_balance_time
int val, val2;
int ret;
- ret = iio_str_to_fixpoint(buf, 1000, &val, &val2);
+ ret = iio_str_to_fixpoint(buf, 100, &val, &val2);
if (ret)
return ret;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 522/568] MIPS: mm: Prevent a TLB shutdown on initial uniquification
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (520 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 521/568] iio: adc: ad7280a: fix ad7280_store_balance_timer() Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 523/568] MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow Greg Kroah-Hartman
` (52 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej W. Rozycki, Jiaxun Yang,
Thomas Bogendoerfer
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <macro@orcam.me.uk>
commit 9f048fa487409e364cf866c957cf0b0d782ca5a3 upstream.
Depending on the particular CPU implementation a TLB shutdown may occur
if multiple matching entries are detected upon the execution of a TLBP
or the TLBWI/TLBWR instructions. Given that we don't know what entries
we have been handed we need to be very careful with the initial TLB
setup and avoid all these instructions.
Therefore read all the TLB entries one by one with the TLBR instruction,
bypassing the content addressing logic, and truncate any large pages in
place so as to avoid a case in the second step where an incoming entry
for a large page at a lower address overlaps with a replacement entry
chosen at another index. Then preinitialize the TLB using addresses
outside our usual unique range and avoiding clashes with any entries
received, before making the usual call to local_flush_tlb_all().
This fixes (at least) R4x00 cores if TLBP hits multiple matching TLB
entries (SGI IP22 PROM for examples sets up all TLBs to the same virtual
address).
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 35ad7e181541 ("MIPS: mm: tlb-r4k: Uniquify TLB entries on init")
Cc: stable@vger.kernel.org
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com> # Boston I6400, M5150 sim
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/mm/tlb-r4k.c | 102 ++++++++++++++++++++++++++++++-------------------
1 file changed, 64 insertions(+), 38 deletions(-)
--- a/arch/mips/mm/tlb-r4k.c
+++ b/arch/mips/mm/tlb-r4k.c
@@ -15,6 +15,7 @@
#include <linux/mm.h>
#include <linux/hugetlb.h>
#include <linux/export.h>
+#include <linux/sort.h>
#include <asm/cpu.h>
#include <asm/cpu-type.h>
@@ -498,55 +499,79 @@ static int __init set_ntlb(char *str)
__setup("ntlb=", set_ntlb);
-/* Initialise all TLB entries with unique values */
+
+/* Comparison function for EntryHi VPN fields. */
+static int r4k_vpn_cmp(const void *a, const void *b)
+{
+ long v = *(unsigned long *)a - *(unsigned long *)b;
+ int s = sizeof(long) > sizeof(int) ? sizeof(long) * 8 - 1: 0;
+ return s ? (v != 0) | v >> s : v;
+}
+
+/*
+ * Initialise all TLB entries with unique values that do not clash with
+ * what we have been handed over and what we'll be using ourselves.
+ */
static void r4k_tlb_uniquify(void)
{
- int entry = num_wired_entries();
+ unsigned long tlb_vpns[1 << MIPS_CONF1_TLBS_SIZE];
+ int tlbsize = current_cpu_data.tlbsize;
+ int start = num_wired_entries();
+ unsigned long vpn_mask;
+ int cnt, ent, idx, i;
+
+ vpn_mask = GENMASK(cpu_vmbits - 1, 13);
+ vpn_mask |= IS_ENABLED(CONFIG_64BIT) ? 3ULL << 62 : 1 << 31;
htw_stop();
- write_c0_entrylo0(0);
- write_c0_entrylo1(0);
- while (entry < current_cpu_data.tlbsize) {
- unsigned long asid_mask = cpu_asid_mask(¤t_cpu_data);
- unsigned long asid = 0;
- int idx;
+ for (i = start, cnt = 0; i < tlbsize; i++, cnt++) {
+ unsigned long vpn;
- /* Skip wired MMID to make ginvt_mmid work */
- if (cpu_has_mmid)
- asid = MMID_KERNEL_WIRED + 1;
+ write_c0_index(i);
+ mtc0_tlbr_hazard();
+ tlb_read();
+ tlb_read_hazard();
+ vpn = read_c0_entryhi();
+ vpn &= vpn_mask & PAGE_MASK;
+ tlb_vpns[cnt] = vpn;
- /* Check for match before using UNIQUE_ENTRYHI */
- do {
- if (cpu_has_mmid) {
- write_c0_memorymapid(asid);
- write_c0_entryhi(UNIQUE_ENTRYHI(entry));
- } else {
- write_c0_entryhi(UNIQUE_ENTRYHI(entry) | asid);
- }
- mtc0_tlbw_hazard();
- tlb_probe();
- tlb_probe_hazard();
- idx = read_c0_index();
- /* No match or match is on current entry */
- if (idx < 0 || idx == entry)
- break;
- /*
- * If we hit a match, we need to try again with
- * a different ASID.
- */
- asid++;
- } while (asid < asid_mask);
-
- if (idx >= 0 && idx != entry)
- panic("Unable to uniquify TLB entry %d", idx);
-
- write_c0_index(entry);
+ /* Prevent any large pages from overlapping regular ones. */
+ write_c0_pagemask(read_c0_pagemask() & PM_DEFAULT_MASK);
mtc0_tlbw_hazard();
tlb_write_indexed();
- entry++;
+ tlbw_use_hazard();
}
+ sort(tlb_vpns, cnt, sizeof(tlb_vpns[0]), r4k_vpn_cmp, NULL);
+
+ write_c0_pagemask(PM_DEFAULT_MASK);
+ write_c0_entrylo0(0);
+ write_c0_entrylo1(0);
+
+ idx = 0;
+ ent = tlbsize;
+ for (i = start; i < tlbsize; i++)
+ while (1) {
+ unsigned long entryhi, vpn;
+
+ entryhi = UNIQUE_ENTRYHI(ent);
+ vpn = entryhi & vpn_mask & PAGE_MASK;
+
+ if (idx >= cnt || vpn < tlb_vpns[idx]) {
+ write_c0_entryhi(entryhi);
+ write_c0_index(i);
+ mtc0_tlbw_hazard();
+ tlb_write_indexed();
+ ent++;
+ break;
+ } else if (vpn == tlb_vpns[idx]) {
+ ent++;
+ } else {
+ idx++;
+ }
+ }
+
tlbw_use_hazard();
htw_start();
flush_micro_tlb();
@@ -592,6 +617,7 @@ static void r4k_tlb_configure(void)
/* From this point on the ARC firmware is dead. */
r4k_tlb_uniquify();
+ local_flush_tlb_all();
/* Did I tell you that ARC SUCKS? */
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 523/568] MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (521 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 522/568] MIPS: mm: Prevent a TLB shutdown on initial uniquification Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 524/568] ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 Greg Kroah-Hartman
` (51 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej W. Rozycki, Gregory CLEMENT,
Klara Modin, Thomas Bogendoerfer
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
commit 841ecc979b18d3227fad5e2d6a1e6f92688776b5 upstream.
Owing to Config4.MMUSizeExt and VTLB/FTLB MMU features later MIPSr2+
cores can have more than 64 TLB entries. Therefore allocate an array
for uniquification instead of placing too an small array on the stack.
Fixes: 35ad7e181541 ("MIPS: mm: tlb-r4k: Uniquify TLB entries on init")
Co-developed-by: Maciej W. Rozycki <macro@orcam.me.uk>
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Cc: stable@vger.kernel.org # v6.17+: 9f048fa48740: MIPS: mm: Prevent a TLB shutdown on initial uniquification
Cc: stable@vger.kernel.org # v6.17+
Tested-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Tested-by: Klara Modin <klarasmodin@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/mm/tlb-r4k.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
--- a/arch/mips/mm/tlb-r4k.c
+++ b/arch/mips/mm/tlb-r4k.c
@@ -12,6 +12,7 @@
#include <linux/init.h>
#include <linux/sched.h>
#include <linux/smp.h>
+#include <linux/memblock.h>
#include <linux/mm.h>
#include <linux/hugetlb.h>
#include <linux/export.h>
@@ -512,17 +513,26 @@ static int r4k_vpn_cmp(const void *a, co
* Initialise all TLB entries with unique values that do not clash with
* what we have been handed over and what we'll be using ourselves.
*/
-static void r4k_tlb_uniquify(void)
+static void __ref r4k_tlb_uniquify(void)
{
- unsigned long tlb_vpns[1 << MIPS_CONF1_TLBS_SIZE];
int tlbsize = current_cpu_data.tlbsize;
+ bool use_slab = slab_is_available();
int start = num_wired_entries();
+ phys_addr_t tlb_vpn_size;
+ unsigned long *tlb_vpns;
unsigned long vpn_mask;
int cnt, ent, idx, i;
vpn_mask = GENMASK(cpu_vmbits - 1, 13);
vpn_mask |= IS_ENABLED(CONFIG_64BIT) ? 3ULL << 62 : 1 << 31;
+ tlb_vpn_size = tlbsize * sizeof(*tlb_vpns);
+ tlb_vpns = (use_slab ?
+ kmalloc(tlb_vpn_size, GFP_KERNEL) :
+ memblock_alloc_raw(tlb_vpn_size, sizeof(*tlb_vpns)));
+ if (WARN_ON(!tlb_vpns))
+ return; /* Pray local_flush_tlb_all() is good enough. */
+
htw_stop();
for (i = start, cnt = 0; i < tlbsize; i++, cnt++) {
@@ -575,6 +585,10 @@ static void r4k_tlb_uniquify(void)
tlbw_use_hazard();
htw_start();
flush_micro_tlb();
+ if (use_slab)
+ kfree(tlb_vpns);
+ else
+ memblock_free(tlb_vpns, tlb_vpn_size);
}
/*
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 524/568] ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (522 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 523/568] MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 525/568] atm/fore200e: Fix possible data race in fore200e_open() Greg Kroah-Hartman
` (50 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ivan Zhaldak, Takashi Iwai
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Zhaldak <i.v.zhaldak@gmail.com>
commit c83fc13960643c4429cd9dfef1321e6430a81b47 upstream.
Integrated amplifier LEAK Stereo 230 by IAG Limited has built-in
ESS9038Q2M DAC served by XMOS controller. It supports both DSD Native
and DSD-over-PCM (DoP) operational modes. But it doesn't work properly
by default and tries DSD-to-PCM conversion. USB quirks below allow it
to operate as designed.
Add DSD_RAW quirk flag for IAG Limited devices (vendor ID 0x2622)
Add DSD format quirk for LEAK Stereo 230 (USB ID 0x2622:0x0061)
Signed-off-by: Ivan Zhaldak <i.v.zhaldak@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20251117125848.30769-1-i.v.zhaldak@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/quirks.c | 3 +++
1 file changed, 3 insertions(+)
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1926,6 +1926,7 @@ u64 snd_usb_interface_dsd_format_quirks(
case USB_ID(0x249c, 0x9326): /* M2Tech Young MkIII */
case USB_ID(0x2616, 0x0106): /* PS Audio NuWave DAC */
case USB_ID(0x2622, 0x0041): /* Audiolab M-DAC+ */
+ case USB_ID(0x2622, 0x0061): /* LEAK Stereo 230 */
case USB_ID(0x278b, 0x5100): /* Rotel RC-1590 */
case USB_ID(0x27f7, 0x3002): /* W4S DAC-2v2SE */
case USB_ID(0x29a2, 0x0086): /* Mutec MC3+ USB */
@@ -2309,6 +2310,8 @@ static const struct usb_audio_quirk_flag
QUIRK_FLAG_DSD_RAW),
VENDOR_FLG(0x25ce, /* Mytek devices */
QUIRK_FLAG_DSD_RAW),
+ VENDOR_FLG(0x2622, /* IAG Limited devices */
+ QUIRK_FLAG_DSD_RAW),
VENDOR_FLG(0x278b, /* Rotel? */
QUIRK_FLAG_DSD_RAW),
VENDOR_FLG(0x292b, /* Gustard/Ess based devices */
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 525/568] atm/fore200e: Fix possible data race in fore200e_open()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (523 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 524/568] ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 526/568] can: sja1000: fix max irq loop handling Greg Kroah-Hartman
` (49 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gui-Dong Han, Simon Horman,
Paolo Abeni
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <hanguidong02@gmail.com>
commit 82fca3d8a4a34667f01ec2351a607135249c9cff upstream.
Protect access to fore200e->available_cell_rate with rate_mtx lock in the
error handling path of fore200e_open() to prevent a data race.
The field fore200e->available_cell_rate is a shared resource used to track
available bandwidth. It is concurrently accessed by fore200e_open(),
fore200e_close(), and fore200e_change_qos().
In fore200e_open(), the lock rate_mtx is correctly held when subtracting
vcc->qos.txtp.max_pcr from available_cell_rate to reserve bandwidth.
However, if the subsequent call to fore200e_activate_vcin() fails, the
function restores the reserved bandwidth by adding back to
available_cell_rate without holding the lock.
This introduces a race condition because available_cell_rate is a global
device resource shared across all VCCs. If the error path in
fore200e_open() executes concurrently with operations like
fore200e_close() or fore200e_change_qos() on other VCCs, a
read-modify-write race occurs.
Specifically, the error path reads the rate without the lock. If another
CPU acquires the lock and modifies the rate (e.g., releasing bandwidth in
fore200e_close()) between this read and the subsequent write, the error
path will overwrite the concurrent update with a stale value. This results
in incorrect bandwidth accounting.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251120120657.2462194-1-hanguidong02@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/atm/fore200e.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/atm/fore200e.c
+++ b/drivers/atm/fore200e.c
@@ -1377,7 +1377,9 @@ fore200e_open(struct atm_vcc *vcc)
vcc->dev_data = NULL;
+ mutex_lock(&fore200e->rate_mtx);
fore200e->available_cell_rate += vcc->qos.txtp.max_pcr;
+ mutex_unlock(&fore200e->rate_mtx);
kfree(fore200e_vcc);
return -EINVAL;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 526/568] can: sja1000: fix max irq loop handling
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (524 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 525/568] atm/fore200e: Fix possible data race in fore200e_open() Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 527/568] can: sun4i_can: sun4i_can_interrupt(): " Greg Kroah-Hartman
` (48 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Mühlbacher,
Oliver Hartkopp, Marc Kleine-Budde
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Mühlbacher <tmuehlbacher@posteo.net>
commit 30db4451c7f6aabcada029b15859a76962ec0cf8 upstream.
Reading the interrupt register `SJA1000_IR` causes all of its bits to be
reset. If we ever reach the condition of handling more than
`SJA1000_MAX_IRQ` IRQs, we will have read the register and reset all its
bits but without actually handling the interrupt inside of the loop
body.
This may, among other issues, cause us to never `netif_wake_queue()`
again after a transmission interrupt.
Fixes: 429da1cc841b ("can: Driver for the SJA1000 CAN controller")
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Mühlbacher <tmuehlbacher@posteo.net>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20251115153437.11419-1-tmuehlbacher@posteo.net
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/sja1000/sja1000.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -521,8 +521,8 @@ irqreturn_t sja1000_interrupt(int irq, v
if (priv->read_reg(priv, SJA1000_IER) == IRQ_OFF)
goto out;
- while ((isrc = priv->read_reg(priv, SJA1000_IR)) &&
- (n < SJA1000_MAX_IRQ)) {
+ while ((n < SJA1000_MAX_IRQ) &&
+ (isrc = priv->read_reg(priv, SJA1000_IR))) {
status = priv->read_reg(priv, SJA1000_SR);
/* check for absent controller due to hw unplug */
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 527/568] can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (525 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 526/568] can: sja1000: fix max irq loop handling Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 528/568] dm-verity: fix unreliable memory allocation Greg Kroah-Hartman
` (47 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Mühlbacher,
Jernej Skrabec, Marc Kleine-Budde
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <mkl@pengutronix.de>
commit 76544beea7cfe5bcce6d60f53811657b88ec8be1 upstream.
Reading the interrupt register `SUN4I_REG_INT_ADDR` causes all of its bits
to be reset. If we ever reach the condition of handling more than
`SUN4I_CAN_MAX_IRQ` IRQs, we will have read the register and reset all its
bits but without actually handling the interrupt inside of the loop body.
This may, among other issues, cause us to never `netif_wake_queue()` again
after a transmission interrupt.
Fixes: 0738eff14d81 ("can: Allwinner A10/A20 CAN Controller support - Kernel module")
Cc: stable@vger.kernel.org
Co-developed-by: Thomas Mühlbacher <tmuehlbacher@posteo.net>
Signed-off-by: Thomas Mühlbacher <tmuehlbacher@posteo.net>
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Link: https://patch.msgid.link/20251116-sun4i-fix-loop-v1-1-3d76d3f81950@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/sun4i_can.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/can/sun4i_can.c
+++ b/drivers/net/can/sun4i_can.c
@@ -658,8 +658,8 @@ static irqreturn_t sun4i_can_interrupt(i
u8 isrc, status;
int n = 0;
- while ((isrc = readl(priv->base + SUN4I_REG_INT_ADDR)) &&
- (n < SUN4I_CAN_MAX_IRQ)) {
+ while ((n < SUN4I_CAN_MAX_IRQ) &&
+ (isrc = readl(priv->base + SUN4I_REG_INT_ADDR))) {
n++;
status = readl(priv->base + SUN4I_REG_STA_ADDR);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 528/568] dm-verity: fix unreliable memory allocation
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (526 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 527/568] can: sun4i_can: sun4i_can_interrupt(): " Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 529/568] drivers/usb/dwc3: fix PCI parent check Greg Kroah-Hartman
` (46 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Eric Biggers
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit fe680d8c747f4e676ac835c8c7fb0f287cd98758 upstream.
GFP_NOWAIT allocation may fail anytime. It needs to be changed to
GFP_NOIO. There's no need to handle an error because mempool_alloc with
GFP_NOIO can't fail.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Reviewed-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-verity-fec.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
--- a/drivers/md/dm-verity-fec.c
+++ b/drivers/md/dm-verity-fec.c
@@ -330,11 +330,7 @@ static int fec_alloc_bufs(struct dm_veri
if (fio->bufs[n])
continue;
- fio->bufs[n] = mempool_alloc(&v->fec->prealloc_pool, GFP_NOWAIT);
- if (unlikely(!fio->bufs[n])) {
- DMERR("failed to allocate FEC buffer");
- return -ENOMEM;
- }
+ fio->bufs[n] = mempool_alloc(&v->fec->prealloc_pool, GFP_NOIO);
}
/* try to allocate the maximum number of buffers */
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 529/568] drivers/usb/dwc3: fix PCI parent check
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (527 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 528/568] dm-verity: fix unreliable memory allocation Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 530/568] smb: client: fix memory leak in cifs_construct_tcon() Greg Kroah-Hartman
` (45 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Jamie Iles, Punit Agrawal,
Thinh Nguyen
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamie Iles <jamie.iles@oss.qualcomm.com>
commit 40f8d17eed7533ed2bbb5e3cc680049b19411b2e upstream.
The sysdev_is_parent check was being used to infer PCI devices that have
the DMA mask set from the PCI capabilities, but sysdev_is_parent is also
used for non-PCI ACPI devices in which case the DMA mask would be the
bus default or as set by the _DMA method.
Without this fix the DMA mask would default to 32-bits and so allocation
would fail if there was no DRAM below 4GB.
Fixes: 47ce45906ca9 ("usb: dwc3: leave default DMA for PCI devices")
Cc: stable <stable@kernel.org>
Signed-off-by: Jamie Iles <jamie.iles@oss.qualcomm.com>
Signed-off-by: Punit Agrawal <punit.agrawal@oss.qualcomm.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://patch.msgid.link/20251107104437.1602509-1-punit.agrawal@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -25,6 +25,7 @@
#include <linux/of.h>
#include <linux/of_graph.h>
#include <linux/acpi.h>
+#include <linux/pci.h>
#include <linux/pinctrl/consumer.h>
#include <linux/reset.h>
#include <linux/bitfield.h>
@@ -1996,7 +1997,7 @@ static int dwc3_probe(struct platform_de
platform_set_drvdata(pdev, dwc);
dwc3_cache_hwparams(dwc);
- if (!dwc->sysdev_is_parent &&
+ if (!dev_is_pci(dwc->sysdev) &&
DWC3_GHWPARAMS0_AWIDTH(dwc->hwparams.hwparams0) == 64) {
ret = dma_set_mask_and_coherent(dwc->sysdev, DMA_BIT_MASK(64));
if (ret)
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 530/568] smb: client: fix memory leak in cifs_construct_tcon()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (528 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 529/568] drivers/usb/dwc3: fix PCI parent check Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 531/568] thunderbolt: Add support for Intel Wildcat Lake Greg Kroah-Hartman
` (44 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paulo Alcantara (Red Hat),
David Howells, Jay Shin, linux-cifs, Steve French
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <pc@manguebit.org>
commit 3184b6a5a24ec9ee74087b2a550476f386df7dc2 upstream.
When having a multiuser mount with domain= specified and using
cifscreds, cifs_set_cifscreds() will end up setting @ctx->domainname,
so it needs to be freed before leaving cifs_construct_tcon().
This fixes the following memory leak reported by kmemleak:
mount.cifs //srv/share /mnt -o domain=ZELDA,multiuser,...
su - testuser
cifscreds add -d ZELDA -u testuser
...
ls /mnt/1
...
umount /mnt
echo scan > /sys/kernel/debug/kmemleak
cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff8881203c3f08 (size 8):
comm "ls", pid 5060, jiffies 4307222943
hex dump (first 8 bytes):
5a 45 4c 44 41 00 cc cc ZELDA...
backtrace (crc d109a8cf):
__kmalloc_node_track_caller_noprof+0x572/0x710
kstrdup+0x3a/0x70
cifs_sb_tlink+0x1209/0x1770 [cifs]
cifs_get_fattr+0xe1/0xf50 [cifs]
cifs_get_inode_info+0xb5/0x240 [cifs]
cifs_revalidate_dentry_attr+0x2d1/0x470 [cifs]
cifs_getattr+0x28e/0x450 [cifs]
vfs_getattr_nosec+0x126/0x180
vfs_statx+0xf6/0x220
do_statx+0xab/0x110
__x64_sys_statx+0xd5/0x130
do_syscall_64+0xbb/0x380
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Fixes: f2aee329a68f ("cifs: set domainName when a domain-key is used in multiuser")
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Reviewed-by: David Howells <dhowells@redhat.com>
Cc: Jay Shin <jaeshin@redhat.com>
Cc: stable@vger.kernel.org
Cc: linux-cifs@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/connect.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/smb/client/connect.c
+++ b/fs/smb/client/connect.c
@@ -4417,6 +4417,7 @@ cifs_construct_tcon(struct cifs_sb_info
out:
kfree(ctx->username);
+ kfree(ctx->domainname);
kfree_sensitive(ctx->password);
kfree(ctx);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 531/568] thunderbolt: Add support for Intel Wildcat Lake
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (529 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 530/568] smb: client: fix memory leak in cifs_construct_tcon() Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 532/568] slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves Greg Kroah-Hartman
` (43 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alan Borzeszkowski, Mika Westerberg
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
commit 3575254546a27210a4b661ea37fbbfb836c0815d upstream.
Intel Wildcat Lake derives its Thunderbolt/USB4 controller from Lunar
Lake platform. Add Wildcat Lake PCI ID to the driver list of supported
devices.
Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thunderbolt/nhi.c | 2 ++
drivers/thunderbolt/nhi.h | 1 +
2 files changed, 3 insertions(+)
--- a/drivers/thunderbolt/nhi.c
+++ b/drivers/thunderbolt/nhi.c
@@ -1491,6 +1491,8 @@ static struct pci_device_id nhi_ids[] =
.driver_data = (kernel_ulong_t)&icl_nhi_ops },
{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_P_NHI1),
.driver_data = (kernel_ulong_t)&icl_nhi_ops },
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_WCL_NHI0),
+ .driver_data = (kernel_ulong_t)&icl_nhi_ops },
{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI) },
{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI) },
--- a/drivers/thunderbolt/nhi.h
+++ b/drivers/thunderbolt/nhi.h
@@ -75,6 +75,7 @@ extern const struct tb_nhi_ops icl_nhi_o
#define PCI_DEVICE_ID_INTEL_TITAN_RIDGE_DD_BRIDGE 0x15ef
#define PCI_DEVICE_ID_INTEL_ADL_NHI0 0x463e
#define PCI_DEVICE_ID_INTEL_ADL_NHI1 0x466d
+#define PCI_DEVICE_ID_INTEL_WCL_NHI0 0x4d33
#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI 0x5781
#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI 0x5784
#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_80G_BRIDGE 0x5786
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 532/568] slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (530 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 531/568] thunderbolt: Add support for Intel Wildcat Lake Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 533/568] firmware: stratix10-svc: fix bug in saving controller data Greg Kroah-Hartman
` (42 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Miaoqian Lin,
Dmitry Baryshkov
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <linmq006@gmail.com>
commit 96cf8500934e0ce2a6c486f1dbc3b1fff12f7a5e upstream.
The function qcom_slim_ngd_notify_slaves() calls of_slim_get_device() which
internally uses device_find_child() to obtain a device reference.
According to the device_find_child() documentation,
the caller must drop the reference with put_device() after use.
Found via static analysis and this is similar to commit 4e65bda8273c
("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()")
Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://patch.msgid.link/20251027060601.33228-1-linmq006@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/slimbus/qcom-ngd-ctrl.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/slimbus/qcom-ngd-ctrl.c
+++ b/drivers/slimbus/qcom-ngd-ctrl.c
@@ -1164,6 +1164,7 @@ static void qcom_slim_ngd_notify_slaves(
if (slim_get_logical_addr(sbdev))
dev_err(ctrl->dev, "Failed to get logical address\n");
+ put_device(&sbdev->dev);
}
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 533/568] firmware: stratix10-svc: fix bug in saving controller data
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (531 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 532/568] slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 534/568] serial: amba-pl011: prefer dma_mapping_error() over explicit address checking Greg Kroah-Hartman
` (41 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ang Tien Sung, Khairul Anuar Romli,
Dinh Nguyen
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Khairul Anuar Romli <khairul.anuar.romli@altera.com>
commit d0fcf70c680e4d1669fcb3a8632f41400b9a73c2 upstream.
Fix the incorrect usage of platform_set_drvdata and dev_set_drvdata. They
both are of the same data and overrides each other. This resulted in the
rmmod of the svc driver to fail and throw a kernel panic for kthread_stop
and fifo free.
Fixes: b5dc75c915cd ("firmware: stratix10-svc: extend svc to support new RSU features")
Cc: stable@vger.kernel.org # 6.6+
Signed-off-by: Ang Tien Sung <tiensung.ang@altera.com>
Signed-off-by: Khairul Anuar Romli <khairul.anuar.romli@altera.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/stratix10-svc.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/firmware/stratix10-svc.c
+++ b/drivers/firmware/stratix10-svc.c
@@ -133,6 +133,7 @@ struct stratix10_svc_data {
* @complete_status: state for completion
* @svc_fifo_lock: protect access to service message data queue
* @invoke_fn: function to issue secure monitor call or hypervisor call
+ * @svc: manages the list of client svc drivers
*
* This struct is used to create communication channels for service clients, to
* handle secure monitor or hypervisor call.
@@ -149,6 +150,7 @@ struct stratix10_svc_controller {
struct completion complete_status;
spinlock_t svc_fifo_lock;
svc_invoke_fn *invoke_fn;
+ struct stratix10_svc *svc;
};
/**
@@ -1191,6 +1193,7 @@ static int stratix10_svc_drv_probe(struc
ret = -ENOMEM;
goto err_free_kfifo;
}
+ controller->svc = svc;
svc->stratix10_svc_rsu = platform_device_alloc(STRATIX10_RSU, 0);
if (!svc->stratix10_svc_rsu) {
@@ -1218,8 +1221,6 @@ static int stratix10_svc_drv_probe(struc
goto err_unregister_dev;
}
- dev_set_drvdata(dev, svc);
-
pr_info("Intel Service Layer Driver Initialized\n");
return 0;
@@ -1235,8 +1236,8 @@ err_destroy_pool:
static int stratix10_svc_drv_remove(struct platform_device *pdev)
{
- struct stratix10_svc *svc = dev_get_drvdata(&pdev->dev);
struct stratix10_svc_controller *ctrl = platform_get_drvdata(pdev);
+ struct stratix10_svc *svc = ctrl->svc;
platform_device_unregister(svc->intel_svc_fcs);
platform_device_unregister(svc->stratix10_svc_rsu);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 534/568] serial: amba-pl011: prefer dma_mapping_error() over explicit address checking
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (532 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 533/568] firmware: stratix10-svc: fix bug in saving controller data Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 535/568] most: usb: fix double free on late probe failure Greg Kroah-Hartman
` (40 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Miaoqian Lin,
Gregory CLEMENT
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <linmq006@gmail.com>
commit eb4917f557d43c7a1c805dd73ffcdfddb2aba39a upstream.
Check for returned DMA addresses using specialized dma_mapping_error()
helper which is generally recommended for this purpose by
Documentation/core-api/dma-api.rst:
"In some circumstances dma_map_single(), ...
will fail to create a mapping. A driver can check for these errors
by testing the returned DMA address with dma_mapping_error()."
Found via static analysis and this is similar to commit fa0308134d26
("ALSA: memalloc: prefer dma_mapping_error() over explicit address checking")
Fixes: 58ac1b379979 ("ARM: PL011: Fix DMA support")
Cc: stable <stable@kernel.org>
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Link: https://patch.msgid.link/20251027092053.87937-1-linmq006@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/amba-pl011.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -635,7 +635,7 @@ static int pl011_dma_tx_refill(struct ua
dmatx->len = count;
dmatx->dma = dma_map_single(dma_dev->dev, dmatx->buf, count,
DMA_TO_DEVICE);
- if (dmatx->dma == DMA_MAPPING_ERROR) {
+ if (dma_mapping_error(dma_dev->dev, dmatx->dma)) {
uap->dmatx.queued = false;
dev_dbg(uap->port.dev, "unable to map TX DMA\n");
return -EBUSY;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 535/568] most: usb: fix double free on late probe failure
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (533 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 534/568] serial: amba-pl011: prefer dma_mapping_error() over explicit address checking Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 536/568] usb: cdns3: Fix double resource release in cdns3_pci_probe Greg Kroah-Hartman
` (39 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Gromm, Victoria Votokina,
Johan Hovold
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit baadf2a5c26e802a46573eaad331b427b49aaa36 upstream.
The MOST subsystem has a non-standard registration function which frees
the interface on registration failures and on deregistration.
This unsurprisingly leads to bugs in the MOST drivers, and a couple of
recent changes turned a reference underflow and use-after-free in the
USB driver into several double free and a use-after-free on late probe
failures.
Fixes: 723de0f9171e ("staging: most: remove device from interface structure")
Fixes: 4b1270902609 ("most: usb: Fix use-after-free in hdm_disconnect")
Fixes: a8cc9e5fcb0e ("most: usb: hdm_probe: Fix calling put_device() before device initialization")
Cc: stable@vger.kernel.org
Cc: Christian Gromm <christian.gromm@microchip.com>
Cc: Victoria Votokina <Victoria.Votokina@kaspersky.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20251029093029.28922-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/most/most_usb.c | 14 +++++---------
1 file changed, 5 insertions(+), 9 deletions(-)
--- a/drivers/most/most_usb.c
+++ b/drivers/most/most_usb.c
@@ -1058,7 +1058,7 @@ hdm_probe(struct usb_interface *interfac
ret = most_register_interface(&mdev->iface);
if (ret)
- goto err_free_busy_urbs;
+ return ret;
mutex_lock(&mdev->io_mutex);
if (le16_to_cpu(usb_dev->descriptor.idProduct) == USB_DEV_ID_OS81118 ||
@@ -1068,8 +1068,7 @@ hdm_probe(struct usb_interface *interfac
if (!mdev->dci) {
mutex_unlock(&mdev->io_mutex);
most_deregister_interface(&mdev->iface);
- ret = -ENOMEM;
- goto err_free_busy_urbs;
+ return -ENOMEM;
}
mdev->dci->dev.init_name = "dci";
@@ -1078,18 +1077,15 @@ hdm_probe(struct usb_interface *interfac
mdev->dci->dev.release = release_dci;
if (device_register(&mdev->dci->dev)) {
mutex_unlock(&mdev->io_mutex);
+ put_device(&mdev->dci->dev);
most_deregister_interface(&mdev->iface);
- ret = -ENOMEM;
- goto err_free_dci;
+ return -ENOMEM;
}
mdev->dci->usb_device = mdev->usb_device;
}
mutex_unlock(&mdev->io_mutex);
return 0;
-err_free_dci:
- put_device(&mdev->dci->dev);
-err_free_busy_urbs:
- kfree(mdev->busy_urbs);
+
err_free_ep_address:
kfree(mdev->ep_address);
err_free_cap:
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 536/568] usb: cdns3: Fix double resource release in cdns3_pci_probe
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (534 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 535/568] most: usb: fix double free on late probe failure Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 6.1 537/568] usb: gadget: f_eem: Fix memory leak in eem_unwrap Greg Kroah-Hartman
` (38 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Miaoqian Lin, Peter Chen
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <linmq006@gmail.com>
commit 1ec39d2cd88dac2e7cdbac248762f1f057971c5d upstream.
The driver uses pcim_enable_device() to enable the PCI device,
the device will be automatically disabled on driver detach through
the managed device framework. The manual pci_disable_device() calls
in the error paths are therefore redundant and should be removed.
Found via static anlaysis and this is similar to commit 99ca0b57e49f
("thermal: intel: int340x: processor: Fix warning during module unload").
Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Acked-by: Peter Chen <peter.chen@kernel.org>
Link: https://patch.msgid.link/20251026090859.33107-1-linmq006@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/cdns3/cdns3-pci-wrap.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
--- a/drivers/usb/cdns3/cdns3-pci-wrap.c
+++ b/drivers/usb/cdns3/cdns3-pci-wrap.c
@@ -101,10 +101,8 @@ static int cdns3_pci_probe(struct pci_de
wrap = pci_get_drvdata(func);
} else {
wrap = kzalloc(sizeof(*wrap), GFP_KERNEL);
- if (!wrap) {
- pci_disable_device(pdev);
+ if (!wrap)
return -ENOMEM;
- }
}
res = wrap->dev_res;
@@ -163,7 +161,6 @@ static int cdns3_pci_probe(struct pci_de
/* register platform device */
wrap->plat_dev = platform_device_register_full(&plat_info);
if (IS_ERR(wrap->plat_dev)) {
- pci_disable_device(pdev);
err = PTR_ERR(wrap->plat_dev);
kfree(wrap);
return err;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 537/568] usb: gadget: f_eem: Fix memory leak in eem_unwrap
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (535 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 536/568] usb: cdns3: Fix double resource release in cdns3_pci_probe Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 538/568] usb: storage: Fix memory leak in USB bulk transport Greg Kroah-Hartman
` (37 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Kuen-Han Tsai
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <khtsai@google.com>
commit e4f5ce990818d37930cd9fb0be29eee0553c59d9 upstream.
The existing code did not handle the failure case of usb_ep_queue in the
command path, potentially leading to memory leaks.
Improve error handling to free all allocated resources on usb_ep_queue
failure. This patch continues to use goto logic for error handling, as the
existing error handling is complex and not easily adaptable to auto-cleanup
helpers.
kmemleak results:
unreferenced object 0xffffff895a512300 (size 240):
backtrace:
slab_post_alloc_hook+0xbc/0x3a4
kmem_cache_alloc+0x1b4/0x358
skb_clone+0x90/0xd8
eem_unwrap+0x1cc/0x36c
unreferenced object 0xffffff8a157f4000 (size 256):
backtrace:
slab_post_alloc_hook+0xbc/0x3a4
__kmem_cache_alloc_node+0x1b4/0x2dc
kmalloc_trace+0x48/0x140
dwc3_gadget_ep_alloc_request+0x58/0x11c
usb_ep_alloc_request+0x40/0xe4
eem_unwrap+0x204/0x36c
unreferenced object 0xffffff8aadbaac00 (size 128):
backtrace:
slab_post_alloc_hook+0xbc/0x3a4
__kmem_cache_alloc_node+0x1b4/0x2dc
__kmalloc+0x64/0x1a8
eem_unwrap+0x218/0x36c
unreferenced object 0xffffff89ccef3500 (size 64):
backtrace:
slab_post_alloc_hook+0xbc/0x3a4
__kmem_cache_alloc_node+0x1b4/0x2dc
kmalloc_trace+0x48/0x140
eem_unwrap+0x238/0x36c
Fixes: 4249d6fbc10f ("usb: gadget: eem: fix echo command packet response issue")
Cc: stable@kernel.org
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
Link: https://patch.msgid.link/20251103121814.1559719-1-khtsai@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_eem.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/f_eem.c
+++ b/drivers/usb/gadget/function/f_eem.c
@@ -479,8 +479,13 @@ static int eem_unwrap(struct gether *por
req->complete = eem_cmd_complete;
req->zero = 1;
req->context = ctx;
- if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC))
+ if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC)) {
DBG(cdev, "echo response queue fail\n");
+ kfree(ctx);
+ kfree(req->buf);
+ usb_ep_free_request(ep, req);
+ dev_kfree_skb_any(skb2);
+ }
break;
case 1: /* echo response */
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 538/568] usb: storage: Fix memory leak in USB bulk transport
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (536 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 6.1 537/568] usb: gadget: f_eem: Fix memory leak in eem_unwrap Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 539/568] USB: storage: Remove subclass and protocol overrides from Novatek quirk Greg Kroah-Hartman
` (36 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Desnes Nunes, Alan Stern
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Desnes Nunes <desnesn@redhat.com>
commit 41e99fe2005182139b1058db71f0d241f8f0078c upstream.
A kernel memory leak was identified by the 'ioctl_sg01' test from Linux
Test Project (LTP). The following bytes were mainly observed: 0x53425355.
When USB storage devices incorrectly skip the data phase with status data,
the code extracts/validates the CSW from the sg buffer, but fails to clear
it afterwards. This leaves status protocol data in srb's transfer buffer,
such as the US_BULK_CS_SIGN 'USBS' signature observed here. Thus, this can
lead to USB protocols leaks to user space through SCSI generic (/dev/sg*)
interfaces, such as the one seen here when the LTP test requested 512 KiB.
Fix the leak by zeroing the CSW data in srb's transfer buffer immediately
after the validation of devices that skip data phase.
Note: Differently from CVE-2018-1000204, which fixed a big leak by zero-
ing pages at allocation time, this leak occurs after allocation, when USB
protocol data is written to already-allocated sg pages.
Fixes: a45b599ad808 ("scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()")
Cc: stable <stable@kernel.org>
Signed-off-by: Desnes Nunes <desnesn@redhat.com>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20251031043436.55929-1-desnesn@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/transport.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -1204,7 +1204,23 @@ int usb_stor_Bulk_transport(struct scsi_
US_BULK_CS_WRAP_LEN &&
bcs->Signature ==
cpu_to_le32(US_BULK_CS_SIGN)) {
+ unsigned char buf[US_BULK_CS_WRAP_LEN];
+
usb_stor_dbg(us, "Device skipped data phase\n");
+
+ /*
+ * Devices skipping data phase might leave CSW data in srb's
+ * transfer buffer. Zero it to prevent USB protocol leakage.
+ */
+ sg = NULL;
+ offset = 0;
+ memset(buf, 0, sizeof(buf));
+ if (usb_stor_access_xfer_buf(buf,
+ US_BULK_CS_WRAP_LEN, srb, &sg,
+ &offset, TO_XFER_BUF) !=
+ US_BULK_CS_WRAP_LEN)
+ usb_stor_dbg(us, "Failed to clear CSW data\n");
+
scsi_set_resid(srb, transfer_length);
goto skipped_data_phase;
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 539/568] USB: storage: Remove subclass and protocol overrides from Novatek quirk
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (537 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 538/568] usb: storage: Fix memory leak in USB bulk transport Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 540/568] usb: storage: sddr55: Reject out-of-bound new_pba Greg Kroah-Hartman
` (35 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stealth, Alan Stern, stable
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit df5fde297e617041449f603ed5f646861c80000b upstream.
A report from Oleg Smirnov indicates that the unusual_devs quirks
entry for the Novatek camera does not need to override the subclass
and protocol parameters:
[3266355.209532] usb 1-3: new high-speed USB device number 10 using xhci_hcd
[3266355.333031] usb 1-3: New USB device found, idVendor=0603, idProduct=8611, bcdDevice= 1.00
[3266355.333040] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[3266355.333043] usb 1-3: Product: YICARCAM
[3266355.333045] usb 1-3: Manufacturer: XIAO-YI
[3266355.333047] usb 1-3: SerialNumber: 966110000000100
[3266355.338621] usb-storage 1-3:1.0: USB Mass Storage device detected
[3266355.338817] usb-storage 1-3:1.0: Quirks match for vid 0603 pid 8611: 4000
[3266355.338821] usb-storage 1-3:1.0: This device (0603,8611,0100 S 06 P 50) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel 6.16.10-arch1-1)
Please send a copy of this message to
<linux-usb@vger.kernel.org> and <usb-storage@lists.one-eyed-alien.net>
The overrides are harmless but they do provoke the driver into logging
this annoying message. Update the entry to remove the unneeded entries.
Reported-by: stealth <oleg.smirnov.1988@gmail.com>
Closes: https://lore.kernel.org/CAKxjRRxhC0s19iEWoN=pEMqXJ_z8w_moC0GCXSqSKCcOddnWjQ@mail.gmail.com/
Fixes: 6ca8af3c8fb5 ("USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera")
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/b440f177-f0b8-4d5a-8f7b-10855d4424ee@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/unusual_devs.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -938,7 +938,7 @@ UNUSUAL_DEV( 0x05e3, 0x0723, 0x9451, 0x
UNUSUAL_DEV( 0x0603, 0x8611, 0x0000, 0xffff,
"Novatek",
"NTK96550-based camera",
- USB_SC_SCSI, USB_PR_BULK, NULL,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
US_FL_BULK_IGNORE_TAG ),
/*
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 540/568] usb: storage: sddr55: Reject out-of-bound new_pba
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (538 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 539/568] USB: storage: Remove subclass and protocol overrides from Novatek quirk Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 541/568] usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer Greg Kroah-Hartman
` (34 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tianchu Chen, stable
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tianchu Chen <flynnnchen@tencent.com>
commit b59d4fda7e7d0aff1043a7f742487cb829f5aac1 upstream.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
new_pba comes from the status packet returned after each write.
A bogus device could report values beyond the block count derived
from info->capacity, letting the driver walk off the end of
pba_to_lba[] and corrupt heap memory.
Reject PBAs that exceed the computed block count and fail the
transfer so we avoid touching out-of-range mapping entries.
Signed-off-by: Tianchu Chen <flynnnchen@tencent.com>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/B2DC73A3EE1E3A1D+202511161322001664687@tencent.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/sddr55.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/usb/storage/sddr55.c
+++ b/drivers/usb/storage/sddr55.c
@@ -469,6 +469,12 @@ static int sddr55_write_data(struct us_d
new_pba = (status[3] + (status[4] << 8) + (status[5] << 16))
>> info->blockshift;
+ /* check if device-reported new_pba is out of range */
+ if (new_pba >= (info->capacity >> (info->blockshift + info->pageshift))) {
+ result = USB_STOR_TRANSPORT_FAILED;
+ goto leave;
+ }
+
/* check status for error */
if (status[0] == 0xff && status[1] == 0x4) {
info->pba_to_lba[new_pba] = BAD_BLOCK;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 541/568] usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (539 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 540/568] usb: storage: sddr55: Reject out-of-bound new_pba Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 542/568] usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths Greg Kroah-Hartman
` (33 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Yu Chen, Owen Gu,
Oliver Neukum
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Owen Gu <guhuinan@xiaomi.com>
commit 26d56a9fcb2014b99e654127960aa0a48a391e3c upstream.
When a UAS device is unplugged during data transfer, there is
a probability of a system panic occurring. The root cause is
an access to an invalid memory address during URB callback handling.
Specifically, this happens when the dma_direct_unmap_sg() function
is called within the usb_hcd_unmap_urb_for_dma() interface, but the
sg->dma_address field is 0 and the sg data structure has already been
freed.
The SCSI driver sends transfer commands by invoking uas_queuecommand_lck()
in uas.c, using the uas_submit_urbs() function to submit requests to USB.
Within the uas_submit_urbs() implementation, three URBs (sense_urb,
data_urb, and cmd_urb) are sequentially submitted. Device removal may
occur at any point during uas_submit_urbs execution, which may result
in URB submission failure. However, some URBs might have been successfully
submitted before the failure, and uas_submit_urbs will return the -ENODEV
error code in this case. The current error handling directly calls
scsi_done(). In the SCSI driver, this eventually triggers scsi_complete()
to invoke scsi_end_request() for releasing the sgtable. The successfully
submitted URBs, when being unlinked to giveback, call
usb_hcd_unmap_urb_for_dma() in hcd.c, leading to exceptions during sg
unmapping operations since the sg data structure has already been freed.
This patch modifies the error condition check in the uas_submit_urbs()
function. When a UAS device is removed but one or more URBs have already
been successfully submitted to USB, it avoids immediately invoking
scsi_done() and save the cmnd to devinfo->cmnd array. If the successfully
submitted URBs is completed before devinfo->resetting being set, then
the scsi_done() function will be called within uas_try_complete() after
all pending URB operations are finalized. Otherwise, the scsi_done()
function will be called within uas_zap_pending(), which is executed after
usb_kill_anchored_urbs().
The error handling only takes effect when uas_queuecommand_lck() calls
uas_submit_urbs() and returns the error value -ENODEV . In this case,
the device is disconnected, and the flow proceeds to uas_disconnect(),
where uas_zap_pending() is invoked to call uas_try_complete().
Fixes: eb2a86ae8c54 ("USB: UAS: fix disconnect by unplugging a hub")
Cc: stable <stable@kernel.org>
Signed-off-by: Yu Chen <chenyu45@xiaomi.com>
Signed-off-by: Owen Gu <guhuinan@xiaomi.com>
Acked-by: Oliver Neukum <oneukum@suse.com>
Link: https://patch.msgid.link/20251120123336.3328-1-guhuinan@xiaomi.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/uas.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -697,6 +697,10 @@ static int uas_queuecommand_lck(struct s
* of queueing, no matter how fatal the error
*/
if (err == -ENODEV) {
+ if (cmdinfo->state & (COMMAND_INFLIGHT | DATA_IN_URB_INFLIGHT |
+ DATA_OUT_URB_INFLIGHT))
+ goto out;
+
set_host_byte(cmnd, DID_NO_CONNECT);
scsi_done(cmnd);
goto zombie;
@@ -710,6 +714,7 @@ static int uas_queuecommand_lck(struct s
uas_add_work(cmnd);
}
+out:
devinfo->cmnd[idx] = cmnd;
zombie:
spin_unlock_irqrestore(&devinfo->lock, flags);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 542/568] usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (540 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 541/568] usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 543/568] xhci: dbgtty: Fix data corruption when transmitting data form DbC to host Greg Kroah-Hartman
` (32 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Thinh Nguyen, Manish Nagar
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manish Nagar <manish.nagar@oss.qualcomm.com>
commit e4037689a366743c4233966f0e74bc455820d316 upstream.
This patch addresses a race condition caused by unsynchronized
execution of multiple call paths invoking `dwc3_remove_requests()`,
leading to premature freeing of USB requests and subsequent crashes.
Three distinct execution paths interact with `dwc3_remove_requests()`:
Path 1:
Triggered via `dwc3_gadget_reset_interrupt()` during USB reset
handling. The call stack includes:
- `dwc3_ep0_reset_state()`
- `dwc3_ep0_stall_and_restart()`
- `dwc3_ep0_out_start()`
- `dwc3_remove_requests()`
- `dwc3_gadget_del_and_unmap_request()`
Path 2:
Also initiated from `dwc3_gadget_reset_interrupt()`, but through
`dwc3_stop_active_transfers()`. The call stack includes:
- `dwc3_stop_active_transfers()`
- `dwc3_remove_requests()`
- `dwc3_gadget_del_and_unmap_request()`
Path 3:
Occurs independently during `adb root` execution, which triggers
USB function unbind and bind operations. The sequence includes:
- `gserial_disconnect()`
- `usb_ep_disable()`
- `dwc3_gadget_ep_disable()`
- `dwc3_remove_requests()` with `-ESHUTDOWN` status
Path 3 operates asynchronously and lacks synchronization with Paths
1 and 2. When Path 3 completes, it disables endpoints and frees 'out'
requests. If Paths 1 or 2 are still processing these requests,
accessing freed memory leads to a crash due to use-after-free conditions.
To fix this added check for request completion and skip processing
if already completed and added the request status for ep0 while queue.
Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")
Cc: stable <stable@kernel.org>
Suggested-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Manish Nagar <manish.nagar@oss.qualcomm.com>
Link: https://patch.msgid.link/20251120074435.1983091-1-manish.nagar@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/ep0.c | 1 +
drivers/usb/dwc3/gadget.c | 7 +++++++
2 files changed, 8 insertions(+)
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -92,6 +92,7 @@ static int __dwc3_gadget_ep0_queue(struc
req->request.actual = 0;
req->request.status = -EINPROGRESS;
req->epnum = dep->number;
+ req->status = DWC3_REQUEST_STATUS_QUEUED;
list_add_tail(&req->list, &dep->pending_list);
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -229,6 +229,13 @@ void dwc3_gadget_giveback(struct dwc3_ep
{
struct dwc3 *dwc = dep->dwc;
+ /*
+ * The request might have been processed and completed while the
+ * spinlock was released. Skip processing if already completed.
+ */
+ if (req->status == DWC3_REQUEST_STATUS_COMPLETED)
+ return;
+
dwc3_gadget_del_and_unmap_request(dep, req, status);
req->status = DWC3_REQUEST_STATUS_COMPLETED;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 543/568] xhci: dbgtty: Fix data corruption when transmitting data form DbC to host
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (541 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 542/568] usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 544/568] xhci: dbgtty: fix device unregister Greg Kroah-Hartman
` (31 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Łukasz Bartosik, Mathias Nyman
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit f6bb3b67be9af0cfb90075c60850b6af5338a508 upstream.
Data read from a DbC device may be corrupted due to a race between
ongoing write and write request completion handler both queuing new
transfer blocks (TRBs) if there are remining data in the kfifo.
TRBs may be in incorrct order compared to the data in the kfifo.
Driver fails to keep lock between reading data from kfifo into a
dbc request buffer, and queuing the request to the transfer ring.
This allows completed request to re-queue itself in the middle of
an ongoing transfer loop, forcing itself between a kfifo read and
request TRB write of another request
cpu0 cpu1 (re-queue completed req2)
lock(port_lock)
dbc_start_tx()
kfifo_out(fifo, req1->buffer)
unlock(port_lock)
lock(port_lock)
dbc_write_complete(req2)
dbc_start_tx()
kfifo_out(fifo, req2->buffer)
unlock(port_lock)
lock(port_lock)
req2->trb = ring->enqueue;
ring->enqueue++
unlock(port_lock)
lock(port_lock)
req1->trb = ring->enqueue;
ring->enqueue++
unlock(port_lock)
In the above scenario a kfifo containing "12345678" would read "1234" to
req1 and "5678" to req2, but req2 is queued before req1 leading to
data being transmitted as "56781234"
Solve this by adding a flag that prevents starting a new tx if we
are already mid dbc_start_tx() during the unlocked part.
The already running dbc_do_start_tx() will make sure the newly completed
request gets re-queued as it is added to the request write_pool while
holding the lock.
Cc: stable@vger.kernel.org
Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver")
Tested-by: Łukasz Bartosik <ukaszb@chromium.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20251107162819.1362579-3-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-dbgcap.h | 1 +
drivers/usb/host/xhci-dbgtty.c | 17 ++++++++++++++++-
2 files changed, 17 insertions(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-dbgcap.h
+++ b/drivers/usb/host/xhci-dbgcap.h
@@ -113,6 +113,7 @@ struct dbc_port {
unsigned int tx_boundary;
bool registered;
+ bool tx_running;
};
struct dbc_driver {
--- a/drivers/usb/host/xhci-dbgtty.c
+++ b/drivers/usb/host/xhci-dbgtty.c
@@ -47,7 +47,7 @@ dbc_kfifo_to_req(struct dbc_port *port,
return len;
}
-static int dbc_start_tx(struct dbc_port *port)
+static int dbc_do_start_tx(struct dbc_port *port)
__releases(&port->port_lock)
__acquires(&port->port_lock)
{
@@ -57,6 +57,8 @@ static int dbc_start_tx(struct dbc_port
bool do_tty_wake = false;
struct list_head *pool = &port->write_pool;
+ port->tx_running = true;
+
while (!list_empty(pool)) {
req = list_entry(pool->next, struct dbc_request, list_pool);
len = dbc_kfifo_to_req(port, req->buf);
@@ -77,12 +79,25 @@ static int dbc_start_tx(struct dbc_port
}
}
+ port->tx_running = false;
+
if (do_tty_wake && port->port.tty)
tty_wakeup(port->port.tty);
return status;
}
+/* must be called with port->port_lock held */
+static int dbc_start_tx(struct dbc_port *port)
+{
+ lockdep_assert_held(&port->port_lock);
+
+ if (port->tx_running)
+ return -EBUSY;
+
+ return dbc_do_start_tx(port);
+}
+
static void dbc_start_rx(struct dbc_port *port)
__releases(&port->port_lock)
__acquires(&port->port_lock)
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 544/568] xhci: dbgtty: fix device unregister
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (542 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 543/568] xhci: dbgtty: Fix data corruption when transmitting data form DbC to host Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 545/568] USB: serial: ftdi_sio: add support for u-blox EVK-M101 Greg Kroah-Hartman
` (30 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Łukasz Bartosik
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Łukasz Bartosik <ukaszb@chromium.org>
commit 1f73b8b56cf35de29a433aee7bfff26cea98be3f upstream.
When DbC is disconnected then xhci_dbc_tty_unregister_device()
is called. However if there is any user space process blocked
on write to DbC terminal device then it will never be signalled
and thus stay blocked indifinitely.
This fix adds a tty_vhangup() call in xhci_dbc_tty_unregister_device().
The tty_vhangup() wakes up any blocked writers and causes subsequent
write attempts to DbC terminal device to fail.
Cc: stable <stable@kernel.org>
Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver")
Signed-off-by: Łukasz Bartosik <ukaszb@chromium.org>
Link: https://patch.msgid.link/20251119212910.1245694-1-ukaszb@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-dbgtty.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/usb/host/xhci-dbgtty.c
+++ b/drivers/usb/host/xhci-dbgtty.c
@@ -519,6 +519,12 @@ static void xhci_dbc_tty_unregister_devi
if (!port->registered)
return;
+ /*
+ * Hang up the TTY. This wakes up any blocked
+ * writers and causes subsequent writes to fail.
+ */
+ tty_vhangup(port->port.tty);
+
tty_unregister_device(dbc_tty_driver, port->minor);
xhci_dbc_tty_exit_port(port);
port->registered = false;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 545/568] USB: serial: ftdi_sio: add support for u-blox EVK-M101
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (543 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 544/568] xhci: dbgtty: fix device unregister Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 546/568] USB: serial: option: add support for Rolling RW101R-GL Greg Kroah-Hartman
` (29 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oleksandr Suvorov, Johan Hovold
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksandr Suvorov <cryosay@gmail.com>
commit 2d8ab771d5316de64f3bb920b82575c58eb00b1b upstream.
The U-Blox EVK-M101 enumerates as 1546:0506 [1] with four FTDI interfaces:
- EVK-M101 current sensors
- EVK-M101 I2C
- EVK-M101 UART
- EVK-M101 port D
Only the third USB interface is a UART. This change lets ftdi_sio probe
the VID/PID and registers only interface #3 as a TTY, leaving the rest
available for other drivers.
[1]
usb 5-1.3: new high-speed USB device number 11 using xhci_hcd
usb 5-1.3: New USB device found, idVendor=1546, idProduct=0506, bcdDevice= 8.00
usb 5-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
usb 5-1.3: Product: EVK-M101
usb 5-1.3: Manufacturer: u-blox AG
Datasheet: https://content.u-blox.com/sites/default/files/documents/EVK-M10_UserGuide_UBX-21003949.pdf
Signed-off-by: Oleksandr Suvorov <cryosay@gmail.com>
Link: https://lore.kernel.org/20250926060235.3442748-1-cryosay@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/ftdi_sio.c | 1 +
drivers/usb/serial/ftdi_sio_ids.h | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1074,6 +1074,7 @@ static const struct usb_device_id id_tab
/* U-Blox devices */
{ USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) },
{ USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) },
+ { USB_DEVICE_INTERFACE_NUMBER(UBLOX_VID, UBLOX_EVK_M101_PID, 2) },
/* FreeCalypso USB adapters */
{ USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID),
.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1614,6 +1614,7 @@
#define UBLOX_VID 0x1546
#define UBLOX_C099F9P_ZED_PID 0x0502
#define UBLOX_C099F9P_ODIN_PID 0x0503
+#define UBLOX_EVK_M101_PID 0x0506
/*
* GMC devices
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 546/568] USB: serial: option: add support for Rolling RW101R-GL
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (544 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 545/568] USB: serial: ftdi_sio: add support for u-blox EVK-M101 Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 547/568] drm: sti: fix device leaks at component probe Greg Kroah-Hartman
` (28 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Vanillan Wang, Johan Hovold
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vanillan Wang <vanillanwang@163.com>
commit 523bf0a59e674b52e4b5607a2aba655fbfa20ff2 upstream.
- VID:PID 33f8:0301, RW101R-GL for laptop debug M.2 cards (with MBIM
interface for Linux/Chrome OS)
0x0301: mbim, pipe
T: Bus=04 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0
D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
P: Vendor=33f8 ProdID=0301 Rev=05.04
S: Manufacturer=Rolling Wireless S.a.r.l.
S: Product=Rolling RW101R-GL Module
S: SerialNumber=3ec4efdf
C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=896mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
- VID:PID 33f8:01a8, RW101R-GL for laptop debug M.2 cards (with MBIM
interface for Linux/Chrome OS)
0x01a8: mbim, diag, AT, ADB, pipe1, pipe2
T: Bus=04 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0
D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
P: Vendor=33f8 ProdID=01a8 Rev=05.04
S: Manufacturer=Rolling Wireless S.a.r.l.
S: Product=Rolling RW101R-GL Module
S: SerialNumber=3ec4efdf
C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=896mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=89(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
- VID:PID 33f8:0302, RW101R-GL for laptop debug M.2 cards (with MBIM
interface for Linux/Chrome OS)
0x0302: mbim, pipe
T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=33f8 ProdID=0302 Rev=05.04
S: Manufacturer=Rolling Wireless S.a.r.l.
S: Product=Rolling RW101R-GL Module
S: SerialNumber=3ec4efdf
C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
- VID:PID 33f8:01a9, RW101R-GL for laptop debug M.2 cards (with MBIM
interface for Linux/Chrome OS)
0x01a9: mbim, diag, AT, ADB, pipe1, pipe2
T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=33f8 ProdID=01a9 Rev=05.04
S: Manufacturer=Rolling Wireless S.a.r.l.
S: Product=Rolling RW101R-GL Module
S: SerialNumber=3ec4efdf
C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=89(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
Signed-off-by: Vanillan Wang <vanillanwang@163.com>
Cc: stable@vger.kernel.org
[ johan: sort vendor entries, edit commit message slightly ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2424,12 +2424,18 @@ static const struct usb_device_id option
{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */
{ USB_DEVICE(0x33f8, 0x0104), /* Rolling RW101-GL (laptop RMNET) */
.driver_info = RSVD(4) | RSVD(5) },
+ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */
+ .driver_info = RSVD(5) },
{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a2, 0xff) }, /* Rolling RW101-GL (laptop MBIM) */
{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a3, 0xff) }, /* Rolling RW101-GL (laptop MBIM) */
{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a4, 0xff), /* Rolling RW101-GL (laptop MBIM) */
.driver_info = RSVD(4) },
- { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */
- .driver_info = RSVD(5) },
+ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a8, 0xff), /* Rolling RW101R-GL (laptop MBIM) */
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a9, 0xff), /* Rolling RW101R-GL (laptop MBIM) */
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0301, 0xff) }, /* Rolling RW101R-GL (laptop MBIM) */
+ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0302, 0xff) }, /* Rolling RW101R-GL (laptop MBIM) */
{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0802, 0xff), /* Rolling RW350-GL (laptop MBIM) */
.driver_info = RSVD(5) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Global */
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 547/568] drm: sti: fix device leaks at component probe
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (545 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 546/568] USB: serial: option: add support for Rolling RW101R-GL Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 548/568] drm/amd/display: Check NULL before accessing Greg Kroah-Hartman
` (27 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Gaignard, Johan Hovold,
Raphael Gallais-Pou
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 620a8f131154250f6a64a07d049a4f235d6451a5 upstream.
Make sure to drop the references taken to the vtg devices by
of_find_device_by_node() when looking up their driver data during
component probe.
Note that holding a reference to a platform device does not prevent its
driver data from going away so there is no point in keeping the
reference after the lookup helper returns.
Fixes: cc6b741c6f63 ("drm: sti: remove useless fields from vtg structure")
Cc: stable@vger.kernel.org # 4.16
Cc: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20250922122012.27407-1-johan@kernel.org
Signed-off-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/sti/sti_vtg.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/sti/sti_vtg.c
+++ b/drivers/gpu/drm/sti/sti_vtg.c
@@ -143,12 +143,17 @@ struct sti_vtg {
struct sti_vtg *of_vtg_find(struct device_node *np)
{
struct platform_device *pdev;
+ struct sti_vtg *vtg;
pdev = of_find_device_by_node(np);
if (!pdev)
return NULL;
- return (struct sti_vtg *)platform_get_drvdata(pdev);
+ vtg = platform_get_drvdata(pdev);
+
+ put_device(&pdev->dev);
+
+ return vtg;
}
static void vtg_reset(struct sti_vtg *vtg)
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 548/568] drm/amd/display: Check NULL before accessing
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (546 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 547/568] drm: sti: fix device leaks at component probe Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 549/568] net: dsa: microchip: common: Fix checks on irq_find_mapping() Greg Kroah-Hartman
` (26 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello, Alex Deucher,
Aurabindo Pillai, Alex Hung
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <alex.hung@amd.com>
commit 3ce62c189693e8ed7b3abe551802bbc67f3ace54 upstream.
[WHAT]
IGT kms_cursor_legacy's long-nonblocking-modeset-vs-cursor-atomic
fails with NULL pointer dereference. This can be reproduced with
both an eDP panel and a DP monitors connected.
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 13 UID: 0 PID: 2960 Comm: kms_cursor_lega Not tainted
6.16.0-99-custom #8 PREEMPT(voluntary)
Hardware name: AMD ........
RIP: 0010:dc_stream_get_scanoutpos+0x34/0x130 [amdgpu]
Code: 57 4d 89 c7 41 56 49 89 ce 41 55 49 89 d5 41 54 49
89 fc 53 48 83 ec 18 48 8b 87 a0 64 00 00 48 89 75 d0 48 c7 c6 e0 41 30
c2 <48> 8b 38 48 8b 9f 68 06 00 00 e8 8d d7 fd ff 31 c0 48 81 c3 e0 02
RSP: 0018:ffffd0f3c2bd7608 EFLAGS: 00010292
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffd0f3c2bd7668
RDX: ffffd0f3c2bd7664 RSI: ffffffffc23041e0 RDI: ffff8b32494b8000
RBP: ffffd0f3c2bd7648 R08: ffffd0f3c2bd766c R09: ffffd0f3c2bd7760
R10: ffffd0f3c2bd7820 R11: 0000000000000000 R12: ffff8b32494b8000
R13: ffffd0f3c2bd7664 R14: ffffd0f3c2bd7668 R15: ffffd0f3c2bd766c
FS: 000071f631b68700(0000) GS:ffff8b399f114000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001b8105000 CR4: 0000000000f50ef0
PKRU: 55555554
Call Trace:
<TASK>
dm_crtc_get_scanoutpos+0xd7/0x180 [amdgpu]
amdgpu_display_get_crtc_scanoutpos+0x86/0x1c0 [amdgpu]
? __pfx_amdgpu_crtc_get_scanout_position+0x10/0x10[amdgpu]
amdgpu_crtc_get_scanout_position+0x27/0x50 [amdgpu]
drm_crtc_vblank_helper_get_vblank_timestamp_internal+0xf7/0x400
drm_crtc_vblank_helper_get_vblank_timestamp+0x1c/0x30
drm_crtc_get_last_vbltimestamp+0x55/0x90
drm_crtc_next_vblank_start+0x45/0xa0
drm_atomic_helper_wait_for_fences+0x81/0x1f0
...
Cc: Mario Limonciello <mario.limonciello@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 621e55f1919640acab25383362b96e65f2baea3c)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -619,9 +619,14 @@ bool dc_stream_get_scanoutpos(const stru
{
uint8_t i;
bool ret = false;
- struct dc *dc = stream->ctx->dc;
- struct resource_context *res_ctx =
- &dc->current_state->res_ctx;
+ struct dc *dc;
+ struct resource_context *res_ctx;
+
+ if (!stream->ctx)
+ return false;
+
+ dc = stream->ctx->dc;
+ res_ctx = &dc->current_state->res_ctx;
for (i = 0; i < MAX_PIPES; i++) {
struct timing_generator *tg = res_ctx->pipe_ctx[i].stream_res.tg;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 549/568] net: dsa: microchip: common: Fix checks on irq_find_mapping()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (547 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 548/568] drm/amd/display: Check NULL before accessing Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 550/568] libceph: fix potential use-after-free in have_mon_and_osd_map() Greg Kroah-Hartman
` (25 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrew Lunn,
Bastien Curutchet (Schneider Electric), Paolo Abeni
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com>
commit 7b3c09e1667977edee11de94a85e2593a7c15e87 upstream.
irq_find_mapping() returns a positive IRQ number or 0 if no IRQ is found
but it never returns a negative value. However, on each
irq_find_mapping() call, we verify that the returned value isn't
negative.
Fix the irq_find_mapping() checks to enter error paths when 0 is
returned. Return -EINVAL in such cases.
CC: stable@vger.kernel.org
Fixes: c9cd961c0d43 ("net: dsa: microchip: lan937x: add interrupt support for port phy link")
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com>
Link: https://patch.msgid.link/20251120-ksz-fix-v6-1-891f80ae7f8f@bootlin.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/dsa/microchip/ksz_common.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/net/dsa/microchip/ksz_common.c
+++ b/drivers/net/dsa/microchip/ksz_common.c
@@ -1693,8 +1693,8 @@ static int ksz_irq_phy_setup(struct ksz_
if (BIT(phy) & ds->phys_mii_mask) {
irq = irq_find_mapping(dev->ports[phy].pirq.domain,
PORT_SRC_PHY_INT);
- if (irq < 0) {
- ret = irq;
+ if (!irq) {
+ ret = -EINVAL;
goto out;
}
ds->slave_mii_bus->irq[phy] = irq;
@@ -1918,8 +1918,8 @@ static int ksz_pirq_setup(struct ksz_dev
snprintf(pirq->name, sizeof(pirq->name), "port_irq-%d", p);
pirq->irq_num = irq_find_mapping(dev->girq.domain, p);
- if (pirq->irq_num < 0)
- return pirq->irq_num;
+ if (!pirq->irq_num)
+ return -EINVAL;
return ksz_irq_common_setup(dev, pirq);
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 550/568] libceph: fix potential use-after-free in have_mon_and_osd_map()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (548 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 549/568] net: dsa: microchip: common: Fix checks on irq_find_mapping() Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 551/568] libceph: prevent potential out-of-bounds writes in handle_auth_session_key() Greg Kroah-Hartman
` (24 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Ilya Dryomov,
Viacheslav Dubeyko
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <idryomov@gmail.com>
commit 076381c261374c587700b3accf410bdd2dba334e upstream.
The wait loop in __ceph_open_session() can race with the client
receiving a new monmap or osdmap shortly after the initial map is
received. Both ceph_monc_handle_map() and handle_one_map() install
a new map immediately after freeing the old one
kfree(monc->monmap);
monc->monmap = monmap;
ceph_osdmap_destroy(osdc->osdmap);
osdc->osdmap = newmap;
under client->monc.mutex and client->osdc.lock respectively, but
because neither is taken in have_mon_and_osd_map() it's possible for
client->monc.monmap->epoch and client->osdc.osdmap->epoch arms in
client->monc.monmap && client->monc.monmap->epoch &&
client->osdc.osdmap && client->osdc.osdmap->epoch;
condition to dereference an already freed map. This happens to be
reproducible with generic/395 and generic/397 with KASAN enabled:
BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70
Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305
CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266
...
Call Trace:
<TASK>
have_mon_and_osd_map+0x56/0x70
ceph_open_session+0x182/0x290
ceph_get_tree+0x333/0x680
vfs_get_tree+0x49/0x180
do_new_mount+0x1a3/0x2d0
path_mount+0x6dd/0x730
do_mount+0x99/0xe0
__do_sys_mount+0x141/0x180
do_syscall_64+0x9f/0x100
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>
Allocated by task 13305:
ceph_osdmap_alloc+0x16/0x130
ceph_osdc_init+0x27a/0x4c0
ceph_create_client+0x153/0x190
create_fs_client+0x50/0x2a0
ceph_get_tree+0xff/0x680
vfs_get_tree+0x49/0x180
do_new_mount+0x1a3/0x2d0
path_mount+0x6dd/0x730
do_mount+0x99/0xe0
__do_sys_mount+0x141/0x180
do_syscall_64+0x9f/0x100
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Freed by task 9475:
kfree+0x212/0x290
handle_one_map+0x23c/0x3b0
ceph_osdc_handle_map+0x3c9/0x590
mon_dispatch+0x655/0x6f0
ceph_con_process_message+0xc3/0xe0
ceph_con_v1_try_read+0x614/0x760
ceph_con_workfn+0x2de/0x650
process_one_work+0x486/0x7c0
process_scheduled_works+0x73/0x90
worker_thread+0x1c8/0x2a0
kthread+0x2ec/0x300
ret_from_fork+0x24/0x40
ret_from_fork_asm+0x1a/0x30
Rewrite the wait loop to check the above condition directly with
client->monc.mutex and client->osdc.lock taken as appropriate. While
at it, improve the timeout handling (previously mount_timeout could be
exceeded in case wait_event_interruptible_timeout() slept more than
once) and access client->auth_err under client->monc.mutex to match
how it's set in finish_auth().
monmap_show() and osdmap_show() now take the respective lock before
accessing the map as well.
Cc: stable@vger.kernel.org
Reported-by: David Howells <dhowells@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ceph/ceph_common.c | 53 +++++++++++++++++++++++++++++--------------------
net/ceph/debugfs.c | 14 +++++++++---
2 files changed, 42 insertions(+), 25 deletions(-)
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -786,41 +786,52 @@ void ceph_reset_client_addr(struct ceph_
EXPORT_SYMBOL(ceph_reset_client_addr);
/*
- * true if we have the mon map (and have thus joined the cluster)
- */
-static bool have_mon_and_osd_map(struct ceph_client *client)
-{
- return client->monc.monmap && client->monc.monmap->epoch &&
- client->osdc.osdmap && client->osdc.osdmap->epoch;
-}
-
-/*
* mount: join the ceph cluster, and open root directory.
*/
int __ceph_open_session(struct ceph_client *client, unsigned long started)
{
- unsigned long timeout = client->options->mount_timeout;
- long err;
+ DEFINE_WAIT_FUNC(wait, woken_wake_function);
+ long timeout = ceph_timeout_jiffies(client->options->mount_timeout);
+ bool have_monmap, have_osdmap;
+ int err;
/* open session, and wait for mon and osd maps */
err = ceph_monc_open_session(&client->monc);
if (err < 0)
return err;
- while (!have_mon_and_osd_map(client)) {
- if (timeout && time_after_eq(jiffies, started + timeout))
- return -ETIMEDOUT;
+ add_wait_queue(&client->auth_wq, &wait);
+ for (;;) {
+ mutex_lock(&client->monc.mutex);
+ err = client->auth_err;
+ have_monmap = client->monc.monmap && client->monc.monmap->epoch;
+ mutex_unlock(&client->monc.mutex);
+
+ down_read(&client->osdc.lock);
+ have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch;
+ up_read(&client->osdc.lock);
+
+ if (err || (have_monmap && have_osdmap))
+ break;
+
+ if (signal_pending(current)) {
+ err = -ERESTARTSYS;
+ break;
+ }
+
+ if (!timeout) {
+ err = -ETIMEDOUT;
+ break;
+ }
/* wait */
dout("mount waiting for mon_map\n");
- err = wait_event_interruptible_timeout(client->auth_wq,
- have_mon_and_osd_map(client) || (client->auth_err < 0),
- ceph_timeout_jiffies(timeout));
- if (err < 0)
- return err;
- if (client->auth_err < 0)
- return client->auth_err;
+ timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout);
}
+ remove_wait_queue(&client->auth_wq, &wait);
+
+ if (err)
+ return err;
pr_info("client%llu fsid %pU\n", ceph_client_gid(client),
&client->fsid);
--- a/net/ceph/debugfs.c
+++ b/net/ceph/debugfs.c
@@ -36,8 +36,9 @@ static int monmap_show(struct seq_file *
int i;
struct ceph_client *client = s->private;
+ mutex_lock(&client->monc.mutex);
if (client->monc.monmap == NULL)
- return 0;
+ goto out_unlock;
seq_printf(s, "epoch %d\n", client->monc.monmap->epoch);
for (i = 0; i < client->monc.monmap->num_mon; i++) {
@@ -48,6 +49,9 @@ static int monmap_show(struct seq_file *
ENTITY_NAME(inst->name),
ceph_pr_addr(&inst->addr));
}
+
+out_unlock:
+ mutex_unlock(&client->monc.mutex);
return 0;
}
@@ -56,13 +60,14 @@ static int osdmap_show(struct seq_file *
int i;
struct ceph_client *client = s->private;
struct ceph_osd_client *osdc = &client->osdc;
- struct ceph_osdmap *map = osdc->osdmap;
+ struct ceph_osdmap *map;
struct rb_node *n;
+ down_read(&osdc->lock);
+ map = osdc->osdmap;
if (map == NULL)
- return 0;
+ goto out_unlock;
- down_read(&osdc->lock);
seq_printf(s, "epoch %u barrier %u flags 0x%x\n", map->epoch,
osdc->epoch_barrier, map->flags);
@@ -131,6 +136,7 @@ static int osdmap_show(struct seq_file *
seq_printf(s, "]\n");
}
+out_unlock:
up_read(&osdc->lock);
return 0;
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 551/568] libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (549 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 550/568] libceph: fix potential use-after-free in have_mon_and_osd_map() Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 552/568] libceph: replace BUG_ON with bounds check for map->max_osd Greg Kroah-Hartman
` (23 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, ziming zhang, Ilya Dryomov
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ziming zhang <ezrakiez@gmail.com>
commit 7fce830ecd0a0256590ee37eb65a39cbad3d64fc upstream.
The len field originates from untrusted network packets. Boundary
checks have been added to prevent potential out-of-bounds writes when
decrypting the connection secret or processing service tickets.
[ idryomov: changelog ]
Cc: stable@vger.kernel.org
Signed-off-by: ziming zhang <ezrakiez@gmail.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ceph/auth_x.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -631,6 +631,7 @@ static int handle_auth_session_key(struc
/* connection secret */
ceph_decode_32_safe(p, end, len, e_inval);
+ ceph_decode_need(p, end, len, e_inval);
dout("%s connection secret blob len %d\n", __func__, len);
if (len > 0) {
dp = *p + ceph_x_encrypt_offset();
@@ -648,6 +649,7 @@ static int handle_auth_session_key(struc
/* service tickets */
ceph_decode_32_safe(p, end, len, e_inval);
+ ceph_decode_need(p, end, len, e_inval);
dout("%s service tickets blob len %d\n", __func__, len);
if (len > 0) {
ret = ceph_x_proc_ticket_reply(ac, &th->session_key,
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 552/568] libceph: replace BUG_ON with bounds check for map->max_osd
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (550 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 551/568] libceph: prevent potential out-of-bounds writes in handle_auth_session_key() Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 553/568] nfsd: Replace clamp_t in nfsd4_get_drc_mem() Greg Kroah-Hartman
` (22 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, ziming zhang, Ilya Dryomov
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ziming zhang <ezrakiez@gmail.com>
commit ec3797f043756a94ea2d0f106022e14ac4946c02 upstream.
OSD indexes come from untrusted network packets. Boundary checks are
added to validate these against map->max_osd.
[ idryomov: drop BUG_ON in ceph_get_primary_affinity(), minor cosmetic
edits ]
Cc: stable@vger.kernel.org
Signed-off-by: ziming zhang <ezrakiez@gmail.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ceph/osdmap.c | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -1504,8 +1504,6 @@ static int decode_new_primary_temp(void
u32 ceph_get_primary_affinity(struct ceph_osdmap *map, int osd)
{
- BUG_ON(osd >= map->max_osd);
-
if (!map->osd_primary_affinity)
return CEPH_OSD_DEFAULT_PRIMARY_AFFINITY;
@@ -1514,8 +1512,6 @@ u32 ceph_get_primary_affinity(struct cep
static int set_primary_affinity(struct ceph_osdmap *map, int osd, u32 aff)
{
- BUG_ON(osd >= map->max_osd);
-
if (!map->osd_primary_affinity) {
int i;
@@ -1577,6 +1573,8 @@ static int decode_new_primary_affinity(v
ceph_decode_32_safe(p, end, osd, e_inval);
ceph_decode_32_safe(p, end, aff, e_inval);
+ if (osd >= map->max_osd)
+ goto e_inval;
ret = set_primary_affinity(map, osd, aff);
if (ret)
@@ -1879,7 +1877,9 @@ static int decode_new_up_state_weight(vo
ceph_decode_need(p, end, 2*sizeof(u32), e_inval);
osd = ceph_decode_32(p);
w = ceph_decode_32(p);
- BUG_ON(osd >= map->max_osd);
+ if (osd >= map->max_osd)
+ goto e_inval;
+
osdmap_info(map, "osd%d weight 0x%x %s\n", osd, w,
w == CEPH_OSD_IN ? "(in)" :
(w == CEPH_OSD_OUT ? "(out)" : ""));
@@ -1905,13 +1905,15 @@ static int decode_new_up_state_weight(vo
u32 xorstate;
osd = ceph_decode_32(p);
+ if (osd >= map->max_osd)
+ goto e_inval;
+
if (struct_v >= 5)
xorstate = ceph_decode_32(p);
else
xorstate = ceph_decode_8(p);
if (xorstate == 0)
xorstate = CEPH_OSD_UP;
- BUG_ON(osd >= map->max_osd);
if ((map->osd_state[osd] & CEPH_OSD_UP) &&
(xorstate & CEPH_OSD_UP))
osdmap_info(map, "osd%d down\n", osd);
@@ -1937,7 +1939,9 @@ static int decode_new_up_state_weight(vo
struct ceph_entity_addr addr;
osd = ceph_decode_32(p);
- BUG_ON(osd >= map->max_osd);
+ if (osd >= map->max_osd)
+ goto e_inval;
+
if (struct_v >= 7)
ret = ceph_decode_entity_addrvec(p, end, msgr2, &addr);
else
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 553/568] nfsd: Replace clamp_t in nfsd4_get_drc_mem()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (551 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 552/568] libceph: replace BUG_ON with bounds check for map->max_osd Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 554/568] usb: renesas_usbhs: Convert to platform remove callback returning void Greg Kroah-Hartman
` (21 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, NeilBrown, Chuck Lever
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neil@brown.name>
A recent change to clamp_t() in 6.1.y caused fs/nfsd/nfs4state.c to fail
to compile with gcc-9. The code in nfsd4_get_drc_mem() was written with
the assumption that when "max < min",
clamp(val, min, max)
would return max. This assumption is not documented as an API promise
and the change caused a compile failure if it could be statically
determined that "max < min".
The relevant code was no longer present upstream when commit 1519fbc8832b
("minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()")
landed there, so there is no upstream change to nfsd4_get_drc_mem() to
backport.
There is no clear case that the existing code in nfsd4_get_drc_mem()
is functioning incorrectly. The goal of this patch is to permit the clean
application of commit 1519fbc8832b ("minmax.h: use BUILD_BUG_ON_MSG() for
the lo < hi test in clamp()"), and any commits that depend on it, to LTS
kernels without affecting the ability to compile those kernels. This is
done by open-coding the __clamp() macro sans the built-in type checking.
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220745#c0
Signed-off-by: NeilBrown <neil@brown.name>
Stable-dep-of: 1519fbc8832b ("minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Reviewed_by: David Laight <david.laight.linux@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
Changes since Neil's post:
* Editorial changes to the commit message
* Attempt to address David's review comments
* Applied to linux-6.12.y, passed NFSD upstream CI suite
This patch is intended to be applied to linux-6.12.y, and should
apply cleanly to other LTS kernels since nfsd4_get_drc_mem hasn't
changed since v5.4.
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1823,8 +1823,10 @@ static u32 nfsd4_get_drc_mem(struct nfsd
*/
scale_factor = max_t(unsigned int, 8, nn->nfsd_serv->sv_nrthreads);
- avail = clamp_t(unsigned long, avail, slotsize,
- total_avail/scale_factor);
+ if (avail > total_avail / scale_factor)
+ avail = total_avail / scale_factor;
+ else if (avail < slotsize)
+ avail = slotsize;
num = min_t(int, num, avail / slotsize);
num = max_t(int, num, 1);
nfsd_drc_mem_used += num * slotsize;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 554/568] usb: renesas_usbhs: Convert to platform remove callback returning void
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (552 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 553/568] nfsd: Replace clamp_t in nfsd4_get_drc_mem() Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 555/568] usb: renesas_usbhs: Fix synchronous external abort on unbind Greg Kroah-Hartman
` (20 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König,
Yoshihiro Shimoda, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit 456a91ce7de4b9157fd5013c1e4dd8dd3c6daccb ]
The .remove() callback for a platform driver returns an int which makes
many driver authors wrongly assume it's possible to do error handling by
returning an error code. However the value returned is ignored (apart from
emitting a warning) and this typically results in resource leaks. To improve
here there is a quest to make the remove callback return void. In the first
step of this quest all drivers are converted to .remove_new() which already
returns void. Eventually after all drivers are converted, .remove_new() is
renamed to .remove().
Trivially convert this driver from always returning zero in the remove
callback to the void returning variant.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/20230517230239.187727-89-u.kleine-koenig@pengutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: eb9ac779830b ("usb: renesas_usbhs: Fix synchronous external abort on unbind")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/renesas_usbhs/common.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/drivers/usb/renesas_usbhs/common.c
+++ b/drivers/usb/renesas_usbhs/common.c
@@ -790,7 +790,7 @@ probe_pm_disable:
return ret;
}
-static int usbhs_remove(struct platform_device *pdev)
+static void usbhs_remove(struct platform_device *pdev)
{
struct usbhs_priv *priv = usbhs_pdev_to_priv(pdev);
@@ -810,8 +810,6 @@ static int usbhs_remove(struct platform_
usbhs_mod_remove(priv);
usbhs_fifo_remove(priv);
usbhs_pipe_remove(priv);
-
- return 0;
}
static __maybe_unused int usbhsc_suspend(struct device *dev)
@@ -856,7 +854,7 @@ static struct platform_driver renesas_us
.of_match_table = of_match_ptr(usbhs_of_match),
},
.probe = usbhs_probe,
- .remove = usbhs_remove,
+ .remove_new = usbhs_remove,
};
module_platform_driver(renesas_usbhs_driver);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 555/568] usb: renesas_usbhs: Fix synchronous external abort on unbind
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (553 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 554/568] usb: renesas_usbhs: Convert to platform remove callback returning void Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 556/568] iio: adc: rtq6056: Correct the sign bit index Greg Kroah-Hartman
` (19 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Claudiu Beznea, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
[ Upstream commit eb9ac779830b2235847b72cb15cf07c7e3333c5e ]
A synchronous external abort occurs on the Renesas RZ/G3S SoC if unbind is
executed after the configuration sequence described above:
modprobe usb_f_ecm
modprobe libcomposite
modprobe configfs
cd /sys/kernel/config/usb_gadget
mkdir -p g1
cd g1
echo "0x1d6b" > idVendor
echo "0x0104" > idProduct
mkdir -p strings/0x409
echo "0123456789" > strings/0x409/serialnumber
echo "Renesas." > strings/0x409/manufacturer
echo "Ethernet Gadget" > strings/0x409/product
mkdir -p functions/ecm.usb0
mkdir -p configs/c.1
mkdir -p configs/c.1/strings/0x409
echo "ECM" > configs/c.1/strings/0x409/configuration
if [ ! -L configs/c.1/ecm.usb0 ]; then
ln -s functions/ecm.usb0 configs/c.1
fi
echo 11e20000.usb > UDC
echo 11e20000.usb > /sys/bus/platform/drivers/renesas_usbhs/unbind
The displayed trace is as follows:
Internal error: synchronous external abort: 0000000096000010 [#1] SMP
CPU: 0 UID: 0 PID: 188 Comm: sh Tainted: G M 6.17.0-rc7-next-20250922-00010-g41050493b2bd #55 PREEMPT
Tainted: [M]=MACHINE_CHECK
Hardware name: Renesas SMARC EVK version 2 based on r9a08g045s33 (DT)
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : usbhs_sys_function_pullup+0x10/0x40 [renesas_usbhs]
lr : usbhsg_update_pullup+0x3c/0x68 [renesas_usbhs]
sp : ffff8000838b3920
x29: ffff8000838b3920 x28: ffff00000d585780 x27: 0000000000000000
x26: 0000000000000000 x25: 0000000000000000 x24: ffff00000c3e3810
x23: ffff00000d5e5c80 x22: ffff00000d5e5d40 x21: 0000000000000000
x20: 0000000000000000 x19: ffff00000d5e5c80 x18: 0000000000000020
x17: 2e30303230316531 x16: 312d7968703a7968 x15: 3d454d414e5f4344
x14: 000000000000002c x13: 0000000000000000 x12: 0000000000000000
x11: ffff00000f358f38 x10: ffff00000f358db0 x9 : ffff00000b41f418
x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff6364626d
x5 : 8080808000000000 x4 : 000000004b5ccb9d x3 : 0000000000000000
x2 : 0000000000000000 x1 : ffff800083790000 x0 : ffff00000d5e5c80
Call trace:
usbhs_sys_function_pullup+0x10/0x40 [renesas_usbhs] (P)
usbhsg_pullup+0x4c/0x7c [renesas_usbhs]
usb_gadget_disconnect_locked+0x48/0xd4
gadget_unbind_driver+0x44/0x114
device_remove+0x4c/0x80
device_release_driver_internal+0x1c8/0x224
device_release_driver+0x18/0x24
bus_remove_device+0xcc/0x10c
device_del+0x14c/0x404
usb_del_gadget+0x88/0xc0
usb_del_gadget_udc+0x18/0x30
usbhs_mod_gadget_remove+0x24/0x44 [renesas_usbhs]
usbhs_mod_remove+0x20/0x30 [renesas_usbhs]
usbhs_remove+0x98/0xdc [renesas_usbhs]
platform_remove+0x20/0x30
device_remove+0x4c/0x80
device_release_driver_internal+0x1c8/0x224
device_driver_detach+0x18/0x24
unbind_store+0xb4/0xb8
drv_attr_store+0x24/0x38
sysfs_kf_write+0x7c/0x94
kernfs_fop_write_iter+0x128/0x1b8
vfs_write+0x2ac/0x350
ksys_write+0x68/0xfc
__arm64_sys_write+0x1c/0x28
invoke_syscall+0x48/0x110
el0_svc_common.constprop.0+0xc0/0xe0
do_el0_svc+0x1c/0x28
el0_svc+0x34/0xf0
el0t_64_sync_handler+0xa0/0xe4
el0t_64_sync+0x198/0x19c
Code: 7100003f 1a9f07e1 531c6c22 f9400001 (79400021)
---[ end trace 0000000000000000 ]---
note: sh[188] exited with irqs disabled
note: sh[188] exited with preempt_count 1
The issue occurs because usbhs_sys_function_pullup(), which accesses the IP
registers, is executed after the USBHS clocks have been disabled. The
problem is reproducible on the Renesas RZ/G3S SoC starting with the
addition of module stop in the clock enable/disable APIs. With module stop
functionality enabled, a bus error is expected if a master accesses a
module whose clock has been stopped and module stop activated.
Disable the IP clocks at the end of remove.
Cc: stable <stable@kernel.org>
Fixes: f1407d5c6624 ("usb: renesas_usbhs: Add Renesas USBHS common code")
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Link: https://patch.msgid.link/20251027140741.557198-1-claudiu.beznea.uj@bp.renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/renesas_usbhs/common.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/drivers/usb/renesas_usbhs/common.c
+++ b/drivers/usb/renesas_usbhs/common.c
@@ -798,18 +798,18 @@ static void usbhs_remove(struct platform
flush_delayed_work(&priv->notify_hotplug_work);
- /* power off */
- if (!usbhs_get_dparam(priv, runtime_pwctrl))
- usbhsc_power_ctrl(priv, 0);
-
- pm_runtime_disable(&pdev->dev);
-
usbhs_platform_call(priv, hardware_exit, pdev);
- usbhsc_clk_put(priv);
reset_control_assert(priv->rsts);
usbhs_mod_remove(priv);
usbhs_fifo_remove(priv);
usbhs_pipe_remove(priv);
+
+ /* power off */
+ if (!usbhs_get_dparam(priv, runtime_pwctrl))
+ usbhsc_power_ctrl(priv, 0);
+
+ usbhsc_clk_put(priv);
+ pm_runtime_disable(&pdev->dev);
}
static __maybe_unused int usbhsc_suspend(struct device *dev)
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 556/568] iio: adc: rtq6056: Correct the sign bit index
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (554 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 555/568] usb: renesas_usbhs: Fix synchronous external abort on unbind Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 557/568] net: macb: fix unregister_netdev call order in macb_remove() Greg Kroah-Hartman
` (18 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Hsu, ChiYuan Huang,
David Lechner, Stable, Jonathan Cameron, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ChiYuan Huang <cy_huang@richtek.com>
[ Upstream commit 9b45744bf09fc2a3287e05287141d6e123c125a7 ]
The vshunt/current reported register is a signed 16bit integer. The
sign bit index should be '15', not '16'.
Fixes: 4396f45d211b ("iio: adc: Add rtq6056 support")
Reported-by: Andy Hsu <andy_ya_hsu@wiwynn.com>
Signed-off-by: ChiYuan Huang <cy_huang@richtek.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
[ adapted switch statement to existing if-else structure for sign_extend32() fix ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/rtq6056.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/adc/rtq6056.c
+++ b/drivers/iio/adc/rtq6056.c
@@ -171,7 +171,7 @@ static int rtq6056_adc_read_channel(stru
if (addr == RTQ6056_REG_BUSVOLT || addr == RTQ6056_REG_POWER)
*val = regval;
else
- *val = sign_extend32(regval, 16);
+ *val = sign_extend32(regval, 15);
return IIO_VAL_INT;
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 557/568] net: macb: fix unregister_netdev call order in macb_remove()
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (555 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 556/568] iio: adc: rtq6056: Correct the sign bit index Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 558/568] selftests: mptcp: join: endpoints: longer transfer Greg Kroah-Hartman
` (17 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, luoguangfei, Jakub Kicinski,
Alva Lan
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: luoguangfei <15388634752@163.com>
[ Upstream commit 01b9128c5db1b470575d07b05b67ffa3cb02ebf1 ]
When removing a macb device, the driver calls phy_exit() before
unregister_netdev(). This leads to a WARN from kernfs:
------------[ cut here ]------------
kernfs: can not remove 'attached_dev', no directory
WARNING: CPU: 1 PID: 27146 at fs/kernfs/dir.c:1683
Call trace:
kernfs_remove_by_name_ns+0xd8/0xf0
sysfs_remove_link+0x24/0x58
phy_detach+0x5c/0x168
phy_disconnect+0x4c/0x70
phylink_disconnect_phy+0x6c/0xc0 [phylink]
macb_close+0x6c/0x170 [macb]
...
macb_remove+0x60/0x168 [macb]
platform_remove+0x5c/0x80
...
The warning happens because the PHY is being exited while the netdev
is still registered. The correct order is to unregister the netdev
before shutting down the PHY and cleaning up the MDIO bus.
Fix this by moving unregister_netdev() ahead of phy_exit() in
macb_remove().
Fixes: 8b73fa3ae02b ("net: macb: Added ZynqMP-specific initialization")
Signed-off-by: luoguangfei <15388634752@163.com>
Link: https://patch.msgid.link/20250818232527.1316-1-15388634752@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ Minor context change fixed. ]
Signed-off-by: Alva Lan <alvalan9@foxmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/cadence/macb_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -5068,11 +5068,11 @@ static int macb_remove(struct platform_d
if (dev) {
bp = netdev_priv(dev);
+ unregister_netdev(dev);
phy_exit(bp->sgmii_phy);
mdiobus_unregister(bp->mii_bus);
mdiobus_free(bp->mii_bus);
- unregister_netdev(dev);
tasklet_kill(&bp->hresp_err_tasklet);
pm_runtime_disable(&pdev->dev);
pm_runtime_dont_use_autosuspend(&pdev->dev);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 558/568] selftests: mptcp: join: endpoints: longer transfer
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (556 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 557/568] net: macb: fix unregister_netdev call order in macb_remove() Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 559/568] mptcp: fix duplicate reset on fastclose Greg Kroah-Hartman
` (16 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geliang Tang, Matthieu Baerts (NGI0),
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
[ Upstream commit 6457595db9870298ee30b6d75287b8548e33fe19 ]
In rare cases, when the test environment is very slow, some userspace
tests can fail because some expected events have not been seen.
Because the tests are expecting a long on-going connection, and they are
not waiting for the end of the transfer, it is fine to make the
connection longer. This connection will be killed at the end, after the
verifications, so making it longer doesn't change anything, apart from
avoid it to end before the end of the verifications
To play it safe, all endpoints tests not waiting for the end of the
transfer are now sharing a longer file (128KB) at slow speed.
Fixes: 69c6ce7b6eca ("selftests: mptcp: add implicit endpoint test case")
Cc: stable@vger.kernel.org
Fixes: e274f7154008 ("selftests: mptcp: add subflow limits test-cases")
Fixes: b5e2fb832f48 ("selftests: mptcp: add explicit test case for remove/readd")
Fixes: e06959e9eebd ("selftests: mptcp: join: test for flush/re-add endpoints")
Reviewed-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-3-a4332c714e10@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ removed curly braces and stderr redirection ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Conflicts in mptcp_join.sh because commit 0c93af1f8907 ("selftests:
mptcp: drop test_linkfail parameter") is not in this version. It moved
the 4th parameter to an env var. To fix the conflicts, the new value
simply needs to be added as the 4th argument instead of an env var. ]
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/mptcp/mptcp_join.sh | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
@@ -3313,7 +3313,7 @@ endpoint_tests()
pm_nl_set_limits $ns1 2 2
pm_nl_set_limits $ns2 2 2
pm_nl_add_endpoint $ns1 10.0.2.1 flags signal
- run_tests $ns1 $ns2 10.0.1.1 0 0 0 slow 2>/dev/null &
+ run_tests $ns1 $ns2 10.0.1.1 128 0 0 slow 2>/dev/null &
wait_mpj $ns1
pm_nl_check_endpoint 1 "creation" \
@@ -3336,7 +3336,7 @@ endpoint_tests()
pm_nl_set_limits $ns2 0 3
pm_nl_add_endpoint $ns2 10.0.1.2 id 1 dev ns2eth1 flags subflow
pm_nl_add_endpoint $ns2 10.0.2.2 id 2 dev ns2eth2 flags subflow
- run_tests $ns1 $ns2 10.0.1.1 4 0 0 speed_5 2>/dev/null &
+ run_tests $ns1 $ns2 10.0.1.1 128 0 0 speed_5 2>/dev/null &
local tests_pid=$!
wait_mpj $ns2
@@ -3401,7 +3401,7 @@ endpoint_tests()
# broadcast IP: no packet for this address will be received on ns1
pm_nl_add_endpoint $ns1 224.0.0.1 id 2 flags signal
pm_nl_add_endpoint $ns1 10.0.1.1 id 42 flags signal
- run_tests $ns1 $ns2 10.0.1.1 4 0 0 speed_5 2>/dev/null &
+ run_tests $ns1 $ns2 10.0.1.1 128 0 0 speed_5 2>/dev/null &
local tests_pid=$!
wait_mpj $ns2
@@ -3464,7 +3464,7 @@ endpoint_tests()
# broadcast IP: no packet for this address will be received on ns1
pm_nl_add_endpoint $ns1 224.0.0.1 id 2 flags signal
pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow
- run_tests $ns1 $ns2 10.0.1.1 4 0 0 speed_20 2>/dev/null &
+ run_tests $ns1 $ns2 10.0.1.1 128 0 0 speed_20 2>/dev/null &
local tests_pid=$!
wait_attempt_fail $ns2
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 559/568] mptcp: fix duplicate reset on fastclose
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (557 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 558/568] selftests: mptcp: join: endpoints: longer transfer Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 560/568] mptcp: Fix proto fallback detection with BPF Greg Kroah-Hartman
` (15 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Geliang Tang,
Matthieu Baerts (NGI0), Jakub Kicinski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <pabeni@redhat.com>
commit ae155060247be8dcae3802a95bd1bdf93ab3215d upstream.
The CI reports sporadic failures of the fastclose self-tests. The root
cause is a duplicate reset, not carrying the relevant MPTCP option.
In the failing scenario the bad reset is received by the peer before
the fastclose one, preventing the reception of the latter.
Indeed there is window of opportunity at fastclose time for the
following race:
mptcp_do_fastclose
__mptcp_close_ssk
__tcp_close()
tcp_set_state() [1]
tcp_send_active_reset() [2]
After [1] the stack will send reset to in-flight data reaching the now
closed port. Such reset may race with [2].
Address the issue explicitly sending a single reset on fastclose before
explicitly moving the subflow to close status.
Fixes: d21f83485518 ("mptcp: use fastclose on more edge scenarios")
Cc: stable@vger.kernel.org
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/596
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Geliang Tang <geliang@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-6-806d3781c95f@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ Conflicts in protocol.c, because commit bbd49d114d57 ("mptcp:
consolidate transition to TCP_CLOSE in mptcp_do_fastclose()") is not
in this version. It introduced a new line in the context. The same
modification can still be applied.
Also, tcp_send_active_reset() doesn't take a 3rd argument
(sk_rst_reason) in this version, see commit 5691276b39da ("rstreason:
prepare for active reset"). This argument is only helpful for tracing,
it is fine to drop it. ]
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/protocol.c | 34 +++++++++++++++++++++-------------
1 file changed, 21 insertions(+), 13 deletions(-)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -2440,7 +2440,6 @@ bool __mptcp_retransmit_pending_data(str
/* flags for __mptcp_close_ssk() */
#define MPTCP_CF_PUSH BIT(1)
-#define MPTCP_CF_FASTCLOSE BIT(2)
/* be sure to send a reset only if the caller asked for it, also
* clean completely the subflow status when the subflow reaches
@@ -2451,7 +2450,7 @@ static void __mptcp_subflow_disconnect(s
unsigned int flags)
{
if (((1 << ssk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) ||
- (flags & MPTCP_CF_FASTCLOSE)) {
+ subflow->send_fastclose) {
/* The MPTCP code never wait on the subflow sockets, TCP-level
* disconnect should never fail
*/
@@ -2498,14 +2497,8 @@ static void __mptcp_close_ssk(struct soc
lock_sock_nested(ssk, SINGLE_DEPTH_NESTING);
- if ((flags & MPTCP_CF_FASTCLOSE) && !__mptcp_check_fallback(msk)) {
- /* be sure to force the tcp_close path
- * to generate the egress reset
- */
- ssk->sk_lingertime = 0;
- sock_set_flag(ssk, SOCK_LINGER);
- subflow->send_fastclose = 1;
- }
+ if (subflow->send_fastclose && ssk->sk_state != TCP_CLOSE)
+ tcp_set_state(ssk, TCP_CLOSE);
need_push = (flags & MPTCP_CF_PUSH) && __mptcp_retransmit_pending_data(sk);
if (!dispose_it) {
@@ -2794,9 +2787,24 @@ static void mptcp_do_fastclose(struct so
struct mptcp_subflow_context *subflow, *tmp;
struct mptcp_sock *msk = mptcp_sk(sk);
- mptcp_for_each_subflow_safe(msk, subflow, tmp)
- __mptcp_close_ssk(sk, mptcp_subflow_tcp_sock(subflow),
- subflow, MPTCP_CF_FASTCLOSE);
+ /* Explicitly send the fastclose reset as need */
+ if (__mptcp_check_fallback(msk))
+ return;
+
+ mptcp_for_each_subflow_safe(msk, subflow, tmp) {
+ struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
+
+ lock_sock(ssk);
+
+ /* Some subflow socket states don't allow/need a reset.*/
+ if ((1 << ssk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
+ goto unlock;
+
+ subflow->send_fastclose = 1;
+ tcp_send_active_reset(ssk, ssk->sk_allocation);
+unlock:
+ release_sock(ssk);
+ }
}
static void mptcp_worker(struct work_struct *work)
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 560/568] mptcp: Fix proto fallback detection with BPF
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (558 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 559/568] mptcp: fix duplicate reset on fastclose Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 561/568] staging: rtl8712: Remove driver using deprecated API wext Greg Kroah-Hartman
` (14 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiayuan Chen, Martin KaFai Lau,
Jakub Sitnicki, Matthieu Baerts (NGI0)
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <jiayuan.chen@linux.dev>
commit c77b3b79a92e3345aa1ee296180d1af4e7031f8f upstream.
The sockmap feature allows bpf syscall from userspace, or based
on bpf sockops, replacing the sk_prot of sockets during protocol stack
processing with sockmap's custom read/write interfaces.
'''
tcp_rcv_state_process()
syn_recv_sock()/subflow_syn_recv_sock()
tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB)
bpf_skops_established <== sockops
bpf_sock_map_update(sk) <== call bpf helper
tcp_bpf_update_proto() <== update sk_prot
'''
When the server has MPTCP enabled but the client sends a TCP SYN
without MPTCP, subflow_syn_recv_sock() performs a fallback on the
subflow, replacing the subflow sk's sk_prot with the native sk_prot.
'''
subflow_syn_recv_sock()
subflow_ulp_fallback()
subflow_drop_ctx()
mptcp_subflow_ops_undo_override()
'''
Then, this subflow can be normally used by sockmap, which replaces the
native sk_prot with sockmap's custom sk_prot. The issue occurs when the
user executes accept::mptcp_stream_accept::mptcp_fallback_tcp_ops().
Here, it uses sk->sk_prot to compare with the native sk_prot, but this
is incorrect when sockmap is used, as we may incorrectly set
sk->sk_socket->ops.
This fix uses the more generic sk_family for the comparison instead.
Additionally, this also prevents a WARNING from occurring:
result from ./scripts/decode_stacktrace.sh:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 337 at net/mptcp/protocol.c:68 mptcp_stream_accept \
(net/mptcp/protocol.c:4005)
Modules linked in:
...
PKRU: 55555554
Call Trace:
<TASK>
do_accept (net/socket.c:1989)
__sys_accept4 (net/socket.c:2028 net/socket.c:2057)
__x64_sys_accept (net/socket.c:2067)
x64_sys_call (arch/x86/entry/syscall_64.c:41)
do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
RIP: 0033:0x7f87ac92b83d
---[ end trace 0000000000000000 ]---
Fixes: 0b4f33def7bb ("mptcp: fix tcp fallback crash")
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20251111060307.194196-3-jiayuan.chen@linux.dev
[ Conflicts in protocol.c, because commit 8e2b8a9fa512 ("mptcp: don't
overwrite sock_ops in mptcp_is_tcpsk()") is not in this version. It
changes the logic on how and where the sock_ops is overridden in case
of passive fallback. To fix this, mptcp_is_tcpsk() is modified to use
the family, but first, a check of the protocol is required to continue
returning 'false' in case of MPTCP socket. ]
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/protocol.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -79,8 +79,13 @@ static u64 mptcp_wnd_end(const struct mp
static bool mptcp_is_tcpsk(struct sock *sk)
{
struct socket *sock = sk->sk_socket;
+ unsigned short family;
- if (unlikely(sk->sk_prot == &tcp_prot)) {
+ if (likely(sk->sk_protocol == IPPROTO_MPTCP))
+ return false;
+
+ family = READ_ONCE(sk->sk_family);
+ if (unlikely(family == AF_INET)) {
/* we are being invoked after mptcp_accept() has
* accepted a non-mp-capable flow: sk is a tcp_sk,
* not an mptcp one.
@@ -91,7 +96,7 @@ static bool mptcp_is_tcpsk(struct sock *
sock->ops = &inet_stream_ops;
return true;
#if IS_ENABLED(CONFIG_MPTCP_IPV6)
- } else if (unlikely(sk->sk_prot == &tcpv6_prot)) {
+ } else if (unlikely(family == AF_INET6)) {
sock->ops = &inet6_stream_ops;
return true;
#endif
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 561/568] staging: rtl8712: Remove driver using deprecated API wext
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (559 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 560/568] mptcp: Fix proto fallback detection with BPF Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 562/568] ksmbd: fix use-after-free in session logoff Greg Kroah-Hartman
` (13 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Philipp Hortmann,
Dominik Karol Piątkowski, Guenter Roeck
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Hortmann <philipp.g.hortmann@gmail.com>
commit e8785404de06a69d89dcdd1e9a0b6ea42dc6d327 upstream.
This driver is in the staging area since 2010.
The following reasons lead to the removal:
- This driver generates maintenance workload for itself and for API wext
- A MAC80211 driver was available in 2016 time frame; This driver does
not compile anymore but would be a better starting point than the
current driver. Here the note from the TODO file:
A replacement for this driver with MAC80211 support is available
at https://github.com/chunkeey/rtl8192su
- no progress changing to mac80211
- Using this hardware is security wise not state of the art as WPA3 is
not supported.
Find further discussions in the Link below.
Link: https://lore.kernel.org/linux-staging/a02e3e0b-8a9b-47d5-87cf-2c957a474daa@gmail.com/T/#t
Signed-off-by: Philipp Hortmann <philipp.g.hortmann@gmail.com>
Tested-by: Dominik Karol Piątkowski <dominik.karol.piatkowski@protonmail.com>
Link: https://lore.kernel.org/r/20241020144933.10956-1-philipp.g.hortmann@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[groeck: Resolved conflicts; dropped statement about hardware support in longterm kernels]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
MAINTAINERS | 6
drivers/staging/Kconfig | 2
drivers/staging/Makefile | 1
drivers/staging/rtl8712/Kconfig | 21
drivers/staging/rtl8712/Makefile | 35
drivers/staging/rtl8712/TODO | 13
drivers/staging/rtl8712/basic_types.h | 28
drivers/staging/rtl8712/drv_types.h | 175 -
drivers/staging/rtl8712/ethernet.h | 21
drivers/staging/rtl8712/hal_init.c | 401 ---
drivers/staging/rtl8712/ieee80211.c | 415 ---
drivers/staging/rtl8712/ieee80211.h | 165 -
drivers/staging/rtl8712/mlme_linux.c | 160 -
drivers/staging/rtl8712/mlme_osdep.h | 31
drivers/staging/rtl8712/mp_custom_oid.h | 287 --
drivers/staging/rtl8712/os_intfs.c | 465 ---
drivers/staging/rtl8712/osdep_intf.h | 32
drivers/staging/rtl8712/osdep_service.h | 60
drivers/staging/rtl8712/recv_linux.c | 139 -
drivers/staging/rtl8712/recv_osdep.h | 39
drivers/staging/rtl8712/rtl8712_bitdef.h | 26
drivers/staging/rtl8712/rtl8712_cmd.c | 409 ---
drivers/staging/rtl8712/rtl8712_cmd.h | 231 -
drivers/staging/rtl8712/rtl8712_cmdctrl_bitdef.h | 95
drivers/staging/rtl8712/rtl8712_cmdctrl_regdef.h | 19
drivers/staging/rtl8712/rtl8712_debugctrl_bitdef.h | 41
drivers/staging/rtl8712/rtl8712_debugctrl_regdef.h | 32
drivers/staging/rtl8712/rtl8712_edcasetting_bitdef.h | 65
drivers/staging/rtl8712/rtl8712_edcasetting_regdef.h | 24
drivers/staging/rtl8712/rtl8712_efuse.c | 564 ----
drivers/staging/rtl8712/rtl8712_efuse.h | 43
drivers/staging/rtl8712/rtl8712_event.h | 86
drivers/staging/rtl8712/rtl8712_fifoctrl_bitdef.h | 131 -
drivers/staging/rtl8712/rtl8712_fifoctrl_regdef.h | 61
drivers/staging/rtl8712/rtl8712_gp_bitdef.h | 68
drivers/staging/rtl8712/rtl8712_gp_regdef.h | 29
drivers/staging/rtl8712/rtl8712_hal.h | 142 -
drivers/staging/rtl8712/rtl8712_interrupt_bitdef.h | 44
drivers/staging/rtl8712/rtl8712_io.c | 99
drivers/staging/rtl8712/rtl8712_led.c | 1830 --------------
drivers/staging/rtl8712/rtl8712_macsetting_bitdef.h | 31
drivers/staging/rtl8712/rtl8712_macsetting_regdef.h | 20
drivers/staging/rtl8712/rtl8712_powersave_bitdef.h | 39
drivers/staging/rtl8712/rtl8712_powersave_regdef.h | 26
drivers/staging/rtl8712/rtl8712_ratectrl_bitdef.h | 36
drivers/staging/rtl8712/rtl8712_ratectrl_regdef.h | 43
drivers/staging/rtl8712/rtl8712_recv.c | 1079 --------
drivers/staging/rtl8712/rtl8712_recv.h | 145 -
drivers/staging/rtl8712/rtl8712_regdef.h | 32
drivers/staging/rtl8712/rtl8712_security_bitdef.h | 34
drivers/staging/rtl8712/rtl8712_spec.h | 121
drivers/staging/rtl8712/rtl8712_syscfg_bitdef.h | 163 -
drivers/staging/rtl8712/rtl8712_syscfg_regdef.h | 42
drivers/staging/rtl8712/rtl8712_timectrl_bitdef.h | 49
drivers/staging/rtl8712/rtl8712_timectrl_regdef.h | 26
drivers/staging/rtl8712/rtl8712_wmac_bitdef.h | 49
drivers/staging/rtl8712/rtl8712_wmac_regdef.h | 36
drivers/staging/rtl8712/rtl8712_xmit.c | 745 ------
drivers/staging/rtl8712/rtl8712_xmit.h | 108
drivers/staging/rtl8712/rtl871x_cmd.c | 796 ------
drivers/staging/rtl8712/rtl871x_cmd.h | 761 ------
drivers/staging/rtl8712/rtl871x_debug.h | 130 -
drivers/staging/rtl8712/rtl871x_eeprom.c | 220 -
drivers/staging/rtl8712/rtl871x_eeprom.h | 88
drivers/staging/rtl8712/rtl871x_event.h | 109
drivers/staging/rtl8712/rtl871x_ht.h | 33
drivers/staging/rtl8712/rtl871x_io.c | 147 -
drivers/staging/rtl8712/rtl871x_io.h | 236 -
drivers/staging/rtl8712/rtl871x_ioctl.h | 94
drivers/staging/rtl8712/rtl871x_ioctl_linux.c | 2330 -------------------
drivers/staging/rtl8712/rtl871x_ioctl_rtl.c | 519 ----
drivers/staging/rtl8712/rtl871x_ioctl_rtl.h | 109
drivers/staging/rtl8712/rtl871x_ioctl_set.c | 354 --
drivers/staging/rtl8712/rtl871x_ioctl_set.h | 45
drivers/staging/rtl8712/rtl871x_led.h | 118
drivers/staging/rtl8712/rtl871x_mlme.c | 1709 -------------
drivers/staging/rtl8712/rtl871x_mlme.h | 205 -
drivers/staging/rtl8712/rtl871x_mp.c | 724 -----
drivers/staging/rtl8712/rtl871x_mp.h | 275 --
drivers/staging/rtl8712/rtl871x_mp_ioctl.c | 883 -------
drivers/staging/rtl8712/rtl871x_mp_ioctl.h | 328 --
drivers/staging/rtl8712/rtl871x_mp_phy_regdef.h | 1034 --------
drivers/staging/rtl8712/rtl871x_pwrctrl.c | 234 -
drivers/staging/rtl8712/rtl871x_pwrctrl.h | 113
drivers/staging/rtl8712/rtl871x_recv.c | 669 -----
drivers/staging/rtl8712/rtl871x_recv.h | 208 -
drivers/staging/rtl8712/rtl871x_rf.h | 55
drivers/staging/rtl8712/rtl871x_security.c | 1386 -----------
drivers/staging/rtl8712/rtl871x_security.h | 218 -
drivers/staging/rtl8712/rtl871x_sta_mgt.c | 263 --
drivers/staging/rtl8712/rtl871x_wlan_sme.h | 35
drivers/staging/rtl8712/rtl871x_xmit.c | 1059 --------
drivers/staging/rtl8712/rtl871x_xmit.h | 288 --
drivers/staging/rtl8712/sta_info.h | 132 -
drivers/staging/rtl8712/usb_halinit.c | 307 --
drivers/staging/rtl8712/usb_intf.c | 638 -----
drivers/staging/rtl8712/usb_ops.c | 195 -
drivers/staging/rtl8712/usb_ops.h | 38
drivers/staging/rtl8712/usb_ops_linux.c | 515 ----
drivers/staging/rtl8712/usb_osintf.h | 35
drivers/staging/rtl8712/wifi.h | 196 -
drivers/staging/rtl8712/wlan_bssdef.h | 223 -
drivers/staging/rtl8712/xmit_linux.c | 181 -
drivers/staging/rtl8712/xmit_osdep.h | 52
104 files changed, 27646 deletions(-)
delete mode 100644 drivers/staging/rtl8712/Kconfig
delete mode 100644 drivers/staging/rtl8712/Makefile
delete mode 100644 drivers/staging/rtl8712/TODO
delete mode 100644 drivers/staging/rtl8712/basic_types.h
delete mode 100644 drivers/staging/rtl8712/drv_types.h
delete mode 100644 drivers/staging/rtl8712/ethernet.h
delete mode 100644 drivers/staging/rtl8712/hal_init.c
delete mode 100644 drivers/staging/rtl8712/ieee80211.c
delete mode 100644 drivers/staging/rtl8712/ieee80211.h
delete mode 100644 drivers/staging/rtl8712/mlme_linux.c
delete mode 100644 drivers/staging/rtl8712/mlme_osdep.h
delete mode 100644 drivers/staging/rtl8712/mp_custom_oid.h
delete mode 100644 drivers/staging/rtl8712/os_intfs.c
delete mode 100644 drivers/staging/rtl8712/osdep_intf.h
delete mode 100644 drivers/staging/rtl8712/osdep_service.h
delete mode 100644 drivers/staging/rtl8712/recv_linux.c
delete mode 100644 drivers/staging/rtl8712/recv_osdep.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_bitdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_cmd.c
delete mode 100644 drivers/staging/rtl8712/rtl8712_cmd.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_cmdctrl_bitdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_cmdctrl_regdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_debugctrl_bitdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_debugctrl_regdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_edcasetting_bitdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_edcasetting_regdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_efuse.c
delete mode 100644 drivers/staging/rtl8712/rtl8712_efuse.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_event.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_fifoctrl_bitdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_fifoctrl_regdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_gp_bitdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_gp_regdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_hal.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_interrupt_bitdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_io.c
delete mode 100644 drivers/staging/rtl8712/rtl8712_led.c
delete mode 100644 drivers/staging/rtl8712/rtl8712_macsetting_bitdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_macsetting_regdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_powersave_bitdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_powersave_regdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_ratectrl_bitdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_ratectrl_regdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_recv.c
delete mode 100644 drivers/staging/rtl8712/rtl8712_recv.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_regdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_security_bitdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_spec.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_syscfg_bitdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_syscfg_regdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_timectrl_bitdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_timectrl_regdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_wmac_bitdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_wmac_regdef.h
delete mode 100644 drivers/staging/rtl8712/rtl8712_xmit.c
delete mode 100644 drivers/staging/rtl8712/rtl8712_xmit.h
delete mode 100644 drivers/staging/rtl8712/rtl871x_cmd.c
delete mode 100644 drivers/staging/rtl8712/rtl871x_cmd.h
delete mode 100644 drivers/staging/rtl8712/rtl871x_debug.h
delete mode 100644 drivers/staging/rtl8712/rtl871x_eeprom.c
delete mode 100644 drivers/staging/rtl8712/rtl871x_eeprom.h
delete mode 100644 drivers/staging/rtl8712/rtl871x_event.h
delete mode 100644 drivers/staging/rtl8712/rtl871x_ht.h
delete mode 100644 drivers/staging/rtl8712/rtl871x_io.c
delete mode 100644 drivers/staging/rtl8712/rtl871x_io.h
delete mode 100644 drivers/staging/rtl8712/rtl871x_ioctl.h
delete mode 100644 drivers/staging/rtl8712/rtl871x_ioctl_linux.c
delete mode 100644 drivers/staging/rtl8712/rtl871x_ioctl_rtl.c
delete mode 100644 drivers/staging/rtl8712/rtl871x_ioctl_rtl.h
delete mode 100644 drivers/staging/rtl8712/rtl871x_ioctl_set.c
delete mode 100644 drivers/staging/rtl8712/rtl871x_ioctl_set.h
delete mode 100644 drivers/staging/rtl8712/rtl871x_led.h
delete mode 100644 drivers/staging/rtl8712/rtl871x_mlme.c
delete mode 100644 drivers/staging/rtl8712/rtl871x_mlme.h
delete mode 100644 drivers/staging/rtl8712/rtl871x_mp.c
delete mode 100644 drivers/staging/rtl8712/rtl871x_mp.h
delete mode 100644 drivers/staging/rtl8712/rtl871x_mp_ioctl.c
delete mode 100644 drivers/staging/rtl8712/rtl871x_mp_ioctl.h
delete mode 100644 drivers/staging/rtl8712/rtl871x_mp_phy_regdef.h
delete mode 100644 drivers/staging/rtl8712/rtl871x_pwrctrl.c
delete mode 100644 drivers/staging/rtl8712/rtl871x_pwrctrl.h
delete mode 100644 drivers/staging/rtl8712/rtl871x_recv.c
delete mode 100644 drivers/staging/rtl8712/rtl871x_recv.h
delete mode 100644 drivers/staging/rtl8712/rtl871x_rf.h
delete mode 100644 drivers/staging/rtl8712/rtl871x_security.c
delete mode 100644 drivers/staging/rtl8712/rtl871x_security.h
delete mode 100644 drivers/staging/rtl8712/rtl871x_sta_mgt.c
delete mode 100644 drivers/staging/rtl8712/rtl871x_wlan_sme.h
delete mode 100644 drivers/staging/rtl8712/rtl871x_xmit.c
delete mode 100644 drivers/staging/rtl8712/rtl871x_xmit.h
delete mode 100644 drivers/staging/rtl8712/sta_info.h
delete mode 100644 drivers/staging/rtl8712/usb_halinit.c
delete mode 100644 drivers/staging/rtl8712/usb_intf.c
delete mode 100644 drivers/staging/rtl8712/usb_ops.c
delete mode 100644 drivers/staging/rtl8712/usb_ops.h
delete mode 100644 drivers/staging/rtl8712/usb_ops_linux.c
delete mode 100644 drivers/staging/rtl8712/usb_osintf.h
delete mode 100644 drivers/staging/rtl8712/wifi.h
delete mode 100644 drivers/staging/rtl8712/wlan_bssdef.h
delete mode 100644 drivers/staging/rtl8712/xmit_linux.c
delete mode 100644 drivers/staging/rtl8712/xmit_osdep.h
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -19602,12 +19602,6 @@ R: Pavel Skripkin <paskripkin@gmail.com>
S: Supported
F: drivers/staging/r8188eu/
-STAGING - REALTEK RTL8712U DRIVERS
-M: Larry Finger <Larry.Finger@lwfinger.net>
-M: Florian Schilhabel <florian.c.schilhabel@googlemail.com>.
-S: Odd Fixes
-F: drivers/staging/rtl8712/
-
STAGING - SEPS525 LCD CONTROLLER DRIVERS
M: Michael Hennerich <michael.hennerich@analog.com>
L: linux-fbdev@vger.kernel.org
--- a/drivers/staging/Kconfig
+++ b/drivers/staging/Kconfig
@@ -34,8 +34,6 @@ source "drivers/staging/rtl8192e/Kconfig
source "drivers/staging/rtl8723bs/Kconfig"
-source "drivers/staging/rtl8712/Kconfig"
-
source "drivers/staging/r8188eu/Kconfig"
source "drivers/staging/rts5208/Kconfig"
--- a/drivers/staging/Makefile
+++ b/drivers/staging/Makefile
@@ -7,7 +7,6 @@ obj-$(CONFIG_FB_OLPC_DCON) += olpc_dcon/
obj-$(CONFIG_RTL8192U) += rtl8192u/
obj-$(CONFIG_RTL8192E) += rtl8192e/
obj-$(CONFIG_RTL8723BS) += rtl8723bs/
-obj-$(CONFIG_R8712U) += rtl8712/
obj-$(CONFIG_R8188EU) += r8188eu/
obj-$(CONFIG_RTS5208) += rts5208/
obj-$(CONFIG_OCTEON_ETHERNET) += octeon/
--- a/drivers/staging/rtl8712/Kconfig
+++ /dev/null
@@ -1,21 +0,0 @@
-# SPDX-License-Identifier: GPL-2.0
-config R8712U
- tristate "RealTek RTL8712U (RTL8192SU) Wireless LAN NIC driver"
- depends on WLAN && USB && CFG80211
- select WIRELESS_EXT
- select WEXT_PRIV
- select FW_LOADER
- help
- This option adds the Realtek RTL8712 USB device such as the
- D-Link DWA-130.
-
- If built as a module, it will be called r8712u.
-
-config R8712_TX_AGGR
- bool "Realtek RTL8712U Transmit Aggregation code"
- depends on R8712U && BROKEN
- help
- This option provides transmit aggregation for the Realtek
- RTL8712 USB device.
-
-
--- a/drivers/staging/rtl8712/Makefile
+++ /dev/null
@@ -1,35 +0,0 @@
-# SPDX-License-Identifier: GPL-2.0
-r8712u-y := \
- rtl871x_cmd.o \
- rtl8712_cmd.o \
- rtl871x_security.o \
- rtl871x_eeprom.o \
- rtl8712_efuse.o \
- hal_init.o \
- usb_halinit.o \
- usb_ops.o \
- usb_ops_linux.o \
- rtl871x_io.o \
- rtl8712_io.o \
- rtl871x_ioctl_linux.o \
- rtl871x_ioctl_rtl.o \
- rtl871x_ioctl_set.o \
- rtl8712_led.o \
- rtl871x_mlme.o \
- ieee80211.o \
- rtl871x_mp_ioctl.o \
- rtl871x_mp.o \
- mlme_linux.o \
- recv_linux.o \
- xmit_linux.o \
- usb_intf.o \
- os_intfs.o \
- rtl871x_pwrctrl.o \
- rtl8712_recv.o \
- rtl871x_recv.o \
- rtl871x_sta_mgt.o \
- rtl871x_xmit.o \
- rtl8712_xmit.o
-
-obj-$(CONFIG_R8712U) := r8712u.o
-
--- a/drivers/staging/rtl8712/TODO
+++ /dev/null
@@ -1,13 +0,0 @@
-TODO:
-- merge Realtek's bugfixes and new features into the driver
-- switch to use LIB80211
-- switch to use MAC80211
-- checkpatch.pl fixes - only a few remain
-
-A replacement for this driver with MAC80211 support is available
-at https://github.com/chunkeey/rtl8192su
-
-Please send any patches to Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
-Larry Finger <Larry.Finger@lwfinger.net>,
-Florian Schilhabel <florian.c.schilhabel@googlemail.com> and
-Linux Driver Project Developer List <driverdev-devel@linuxdriverproject.org>.
--- a/drivers/staging/rtl8712/basic_types.h
+++ /dev/null
@@ -1,28 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __BASIC_TYPES_H__
-#define __BASIC_TYPES_H__
-
-#include <linux/types.h>
-
-#define sint signed int
-
-/* Should we extend this to be host_addr_t and target_addr_t for case:
- * host : x86_64
- * target : mips64
- */
-#define addr_t unsigned long
-
-#endif /*__BASIC_TYPES_H__*/
-
--- a/drivers/staging/rtl8712/drv_types.h
+++ /dev/null
@@ -1,175 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-/* ---------------------------------------------------------------------
- *
- * For type defines and data structure defines
- *
- * ---------------------------------------------------------------------
- */
-#ifndef __DRV_TYPES_H__
-#define __DRV_TYPES_H__
-
-struct _adapter;
-
-#include "osdep_service.h"
-#include "wlan_bssdef.h"
-#include "rtl8712_spec.h"
-#include "rtl8712_hal.h"
-#include <linux/mutex.h>
-#include <linux/completion.h>
-
-enum _NIC_VERSION {
- RTL8711_NIC,
- RTL8712_NIC,
- RTL8713_NIC,
- RTL8716_NIC
-};
-
-struct qos_priv {
- /* bit mask option: u-apsd, s-apsd, ts, block ack... */
- unsigned int qos_option;
-};
-
-#include "rtl871x_ht.h"
-#include "rtl871x_cmd.h"
-#include "rtl871x_xmit.h"
-#include "rtl871x_recv.h"
-#include "rtl871x_security.h"
-#include "rtl871x_pwrctrl.h"
-#include "rtl871x_io.h"
-#include "rtl871x_eeprom.h"
-#include "sta_info.h"
-#include "rtl871x_mlme.h"
-#include "rtl871x_mp.h"
-#include "rtl871x_debug.h"
-#include "rtl871x_rf.h"
-#include "rtl871x_event.h"
-#include "rtl871x_led.h"
-
-#define SPEC_DEV_ID_DISABLE_HT BIT(1)
-
-struct specific_device_id {
- u32 flags;
- u16 idVendor;
- u16 idProduct;
-
-};
-
-struct registry_priv {
- u8 chip_version;
- u8 rfintfs;
- u8 lbkmode;
- u8 hci;
- u8 network_mode; /*infra, ad-hoc, auto*/
- struct ndis_802_11_ssid ssid;
- u8 channel;/* ad-hoc support requirement */
- u8 wireless_mode;/* A, B, G, auto */
- u8 vrtl_carrier_sense; /*Enable, Disable, Auto*/
- u8 vcs_type;/*RTS/CTS, CTS-to-self*/
- u16 rts_thresh;
- u16 frag_thresh;
- u8 preamble;/*long, short, auto*/
- u8 scan_mode;/*active, passive*/
- u8 adhoc_tx_pwr;
- u8 soft_ap;
- u8 smart_ps;
- u8 power_mgnt;
- u8 radio_enable;
- u8 long_retry_lmt;
- u8 short_retry_lmt;
- u16 busy_thresh;
- u8 ack_policy;
- u8 mp_mode;
- u8 software_encrypt;
- u8 software_decrypt;
- /* UAPSD */
- u8 wmm_enable;
- u8 uapsd_enable;
- u8 uapsd_max_sp;
- u8 uapsd_acbk_en;
- u8 uapsd_acbe_en;
- u8 uapsd_acvi_en;
- u8 uapsd_acvo_en;
-
- struct wlan_bssid_ex dev_network;
-
- u8 ht_enable;
- u8 cbw40_enable;
- u8 ampdu_enable;/*for tx*/
- u8 rf_config;
- u8 low_power;
- u8 wifi_test;
-};
-
-struct dvobj_priv {
- struct _adapter *padapter;
- u32 nr_endpoint;
- u8 ishighspeed;
- uint (*inirp_init)(struct _adapter *adapter);
- uint (*inirp_deinit)(struct _adapter *adapter);
- struct usb_device *pusbdev;
-};
-
-/**
- * struct _adapter - the main adapter structure for this device.
- *
- * bup: True indicates that the interface is up.
- */
-struct _adapter {
- struct dvobj_priv dvobjpriv;
- struct mlme_priv mlmepriv;
- struct cmd_priv cmdpriv;
- struct evt_priv evtpriv;
- struct io_queue *pio_queue;
- struct xmit_priv xmitpriv;
- struct recv_priv recvpriv;
- struct sta_priv stapriv;
- struct security_priv securitypriv;
- struct registry_priv registrypriv;
- struct wlan_acl_pool acl_list;
- struct pwrctrl_priv pwrctrlpriv;
- struct eeprom_priv eeprompriv;
- struct hal_priv halpriv;
- struct led_priv ledpriv;
- struct mp_priv mppriv;
- bool driver_stopped;
- bool surprise_removed;
- bool suspended;
- u8 eeprom_address_size;
- u8 hw_init_completed;
- struct task_struct *cmd_thread;
- uint (*dvobj_init)(struct _adapter *adapter);
- void (*dvobj_deinit)(struct _adapter *adapter);
- struct net_device *pnetdev;
- int bup;
- struct net_device_stats stats;
- struct iw_statistics iwstats;
- int pid; /*process id from UI*/
- struct work_struct wk_filter_rx_ff0;
- const struct firmware *fw;
- struct usb_interface *pusb_intf;
- struct mutex mutex_start;
- struct completion rtl8712_fw_ready;
- struct completion rx_filter_ready;
-};
-
-static inline u8 *myid(struct eeprom_priv *peepriv)
-{
- return peepriv->mac_addr;
-}
-
-u8 r8712_usb_hal_bus_init(struct _adapter *adapter);
-
-#endif /*__DRV_TYPES_H__*/
-
--- a/drivers/staging/rtl8712/ethernet.h
+++ /dev/null
@@ -1,21 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __INC_ETHERNET_H
-#define __INC_ETHERNET_H
-
-#define ETHERNET_HEADER_SIZE 14 /*!< Ethernet Header Length*/
-#define LLC_HEADER_SIZE 6 /*!< LLC Header Length*/
-
-#endif /* #ifndef __INC_ETHERNET_H */
-
--- a/drivers/staging/rtl8712/hal_init.c
+++ /dev/null
@@ -1,401 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>.
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _HAL_INIT_C_
-
-#include <linux/usb.h>
-#include <linux/device.h>
-#include <linux/usb/ch9.h>
-#include <linux/firmware.h>
-#include <linux/module.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "usb_osintf.h"
-
-#define FWBUFF_ALIGN_SZ 512
-#define MAX_DUMP_FWSZ (48 * 1024)
-
-static void rtl871x_load_fw_fail(struct _adapter *adapter)
-{
- struct usb_device *udev = adapter->dvobjpriv.pusbdev;
- struct device *dev = &udev->dev;
- struct device *parent = dev->parent;
-
- complete(&adapter->rtl8712_fw_ready);
-
- dev_err(&udev->dev, "r8712u: Firmware request failed\n");
-
- if (parent)
- device_lock(parent);
-
- device_release_driver(dev);
-
- if (parent)
- device_unlock(parent);
-}
-
-static void rtl871x_load_fw_cb(const struct firmware *firmware, void *context)
-{
- struct _adapter *adapter = context;
-
- if (!firmware) {
- rtl871x_load_fw_fail(adapter);
- return;
- }
- adapter->fw = firmware;
- /* firmware available - start netdev */
- register_netdev(adapter->pnetdev);
- complete(&adapter->rtl8712_fw_ready);
-}
-
-static const char firmware_file[] = "rtlwifi/rtl8712u.bin";
-
-int rtl871x_load_fw(struct _adapter *padapter)
-{
- struct device *dev = &padapter->dvobjpriv.pusbdev->dev;
- int rc;
-
- init_completion(&padapter->rtl8712_fw_ready);
- dev_info(dev, "r8712u: Loading firmware from \"%s\"\n", firmware_file);
- rc = request_firmware_nowait(THIS_MODULE, 1, firmware_file, dev,
- GFP_KERNEL, padapter, rtl871x_load_fw_cb);
- if (rc)
- dev_err(dev, "r8712u: Firmware request error %d\n", rc);
- return rc;
-}
-MODULE_FIRMWARE("rtlwifi/rtl8712u.bin");
-
-static u32 rtl871x_open_fw(struct _adapter *adapter, const u8 **mappedfw)
-{
- if (adapter->fw->size > 200000) {
- dev_err(&adapter->pnetdev->dev, "r8712u: Bad fw->size of %zu\n",
- adapter->fw->size);
- return 0;
- }
- *mappedfw = adapter->fw->data;
- return adapter->fw->size;
-}
-
-static void fill_fwpriv(struct _adapter *adapter, struct fw_priv *fwpriv)
-{
- struct dvobj_priv *dvobj = &adapter->dvobjpriv;
- struct registry_priv *regpriv = &adapter->registrypriv;
-
- memset(fwpriv, 0, sizeof(struct fw_priv));
- /* todo: check if needs endian conversion */
- fwpriv->hci_sel = RTL8712_HCI_TYPE_72USB;
- fwpriv->usb_ep_num = (u8)dvobj->nr_endpoint;
- fwpriv->bw_40MHz_en = regpriv->cbw40_enable;
- switch (regpriv->rf_config) {
- case RTL8712_RF_1T1R:
- fwpriv->rf_config = RTL8712_RFC_1T1R;
- break;
- case RTL8712_RF_2T2R:
- fwpriv->rf_config = RTL8712_RFC_2T2R;
- break;
- case RTL8712_RF_1T2R:
- default:
- fwpriv->rf_config = RTL8712_RFC_1T2R;
- }
- fwpriv->mp_mode = (regpriv->mp_mode == 1);
- /* 0:off 1:on 2:auto */
- fwpriv->vcs_type = regpriv->vrtl_carrier_sense;
- fwpriv->vcs_mode = regpriv->vcs_type; /* 1:RTS/CTS 2:CTS to self */
- /* default enable turbo_mode */
- fwpriv->turbo_mode = (regpriv->wifi_test != 1);
- fwpriv->low_power_mode = regpriv->low_power;
-}
-
-static void update_fwhdr(struct fw_hdr *pfwhdr, const u8 *pmappedfw)
-{
- pfwhdr->signature = le16_to_cpu(*(__le16 *)pmappedfw);
- pfwhdr->version = le16_to_cpu(*(__le16 *)(pmappedfw + 2));
- /* define the size of boot loader */
- pfwhdr->dmem_size = le32_to_cpu(*(__le32 *)(pmappedfw + 4));
- /* define the size of FW in IMEM */
- pfwhdr->img_IMEM_size = le32_to_cpu(*(__le32 *)(pmappedfw + 8));
- /* define the size of FW in SRAM */
- pfwhdr->img_SRAM_size = le32_to_cpu(*(__le32 *)(pmappedfw + 12));
- /* define the size of DMEM variable */
- pfwhdr->fw_priv_sz = le32_to_cpu(*(__le32 *)(pmappedfw + 16));
-}
-
-static u8 chk_fwhdr(struct fw_hdr *pfwhdr, u32 ulfilelength)
-{
- u32 fwhdrsz, fw_sz;
-
- /* check signature */
- if ((pfwhdr->signature != 0x8712) && (pfwhdr->signature != 0x8192))
- return _FAIL;
- /* check fw_priv_sze & sizeof(struct fw_priv) */
- if (pfwhdr->fw_priv_sz != sizeof(struct fw_priv))
- return _FAIL;
- /* check fw_sz & image_fw_sz */
- fwhdrsz = offsetof(struct fw_hdr, fwpriv) + pfwhdr->fw_priv_sz;
- fw_sz = fwhdrsz + pfwhdr->img_IMEM_size + pfwhdr->img_SRAM_size +
- pfwhdr->dmem_size;
- if (fw_sz != ulfilelength)
- return _FAIL;
- return _SUCCESS;
-}
-
-static u8 rtl8712_dl_fw(struct _adapter *adapter)
-{
- sint i;
- u8 tmp8, tmp8_a;
- u16 tmp16;
- u32 maxlen = 0; /* for compare usage */
- uint dump_imem_sz, imem_sz, dump_emem_sz, emem_sz; /* max = 49152; */
- struct fw_hdr fwhdr;
- u32 ulfilelength; /* FW file size */
- const u8 *mappedfw = NULL;
- u8 *tmpchar = NULL, *payload, *ptr;
- struct tx_desc *txdesc;
- u32 txdscp_sz = sizeof(struct tx_desc);
- u8 ret = _FAIL;
-
- ulfilelength = rtl871x_open_fw(adapter, &mappedfw);
- if (mappedfw && (ulfilelength > 0)) {
- update_fwhdr(&fwhdr, mappedfw);
- if (chk_fwhdr(&fwhdr, ulfilelength) == _FAIL)
- return ret;
- fill_fwpriv(adapter, &fwhdr.fwpriv);
- /* firmware check ok */
- maxlen = (fwhdr.img_IMEM_size > fwhdr.img_SRAM_size) ?
- fwhdr.img_IMEM_size : fwhdr.img_SRAM_size;
- maxlen += txdscp_sz;
- tmpchar = kmalloc(maxlen + FWBUFF_ALIGN_SZ, GFP_KERNEL);
- if (!tmpchar)
- return ret;
-
- txdesc = (struct tx_desc *)(tmpchar + FWBUFF_ALIGN_SZ -
- ((addr_t)(tmpchar) & (FWBUFF_ALIGN_SZ - 1)));
- payload = (u8 *)(txdesc) + txdscp_sz;
- ptr = (u8 *)mappedfw + offsetof(struct fw_hdr, fwpriv) +
- fwhdr.fw_priv_sz;
- /* Download FirmWare */
- /* 1. determine IMEM code size and Load IMEM Code Section */
- imem_sz = fwhdr.img_IMEM_size;
- do {
- memset(txdesc, 0, TXDESC_SIZE);
- if (imem_sz > MAX_DUMP_FWSZ/*49152*/) {
- dump_imem_sz = MAX_DUMP_FWSZ;
- } else {
- dump_imem_sz = imem_sz;
- txdesc->txdw0 |= cpu_to_le32(BIT(28));
- }
- txdesc->txdw0 |= cpu_to_le32(dump_imem_sz &
- 0x0000ffff);
- memcpy(payload, ptr, dump_imem_sz);
- r8712_write_mem(adapter, RTL8712_DMA_VOQ,
- dump_imem_sz + TXDESC_SIZE,
- (u8 *)txdesc);
- ptr += dump_imem_sz;
- imem_sz -= dump_imem_sz;
- } while (imem_sz > 0);
- i = 10;
- tmp16 = r8712_read16(adapter, TCR);
- while (((tmp16 & _IMEM_CODE_DONE) == 0) && (i > 0)) {
- usleep_range(10, 1000);
- tmp16 = r8712_read16(adapter, TCR);
- i--;
- }
- if (i == 0 || (tmp16 & _IMEM_CHK_RPT) == 0)
- goto exit_fail;
-
- /* 2.Download EMEM code size and Load EMEM Code Section */
- emem_sz = fwhdr.img_SRAM_size;
- do {
- memset(txdesc, 0, TXDESC_SIZE);
- if (emem_sz > MAX_DUMP_FWSZ) { /* max=48k */
- dump_emem_sz = MAX_DUMP_FWSZ;
- } else {
- dump_emem_sz = emem_sz;
- txdesc->txdw0 |= cpu_to_le32(BIT(28));
- }
- txdesc->txdw0 |= cpu_to_le32(dump_emem_sz &
- 0x0000ffff);
- memcpy(payload, ptr, dump_emem_sz);
- r8712_write_mem(adapter, RTL8712_DMA_VOQ,
- dump_emem_sz + TXDESC_SIZE,
- (u8 *)txdesc);
- ptr += dump_emem_sz;
- emem_sz -= dump_emem_sz;
- } while (emem_sz > 0);
- i = 5;
- tmp16 = r8712_read16(adapter, TCR);
- while (((tmp16 & _EMEM_CODE_DONE) == 0) && (i > 0)) {
- usleep_range(10, 1000);
- tmp16 = r8712_read16(adapter, TCR);
- i--;
- }
- if (i == 0 || (tmp16 & _EMEM_CHK_RPT) == 0)
- goto exit_fail;
-
- /* 3.Enable CPU */
- tmp8 = r8712_read8(adapter, SYS_CLKR);
- r8712_write8(adapter, SYS_CLKR, tmp8 | BIT(2));
- tmp8_a = r8712_read8(adapter, SYS_CLKR);
- if (tmp8_a != (tmp8 | BIT(2)))
- goto exit_fail;
-
- tmp8 = r8712_read8(adapter, SYS_FUNC_EN + 1);
- r8712_write8(adapter, SYS_FUNC_EN + 1, tmp8 | BIT(2));
- tmp8_a = r8712_read8(adapter, SYS_FUNC_EN + 1);
- if (tmp8_a != (tmp8 | BIT(2)))
- goto exit_fail;
-
- r8712_read32(adapter, TCR);
-
- /* 4.polling IMEM Ready */
- i = 100;
- tmp16 = r8712_read16(adapter, TCR);
- while (((tmp16 & _IMEM_RDY) == 0) && (i > 0)) {
- msleep(20);
- tmp16 = r8712_read16(adapter, TCR);
- i--;
- }
- if (i == 0) {
- r8712_write16(adapter, 0x10250348, 0xc000);
- r8712_write16(adapter, 0x10250348, 0xc001);
- r8712_write16(adapter, 0x10250348, 0x2000);
- r8712_write16(adapter, 0x10250348, 0x2001);
- r8712_write16(adapter, 0x10250348, 0x2002);
- r8712_write16(adapter, 0x10250348, 0x2003);
- goto exit_fail;
- }
- /* 5.Download DMEM code size and Load EMEM Code Section */
- memset(txdesc, 0, TXDESC_SIZE);
- txdesc->txdw0 |= cpu_to_le32(fwhdr.fw_priv_sz & 0x0000ffff);
- txdesc->txdw0 |= cpu_to_le32(BIT(28));
- memcpy(payload, &fwhdr.fwpriv, fwhdr.fw_priv_sz);
- r8712_write_mem(adapter, RTL8712_DMA_VOQ,
- fwhdr.fw_priv_sz + TXDESC_SIZE, (u8 *)txdesc);
-
- /* polling dmem code done */
- i = 100;
- tmp16 = r8712_read16(adapter, TCR);
- while (((tmp16 & _DMEM_CODE_DONE) == 0) && (i > 0)) {
- msleep(20);
- tmp16 = r8712_read16(adapter, TCR);
- i--;
- }
- if (i == 0)
- goto exit_fail;
-
- tmp8 = r8712_read8(adapter, 0x1025000A);
- if (tmp8 & BIT(4)) /* When boot from EEPROM,
- * & FW need more time to read EEPROM
- */
- i = 60;
- else /* boot from EFUSE */
- i = 30;
- tmp16 = r8712_read16(adapter, TCR);
- while (((tmp16 & _FWRDY) == 0) && (i > 0)) {
- msleep(100);
- tmp16 = r8712_read16(adapter, TCR);
- i--;
- }
- if (i == 0)
- goto exit_fail;
- } else {
- goto exit_fail;
- }
- ret = _SUCCESS;
-
-exit_fail:
- kfree(tmpchar);
- return ret;
-}
-
-uint rtl8712_hal_init(struct _adapter *padapter)
-{
- u32 val32;
- int i;
-
- /* r8712 firmware download */
- if (rtl8712_dl_fw(padapter) != _SUCCESS)
- return _FAIL;
-
- netdev_info(padapter->pnetdev, "1 RCR=0x%x\n",
- r8712_read32(padapter, RCR));
- val32 = r8712_read32(padapter, RCR);
- r8712_write32(padapter, RCR, (val32 | BIT(26))); /* Enable RX TCP
- * Checksum offload
- */
- netdev_info(padapter->pnetdev, "2 RCR=0x%x\n",
- r8712_read32(padapter, RCR));
- val32 = r8712_read32(padapter, RCR);
- r8712_write32(padapter, RCR, (val32 | BIT(25))); /* Append PHY status */
- val32 = r8712_read32(padapter, 0x10250040);
- r8712_write32(padapter, 0x10250040, (val32 & 0x00FFFFFF));
- /* for usb rx aggregation */
- r8712_write8(padapter, 0x102500B5, r8712_read8(padapter, 0x102500B5) |
- BIT(0)); /* page = 128bytes */
- r8712_write8(padapter, 0x102500BD, r8712_read8(padapter, 0x102500BD) |
- BIT(7)); /* enable usb rx aggregation */
- r8712_write8(padapter, 0x102500D9, 1); /* TH=1 => means that invalidate
- * usb rx aggregation
- */
- r8712_write8(padapter, 0x1025FE5B, 0x04); /* 1.7ms/4 */
- /* Fix the RX FIFO issue(USB error) */
- r8712_write8(padapter, 0x1025fe5C, r8712_read8(padapter, 0x1025fe5C)
- | BIT(7));
- for (i = 0; i < ETH_ALEN; i++)
- padapter->eeprompriv.mac_addr[i] = r8712_read8(padapter,
- MACID + i);
- return _SUCCESS;
-}
-
-uint rtl8712_hal_deinit(struct _adapter *padapter)
-{
- r8712_write8(padapter, RF_CTRL, 0x00);
- /* Turn off BB */
- msleep(20);
- /* Turn off MAC */
- r8712_write8(padapter, SYS_CLKR + 1, 0x38); /* Switch Control Path */
- r8712_write8(padapter, SYS_FUNC_EN + 1, 0x70);
- r8712_write8(padapter, PMC_FSM, 0x06); /* Enable Loader Data Keep */
- r8712_write8(padapter, SYS_ISO_CTRL, 0xF9); /* Isolation signals from
- * CORE, PLL
- */
- r8712_write8(padapter, SYS_ISO_CTRL + 1, 0xe8); /* Enable EFUSE 1.2V */
- r8712_write8(padapter, AFE_PLL_CTRL, 0x00); /* Disable AFE PLL. */
- r8712_write8(padapter, LDOA15_CTRL, 0x54); /* Disable A15V */
- r8712_write8(padapter, SYS_FUNC_EN + 1, 0x50); /* Disable E-Fuse 1.2V */
- r8712_write8(padapter, LDOV12D_CTRL, 0x24); /* Disable LDO12(for CE) */
- r8712_write8(padapter, AFE_MISC, 0x30); /* Disable AFE BG&MB */
- /* Option for Disable 1.6V LDO. */
- r8712_write8(padapter, SPS0_CTRL, 0x56); /* Disable 1.6V LDO */
- r8712_write8(padapter, SPS0_CTRL + 1, 0x43); /* Set SW PFM */
- return _SUCCESS;
-}
-
-uint rtl871x_hal_init(struct _adapter *padapter)
-{
- padapter->hw_init_completed = false;
- if (!padapter->halpriv.hal_bus_init)
- return _FAIL;
- if (padapter->halpriv.hal_bus_init(padapter) != _SUCCESS)
- return _FAIL;
- if (rtl8712_hal_init(padapter) == _SUCCESS) {
- padapter->hw_init_completed = true;
- } else {
- padapter->hw_init_completed = false;
- return _FAIL;
- }
- return _SUCCESS;
-}
--- a/drivers/staging/rtl8712/ieee80211.c
+++ /dev/null
@@ -1,415 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * ieee80211.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>.
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _IEEE80211_C
-
-#include "drv_types.h"
-#include "ieee80211.h"
-#include "wifi.h"
-#include "osdep_service.h"
-#include "wlan_bssdef.h"
-
-static const u8 WPA_OUI_TYPE[] = {0x00, 0x50, 0xf2, 1};
-static const u8 WPA_CIPHER_SUITE_NONE[] = {0x00, 0x50, 0xf2, 0};
-static const u8 WPA_CIPHER_SUITE_WEP40[] = {0x00, 0x50, 0xf2, 1};
-static const u8 WPA_CIPHER_SUITE_TKIP[] = {0x00, 0x50, 0xf2, 2};
-static const u8 WPA_CIPHER_SUITE_CCMP[] = {0x00, 0x50, 0xf2, 4};
-static const u8 WPA_CIPHER_SUITE_WEP104[] = {0x00, 0x50, 0xf2, 5};
-
-static const u8 RSN_CIPHER_SUITE_NONE[] = {0x00, 0x0f, 0xac, 0};
-static const u8 RSN_CIPHER_SUITE_WEP40[] = {0x00, 0x0f, 0xac, 1};
-static const u8 RSN_CIPHER_SUITE_TKIP[] = {0x00, 0x0f, 0xac, 2};
-static const u8 RSN_CIPHER_SUITE_CCMP[] = {0x00, 0x0f, 0xac, 4};
-static const u8 RSN_CIPHER_SUITE_WEP104[] = {0x00, 0x0f, 0xac, 5};
-
-/*-----------------------------------------------------------
- * for adhoc-master to generate ie and provide supported-rate to fw
- *-----------------------------------------------------------
- */
-
-static u8 WIFI_CCKRATES[] = {
- (IEEE80211_CCK_RATE_1MB | IEEE80211_BASIC_RATE_MASK),
- (IEEE80211_CCK_RATE_2MB | IEEE80211_BASIC_RATE_MASK),
- (IEEE80211_CCK_RATE_5MB | IEEE80211_BASIC_RATE_MASK),
- (IEEE80211_CCK_RATE_11MB | IEEE80211_BASIC_RATE_MASK)
-};
-
-static u8 WIFI_OFDMRATES[] = {
- (IEEE80211_OFDM_RATE_6MB),
- (IEEE80211_OFDM_RATE_9MB),
- (IEEE80211_OFDM_RATE_12MB),
- (IEEE80211_OFDM_RATE_18MB),
- (IEEE80211_OFDM_RATE_24MB),
- (IEEE80211_OFDM_RATE_36MB),
- (IEEE80211_OFDM_RATE_48MB),
- (IEEE80211_OFDM_RATE_54MB)
-};
-
-uint r8712_is_cckrates_included(u8 *rate)
-{
- u32 i = 0;
-
- while (rate[i] != 0) {
- if ((((rate[i]) & 0x7f) == 2) || (((rate[i]) & 0x7f) == 4) ||
- (((rate[i]) & 0x7f) == 11) || (((rate[i]) & 0x7f) == 22))
- return true;
- i++;
- }
- return false;
-}
-
-uint r8712_is_cckratesonly_included(u8 *rate)
-{
- u32 i = 0;
-
- while (rate[i] != 0) {
- if ((((rate[i]) & 0x7f) != 2) && (((rate[i]) & 0x7f) != 4) &&
- (((rate[i]) & 0x7f) != 11) && (((rate[i]) & 0x7f) != 22))
- return false;
- i++;
- }
- return true;
-}
-
-/* r8712_set_ie will update frame length */
-u8 *r8712_set_ie(u8 *pbuf, sint index, uint len, u8 *source, uint *frlen)
-{
- *pbuf = (u8)index;
- *(pbuf + 1) = (u8)len;
- if (len > 0)
- memcpy((void *)(pbuf + 2), (void *)source, len);
- *frlen = *frlen + (len + 2);
- return pbuf + len + 2;
-}
-
-/* ---------------------------------------------------------------------------
- * index: the information element id index, limit is the limit for search
- * ---------------------------------------------------------------------------
- */
-u8 *r8712_get_ie(u8 *pbuf, sint index, uint *len, sint limit)
-{
- sint tmp, i;
- u8 *p;
-
- if (limit < 1)
- return NULL;
- p = pbuf;
- i = 0;
- *len = 0;
- while (1) {
- if (*p == index) {
- *len = *(p + 1);
- return p;
- }
- tmp = *(p + 1);
- p += (tmp + 2);
- i += (tmp + 2);
- if (i >= limit)
- break;
- }
- return NULL;
-}
-
-static void set_supported_rate(u8 *rates, uint mode)
-{
- memset(rates, 0, NDIS_802_11_LENGTH_RATES_EX);
- switch (mode) {
- case WIRELESS_11B:
- memcpy(rates, WIFI_CCKRATES, IEEE80211_CCK_RATE_LEN);
- break;
- case WIRELESS_11G:
- case WIRELESS_11A:
- memcpy(rates, WIFI_OFDMRATES, IEEE80211_NUM_OFDM_RATESLEN);
- break;
- case WIRELESS_11BG:
- memcpy(rates, WIFI_CCKRATES, IEEE80211_CCK_RATE_LEN);
- memcpy(rates + IEEE80211_CCK_RATE_LEN, WIFI_OFDMRATES,
- IEEE80211_NUM_OFDM_RATESLEN);
- break;
- }
-}
-
-static uint r8712_get_rateset_len(u8 *rateset)
-{
- uint i = 0;
-
- while (1) {
- if ((rateset[i]) == 0)
- break;
- if (i > 12)
- break;
- i++;
- }
- return i;
-}
-
-int r8712_generate_ie(struct registry_priv *registrypriv)
-{
- int rate_len;
- uint sz = 0;
- struct wlan_bssid_ex *dev_network = ®istrypriv->dev_network;
- u8 *ie = dev_network->IEs;
- u16 beacon_period = (u16)dev_network->Configuration.BeaconPeriod;
-
- /*timestamp will be inserted by hardware*/
- sz += 8;
- ie += sz;
- /*beacon interval : 2bytes*/
- *(__le16 *)ie = cpu_to_le16(beacon_period);
- sz += 2;
- ie += 2;
- /*capability info*/
- *(u16 *)ie = 0;
- *(__le16 *)ie |= cpu_to_le16(WLAN_CAPABILITY_IBSS);
- if (registrypriv->preamble == PREAMBLE_SHORT)
- *(__le16 *)ie |= cpu_to_le16(WLAN_CAPABILITY_SHORT_PREAMBLE);
- if (dev_network->Privacy)
- *(__le16 *)ie |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY);
- sz += 2;
- ie += 2;
- /*SSID*/
- ie = r8712_set_ie(ie, WLAN_EID_SSID, dev_network->Ssid.SsidLength,
- dev_network->Ssid.Ssid, &sz);
- /*supported rates*/
- set_supported_rate(dev_network->rates, registrypriv->wireless_mode);
- rate_len = r8712_get_rateset_len(dev_network->rates);
- if (rate_len > 8) {
- ie = r8712_set_ie(ie, WLAN_EID_SUPP_RATES, 8,
- dev_network->rates, &sz);
- ie = r8712_set_ie(ie, WLAN_EID_EXT_SUPP_RATES, (rate_len - 8),
- (dev_network->rates + 8), &sz);
- } else {
- ie = r8712_set_ie(ie, WLAN_EID_SUPP_RATES,
- rate_len, dev_network->rates, &sz);
- }
- /*DS parameter set*/
- ie = r8712_set_ie(ie, WLAN_EID_DS_PARAMS, 1,
- (u8 *)&dev_network->Configuration.DSConfig, &sz);
- /*IBSS Parameter Set*/
- ie = r8712_set_ie(ie, WLAN_EID_IBSS_PARAMS, 2,
- (u8 *)&dev_network->Configuration.ATIMWindow, &sz);
- return sz;
-}
-
-unsigned char *r8712_get_wpa_ie(unsigned char *ie, uint *wpa_ie_len, int limit)
-{
- u32 len;
- u16 val16;
- unsigned char wpa_oui_type[] = {0x00, 0x50, 0xf2, 0x01};
- u8 *buf = ie;
-
- while (1) {
- buf = r8712_get_ie(buf, _WPA_IE_ID_, &len, limit);
- if (buf) {
- /*check if oui matches...*/
- if (memcmp((buf + 2), wpa_oui_type,
- sizeof(wpa_oui_type)))
- goto check_next_ie;
- /*check version...*/
- memcpy((u8 *)&val16, (buf + 6), sizeof(val16));
- le16_to_cpus(&val16);
- if (val16 != 0x0001)
- goto check_next_ie;
- *wpa_ie_len = *(buf + 1);
- return buf;
- }
- *wpa_ie_len = 0;
- return NULL;
-check_next_ie:
- limit = limit - (buf - ie) - 2 - len;
- if (limit <= 0)
- break;
- buf += (2 + len);
- }
- *wpa_ie_len = 0;
- return NULL;
-}
-
-unsigned char *r8712_get_wpa2_ie(unsigned char *pie, uint *rsn_ie_len,
- int limit)
-{
- return r8712_get_ie(pie, _WPA2_IE_ID_, rsn_ie_len, limit);
-}
-
-static int r8712_get_wpa_cipher_suite(u8 *s)
-{
- if (!memcmp(s, (void *)WPA_CIPHER_SUITE_NONE, WPA_SELECTOR_LEN))
- return WPA_CIPHER_NONE;
- if (!memcmp(s, (void *)WPA_CIPHER_SUITE_WEP40, WPA_SELECTOR_LEN))
- return WPA_CIPHER_WEP40;
- if (!memcmp(s, (void *)WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN))
- return WPA_CIPHER_TKIP;
- if (!memcmp(s, (void *)WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN))
- return WPA_CIPHER_CCMP;
- if (!memcmp(s, (void *)WPA_CIPHER_SUITE_WEP104, WPA_SELECTOR_LEN))
- return WPA_CIPHER_WEP104;
- return 0;
-}
-
-static int r8712_get_wpa2_cipher_suite(u8 *s)
-{
- if (!memcmp(s, (void *)RSN_CIPHER_SUITE_NONE, RSN_SELECTOR_LEN))
- return WPA_CIPHER_NONE;
- if (!memcmp(s, (void *)RSN_CIPHER_SUITE_WEP40, RSN_SELECTOR_LEN))
- return WPA_CIPHER_WEP40;
- if (!memcmp(s, (void *)RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN))
- return WPA_CIPHER_TKIP;
- if (!memcmp(s, (void *)RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN))
- return WPA_CIPHER_CCMP;
- if (!memcmp(s, (void *)RSN_CIPHER_SUITE_WEP104, RSN_SELECTOR_LEN))
- return WPA_CIPHER_WEP104;
- return 0;
-}
-
-int r8712_parse_wpa_ie(u8 *wpa_ie, int wpa_ie_len, int *group_cipher,
- int *pairwise_cipher)
-{
- int i;
- int left, count;
- u8 *pos;
-
- if (wpa_ie_len <= 0) {
- /* No WPA IE - fail silently */
- return -EINVAL;
- }
- if ((*wpa_ie != _WPA_IE_ID_) ||
- (*(wpa_ie + 1) != (u8)(wpa_ie_len - 2)) ||
- (memcmp(wpa_ie + 2, (void *)WPA_OUI_TYPE, WPA_SELECTOR_LEN)))
- return -EINVAL;
- pos = wpa_ie;
- pos += 8;
- left = wpa_ie_len - 8;
- /*group_cipher*/
- if (left >= WPA_SELECTOR_LEN) {
- *group_cipher = r8712_get_wpa_cipher_suite(pos);
- pos += WPA_SELECTOR_LEN;
- left -= WPA_SELECTOR_LEN;
- } else if (left > 0) {
- return -EINVAL;
- }
- /*pairwise_cipher*/
- if (left >= 2) {
- count = le16_to_cpu(*(__le16 *)pos);
- pos += 2;
- left -= 2;
- if (count == 0 || left < count * WPA_SELECTOR_LEN)
- return -EINVAL;
- for (i = 0; i < count; i++) {
- *pairwise_cipher |= r8712_get_wpa_cipher_suite(pos);
- pos += WPA_SELECTOR_LEN;
- left -= WPA_SELECTOR_LEN;
- }
- } else if (left == 1) {
- return -EINVAL;
- }
- return 0;
-}
-
-int r8712_parse_wpa2_ie(u8 *rsn_ie, int rsn_ie_len, int *group_cipher,
- int *pairwise_cipher)
-{
- int i;
- int left, count;
- u8 *pos;
-
- if (rsn_ie_len <= 0) {
- /* No RSN IE - fail silently */
- return -EINVAL;
- }
- if ((*rsn_ie != _WPA2_IE_ID_) ||
- (*(rsn_ie + 1) != (u8)(rsn_ie_len - 2)))
- return -EINVAL;
- pos = rsn_ie;
- pos += 4;
- left = rsn_ie_len - 4;
- /*group_cipher*/
- if (left >= RSN_SELECTOR_LEN) {
- *group_cipher = r8712_get_wpa2_cipher_suite(pos);
- pos += RSN_SELECTOR_LEN;
- left -= RSN_SELECTOR_LEN;
- } else if (left > 0) {
- return -EINVAL;
- }
- /*pairwise_cipher*/
- if (left >= 2) {
- count = le16_to_cpu(*(__le16 *)pos);
- pos += 2;
- left -= 2;
- if (count == 0 || left < count * RSN_SELECTOR_LEN)
- return -EINVAL;
- for (i = 0; i < count; i++) {
- *pairwise_cipher |= r8712_get_wpa2_cipher_suite(pos);
- pos += RSN_SELECTOR_LEN;
- left -= RSN_SELECTOR_LEN;
- }
- } else if (left == 1) {
- return -EINVAL;
- }
- return 0;
-}
-
-int r8712_get_sec_ie(u8 *in_ie, uint in_len, u8 *rsn_ie, u16 *rsn_len,
- u8 *wpa_ie, u16 *wpa_len)
-{
- u8 authmode;
- u8 wpa_oui[4] = {0x0, 0x50, 0xf2, 0x01};
- uint cnt;
-
- /*Search required WPA or WPA2 IE and copy to sec_ie[ ]*/
- cnt = _TIMESTAMP_ + _BEACON_ITERVAL_ + _CAPABILITY_;
- while (cnt < in_len) {
- authmode = in_ie[cnt];
- if ((authmode == _WPA_IE_ID_) &&
- (!memcmp(&in_ie[cnt + 2], &wpa_oui[0], 4))) {
- memcpy(wpa_ie, &in_ie[cnt], in_ie[cnt + 1] + 2);
- *wpa_len = in_ie[cnt + 1] + 2;
- cnt += in_ie[cnt + 1] + 2; /*get next */
- } else {
- if (authmode == _WPA2_IE_ID_) {
- memcpy(rsn_ie, &in_ie[cnt],
- in_ie[cnt + 1] + 2);
- *rsn_len = in_ie[cnt + 1] + 2;
- cnt += in_ie[cnt + 1] + 2; /*get next*/
- } else {
- cnt += in_ie[cnt + 1] + 2; /*get next*/
- }
- }
- }
- return *rsn_len + *wpa_len;
-}
-
-int r8712_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen)
-{
- int match;
- uint cnt;
- u8 eid, wps_oui[4] = {0x0, 0x50, 0xf2, 0x04};
-
- cnt = 12;
- match = false;
- while (cnt < in_len) {
- eid = in_ie[cnt];
- if ((eid == _WPA_IE_ID_) &&
- (!memcmp(&in_ie[cnt + 2], wps_oui, 4))) {
- memcpy(wps_ie, &in_ie[cnt], in_ie[cnt + 1] + 2);
- *wps_ielen = in_ie[cnt + 1] + 2;
- cnt += in_ie[cnt + 1] + 2;
- match = true;
- break;
- }
- cnt += in_ie[cnt + 1] + 2; /* goto next */
- }
- return match;
-}
--- a/drivers/staging/rtl8712/ieee80211.h
+++ /dev/null
@@ -1,165 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __IEEE80211_H
-#define __IEEE80211_H
-
-#include <linux/ieee80211.h>
-
-#define IEEE_CMD_SET_WPA_PARAM 1
-#define IEEE_CMD_SET_WPA_IE 2
-#define IEEE_CMD_SET_ENCRYPTION 3
-#define IEEE_CMD_MLME 4
-
-#define IEEE_PARAM_WPA_ENABLED 1
-#define IEEE_PARAM_TKIP_COUNTERMEASURES 2
-#define IEEE_PARAM_DROP_UNENCRYPTED 3
-#define IEEE_PARAM_PRIVACY_INVOKED 4
-#define IEEE_PARAM_AUTH_ALGS 5
-#define IEEE_PARAM_IEEE_802_1X 6
-#define IEEE_PARAM_WPAX_SELECT 7
-
-#define AUTH_ALG_OPEN_SYSTEM 0x1
-#define AUTH_ALG_SHARED_KEY 0x2
-#define AUTH_ALG_LEAP 0x00000004
-
-#define IEEE_MLME_STA_DEAUTH 1
-#define IEEE_MLME_STA_DISASSOC 2
-
-#define IEEE_CRYPT_ERR_UNKNOWN_ALG 2
-#define IEEE_CRYPT_ERR_UNKNOWN_ADDR 3
-#define IEEE_CRYPT_ERR_CRYPT_INIT_FAILED 4
-#define IEEE_CRYPT_ERR_KEY_SET_FAILED 5
-#define IEEE_CRYPT_ERR_TX_KEY_SET_FAILED 6
-#define IEEE_CRYPT_ERR_CARD_CONF_FAILED 7
-
-#define IEEE_CRYPT_ALG_NAME_LEN 16
-
-#define WPA_CIPHER_NONE BIT(0)
-#define WPA_CIPHER_WEP40 BIT(1)
-#define WPA_CIPHER_WEP104 BIT(2)
-#define WPA_CIPHER_TKIP BIT(3)
-#define WPA_CIPHER_CCMP BIT(4)
-
-#define WPA_SELECTOR_LEN 4
-#define RSN_HEADER_LEN 4
-
-#define RSN_SELECTOR_LEN 4
-
-enum NETWORK_TYPE {
- WIRELESS_INVALID = 0,
- WIRELESS_11B = 1,
- WIRELESS_11G = 2,
- WIRELESS_11BG = (WIRELESS_11B | WIRELESS_11G),
- WIRELESS_11A = 4,
- WIRELESS_11N = 8,
- WIRELESS_11GN = (WIRELESS_11G | WIRELESS_11N),
- WIRELESS_11BGN = (WIRELESS_11B | WIRELESS_11G | WIRELESS_11N),
-};
-
-struct ieee_param {
- u32 cmd;
- u8 sta_addr[ETH_ALEN];
- union {
- struct {
- u8 name;
- u32 value;
- } wpa_param;
- struct {
- u32 len;
- u8 reserved[32];
- u8 data[];
- } wpa_ie;
- struct {
- int command;
- int reason_code;
- } mlme;
- struct {
- u8 alg[IEEE_CRYPT_ALG_NAME_LEN];
- u8 set_tx;
- u32 err;
- u8 idx;
- u8 seq[8]; /* sequence counter (set: RX, get: TX) */
- u16 key_len;
- u8 key[];
- } crypt;
- } u;
-};
-
-#define MIN_FRAG_THRESHOLD 256U
-#define MAX_FRAG_THRESHOLD 2346U
-
-/* QoS,QOS */
-#define NORMAL_ACK 0
-
-/* IEEE 802.11 defines */
-
-#define P80211_OUI_LEN 3
-
-struct ieee80211_snap_hdr {
- u8 dsap; /* always 0xAA */
- u8 ssap; /* always 0xAA */
- u8 ctrl; /* always 0x03 */
- u8 oui[P80211_OUI_LEN]; /* organizational universal id */
-} __packed;
-
-#define SNAP_SIZE sizeof(struct ieee80211_snap_hdr)
-
-#define IEEE80211_CCK_RATE_LEN 4
-#define IEEE80211_NUM_OFDM_RATESLEN 8
-
-#define IEEE80211_CCK_RATE_1MB 0x02
-#define IEEE80211_CCK_RATE_2MB 0x04
-#define IEEE80211_CCK_RATE_5MB 0x0B
-#define IEEE80211_CCK_RATE_11MB 0x16
-#define IEEE80211_OFDM_RATE_6MB 0x0C
-#define IEEE80211_OFDM_RATE_9MB 0x12
-#define IEEE80211_OFDM_RATE_12MB 0x18
-#define IEEE80211_OFDM_RATE_18MB 0x24
-#define IEEE80211_OFDM_RATE_24MB 0x30
-#define IEEE80211_OFDM_RATE_36MB 0x48
-#define IEEE80211_OFDM_RATE_48MB 0x60
-#define IEEE80211_OFDM_RATE_54MB 0x6C
-#define IEEE80211_BASIC_RATE_MASK 0x80
-
-#define WEP_KEYS 4
-
-/* MAX_RATES_LENGTH needs to be 12. The spec says 8, and many APs
- * only use 8, and then use extended rates for the remaining supported
- * rates. Other APs, however, stick all of their supported rates on the
- * main rates information element...
- */
-#define MAX_RATES_LENGTH ((u8)12)
-#define MAX_WPA_IE_LEN 128
-
-struct registry_priv;
-
-u8 *r8712_set_ie(u8 *pbuf, sint index, uint len, u8 *source, uint *frlen);
-u8 *r8712_get_ie(u8 *pbuf, sint index, uint *len, sint limit);
-unsigned char *r8712_get_wpa_ie(unsigned char *pie, uint *rsn_ie_len,
- int limit);
-unsigned char *r8712_get_wpa2_ie(unsigned char *pie, uint *rsn_ie_len,
- int limit);
-int r8712_parse_wpa_ie(u8 *wpa_ie, int wpa_ie_len, int *group_cipher,
- int *pairwise_cipher);
-int r8712_parse_wpa2_ie(u8 *wpa_ie, int wpa_ie_len, int *group_cipher,
- int *pairwise_cipher);
-int r8712_get_sec_ie(u8 *in_ie, uint in_len, u8 *rsn_ie, u16 *rsn_len,
- u8 *wpa_ie, u16 *wpa_len);
-int r8712_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen);
-int r8712_generate_ie(struct registry_priv *pregistrypriv);
-uint r8712_is_cckrates_included(u8 *rate);
-uint r8712_is_cckratesonly_included(u8 *rate);
-
-#endif /* IEEE80211_H */
-
--- a/drivers/staging/rtl8712/mlme_linux.c
+++ /dev/null
@@ -1,160 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * mlme_linux.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>.
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _MLME_OSDEP_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "mlme_osdep.h"
-
-static void sitesurvey_ctrl_handler(struct timer_list *t)
-{
- struct _adapter *adapter =
- from_timer(adapter, t,
- mlmepriv.sitesurveyctrl.sitesurvey_ctrl_timer);
-
- _r8712_sitesurvey_ctrl_handler(adapter);
- mod_timer(&adapter->mlmepriv.sitesurveyctrl.sitesurvey_ctrl_timer,
- jiffies + msecs_to_jiffies(3000));
-}
-
-static void join_timeout_handler (struct timer_list *t)
-{
- struct _adapter *adapter =
- from_timer(adapter, t, mlmepriv.assoc_timer);
-
- _r8712_join_timeout_handler(adapter);
-}
-
-static void _scan_timeout_handler (struct timer_list *t)
-{
- struct _adapter *adapter =
- from_timer(adapter, t, mlmepriv.scan_to_timer);
-
- r8712_scan_timeout_handler(adapter);
-}
-
-static void dhcp_timeout_handler (struct timer_list *t)
-{
- struct _adapter *adapter =
- from_timer(adapter, t, mlmepriv.dhcp_timer);
-
- _r8712_dhcp_timeout_handler(adapter);
-}
-
-static void wdg_timeout_handler (struct timer_list *t)
-{
- struct _adapter *adapter =
- from_timer(adapter, t, mlmepriv.wdg_timer);
-
- r8712_wdg_wk_cmd(adapter);
-
- mod_timer(&adapter->mlmepriv.wdg_timer,
- jiffies + msecs_to_jiffies(2000));
-}
-
-void r8712_init_mlme_timer(struct _adapter *adapter)
-{
- struct mlme_priv *mlmepriv = &adapter->mlmepriv;
-
- timer_setup(&mlmepriv->assoc_timer, join_timeout_handler, 0);
- timer_setup(&mlmepriv->sitesurveyctrl.sitesurvey_ctrl_timer,
- sitesurvey_ctrl_handler, 0);
- timer_setup(&mlmepriv->scan_to_timer, _scan_timeout_handler, 0);
- timer_setup(&mlmepriv->dhcp_timer, dhcp_timeout_handler, 0);
- timer_setup(&mlmepriv->wdg_timer, wdg_timeout_handler, 0);
-}
-
-void r8712_os_indicate_connect(struct _adapter *adapter)
-{
- r8712_indicate_wx_assoc_event(adapter);
- netif_carrier_on(adapter->pnetdev);
-}
-
-static struct RT_PMKID_LIST backupPMKIDList[NUM_PMKID_CACHE];
-void r8712_os_indicate_disconnect(struct _adapter *adapter)
-{
- u8 backupPMKIDIndex = 0;
- u8 backupTKIPCountermeasure = 0x00;
-
- r8712_indicate_wx_disassoc_event(adapter);
- netif_carrier_off(adapter->pnetdev);
- if (adapter->securitypriv.AuthAlgrthm == 2) { /*/802.1x*/
- /* We have to backup the PMK information for WiFi PMK Caching
- * test item. Backup the btkip_countermeasure information.
- * When the countermeasure is trigger, the driver have to
- * disconnect with AP for 60 seconds.
- */
-
- memcpy(&backupPMKIDList[0],
- &adapter->securitypriv.PMKIDList[0],
- sizeof(struct RT_PMKID_LIST) * NUM_PMKID_CACHE);
- backupPMKIDIndex = adapter->securitypriv.PMKIDIndex;
- backupTKIPCountermeasure =
- adapter->securitypriv.btkip_countermeasure;
- memset((unsigned char *)&adapter->securitypriv, 0,
- sizeof(struct security_priv));
- timer_setup(&adapter->securitypriv.tkip_timer,
- r8712_use_tkipkey_handler, 0);
- /* Restore the PMK information to securitypriv structure
- * for the following connection.
- */
- memcpy(&adapter->securitypriv.PMKIDList[0],
- &backupPMKIDList[0],
- sizeof(struct RT_PMKID_LIST) * NUM_PMKID_CACHE);
- adapter->securitypriv.PMKIDIndex = backupPMKIDIndex;
- adapter->securitypriv.btkip_countermeasure =
- backupTKIPCountermeasure;
- } else { /*reset values in securitypriv*/
- struct security_priv *sec_priv = &adapter->securitypriv;
-
- sec_priv->AuthAlgrthm = 0; /*open system*/
- sec_priv->PrivacyAlgrthm = _NO_PRIVACY_;
- sec_priv->PrivacyKeyIndex = 0;
- sec_priv->XGrpPrivacy = _NO_PRIVACY_;
- sec_priv->XGrpKeyid = 1;
- sec_priv->ndisauthtype = Ndis802_11AuthModeOpen;
- sec_priv->ndisencryptstatus = Ndis802_11WEPDisabled;
- sec_priv->wps_phase = false;
- }
-}
-
-void r8712_report_sec_ie(struct _adapter *adapter, u8 authmode, u8 *sec_ie)
-{
- uint len;
- u8 *buff, *p, i;
- union iwreq_data wrqu;
-
- buff = NULL;
- if (authmode == _WPA_IE_ID_) {
- buff = kzalloc(IW_CUSTOM_MAX, GFP_ATOMIC);
- if (!buff)
- return;
- p = buff;
- p += sprintf(p, "ASSOCINFO(ReqIEs=");
- len = sec_ie[1] + 2;
- len = (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX;
- for (i = 0; i < len; i++)
- p += sprintf(p, "%02x", sec_ie[i]);
- p += sprintf(p, ")");
- memset(&wrqu, 0, sizeof(wrqu));
- wrqu.data.length = p - buff;
- wrqu.data.length = (wrqu.data.length < IW_CUSTOM_MAX) ?
- wrqu.data.length : IW_CUSTOM_MAX;
- wireless_send_event(adapter->pnetdev, IWEVCUSTOM, &wrqu, buff);
- kfree(buff);
- }
-}
--- a/drivers/staging/rtl8712/mlme_osdep.h
+++ /dev/null
@@ -1,31 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __MLME_OSDEP_H_
-#define __MLME_OSDEP_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-void r8712_init_mlme_timer(struct _adapter *padapter);
-void r8712_os_indicate_disconnect(struct _adapter *adapter);
-void r8712_os_indicate_connect(struct _adapter *adapter);
-void r8712_report_sec_ie(struct _adapter *adapter, u8 authmode, u8 *sec_ie);
-int r8712_recv_indicatepkts_in_order(struct _adapter *adapter,
- struct recv_reorder_ctrl *precvreorder_ctrl,
- int bforced);
-void r8712_indicate_wx_assoc_event(struct _adapter *padapter);
-void r8712_indicate_wx_disassoc_event(struct _adapter *padapter);
-
-#endif /*_MLME_OSDEP_H_*/
-
--- a/drivers/staging/rtl8712/mp_custom_oid.h
+++ /dev/null
@@ -1,287 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __CUSTOM_OID_H
-#define __CUSTOM_OID_H
-
-/* 0xFF818000 - 0xFF81802F RTL8180 Mass Production Kit
- * 0xFF818500 - 0xFF81850F RTL8185 Setup Utility
- * 0xFF818580 - 0xFF81858F RTL8185 Phy Status Utility
- *
- * by Owen for Production Kit
- * For Production Kit with Agilent Equipments
- * in order to make our custom oids hopefully somewhat unique
- * we will use 0xFF (indicating implementation specific OID)
- * 81(first byte of non zero Realtek unique identifier)
- * 80 (second byte of non zero Realtek unique identifier)
- * XX (the custom OID number - providing 255 possible custom oids)
- */
-#define OID_RT_PRO_RESET_DUT 0xFF818000
-#define OID_RT_PRO_SET_DATA_RATE 0xFF818001
-#define OID_RT_PRO_START_TEST 0xFF818002
-#define OID_RT_PRO_STOP_TEST 0xFF818003
-#define OID_RT_PRO_SET_PREAMBLE 0xFF818004
-#define OID_RT_PRO_SET_SCRAMBLER 0xFF818005
-#define OID_RT_PRO_SET_FILTER_BB 0xFF818006
-#define OID_RT_PRO_SET_MANUAL_DIVERSITY_BB 0xFF818007
-#define OID_RT_PRO_SET_CHANNEL_DIRECT_CALL 0xFF818008
-#define OID_RT_PRO_SET_SLEEP_MODE_DIRECT_CALL 0xFF818009
-#define OID_RT_PRO_SET_WAKE_MODE_DIRECT_CALL 0xFF81800A
-
-#define OID_RT_PRO_SET_TX_ANTENNA_BB 0xFF81800D
-#define OID_RT_PRO_SET_ANTENNA_BB 0xFF81800E
-#define OID_RT_PRO_SET_CR_SCRAMBLER 0xFF81800F
-#define OID_RT_PRO_SET_CR_NEW_FILTER 0xFF818010
-#define OID_RT_PRO_SET_TX_POWER_CONTROL 0xFF818011
-#define OID_RT_PRO_SET_CR_TX_CONFIG 0xFF818012
-#define OID_RT_PRO_GET_TX_POWER_CONTROL 0xFF818013
-#define OID_RT_PRO_GET_CR_SIGNAL_QUALITY 0xFF818014
-#define OID_RT_PRO_SET_CR_SETPOINT 0xFF818015
-#define OID_RT_PRO_SET_INTEGRATOR 0xFF818016
-#define OID_RT_PRO_SET_SIGNAL_QUALITY 0xFF818017
-#define OID_RT_PRO_GET_INTEGRATOR 0xFF818018
-#define OID_RT_PRO_GET_SIGNAL_QUALITY 0xFF818019
-#define OID_RT_PRO_QUERY_EEPROM_TYPE 0xFF81801A
-#define OID_RT_PRO_WRITE_MAC_ADDRESS 0xFF81801B
-#define OID_RT_PRO_READ_MAC_ADDRESS 0xFF81801C
-#define OID_RT_PRO_WRITE_CIS_DATA 0xFF81801D
-#define OID_RT_PRO_READ_CIS_DATA 0xFF81801E
-#define OID_RT_PRO_WRITE_POWER_CONTROL 0xFF81801F
-#define OID_RT_PRO_READ_POWER_CONTROL 0xFF818020
-#define OID_RT_PRO_WRITE_EEPROM 0xFF818021
-#define OID_RT_PRO_READ_EEPROM 0xFF818022
-#define OID_RT_PRO_RESET_TX_PACKET_SENT 0xFF818023
-#define OID_RT_PRO_QUERY_TX_PACKET_SENT 0xFF818024
-#define OID_RT_PRO_RESET_RX_PACKET_RECEIVED 0xFF818025
-#define OID_RT_PRO_QUERY_RX_PACKET_RECEIVED 0xFF818026
-#define OID_RT_PRO_QUERY_RX_PACKET_CRC32_ERROR 0xFF818027
-#define OID_RT_PRO_QUERY_CURRENT_ADDRESS 0xFF818028
-#define OID_RT_PRO_QUERY_PERMANENT_ADDRESS 0xFF818029
-#define OID_RT_PRO_SET_PHILIPS_RF_PARAMETERS 0xFF81802A
-#define OID_RT_PRO_RECEIVE_PACKET 0xFF81802C
-#define OID_RT_PRO_WRITE_EEPROM_BYTE 0xFF81802D
-#define OID_RT_PRO_READ_EEPROM_BYTE 0xFF81802E
-#define OID_RT_PRO_SET_MODULATION 0xFF81802F
-#define OID_RT_DRIVER_OPTION 0xFF818080
-#define OID_RT_RF_OFF 0xFF818081
-#define OID_RT_AUTH_STATUS 0xFF818082
-#define OID_RT_PRO_SET_CONTINUOUS_TX 0xFF81800B
-#define OID_RT_PRO_SET_SINGLE_CARRIER_TX 0xFF81800C
-#define OID_RT_PRO_SET_CARRIER_SUPPRESSION_TX 0xFF81802B
-#define OID_RT_PRO_SET_SINGLE_TONE_TX 0xFF818043
-#define OID_RT_UTILITY_FALSE_ALARM_COUNTERS 0xFF818580
-#define OID_RT_UTILITY_SELECT_DEBUG_MODE 0xFF818581
-#define OID_RT_UTILITY_SELECT_SUBCARRIER_NUMBER 0xFF818582
-#define OID_RT_UTILITY_GET_RSSI_STATUS 0xFF818583
-#define OID_RT_UTILITY_GET_FRAME_DETECTION_STATUS 0xFF818584
-#define OID_RT_UTILITY_GET_AGC_AND_FREQUENCY_OFFSET_ESTIMATION_STATUS \
- 0xFF818585
-#define OID_RT_UTILITY_GET_CHANNEL_ESTIMATION_STATUS 0xFF818586
-#define OID_RT_WIRELESS_MODE 0xFF818500
-#define OID_RT_SUPPORTED_RATES 0xFF818501
-#define OID_RT_DESIRED_RATES 0xFF818502
-#define OID_RT_WIRELESS_MODE_STARTING_ADHOC 0xFF818503
-#define OID_RT_GET_CONNECT_STATE 0xFF030001
-#define OID_RT_RESCAN 0xFF030002
-#define OID_RT_SET_KEY_LENGTH 0xFF030003
-#define OID_RT_SET_DEFAULT_KEY_ID 0xFF030004
-#define OID_RT_SET_CHANNEL 0xFF010182
-#define OID_RT_SET_SNIFFER_MODE 0xFF010183
-#define OID_RT_GET_SIGNAL_QUALITY 0xFF010184
-#define OID_RT_GET_SMALL_PACKET_CRC 0xFF010185
-#define OID_RT_GET_MIDDLE_PACKET_CRC 0xFF010186
-#define OID_RT_GET_LARGE_PACKET_CRC 0xFF010187
-#define OID_RT_GET_TX_RETRY 0xFF010188
-#define OID_RT_GET_RX_RETRY 0xFF010189
-#define OID_RT_PRO_SET_FW_DIG_STATE 0xFF01018A
-#define OID_RT_PRO_SET_FW_RA_STATE 0xFF01018B
-#define OID_RT_GET_RX_TOTAL_PACKET 0xFF010190
-#define OID_RT_GET_TX_BEACON_OK 0xFF010191
-#define OID_RT_GET_TX_BEACON_ERR 0xFF010192
-#define OID_RT_GET_RX_ICV_ERR 0xFF010193
-#define OID_RT_SET_ENCRYPTION_ALGORITHM 0xFF010194
-#define OID_RT_SET_NO_AUTO_RESCAN 0xFF010195
-#define OID_RT_GET_PREAMBLE_MODE 0xFF010196
-#define OID_RT_GET_DRIVER_UP_DELTA_TIME 0xFF010197
-#define OID_RT_GET_AP_IP 0xFF010198
-#define OID_RT_GET_CHANNELPLAN 0xFF010199
-#define OID_RT_SET_PREAMBLE_MODE 0xFF01019A
-#define OID_RT_SET_BCN_INTVL 0xFF01019B
-#define OID_RT_GET_RF_VENDER 0xFF01019C
-#define OID_RT_DEDICATE_PROBE 0xFF01019D
-#define OID_RT_PRO_RX_FILTER_PATTERN 0xFF01019E
-#define OID_RT_GET_DCST_CURRENT_THRESHOLD 0xFF01019F
-#define OID_RT_GET_CCA_ERR 0xFF0101A0
-#define OID_RT_GET_CCA_UPGRADE_THRESHOLD 0xFF0101A1
-#define OID_RT_GET_CCA_FALLBACK_THRESHOLD 0xFF0101A2
-#define OID_RT_GET_CCA_UPGRADE_EVALUATE_TIMES 0xFF0101A3
-#define OID_RT_GET_CCA_FALLBACK_EVALUATE_TIMES 0xFF0101A4
-#define OID_RT_SET_RATE_ADAPTIVE 0xFF0101A5
-#define OID_RT_GET_DCST_EVALUATE_PERIOD 0xFF0101A5
-#define OID_RT_GET_DCST_TIME_UNIT_INDEX 0xFF0101A6
-#define OID_RT_GET_TOTAL_TX_BYTES 0xFF0101A7
-#define OID_RT_GET_TOTAL_RX_BYTES 0xFF0101A8
-#define OID_RT_CURRENT_TX_POWER_LEVEL 0xFF0101A9
-#define OID_RT_GET_ENC_KEY_MISMATCH_COUNT 0xFF0101AA
-#define OID_RT_GET_ENC_KEY_MATCH_COUNT 0xFF0101AB
-#define OID_RT_GET_CHANNEL 0xFF0101AC
-#define OID_RT_SET_CHANNELPLAN 0xFF0101AD
-#define OID_RT_GET_HARDWARE_RADIO_OFF 0xFF0101AE
-#define OID_RT_CHANNELPLAN_BY_COUNTRY 0xFF0101AF
-#define OID_RT_SCAN_AVAILABLE_BSSID 0xFF0101B0
-#define OID_RT_GET_HARDWARE_VERSION 0xFF0101B1
-#define OID_RT_GET_IS_ROAMING 0xFF0101B2
-#define OID_RT_GET_IS_PRIVACY 0xFF0101B3
-#define OID_RT_GET_KEY_MISMATCH 0xFF0101B4
-#define OID_RT_SET_RSSI_ROAM_TRAFFIC_TH 0xFF0101B5
-#define OID_RT_SET_RSSI_ROAM_SIGNAL_TH 0xFF0101B6
-#define OID_RT_RESET_LOG 0xFF0101B7
-#define OID_RT_GET_LOG 0xFF0101B8
-#define OID_RT_SET_INDICATE_HIDDEN_AP 0xFF0101B9
-#define OID_RT_GET_HEADER_FAIL 0xFF0101BA
-#define OID_RT_SUPPORTED_WIRELESS_MODE 0xFF0101BB
-#define OID_RT_GET_CHANNEL_LIST 0xFF0101BC
-#define OID_RT_GET_SCAN_IN_PROGRESS 0xFF0101BD
-#define OID_RT_GET_TX_INFO 0xFF0101BE
-#define OID_RT_RF_READ_WRITE_OFFSET 0xFF0101BF
-#define OID_RT_RF_READ_WRITE 0xFF0101C0
-#define OID_RT_FORCED_DATA_RATE 0xFF0101C1
-#define OID_RT_WIRELESS_MODE_FOR_SCAN_LIST 0xFF0101C2
-#define OID_RT_GET_BSS_WIRELESS_MODE 0xFF0101C3
-#define OID_RT_SCAN_WITH_MAGIC_PACKET 0xFF0101C4
-#define OID_RT_PRO_RX_FILTER 0xFF0111C0
-#define OID_CE_USB_WRITE_REGISTRY 0xFF0111C1
-#define OID_CE_USB_READ_REGISTRY 0xFF0111C2
-#define OID_RT_PRO_SET_INITIAL_GAIN 0xFF0111C3
-#define OID_RT_PRO_SET_BB_RF_STANDBY_MODE 0xFF0111C4
-#define OID_RT_PRO_SET_BB_RF_SHUTDOWN_MODE 0xFF0111C5
-#define OID_RT_PRO_SET_TX_CHARGE_PUMP 0xFF0111C6
-#define OID_RT_PRO_SET_RX_CHARGE_PUMP 0xFF0111C7
-#define OID_RT_PRO_RF_WRITE_REGISTRY 0xFF0111C8
-#define OID_RT_PRO_RF_READ_REGISTRY 0xFF0111C9
-#define OID_RT_PRO_QUERY_RF_TYPE 0xFF0111CA
-#define OID_RT_AP_GET_ASSOCIATED_STATION_LIST 0xFF010300
-#define OID_RT_AP_GET_CURRENT_TIME_STAMP 0xFF010301
-#define OID_RT_AP_SWITCH_INTO_AP_MODE 0xFF010302
-#define OID_RT_AP_SET_DTIM_PERIOD 0xFF010303
-#define OID_RT_AP_SUPPORTED 0xFF010304
-#define OID_RT_AP_SET_PASSPHRASE 0xFF010305
-#define OID_RT_PRO8187_WI_POLL 0xFF818780
-#define OID_RT_PRO_WRITE_BB_REG 0xFF818781
-#define OID_RT_PRO_READ_BB_REG 0xFF818782
-#define OID_RT_PRO_WRITE_RF_REG 0xFF818783
-#define OID_RT_PRO_READ_RF_REG 0xFF818784
-#define OID_RT_MH_VENDER_ID 0xFFEDC100
-#define OID_RT_PRO8711_JOIN_BSS 0xFF871100
-#define OID_RT_PRO_READ_REGISTER 0xFF871101
-#define OID_RT_PRO_WRITE_REGISTER 0xFF871102
-#define OID_RT_PRO_BURST_READ_REGISTER 0xFF871103
-#define OID_RT_PRO_BURST_WRITE_REGISTER 0xFF871104
-#define OID_RT_PRO_WRITE_TXCMD 0xFF871105
-#define OID_RT_PRO_READ16_EEPROM 0xFF871106
-#define OID_RT_PRO_WRITE16_EEPROM 0xFF871107
-#define OID_RT_PRO_H2C_SET_COMMAND 0xFF871108
-#define OID_RT_PRO_H2C_QUERY_RESULT 0xFF871109
-#define OID_RT_PRO8711_WI_POLL 0xFF87110A
-#define OID_RT_PRO8711_PKT_LOSS 0xFF87110B
-#define OID_RT_RD_ATTRIB_MEM 0xFF87110C
-#define OID_RT_WR_ATTRIB_MEM 0xFF87110D
-/*Method 2 for H2C/C2H*/
-#define OID_RT_PRO_H2C_CMD_MODE 0xFF871110
-#define OID_RT_PRO_H2C_CMD_RSP_MODE 0xFF871111
-#define OID_RT_PRO_H2C_CMD_EVENT_MODE 0xFF871112
-#define OID_RT_PRO_WAIT_C2H_EVENT 0xFF871113
-#define OID_RT_PRO_RW_ACCESS_PROTOCOL_TEST 0xFF871114
-#define OID_RT_PRO_SCSI_ACCESS_TEST 0xFF871115
-#define OID_RT_PRO_SCSI_TCPIPOFFLOAD_OUT 0xFF871116
-#define OID_RT_PRO_SCSI_TCPIPOFFLOAD_IN 0xFF871117
-#define OID_RT_RRO_RX_PKT_VIA_IOCTRL 0xFF871118
-#define OID_RT_RRO_RX_PKTARRAY_VIA_IOCTRL 0xFF871119
-#define OID_RT_RPO_SET_PWRMGT_TEST 0xFF87111A
-#define OID_RT_PRO_QRY_PWRMGT_TEST 0XFF87111B
-#define OID_RT_RPO_ASYNC_RWIO_TEST 0xFF87111C
-#define OID_RT_RPO_ASYNC_RWIO_POLL 0xFF87111D
-#define OID_RT_PRO_SET_RF_INTFS 0xFF87111E
-#define OID_RT_POLL_RX_STATUS 0xFF87111F
-#define OID_RT_PRO_CFG_DEBUG_MESSAGE 0xFF871120
-#define OID_RT_PRO_SET_DATA_RATE_EX 0xFF871121
-#define OID_RT_PRO_SET_BASIC_RATE 0xFF871122
-#define OID_RT_PRO_READ_TSSI 0xFF871123
-#define OID_RT_PRO_SET_POWER_TRACKING 0xFF871124
-#define OID_RT_PRO_QRY_PWRSTATE 0xFF871150
-#define OID_RT_PRO_SET_PWRSTATE 0xFF871151
-/*Method 2 , using workitem */
-#define OID_RT_SET_READ_REG 0xFF871181
-#define OID_RT_SET_WRITE_REG 0xFF871182
-#define OID_RT_SET_BURST_READ_REG 0xFF871183
-#define OID_RT_SET_BURST_WRITE_REG 0xFF871184
-#define OID_RT_SET_WRITE_TXCMD 0xFF871185
-#define OID_RT_SET_READ16_EEPROM 0xFF871186
-#define OID_RT_SET_WRITE16_EEPROM 0xFF871187
-#define OID_RT_QRY_POLL_WKITEM 0xFF871188
-
-/*For SDIO INTERFACE only*/
-#define OID_RT_PRO_SYNCPAGERW_SRAM 0xFF8711A0
-#define OID_RT_PRO_871X_DRV_EXT 0xFF8711A1
-
-/*For USB INTERFACE only*/
-#define OID_RT_PRO_USB_VENDOR_REQ 0xFF8711B0
-#define OID_RT_PRO_SCSI_AUTO_TEST 0xFF8711B1
-#define OID_RT_PRO_USB_MAC_AC_FIFO_WRITE 0xFF8711B2
-#define OID_RT_PRO_USB_MAC_RX_FIFO_READ 0xFF8711B3
-#define OID_RT_PRO_USB_MAC_RX_FIFO_POLLING 0xFF8711B4
-
-#define OID_RT_PRO_H2C_SET_RATE_TABLE 0xFF8711FB
-#define OID_RT_PRO_H2C_GET_RATE_TABLE 0xFF8711FC
-#define OID_RT_PRO_H2C_C2H_LBK_TEST 0xFF8711FE
-
-#define OID_RT_PRO_ENCRYPTION_CTRL 0xFF871200
-#define OID_RT_PRO_ADD_STA_INFO 0xFF871201
-#define OID_RT_PRO_DELE_STA_INFO 0xFF871202
-#define OID_RT_PRO_QUERY_DR_VARIABLE 0xFF871203
-
-#define OID_RT_PRO_RX_PACKET_TYPE 0xFF871204
-
-#define OID_RT_PRO_READ_EFUSE 0xFF871205
-#define OID_RT_PRO_WRITE_EFUSE 0xFF871206
-#define OID_RT_PRO_RW_EFUSE_PGPKT 0xFF871207
-#define OID_RT_GET_EFUSE_CURRENT_SIZE 0xFF871208
-
-#define OID_RT_SET_BANDWIDTH 0xFF871209
-#define OID_RT_SET_CRYSTAL_CAP 0xFF87120A
-
-#define OID_RT_SET_RX_PACKET_TYPE 0xFF87120B
-
-#define OID_RT_GET_EFUSE_MAX_SIZE 0xFF87120C
-
-#define OID_RT_PRO_SET_TX_AGC_OFFSET 0xFF87120D
-
-#define OID_RT_PRO_SET_PKT_TEST_MODE 0xFF87120E
-
-#define OID_RT_PRO_FOR_EVM_TEST_SETTING 0xFF87120F
-
-#define OID_RT_PRO_GET_THERMAL_METER 0xFF871210
-
-#define OID_RT_RESET_PHY_RX_PACKET_COUNT 0xFF871211
-#define OID_RT_GET_PHY_RX_PACKET_RECEIVED 0xFF871212
-#define OID_RT_GET_PHY_RX_PACKET_CRC32_ERROR 0xFF871213
-
-#define OID_RT_SET_POWER_DOWN 0xFF871214
-
-#define OID_RT_GET_POWER_MODE 0xFF871215
-
-#define OID_RT_PRO_EFUSE 0xFF871216
-#define OID_RT_PRO_EFUSE_MAP 0xFF871217
-
-#endif /*#ifndef __CUSTOM_OID_H */
-
--- a/drivers/staging/rtl8712/os_intfs.c
+++ /dev/null
@@ -1,465 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * os_intfs.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>.
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _OS_INTFS_C_
-
-#include <linux/module.h>
-#include <linux/kthread.h>
-#include <linux/firmware.h>
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "xmit_osdep.h"
-#include "recv_osdep.h"
-#include "rtl871x_ioctl.h"
-#include "usb_osintf.h"
-
-MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION("rtl871x wireless lan driver");
-MODULE_AUTHOR("Larry Finger");
-
-static char ifname[IFNAMSIZ] = "wlan%d";
-
-/* module param defaults */
-static int chip_version = RTL8712_2ndCUT;
-static int rfintfs = HWPI;
-static int lbkmode = RTL8712_AIR_TRX;
-static int hci = RTL8712_USB;
-static int ampdu_enable = 1;/*for enable tx_ampdu*/
-
-/* The video_mode variable is for video mode.*/
-/* It may be specify when inserting module with video_mode=1 parameter.*/
-static int video_mode = 1; /* enable video mode*/
-
-/*Ndis802_11Infrastructure; infra, ad-hoc, auto*/
-static int network_mode = Ndis802_11IBSS;
-static int channel = 1;/*ad-hoc support requirement*/
-static int wireless_mode = WIRELESS_11BG;
-static int vrtl_carrier_sense = AUTO_VCS;
-static int vcs_type = RTS_CTS;
-static int frag_thresh = 2346;
-static int preamble = PREAMBLE_LONG;/*long, short, auto*/
-static int scan_mode = 1;/*active, passive*/
-static int adhoc_tx_pwr = 1;
-static int soft_ap;
-static int smart_ps = 1;
-static int power_mgnt = PS_MODE_ACTIVE;
-static int radio_enable = 1;
-static int long_retry_lmt = 7;
-static int short_retry_lmt = 7;
-static int busy_thresh = 40;
-static int ack_policy = NORMAL_ACK;
-static int mp_mode;
-static int software_encrypt;
-static int software_decrypt;
-
-static int wmm_enable;/* default is set to disable the wmm.*/
-static int uapsd_enable;
-static int uapsd_max_sp = NO_LIMIT;
-static int uapsd_acbk_en;
-static int uapsd_acbe_en;
-static int uapsd_acvi_en;
-static int uapsd_acvo_en;
-
-static int ht_enable = 1;
-static int cbw40_enable = 1;
-static int rf_config = RTL8712_RF_1T2R; /* 1T2R*/
-static int low_power;
-/* mac address to use instead of the one stored in Efuse */
-char *r8712_initmac;
-static char *initmac;
-/* if wifi_test = 1, driver will disable the turbo mode and pass it to
- * firmware private.
- */
-static int wifi_test;
-
-module_param_string(ifname, ifname, sizeof(ifname), 0644);
-module_param(wifi_test, int, 0644);
-module_param(initmac, charp, 0644);
-module_param(video_mode, int, 0644);
-module_param(chip_version, int, 0644);
-module_param(rfintfs, int, 0644);
-module_param(lbkmode, int, 0644);
-module_param(hci, int, 0644);
-module_param(network_mode, int, 0644);
-module_param(channel, int, 0644);
-module_param(mp_mode, int, 0644);
-module_param(wmm_enable, int, 0644);
-module_param(vrtl_carrier_sense, int, 0644);
-module_param(vcs_type, int, 0644);
-module_param(busy_thresh, int, 0644);
-module_param(ht_enable, int, 0644);
-module_param(cbw40_enable, int, 0644);
-module_param(ampdu_enable, int, 0644);
-module_param(rf_config, int, 0644);
-module_param(power_mgnt, int, 0644);
-module_param(low_power, int, 0644);
-
-MODULE_PARM_DESC(ifname, " Net interface name, wlan%d=default");
-MODULE_PARM_DESC(initmac, "MAC-Address, default: use FUSE");
-
-static int netdev_open(struct net_device *pnetdev);
-static int netdev_close(struct net_device *pnetdev);
-
-static void loadparam(struct _adapter *padapter, struct net_device *pnetdev)
-{
- struct registry_priv *registry_par = &padapter->registrypriv;
-
- registry_par->chip_version = (u8)chip_version;
- registry_par->rfintfs = (u8)rfintfs;
- registry_par->lbkmode = (u8)lbkmode;
- registry_par->hci = (u8)hci;
- registry_par->network_mode = (u8)network_mode;
- memcpy(registry_par->ssid.Ssid, "ANY", 3);
- registry_par->ssid.SsidLength = 3;
- registry_par->channel = (u8)channel;
- registry_par->wireless_mode = (u8)wireless_mode;
- registry_par->vrtl_carrier_sense = (u8)vrtl_carrier_sense;
- registry_par->vcs_type = (u8)vcs_type;
- registry_par->frag_thresh = (u16)frag_thresh;
- registry_par->preamble = (u8)preamble;
- registry_par->scan_mode = (u8)scan_mode;
- registry_par->adhoc_tx_pwr = (u8)adhoc_tx_pwr;
- registry_par->soft_ap = (u8)soft_ap;
- registry_par->smart_ps = (u8)smart_ps;
- registry_par->power_mgnt = (u8)power_mgnt;
- registry_par->radio_enable = (u8)radio_enable;
- registry_par->long_retry_lmt = (u8)long_retry_lmt;
- registry_par->short_retry_lmt = (u8)short_retry_lmt;
- registry_par->busy_thresh = (u16)busy_thresh;
- registry_par->ack_policy = (u8)ack_policy;
- registry_par->mp_mode = (u8)mp_mode;
- registry_par->software_encrypt = (u8)software_encrypt;
- registry_par->software_decrypt = (u8)software_decrypt;
- /*UAPSD*/
- registry_par->wmm_enable = (u8)wmm_enable;
- registry_par->uapsd_enable = (u8)uapsd_enable;
- registry_par->uapsd_max_sp = (u8)uapsd_max_sp;
- registry_par->uapsd_acbk_en = (u8)uapsd_acbk_en;
- registry_par->uapsd_acbe_en = (u8)uapsd_acbe_en;
- registry_par->uapsd_acvi_en = (u8)uapsd_acvi_en;
- registry_par->uapsd_acvo_en = (u8)uapsd_acvo_en;
- registry_par->ht_enable = (u8)ht_enable;
- registry_par->cbw40_enable = (u8)cbw40_enable;
- registry_par->ampdu_enable = (u8)ampdu_enable;
- registry_par->rf_config = (u8)rf_config;
- registry_par->low_power = (u8)low_power;
- registry_par->wifi_test = (u8)wifi_test;
- r8712_initmac = initmac;
-}
-
-static int r871x_net_set_mac_address(struct net_device *pnetdev, void *p)
-{
- struct _adapter *padapter = netdev_priv(pnetdev);
- struct sockaddr *addr = p;
-
- if (!padapter->bup)
- eth_hw_addr_set(pnetdev, addr->sa_data);
- return 0;
-}
-
-static struct net_device_stats *r871x_net_get_stats(struct net_device *pnetdev)
-{
- struct _adapter *padapter = netdev_priv(pnetdev);
- struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
- struct recv_priv *precvpriv = &padapter->recvpriv;
-
- padapter->stats.tx_packets = pxmitpriv->tx_pkts;
- padapter->stats.rx_packets = precvpriv->rx_pkts;
- padapter->stats.tx_dropped = pxmitpriv->tx_drop;
- padapter->stats.rx_dropped = precvpriv->rx_drop;
- padapter->stats.tx_bytes = pxmitpriv->tx_bytes;
- padapter->stats.rx_bytes = precvpriv->rx_bytes;
- return &padapter->stats;
-}
-
-static const struct net_device_ops rtl8712_netdev_ops = {
- .ndo_open = netdev_open,
- .ndo_stop = netdev_close,
- .ndo_start_xmit = r8712_xmit_entry,
- .ndo_set_mac_address = r871x_net_set_mac_address,
- .ndo_get_stats = r871x_net_get_stats,
- .ndo_do_ioctl = r871x_ioctl,
-};
-
-struct net_device *r8712_init_netdev(void)
-{
- struct _adapter *padapter;
- struct net_device *pnetdev;
-
- pnetdev = alloc_etherdev(sizeof(struct _adapter));
- if (!pnetdev)
- return NULL;
- if (dev_alloc_name(pnetdev, ifname) < 0) {
- strscpy(ifname, "wlan%d", sizeof(ifname));
- dev_alloc_name(pnetdev, ifname);
- }
- padapter = netdev_priv(pnetdev);
- padapter->pnetdev = pnetdev;
- pr_info("r8712u: register rtl8712_netdev_ops to netdev_ops\n");
- pnetdev->netdev_ops = &rtl8712_netdev_ops;
- pnetdev->watchdog_timeo = HZ; /* 1 second timeout */
- pnetdev->wireless_handlers = (struct iw_handler_def *)
- &r871x_handlers_def;
- loadparam(padapter, pnetdev);
- netif_carrier_off(pnetdev);
- padapter->pid = 0; /* Initial the PID value used for HW PBC.*/
- return pnetdev;
-}
-
-static u32 start_drv_threads(struct _adapter *padapter)
-{
- padapter->cmd_thread = kthread_run(r8712_cmd_thread, padapter, "%s",
- padapter->pnetdev->name);
- if (IS_ERR(padapter->cmd_thread))
- return _FAIL;
- return _SUCCESS;
-}
-
-void r8712_stop_drv_threads(struct _adapter *padapter)
-{
- struct completion *completion =
- &padapter->cmdpriv.terminate_cmdthread_comp;
-
- /*Below is to terminate r8712_cmd_thread & event_thread...*/
- complete(&padapter->cmdpriv.cmd_queue_comp);
- if (padapter->cmd_thread)
- wait_for_completion_interruptible(completion);
- padapter->cmdpriv.cmd_seq = 1;
-}
-
-static void start_drv_timers(struct _adapter *padapter)
-{
- mod_timer(&padapter->mlmepriv.sitesurveyctrl.sitesurvey_ctrl_timer,
- jiffies + msecs_to_jiffies(5000));
- mod_timer(&padapter->mlmepriv.wdg_timer,
- jiffies + msecs_to_jiffies(2000));
-}
-
-void r8712_stop_drv_timers(struct _adapter *padapter)
-{
- del_timer_sync(&padapter->mlmepriv.assoc_timer);
- del_timer_sync(&padapter->securitypriv.tkip_timer);
- del_timer_sync(&padapter->mlmepriv.scan_to_timer);
- del_timer_sync(&padapter->mlmepriv.dhcp_timer);
- del_timer_sync(&padapter->mlmepriv.wdg_timer);
- del_timer_sync(&padapter->mlmepriv.sitesurveyctrl.sitesurvey_ctrl_timer);
-}
-
-static void init_default_value(struct _adapter *padapter)
-{
- struct registry_priv *pregistrypriv = &padapter->registrypriv;
- struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct security_priv *psecuritypriv = &padapter->securitypriv;
-
- /*xmit_priv*/
- pxmitpriv->vcs_setting = pregistrypriv->vrtl_carrier_sense;
- pxmitpriv->vcs = pregistrypriv->vcs_type;
- pxmitpriv->vcs_type = pregistrypriv->vcs_type;
- pxmitpriv->rts_thresh = pregistrypriv->rts_thresh;
- pxmitpriv->frag_len = pregistrypriv->frag_thresh;
- /* mlme_priv */
- /* Maybe someday we should rename this variable to "active_mode"(Jeff)*/
- pmlmepriv->passive_mode = 1; /* 1: active, 0: passive. */
- /*ht_priv*/
- {
- int i;
- struct ht_priv *phtpriv = &pmlmepriv->htpriv;
-
- phtpriv->ampdu_enable = false;/*set to disabled*/
- for (i = 0; i < 16; i++)
- phtpriv->baddbareq_issued[i] = false;
- }
- /*security_priv*/
- psecuritypriv->sw_encrypt = pregistrypriv->software_encrypt;
- psecuritypriv->sw_decrypt = pregistrypriv->software_decrypt;
- psecuritypriv->binstallGrpkey = _FAIL;
- /*pwrctrl_priv*/
- /*registry_priv*/
- r8712_init_registrypriv_dev_network(padapter);
- r8712_update_registrypriv_dev_network(padapter);
- /*misc.*/
-}
-
-int r8712_init_drv_sw(struct _adapter *padapter)
-{
- int ret;
-
- ret = r8712_init_cmd_priv(&padapter->cmdpriv);
- if (ret)
- return ret;
- padapter->cmdpriv.padapter = padapter;
- ret = r8712_init_evt_priv(&padapter->evtpriv);
- if (ret)
- return ret;
- ret = r8712_init_mlme_priv(padapter);
- if (ret)
- return ret;
- _r8712_init_xmit_priv(&padapter->xmitpriv, padapter);
- _r8712_init_recv_priv(&padapter->recvpriv, padapter);
- memset((unsigned char *)&padapter->securitypriv, 0,
- sizeof(struct security_priv));
- timer_setup(&padapter->securitypriv.tkip_timer,
- r8712_use_tkipkey_handler, 0);
- ret = _r8712_init_sta_priv(&padapter->stapriv);
- if (ret)
- return ret;
- padapter->stapriv.padapter = padapter;
- r8712_init_bcmc_stainfo(padapter);
- r8712_init_pwrctrl_priv(padapter);
- mp871xinit(padapter);
- init_default_value(padapter);
- r8712_InitSwLeds(padapter);
- mutex_init(&padapter->mutex_start);
- return ret;
-}
-
-void r8712_free_drv_sw(struct _adapter *padapter)
-{
- r8712_free_cmd_priv(&padapter->cmdpriv);
- r8712_free_evt_priv(&padapter->evtpriv);
- r8712_DeInitSwLeds(padapter);
- r8712_free_mlme_priv(&padapter->mlmepriv);
- _free_xmit_priv(&padapter->xmitpriv);
- _r8712_free_sta_priv(&padapter->stapriv);
- _r8712_free_recv_priv(&padapter->recvpriv);
- mp871xdeinit(padapter);
-}
-
-static void enable_video_mode(struct _adapter *padapter, int cbw40_value)
-{
- /* bit 8:
- * 1 -> enable video mode to 96B AP
- * 0 -> disable video mode to 96B AP
- * bit 9:
- * 1 -> enable 40MHz mode
- * 0 -> disable 40MHz mode
- * bit 10:
- * 1 -> enable STBC
- * 0 -> disable STBC
- */
- u32 intcmd = 0xf4000500; /* enable bit8, bit10*/
-
- if (cbw40_value) {
- /* if the driver supports the 40M bandwidth,
- * we can enable the bit 9.
- */
- intcmd |= 0x200;
- }
- r8712_fw_cmd(padapter, intcmd);
-}
-
-/*
- *
- * This function intends to handle the activation of an interface
- * i.e. when it is brought Up/Active from a Down state.
- *
- */
-static int netdev_open(struct net_device *pnetdev)
-{
- struct _adapter *padapter = netdev_priv(pnetdev);
-
- mutex_lock(&padapter->mutex_start);
- if (!padapter->bup) {
- padapter->driver_stopped = false;
- padapter->surprise_removed = false;
- padapter->bup = true;
- if (rtl871x_hal_init(padapter) != _SUCCESS)
- goto netdev_open_error;
- if (!r8712_initmac) {
- /* Use the mac address stored in the Efuse */
- eth_hw_addr_set(pnetdev,
- padapter->eeprompriv.mac_addr);
- } else {
- /* We have to inform f/w to use user-supplied MAC
- * address.
- */
- msleep(200);
- r8712_setMacAddr_cmd(padapter,
- (const u8 *)pnetdev->dev_addr);
- /*
- * The "myid" function will get the wifi mac address
- * from eeprompriv structure instead of netdev
- * structure. So, we have to overwrite the mac_addr
- * stored in the eeprompriv structure. In this case,
- * the real mac address won't be used anymore. So that,
- * the eeprompriv.mac_addr should store the mac which
- * users specify.
- */
- memcpy(padapter->eeprompriv.mac_addr,
- pnetdev->dev_addr, ETH_ALEN);
- }
- if (start_drv_threads(padapter) != _SUCCESS)
- goto netdev_open_error;
- if (!padapter->dvobjpriv.inirp_init)
- goto netdev_open_error;
- else
- padapter->dvobjpriv.inirp_init(padapter);
- r8712_set_ps_mode(padapter, padapter->registrypriv.power_mgnt,
- padapter->registrypriv.smart_ps);
- }
- if (!netif_queue_stopped(pnetdev))
- netif_start_queue(pnetdev);
- else
- netif_wake_queue(pnetdev);
-
- if (video_mode)
- enable_video_mode(padapter, cbw40_enable);
- /* start driver mlme relation timer */
- start_drv_timers(padapter);
- padapter->ledpriv.LedControlHandler(padapter, LED_CTL_NO_LINK);
- mutex_unlock(&padapter->mutex_start);
- return 0;
-netdev_open_error:
- padapter->bup = false;
- netif_carrier_off(pnetdev);
- netif_stop_queue(pnetdev);
- mutex_unlock(&padapter->mutex_start);
- return -1;
-}
-
-/*
- *
- * This function intends to handle the shutdown of an interface
- * i.e. when it is brought Down from an Up/Active state.
- *
- */
-static int netdev_close(struct net_device *pnetdev)
-{
- struct _adapter *padapter = netdev_priv(pnetdev);
-
- /* Close LED*/
- padapter->ledpriv.LedControlHandler(padapter, LED_CTL_POWER_OFF);
- msleep(200);
-
- /*s1.*/
- if (pnetdev) {
- if (!netif_queue_stopped(pnetdev))
- netif_stop_queue(pnetdev);
- }
- /*s2.*/
- /*s2-1. issue disassoc_cmd to fw*/
- r8712_disassoc_cmd(padapter);
- /*s2-2. indicate disconnect to os*/
- r8712_ind_disconnect(padapter);
- /*s2-3.*/
- r8712_free_assoc_resources(padapter);
- /*s2-4.*/
- r8712_free_network_queue(padapter);
- return 0;
-}
-
-#include "mlme_osdep.h"
--- a/drivers/staging/rtl8712/osdep_intf.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __OSDEP_INTF_H_
-#define __OSDEP_INTF_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-#define RND4(x) (((x >> 2) + ((x & 3) != 0)) << 2)
-
-struct intf_priv {
- u8 *intf_dev;
- /* when in USB, IO is through interrupt in/out endpoints */
- struct usb_device *udev;
- struct urb *piorw_urb;
- struct completion io_retevt_comp;
-};
-
-int r871x_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
-
-#endif /*_OSDEP_INTF_H_*/
--- a/drivers/staging/rtl8712/osdep_service.h
+++ /dev/null
@@ -1,60 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __OSDEP_SERVICE_H_
-#define __OSDEP_SERVICE_H_
-
-#define _SUCCESS 1
-#define _FAIL 0
-
-#include <linux/spinlock.h>
-
-#include <linux/interrupt.h>
-#include <linux/semaphore.h>
-#include <linux/sched/signal.h>
-#include <linux/sem.h>
-#include <linux/netdevice.h>
-#include <linux/etherdevice.h>
-#include <net/iw_handler.h>
-#include <linux/proc_fs.h> /* Necessary because we use the proc fs */
-
-#include "basic_types.h"
-
-struct __queue {
- struct list_head queue;
- spinlock_t lock;
-};
-
-#define _pkt struct sk_buff
-#define _buffer unsigned char
-
-#define _init_queue(pqueue) \
- do { \
- INIT_LIST_HEAD(&((pqueue)->queue)); \
- spin_lock_init(&((pqueue)->lock)); \
- } while (0)
-
-static inline u32 end_of_queue_search(struct list_head *head,
- struct list_head *plist)
-{
- return (head == plist);
-}
-
-static inline void flush_signals_thread(void)
-{
- if (signal_pending(current))
- flush_signals(current);
-}
-
-#endif
-
--- a/drivers/staging/rtl8712/recv_linux.c
+++ /dev/null
@@ -1,139 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * recv_linux.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>.
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RECV_OSDEP_C_
-
-#include <linux/usb.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "wifi.h"
-#include "recv_osdep.h"
-#include "osdep_intf.h"
-#include "ethernet.h"
-#include <linux/if_arp.h>
-#include "usb_ops.h"
-
-/*init os related resource in struct recv_priv*/
-/*alloc os related resource in union recv_frame*/
-void r8712_os_recv_resource_alloc(struct _adapter *padapter,
- union recv_frame *precvframe)
-{
- precvframe->u.hdr.pkt_newalloc = NULL;
- precvframe->u.hdr.pkt = NULL;
-}
-
-/*alloc os related resource in struct recv_buf*/
-int r8712_os_recvbuf_resource_alloc(struct _adapter *padapter,
- struct recv_buf *precvbuf)
-{
- int res = 0;
-
- precvbuf->irp_pending = false;
- precvbuf->purb = usb_alloc_urb(0, GFP_KERNEL);
- if (!precvbuf->purb)
- res = -ENOMEM;
- precvbuf->pskb = NULL;
- precvbuf->pallocated_buf = NULL;
- precvbuf->pbuf = NULL;
- precvbuf->pdata = NULL;
- precvbuf->phead = NULL;
- precvbuf->ptail = NULL;
- precvbuf->pend = NULL;
- precvbuf->transfer_len = 0;
- precvbuf->len = 0;
- return res;
-}
-
-/*free os related resource in struct recv_buf*/
-void r8712_os_recvbuf_resource_free(struct _adapter *padapter,
- struct recv_buf *precvbuf)
-{
- if (precvbuf->pskb)
- dev_kfree_skb_any(precvbuf->pskb);
- if (precvbuf->purb) {
- usb_kill_urb(precvbuf->purb);
- usb_free_urb(precvbuf->purb);
- }
-}
-
-void r8712_handle_tkip_mic_err(struct _adapter *adapter, u8 bgroup)
-{
- union iwreq_data wrqu;
- struct iw_michaelmicfailure ev;
- struct mlme_priv *mlmepriv = &adapter->mlmepriv;
-
- memset(&ev, 0x00, sizeof(ev));
- if (bgroup)
- ev.flags |= IW_MICFAILURE_GROUP;
- else
- ev.flags |= IW_MICFAILURE_PAIRWISE;
- ev.src_addr.sa_family = ARPHRD_ETHER;
- ether_addr_copy(ev.src_addr.sa_data, &mlmepriv->assoc_bssid[0]);
- memset(&wrqu, 0x00, sizeof(wrqu));
- wrqu.data.length = sizeof(ev);
- wireless_send_event(adapter->pnetdev, IWEVMICHAELMICFAILURE, &wrqu,
- (char *)&ev);
-}
-
-void r8712_recv_indicatepkt(struct _adapter *adapter,
- union recv_frame *recvframe)
-{
- struct recv_priv *recvpriv;
- struct __queue *free_recv_queue;
- _pkt *skb;
- struct rx_pkt_attrib *attrib = &recvframe->u.hdr.attrib;
-
- recvpriv = &adapter->recvpriv;
- free_recv_queue = &recvpriv->free_recv_queue;
- skb = recvframe->u.hdr.pkt;
- if (!skb)
- goto _recv_indicatepkt_drop;
- skb->data = recvframe->u.hdr.rx_data;
- skb->len = recvframe->u.hdr.len;
- skb_set_tail_pointer(skb, skb->len);
- if ((attrib->tcpchk_valid == 1) && (attrib->tcp_chkrpt == 1))
- skb->ip_summed = CHECKSUM_UNNECESSARY;
- else
- skb->ip_summed = CHECKSUM_NONE;
- skb->dev = adapter->pnetdev;
- skb->protocol = eth_type_trans(skb, adapter->pnetdev);
- netif_rx(skb);
- recvframe->u.hdr.pkt = NULL; /* pointers to NULL before
- * r8712_free_recvframe()
- */
- r8712_free_recvframe(recvframe, free_recv_queue);
- return;
-_recv_indicatepkt_drop:
- /*enqueue back to free_recv_queue*/
- if (recvframe)
- r8712_free_recvframe(recvframe, free_recv_queue);
- recvpriv->rx_drop++;
-}
-
-static void _r8712_reordering_ctrl_timeout_handler (struct timer_list *t)
-{
- struct recv_reorder_ctrl *reorder_ctrl =
- from_timer(reorder_ctrl, t, reordering_ctrl_timer);
-
- r8712_reordering_ctrl_timeout_handler(reorder_ctrl);
-}
-
-void r8712_init_recv_timer(struct recv_reorder_ctrl *preorder_ctrl)
-{
- timer_setup(&preorder_ctrl->reordering_ctrl_timer,
- _r8712_reordering_ctrl_timeout_handler, 0);
-}
--- a/drivers/staging/rtl8712/recv_osdep.h
+++ /dev/null
@@ -1,39 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RECV_OSDEP_H_
-#define __RECV_OSDEP_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include <linux/skbuff.h>
-
-void _r8712_init_recv_priv(struct recv_priv *precvpriv,
- struct _adapter *padapter);
-void _r8712_free_recv_priv(struct recv_priv *precvpriv);
-void r8712_recv_entry(union recv_frame *precv_frame);
-void r8712_recv_indicatepkt(struct _adapter *adapter,
- union recv_frame *precv_frame);
-void r8712_handle_tkip_mic_err(struct _adapter *padapter, u8 bgroup);
-void r8712_init_recv_priv(struct recv_priv *precvpriv,
- struct _adapter *padapter);
-void r8712_free_recv_priv(struct recv_priv *precvpriv);
-void r8712_os_recv_resource_alloc(struct _adapter *padapter,
- union recv_frame *precvframe);
-int r8712_os_recvbuf_resource_alloc(struct _adapter *padapter,
- struct recv_buf *precvbuf);
-void r8712_os_recvbuf_resource_free(struct _adapter *padapter,
- struct recv_buf *precvbuf);
-void r8712_init_recv_timer(struct recv_reorder_ctrl *preorder_ctrl);
-
-#endif
--- a/drivers/staging/rtl8712/rtl8712_bitdef.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-
-#ifndef __RTL8712_BITDEF_H__
-#define __RTL8712_BITDEF_H__
-
-#include "rtl8712_cmdctrl_bitdef.h"
-#include "rtl8712_syscfg_bitdef.h"
-#include "rtl8712_macsetting_bitdef.h"
-#include "rtl8712_timectrl_bitdef.h"
-#include "rtl8712_fifoctrl_bitdef.h"
-#include "rtl8712_ratectrl_bitdef.h"
-#include "rtl8712_edcasetting_bitdef.h"
-#include "rtl8712_wmac_bitdef.h"
-#include "rtl8712_security_bitdef.h"
-#include "rtl8712_powersave_bitdef.h"
-#include "rtl8712_gp_bitdef.h"
-#include "rtl8712_interrupt_bitdef.h"
-#include "rtl8712_debugctrl_bitdef.h"
-
-#endif /* __RTL8712_BITDEF_H__ */
-
--- a/drivers/staging/rtl8712/rtl8712_cmd.c
+++ /dev/null
@@ -1,409 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl8712_cmd.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>.
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL8712_CMD_C_
-
-#include <linux/compiler.h>
-#include <linux/kernel.h>
-#include <linux/errno.h>
-#include <linux/slab.h>
-#include <linux/sched/signal.h>
-#include <linux/module.h>
-#include <linux/kref.h>
-#include <linux/netdevice.h>
-#include <linux/skbuff.h>
-#include <linux/usb.h>
-#include <linux/usb/ch9.h>
-#include <linux/circ_buf.h>
-#include <linux/uaccess.h>
-#include <asm/byteorder.h>
-#include <linux/atomic.h>
-#include <linux/semaphore.h>
-#include <linux/rtnetlink.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "recv_osdep.h"
-#include "mlme_osdep.h"
-#include "rtl871x_ioctl_set.h"
-
-static void check_hw_pbc(struct _adapter *padapter)
-{
- u8 tmp1byte;
-
- r8712_write8(padapter, MAC_PINMUX_CTRL, (GPIOMUX_EN | GPIOSEL_GPIO));
- tmp1byte = r8712_read8(padapter, GPIO_IO_SEL);
- tmp1byte &= ~(HAL_8192S_HW_GPIO_WPS_BIT);
- r8712_write8(padapter, GPIO_IO_SEL, tmp1byte);
- tmp1byte = r8712_read8(padapter, GPIO_CTRL);
- if (tmp1byte == 0xff)
- return;
- if (tmp1byte & HAL_8192S_HW_GPIO_WPS_BIT) {
- /* Here we only set bPbcPressed to true
- * After trigger PBC, the variable will be set to false
- */
- netdev_dbg(padapter->pnetdev, "CheckPbcGPIO - PBC is pressed !!!!\n");
- /* 0 is the default value and it means the application monitors
- * the HW PBC doesn't provide its pid to driver.
- */
- if (padapter->pid == 0)
- return;
- kill_pid(find_vpid(padapter->pid), SIGUSR1, 1);
- }
-}
-
-/* query rx phy status from fw.
- * Adhoc mode: beacon.
- * Infrastructure mode: beacon , data.
- */
-static void query_fw_rx_phy_status(struct _adapter *padapter)
-{
- u32 val32 = 0;
- int pollingcnts = 50;
-
- if (check_fwstate(&padapter->mlmepriv, _FW_LINKED)) {
- r8712_write32(padapter, IOCMD_CTRL_REG, 0xf4000001);
- msleep(100);
- /* Wait FW complete IO Cmd */
- while ((r8712_read32(padapter, IOCMD_CTRL_REG)) &&
- (pollingcnts > 0)) {
- pollingcnts--;
- msleep(20);
- }
- if (pollingcnts != 0)
- val32 = r8712_read32(padapter, IOCMD_DATA_REG);
- else /* time out */
- val32 = 0;
- val32 >>= 4;
- padapter->recvpriv.fw_rssi =
- (u8)r8712_signal_scale_mapping(val32);
- }
-}
-
-/* check mlme, hw, phy, or dynamic algorithm status. */
-static void StatusWatchdogCallback(struct _adapter *padapter)
-{
- check_hw_pbc(padapter);
- query_fw_rx_phy_status(padapter);
-}
-
-static void r871x_internal_cmd_hdl(struct _adapter *padapter, u8 *pbuf)
-{
- struct drvint_cmd_parm *pdrvcmd;
-
- if (!pbuf)
- return;
- pdrvcmd = (struct drvint_cmd_parm *)pbuf;
- switch (pdrvcmd->i_cid) {
- case WDG_WK_CID:
- StatusWatchdogCallback(padapter);
- break;
- default:
- break;
- }
- kfree(pdrvcmd->pbuf);
-}
-
-static u8 read_bbreg_hdl(struct _adapter *padapter, u8 *pbuf)
-{
- struct cmd_obj *pcmd = (struct cmd_obj *)pbuf;
-
- r8712_free_cmd_obj(pcmd);
- return H2C_SUCCESS;
-}
-
-static u8 write_bbreg_hdl(struct _adapter *padapter, u8 *pbuf)
-{
- void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd);
- struct cmd_obj *pcmd = (struct cmd_obj *)pbuf;
-
- pcmd_callback = cmd_callback[pcmd->cmdcode].callback;
- if (!pcmd_callback)
- r8712_free_cmd_obj(pcmd);
- else
- pcmd_callback(padapter, pcmd);
- return H2C_SUCCESS;
-}
-
-static u8 read_rfreg_hdl(struct _adapter *padapter, u8 *pbuf)
-{
- u32 val;
- void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd);
- struct cmd_obj *pcmd = (struct cmd_obj *)pbuf;
-
- if (pcmd->rsp && pcmd->rspsz > 0)
- memcpy(pcmd->rsp, (u8 *)&val, pcmd->rspsz);
- pcmd_callback = cmd_callback[pcmd->cmdcode].callback;
- if (!pcmd_callback)
- r8712_free_cmd_obj(pcmd);
- else
- pcmd_callback(padapter, pcmd);
- return H2C_SUCCESS;
-}
-
-static u8 write_rfreg_hdl(struct _adapter *padapter, u8 *pbuf)
-{
- void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd);
- struct cmd_obj *pcmd = (struct cmd_obj *)pbuf;
-
- pcmd_callback = cmd_callback[pcmd->cmdcode].callback;
- if (!pcmd_callback)
- r8712_free_cmd_obj(pcmd);
- else
- pcmd_callback(padapter, pcmd);
- return H2C_SUCCESS;
-}
-
-static u8 sys_suspend_hdl(struct _adapter *padapter, u8 *pbuf)
-{
- struct cmd_obj *pcmd = (struct cmd_obj *)pbuf;
-
- r8712_free_cmd_obj(pcmd);
- return H2C_SUCCESS;
-}
-
-static struct cmd_obj *cmd_hdl_filter(struct _adapter *padapter,
- struct cmd_obj *pcmd)
-{
- struct cmd_obj *pcmd_r;
-
- if (!pcmd)
- return pcmd;
- pcmd_r = NULL;
-
- switch (pcmd->cmdcode) {
- case GEN_CMD_CODE(_Read_BBREG):
- read_bbreg_hdl(padapter, (u8 *)pcmd);
- break;
- case GEN_CMD_CODE(_Write_BBREG):
- write_bbreg_hdl(padapter, (u8 *)pcmd);
- break;
- case GEN_CMD_CODE(_Read_RFREG):
- read_rfreg_hdl(padapter, (u8 *)pcmd);
- break;
- case GEN_CMD_CODE(_Write_RFREG):
- write_rfreg_hdl(padapter, (u8 *)pcmd);
- break;
- case GEN_CMD_CODE(_SetUsbSuspend):
- sys_suspend_hdl(padapter, (u8 *)pcmd);
- break;
- case GEN_CMD_CODE(_JoinBss):
- r8712_joinbss_reset(padapter);
- /* Before set JoinBss_CMD to FW, driver must ensure FW is in
- * PS_MODE_ACTIVE. Directly write rpwm to radio on and assign
- * new pwr_mode to Driver, instead of use workitem to change
- * state.
- */
- if (padapter->pwrctrlpriv.pwr_mode > PS_MODE_ACTIVE) {
- padapter->pwrctrlpriv.pwr_mode = PS_MODE_ACTIVE;
- mutex_lock(&padapter->pwrctrlpriv.mutex_lock);
- r8712_set_rpwm(padapter, PS_STATE_S4);
- mutex_unlock(&padapter->pwrctrlpriv.mutex_lock);
- }
- pcmd_r = pcmd;
- break;
- case _DRV_INT_CMD_:
- r871x_internal_cmd_hdl(padapter, pcmd->parmbuf);
- r8712_free_cmd_obj(pcmd);
- pcmd_r = NULL;
- break;
- default:
- pcmd_r = pcmd;
- break;
- }
- return pcmd_r; /* if returning pcmd_r == NULL, pcmd must be free. */
-}
-
-u8 r8712_fw_cmd(struct _adapter *pAdapter, u32 cmd)
-{
- int pollingcnts = 50;
-
- r8712_write32(pAdapter, IOCMD_CTRL_REG, cmd);
- msleep(100);
- while ((r8712_read32(pAdapter, IOCMD_CTRL_REG != 0)) &&
- (pollingcnts > 0)) {
- pollingcnts--;
- msleep(20);
- }
- if (pollingcnts == 0)
- return false;
- return true;
-}
-
-void r8712_fw_cmd_data(struct _adapter *pAdapter, u32 *value, u8 flag)
-{
- if (flag == 0) /* set */
- r8712_write32(pAdapter, IOCMD_DATA_REG, *value);
- else /* query */
- *value = r8712_read32(pAdapter, IOCMD_DATA_REG);
-}
-
-int r8712_cmd_thread(void *context)
-{
- struct cmd_obj *pcmd;
- unsigned int cmdsz, wr_sz;
- __le32 *pcmdbuf;
- struct tx_desc *pdesc;
- void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd);
- struct _adapter *padapter = context;
- struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
- struct completion *cmd_queue_comp =
- &pcmdpriv->cmd_queue_comp;
- struct mutex *pwctrl_lock = &padapter->pwrctrlpriv.mutex_lock;
-
- allow_signal(SIGTERM);
- while (1) {
- if (wait_for_completion_interruptible(cmd_queue_comp))
- break;
- if (padapter->driver_stopped || padapter->surprise_removed)
- break;
- if (r8712_register_cmd_alive(padapter))
- continue;
-_next:
- pcmd = r8712_dequeue_cmd(&pcmdpriv->cmd_queue);
- if (!(pcmd)) {
- r8712_unregister_cmd_alive(padapter);
- continue;
- }
- pcmdbuf = (__le32 *)pcmdpriv->cmd_buf;
- pdesc = (struct tx_desc *)pcmdbuf;
- memset(pdesc, 0, TXDESC_SIZE);
- pcmd = cmd_hdl_filter(padapter, pcmd);
- if (pcmd) { /* if pcmd != NULL, cmd will be handled by f/w */
- struct dvobj_priv *pdvobj = &padapter->dvobjpriv;
- u8 blnPending = 0;
- u16 cmdcode = pcmd->cmdcode;
-
- pcmdpriv->cmd_issued_cnt++;
- cmdsz = round_up(pcmd->cmdsz, 8);
- wr_sz = TXDESC_SIZE + 8 + cmdsz;
- pdesc->txdw0 |= cpu_to_le32((wr_sz - TXDESC_SIZE) &
- 0x0000ffff);
- if (pdvobj->ishighspeed) {
- if ((wr_sz % 512) == 0)
- blnPending = 1;
- } else {
- if ((wr_sz % 64) == 0)
- blnPending = 1;
- }
- if (blnPending) { /* 32 bytes for TX Desc - 8 offset */
- pdesc->txdw0 |= cpu_to_le32(((TXDESC_SIZE +
- OFFSET_SZ + 8) << OFFSET_SHT) &
- 0x00ff0000);
- } else {
- pdesc->txdw0 |= cpu_to_le32(((TXDESC_SIZE +
- OFFSET_SZ) <<
- OFFSET_SHT) &
- 0x00ff0000);
- }
- pdesc->txdw0 |= cpu_to_le32(OWN | FSG | LSG);
- pdesc->txdw1 |= cpu_to_le32((0x13 << QSEL_SHT) &
- 0x00001f00);
- pcmdbuf += (TXDESC_SIZE >> 2);
- *pcmdbuf = cpu_to_le32((cmdsz & 0x0000ffff) |
- (pcmd->cmdcode << 16) |
- (pcmdpriv->cmd_seq << 24));
- pcmdbuf += 2; /* 8 bytes alignment */
- memcpy((u8 *)pcmdbuf, pcmd->parmbuf, pcmd->cmdsz);
- if (blnPending)
- wr_sz += 8; /* Append 8 bytes */
- r8712_write_mem(padapter, RTL8712_DMA_H2CCMD, wr_sz,
- (u8 *)pdesc);
- pcmdpriv->cmd_seq++;
- if (cmdcode == GEN_CMD_CODE(_CreateBss)) {
- pcmd->res = H2C_SUCCESS;
- pcmd_callback = cmd_callback[cmdcode].callback;
- if (pcmd_callback)
- pcmd_callback(padapter, pcmd);
- continue;
- }
- if (cmdcode == GEN_CMD_CODE(_SetPwrMode)) {
- if (padapter->pwrctrlpriv.bSleep) {
- mutex_lock(pwctrl_lock);
- r8712_set_rpwm(padapter, PS_STATE_S2);
- mutex_unlock(pwctrl_lock);
- }
- }
- r8712_free_cmd_obj(pcmd);
- if (list_empty(&pcmdpriv->cmd_queue.queue)) {
- r8712_unregister_cmd_alive(padapter);
- continue;
- } else {
- goto _next;
- }
- } else {
- goto _next;
- }
- flush_signals_thread();
- }
- /* free all cmd_obj resources */
- do {
- pcmd = r8712_dequeue_cmd(&pcmdpriv->cmd_queue);
- if (!pcmd)
- break;
- r8712_free_cmd_obj(pcmd);
- } while (1);
- complete(&pcmdpriv->terminate_cmdthread_comp);
- return 0;
-}
-
-void r8712_event_handle(struct _adapter *padapter, __le32 *peventbuf)
-{
- u8 evt_code, evt_seq;
- u16 evt_sz;
- void (*event_callback)(struct _adapter *dev, u8 *pbuf);
- struct evt_priv *pevt_priv = &padapter->evtpriv;
-
- if (!peventbuf)
- goto _abort_event_;
- evt_sz = (u16)(le32_to_cpu(*peventbuf) & 0xffff);
- evt_seq = (u8)((le32_to_cpu(*peventbuf) >> 24) & 0x7f);
- evt_code = (u8)((le32_to_cpu(*peventbuf) >> 16) & 0xff);
- /* checking event sequence... */
- if ((evt_seq & 0x7f) != pevt_priv->event_seq) {
- pevt_priv->event_seq = ((evt_seq + 1) & 0x7f);
- goto _abort_event_;
- }
- /* checking if event code is valid */
- if (evt_code >= MAX_C2HEVT) {
- pevt_priv->event_seq = ((evt_seq + 1) & 0x7f);
- goto _abort_event_;
- } else if ((evt_code == GEN_EVT_CODE(_Survey)) &&
- (evt_sz > sizeof(struct wlan_bssid_ex))) {
- pevt_priv->event_seq = ((evt_seq + 1) & 0x7f);
- goto _abort_event_;
- }
- /* checking if event size match the event parm size */
- if ((wlanevents[evt_code].parmsize) &&
- (wlanevents[evt_code].parmsize != evt_sz)) {
- pevt_priv->event_seq = ((evt_seq + 1) & 0x7f);
- goto _abort_event_;
- } else if ((evt_sz == 0) && (evt_code != GEN_EVT_CODE(_WPS_PBC))) {
- pevt_priv->event_seq = ((evt_seq + 1) & 0x7f);
- goto _abort_event_;
- }
- pevt_priv->event_seq++; /* update evt_seq */
- if (pevt_priv->event_seq > 127)
- pevt_priv->event_seq = 0;
- /* move to event content, 8 bytes alignment */
- peventbuf = peventbuf + 2;
- event_callback = wlanevents[evt_code].event_callback;
- if (event_callback)
- event_callback(padapter, (u8 *)peventbuf);
- pevt_priv->evt_done_cnt++;
-_abort_event_:
- return;
-}
--- a/drivers/staging/rtl8712/rtl8712_cmd.h
+++ /dev/null
@@ -1,231 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_CMD_H_
-#define __RTL8712_CMD_H_
-
-#define CMD_HDR_SZ 8
-
-u8 r8712_fw_cmd(struct _adapter *pAdapter, u32 cmd);
-void r8712_fw_cmd_data(struct _adapter *pAdapter, u32 *value, u8 flag);
-
-struct cmd_hdr {
- u32 cmd_dw0;
- u32 cmd_dw1;
-};
-
-enum rtl8712_h2c_cmd {
- GEN_CMD_CODE(_Read_MACREG), /*0*/
- GEN_CMD_CODE(_Write_MACREG),
- GEN_CMD_CODE(_Read_BBREG),
- GEN_CMD_CODE(_Write_BBREG),
- GEN_CMD_CODE(_Read_RFREG),
- GEN_CMD_CODE(_Write_RFREG), /*5*/
- GEN_CMD_CODE(_Read_EEPROM),
- GEN_CMD_CODE(_Write_EEPROM),
- GEN_CMD_CODE(_Read_EFUSE),
- GEN_CMD_CODE(_Write_EFUSE),
-
- GEN_CMD_CODE(_Read_CAM), /*10*/
- GEN_CMD_CODE(_Write_CAM),
- GEN_CMD_CODE(_setBCNITV),
- GEN_CMD_CODE(_setMBIDCFG),
- GEN_CMD_CODE(_JoinBss), /*14*/
- GEN_CMD_CODE(_DisConnect), /*15*/
- GEN_CMD_CODE(_CreateBss),
- GEN_CMD_CODE(_SetOpMode),
- GEN_CMD_CODE(_SiteSurvey), /*18*/
- GEN_CMD_CODE(_SetAuth),
-
- GEN_CMD_CODE(_SetKey), /*20*/
- GEN_CMD_CODE(_SetStaKey),
- GEN_CMD_CODE(_SetAssocSta),
- GEN_CMD_CODE(_DelAssocSta),
- GEN_CMD_CODE(_SetStaPwrState),
- GEN_CMD_CODE(_SetBasicRate), /*25*/
- GEN_CMD_CODE(_GetBasicRate),
- GEN_CMD_CODE(_SetDataRate),
- GEN_CMD_CODE(_GetDataRate),
- GEN_CMD_CODE(_SetPhyInfo),
-
- GEN_CMD_CODE(_GetPhyInfo), /*30*/
- GEN_CMD_CODE(_SetPhy),
- GEN_CMD_CODE(_GetPhy),
- GEN_CMD_CODE(_readRssi),
- GEN_CMD_CODE(_readGain),
- GEN_CMD_CODE(_SetAtim), /*35*/
- GEN_CMD_CODE(_SetPwrMode),
- GEN_CMD_CODE(_JoinbssRpt),
- GEN_CMD_CODE(_SetRaTable),
- GEN_CMD_CODE(_GetRaTable),
-
- GEN_CMD_CODE(_GetCCXReport), /*40*/
- GEN_CMD_CODE(_GetDTMReport),
- GEN_CMD_CODE(_GetTXRateStatistics),
- GEN_CMD_CODE(_SetUsbSuspend),
- GEN_CMD_CODE(_SetH2cLbk),
- GEN_CMD_CODE(_AddBAReq), /*45*/
-
- GEN_CMD_CODE(_SetChannel), /*46*/
-/* MP_OFFLOAD Start (47~54)*/
- GEN_CMD_CODE(_SetTxPower),
- GEN_CMD_CODE(_SwitchAntenna),
- GEN_CMD_CODE(_SetCrystalCap),
- GEN_CMD_CODE(_SetSingleCarrierTx), /*50*/
- GEN_CMD_CODE(_SetSingleToneTx),
- GEN_CMD_CODE(_SetCarrierSuppressionTx),
- GEN_CMD_CODE(_SetContinuousTx),
- GEN_CMD_CODE(_SwitchBandwidth), /*54*/
-/* MP_OFFLOAD End*/
- GEN_CMD_CODE(_TX_Beacon), /*55*/
- GEN_CMD_CODE(_SetPowerTracking),
- GEN_CMD_CODE(_AMSDU_TO_AMPDU), /*57*/
- GEN_CMD_CODE(_SetMacAddress), /*58*/
-
- GEN_CMD_CODE(_DisconnectCtrl), /*59*/
- GEN_CMD_CODE(_SetChannelPlan), /*60*/
- GEN_CMD_CODE(_DisconnectCtrlEx), /*61*/
-
- /* To do, modify these h2c cmd, add or delete */
- GEN_CMD_CODE(_GetH2cLbk),
-
- /* WPS extra IE */
- GEN_CMD_CODE(_SetProbeReqExtraIE),
- GEN_CMD_CODE(_SetAssocReqExtraIE),
- GEN_CMD_CODE(_SetProbeRspExtraIE),
- GEN_CMD_CODE(_SetAssocRspExtraIE),
-
- /* the following is driver will do */
- GEN_CMD_CODE(_GetCurDataRate),
-
- GEN_CMD_CODE(_GetTxRetrycnt), /* to record times that Tx retry to
- * transmit packet after association
- */
- GEN_CMD_CODE(_GetRxRetrycnt), /* to record total number of the
- * received frame with ReTry bit set in
- * the WLAN header
- */
-
- GEN_CMD_CODE(_GetBCNOKcnt),
- GEN_CMD_CODE(_GetBCNERRcnt),
- GEN_CMD_CODE(_GetCurTxPwrLevel),
-
- GEN_CMD_CODE(_SetDIG),
- GEN_CMD_CODE(_SetRA),
- GEN_CMD_CODE(_SetPT),
- GEN_CMD_CODE(_ReadTSSI),
-
- MAX_H2CCMD
-};
-
-#define _GetBBReg_CMD_ _Read_BBREG_CMD_
-#define _SetBBReg_CMD_ _Write_BBREG_CMD_
-#define _GetRFReg_CMD_ _Read_RFREG_CMD_
-#define _SetRFReg_CMD_ _Write_RFREG_CMD_
-#define _DRV_INT_CMD_ (MAX_H2CCMD + 1)
-#define _SetRFIntFs_CMD_ (MAX_H2CCMD + 2)
-
-#ifdef _RTL8712_CMD_C_
-static struct _cmd_callback cmd_callback[] = {
- {GEN_CMD_CODE(_Read_MACREG), NULL}, /*0*/
- {GEN_CMD_CODE(_Write_MACREG), NULL},
- {GEN_CMD_CODE(_Read_BBREG), NULL},
- {GEN_CMD_CODE(_Write_BBREG), NULL},
- {GEN_CMD_CODE(_Read_RFREG), &r8712_getbbrfreg_cmdrsp_callback},
- {GEN_CMD_CODE(_Write_RFREG), NULL}, /*5*/
- {GEN_CMD_CODE(_Read_EEPROM), NULL},
- {GEN_CMD_CODE(_Write_EEPROM), NULL},
- {GEN_CMD_CODE(_Read_EFUSE), NULL},
- {GEN_CMD_CODE(_Write_EFUSE), NULL},
-
- {GEN_CMD_CODE(_Read_CAM), NULL}, /*10*/
- {GEN_CMD_CODE(_Write_CAM), NULL},
- {GEN_CMD_CODE(_setBCNITV), NULL},
- {GEN_CMD_CODE(_setMBIDCFG), NULL},
- {GEN_CMD_CODE(_JoinBss), &r8712_joinbss_cmd_callback}, /*14*/
- {GEN_CMD_CODE(_DisConnect), &r8712_disassoc_cmd_callback}, /*15*/
- {GEN_CMD_CODE(_CreateBss), &r8712_createbss_cmd_callback},
- {GEN_CMD_CODE(_SetOpMode), NULL},
- {GEN_CMD_CODE(_SiteSurvey), &r8712_survey_cmd_callback}, /*18*/
- {GEN_CMD_CODE(_SetAuth), NULL},
-
- {GEN_CMD_CODE(_SetKey), NULL}, /*20*/
- {GEN_CMD_CODE(_SetStaKey), &r8712_setstaKey_cmdrsp_callback},
- {GEN_CMD_CODE(_SetAssocSta), &r8712_setassocsta_cmdrsp_callback},
- {GEN_CMD_CODE(_DelAssocSta), NULL},
- {GEN_CMD_CODE(_SetStaPwrState), NULL},
- {GEN_CMD_CODE(_SetBasicRate), NULL}, /*25*/
- {GEN_CMD_CODE(_GetBasicRate), NULL},
- {GEN_CMD_CODE(_SetDataRate), NULL},
- {GEN_CMD_CODE(_GetDataRate), NULL},
- {GEN_CMD_CODE(_SetPhyInfo), NULL},
-
- {GEN_CMD_CODE(_GetPhyInfo), NULL}, /*30*/
- {GEN_CMD_CODE(_SetPhy), NULL},
- {GEN_CMD_CODE(_GetPhy), NULL},
- {GEN_CMD_CODE(_readRssi), NULL},
- {GEN_CMD_CODE(_readGain), NULL},
- {GEN_CMD_CODE(_SetAtim), NULL}, /*35*/
- {GEN_CMD_CODE(_SetPwrMode), NULL},
- {GEN_CMD_CODE(_JoinbssRpt), NULL},
- {GEN_CMD_CODE(_SetRaTable), NULL},
- {GEN_CMD_CODE(_GetRaTable), NULL},
-
- {GEN_CMD_CODE(_GetCCXReport), NULL}, /*40*/
- {GEN_CMD_CODE(_GetDTMReport), NULL},
- {GEN_CMD_CODE(_GetTXRateStatistics), NULL},
- {GEN_CMD_CODE(_SetUsbSuspend), NULL},
- {GEN_CMD_CODE(_SetH2cLbk), NULL},
- {GEN_CMD_CODE(_AddBAReq), NULL}, /*45*/
-
- {GEN_CMD_CODE(_SetChannel), NULL}, /*46*/
-/* MP_OFFLOAD Start (47~54)*/
- {GEN_CMD_CODE(_SetTxPower), NULL},
- {GEN_CMD_CODE(_SwitchAntenna), NULL},
- {GEN_CMD_CODE(_SetCrystalCap), NULL},
- {GEN_CMD_CODE(_SetSingleCarrierTx), NULL}, /*50*/
- {GEN_CMD_CODE(_SetSingleToneTx), NULL},
- {GEN_CMD_CODE(_SetCarrierSuppressionTx), NULL},
- {GEN_CMD_CODE(_SetContinuousTx), NULL},
- {GEN_CMD_CODE(_SwitchBandwidth), NULL}, /*54*/
-/* MP_OFFLOAD End*/
- {GEN_CMD_CODE(_TX_Beacon), NULL}, /*55*/
- {GEN_CMD_CODE(_SetPowerTracking), NULL},
- {GEN_CMD_CODE(_AMSDU_TO_AMPDU), NULL}, /*57*/
- {GEN_CMD_CODE(_SetMacAddress), NULL}, /*58*/
-
- {GEN_CMD_CODE(_DisconnectCtrl), NULL}, /*59*/
- {GEN_CMD_CODE(_SetChannelPlan), NULL}, /*60*/
- {GEN_CMD_CODE(_DisconnectCtrlEx), NULL}, /*61*/
-
- /* To do, modify these h2c cmd, add or delete */
- {GEN_CMD_CODE(_GetH2cLbk), NULL},
-
- {_SetProbeReqExtraIE_CMD_, NULL},
- {_SetAssocReqExtraIE_CMD_, NULL},
- {_SetProbeRspExtraIE_CMD_, NULL},
- {_SetAssocRspExtraIE_CMD_, NULL},
- {_GetCurDataRate_CMD_, NULL},
- {_GetTxRetrycnt_CMD_, NULL},
- {_GetRxRetrycnt_CMD_, NULL},
- {_GetBCNOKcnt_CMD_, NULL},
- {_GetBCNERRcnt_CMD_, NULL},
- {_GetCurTxPwrLevel_CMD_, NULL},
- {_SetDIG_CMD_, NULL},
- {_SetRA_CMD_, NULL},
- {_SetPT_CMD_, NULL},
- {GEN_CMD_CODE(_ReadTSSI), &r8712_readtssi_cmdrsp_callback}
-};
-#endif
-
-#endif
--- a/drivers/staging/rtl8712/rtl8712_cmdctrl_bitdef.h
+++ /dev/null
@@ -1,95 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_CMDCTRL_BITDEF_H__
-#define __RTL8712_CMDCTRL_BITDEF_H__
-
-/*
- * 2. Command Control Registers (Offset: 0x0040 - 0x004F)
- */
-/*--------------------------------------------------------------------------*/
-/* 8192S (CMD) command register bits (Offset 0x40, 16 bits)*/
-/*--------------------------------------------------------------------------*/
-#define _APSDOFF_STATUS BIT(15)
-#define _APSDOFF BIT(14)
-#define _BBRSTn BIT(13) /*Enable OFDM/CCK*/
-#define _BB_GLB_RSTn BIT(12) /*Enable BB*/
-#define _SCHEDULE_EN BIT(10) /*Enable MAC scheduler*/
-#define _MACRXEN BIT(9)
-#define _MACTXEN BIT(8)
-#define _DDMA_EN BIT(7) /*FW off load function enable*/
-#define _FW2HW_EN BIT(6) /*MAC every module reset */
-#define _RXDMA_EN BIT(5)
-#define _TXDMA_EN BIT(4)
-#define _HCI_RXDMA_EN BIT(3)
-#define _HCI_TXDMA_EN BIT(2)
-
-/*TXPAUSE*/
-#define _STOPHCCA BIT(6)
-#define _STOPHIGH BIT(5)
-#define _STOPMGT BIT(4)
-#define _STOPVO BIT(3)
-#define _STOPVI BIT(2)
-#define _STOPBE BIT(1)
-#define _STOPBK BIT(0)
-
-/*TCR*/
-#define _DISCW BIT(20)
-#define _ICV BIT(19)
-#define _CFEND_FMT BIT(17)
-#define _CRC BIT(16)
-#define _FWRDY BIT(7)
-#define _BASECHG BIT(6)
-#define _IMEM_RDY BIT(5)
-#define _DMEM_CODE_DONE BIT(4)
-#define _EMEM_CHK_RPT BIT(3)
-#define _EMEM_CODE_DONE BIT(2)
-#define _IMEM_CHK_RPT BIT(1)
-#define _IMEM_CODE_DONE BIT(0)
-
-#define _TXDMA_INIT_VALUE (_IMEM_CHK_RPT | _EMEM_CHK_RPT)
-
-/*RCR*/
-#define _ENMBID BIT(27)
-#define _APP_PHYST_RXFF BIT(25)
-#define _APP_PHYST_STAFF BIT(24)
-#define _CBSSID BIT(23)
-#define _APWRMGT BIT(22)
-#define _ADD3 BIT(21)
-#define _AMF BIT(20)
-#define _ACF BIT(19)
-#define _ADF BIT(18)
-#define _APP_MIC BIT(17)
-#define _APP_ICV BIT(16)
-#define _RXFTH_MSK 0x0000E000
-#define _RXFTH_SHT 13
-#define _AICV BIT(12)
-#define _RXPKTLMT_MSK 0x00000FC0
-#define _RXPKTLMT_SHT 6
-#define _ACRC32 BIT(5)
-#define _AB BIT(3)
-#define _AM BIT(2)
-#define _APM BIT(1)
-#define _AAP BIT(0)
-
-/*MSR*/
-#define _NETTYPE_MSK 0x03
-#define _NETTYPE_SHT 0
-
-/*BT*/
-#define _BTMODE_MSK 0x06
-#define _BTMODE_SHT 1
-#define _ENBT BIT(0)
-
-/*MBIDCTRL*/
-#define _ENMBID_MODE BIT(15)
-#define _BCNNO_MSK 0x7000
-#define _BCNNO_SHT 12
-#define _BCNSPACE_MSK 0x0FFF
-#define _BCNSPACE_SHT 0
-
-#endif /* __RTL8712_CMDCTRL_BITDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_cmdctrl_regdef.h
+++ /dev/null
@@ -1,19 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_CMDCTRL_REGDEF_H__
-#define __RTL8712_CMDCTRL_REGDEF_H__
-
-#define CR (RTL8712_CMDCTRL_ + 0x0000)
-#define TXPAUSE (RTL8712_CMDCTRL_ + 0x0002)
-#define TCR (RTL8712_CMDCTRL_ + 0x0004)
-#define RCR (RTL8712_CMDCTRL_ + 0x0008)
-#define MSR (RTL8712_CMDCTRL_ + 0x000C)
-#define SYSF_CFG (RTL8712_CMDCTRL_ + 0x000D)
-#define MBIDCTRL (RTL8712_CMDCTRL_ + 0x000E)
-
-#endif /* __RTL8712_CMDCTRL_REGDEF_H__ */
-
--- a/drivers/staging/rtl8712/rtl8712_debugctrl_bitdef.h
+++ /dev/null
@@ -1,41 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_DEBUGCTRL_BITDEF_H__
-#define __RTL8712_DEBUGCTRL_BITDEF_H__
-
-/*BIST*/
-#define _BIST_RST BIT(0)
-
-/*LMS*/
-#define _LMS_MSK 0x03
-
-/*WDG_CTRL*/
-#define _OVSEL_MSK 0x0600
-#define _OVSEL_SHT 9
-#define _WDGCLR BIT(8)
-#define _WDGEN_MSK 0x00FF
-#define _WDGEN_SHT 0
-
-/*INTM*/
-#define _TXTIMER_MSK 0xF000
-#define _TXTIMER_SHT 12
-#define _TXNUM_MSK 0x0F00
-#define _TXNUM_SHT 8
-#define _RXTIMER_MSK 0x00F0
-#define _RXTIMER_SHT 4
-#define _RXNUM_MSK 0x000F
-#define _RXNUM_SHT 0
-
-/*FDLOCKTURN0*/
-/*FDLOCKTURN1*/
-#define _TURN1 BIT(0)
-
-/*FDLOCKFLAG0*/
-/*FDLOCKFLAG1*/
-#define _LOCKFLAG1_MSK 0x03
-
-#endif /* __RTL8712_DEBUGCTRL_BITDEF_H__ */
--- a/drivers/staging/rtl8712/rtl8712_debugctrl_regdef.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_DEBUGCTRL_REGDEF_H__
-#define __RTL8712_DEBUGCTRL_REGDEF_H__
-
-#define BIST (RTL8712_DEBUGCTRL_ + 0x00)
-#define DBS (RTL8712_DEBUGCTRL_ + 0x04)
-#define LMS (RTL8712_DEBUGCTRL_ + 0x05)
-#define CPUINST (RTL8712_DEBUGCTRL_ + 0x08)
-#define CPUCAUSE (RTL8712_DEBUGCTRL_ + 0x0C)
-#define LBUS_ERR_ADDR (RTL8712_DEBUGCTRL_ + 0x10)
-#define LBUS_ERR_CMD (RTL8712_DEBUGCTRL_ + 0x14)
-#define LBUS_ERR_DATA_L (RTL8712_DEBUGCTRL_ + 0x18)
-#define LBUS_ERR_DATA_H (RTL8712_DEBUGCTRL_ + 0x1C)
-#define LBUS_EXCEPTION_ADDR (RTL8712_DEBUGCTRL_ + 0x20)
-#define WDG_CTRL (RTL8712_DEBUGCTRL_ + 0x24)
-#define INTMTU (RTL8712_DEBUGCTRL_ + 0x28)
-#define INTM (RTL8712_DEBUGCTRL_ + 0x2A)
-#define FDLOCKTURN0 (RTL8712_DEBUGCTRL_ + 0x2C)
-#define FDLOCKTURN1 (RTL8712_DEBUGCTRL_ + 0x2D)
-#define FDLOCKFLAG0 (RTL8712_DEBUGCTRL_ + 0x2E)
-#define FDLOCKFLAG1 (RTL8712_DEBUGCTRL_ + 0x2F)
-#define TRXPKTBUF_DBG_DATA (RTL8712_DEBUGCTRL_ + 0x30)
-#define TRXPKTBUF_DBG_CTRL (RTL8712_DEBUGCTRL_ + 0x38)
-#define DPLL_MON (RTL8712_DEBUGCTRL_ + 0x3A)
-
-#endif /* __RTL8712_DEBUGCTRL_REGDEF_H__ */
-
--- a/drivers/staging/rtl8712/rtl8712_edcasetting_bitdef.h
+++ /dev/null
@@ -1,65 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_EDCASETTING_BITDEF_H__
-#define __RTL8712_EDCASETTING_BITDEF_H__
-
-/*EDCAPARAM*/
-#define _TXOPLIMIT_MSK 0xFFFF0000
-#define _TXOPLIMIT_SHT 16
-#define _ECWIN_MSK 0x0000FF00
-#define _ECWIN_SHT 8
-#define _AIFS_MSK 0x000000FF
-#define _AIFS_SHT 0
-
-/*BCNTCFG*/
-#define _BCNECW_MSK 0xFF00
-#define _BCNECW_SHT 8
-#define _BCNIFS_MSK 0x00FF
-#define _BCNIFS_SHT 0
-
-/*CWRR*/
-#define _CWRR_MSK 0x03FF
-
-/*ACMAVG*/
-#define _AVG_TIME_UP BIT(3)
-#define _AVGPERIOD_MSK 0x03
-
-/*ACMHWCTRL*/
-#define _VOQ_ACM_STATUS BIT(6)
-#define _VIQ_ACM_STATUS BIT(5)
-#define _BEQ_ACM_STATUS BIT(4)
-#define _VOQ_ACM_EN BIT(3)
-#define _VIQ_ACM_EN BIT(2)
-#define _BEQ_ACM_EN BIT(1)
-#define _ACMHWEN BIT(0)
-
-/*VO_ADMTIME*/
-#define _VO_ACM_RUT BIT(18)
-#define _VO_ADMTIME_MSK 0x0003FFF
-
-/*VI_ADMTIME*/
-#define _VI_ACM_RUT BIT(18)
-#define _VI_ADMTIME_MSK 0x0003FFF
-
-/*BE_ADMTIME*/
-#define _BE_ACM_RUT BIT(18)
-#define _BE_ADMTIME_MSK 0x0003FFF
-
-/*Retry limit reg*/
-#define _SRL_MSK 0xFF00
-#define _SRL_SHT 8
-#define _LRL_MSK 0x00FF
-#define _LRL_SHT 0
-
-#endif /* __RTL8712_EDCASETTING_BITDEF_H__*/
--- a/drivers/staging/rtl8712/rtl8712_edcasetting_regdef.h
+++ /dev/null
@@ -1,24 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_EDCASETTING_REGDEF_H__
-#define __RTL8712_EDCASETTING_REGDEF_H__
-
-#define EDCA_VO_PARAM (RTL8712_EDCASETTING_ + 0x00)
-#define EDCA_VI_PARAM (RTL8712_EDCASETTING_ + 0x04)
-#define EDCA_BE_PARAM (RTL8712_EDCASETTING_ + 0x08)
-#define EDCA_BK_PARAM (RTL8712_EDCASETTING_ + 0x0C)
-#define BCNTCFG (RTL8712_EDCASETTING_ + 0x10)
-#define CWRR (RTL8712_EDCASETTING_ + 0x12)
-#define ACMAVG (RTL8712_EDCASETTING_ + 0x16)
-#define ACMHWCTRL (RTL8712_EDCASETTING_ + 0x17)
-#define VO_ADMTIME (RTL8712_EDCASETTING_ + 0x18)
-#define VI_ADMTIME (RTL8712_EDCASETTING_ + 0x1C)
-#define BE_ADMTIME (RTL8712_EDCASETTING_ + 0x20)
-#define RL (RTL8712_EDCASETTING_ + 0x24)
-
-#endif /* __RTL8712_EDCASETTING_REGDEF_H__ */
-
--- a/drivers/staging/rtl8712/rtl8712_efuse.c
+++ /dev/null
@@ -1,564 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * rtl8712_efuse.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>.
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL8712_EFUSE_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "rtl8712_efuse.h"
-
-/* reserve 3 bytes for HW stop read */
-static int efuse_available_max_size = EFUSE_MAX_SIZE - 3 /*0x1FD*/;
-
-static void efuse_reg_ctrl(struct _adapter *adapter, u8 bPowerOn)
-{
- u8 tmpu8 = 0;
-
- if (bPowerOn) {
- /* -----------------e-fuse pwr & clk reg ctrl ---------------
- * Enable LDOE25 Macro Block
- */
- tmpu8 = r8712_read8(adapter, EFUSE_TEST + 3);
- tmpu8 |= 0x80;
- r8712_write8(adapter, EFUSE_TEST + 3, tmpu8);
- msleep(20); /* for some platform , need some delay time */
- /* Change Efuse Clock for write action to 40MHZ */
- r8712_write8(adapter, EFUSE_CLK_CTRL, 0x03);
- msleep(20); /* for some platform , need some delay time */
- } else {
- /* -----------------e-fuse pwr & clk reg ctrl -----------------
- * Disable LDOE25 Macro Block
- */
- tmpu8 = r8712_read8(adapter, EFUSE_TEST + 3);
- tmpu8 &= 0x7F;
- r8712_write8(adapter, EFUSE_TEST + 3, tmpu8);
- /* Change Efuse Clock for write action to 500K */
- r8712_write8(adapter, EFUSE_CLK_CTRL, 0x02);
- }
-}
-
-/*
- * Before write E-Fuse, this function must be called.
- */
-u8 r8712_efuse_reg_init(struct _adapter *adapter)
-{
- return true;
-}
-
-void r8712_efuse_reg_uninit(struct _adapter *adapter)
-{
- efuse_reg_ctrl(adapter, false);
-}
-
-static u8 efuse_one_byte_read(struct _adapter *adapter, u16 addr, u8 *data)
-{
- u8 tmpidx = 0, bResult;
-
- /* -----------------e-fuse reg ctrl --------------------------------- */
- r8712_write8(adapter, EFUSE_CTRL + 1, (u8)(addr & 0xFF)); /* address */
- r8712_write8(adapter, EFUSE_CTRL + 2, ((u8)((addr >> 8) & 0x03)) |
- (r8712_read8(adapter, EFUSE_CTRL + 2) & 0xFC));
- r8712_write8(adapter, EFUSE_CTRL + 3, 0x72); /* read cmd */
- /* wait for complete */
- while (!(0x80 & r8712_read8(adapter, EFUSE_CTRL + 3)) &&
- (tmpidx < 100))
- tmpidx++;
- if (tmpidx < 100) {
- *data = r8712_read8(adapter, EFUSE_CTRL);
- bResult = true;
- } else {
- *data = 0xff;
- bResult = false;
- }
- return bResult;
-}
-
-static u8 efuse_one_byte_write(struct _adapter *adapter, u16 addr, u8 data)
-{
- u8 tmpidx = 0, bResult;
-
- /* -----------------e-fuse reg ctrl -------------------------------- */
- r8712_write8(adapter, EFUSE_CTRL + 1, (u8)(addr & 0xFF)); /* address */
- r8712_write8(adapter, EFUSE_CTRL + 2, ((u8)((addr >> 8) & 0x03)) |
- (r8712_read8(adapter, EFUSE_CTRL + 2) & 0xFC));
- r8712_write8(adapter, EFUSE_CTRL, data); /* data */
- r8712_write8(adapter, EFUSE_CTRL + 3, 0xF2); /* write cmd */
- /* wait for complete */
- while ((0x80 & r8712_read8(adapter, EFUSE_CTRL + 3)) &&
- (tmpidx < 100))
- tmpidx++;
- if (tmpidx < 100)
- bResult = true;
- else
- bResult = false;
- return bResult;
-}
-
-static u8 efuse_one_byte_rw(struct _adapter *adapter, u8 bRead, u16 addr,
- u8 *data)
-{
- u8 tmpidx = 0, tmpv8 = 0, bResult;
-
- /* -----------------e-fuse reg ctrl --------------------------------- */
- r8712_write8(adapter, EFUSE_CTRL + 1, (u8)(addr & 0xFF)); /* address */
- tmpv8 = ((u8)((addr >> 8) & 0x03)) |
- (r8712_read8(adapter, EFUSE_CTRL + 2) & 0xFC);
- r8712_write8(adapter, EFUSE_CTRL + 2, tmpv8);
- if (bRead) {
- r8712_write8(adapter, EFUSE_CTRL + 3, 0x72); /* read cmd */
- while (!(0x80 & r8712_read8(adapter, EFUSE_CTRL + 3)) &&
- (tmpidx < 100))
- tmpidx++;
- if (tmpidx < 100) {
- *data = r8712_read8(adapter, EFUSE_CTRL);
- bResult = true;
- } else {
- *data = 0;
- bResult = false;
- }
- } else {
- r8712_write8(adapter, EFUSE_CTRL, *data); /* data */
- r8712_write8(adapter, EFUSE_CTRL + 3, 0xF2); /* write cmd */
- while ((0x80 & r8712_read8(adapter, EFUSE_CTRL + 3)) &&
- (tmpidx < 100))
- tmpidx++;
- if (tmpidx < 100)
- bResult = true;
- else
- bResult = false;
- }
- return bResult;
-}
-
-static u8 efuse_is_empty(struct _adapter *adapter, u8 *empty)
-{
- u8 value, ret = true;
-
- /* read one byte to check if E-Fuse is empty */
- if (efuse_one_byte_rw(adapter, true, 0, &value)) {
- if (value == 0xFF)
- *empty = true;
- else
- *empty = false;
- } else {
- ret = false;
- }
- return ret;
-}
-
-void r8712_efuse_change_max_size(struct _adapter *adapter)
-{
- u16 pre_pg_data_saddr = 0x1FB;
- u16 i;
- u16 pre_pg_data_size = 5;
- u8 pre_pg_data[5];
-
- for (i = 0; i < pre_pg_data_size; i++)
- efuse_one_byte_read(adapter, pre_pg_data_saddr + i,
- &pre_pg_data[i]);
- if ((pre_pg_data[0] == 0x03) && (pre_pg_data[1] == 0x00) &&
- (pre_pg_data[2] == 0x00) && (pre_pg_data[3] == 0x00) &&
- (pre_pg_data[4] == 0x0C))
- efuse_available_max_size -= pre_pg_data_size;
-}
-
-int r8712_efuse_get_max_size(struct _adapter *adapter)
-{
- return efuse_available_max_size;
-}
-
-static u8 calculate_word_cnts(const u8 word_en)
-{
- u8 word_cnts = 0;
- u8 word_idx;
-
- for (word_idx = 0; word_idx < PGPKG_MAX_WORDS; word_idx++)
- if (!(word_en & BIT(word_idx)))
- word_cnts++; /* 0 : write enable */
- return word_cnts;
-}
-
-static void pgpacket_copy_data(const u8 word_en, const u8 *sourdata,
- u8 *targetdata)
-{
- u8 tmpindex = 0;
- u8 word_idx, byte_idx;
-
- for (word_idx = 0; word_idx < PGPKG_MAX_WORDS; word_idx++) {
- if (!(word_en & BIT(word_idx))) {
- byte_idx = word_idx * 2;
- targetdata[byte_idx] = sourdata[tmpindex++];
- targetdata[byte_idx + 1] = sourdata[tmpindex++];
- }
- }
-}
-
-u16 r8712_efuse_get_current_size(struct _adapter *adapter)
-{
- int bContinual = true;
- u16 efuse_addr = 0;
- u8 hworden = 0;
- u8 efuse_data, word_cnts = 0;
-
- while (bContinual && efuse_one_byte_read(adapter, efuse_addr,
- &efuse_data) && (efuse_addr < efuse_available_max_size)) {
- if (efuse_data != 0xFF) {
- hworden = efuse_data & 0x0F;
- word_cnts = calculate_word_cnts(hworden);
- /* read next header */
- efuse_addr = efuse_addr + (word_cnts * 2) + 1;
- } else {
- bContinual = false;
- }
- }
- return efuse_addr;
-}
-
-u8 r8712_efuse_pg_packet_read(struct _adapter *adapter, u8 offset, u8 *data)
-{
- u8 hoffset = 0, hworden = 0, word_cnts = 0;
- u16 efuse_addr = 0;
- u8 efuse_data;
- u8 tmpidx = 0;
- u8 tmpdata[PGPKT_DATA_SIZE];
- u8 ret = true;
-
- if (!data)
- return false;
- if (offset > 0x0f)
- return false;
- memset(data, 0xFF, sizeof(u8) * PGPKT_DATA_SIZE);
- while (efuse_addr < efuse_available_max_size) {
- if (efuse_one_byte_read(adapter, efuse_addr, &efuse_data)) {
- if (efuse_data == 0xFF)
- break;
- hoffset = (efuse_data >> 4) & 0x0F;
- hworden = efuse_data & 0x0F;
- word_cnts = calculate_word_cnts(hworden);
- if (hoffset == offset) {
- memset(tmpdata, 0xFF, PGPKT_DATA_SIZE);
- for (tmpidx = 0; tmpidx < word_cnts * 2;
- tmpidx++) {
- if (efuse_one_byte_read(adapter,
- efuse_addr + 1 + tmpidx,
- &efuse_data)) {
- tmpdata[tmpidx] = efuse_data;
- } else {
- ret = false;
- }
- }
- pgpacket_copy_data(hworden, tmpdata, data);
- }
- efuse_addr += 1 + (word_cnts * 2);
- } else {
- ret = false;
- break;
- }
- }
- return ret;
-}
-
-static u8 fix_header(struct _adapter *adapter, u8 header, u16 header_addr)
-{
- struct PGPKT_STRUCT pkt;
- u8 offset, word_en, value;
- u16 addr;
- int i;
- u8 ret = true;
-
- pkt.offset = GET_EFUSE_OFFSET(header);
- pkt.word_en = GET_EFUSE_WORD_EN(header);
- addr = header_addr + 1 + calculate_word_cnts(pkt.word_en) * 2;
- if (addr > efuse_available_max_size)
- return false;
- /* retrieve original data */
- addr = 0;
- while (addr < header_addr) {
- if (!efuse_one_byte_read(adapter, addr++, &value)) {
- ret = false;
- break;
- }
- offset = GET_EFUSE_OFFSET(value);
- word_en = GET_EFUSE_WORD_EN(value);
- if (pkt.offset != offset) {
- addr += calculate_word_cnts(word_en) * 2;
- continue;
- }
- for (i = 0; i < PGPKG_MAX_WORDS; i++) {
- if (!(BIT(i) & word_en))
- continue;
- if (BIT(i) & pkt.word_en) {
- if (efuse_one_byte_read(adapter,
- addr,
- &value))
- pkt.data[i * 2] = value;
- else
- return false;
- if (efuse_one_byte_read(adapter,
- addr + 1,
- &value))
- pkt.data[i * 2 + 1] = value;
- else
- return false;
- }
- addr += 2;
- }
- }
- if (addr != header_addr)
- return false;
- addr++;
- /* fill original data */
- for (i = 0; i < PGPKG_MAX_WORDS; i++) {
- if (BIT(i) & pkt.word_en) {
- efuse_one_byte_write(adapter, addr, pkt.data[i * 2]);
- efuse_one_byte_write(adapter, addr + 1,
- pkt.data[i * 2 + 1]);
- /* additional check */
- if (!efuse_one_byte_read(adapter, addr, &value)) {
- ret = false;
- } else if (pkt.data[i * 2] != value) {
- ret = false;
- if (value == 0xFF) /* write again */
- efuse_one_byte_write(adapter, addr,
- pkt.data[i * 2]);
- }
- if (!efuse_one_byte_read(adapter, addr + 1, &value)) {
- ret = false;
- } else if (pkt.data[i * 2 + 1] != value) {
- ret = false;
- if (value == 0xFF) /* write again */
- efuse_one_byte_write(adapter, addr + 1,
- pkt.data[i * 2 +
- 1]);
- }
- }
- addr += 2;
- }
- return ret;
-}
-
-u8 r8712_efuse_pg_packet_write(struct _adapter *adapter, const u8 offset,
- const u8 word_en, const u8 *data)
-{
- u8 pg_header = 0;
- u16 efuse_addr = 0, curr_size = 0;
- u8 efuse_data, target_word_cnts = 0;
- int repeat_times;
- int sub_repeat;
- u8 bResult = true;
-
- /* check if E-Fuse Clock Enable and E-Fuse Clock is 40M */
- efuse_data = r8712_read8(adapter, EFUSE_CLK_CTRL);
- if (efuse_data != 0x03)
- return false;
- pg_header = MAKE_EFUSE_HEADER(offset, word_en);
- target_word_cnts = calculate_word_cnts(word_en);
- repeat_times = 0;
- efuse_addr = 0;
- while (efuse_addr < efuse_available_max_size) {
- curr_size = r8712_efuse_get_current_size(adapter);
- if ((curr_size + 1 + target_word_cnts * 2) >
- efuse_available_max_size)
- return false; /*target_word_cnts + pg header(1 byte)*/
- efuse_addr = curr_size; /* current size is also the last addr*/
- efuse_one_byte_write(adapter, efuse_addr, pg_header); /*hdr*/
- sub_repeat = 0;
- /* check if what we read is what we write */
- while (!efuse_one_byte_read(adapter, efuse_addr,
- &efuse_data)) {
- if (++sub_repeat > _REPEAT_THRESHOLD_) {
- bResult = false; /* continue to blind write */
- break; /* continue to blind write */
- }
- }
- if ((sub_repeat > _REPEAT_THRESHOLD_) ||
- (pg_header == efuse_data)) {
- /* write header ok OR can't check header(creep) */
- u8 i;
-
- /* go to next address */
- efuse_addr++;
- for (i = 0; i < target_word_cnts * 2; i++) {
- efuse_one_byte_write(adapter,
- efuse_addr + i,
- *(data + i));
- if (!efuse_one_byte_read(adapter,
- efuse_addr + i,
- &efuse_data))
- bResult = false;
- else if (*(data + i) != efuse_data) /* fail */
- bResult = false;
- }
- break;
- }
- /* write header fail */
- bResult = false;
- if (efuse_data == 0xFF)
- return bResult; /* nothing damaged. */
- /* call rescue procedure */
- if (!fix_header(adapter, efuse_data, efuse_addr))
- return false; /* rescue fail */
-
- if (++repeat_times > _REPEAT_THRESHOLD_) /* fail */
- break;
- /* otherwise, take another risk... */
- }
- return bResult;
-}
-
-u8 r8712_efuse_access(struct _adapter *adapter, u8 bRead, u16 start_addr,
- u16 cnts, u8 *data)
-{
- int i;
- u8 res = true;
-
- if (start_addr > EFUSE_MAX_SIZE)
- return false;
- if (!bRead && ((start_addr + cnts) >
- efuse_available_max_size))
- return false;
- if (!bRead && !r8712_efuse_reg_init(adapter))
- return false;
- /* -----------------e-fuse one byte read / write ---------------------*/
- for (i = 0; i < cnts; i++) {
- if ((start_addr + i) > EFUSE_MAX_SIZE) {
- res = false;
- break;
- }
- res = efuse_one_byte_rw(adapter, bRead, start_addr + i,
- data + i);
- if (!bRead && !res)
- break;
- }
- if (!bRead)
- r8712_efuse_reg_uninit(adapter);
- return res;
-}
-
-u8 r8712_efuse_map_read(struct _adapter *adapter, u16 addr, u16 cnts, u8 *data)
-{
- u8 offset, ret = true;
- u8 pktdata[PGPKT_DATA_SIZE];
- int i, idx;
-
- if ((addr + cnts) > EFUSE_MAP_MAX_SIZE)
- return false;
- if (efuse_is_empty(adapter, &offset) && offset) {
- for (i = 0; i < cnts; i++)
- data[i] = 0xFF;
- return ret;
- }
- offset = (addr >> 3) & 0xF;
- ret = r8712_efuse_pg_packet_read(adapter, offset, pktdata);
- i = addr & 0x7; /* pktdata index */
- idx = 0; /* data index */
-
- do {
- for (; i < PGPKT_DATA_SIZE; i++) {
- data[idx++] = pktdata[i];
- if (idx == cnts)
- return ret;
- }
- offset++;
- if (!r8712_efuse_pg_packet_read(adapter, offset, pktdata))
- ret = false;
- i = 0;
- } while (1);
- return ret;
-}
-
-u8 r8712_efuse_map_write(struct _adapter *adapter, u16 addr, u16 cnts,
- u8 *data)
-{
- u8 offset, word_en, empty;
- u8 pktdata[PGPKT_DATA_SIZE], newdata[PGPKT_DATA_SIZE];
- int i, j, idx;
-
- if ((addr + cnts) > EFUSE_MAP_MAX_SIZE)
- return false;
- /* check if E-Fuse Clock Enable and E-Fuse Clock is 40M */
- empty = r8712_read8(adapter, EFUSE_CLK_CTRL);
- if (empty != 0x03)
- return false;
- if (efuse_is_empty(adapter, &empty)) {
- if (empty)
- memset(pktdata, 0xFF, PGPKT_DATA_SIZE);
- } else {
- return false;
- }
- offset = (addr >> 3) & 0xF;
- if (!empty)
- if (!r8712_efuse_pg_packet_read(adapter, offset, pktdata))
- return false;
- word_en = 0xF;
- memset(newdata, 0xFF, PGPKT_DATA_SIZE);
- i = addr & 0x7; /* pktdata index */
- j = 0; /* newdata index */
- idx = 0; /* data index */
-
- if (i & 0x1) {
- /* odd start */
- if (data[idx] != pktdata[i]) {
- word_en &= ~BIT(i >> 1);
- newdata[j++] = pktdata[i - 1];
- newdata[j++] = data[idx];
- }
- i++;
- idx++;
- }
- do {
- for (; i < PGPKT_DATA_SIZE; i += 2) {
- if ((cnts - idx) == 1) {
- if (data[idx] != pktdata[i]) {
- word_en &= ~BIT(i >> 1);
- newdata[j++] = data[idx];
- newdata[j++] = pktdata[1 + 1];
- }
- idx++;
- break;
- }
-
- if ((data[idx] != pktdata[i]) || (data[idx + 1] !=
- pktdata[i + 1])) {
- word_en &= ~BIT(i >> 1);
- newdata[j++] = data[idx];
- newdata[j++] = data[idx + 1];
- }
- idx += 2;
-
- if (idx == cnts)
- break;
- }
-
- if (word_en != 0xF)
- if (!r8712_efuse_pg_packet_write(adapter, offset,
- word_en, newdata))
- return false;
- if (idx == cnts)
- break;
- offset++;
- if (!empty)
- if (!r8712_efuse_pg_packet_read(adapter, offset,
- pktdata))
- return false;
- i = 0;
- j = 0;
- word_en = 0xF;
- memset(newdata, 0xFF, PGPKT_DATA_SIZE);
- } while (1);
-
- return true;
-}
--- a/drivers/staging/rtl8712/rtl8712_efuse.h
+++ /dev/null
@@ -1,43 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef __RTL8712_EFUSE_H__
-#define __RTL8712_EFUSE_H__
-
-#include "osdep_service.h"
-
-#define _REPEAT_THRESHOLD_ 3
-
-#define EFUSE_MAX_SIZE 512
-#define EFUSE_MAP_MAX_SIZE 128
-
-#define PGPKG_MAX_WORDS 4
-#define PGPKT_DATA_SIZE 8 /* PGPKG_MAX_WORDS*2; BYTES sizeof(u8)*8*/
-#define MAX_PGPKT_SIZE 9 /* 1 + PGPKT_DATA_SIZE; header + 2 * 4 words (BYTES)*/
-
-#define GET_EFUSE_OFFSET(header) ((header & 0xF0) >> 4)
-#define GET_EFUSE_WORD_EN(header) (header & 0x0F)
-#define MAKE_EFUSE_HEADER(offset, word_en) ((((offset) & 0x0F) << 4) | \
- ((word_en) & 0x0F))
-/*--------------------------------------------------------------------------*/
-struct PGPKT_STRUCT {
- u8 offset;
- u8 word_en;
- u8 data[PGPKT_DATA_SIZE];
-};
-/*--------------------------------------------------------------------------*/
-u8 r8712_efuse_reg_init(struct _adapter *padapter);
-void r8712_efuse_reg_uninit(struct _adapter *padapter);
-u16 r8712_efuse_get_current_size(struct _adapter *padapter);
-int r8712_efuse_get_max_size(struct _adapter *padapter);
-void r8712_efuse_change_max_size(struct _adapter *padapter);
-u8 r8712_efuse_pg_packet_read(struct _adapter *padapter,
- u8 offset, u8 *data);
-u8 r8712_efuse_pg_packet_write(struct _adapter *padapter,
- const u8 offset, const u8 word_en,
- const u8 *data);
-u8 r8712_efuse_access(struct _adapter *padapter, u8 bRead,
- u16 start_addr, u16 cnts, u8 *data);
-u8 r8712_efuse_map_read(struct _adapter *padapter, u16 addr,
- u16 cnts, u8 *data);
-u8 r8712_efuse_map_write(struct _adapter *padapter, u16 addr,
- u16 cnts, u8 *data);
-#endif
--- a/drivers/staging/rtl8712/rtl8712_event.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _RTL8712_EVENT_H_
-#define _RTL8712_EVENT_H_
-
-void r8712_event_handle(struct _adapter *padapter, __le32 *peventbuf);
-void r8712_got_addbareq_event_callback(struct _adapter *adapter, u8 *pbuf);
-
-enum rtl8712_c2h_event {
- GEN_EVT_CODE(_Read_MACREG) = 0, /*0*/
- GEN_EVT_CODE(_Read_BBREG),
- GEN_EVT_CODE(_Read_RFREG),
- GEN_EVT_CODE(_Read_EEPROM),
- GEN_EVT_CODE(_Read_EFUSE),
- GEN_EVT_CODE(_Read_CAM), /*5*/
- GEN_EVT_CODE(_Get_BasicRate),
- GEN_EVT_CODE(_Get_DataRate),
- GEN_EVT_CODE(_Survey), /*8*/
- GEN_EVT_CODE(_SurveyDone), /*9*/
-
- GEN_EVT_CODE(_JoinBss), /*10*/
- GEN_EVT_CODE(_AddSTA),
- GEN_EVT_CODE(_DelSTA),
- GEN_EVT_CODE(_AtimDone),
- GEN_EVT_CODE(_TX_Report),
- GEN_EVT_CODE(_CCX_Report), /*15*/
- GEN_EVT_CODE(_DTM_Report),
- GEN_EVT_CODE(_TX_Rate_Statistics),
- GEN_EVT_CODE(_C2HLBK),
- GEN_EVT_CODE(_FWDBG),
- GEN_EVT_CODE(_C2HFEEDBACK), /*20*/
- GEN_EVT_CODE(_ADDBA),
- GEN_EVT_CODE(_C2HBCN),
- GEN_EVT_CODE(_ReportPwrState), /*filen: only for PCIE, USB*/
- GEN_EVT_CODE(_WPS_PBC), /*24*/
- GEN_EVT_CODE(_ADDBAReq_Report), /*25*/
- MAX_C2HEVT
-};
-
-#ifdef _RTL8712_CMD_C_
-
-static struct fwevent wlanevents[] = {
- {0, NULL}, /*0*/
- {0, NULL},
- {0, NULL},
- {0, NULL},
- {0, NULL},
- {0, NULL},
- {0, NULL},
- {0, NULL},
- {0, &r8712_survey_event_callback}, /*8*/
- {sizeof(struct surveydone_event),
- &r8712_surveydone_event_callback}, /*9*/
-
- {0, &r8712_joinbss_event_callback}, /*10*/
- {sizeof(struct stassoc_event), &r8712_stassoc_event_callback},
- {sizeof(struct stadel_event), &r8712_stadel_event_callback},
- {0, &r8712_atimdone_event_callback},
- {0, NULL},
- {0, NULL}, /*15*/
- {0, NULL},
- {0, NULL},
- {0, NULL},
- {0, NULL}, /*fwdbg_event_callback},*/
- {0, NULL}, /*20*/
- {0, NULL},
- {0, NULL},
- {0, &r8712_cpwm_event_callback},
- {0, &r8712_wpspbc_event_callback},
- {0, &r8712_got_addbareq_event_callback},
-};
-
-#endif/*_RTL8712_CMD_C_*/
-
-#endif
--- a/drivers/staging/rtl8712/rtl8712_fifoctrl_bitdef.h
+++ /dev/null
@@ -1,131 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_FIFOCTRL_BITDEF_H__
-#define __RTL8712_FIFOCTRL_BITDEF_H__
-
-/*PBP*/
-#define _PSTX_MSK 0xF0
-#define _PSTX_SHT 4
-#define _PSRX_MSK 0x0F
-#define _PSRX_SHT 0
-
-/*TXFF_STATUS*/
-#define _TXSTATUS_OVF BIT(15)
-
-/*RXFF_STATUS*/
-#define _STATUSFF1_OVF BIT(7)
-#define _STATUSFF1_EMPTY BIT(6)
-#define _STATUSFF0_OVF BIT(5)
-#define _STATUSFF0_EMPTY BIT(4)
-#define _RXFF1_OVF BIT(3)
-#define _RXFF1_EMPTY BIT(2)
-#define _RXFF0_OVF BIT(1)
-#define _RXFF0_EMPTY BIT(0)
-
-/*TXFF_EMPTY_TH*/
-#define _BKQ_EMPTY_TH_MSK 0x0F0000
-#define _BKQ_EMPTY_TH_SHT 16
-#define _BEQ_EMPTY_TH_MSK 0x00F000
-#define _BEQ_EMPTY_TH_SHT 12
-#define _VIQ_EMPTY_TH_MSK 0x000F00
-#define _VIQ_EMPTY_TH_SHT 8
-#define _VOQ_EMPTY_TH_MSK 0x0000F0
-#define _VOQ_EMPTY_TH_SHT 4
-#define _BMCQ_EMPTY_TH_MSK 0x00000F
-#define _BMCQ_EMPTY_TH_SHT 0
-
-/*SDIO_RX_BLKSZ*/
-#define _SDIO_RX_BLKSZ_MSK 0x07
-
-/*RXDMA_CTRL*/
-#define _C2HFF_POLL BIT(4)
-#define _RXPKT_POLL BIT(0)
-
-/*RXPKT_NUM*/
-#define _RXCMD_NUM_MSK 0xFF00
-#define _RXCMD_NUM_SHT 8
-#define _RXFF0_NUM_MSK 0x00FF
-#define _RXFF0_NUM_SHT 0
-
-/*FIFOPAGE2*/
-#define _PUB_AVAL_PG_MSK 0xFFFF0000
-#define _PUB_AVAL_PG_SHT 16
-#define _BCN_AVAL_PG_MSK 0x0000FFFF
-#define _BCN_AVAL_PG_SHT 0
-
-/*RX0PKTNUM*/
-#define _RXFF0_DEC_POLL BIT(15)
-#define _RXFF0_PKT_DEC_NUM_MSK 0x3F00
-#define _RXFF0_PKT_DEC_NUM_SHT 8
-#define _RXFF0_PKTNUM_RPT_MSK 0x00FF
-#define _RXFF0_PKTNUM_RPT_SHT 0
-
-/*RX1PKTNUM*/
-#define _RXFF1_DEC_POLL BIT(15)
-#define _RXFF1_PKT_DEC_NUM_MSK 0x3F00
-#define _RXFF1_PKT_DEC_NUM_SHT 8
-#define _RXFF1_PKTNUM_RPT_MSK 0x00FF
-#define _RXFF1_PKTNUM_RPT_SHT 0
-
-/*RXFLTMAP0*/
-#define _MGTFLT13EN BIT(13)
-#define _MGTFLT12EN BIT(12)
-#define _MGTFLT11EN BIT(11)
-#define _MGTFLT10EN BIT(10)
-#define _MGTFLT9EN BIT(9)
-#define _MGTFLT8EN BIT(8)
-#define _MGTFLT5EN BIT(5)
-#define _MGTFLT4EN BIT(4)
-#define _MGTFLT3EN BIT(3)
-#define _MGTFLT2EN BIT(2)
-#define _MGTFLT1EN BIT(1)
-#define _MGTFLT0EN BIT(0)
-
-/*RXFLTMAP1*/
-#define _CTRLFLT15EN BIT(15)
-#define _CTRLFLT14EN BIT(14)
-#define _CTRLFLT13EN BIT(13)
-#define _CTRLFLT12EN BIT(12)
-#define _CTRLFLT11EN BIT(11)
-#define _CTRLFLT10EN BIT(10)
-#define _CTRLFLT9EN BIT(9)
-#define _CTRLFLT8EN BIT(8)
-#define _CTRLFLT7EN BIT(7)
-#define _CTRLFLT6EN BIT(6)
-
-/*RXFLTMAP2*/
-#define _DATAFLT15EN BIT(15)
-#define _DATAFLT14EN BIT(14)
-#define _DATAFLT13EN BIT(13)
-#define _DATAFLT12EN BIT(12)
-#define _DATAFLT11EN BIT(11)
-#define _DATAFLT10EN BIT(10)
-#define _DATAFLT9EN BIT(9)
-#define _DATAFLT8EN BIT(8)
-#define _DATAFLT7EN BIT(7)
-#define _DATAFLT6EN BIT(6)
-#define _DATAFLT5EN BIT(5)
-#define _DATAFLT4EN BIT(4)
-#define _DATAFLT3EN BIT(3)
-#define _DATAFLT2EN BIT(2)
-#define _DATAFLT1EN BIT(1)
-#define _DATAFLT0EN BIT(0)
-
-/*RXFLTMAP3*/
-#define _MESHAFLT1EN BIT(1)
-#define _MESHAFLT0EN BIT(0)
-
-/*TXPKT_NUM_CTRL*/
-#define _TXPKTNUM_DEC BIT(8)
-#define _TXPKTNUM_MSK 0x00FF
-#define _TXPKTNUM_SHT 0
-
-/*TXFF_PG_NUM*/
-#define _TXFF_PG_NUM_MSK 0x0FFF
-
-#endif /* __RTL8712_FIFOCTRL_BITDEF_H__ */
-
--- a/drivers/staging/rtl8712/rtl8712_fifoctrl_regdef.h
+++ /dev/null
@@ -1,61 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_FIFOCTRL_REGDEF_H__
-#define __RTL8712_FIFOCTRL_REGDEF_H__
-
-#define RQPN (RTL8712_FIFOCTRL_ + 0x00)
-#define RXFF_BNDY (RTL8712_FIFOCTRL_ + 0x0C)
-#define RXRPT_BNDY (RTL8712_FIFOCTRL_ + 0x10)
-#define TXPKTBUF_PGBNDY (RTL8712_FIFOCTRL_ + 0x14)
-#define PBP (RTL8712_FIFOCTRL_ + 0x15)
-#define RX_DRVINFO_SZ (RTL8712_FIFOCTRL_ + 0x16)
-#define TXFF_STATUS (RTL8712_FIFOCTRL_ + 0x17)
-#define RXFF_STATUS (RTL8712_FIFOCTRL_ + 0x18)
-#define TXFF_EMPTY_TH (RTL8712_FIFOCTRL_ + 0x19)
-#define SDIO_RX_BLKSZ (RTL8712_FIFOCTRL_ + 0x1C)
-#define RXDMA_RXCTRL (RTL8712_FIFOCTRL_ + 0x1D)
-#define RXPKT_NUM (RTL8712_FIFOCTRL_ + 0x1E)
-#define RXPKT_NUM_C2H (RTL8712_FIFOCTRL_ + 0x1F)
-#define C2HCMD_UDT_SIZE (RTL8712_FIFOCTRL_ + 0x20)
-#define C2HCMD_UDT_ADDR (RTL8712_FIFOCTRL_ + 0x22)
-#define FIFOPAGE2 (RTL8712_FIFOCTRL_ + 0x24)
-#define FIFOPAGE1 (RTL8712_FIFOCTRL_ + 0x28)
-#define FW_RSVD_PG_CTRL (RTL8712_FIFOCTRL_ + 0x30)
-#define TXRPTFF_RDPTR (RTL8712_FIFOCTRL_ + 0x40)
-#define TXRPTFF_WTPTR (RTL8712_FIFOCTRL_ + 0x44)
-#define C2HFF_RDPTR (RTL8712_FIFOCTRL_ + 0x48)
-#define C2HFF_WTPTR (RTL8712_FIFOCTRL_ + 0x4C)
-#define RXFF0_RDPTR (RTL8712_FIFOCTRL_ + 0x50)
-#define RXFF0_WTPTR (RTL8712_FIFOCTRL_ + 0x54)
-#define RXFF1_RDPTR (RTL8712_FIFOCTRL_ + 0x58)
-#define RXFF1_WTPTR (RTL8712_FIFOCTRL_ + 0x5C)
-#define RXRPT0FF_RDPTR (RTL8712_FIFOCTRL_ + 0x60)
-#define RXRPT0FF_WTPTR (RTL8712_FIFOCTRL_ + 0x64)
-#define RXRPT1FF_RDPTR (RTL8712_FIFOCTRL_ + 0x68)
-#define RXRPT1FF_WTPTR (RTL8712_FIFOCTRL_ + 0x6C)
-#define RX0PKTNUM (RTL8712_FIFOCTRL_ + 0x72)
-#define RX1PKTNUM (RTL8712_FIFOCTRL_ + 0x74)
-#define RXFLTMAP0 (RTL8712_FIFOCTRL_ + 0x76)
-#define RXFLTMAP1 (RTL8712_FIFOCTRL_ + 0x78)
-#define RXFLTMAP2 (RTL8712_FIFOCTRL_ + 0x7A)
-#define RXFLTMAP3 (RTL8712_FIFOCTRL_ + 0x7c)
-#define TBDA (RTL8712_FIFOCTRL_ + 0x84)
-#define THPDA (RTL8712_FIFOCTRL_ + 0x88)
-#define TCDA (RTL8712_FIFOCTRL_ + 0x8C)
-#define TMDA (RTL8712_FIFOCTRL_ + 0x90)
-#define HDA (RTL8712_FIFOCTRL_ + 0x94)
-#define TVODA (RTL8712_FIFOCTRL_ + 0x98)
-#define TVIDA (RTL8712_FIFOCTRL_ + 0x9C)
-#define TBEDA (RTL8712_FIFOCTRL_ + 0xA0)
-#define TBKDA (RTL8712_FIFOCTRL_ + 0xA4)
-#define RCDA (RTL8712_FIFOCTRL_ + 0xA8)
-#define RDSA (RTL8712_FIFOCTRL_ + 0xAC)
-#define TXPKT_NUM_CTRL (RTL8712_FIFOCTRL_ + 0xB0)
-#define TXQ_PGADD (RTL8712_FIFOCTRL_ + 0xB3)
-#define TXFF_PG_NUM (RTL8712_FIFOCTRL_ + 0xB4)
-
-#endif /* __RTL8712_FIFOCTRL_REGDEF_H__ */
--- a/drivers/staging/rtl8712/rtl8712_gp_bitdef.h
+++ /dev/null
@@ -1,68 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_GP_BITDEF_H__
-#define __RTL8712_GP_BITDEF_H__
-
-/*GPIO_CTRL*/
-#define _GPIO_MOD_MSK 0xFF000000
-#define _GPIO_MOD_SHT 24
-#define _GPIO_IO_SEL_MSK 0x00FF0000
-#define _GPIO_IO_SEL_SHT 16
-#define _GPIO_OUT_MSK 0x0000FF00
-#define _GPIO_OUT_SHT 8
-#define _GPIO_IN_MSK 0x000000FF
-#define _GPIO_IN_SHT 0
-
-/*SYS_PINMUX_CFG*/
-#define _GPIOSEL_MSK 0x0003
-#define _GPIOSEL_SHT 0
-
-/*LED_CFG*/
-#define _LED1SV BIT(7)
-#define _LED1CM_MSK 0x0070
-#define _LED1CM_SHT 4
-#define _LED0SV BIT(3)
-#define _LED0CM_MSK 0x0007
-#define _LED0CM_SHT 0
-
-/*PHY_REG*/
-#define _HST_RDRDY_SHT 0
-#define _HST_RDRDY_MSK 0xFF
-#define _HST_RDRDY BIT(_HST_RDRDY_SHT)
-#define _CPU_WTBUSY_SHT 1
-#define _CPU_WTBUSY_MSK 0xFF
-#define _CPU_WTBUSY BIT(_CPU_WTBUSY_SHT)
-
-/* 11. General Purpose Registers (Offset: 0x02E0 - 0x02FF)*/
-
-/* 8192S GPIO Config Setting (offset 0x2F1, 1 byte)*/
-
-/*----------------------------------------------------------------------------*/
-
-#define GPIOMUX_EN BIT(3) /* When this bit is set to "1",
- * GPIO PINs will switch to MAC
- * GPIO Function
- */
-#define GPIOSEL_GPIO 0 /* UART or JTAG or pure GPIO*/
-#define GPIOSEL_PHYDBG 1 /* PHYDBG*/
-#define GPIOSEL_BT 2 /* BT_coex*/
-#define GPIOSEL_WLANDBG 3 /* WLANDBG*/
-#define GPIOSEL_GPIO_MASK (~(BIT(0) | BIT(1)))
-/* HW Radio OFF switch (GPIO BIT) */
-#define HAL_8192S_HW_GPIO_OFF_BIT BIT(3)
-#define HAL_8192S_HW_GPIO_OFF_MASK 0xF7
-#define HAL_8192S_HW_GPIO_WPS_BIT BIT(4)
-
-#endif /*__RTL8712_GP_BITDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_gp_regdef.h
+++ /dev/null
@@ -1,29 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_GP_REGDEF_H__
-#define __RTL8712_GP_REGDEF_H__
-
-#define PSTIMER (RTL8712_GP_ + 0x00)
-#define TIMER1 (RTL8712_GP_ + 0x04)
-#define TIMER2 (RTL8712_GP_ + 0x08)
-#define GPIO_CTRL (RTL8712_GP_ + 0x0C)
-#define GPIO_IO_SEL (RTL8712_GP_ + 0x0E)
-#define GPIO_INTCTRL (RTL8712_GP_ + 0x10)
-#define MAC_PINMUX_CTRL (RTL8712_GP_ + 0x11)
-#define LEDCFG (RTL8712_GP_ + 0x12)
-#define PHY_REG_RPT (RTL8712_GP_ + 0x13)
-#define PHY_REG_DATA (RTL8712_GP_ + 0x14)
-
-#endif /*__RTL8712_GP_REGDEF_H__ */
-
--- a/drivers/staging/rtl8712/rtl8712_hal.h
+++ /dev/null
@@ -1,142 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_HAL_H__
-#define __RTL8712_HAL_H__
-
-enum _HW_VERSION {
- RTL8712_FPGA,
- RTL8712_1stCUT, /*A Cut (RTL8712_ASIC)*/
- RTL8712_2ndCUT, /*B Cut*/
- RTL8712_3rdCUT, /*C Cut*/
-};
-
-enum _LOOPBACK_TYPE {
- RTL8712_AIR_TRX = 0,
- RTL8712_MAC_LBK,
- RTL8712_BB_LBK,
- RTL8712_MAC_FW_LBK = 4,
- RTL8712_BB_FW_LBK = 8,
-};
-
-enum RTL871X_HCI_TYPE {
- RTL8712_SDIO,
- RTL8712_USB,
-};
-
-enum RTL8712_RF_CONFIG {
- RTL8712_RF_1T1R,
- RTL8712_RF_1T2R,
- RTL8712_RF_2T2R
-};
-
-enum _RTL8712_HCI_TYPE_ {
- RTL8712_HCI_TYPE_PCIE = 0x01,
- RTL8712_HCI_TYPE_AP_PCIE = 0x81,
- RTL8712_HCI_TYPE_USB = 0x02,
- RTL8712_HCI_TYPE_92USB = 0x02,
- RTL8712_HCI_TYPE_AP_USB = 0x82,
- RTL8712_HCI_TYPE_72USB = 0x12,
- RTL8712_HCI_TYPE_SDIO = 0x04,
- RTL8712_HCI_TYPE_72SDIO = 0x14
-};
-
-struct fw_priv { /*8-bytes alignment required*/
- /*--- long word 0 ----*/
- unsigned char signature_0; /*0x12: CE product, 0x92: IT product*/
- unsigned char signature_1; /*0x87: CE product, 0x81: IT product*/
- unsigned char hci_sel; /*0x81: PCI-AP, 01:PCIe, 02: 92S-U, 0x82: USB-AP,
- * 0x12: 72S-U, 03:SDIO
- */
- unsigned char chip_version; /*the same value as register value*/
- unsigned char customer_ID_0; /*customer ID low byte*/
- unsigned char customer_ID_1; /*customer ID high byte*/
- unsigned char rf_config; /*0x11: 1T1R, 0x12: 1T2R, 0x92: 1T2R turbo,
- * 0x22: 2T2R
- */
- unsigned char usb_ep_num; /* 4: 4EP, 6: 6EP, 11: 11EP*/
- /*--- long word 1 ----*/
- unsigned char regulatory_class_0; /*regulatory class bit map 0*/
- unsigned char regulatory_class_1; /*regulatory class bit map 1*/
- unsigned char regulatory_class_2; /*regulatory class bit map 2*/
- unsigned char regulatory_class_3; /*regulatory class bit map 3*/
- unsigned char rfintfs; /* 0:SWSI, 1:HWSI, 2:HWPI*/
- unsigned char def_nettype;
- unsigned char turbo_mode;
- unsigned char low_power_mode;/* 0: normal mode, 1: low power mode*/
- /*--- long word 2 ----*/
- unsigned char lbk_mode; /*0x00: normal, 0x03: MACLBK, 0x01: PHYLBK*/
- unsigned char mp_mode; /* 1: for MP use, 0: for normal driver */
- unsigned char vcs_type; /* 0:off 1:on 2:auto */
- unsigned char vcs_mode; /* 1:RTS/CTS 2:CTS to self */
- unsigned char rsvd022;
- unsigned char rsvd023;
- unsigned char rsvd024;
- unsigned char rsvd025;
- /*--- long word 3 ----*/
- unsigned char qos_en; /*1: QoS enable*/
- unsigned char bw_40MHz_en; /*1: 40MHz BW enable*/
- unsigned char AMSDU2AMPDU_en; /*1: 4181 convert AMSDU to AMPDU,
- * 0: disable
- */
- unsigned char AMPDU_en; /*1: 11n AMPDU enable*/
- unsigned char rate_control_offload; /*1: FW offloads,0: driver handles*/
- unsigned char aggregation_offload; /*1: FW offloads,0: driver handles*/
- unsigned char rsvd030;
- unsigned char rsvd031;
- /*--- long word 4 ----*/
- unsigned char beacon_offload; /* 1. FW offloads, 0: driver handles*/
- unsigned char MLME_offload; /* 2. FW offloads, 0: driver handles*/
- unsigned char hwpc_offload; /* 3. FW offloads, 0: driver handles*/
- unsigned char tcp_checksum_offload; /*4. FW offloads,0: driver handles*/
- unsigned char tcp_offload; /* 5. FW offloads, 0: driver handles*/
- unsigned char ps_control_offload; /* 6. FW offloads, 0: driver handles*/
- unsigned char WWLAN_offload; /* 7. FW offloads, 0: driver handles*/
- unsigned char rsvd040;
- /*--- long word 5 ----*/
- unsigned char tcp_tx_frame_len_L; /*tcp tx packet length low byte*/
- unsigned char tcp_tx_frame_len_H; /*tcp tx packet length high byte*/
- unsigned char tcp_rx_frame_len_L; /*tcp rx packet length low byte*/
- unsigned char tcp_rx_frame_len_H; /*tcp rx packet length high byte*/
- unsigned char rsvd050;
- unsigned char rsvd051;
- unsigned char rsvd052;
- unsigned char rsvd053;
-};
-
-struct fw_hdr {/*8-byte alignment required*/
- unsigned short signature;
- unsigned short version; /* 0x8000 ~ 0x8FFF for FPGA version,
- * 0x0000 ~ 0x7FFF for ASIC version,
- */
- unsigned int dmem_size; /*define the size of boot loader*/
- unsigned int img_IMEM_size; /*define the size of FW in IMEM*/
- unsigned int img_SRAM_size; /*define the size of FW in SRAM*/
- unsigned int fw_priv_sz; /*define the size of DMEM variable*/
- unsigned short efuse_addr;
- unsigned short h2ccnd_resp_addr;
- unsigned int SVNRevision;
- unsigned int release_time; /*Mon:Day:Hr:Min*/
- struct fw_priv fwpriv;
-};
-
-struct hal_priv {
- /*Endpoint handles*/
- struct net_device *pipehdls_r8712[10];
- u8 (*hal_bus_init)(struct _adapter *adapter);
-};
-
-uint rtl8712_hal_init(struct _adapter *padapter);
-int rtl871x_load_fw(struct _adapter *padapter);
-
-#endif
--- a/drivers/staging/rtl8712/rtl8712_interrupt_bitdef.h
+++ /dev/null
@@ -1,44 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_INTERRUPT_BITDEF_H__
-#define __RTL8712_INTERRUPT_BITDEF_H__
-
-/*HIMR*/
-/*HISR*/
-#define _CPUERR BIT(29)
-#define _ATIMEND BIT(28)
-#define _TXBCNOK BIT(27)
-#define _TXBCNERR BIT(26)
-#define _BCNDMAINT4 BIT(25)
-#define _BCNDMAINT3 BIT(24)
-#define _BCNDMAINT2 BIT(23)
-#define _BCNDMAINT1 BIT(22)
-#define _BCNDOK4 BIT(21)
-#define _BCNDOK3 BIT(20)
-#define _BCNDOK2 BIT(19)
-#define _BCNDOK1 BIT(18)
-#define _TIMEOUT2 BIT(17)
-#define _TIMEOUT1 BIT(16)
-#define _TXFOVW BIT(15)
-#define _PSTIMEOUT BIT(14)
-#define _BCNDMAINT0 BIT(13)
-#define _FOVW BIT(12)
-#define _RDU BIT(11)
-#define _RXCMDOK BIT(10)
-#define _BCNDOK0 BIT(9)
-#define _HIGHDOK BIT(8)
-#define _COMDOK BIT(7)
-#define _MGTDOK BIT(6)
-#define _HCCADOK BIT(5)
-#define _BKDOK BIT(4)
-#define _BEDOK BIT(3)
-#define _VIDOK BIT(2)
-#define _VODOK BIT(1)
-#define _RXOK BIT(0)
-
-#endif /*__RTL8712_INTERRUPT_BITDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_io.c
+++ /dev/null
@@ -1,99 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl8712_io.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>.
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL8712_IO_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "rtl871x_io.h"
-#include "osdep_intf.h"
-#include "usb_ops.h"
-
-u8 r8712_read8(struct _adapter *adapter, u32 addr)
-{
- struct intf_hdl *hdl = &adapter->pio_queue->intf;
-
- return hdl->io_ops._read8(hdl, addr);
-}
-
-u16 r8712_read16(struct _adapter *adapter, u32 addr)
-{
- struct intf_hdl *hdl = &adapter->pio_queue->intf;
-
- return hdl->io_ops._read16(hdl, addr);
-}
-
-u32 r8712_read32(struct _adapter *adapter, u32 addr)
-{
- struct intf_hdl *hdl = &adapter->pio_queue->intf;
-
- return hdl->io_ops._read32(hdl, addr);
-}
-
-void r8712_write8(struct _adapter *adapter, u32 addr, u8 val)
-{
- struct intf_hdl *hdl = &adapter->pio_queue->intf;
-
- hdl->io_ops._write8(hdl, addr, val);
-}
-
-void r8712_write16(struct _adapter *adapter, u32 addr, u16 val)
-{
- struct intf_hdl *hdl = &adapter->pio_queue->intf;
-
- hdl->io_ops._write16(hdl, addr, val);
-}
-
-void r8712_write32(struct _adapter *adapter, u32 addr, u32 val)
-{
- struct intf_hdl *hdl = &adapter->pio_queue->intf;
-
- hdl->io_ops._write32(hdl, addr, val);
-}
-
-void r8712_read_mem(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem)
-{
- struct intf_hdl *hdl = &adapter->pio_queue->intf;
-
- if (adapter->driver_stopped || adapter->surprise_removed)
- return;
-
- hdl->io_ops._read_mem(hdl, addr, cnt, pmem);
-}
-
-void r8712_write_mem(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem)
-{
- struct intf_hdl *hdl = &adapter->pio_queue->intf;
-
- hdl->io_ops._write_mem(hdl, addr, cnt, pmem);
-}
-
-void r8712_read_port(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem)
-{
- struct intf_hdl *hdl = &adapter->pio_queue->intf;
-
- if (adapter->driver_stopped || adapter->surprise_removed)
- return;
-
- hdl->io_ops._read_port(hdl, addr, cnt, pmem);
-}
-
-void r8712_write_port(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem)
-{
- struct intf_hdl *hdl = &adapter->pio_queue->intf;
-
- hdl->io_ops._write_port(hdl, addr, cnt, pmem);
-}
--- a/drivers/staging/rtl8712/rtl8712_led.c
+++ /dev/null
@@ -1,1830 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl8712_led.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#include "drv_types.h"
-
-/*===========================================================================
- * Constant.
- *===========================================================================
-
- *
- * Default LED behavior.
- */
-#define LED_BLINK_NORMAL_INTERVAL 100
-#define LED_BLINK_SLOWLY_INTERVAL 200
-#define LED_BLINK_LONG_INTERVAL 400
-
-#define LED_BLINK_NO_LINK_INTERVAL_ALPHA 1000
-#define LED_BLINK_LINK_INTERVAL_ALPHA 500
-#define LED_BLINK_SCAN_INTERVAL_ALPHA 180
-#define LED_BLINK_FASTER_INTERVAL_ALPHA 50
-#define LED_BLINK_WPS_SUCCESS_INTERVAL_ALPHA 5000
-
-/*===========================================================================
- * LED object.
- *===========================================================================
- */
-enum _LED_STATE_871x {
- LED_UNKNOWN = 0,
- LED_STATE_ON = 1,
- LED_STATE_OFF = 2,
- LED_BLINK_NORMAL = 3,
- LED_BLINK_SLOWLY = 4,
- LED_POWER_ON_BLINK = 5,
- LED_SCAN_BLINK = 6, /* LED is blinking during scanning period,
- * the # of times to blink is depend on time
- * for scanning.
- */
- LED_NO_LINK_BLINK = 7, /* LED is blinking during no link state. */
- LED_BLINK_StartToBlink = 8,/* Customized for Sercomm Printer
- * Server case
- */
- LED_BLINK_WPS = 9, /* LED is blinkg during WPS communication */
- LED_TXRX_BLINK = 10,
- LED_BLINK_WPS_STOP = 11, /*for ALPHA */
- LED_BLINK_WPS_STOP_OVERLAP = 12, /*for BELKIN */
-};
-
-/*===========================================================================
- * Prototype of protected function.
- *===========================================================================
- */
-static void BlinkTimerCallback(struct timer_list *t);
-
-static void BlinkWorkItemCallback(struct work_struct *work);
-/*===========================================================================
- * LED_819xUsb routines.
- *===========================================================================
- *
- *
- *
- * Description:
- * Initialize an LED_871x object.
- */
-static void InitLed871x(struct _adapter *padapter, struct LED_871x *pLed,
- enum LED_PIN_871x LedPin)
-{
- pLed->padapter = padapter;
- pLed->LedPin = LedPin;
- pLed->CurrLedState = LED_STATE_OFF;
- pLed->bLedOn = false;
- pLed->bLedBlinkInProgress = false;
- pLed->BlinkTimes = 0;
- pLed->BlinkingLedState = LED_UNKNOWN;
- timer_setup(&pLed->BlinkTimer, BlinkTimerCallback, 0);
- INIT_WORK(&pLed->BlinkWorkItem, BlinkWorkItemCallback);
-}
-
-/*
- * Description:
- * DeInitialize an LED_871x object.
- */
-static void DeInitLed871x(struct LED_871x *pLed)
-{
- del_timer_sync(&pLed->BlinkTimer);
- /* We should reset bLedBlinkInProgress if we cancel
- * the LedControlTimer,
- */
- pLed->bLedBlinkInProgress = false;
-}
-
-/*
- * Description:
- * Turn on LED according to LedPin specified.
- */
-static void SwLedOn(struct _adapter *padapter, struct LED_871x *pLed)
-{
- u8 LedCfg;
-
- if (padapter->surprise_removed || padapter->driver_stopped)
- return;
- LedCfg = r8712_read8(padapter, LEDCFG);
- switch (pLed->LedPin) {
- case LED_PIN_GPIO0:
- break;
- case LED_PIN_LED0:
- /* SW control led0 on.*/
- r8712_write8(padapter, LEDCFG, LedCfg & 0xf0);
- break;
- case LED_PIN_LED1:
- /* SW control led1 on.*/
- r8712_write8(padapter, LEDCFG, LedCfg & 0x0f);
- break;
- default:
- break;
- }
- pLed->bLedOn = true;
-}
-
-/*
- * Description:
- * Turn off LED according to LedPin specified.
- */
-static void SwLedOff(struct _adapter *padapter, struct LED_871x *pLed)
-{
- u8 LedCfg;
-
- if (padapter->surprise_removed || padapter->driver_stopped)
- return;
- LedCfg = r8712_read8(padapter, LEDCFG);
- switch (pLed->LedPin) {
- case LED_PIN_GPIO0:
- break;
- case LED_PIN_LED0:
- LedCfg &= 0xf0; /* Set to software control.*/
- r8712_write8(padapter, LEDCFG, (LedCfg | BIT(3)));
- break;
- case LED_PIN_LED1:
- LedCfg &= 0x0f; /* Set to software control.*/
- r8712_write8(padapter, LEDCFG, (LedCfg | BIT(7)));
- break;
- default:
- break;
- }
- pLed->bLedOn = false;
-}
-
-/*===========================================================================
- * Interface to manipulate LED objects.
- *===========================================================================
- *
- * Description:
- * Initialize all LED_871x objects.
- */
-void r8712_InitSwLeds(struct _adapter *padapter)
-{
- struct led_priv *pledpriv = &padapter->ledpriv;
-
- pledpriv->LedControlHandler = LedControl871x;
- InitLed871x(padapter, &pledpriv->SwLed0, LED_PIN_LED0);
- InitLed871x(padapter, &pledpriv->SwLed1, LED_PIN_LED1);
-}
-
-/* Description:
- * DeInitialize all LED_819xUsb objects.
- */
-void r8712_DeInitSwLeds(struct _adapter *padapter)
-{
- struct led_priv *ledpriv = &padapter->ledpriv;
-
- DeInitLed871x(&ledpriv->SwLed0);
- DeInitLed871x(&ledpriv->SwLed1);
-}
-
-/* Description:
- * Implementation of LED blinking behavior.
- * It toggle off LED and schedule corresponding timer if necessary.
- */
-static void SwLedBlink(struct LED_871x *pLed)
-{
- struct _adapter *padapter = pLed->padapter;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- u8 bStopBlinking = false;
-
- /* Change LED according to BlinkingLedState specified. */
- if (pLed->BlinkingLedState == LED_STATE_ON)
- SwLedOn(padapter, pLed);
- else
- SwLedOff(padapter, pLed);
- /* Determine if we shall change LED state again. */
- pLed->BlinkTimes--;
- switch (pLed->CurrLedState) {
- case LED_BLINK_NORMAL:
- if (pLed->BlinkTimes == 0)
- bStopBlinking = true;
- break;
- case LED_BLINK_StartToBlink:
- if (check_fwstate(pmlmepriv, _FW_LINKED) &&
- (pmlmepriv->fw_state & WIFI_STATION_STATE))
- bStopBlinking = true;
- if (check_fwstate(pmlmepriv, _FW_LINKED) &&
- ((pmlmepriv->fw_state & WIFI_ADHOC_STATE) ||
- (pmlmepriv->fw_state & WIFI_ADHOC_MASTER_STATE)))
- bStopBlinking = true;
- else if (pLed->BlinkTimes == 0)
- bStopBlinking = true;
- break;
- case LED_BLINK_WPS:
- if (pLed->BlinkTimes == 0)
- bStopBlinking = true;
- break;
- default:
- bStopBlinking = true;
- break;
- }
- if (bStopBlinking) {
- if (check_fwstate(pmlmepriv, _FW_LINKED) &&
- !pLed->bLedOn)
- SwLedOn(padapter, pLed);
- else if (check_fwstate(pmlmepriv, _FW_LINKED) && pLed->bLedOn)
- SwLedOff(padapter, pLed);
- pLed->BlinkTimes = 0;
- pLed->bLedBlinkInProgress = false;
- } else {
- /* Assign LED state to toggle. */
- if (pLed->BlinkingLedState == LED_STATE_ON)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
-
- /* Schedule a timer to toggle LED state. */
- switch (pLed->CurrLedState) {
- case LED_BLINK_NORMAL:
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL));
- break;
- case LED_BLINK_SLOWLY:
- case LED_BLINK_StartToBlink:
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SLOWLY_INTERVAL));
- break;
- case LED_BLINK_WPS:
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_LONG_INTERVAL));
- break;
- default:
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SLOWLY_INTERVAL));
- break;
- }
- }
-}
-
-static void SwLedBlink1(struct LED_871x *pLed)
-{
- struct _adapter *padapter = pLed->padapter;
- struct led_priv *ledpriv = &padapter->ledpriv;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct eeprom_priv *peeprompriv = &padapter->eeprompriv;
- struct LED_871x *pLed1 = &ledpriv->SwLed1;
- u8 bStopBlinking = false;
-
- if (peeprompriv->CustomerID == RT_CID_819x_CAMEO)
- pLed = &ledpriv->SwLed1;
- /* Change LED according to BlinkingLedState specified. */
- if (pLed->BlinkingLedState == LED_STATE_ON)
- SwLedOn(padapter, pLed);
- else
- SwLedOff(padapter, pLed);
- if (peeprompriv->CustomerID == RT_CID_DEFAULT) {
- if (check_fwstate(pmlmepriv, _FW_LINKED)) {
- if (!pLed1->bSWLedCtrl) {
- SwLedOn(padapter, pLed1);
- pLed1->bSWLedCtrl = true;
- } else if (!pLed1->bLedOn) {
- SwLedOn(padapter, pLed1);
- }
- } else {
- if (!pLed1->bSWLedCtrl) {
- SwLedOff(padapter, pLed1);
- pLed1->bSWLedCtrl = true;
- } else if (pLed1->bLedOn) {
- SwLedOff(padapter, pLed1);
- }
- }
- }
- switch (pLed->CurrLedState) {
- case LED_BLINK_SLOWLY:
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
- break;
- case LED_BLINK_NORMAL:
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_LINK_INTERVAL_ALPHA));
- break;
- case LED_SCAN_BLINK:
- pLed->BlinkTimes--;
- if (pLed->BlinkTimes == 0)
- bStopBlinking = true;
- if (bStopBlinking) {
- if (check_fwstate(pmlmepriv, _FW_LINKED)) {
- pLed->bLedLinkBlinkInProgress = true;
- pLed->CurrLedState = LED_BLINK_NORMAL;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_LINK_INTERVAL_ALPHA));
- } else if (!check_fwstate(pmlmepriv, _FW_LINKED)) {
- pLed->bLedNoLinkBlinkInProgress = true;
- pLed->CurrLedState = LED_BLINK_SLOWLY;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
- }
- pLed->bLedScanBlinkInProgress = false;
- } else {
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
- }
- break;
- case LED_TXRX_BLINK:
- pLed->BlinkTimes--;
- if (pLed->BlinkTimes == 0)
- bStopBlinking = true;
- if (bStopBlinking) {
- if (check_fwstate(pmlmepriv, _FW_LINKED)) {
- pLed->bLedLinkBlinkInProgress = true;
- pLed->CurrLedState = LED_BLINK_NORMAL;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_LINK_INTERVAL_ALPHA));
- } else if (!check_fwstate(pmlmepriv, _FW_LINKED)) {
- pLed->bLedNoLinkBlinkInProgress = true;
- pLed->CurrLedState = LED_BLINK_SLOWLY;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
- }
- pLed->BlinkTimes = 0;
- pLed->bLedBlinkInProgress = false;
- } else {
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
- }
- break;
- case LED_BLINK_WPS:
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
- break;
- case LED_BLINK_WPS_STOP: /* WPS success */
- if (pLed->BlinkingLedState == LED_STATE_ON) {
- pLed->BlinkingLedState = LED_STATE_OFF;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_WPS_SUCCESS_INTERVAL_ALPHA));
- bStopBlinking = false;
- } else {
- bStopBlinking = true;
- }
- if (bStopBlinking) {
- pLed->bLedLinkBlinkInProgress = true;
- pLed->CurrLedState = LED_BLINK_NORMAL;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_LINK_INTERVAL_ALPHA));
- }
- pLed->bLedWPSBlinkInProgress = false;
- break;
- default:
- break;
- }
-}
-
-static void SwLedBlink2(struct LED_871x *pLed)
-{
- struct _adapter *padapter = pLed->padapter;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- u8 bStopBlinking = false;
-
- /* Change LED according to BlinkingLedState specified. */
- if (pLed->BlinkingLedState == LED_STATE_ON)
- SwLedOn(padapter, pLed);
- else
- SwLedOff(padapter, pLed);
- switch (pLed->CurrLedState) {
- case LED_SCAN_BLINK:
- pLed->BlinkTimes--;
- if (pLed->BlinkTimes == 0)
- bStopBlinking = true;
- if (bStopBlinking) {
- if (check_fwstate(pmlmepriv, _FW_LINKED)) {
- pLed->CurrLedState = LED_STATE_ON;
- pLed->BlinkingLedState = LED_STATE_ON;
- SwLedOn(padapter, pLed);
- } else if (!check_fwstate(pmlmepriv, _FW_LINKED)) {
- pLed->CurrLedState = LED_STATE_OFF;
- pLed->BlinkingLedState = LED_STATE_OFF;
- SwLedOff(padapter, pLed);
- }
- pLed->bLedScanBlinkInProgress = false;
- } else {
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
- }
- break;
- case LED_TXRX_BLINK:
- pLed->BlinkTimes--;
- if (pLed->BlinkTimes == 0)
- bStopBlinking = true;
- if (bStopBlinking) {
- if (check_fwstate(pmlmepriv, _FW_LINKED)) {
- pLed->CurrLedState = LED_STATE_ON;
- pLed->BlinkingLedState = LED_STATE_ON;
- SwLedOn(padapter, pLed);
- } else if (!check_fwstate(pmlmepriv, _FW_LINKED)) {
- pLed->CurrLedState = LED_STATE_OFF;
- pLed->BlinkingLedState = LED_STATE_OFF;
- SwLedOff(padapter, pLed);
- }
- pLed->bLedBlinkInProgress = false;
- } else {
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
- }
- break;
- default:
- break;
- }
-}
-
-static void SwLedBlink3(struct LED_871x *pLed)
-{
- struct _adapter *padapter = pLed->padapter;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- u8 bStopBlinking = false;
-
- /* Change LED according to BlinkingLedState specified. */
- if (pLed->BlinkingLedState == LED_STATE_ON)
- SwLedOn(padapter, pLed);
- else
- if (pLed->CurrLedState != LED_BLINK_WPS_STOP)
- SwLedOff(padapter, pLed);
- switch (pLed->CurrLedState) {
- case LED_SCAN_BLINK:
- pLed->BlinkTimes--;
- if (pLed->BlinkTimes == 0)
- bStopBlinking = true;
- if (bStopBlinking) {
- if (check_fwstate(pmlmepriv, _FW_LINKED)) {
- pLed->CurrLedState = LED_STATE_ON;
- pLed->BlinkingLedState = LED_STATE_ON;
- if (!pLed->bLedOn)
- SwLedOn(padapter, pLed);
- } else if (!check_fwstate(pmlmepriv, _FW_LINKED)) {
- pLed->CurrLedState = LED_STATE_OFF;
- pLed->BlinkingLedState = LED_STATE_OFF;
- if (pLed->bLedOn)
- SwLedOff(padapter, pLed);
- }
- pLed->bLedScanBlinkInProgress = false;
- } else {
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
- }
- break;
- case LED_TXRX_BLINK:
- pLed->BlinkTimes--;
- if (pLed->BlinkTimes == 0)
- bStopBlinking = true;
- if (bStopBlinking) {
- if (check_fwstate(pmlmepriv, _FW_LINKED)) {
- pLed->CurrLedState = LED_STATE_ON;
- pLed->BlinkingLedState = LED_STATE_ON;
- if (!pLed->bLedOn)
- SwLedOn(padapter, pLed);
- } else if (!check_fwstate(pmlmepriv, _FW_LINKED)) {
- pLed->CurrLedState = LED_STATE_OFF;
- pLed->BlinkingLedState = LED_STATE_OFF;
- if (pLed->bLedOn)
- SwLedOff(padapter, pLed);
- }
- pLed->bLedBlinkInProgress = false;
- } else {
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
- }
- break;
- case LED_BLINK_WPS:
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
- break;
- case LED_BLINK_WPS_STOP: /*WPS success*/
- if (pLed->BlinkingLedState == LED_STATE_ON) {
- pLed->BlinkingLedState = LED_STATE_OFF;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_WPS_SUCCESS_INTERVAL_ALPHA));
- bStopBlinking = false;
- } else {
- bStopBlinking = true;
- }
- if (bStopBlinking) {
- pLed->CurrLedState = LED_STATE_ON;
- pLed->BlinkingLedState = LED_STATE_ON;
- SwLedOn(padapter, pLed);
- pLed->bLedWPSBlinkInProgress = false;
- }
- break;
- default:
- break;
- }
-}
-
-static void SwLedBlink4(struct LED_871x *pLed)
-{
- struct _adapter *padapter = pLed->padapter;
- struct led_priv *ledpriv = &padapter->ledpriv;
- struct LED_871x *pLed1 = &ledpriv->SwLed1;
- u8 bStopBlinking = false;
-
- /* Change LED according to BlinkingLedState specified. */
- if (pLed->BlinkingLedState == LED_STATE_ON)
- SwLedOn(padapter, pLed);
- else
- SwLedOff(padapter, pLed);
- if (!pLed1->bLedWPSBlinkInProgress &&
- pLed1->BlinkingLedState == LED_UNKNOWN) {
- pLed1->BlinkingLedState = LED_STATE_OFF;
- pLed1->CurrLedState = LED_STATE_OFF;
- SwLedOff(padapter, pLed1);
- }
- switch (pLed->CurrLedState) {
- case LED_BLINK_SLOWLY:
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
- break;
- case LED_BLINK_StartToBlink:
- if (pLed->bLedOn) {
- pLed->BlinkingLedState = LED_STATE_OFF;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SLOWLY_INTERVAL));
- } else {
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL));
- }
- break;
- case LED_SCAN_BLINK:
- pLed->BlinkTimes--;
- if (pLed->BlinkTimes == 0)
- bStopBlinking = true;
- if (bStopBlinking) {
- pLed->bLedNoLinkBlinkInProgress = true;
- pLed->CurrLedState = LED_BLINK_SLOWLY;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
- pLed->bLedScanBlinkInProgress = false;
- } else {
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
- }
- break;
- case LED_TXRX_BLINK:
- pLed->BlinkTimes--;
- if (pLed->BlinkTimes == 0)
- bStopBlinking = true;
- if (bStopBlinking) {
- pLed->bLedNoLinkBlinkInProgress = true;
- pLed->CurrLedState = LED_BLINK_SLOWLY;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
- pLed->bLedBlinkInProgress = false;
- } else {
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
- }
- break;
- case LED_BLINK_WPS:
- if (pLed->bLedOn) {
- pLed->BlinkingLedState = LED_STATE_OFF;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SLOWLY_INTERVAL));
- } else {
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL));
- }
- break;
- case LED_BLINK_WPS_STOP: /*WPS authentication fail*/
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL));
- break;
- case LED_BLINK_WPS_STOP_OVERLAP: /*WPS session overlap */
- pLed->BlinkTimes--;
- if (pLed->BlinkTimes == 0) {
- if (pLed->bLedOn)
- pLed->BlinkTimes = 1;
- else
- bStopBlinking = true;
- }
- if (bStopBlinking) {
- pLed->BlinkTimes = 10;
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_LINK_INTERVAL_ALPHA));
- } else {
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL));
- }
- break;
- default:
- break;
- }
-}
-
-static void SwLedBlink5(struct LED_871x *pLed)
-{
- struct _adapter *padapter = pLed->padapter;
- u8 bStopBlinking = false;
-
- /* Change LED according to BlinkingLedState specified. */
- if (pLed->BlinkingLedState == LED_STATE_ON)
- SwLedOn(padapter, pLed);
- else
- SwLedOff(padapter, pLed);
- switch (pLed->CurrLedState) {
- case LED_SCAN_BLINK:
- pLed->BlinkTimes--;
- if (pLed->BlinkTimes == 0)
- bStopBlinking = true;
- if (bStopBlinking) {
- pLed->CurrLedState = LED_STATE_ON;
- pLed->BlinkingLedState = LED_STATE_ON;
- if (!pLed->bLedOn)
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
- pLed->bLedScanBlinkInProgress = false;
- } else {
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
- }
- break;
- case LED_TXRX_BLINK:
- pLed->BlinkTimes--;
- if (pLed->BlinkTimes == 0)
- bStopBlinking = true;
- if (bStopBlinking) {
- pLed->CurrLedState = LED_STATE_ON;
- pLed->BlinkingLedState = LED_STATE_ON;
- if (!pLed->bLedOn)
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
- pLed->bLedBlinkInProgress = false;
- } else {
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
- }
- break;
- default:
- break;
- }
-}
-
-static void SwLedBlink6(struct LED_871x *pLed)
-{
- struct _adapter *padapter = pLed->padapter;
- u8 bStopBlinking = false;
-
- /* Change LED according to BlinkingLedState specified. */
- if (pLed->BlinkingLedState == LED_STATE_ON)
- SwLedOn(padapter, pLed);
- else
- SwLedOff(padapter, pLed);
- switch (pLed->CurrLedState) {
- case LED_TXRX_BLINK:
- pLed->BlinkTimes--;
- if (pLed->BlinkTimes == 0)
- bStopBlinking = true;
- if (bStopBlinking) {
- pLed->CurrLedState = LED_STATE_ON;
- pLed->BlinkingLedState = LED_STATE_ON;
- if (!pLed->bLedOn)
- SwLedOn(padapter, pLed);
- pLed->bLedBlinkInProgress = false;
- } else {
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
- }
- break;
- case LED_BLINK_WPS:
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
- break;
-
- default:
- break;
- }
-}
-
-/* Description:
- * Callback function of LED BlinkTimer,
- * it just schedules to corresponding BlinkWorkItem.
- */
-static void BlinkTimerCallback(struct timer_list *t)
-{
- struct LED_871x *pLed = from_timer(pLed, t, BlinkTimer);
-
- /* This fixed the crash problem on Fedora 12 when trying to do the
- * insmod;ifconfig up;rmmod commands.
- */
- if (pLed->padapter->surprise_removed || pLed->padapter->driver_stopped)
- return;
- schedule_work(&pLed->BlinkWorkItem);
-}
-
-/* Description:
- * Callback function of LED BlinkWorkItem.
- * We dispatch actual LED blink action according to LedStrategy.
- */
-static void BlinkWorkItemCallback(struct work_struct *work)
-{
- struct LED_871x *pLed = container_of(work, struct LED_871x,
- BlinkWorkItem);
- struct led_priv *ledpriv = &pLed->padapter->ledpriv;
-
- switch (ledpriv->LedStrategy) {
- case SW_LED_MODE0:
- SwLedBlink(pLed);
- break;
- case SW_LED_MODE1:
- SwLedBlink1(pLed);
- break;
- case SW_LED_MODE2:
- SwLedBlink2(pLed);
- break;
- case SW_LED_MODE3:
- SwLedBlink3(pLed);
- break;
- case SW_LED_MODE4:
- SwLedBlink4(pLed);
- break;
- case SW_LED_MODE5:
- SwLedBlink5(pLed);
- break;
- case SW_LED_MODE6:
- SwLedBlink6(pLed);
- break;
- default:
- SwLedBlink(pLed);
- break;
- }
-}
-
-/*============================================================================
- * Default LED behavior.
- *============================================================================
- *
- * Description:
- * Implement each led action for SW_LED_MODE0.
- * This is default strategy.
- */
-
-static void SwLedControlMode1(struct _adapter *padapter,
- enum LED_CTL_MODE LedAction)
-{
- struct led_priv *ledpriv = &padapter->ledpriv;
- struct LED_871x *pLed = &ledpriv->SwLed0;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct sitesurvey_ctrl *psitesurveyctrl = &pmlmepriv->sitesurveyctrl;
-
- if (padapter->eeprompriv.CustomerID == RT_CID_819x_CAMEO)
- pLed = &ledpriv->SwLed1;
- switch (LedAction) {
- case LED_CTL_START_TO_LINK:
- case LED_CTL_NO_LINK:
- if (!pLed->bLedNoLinkBlinkInProgress) {
- if (pLed->CurrLedState == LED_SCAN_BLINK ||
- IS_LED_WPS_BLINKING(pLed))
- return;
- if (pLed->bLedLinkBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedLinkBlinkInProgress = false;
- }
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- pLed->bLedNoLinkBlinkInProgress = true;
- pLed->CurrLedState = LED_BLINK_SLOWLY;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
- }
- break;
- case LED_CTL_LINK:
- if (!pLed->bLedLinkBlinkInProgress) {
- if (pLed->CurrLedState == LED_SCAN_BLINK ||
- IS_LED_WPS_BLINKING(pLed))
- return;
- if (pLed->bLedNoLinkBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedNoLinkBlinkInProgress = false;
- }
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- pLed->bLedLinkBlinkInProgress = true;
- pLed->CurrLedState = LED_BLINK_NORMAL;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_LINK_INTERVAL_ALPHA));
- }
- break;
- case LED_CTL_SITE_SURVEY:
- if (psitesurveyctrl->traffic_busy &&
- check_fwstate(pmlmepriv, _FW_LINKED))
- ; /* dummy branch */
- else if (!pLed->bLedScanBlinkInProgress) {
- if (IS_LED_WPS_BLINKING(pLed))
- return;
- if (pLed->bLedNoLinkBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedNoLinkBlinkInProgress = false;
- }
- if (pLed->bLedLinkBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedLinkBlinkInProgress = false;
- }
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- pLed->bLedScanBlinkInProgress = true;
- pLed->CurrLedState = LED_SCAN_BLINK;
- pLed->BlinkTimes = 24;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
- }
- break;
- case LED_CTL_TX:
- case LED_CTL_RX:
- if (!pLed->bLedBlinkInProgress) {
- if (pLed->CurrLedState == LED_SCAN_BLINK ||
- IS_LED_WPS_BLINKING(pLed))
- return;
- if (pLed->bLedNoLinkBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedNoLinkBlinkInProgress = false;
- }
- if (pLed->bLedLinkBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedLinkBlinkInProgress = false;
- }
- pLed->bLedBlinkInProgress = true;
- pLed->CurrLedState = LED_TXRX_BLINK;
- pLed->BlinkTimes = 2;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
- }
- break;
-
- case LED_CTL_START_WPS: /*wait until xinpin finish */
- case LED_CTL_START_WPS_BOTTON:
- if (!pLed->bLedWPSBlinkInProgress) {
- if (pLed->bLedNoLinkBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedNoLinkBlinkInProgress = false;
- }
- if (pLed->bLedLinkBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedLinkBlinkInProgress = false;
- }
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- if (pLed->bLedScanBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedScanBlinkInProgress = false;
- }
- pLed->bLedWPSBlinkInProgress = true;
- pLed->CurrLedState = LED_BLINK_WPS;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
- }
- break;
- case LED_CTL_STOP_WPS:
- if (pLed->bLedNoLinkBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedNoLinkBlinkInProgress = false;
- }
- if (pLed->bLedLinkBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedLinkBlinkInProgress = false;
- }
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- if (pLed->bLedScanBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedScanBlinkInProgress = false;
- }
- if (pLed->bLedWPSBlinkInProgress)
- del_timer(&pLed->BlinkTimer);
- else
- pLed->bLedWPSBlinkInProgress = true;
- pLed->CurrLedState = LED_BLINK_WPS_STOP;
- if (pLed->bLedOn) {
- pLed->BlinkingLedState = LED_STATE_OFF;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_WPS_SUCCESS_INTERVAL_ALPHA));
- } else {
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer,
- jiffies + msecs_to_jiffies(0));
- }
- break;
- case LED_CTL_STOP_WPS_FAIL:
- if (pLed->bLedWPSBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedWPSBlinkInProgress = false;
- }
- pLed->bLedNoLinkBlinkInProgress = true;
- pLed->CurrLedState = LED_BLINK_SLOWLY;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
- break;
- case LED_CTL_POWER_OFF:
- pLed->CurrLedState = LED_STATE_OFF;
- pLed->BlinkingLedState = LED_STATE_OFF;
- if (pLed->bLedNoLinkBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedNoLinkBlinkInProgress = false;
- }
- if (pLed->bLedLinkBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedLinkBlinkInProgress = false;
- }
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- if (pLed->bLedWPSBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedWPSBlinkInProgress = false;
- }
- if (pLed->bLedScanBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedScanBlinkInProgress = false;
- }
- mod_timer(&pLed->BlinkTimer,
- jiffies + msecs_to_jiffies(0));
- break;
- default:
- break;
- }
-}
-
-static void SwLedControlMode2(struct _adapter *padapter,
- enum LED_CTL_MODE LedAction)
-{
- struct led_priv *ledpriv = &padapter->ledpriv;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct LED_871x *pLed = &ledpriv->SwLed0;
-
- switch (LedAction) {
- case LED_CTL_SITE_SURVEY:
- if (pmlmepriv->sitesurveyctrl.traffic_busy)
- ; /* dummy branch */
- else if (!pLed->bLedScanBlinkInProgress) {
- if (IS_LED_WPS_BLINKING(pLed))
- return;
-
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- pLed->bLedScanBlinkInProgress = true;
- pLed->CurrLedState = LED_SCAN_BLINK;
- pLed->BlinkTimes = 24;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
- }
- break;
-
- case LED_CTL_TX:
- case LED_CTL_RX:
- if (!pLed->bLedBlinkInProgress &&
- check_fwstate(pmlmepriv, _FW_LINKED)) {
- if (pLed->CurrLedState == LED_SCAN_BLINK ||
- IS_LED_WPS_BLINKING(pLed))
- return;
- pLed->bLedBlinkInProgress = true;
- pLed->CurrLedState = LED_TXRX_BLINK;
- pLed->BlinkTimes = 2;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
- }
- break;
-
- case LED_CTL_LINK:
- pLed->CurrLedState = LED_STATE_ON;
- pLed->BlinkingLedState = LED_STATE_ON;
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- if (pLed->bLedScanBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedScanBlinkInProgress = false;
- }
-
- mod_timer(&pLed->BlinkTimer,
- jiffies + msecs_to_jiffies(0));
- break;
-
- case LED_CTL_START_WPS: /*wait until xinpin finish*/
- case LED_CTL_START_WPS_BOTTON:
- if (!pLed->bLedWPSBlinkInProgress) {
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- if (pLed->bLedScanBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedScanBlinkInProgress = false;
- }
- pLed->bLedWPSBlinkInProgress = true;
- pLed->CurrLedState = LED_STATE_ON;
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer,
- jiffies + msecs_to_jiffies(0));
- }
- break;
-
- case LED_CTL_STOP_WPS:
- pLed->bLedWPSBlinkInProgress = false;
- pLed->CurrLedState = LED_STATE_ON;
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer,
- jiffies + msecs_to_jiffies(0));
- break;
-
- case LED_CTL_STOP_WPS_FAIL:
- pLed->bLedWPSBlinkInProgress = false;
- pLed->CurrLedState = LED_STATE_OFF;
- pLed->BlinkingLedState = LED_STATE_OFF;
- mod_timer(&pLed->BlinkTimer,
- jiffies + msecs_to_jiffies(0));
- break;
-
- case LED_CTL_START_TO_LINK:
- case LED_CTL_NO_LINK:
- if (!IS_LED_BLINKING(pLed)) {
- pLed->CurrLedState = LED_STATE_OFF;
- pLed->BlinkingLedState = LED_STATE_OFF;
- mod_timer(&pLed->BlinkTimer,
- jiffies + msecs_to_jiffies(0));
- }
- break;
- case LED_CTL_POWER_OFF:
- pLed->CurrLedState = LED_STATE_OFF;
- pLed->BlinkingLedState = LED_STATE_OFF;
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- if (pLed->bLedScanBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedScanBlinkInProgress = false;
- }
- if (pLed->bLedWPSBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedWPSBlinkInProgress = false;
- }
- mod_timer(&pLed->BlinkTimer,
- jiffies + msecs_to_jiffies(0));
- break;
- default:
- break;
- }
-}
-
-static void SwLedControlMode3(struct _adapter *padapter,
- enum LED_CTL_MODE LedAction)
-{
- struct led_priv *ledpriv = &padapter->ledpriv;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct LED_871x *pLed = &ledpriv->SwLed0;
-
- switch (LedAction) {
- case LED_CTL_SITE_SURVEY:
- if (pmlmepriv->sitesurveyctrl.traffic_busy)
- ; /* dummy branch */
- else if (!pLed->bLedScanBlinkInProgress) {
- if (IS_LED_WPS_BLINKING(pLed))
- return;
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- pLed->bLedScanBlinkInProgress = true;
- pLed->CurrLedState = LED_SCAN_BLINK;
- pLed->BlinkTimes = 24;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
- }
- break;
- case LED_CTL_TX:
- case LED_CTL_RX:
- if (!pLed->bLedBlinkInProgress &&
- check_fwstate(pmlmepriv, _FW_LINKED)) {
- if (pLed->CurrLedState == LED_SCAN_BLINK ||
- IS_LED_WPS_BLINKING(pLed))
- return;
- pLed->bLedBlinkInProgress = true;
- pLed->CurrLedState = LED_TXRX_BLINK;
- pLed->BlinkTimes = 2;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
- }
- break;
- case LED_CTL_LINK:
- if (IS_LED_WPS_BLINKING(pLed))
- return;
- pLed->CurrLedState = LED_STATE_ON;
- pLed->BlinkingLedState = LED_STATE_ON;
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- if (pLed->bLedScanBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedScanBlinkInProgress = false;
- }
- mod_timer(&pLed->BlinkTimer,
- jiffies + msecs_to_jiffies(0));
- break;
- case LED_CTL_START_WPS: /* wait until xinpin finish */
- case LED_CTL_START_WPS_BOTTON:
- if (!pLed->bLedWPSBlinkInProgress) {
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- if (pLed->bLedScanBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedScanBlinkInProgress = false;
- }
- pLed->bLedWPSBlinkInProgress = true;
- pLed->CurrLedState = LED_BLINK_WPS;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
- }
- break;
- case LED_CTL_STOP_WPS:
- if (pLed->bLedWPSBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedWPSBlinkInProgress = false;
- } else {
- pLed->bLedWPSBlinkInProgress = true;
- }
- pLed->CurrLedState = LED_BLINK_WPS_STOP;
- if (pLed->bLedOn) {
- pLed->BlinkingLedState = LED_STATE_OFF;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_WPS_SUCCESS_INTERVAL_ALPHA));
- } else {
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer,
- jiffies + msecs_to_jiffies(0));
- }
- break;
- case LED_CTL_STOP_WPS_FAIL:
- if (pLed->bLedWPSBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedWPSBlinkInProgress = false;
- }
- pLed->CurrLedState = LED_STATE_OFF;
- pLed->BlinkingLedState = LED_STATE_OFF;
- mod_timer(&pLed->BlinkTimer,
- jiffies + msecs_to_jiffies(0));
- break;
- case LED_CTL_START_TO_LINK:
- case LED_CTL_NO_LINK:
- if (!IS_LED_BLINKING(pLed)) {
- pLed->CurrLedState = LED_STATE_OFF;
- pLed->BlinkingLedState = LED_STATE_OFF;
- mod_timer(&pLed->BlinkTimer,
- jiffies + msecs_to_jiffies(0));
- }
- break;
- case LED_CTL_POWER_OFF:
- pLed->CurrLedState = LED_STATE_OFF;
- pLed->BlinkingLedState = LED_STATE_OFF;
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- if (pLed->bLedScanBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedScanBlinkInProgress = false;
- }
- if (pLed->bLedWPSBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedWPSBlinkInProgress = false;
- }
- mod_timer(&pLed->BlinkTimer,
- jiffies + msecs_to_jiffies(0));
- break;
- default:
- break;
- }
-}
-
-static void SwLedControlMode4(struct _adapter *padapter,
- enum LED_CTL_MODE LedAction)
-{
- struct led_priv *ledpriv = &padapter->ledpriv;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct LED_871x *pLed = &ledpriv->SwLed0;
- struct LED_871x *pLed1 = &ledpriv->SwLed1;
-
- switch (LedAction) {
- case LED_CTL_START_TO_LINK:
- if (pLed1->bLedWPSBlinkInProgress) {
- pLed1->bLedWPSBlinkInProgress = false;
- del_timer(&pLed1->BlinkTimer);
- pLed1->BlinkingLedState = LED_STATE_OFF;
- pLed1->CurrLedState = LED_STATE_OFF;
- if (pLed1->bLedOn)
- mod_timer(&pLed->BlinkTimer,
- jiffies + msecs_to_jiffies(0));
- }
- if (!pLed->bLedStartToLinkBlinkInProgress) {
- if (pLed->CurrLedState == LED_SCAN_BLINK ||
- IS_LED_WPS_BLINKING(pLed))
- return;
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- if (pLed->bLedNoLinkBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedNoLinkBlinkInProgress = false;
- }
- pLed->bLedStartToLinkBlinkInProgress = true;
- pLed->CurrLedState = LED_BLINK_StartToBlink;
- if (pLed->bLedOn) {
- pLed->BlinkingLedState = LED_STATE_OFF;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SLOWLY_INTERVAL));
- } else {
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL));
- }
- }
- break;
- case LED_CTL_LINK:
- case LED_CTL_NO_LINK:
- /*LED1 settings*/
- if (LedAction == LED_CTL_LINK) {
- if (pLed1->bLedWPSBlinkInProgress) {
- pLed1->bLedWPSBlinkInProgress = false;
- del_timer(&pLed1->BlinkTimer);
- pLed1->BlinkingLedState = LED_STATE_OFF;
- pLed1->CurrLedState = LED_STATE_OFF;
- if (pLed1->bLedOn)
- mod_timer(&pLed->BlinkTimer,
- jiffies + msecs_to_jiffies(0));
- }
- }
- if (!pLed->bLedNoLinkBlinkInProgress) {
- if (pLed->CurrLedState == LED_SCAN_BLINK ||
- IS_LED_WPS_BLINKING(pLed))
- return;
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- pLed->bLedNoLinkBlinkInProgress = true;
- pLed->CurrLedState = LED_BLINK_SLOWLY;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
- }
- break;
- case LED_CTL_SITE_SURVEY:
- if (pmlmepriv->sitesurveyctrl.traffic_busy &&
- check_fwstate(pmlmepriv, _FW_LINKED))
- ;
- else if (!pLed->bLedScanBlinkInProgress) {
- if (IS_LED_WPS_BLINKING(pLed))
- return;
- if (pLed->bLedNoLinkBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedNoLinkBlinkInProgress = false;
- }
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- pLed->bLedScanBlinkInProgress = true;
- pLed->CurrLedState = LED_SCAN_BLINK;
- pLed->BlinkTimes = 24;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
- }
- break;
- case LED_CTL_TX:
- case LED_CTL_RX:
- if (!pLed->bLedBlinkInProgress) {
- if (pLed->CurrLedState == LED_SCAN_BLINK ||
- IS_LED_WPS_BLINKING(pLed))
- return;
- if (pLed->bLedNoLinkBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedNoLinkBlinkInProgress = false;
- }
- pLed->bLedBlinkInProgress = true;
- pLed->CurrLedState = LED_TXRX_BLINK;
- pLed->BlinkTimes = 2;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
- }
- break;
- case LED_CTL_START_WPS: /*wait until xinpin finish*/
- case LED_CTL_START_WPS_BOTTON:
- if (pLed1->bLedWPSBlinkInProgress) {
- pLed1->bLedWPSBlinkInProgress = false;
- del_timer(&pLed1->BlinkTimer);
- pLed1->BlinkingLedState = LED_STATE_OFF;
- pLed1->CurrLedState = LED_STATE_OFF;
- if (pLed1->bLedOn)
- mod_timer(&pLed->BlinkTimer,
- jiffies + msecs_to_jiffies(0));
- }
- if (!pLed->bLedWPSBlinkInProgress) {
- if (pLed->bLedNoLinkBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedNoLinkBlinkInProgress = false;
- }
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- if (pLed->bLedScanBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedScanBlinkInProgress = false;
- }
- pLed->bLedWPSBlinkInProgress = true;
- pLed->CurrLedState = LED_BLINK_WPS;
- if (pLed->bLedOn) {
- pLed->BlinkingLedState = LED_STATE_OFF;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SLOWLY_INTERVAL));
- } else {
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL));
- }
- }
- break;
- case LED_CTL_STOP_WPS: /*WPS connect success*/
- if (pLed->bLedWPSBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedWPSBlinkInProgress = false;
- }
- pLed->bLedNoLinkBlinkInProgress = true;
- pLed->CurrLedState = LED_BLINK_SLOWLY;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
- break;
- case LED_CTL_STOP_WPS_FAIL: /*WPS authentication fail*/
- if (pLed->bLedWPSBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedWPSBlinkInProgress = false;
- }
- pLed->bLedNoLinkBlinkInProgress = true;
- pLed->CurrLedState = LED_BLINK_SLOWLY;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
- /*LED1 settings*/
- if (pLed1->bLedWPSBlinkInProgress)
- del_timer(&pLed1->BlinkTimer);
- else
- pLed1->bLedWPSBlinkInProgress = true;
- pLed1->CurrLedState = LED_BLINK_WPS_STOP;
- if (pLed1->bLedOn)
- pLed1->BlinkingLedState = LED_STATE_OFF;
- else
- pLed1->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL));
- break;
- case LED_CTL_STOP_WPS_FAIL_OVERLAP: /*WPS session overlap*/
- if (pLed->bLedWPSBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedWPSBlinkInProgress = false;
- }
- pLed->bLedNoLinkBlinkInProgress = true;
- pLed->CurrLedState = LED_BLINK_SLOWLY;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
- /*LED1 settings*/
- if (pLed1->bLedWPSBlinkInProgress)
- del_timer(&pLed1->BlinkTimer);
- else
- pLed1->bLedWPSBlinkInProgress = true;
- pLed1->CurrLedState = LED_BLINK_WPS_STOP_OVERLAP;
- pLed1->BlinkTimes = 10;
- if (pLed1->bLedOn)
- pLed1->BlinkingLedState = LED_STATE_OFF;
- else
- pLed1->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL));
- break;
- case LED_CTL_POWER_OFF:
- pLed->CurrLedState = LED_STATE_OFF;
- pLed->BlinkingLedState = LED_STATE_OFF;
- if (pLed->bLedNoLinkBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedNoLinkBlinkInProgress = false;
- }
- if (pLed->bLedLinkBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedLinkBlinkInProgress = false;
- }
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- if (pLed->bLedWPSBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedWPSBlinkInProgress = false;
- }
- if (pLed->bLedScanBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedScanBlinkInProgress = false;
- }
- if (pLed->bLedStartToLinkBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedStartToLinkBlinkInProgress = false;
- }
- if (pLed1->bLedWPSBlinkInProgress) {
- del_timer(&pLed1->BlinkTimer);
- pLed1->bLedWPSBlinkInProgress = false;
- }
- pLed1->BlinkingLedState = LED_UNKNOWN;
- SwLedOff(padapter, pLed);
- SwLedOff(padapter, pLed1);
- break;
- default:
- break;
- }
-}
-
-static void SwLedControlMode5(struct _adapter *padapter,
- enum LED_CTL_MODE LedAction)
-{
- struct led_priv *ledpriv = &padapter->ledpriv;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct LED_871x *pLed = &ledpriv->SwLed0;
-
- if (padapter->eeprompriv.CustomerID == RT_CID_819x_CAMEO)
- pLed = &ledpriv->SwLed1;
-
- switch (LedAction) {
- case LED_CTL_POWER_ON:
- case LED_CTL_NO_LINK:
- case LED_CTL_LINK: /* solid blue */
- if (pLed->CurrLedState == LED_SCAN_BLINK)
- return;
- pLed->CurrLedState = LED_STATE_ON;
- pLed->BlinkingLedState = LED_STATE_ON;
- pLed->bLedBlinkInProgress = false;
- mod_timer(&pLed->BlinkTimer,
- jiffies + msecs_to_jiffies(0));
- break;
- case LED_CTL_SITE_SURVEY:
- if (pmlmepriv->sitesurveyctrl.traffic_busy &&
- check_fwstate(pmlmepriv, _FW_LINKED))
- ; /* dummy branch */
- else if (!pLed->bLedScanBlinkInProgress) {
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- pLed->bLedScanBlinkInProgress = true;
- pLed->CurrLedState = LED_SCAN_BLINK;
- pLed->BlinkTimes = 24;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
- }
- break;
- case LED_CTL_TX:
- case LED_CTL_RX:
- if (!pLed->bLedBlinkInProgress) {
- if (pLed->CurrLedState == LED_SCAN_BLINK)
- return;
- pLed->bLedBlinkInProgress = true;
- pLed->CurrLedState = LED_TXRX_BLINK;
- pLed->BlinkTimes = 2;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
- }
- break;
- case LED_CTL_POWER_OFF:
- pLed->CurrLedState = LED_STATE_OFF;
- pLed->BlinkingLedState = LED_STATE_OFF;
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- SwLedOff(padapter, pLed);
- break;
- default:
- break;
- }
-}
-
-static void SwLedControlMode6(struct _adapter *padapter,
- enum LED_CTL_MODE LedAction)
-{
- struct led_priv *ledpriv = &padapter->ledpriv;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct LED_871x *pLed = &ledpriv->SwLed0;
-
- switch (LedAction) {
- case LED_CTL_POWER_ON:
- case LED_CTL_NO_LINK:
- case LED_CTL_LINK: /*solid blue*/
- case LED_CTL_SITE_SURVEY:
- if (IS_LED_WPS_BLINKING(pLed))
- return;
- pLed->CurrLedState = LED_STATE_ON;
- pLed->BlinkingLedState = LED_STATE_ON;
- pLed->bLedBlinkInProgress = false;
- mod_timer(&pLed->BlinkTimer, jiffies + msecs_to_jiffies(0));
- break;
- case LED_CTL_TX:
- case LED_CTL_RX:
- if (!pLed->bLedBlinkInProgress &&
- check_fwstate(pmlmepriv, _FW_LINKED)) {
- if (IS_LED_WPS_BLINKING(pLed))
- return;
- pLed->bLedBlinkInProgress = true;
- pLed->CurrLedState = LED_TXRX_BLINK;
- pLed->BlinkTimes = 2;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
- }
- break;
- case LED_CTL_START_WPS: /*wait until xinpin finish*/
- case LED_CTL_START_WPS_BOTTON:
- if (!pLed->bLedWPSBlinkInProgress) {
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- pLed->bLedWPSBlinkInProgress = true;
- pLed->CurrLedState = LED_BLINK_WPS;
- if (pLed->bLedOn)
- pLed->BlinkingLedState = LED_STATE_OFF;
- else
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer, jiffies +
- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
- }
- break;
- case LED_CTL_STOP_WPS_FAIL:
- case LED_CTL_STOP_WPS:
- if (pLed->bLedWPSBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedWPSBlinkInProgress = false;
- }
- pLed->CurrLedState = LED_STATE_ON;
- pLed->BlinkingLedState = LED_STATE_ON;
- mod_timer(&pLed->BlinkTimer,
- jiffies + msecs_to_jiffies(0));
- break;
- case LED_CTL_POWER_OFF:
- pLed->CurrLedState = LED_STATE_OFF;
- pLed->BlinkingLedState = LED_STATE_OFF;
- if (pLed->bLedBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedBlinkInProgress = false;
- }
- if (pLed->bLedWPSBlinkInProgress) {
- del_timer(&pLed->BlinkTimer);
- pLed->bLedWPSBlinkInProgress = false;
- }
- SwLedOff(padapter, pLed);
- break;
- default:
- break;
- }
-}
-
-/* Description:
- * Dispatch LED action according to pHalData->LedStrategy.
- */
-void LedControl871x(struct _adapter *padapter, enum LED_CTL_MODE LedAction)
-{
- struct led_priv *ledpriv = &padapter->ledpriv;
-
- if (!ledpriv->bRegUseLed)
- return;
- switch (ledpriv->LedStrategy) {
- case SW_LED_MODE0:
- break;
- case SW_LED_MODE1:
- SwLedControlMode1(padapter, LedAction);
- break;
- case SW_LED_MODE2:
- SwLedControlMode2(padapter, LedAction);
- break;
- case SW_LED_MODE3:
- SwLedControlMode3(padapter, LedAction);
- break;
- case SW_LED_MODE4:
- SwLedControlMode4(padapter, LedAction);
- break;
- case SW_LED_MODE5:
- SwLedControlMode5(padapter, LedAction);
- break;
- case SW_LED_MODE6:
- SwLedControlMode6(padapter, LedAction);
- break;
- default:
- break;
- }
-}
-
-void r8712_flush_led_works(struct _adapter *padapter)
-{
- struct led_priv *pledpriv = &padapter->ledpriv;
-
- flush_work(&pledpriv->SwLed0.BlinkWorkItem);
- flush_work(&pledpriv->SwLed1.BlinkWorkItem);
-}
--- a/drivers/staging/rtl8712/rtl8712_macsetting_bitdef.h
+++ /dev/null
@@ -1,31 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_MACSETTING_BITDEF_H__
-#define __RTL8712_MACSETTING_BITDEF_H__
-
-/*MACID*/
-/*BSSID*/
-
-/*HWVID*/
-#define _HWVID_MSK 0x0F
-
-/*MAR*/
-/*MBIDCANCONTENT*/
-
-/*MBIDCANCFG*/
-#define _POOLING BIT(31)
-#define _WRITE_EN BIT(16)
-#define _CAM_ADDR_MSK 0x001F
-#define _CAM_ADDR_SHT 0
-
-/*BUILDTIME*/
-#define _BUILDTIME_MSK 0x3FFFFFFF
-
-/*BUILDUSER*/
-
-#endif /* __RTL8712_MACSETTING_BITDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_macsetting_regdef.h
+++ /dev/null
@@ -1,20 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_MACSETTING_REGDEF_H__
-#define __RTL8712_MACSETTING_REGDEF_H__
-
-#define MACID (RTL8712_MACIDSETTING_ + 0x0000)
-#define BSSIDR (RTL8712_MACIDSETTING_ + 0x0008)
-#define HWVID (RTL8712_MACIDSETTING_ + 0x000E)
-#define MAR (RTL8712_MACIDSETTING_ + 0x0010)
-#define MBIDCANCONTENT (RTL8712_MACIDSETTING_ + 0x0018)
-#define MBIDCANCFG (RTL8712_MACIDSETTING_ + 0x0020)
-#define BUILDTIME (RTL8712_MACIDSETTING_ + 0x0024)
-#define BUILDUSER (RTL8712_MACIDSETTING_ + 0x0028)
-
-#endif /*__RTL8712_MACSETTING_REGDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_powersave_bitdef.h
+++ /dev/null
@@ -1,39 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_POWERSAVE_BITDEF_H__
-#define __RTL8712_POWERSAVE_BITDEF_H__
-
-/*WOWCTRL*/
-#define _UWF BIT(3)
-#define _MAGIC BIT(2)
-#define _WOW_EN BIT(1)
-#define _PMEN BIT(0)
-
-/*PSSTATUS*/
-#define _PSSTATUS_SEL_MSK 0x0F
-
-/*PSSWITCH*/
-#define _PSSWITCH_ACT BIT(7)
-#define _PSSWITCH_SEL_MSK 0x0F
-#define _PSSWITCH_SEL_SHT 0
-
-/*LPNAV_CTRL*/
-#define _LPNAV_EN BIT(31)
-#define _LPNAV_EARLY_MSK 0x7FFF0000
-#define _LPNAV_EARLY_SHT 16
-#define _LPNAV_TH_MSK 0x0000FFFF
-#define _LPNAV_TH_SHT 0
-
-/*RPWM*/
-/*CPWM*/
-#define _TOGGLING BIT(7)
-#define _WWLAN BIT(3)
-#define _RPS_ST BIT(2)
-#define _WLAN_TRX BIT(1)
-#define _SYS_CLK BIT(0)
-
-#endif /* __RTL8712_POWERSAVE_BITDEF_H__*/
--- a/drivers/staging/rtl8712/rtl8712_powersave_regdef.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_POWERSAVE_REGDEF_H__
-#define __RTL8712_POWERSAVE_REGDEF_H__
-
-#define WOWCTRL (RTL8712_POWERSAVE_ + 0x00)
-#define PSSTATUS (RTL8712_POWERSAVE_ + 0x01)
-#define PSSWITCH (RTL8712_POWERSAVE_ + 0x02)
-#define MIMOPS_WAITPERIOD (RTL8712_POWERSAVE_ + 0x03)
-#define LPNAV_CTRL (RTL8712_POWERSAVE_ + 0x04)
-#define WFM0 (RTL8712_POWERSAVE_ + 0x10)
-#define WFM1 (RTL8712_POWERSAVE_ + 0x20)
-#define WFM2 (RTL8712_POWERSAVE_ + 0x30)
-#define WFM3 (RTL8712_POWERSAVE_ + 0x40)
-#define WFM4 (RTL8712_POWERSAVE_ + 0x50)
-#define WFM5 (RTL8712_POWERSAVE_ + 0x60)
-#define WFCRC (RTL8712_POWERSAVE_ + 0x70)
-#define RPWM (RTL8712_POWERSAVE_ + 0x7C)
-#define CPWM (RTL8712_POWERSAVE_ + 0x7D)
-
-#endif /* __RTL8712_POWERSAVE_REGDEF_H__ */
-
--- a/drivers/staging/rtl8712/rtl8712_ratectrl_bitdef.h
+++ /dev/null
@@ -1,36 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_RATECTRL_BITDEF_H__
-#define __RTL8712_RATECTRL_BITDEF_H__
-
-/*INIRTSMCS_SEL*/
-#define _INIRTSMCS_SEL_MSK 0x3F
-
-/* RRSR*/
-#define _RRSR_SHORT BIT(23)
-#define _RRSR_RSC_MSK 0x600000
-#define _RRSR_RSC_SHT 21
-#define _RRSR_BITMAP_MSK 0x0FFFFF
-#define _RRSR_BITMAP_SHT 0
-
-/* AGGLEN_LMT_H*/
-#define _AGGLMT_MCS32_MSK 0xF0
-#define _AGGLMT_MCS32_SHT 4
-#define _AGGLMT_MCS15_SGI_MSK 0x0F
-#define _AGGLMT_MCS15_SGI_SHT 0
-
-/* DARFRC*/
-/* RARFRC*/
-/* MCS_TXAGC*/
-/* CCK_TXAGC*/
-#define _CCK_MSK 0xFF00
-#define _CCK_SHT 8
-#define _BARKER_MSK 0x00FF
-#define _BARKER_SHT 0
-
-#endif /* __RTL8712_RATECTRL_BITDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_ratectrl_regdef.h
+++ /dev/null
@@ -1,43 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_RATECTRL_REGDEF_H__
-#define __RTL8712_RATECTRL_REGDEF_H__
-
-#define INIMCS_SEL (RTL8712_RATECTRL_ + 0x00)
-#define INIRTSMCS_SEL (RTL8712_RATECTRL_ + 0x20)
-#define RRSR (RTL8712_RATECTRL_ + 0x21)
-#define ARFR0 (RTL8712_RATECTRL_ + 0x24)
-#define ARFR1 (RTL8712_RATECTRL_ + 0x28)
-#define ARFR2 (RTL8712_RATECTRL_ + 0x2C)
-#define ARFR3 (RTL8712_RATECTRL_ + 0x30)
-#define ARFR4 (RTL8712_RATECTRL_ + 0x34)
-#define ARFR5 (RTL8712_RATECTRL_ + 0x38)
-#define ARFR6 (RTL8712_RATECTRL_ + 0x3C)
-#define ARFR7 (RTL8712_RATECTRL_ + 0x40)
-#define AGGLEN_LMT_H (RTL8712_RATECTRL_ + 0x47)
-#define AGGLEN_LMT_L (RTL8712_RATECTRL_ + 0x48)
-#define DARFRC (RTL8712_RATECTRL_ + 0x50)
-#define RARFRC (RTL8712_RATECTRL_ + 0x58)
-#define MCS_TXAGC0 (RTL8712_RATECTRL_ + 0x60)
-#define MCS_TXAGC1 (RTL8712_RATECTRL_ + 0x61)
-#define MCS_TXAGC2 (RTL8712_RATECTRL_ + 0x62)
-#define MCS_TXAGC3 (RTL8712_RATECTRL_ + 0x63)
-#define MCS_TXAGC4 (RTL8712_RATECTRL_ + 0x64)
-#define MCS_TXAGC5 (RTL8712_RATECTRL_ + 0x65)
-#define MCS_TXAGC6 (RTL8712_RATECTRL_ + 0x66)
-#define MCS_TXAGC7 (RTL8712_RATECTRL_ + 0x67)
-#define CCK_TXAGC (RTL8712_RATECTRL_ + 0x68)
-
-#endif /*__RTL8712_RATECTRL_REGDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_recv.c
+++ /dev/null
@@ -1,1079 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl8712_recv.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL8712_RECV_C_
-
-#include <linux/if_ether.h>
-#include <linux/ip.h>
-#include <net/cfg80211.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "recv_osdep.h"
-#include "mlme_osdep.h"
-#include "ethernet.h"
-#include "usb_ops.h"
-#include "wifi.h"
-
-static void recv_tasklet(struct tasklet_struct *t);
-
-void r8712_init_recv_priv(struct recv_priv *precvpriv,
- struct _adapter *padapter)
-{
- int i;
- struct recv_buf *precvbuf;
- addr_t tmpaddr = 0;
- int alignment = 0;
- struct sk_buff *pskb = NULL;
-
- /*init recv_buf*/
- _init_queue(&precvpriv->free_recv_buf_queue);
- precvpriv->pallocated_recv_buf =
- kzalloc(NR_RECVBUFF * sizeof(struct recv_buf) + 4, GFP_ATOMIC);
- if (!precvpriv->pallocated_recv_buf)
- return;
- precvpriv->precv_buf = precvpriv->pallocated_recv_buf + 4 -
- ((addr_t)(precvpriv->pallocated_recv_buf) & 3);
- precvbuf = (struct recv_buf *)precvpriv->precv_buf;
- for (i = 0; i < NR_RECVBUFF; i++) {
- INIT_LIST_HEAD(&precvbuf->list);
- spin_lock_init(&precvbuf->recvbuf_lock);
- if (r8712_os_recvbuf_resource_alloc(padapter, precvbuf))
- break;
- precvbuf->ref_cnt = 0;
- precvbuf->adapter = padapter;
- list_add_tail(&precvbuf->list,
- &precvpriv->free_recv_buf_queue.queue);
- precvbuf++;
- }
- precvpriv->free_recv_buf_queue_cnt = NR_RECVBUFF;
- tasklet_setup(&precvpriv->recv_tasklet, recv_tasklet);
- skb_queue_head_init(&precvpriv->rx_skb_queue);
-
- skb_queue_head_init(&precvpriv->free_recv_skb_queue);
- for (i = 0; i < NR_PREALLOC_RECV_SKB; i++) {
- pskb = netdev_alloc_skb(padapter->pnetdev, MAX_RECVBUF_SZ +
- RECVBUFF_ALIGN_SZ);
- if (pskb) {
- tmpaddr = (addr_t)pskb->data;
- alignment = tmpaddr & (RECVBUFF_ALIGN_SZ - 1);
- skb_reserve(pskb, (RECVBUFF_ALIGN_SZ - alignment));
- skb_queue_tail(&precvpriv->free_recv_skb_queue, pskb);
- }
- pskb = NULL;
- }
-}
-
-void r8712_free_recv_priv(struct recv_priv *precvpriv)
-{
- int i;
- struct recv_buf *precvbuf;
- struct _adapter *padapter = precvpriv->adapter;
-
- precvbuf = (struct recv_buf *)precvpriv->precv_buf;
- for (i = 0; i < NR_RECVBUFF; i++) {
- r8712_os_recvbuf_resource_free(padapter, precvbuf);
- precvbuf++;
- }
- kfree(precvpriv->pallocated_recv_buf);
- skb_queue_purge(&precvpriv->rx_skb_queue);
- if (skb_queue_len(&precvpriv->rx_skb_queue))
- netdev_warn(padapter->pnetdev, "r8712u: rx_skb_queue not empty\n");
- skb_queue_purge(&precvpriv->free_recv_skb_queue);
- if (skb_queue_len(&precvpriv->free_recv_skb_queue))
- netdev_warn(padapter->pnetdev, "r8712u: free_recv_skb_queue not empty %d\n",
- skb_queue_len(&precvpriv->free_recv_skb_queue));
-}
-
-void r8712_init_recvbuf(struct _adapter *padapter, struct recv_buf *precvbuf)
-{
- precvbuf->transfer_len = 0;
- precvbuf->len = 0;
- precvbuf->ref_cnt = 0;
- if (precvbuf->pbuf) {
- precvbuf->pdata = precvbuf->pbuf;
- precvbuf->phead = precvbuf->pbuf;
- precvbuf->ptail = precvbuf->pbuf;
- precvbuf->pend = precvbuf->pdata + MAX_RECVBUF_SZ;
- }
-}
-
-void r8712_free_recvframe(union recv_frame *precvframe,
- struct __queue *pfree_recv_queue)
-{
- unsigned long irqL;
- struct _adapter *padapter = precvframe->u.hdr.adapter;
- struct recv_priv *precvpriv = &padapter->recvpriv;
-
- if (precvframe->u.hdr.pkt) {
- dev_kfree_skb_any(precvframe->u.hdr.pkt);/*free skb by driver*/
- precvframe->u.hdr.pkt = NULL;
- }
- spin_lock_irqsave(&pfree_recv_queue->lock, irqL);
- list_del_init(&precvframe->u.hdr.list);
- list_add_tail(&precvframe->u.hdr.list, &pfree_recv_queue->queue);
- if (padapter) {
- if (pfree_recv_queue == &precvpriv->free_recv_queue)
- precvpriv->free_recvframe_cnt++;
- }
- spin_unlock_irqrestore(&pfree_recv_queue->lock, irqL);
-}
-
-static void update_recvframe_attrib_from_recvstat(struct rx_pkt_attrib *pattrib,
- struct recv_stat *prxstat)
-{
- u16 drvinfo_sz;
-
- drvinfo_sz = (le32_to_cpu(prxstat->rxdw0) & 0x000f0000) >> 16;
- drvinfo_sz <<= 3;
- /*TODO:
- * Offset 0
- */
- pattrib->bdecrypted = (le32_to_cpu(prxstat->rxdw0) & BIT(27)) == 0;
- pattrib->crc_err = (le32_to_cpu(prxstat->rxdw0) & BIT(14)) != 0;
- /*Offset 4*/
- /*Offset 8*/
- /*Offset 12*/
- if (le32_to_cpu(prxstat->rxdw3) & BIT(13)) {
- pattrib->tcpchk_valid = 1; /* valid */
- if (le32_to_cpu(prxstat->rxdw3) & BIT(11))
- pattrib->tcp_chkrpt = 1; /* correct */
- else
- pattrib->tcp_chkrpt = 0; /* incorrect */
- if (le32_to_cpu(prxstat->rxdw3) & BIT(12))
- pattrib->ip_chkrpt = 1; /* correct */
- else
- pattrib->ip_chkrpt = 0; /* incorrect */
- } else {
- pattrib->tcpchk_valid = 0; /* invalid */
- }
- pattrib->mcs_rate = (u8)((le32_to_cpu(prxstat->rxdw3)) & 0x3f);
- pattrib->htc = (u8)((le32_to_cpu(prxstat->rxdw3) >> 14) & 0x1);
- /*Offset 16*/
- /*Offset 20*/
- /*phy_info*/
-}
-
-/*perform defrag*/
-static union recv_frame *recvframe_defrag(struct _adapter *adapter,
- struct __queue *defrag_q)
-{
- struct list_head *plist, *phead;
- u8 wlanhdr_offset;
- u8 curfragnum;
- struct recv_frame_hdr *pfhdr, *pnfhdr;
- union recv_frame *prframe, *pnextrframe;
- struct __queue *pfree_recv_queue;
-
- pfree_recv_queue = &adapter->recvpriv.free_recv_queue;
- phead = &defrag_q->queue;
- plist = phead->next;
- prframe = container_of(plist, union recv_frame, u.list);
- list_del_init(&prframe->u.list);
- pfhdr = &prframe->u.hdr;
- curfragnum = 0;
- if (curfragnum != pfhdr->attrib.frag_num) {
- /*the first fragment number must be 0
- *free the whole queue
- */
- r8712_free_recvframe(prframe, pfree_recv_queue);
- r8712_free_recvframe_queue(defrag_q, pfree_recv_queue);
- return NULL;
- }
- curfragnum++;
- plist = &defrag_q->queue;
- plist = plist->next;
- while (!end_of_queue_search(phead, plist)) {
- pnextrframe = container_of(plist, union recv_frame, u.list);
- pnfhdr = &pnextrframe->u.hdr;
- /*check the fragment sequence (2nd ~n fragment frame) */
- if (curfragnum != pnfhdr->attrib.frag_num) {
- /* the fragment number must increase (after decache)
- * release the defrag_q & prframe
- */
- r8712_free_recvframe(prframe, pfree_recv_queue);
- r8712_free_recvframe_queue(defrag_q, pfree_recv_queue);
- return NULL;
- }
- curfragnum++;
- /* copy the 2nd~n fragment frame's payload to the first fragment
- * get the 2nd~last fragment frame's payload
- */
- wlanhdr_offset = pnfhdr->attrib.hdrlen + pnfhdr->attrib.iv_len;
- recvframe_pull(pnextrframe, wlanhdr_offset);
- /* append to first fragment frame's tail (if privacy frame,
- * pull the ICV)
- */
- recvframe_pull_tail(prframe, pfhdr->attrib.icv_len);
- memcpy(pfhdr->rx_tail, pnfhdr->rx_data, pnfhdr->len);
- recvframe_put(prframe, pnfhdr->len);
- pfhdr->attrib.icv_len = pnfhdr->attrib.icv_len;
- plist = plist->next;
- }
- /* free the defrag_q queue and return the prframe */
- r8712_free_recvframe_queue(defrag_q, pfree_recv_queue);
- return prframe;
-}
-
-/* check if need to defrag, if needed queue the frame to defrag_q */
-union recv_frame *r8712_recvframe_chk_defrag(struct _adapter *padapter,
- union recv_frame *precv_frame)
-{
- u8 ismfrag;
- u8 fragnum;
- u8 *psta_addr;
- struct recv_frame_hdr *pfhdr;
- struct sta_info *psta;
- struct sta_priv *pstapriv;
- struct list_head *phead;
- union recv_frame *prtnframe = NULL;
- struct __queue *pfree_recv_queue, *pdefrag_q;
-
- pstapriv = &padapter->stapriv;
- pfhdr = &precv_frame->u.hdr;
- pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
- /* need to define struct of wlan header frame ctrl */
- ismfrag = pfhdr->attrib.mfrag;
- fragnum = pfhdr->attrib.frag_num;
- psta_addr = pfhdr->attrib.ta;
- psta = r8712_get_stainfo(pstapriv, psta_addr);
- if (!psta)
- pdefrag_q = NULL;
- else
- pdefrag_q = &psta->sta_recvpriv.defrag_q;
-
- if ((ismfrag == 0) && (fragnum == 0))
- prtnframe = precv_frame;/*isn't a fragment frame*/
- if (ismfrag == 1) {
- /* 0~(n-1) fragment frame
- * enqueue to defraf_g
- */
- if (pdefrag_q) {
- if (fragnum == 0) {
- /*the first fragment*/
- if (!list_empty(&pdefrag_q->queue)) {
- /*free current defrag_q */
- r8712_free_recvframe_queue(pdefrag_q,
- pfree_recv_queue);
- }
- }
- /* Then enqueue the 0~(n-1) fragment to the defrag_q */
- phead = &pdefrag_q->queue;
- list_add_tail(&pfhdr->list, phead);
- prtnframe = NULL;
- } else {
- /* can't find this ta's defrag_queue, so free this
- * recv_frame
- */
- r8712_free_recvframe(precv_frame, pfree_recv_queue);
- prtnframe = NULL;
- }
- }
- if ((ismfrag == 0) && (fragnum != 0)) {
- /* the last fragment frame
- * enqueue the last fragment
- */
- if (pdefrag_q) {
- phead = &pdefrag_q->queue;
- list_add_tail(&pfhdr->list, phead);
- /*call recvframe_defrag to defrag*/
- precv_frame = recvframe_defrag(padapter, pdefrag_q);
- prtnframe = precv_frame;
- } else {
- /* can't find this ta's defrag_queue, so free this
- * recv_frame
- */
- r8712_free_recvframe(precv_frame, pfree_recv_queue);
- prtnframe = NULL;
- }
- }
- if (prtnframe && (prtnframe->u.hdr.attrib.privacy)) {
- /* after defrag we must check tkip mic code */
- if (r8712_recvframe_chkmic(padapter, prtnframe) == _FAIL) {
- r8712_free_recvframe(prtnframe, pfree_recv_queue);
- prtnframe = NULL;
- }
- }
- return prtnframe;
-}
-
-static void amsdu_to_msdu(struct _adapter *padapter, union recv_frame *prframe)
-{
- int a_len, padding_len;
- u16 eth_type, nSubframe_Length;
- u8 nr_subframes, i;
- unsigned char *pdata;
- struct rx_pkt_attrib *pattrib;
- _pkt *sub_skb, *subframes[MAX_SUBFRAME_COUNT];
- struct recv_priv *precvpriv = &padapter->recvpriv;
- struct __queue *pfree_recv_queue = &precvpriv->free_recv_queue;
-
- nr_subframes = 0;
- pattrib = &prframe->u.hdr.attrib;
- recvframe_pull(prframe, prframe->u.hdr.attrib.hdrlen);
- if (prframe->u.hdr.attrib.iv_len > 0)
- recvframe_pull(prframe, prframe->u.hdr.attrib.iv_len);
- a_len = prframe->u.hdr.len;
- pdata = prframe->u.hdr.rx_data;
- while (a_len > ETH_HLEN) {
- /* Offset 12 denote 2 mac address */
- nSubframe_Length = *((u16 *)(pdata + 12));
- /*==m==>change the length order*/
- nSubframe_Length = (nSubframe_Length >> 8) +
- (nSubframe_Length << 8);
- if (a_len < (ETHERNET_HEADER_SIZE + nSubframe_Length)) {
- netdev_warn(padapter->pnetdev, "r8712u: nRemain_Length is %d and nSubframe_Length is: %d\n",
- a_len, nSubframe_Length);
- goto exit;
- }
- /* move the data point to data content */
- pdata += ETH_HLEN;
- a_len -= ETH_HLEN;
- /* Allocate new skb for releasing to upper layer */
- sub_skb = dev_alloc_skb(nSubframe_Length + 12);
- if (!sub_skb)
- break;
- skb_reserve(sub_skb, 12);
- skb_put_data(sub_skb, pdata, nSubframe_Length);
- subframes[nr_subframes++] = sub_skb;
- if (nr_subframes >= MAX_SUBFRAME_COUNT) {
- netdev_warn(padapter->pnetdev, "r8712u: ParseSubframe(): Too many Subframes! Packets dropped!\n");
- break;
- }
- pdata += nSubframe_Length;
- a_len -= nSubframe_Length;
- if (a_len != 0) {
- padding_len = 4 - ((nSubframe_Length + ETH_HLEN) & 3);
- if (padding_len == 4)
- padding_len = 0;
- if (a_len < padding_len)
- goto exit;
- pdata += padding_len;
- a_len -= padding_len;
- }
- }
- for (i = 0; i < nr_subframes; i++) {
- sub_skb = subframes[i];
- /* convert hdr + possible LLC headers into Ethernet header */
- eth_type = (sub_skb->data[6] << 8) | sub_skb->data[7];
- if (sub_skb->len >= 8 &&
- ((!memcmp(sub_skb->data, rfc1042_header, SNAP_SIZE) &&
- eth_type != ETH_P_AARP && eth_type != ETH_P_IPX) ||
- !memcmp(sub_skb->data, bridge_tunnel_header, SNAP_SIZE))) {
- /* remove RFC1042 or Bridge-Tunnel encapsulation and
- * replace EtherType
- */
- skb_pull(sub_skb, SNAP_SIZE);
- memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->src,
- ETH_ALEN);
- memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->dst,
- ETH_ALEN);
- } else {
- __be16 len;
- /* Leave Ethernet header part of hdr and full payload */
- len = htons(sub_skb->len);
- memcpy(skb_push(sub_skb, 2), &len, 2);
- memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->src,
- ETH_ALEN);
- memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->dst,
- ETH_ALEN);
- }
- /* Indicate the packets to upper layer */
- if (sub_skb) {
- sub_skb->protocol =
- eth_type_trans(sub_skb, padapter->pnetdev);
- sub_skb->dev = padapter->pnetdev;
- if ((pattrib->tcpchk_valid == 1) &&
- (pattrib->tcp_chkrpt == 1)) {
- sub_skb->ip_summed = CHECKSUM_UNNECESSARY;
- } else {
- sub_skb->ip_summed = CHECKSUM_NONE;
- }
- netif_rx(sub_skb);
- }
- }
-exit:
- prframe->u.hdr.len = 0;
- r8712_free_recvframe(prframe, pfree_recv_queue);
-}
-
-void r8712_rxcmd_event_hdl(struct _adapter *padapter, void *prxcmdbuf)
-{
- __le32 voffset;
- u8 *poffset;
- u16 cmd_len, drvinfo_sz;
- struct recv_stat *prxstat;
-
- poffset = prxcmdbuf;
- voffset = *(__le32 *)poffset;
- prxstat = prxcmdbuf;
- drvinfo_sz = (le32_to_cpu(prxstat->rxdw0) & 0x000f0000) >> 16;
- drvinfo_sz <<= 3;
- poffset += RXDESC_SIZE + drvinfo_sz;
- do {
- voffset = *(__le32 *)poffset;
- cmd_len = (u16)(le32_to_cpu(voffset) & 0xffff);
- r8712_event_handle(padapter, (__le32 *)poffset);
- poffset += (cmd_len + 8);/*8 bytes alignment*/
- } while (le32_to_cpu(voffset) & BIT(31));
-}
-
-static int check_indicate_seq(struct recv_reorder_ctrl *preorder_ctrl,
- u16 seq_num)
-{
- u8 wsize = preorder_ctrl->wsize_b;
- u16 wend = (preorder_ctrl->indicate_seq + wsize - 1) % 4096;
-
- /* Rx Reorder initialize condition.*/
- if (preorder_ctrl->indicate_seq == 0xffff)
- preorder_ctrl->indicate_seq = seq_num;
- /* Drop out the packet which SeqNum is smaller than WinStart */
- if (SN_LESS(seq_num, preorder_ctrl->indicate_seq))
- return false;
- /*
- * Sliding window manipulation. Conditions includes:
- * 1. Incoming SeqNum is equal to WinStart =>Window shift 1
- * 2. Incoming SeqNum is larger than the WinEnd => Window shift N
- */
- if (SN_EQUAL(seq_num, preorder_ctrl->indicate_seq))
- preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq +
- 1) % 4096;
- else if (SN_LESS(wend, seq_num)) {
- if (seq_num >= (wsize - 1))
- preorder_ctrl->indicate_seq = seq_num + 1 - wsize;
- else
- preorder_ctrl->indicate_seq = 4095 - (wsize -
- (seq_num + 1)) + 1;
- }
- return true;
-}
-
-static int enqueue_reorder_recvframe(struct recv_reorder_ctrl *preorder_ctrl,
- union recv_frame *prframe)
-{
- struct list_head *phead, *plist;
- union recv_frame *pnextrframe;
- struct rx_pkt_attrib *pnextattrib;
- struct __queue *ppending_recvframe_queue =
- &preorder_ctrl->pending_recvframe_queue;
- struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib;
-
- phead = &ppending_recvframe_queue->queue;
- plist = phead->next;
- while (!end_of_queue_search(phead, plist)) {
- pnextrframe = container_of(plist, union recv_frame, u.list);
- pnextattrib = &pnextrframe->u.hdr.attrib;
-
- if (SN_EQUAL(pnextattrib->seq_num, pattrib->seq_num))
- return false;
-
- if (SN_LESS(pnextattrib->seq_num, pattrib->seq_num))
- plist = plist->next;
- else
- break;
- }
- list_del_init(&prframe->u.hdr.list);
- list_add_tail(&prframe->u.hdr.list, plist);
- return true;
-}
-
-int r8712_recv_indicatepkts_in_order(struct _adapter *padapter,
- struct recv_reorder_ctrl *preorder_ctrl,
- int bforced)
-{
- struct list_head *phead, *plist;
- union recv_frame *prframe;
- struct rx_pkt_attrib *pattrib;
- int bPktInBuf = false;
- struct __queue *ppending_recvframe_queue =
- &preorder_ctrl->pending_recvframe_queue;
-
- phead = &ppending_recvframe_queue->queue;
- plist = phead->next;
- /* Handling some condition for forced indicate case.*/
- if (bforced) {
- if (list_empty(phead))
- return true;
-
- prframe = container_of(plist, union recv_frame, u.list);
- pattrib = &prframe->u.hdr.attrib;
- preorder_ctrl->indicate_seq = pattrib->seq_num;
- }
- /* Prepare indication list and indication.
- * Check if there is any packet need indicate.
- */
- while (!list_empty(phead)) {
- prframe = container_of(plist, union recv_frame, u.list);
- pattrib = &prframe->u.hdr.attrib;
- if (!SN_LESS(preorder_ctrl->indicate_seq, pattrib->seq_num)) {
- plist = plist->next;
- list_del_init(&prframe->u.hdr.list);
- if (SN_EQUAL(preorder_ctrl->indicate_seq,
- pattrib->seq_num))
- preorder_ctrl->indicate_seq =
- (preorder_ctrl->indicate_seq + 1) % 4096;
- /*indicate this recv_frame*/
- if (!pattrib->amsdu) {
- if (!padapter->driver_stopped &&
- !padapter->surprise_removed) {
- /* indicate this recv_frame */
- r8712_recv_indicatepkt(padapter,
- prframe);
- }
- } else if (pattrib->amsdu == 1) {
- amsdu_to_msdu(padapter, prframe);
- }
- /* Update local variables. */
- bPktInBuf = false;
- } else {
- bPktInBuf = true;
- break;
- }
- }
- return bPktInBuf;
-}
-
-static int recv_indicatepkt_reorder(struct _adapter *padapter,
- union recv_frame *prframe)
-{
- unsigned long irql;
- struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib;
- struct recv_reorder_ctrl *preorder_ctrl = prframe->u.hdr.preorder_ctrl;
- struct __queue *ppending_recvframe_queue =
- &preorder_ctrl->pending_recvframe_queue;
-
- if (!pattrib->amsdu) {
- /* s1. */
- r8712_wlanhdr_to_ethhdr(prframe);
- if (pattrib->qos != 1) {
- if (!padapter->driver_stopped &&
- !padapter->surprise_removed) {
- r8712_recv_indicatepkt(padapter, prframe);
- return 0;
- } else {
- return -EINVAL;
- }
- }
- }
- spin_lock_irqsave(&ppending_recvframe_queue->lock, irql);
- /*s2. check if winstart_b(indicate_seq) needs to be updated*/
- if (!check_indicate_seq(preorder_ctrl, pattrib->seq_num))
- goto _err_exit;
- /*s3. Insert all packet into Reorder Queue to maintain its ordering.*/
- if (!enqueue_reorder_recvframe(preorder_ctrl, prframe))
- goto _err_exit;
- /*s4.
- * Indication process.
- * After Packet dropping and Sliding Window shifting as above, we can
- * now just indicate the packets with the SeqNum smaller than latest
- * WinStart and buffer other packets.
- *
- * For Rx Reorder condition:
- * 1. All packets with SeqNum smaller than WinStart => Indicate
- * 2. All packets with SeqNum larger than or equal to
- * WinStart => Buffer it.
- */
- if (r8712_recv_indicatepkts_in_order(padapter, preorder_ctrl, false)) {
- mod_timer(&preorder_ctrl->reordering_ctrl_timer,
- jiffies + msecs_to_jiffies(REORDER_WAIT_TIME));
- spin_unlock_irqrestore(&ppending_recvframe_queue->lock, irql);
- } else {
- spin_unlock_irqrestore(&ppending_recvframe_queue->lock, irql);
- del_timer(&preorder_ctrl->reordering_ctrl_timer);
- }
- return 0;
-_err_exit:
- spin_unlock_irqrestore(&ppending_recvframe_queue->lock, irql);
- return -ENOMEM;
-}
-
-void r8712_reordering_ctrl_timeout_handler(void *pcontext)
-{
- unsigned long irql;
- struct recv_reorder_ctrl *preorder_ctrl = pcontext;
- struct _adapter *padapter = preorder_ctrl->padapter;
- struct __queue *ppending_recvframe_queue =
- &preorder_ctrl->pending_recvframe_queue;
-
- if (padapter->driver_stopped || padapter->surprise_removed)
- return;
- spin_lock_irqsave(&ppending_recvframe_queue->lock, irql);
- r8712_recv_indicatepkts_in_order(padapter, preorder_ctrl, true);
- spin_unlock_irqrestore(&ppending_recvframe_queue->lock, irql);
-}
-
-static int r8712_process_recv_indicatepkts(struct _adapter *padapter,
- union recv_frame *prframe)
-{
- int retval = _SUCCESS;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct ht_priv *phtpriv = &pmlmepriv->htpriv;
-
- if (phtpriv->ht_option == 1) { /*B/G/N Mode*/
- if (recv_indicatepkt_reorder(padapter, prframe)) {
- /* including perform A-MPDU Rx Ordering Buffer Control*/
- if (!padapter->driver_stopped &&
- !padapter->surprise_removed)
- return _FAIL;
- }
- } else { /*B/G mode*/
- retval = r8712_wlanhdr_to_ethhdr(prframe);
- if (retval)
- return _FAIL;
- if (!padapter->driver_stopped && !padapter->surprise_removed) {
- /* indicate this recv_frame */
- r8712_recv_indicatepkt(padapter, prframe);
- } else {
- return _FAIL;
- }
- }
- return retval;
-}
-
-static u8 query_rx_pwr_percentage(s8 antpower)
-{
- if ((antpower <= -100) || (antpower >= 20))
- return 0;
- else if (antpower >= 0)
- return 100;
- else
- return 100 + antpower;
-}
-
-static u8 evm_db2percentage(s8 value)
-{
- /*
- * -33dB~0dB to 0%~99%
- */
- s8 ret_val = clamp(-value, 0, 33) * 3;
-
- if (ret_val == 99)
- ret_val = 100;
-
- return ret_val;
-}
-
-s32 r8712_signal_scale_mapping(s32 cur_sig)
-{
- s32 ret_sig;
-
- if (cur_sig >= 51 && cur_sig <= 100)
- ret_sig = 100;
- else if (cur_sig >= 41 && cur_sig <= 50)
- ret_sig = 80 + ((cur_sig - 40) * 2);
- else if (cur_sig >= 31 && cur_sig <= 40)
- ret_sig = 66 + (cur_sig - 30);
- else if (cur_sig >= 21 && cur_sig <= 30)
- ret_sig = 54 + (cur_sig - 20);
- else if (cur_sig >= 10 && cur_sig <= 20)
- ret_sig = 42 + (((cur_sig - 10) * 2) / 3);
- else if (cur_sig >= 5 && cur_sig <= 9)
- ret_sig = 22 + (((cur_sig - 5) * 3) / 2);
- else if (cur_sig >= 1 && cur_sig <= 4)
- ret_sig = 6 + (((cur_sig - 1) * 3) / 2);
- else
- ret_sig = cur_sig;
- return ret_sig;
-}
-
-static s32 translate2dbm(struct _adapter *padapter, u8 signal_strength_idx)
-{
- s32 signal_power; /* in dBm.*/
- /* Translate to dBm (x=0.5y-95).*/
- signal_power = (s32)((signal_strength_idx + 1) >> 1);
- signal_power -= 95;
- return signal_power;
-}
-
-static void query_rx_phy_status(struct _adapter *padapter,
- union recv_frame *prframe)
-{
- u8 i, max_spatial_stream, evm;
- struct recv_stat *prxstat = (struct recv_stat *)prframe->u.hdr.rx_head;
- struct phy_stat *pphy_stat = (struct phy_stat *)(prxstat + 1);
- u8 *pphy_head = (u8 *)(prxstat + 1);
- s8 rx_pwr[4], rx_pwr_all;
- u8 pwdb_all;
- u32 rssi, total_rssi = 0;
- u8 bcck_rate = 0, rf_rx_num = 0, cck_highpwr = 0;
- struct phy_cck_rx_status *pcck_buf;
- u8 sq;
-
- /* Record it for next packet processing*/
- bcck_rate = (prframe->u.hdr.attrib.mcs_rate <= 3 ? 1 : 0);
- if (bcck_rate) {
- u8 report;
-
- /* CCK Driver info Structure is not the same as OFDM packet.*/
- pcck_buf = (struct phy_cck_rx_status *)pphy_stat;
- /* (1)Hardware does not provide RSSI for CCK
- * (2)PWDB, Average PWDB calculated by hardware
- * (for rate adaptive)
- */
- if (!cck_highpwr) {
- report = pcck_buf->cck_agc_rpt & 0xc0;
- report >>= 6;
- switch (report) {
- /* Modify the RF RNA gain value to -40, -20,
- * -2, 14 by Jenyu's suggestion
- * Note: different RF with the different
- * RNA gain.
- */
- case 0x3:
- rx_pwr_all = -40 - (pcck_buf->cck_agc_rpt &
- 0x3e);
- break;
- case 0x2:
- rx_pwr_all = -20 - (pcck_buf->cck_agc_rpt &
- 0x3e);
- break;
- case 0x1:
- rx_pwr_all = -2 - (pcck_buf->cck_agc_rpt &
- 0x3e);
- break;
- case 0x0:
- rx_pwr_all = 14 - (pcck_buf->cck_agc_rpt &
- 0x3e);
- break;
- }
- } else {
- report = ((u8)(le32_to_cpu(pphy_stat->phydw1) >> 8)) &
- 0x60;
- report >>= 5;
- switch (report) {
- case 0x3:
- rx_pwr_all = -40 - ((pcck_buf->cck_agc_rpt &
- 0x1f) << 1);
- break;
- case 0x2:
- rx_pwr_all = -20 - ((pcck_buf->cck_agc_rpt &
- 0x1f) << 1);
- break;
- case 0x1:
- rx_pwr_all = -2 - ((pcck_buf->cck_agc_rpt &
- 0x1f) << 1);
- break;
- case 0x0:
- rx_pwr_all = 14 - ((pcck_buf->cck_agc_rpt &
- 0x1f) << 1);
- break;
- }
- }
- pwdb_all = query_rx_pwr_percentage(rx_pwr_all);
- /* CCK gain is smaller than OFDM/MCS gain,*/
- /* so we add gain diff by experiences, the val is 6 */
- pwdb_all += 6;
- if (pwdb_all > 100)
- pwdb_all = 100;
- /* modify the offset to make the same gain index with OFDM.*/
- if (pwdb_all > 34 && pwdb_all <= 42)
- pwdb_all -= 2;
- else if (pwdb_all > 26 && pwdb_all <= 34)
- pwdb_all -= 6;
- else if (pwdb_all > 14 && pwdb_all <= 26)
- pwdb_all -= 8;
- else if (pwdb_all > 4 && pwdb_all <= 14)
- pwdb_all -= 4;
- /*
- * (3) Get Signal Quality (EVM)
- */
- if (pwdb_all > 40) {
- sq = 100;
- } else {
- sq = pcck_buf->sq_rpt;
- if (pcck_buf->sq_rpt > 64)
- sq = 0;
- else if (pcck_buf->sq_rpt < 20)
- sq = 100;
- else
- sq = ((64 - sq) * 100) / 44;
- }
- prframe->u.hdr.attrib.signal_qual = sq;
- prframe->u.hdr.attrib.rx_mimo_signal_qual[0] = sq;
- prframe->u.hdr.attrib.rx_mimo_signal_qual[1] = -1;
- } else {
- /* (1)Get RSSI for HT rate */
- for (i = 0; i < ((padapter->registrypriv.rf_config) &
- 0x0f); i++) {
- rf_rx_num++;
- rx_pwr[i] = ((pphy_head[PHY_STAT_GAIN_TRSW_SHT + i]
- & 0x3F) * 2) - 110;
- /* Translate DBM to percentage. */
- rssi = query_rx_pwr_percentage(rx_pwr[i]);
- total_rssi += rssi;
- }
- /* (2)PWDB, Average PWDB calculated by hardware (for
- * rate adaptive)
- */
- rx_pwr_all = (((pphy_head[PHY_STAT_PWDB_ALL_SHT]) >> 1) & 0x7f)
- - 106;
- pwdb_all = query_rx_pwr_percentage(rx_pwr_all);
-
- {
- /* (3)EVM of HT rate */
- if (prframe->u.hdr.attrib.htc &&
- prframe->u.hdr.attrib.mcs_rate >= 20 &&
- prframe->u.hdr.attrib.mcs_rate <= 27) {
- /* both spatial stream make sense */
- max_spatial_stream = 2;
- } else {
- /* only spatial stream 1 makes sense */
- max_spatial_stream = 1;
- }
- for (i = 0; i < max_spatial_stream; i++) {
- evm = evm_db2percentage((pphy_head
- [PHY_STAT_RXEVM_SHT + i]));/*dbm*/
- prframe->u.hdr.attrib.signal_qual =
- (u8)(evm & 0xff);
- prframe->u.hdr.attrib.rx_mimo_signal_qual[i] =
- (u8)(evm & 0xff);
- }
- }
- }
- /* UI BSS List signal strength(in percentage), make it good looking,
- * from 0~100. It is assigned to the BSS List in
- * GetValueFromBeaconOrProbeRsp().
- */
- if (bcck_rate) {
- prframe->u.hdr.attrib.signal_strength =
- (u8)r8712_signal_scale_mapping(pwdb_all);
- } else {
- if (rf_rx_num != 0)
- prframe->u.hdr.attrib.signal_strength =
- (u8)(r8712_signal_scale_mapping(total_rssi /=
- rf_rx_num));
- }
-}
-
-static void process_link_qual(struct _adapter *padapter,
- union recv_frame *prframe)
-{
- u32 last_evm = 0, tmpVal;
- struct rx_pkt_attrib *pattrib;
- struct smooth_rssi_data *sqd = &padapter->recvpriv.signal_qual_data;
-
- if (!prframe || !padapter)
- return;
- pattrib = &prframe->u.hdr.attrib;
- if (pattrib->signal_qual != 0) {
- /*
- * 1. Record the general EVM to the sliding window.
- */
- if (sqd->total_num++ >= PHY_LINKQUALITY_SLID_WIN_MAX) {
- sqd->total_num = PHY_LINKQUALITY_SLID_WIN_MAX;
- last_evm = sqd->elements[sqd->index];
- sqd->total_val -= last_evm;
- }
- sqd->total_val += pattrib->signal_qual;
- sqd->elements[sqd->index++] = pattrib->signal_qual;
- if (sqd->index >= PHY_LINKQUALITY_SLID_WIN_MAX)
- sqd->index = 0;
-
- /* <1> Showed on UI for user, in percentage. */
- tmpVal = sqd->total_val / sqd->total_num;
- padapter->recvpriv.signal = (u8)tmpVal;
- }
-}
-
-static void process_rssi(struct _adapter *padapter, union recv_frame *prframe)
-{
- u32 last_rssi, tmp_val;
- struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib;
- struct smooth_rssi_data *ssd = &padapter->recvpriv.signal_strength_data;
-
- if (ssd->total_num++ >= PHY_RSSI_SLID_WIN_MAX) {
- ssd->total_num = PHY_RSSI_SLID_WIN_MAX;
- last_rssi = ssd->elements[ssd->index];
- ssd->total_val -= last_rssi;
- }
- ssd->total_val += pattrib->signal_strength;
- ssd->elements[ssd->index++] = pattrib->signal_strength;
- if (ssd->index >= PHY_RSSI_SLID_WIN_MAX)
- ssd->index = 0;
- tmp_val = ssd->total_val / ssd->total_num;
- padapter->recvpriv.rssi = (s8)translate2dbm(padapter, (u8)tmp_val);
-}
-
-static void process_phy_info(struct _adapter *padapter,
- union recv_frame *prframe)
-{
- query_rx_phy_status(padapter, prframe);
- process_rssi(padapter, prframe);
- process_link_qual(padapter, prframe);
-}
-
-int recv_func(struct _adapter *padapter, void *pcontext)
-{
- struct rx_pkt_attrib *pattrib;
- union recv_frame *prframe, *orig_prframe;
- int retval = _SUCCESS;
- struct __queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
- prframe = pcontext;
- orig_prframe = prframe;
- pattrib = &prframe->u.hdr.attrib;
- if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) {
- if (pattrib->crc_err == 1)
- padapter->mppriv.rx_crcerrpktcount++;
- else
- padapter->mppriv.rx_pktcount++;
- if (!check_fwstate(pmlmepriv, WIFI_MP_LPBK_STATE)) {
- /* free this recv_frame */
- r8712_free_recvframe(orig_prframe, pfree_recv_queue);
- goto _exit_recv_func;
- }
- }
- /* check the frame crtl field and decache */
- retval = r8712_validate_recv_frame(padapter, prframe);
- if (retval != _SUCCESS) {
- /* free this recv_frame */
- r8712_free_recvframe(orig_prframe, pfree_recv_queue);
- goto _exit_recv_func;
- }
- process_phy_info(padapter, prframe);
- prframe = r8712_decryptor(padapter, prframe);
- if (!prframe) {
- retval = _FAIL;
- goto _exit_recv_func;
- }
- prframe = r8712_recvframe_chk_defrag(padapter, prframe);
- if (!prframe)
- goto _exit_recv_func;
- prframe = r8712_portctrl(padapter, prframe);
- if (!prframe) {
- retval = _FAIL;
- goto _exit_recv_func;
- }
- retval = r8712_process_recv_indicatepkts(padapter, prframe);
- if (retval != _SUCCESS) {
- r8712_free_recvframe(orig_prframe, pfree_recv_queue);
- goto _exit_recv_func;
- }
-_exit_recv_func:
- return retval;
-}
-
-static void recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb)
-{
- u8 *pbuf, shift_sz = 0;
- u8 frag, mf;
- uint pkt_len;
- u32 transfer_len;
- struct recv_stat *prxstat;
- u16 pkt_cnt, drvinfo_sz, pkt_offset, tmp_len, alloc_sz;
- struct __queue *pfree_recv_queue;
- _pkt *pkt_copy = NULL;
- union recv_frame *precvframe = NULL;
- struct recv_priv *precvpriv = &padapter->recvpriv;
-
- pfree_recv_queue = &precvpriv->free_recv_queue;
- pbuf = pskb->data;
- prxstat = (struct recv_stat *)pbuf;
- pkt_cnt = (le32_to_cpu(prxstat->rxdw2) >> 16) & 0xff;
- pkt_len = le32_to_cpu(prxstat->rxdw0) & 0x00003fff;
- transfer_len = pskb->len;
- /* Test throughput with Netgear 3700 (No security) with Chariot 3T3R
- * pairs. The packet count will be a big number so that the containing
- * packet will effect the Rx reordering.
- */
- if (transfer_len < pkt_len) {
- /* In this case, it means the MAX_RECVBUF_SZ is too small to
- * get the data from 8712u.
- */
- return;
- }
- do {
- prxstat = (struct recv_stat *)pbuf;
- pkt_len = le32_to_cpu(prxstat->rxdw0) & 0x00003fff;
- /* more fragment bit */
- mf = (le32_to_cpu(prxstat->rxdw1) >> 27) & 0x1;
- /* ragmentation number */
- frag = (le32_to_cpu(prxstat->rxdw2) >> 12) & 0xf;
- /* uint 2^3 = 8 bytes */
- drvinfo_sz = (le32_to_cpu(prxstat->rxdw0) & 0x000f0000) >> 16;
- drvinfo_sz <<= 3;
- if (pkt_len <= 0)
- return;
- /* Qos data, wireless lan header length is 26 */
- if ((le32_to_cpu(prxstat->rxdw0) >> 23) & 0x01)
- shift_sz = 2;
- precvframe = r8712_alloc_recvframe(pfree_recv_queue);
- if (!precvframe)
- return;
- INIT_LIST_HEAD(&precvframe->u.hdr.list);
- precvframe->u.hdr.precvbuf = NULL; /*can't access the precvbuf*/
- precvframe->u.hdr.len = 0;
- tmp_len = pkt_len + drvinfo_sz + RXDESC_SIZE;
- pkt_offset = (u16)round_up(tmp_len, 128);
- /* for first fragment packet, driver need allocate 1536 +
- * drvinfo_sz + RXDESC_SIZE to defrag packet.
- */
- if ((mf == 1) && (frag == 0))
- /*1658+6=1664, 1664 is 128 alignment.*/
- alloc_sz = max_t(u16, tmp_len, 1658);
- else
- alloc_sz = tmp_len;
- /* 2 is for IP header 4 bytes alignment in QoS packet case.
- * 4 is for skb->data 4 bytes alignment.
- */
- alloc_sz += 6;
- pkt_copy = netdev_alloc_skb(padapter->pnetdev, alloc_sz);
- if (!pkt_copy)
- return;
-
- precvframe->u.hdr.pkt = pkt_copy;
- skb_reserve(pkt_copy, 4 - ((addr_t)(pkt_copy->data) % 4));
- skb_reserve(pkt_copy, shift_sz);
- memcpy(pkt_copy->data, pbuf, tmp_len);
- precvframe->u.hdr.rx_head = pkt_copy->data;
- precvframe->u.hdr.rx_data = pkt_copy->data;
- precvframe->u.hdr.rx_tail = pkt_copy->data;
- precvframe->u.hdr.rx_end = pkt_copy->data + alloc_sz;
-
- recvframe_put(precvframe, tmp_len);
- recvframe_pull(precvframe, drvinfo_sz + RXDESC_SIZE);
- /* because the endian issue, driver avoid reference to the
- * rxstat after calling update_recvframe_attrib_from_recvstat();
- */
- update_recvframe_attrib_from_recvstat(&precvframe->u.hdr.attrib,
- prxstat);
- r8712_recv_entry(precvframe);
- transfer_len -= pkt_offset;
- pbuf += pkt_offset;
- pkt_cnt--;
- precvframe = NULL;
- pkt_copy = NULL;
- } while ((transfer_len > 0) && pkt_cnt > 0);
-}
-
-static void recv_tasklet(struct tasklet_struct *t)
-{
- struct sk_buff *pskb;
- struct _adapter *padapter = from_tasklet(padapter, t,
- recvpriv.recv_tasklet);
- struct recv_priv *precvpriv = &padapter->recvpriv;
-
- while (NULL != (pskb = skb_dequeue(&precvpriv->rx_skb_queue))) {
- recvbuf2recvframe(padapter, pskb);
- skb_reset_tail_pointer(pskb);
- pskb->len = 0;
- if (!skb_cloned(pskb))
- skb_queue_tail(&precvpriv->free_recv_skb_queue, pskb);
- else
- consume_skb(pskb);
- }
-}
--- a/drivers/staging/rtl8712/rtl8712_recv.h
+++ /dev/null
@@ -1,145 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _RTL8712_RECV_H_
-#define _RTL8712_RECV_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-/* Realtek's v2.6.6 reduced this to 4. However, under heavy network and CPU
- * loads, even 8 receive buffers might not be enough; cutting it to 4 seemed
- * unwise.
- */
-#define NR_RECVBUFF (8)
-
-#define NR_PREALLOC_RECV_SKB (8)
-#define RXDESC_SIZE 24
-#define RXDESC_OFFSET RXDESC_SIZE
-#define RECV_BLK_SZ 512
-#define RECV_BLK_CNT 16
-#define RECV_BLK_TH RECV_BLK_CNT
-#define MAX_RECVBUF_SZ 9100
-#define RECVBUFF_ALIGN_SZ 512
-#define RSVD_ROOM_SZ (0)
-/*These definition is used for Rx packet reordering.*/
-#define SN_LESS(a, b) (((a-b) & 0x800) != 0)
-#define SN_EQUAL(a, b) (a == b)
-#define REORDER_WAIT_TIME 30 /* (ms)*/
-
-struct recv_stat {
- __le32 rxdw0;
- __le32 rxdw1;
- __le32 rxdw2;
- __le32 rxdw3;
- __le32 rxdw4;
- __le32 rxdw5;
-};
-
-struct phy_cck_rx_status {
- /* For CCK rate descriptor. This is a unsigned 8:1 variable.
- * LSB bit present 0.5. And MSB 7 bts present a signed value.
- * Range from -64~+63.5.
- */
- u8 adc_pwdb_X[4];
- u8 sq_rpt;
- u8 cck_agc_rpt;
-};
-
-struct phy_stat {
- __le32 phydw0;
- __le32 phydw1;
- __le32 phydw2;
- __le32 phydw3;
- __le32 phydw4;
- __le32 phydw5;
- __le32 phydw6;
- __le32 phydw7;
-};
-
-#define PHY_STAT_GAIN_TRSW_SHT 0
-#define PHY_STAT_PWDB_ALL_SHT 4
-#define PHY_STAT_CFOSHO_SHT 5
-#define PHY_STAT_CCK_AGC_RPT_SHT 5
-#define PHY_STAT_CFOTAIL_SHT 9
-#define PHY_STAT_RXEVM_SHT 13
-#define PHY_STAT_RXSNR_SHT 15
-#define PHY_STAT_PDSNR_SHT 19
-#define PHY_STAT_CSI_CURRENT_SHT 21
-#define PHY_STAT_CSI_TARGET_SHT 23
-#define PHY_STAT_SIGEVM_SHT 25
-#define PHY_STAT_MAX_EX_PWR_SHT 26
-
-union recvstat {
- struct recv_stat recv_stat;
- unsigned int value[RXDESC_SIZE>>2];
-};
-
-struct recv_buf {
- struct list_head list;
- spinlock_t recvbuf_lock;
- u32 ref_cnt;
- struct _adapter *adapter;
- struct urb *purb;
- _pkt *pskb;
- u8 irp_pending;
- u32 transfer_len;
- uint len;
- u8 *phead;
- u8 *pdata;
- u8 *ptail;
- u8 *pend;
- u8 *pbuf;
- u8 *pallocated_buf;
-};
-
-/*
- * head ----->
- * data ----->
- * payload
- * tail ----->
- * end ----->
- * len = (unsigned int )(tail - data);
- */
-struct recv_frame_hdr {
- struct list_head list;
- _pkt *pkt;
- _pkt *pkt_newalloc;
- struct _adapter *adapter;
- u8 fragcnt;
- struct rx_pkt_attrib attrib;
- uint len;
- u8 *rx_head;
- u8 *rx_data;
- u8 *rx_tail;
- u8 *rx_end;
- void *precvbuf;
- struct sta_info *psta;
- /*for A-MPDU Rx reordering buffer control*/
- struct recv_reorder_ctrl *preorder_ctrl;
-};
-
-union recv_frame {
- union {
- struct list_head list;
- struct recv_frame_hdr hdr;
- } u;
-};
-
-void r8712_init_recvbuf(struct _adapter *padapter, struct recv_buf *precvbuf);
-void r8712_rxcmd_event_hdl(struct _adapter *padapter, void *prxcmdbuf);
-s32 r8712_signal_scale_mapping(s32 cur_sig);
-void r8712_reordering_ctrl_timeout_handler(void *pcontext);
-
-#endif
-
--- a/drivers/staging/rtl8712/rtl8712_regdef.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_REGDEF_H__
-#define __RTL8712_REGDEF_H__
-
-#include "rtl8712_syscfg_regdef.h"
-#include "rtl8712_cmdctrl_regdef.h"
-#include "rtl8712_macsetting_regdef.h"
-#include "rtl8712_timectrl_regdef.h"
-#include "rtl8712_fifoctrl_regdef.h"
-#include "rtl8712_ratectrl_regdef.h"
-#include "rtl8712_edcasetting_regdef.h"
-#include "rtl8712_wmac_regdef.h"
-#include "rtl8712_powersave_regdef.h"
-#include "rtl8712_gp_regdef.h"
-#include "rtl8712_debugctrl_regdef.h"
-
-#define HIMR (RTL8712_INTERRUPT_ + 0x08)
-
-#endif /* __RTL8712_REGDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_security_bitdef.h
+++ /dev/null
@@ -1,34 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_SECURITY_BITDEF_H__
-#define __RTL8712_SECURITY_BITDEF_H__
-
-/*CAMCMD*/
-#define _SECCAM_POLLING BIT(31)
-#define _SECCAM_CLR BIT(30)
-#define _SECCAM_WE BIT(16)
-#define _SECCAM_ADR_MSK 0x000000FF
-#define _SECCAM_ADR_SHT 0
-
-/*CAMDBG*/
-#define _SECCAM_INFO BIT(31)
-#define _SEC_KEYFOUND BIT(30)
-#define _SEC_CONFIG_MSK 0x3F000000
-#define _SEC_CONFIG_SHT 24
-#define _SEC_KEYCONTENT_MSK 0x00FFFFFF
-#define _SEC_KEYCONTENT_SHT 0
-
-/*SECCFG*/
-#define _NOSKMC BIT(5)
-#define _SKBYA2 BIT(4)
-#define _RXDEC BIT(3)
-#define _TXENC BIT(2)
-#define _RXUSEDK BIT(1)
-#define _TXUSEDK BIT(0)
-
-#endif /*__RTL8712_SECURITY_BITDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_spec.h
+++ /dev/null
@@ -1,121 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_SPEC_H__
-#define __RTL8712_SPEC_H__
-
-#define RTL8712_IOBASE_TXPKT 0x10200000 /*IOBASE_TXPKT*/
-#define RTL8712_IOBASE_RXPKT 0x10210000 /*IOBASE_RXPKT*/
-#define RTL8712_IOBASE_RXCMD 0x10220000 /*IOBASE_RXCMD*/
-#define RTL8712_IOBASE_TXSTATUS 0x10230000 /*IOBASE_TXSTATUS*/
-#define RTL8712_IOBASE_RXSTATUS 0x10240000 /*IOBASE_RXSTATUS*/
-#define RTL8712_IOBASE_IOREG 0x10250000 /*IOBASE_IOREG ADDR*/
-#define RTL8712_IOBASE_SCHEDULER 0x10260000 /*IOBASE_SCHEDULE*/
-
-#define RTL8712_IOBASE_TRXDMA 0x10270000 /*IOBASE_TRXDMA*/
-#define RTL8712_IOBASE_TXLLT 0x10280000 /*IOBASE_TXLLT*/
-#define RTL8712_IOBASE_WMAC 0x10290000 /*IOBASE_WMAC*/
-#define RTL8712_IOBASE_FW2HW 0x102A0000 /*IOBASE_FW2HW*/
-#define RTL8712_IOBASE_ACCESS_PHYREG 0x102B0000 /*IOBASE_ACCESS_PHYREG*/
-
-#define RTL8712_IOBASE_FF 0x10300000 /*IOBASE_FIFO 0x1031000~0x103AFFFF*/
-
-/*IOREG Offset for 8712*/
-#define RTL8712_SYSCFG_ RTL8712_IOBASE_IOREG
-#define RTL8712_CMDCTRL_ (RTL8712_IOBASE_IOREG + 0x40)
-#define RTL8712_MACIDSETTING_ (RTL8712_IOBASE_IOREG + 0x50)
-#define RTL8712_TIMECTRL_ (RTL8712_IOBASE_IOREG + 0x80)
-#define RTL8712_FIFOCTRL_ (RTL8712_IOBASE_IOREG + 0xA0)
-#define RTL8712_RATECTRL_ (RTL8712_IOBASE_IOREG + 0x160)
-#define RTL8712_EDCASETTING_ (RTL8712_IOBASE_IOREG + 0x1D0)
-#define RTL8712_WMAC_ (RTL8712_IOBASE_IOREG + 0x200)
-#define RTL8712_SECURITY_ (RTL8712_IOBASE_IOREG + 0x240)
-#define RTL8712_POWERSAVE_ (RTL8712_IOBASE_IOREG + 0x260)
-#define RTL8712_GP_ (RTL8712_IOBASE_IOREG + 0x2E0)
-#define RTL8712_INTERRUPT_ (RTL8712_IOBASE_IOREG + 0x300)
-#define RTL8712_DEBUGCTRL_ (RTL8712_IOBASE_IOREG + 0x310)
-#define RTL8712_OFFLOAD_ (RTL8712_IOBASE_IOREG + 0x2D0)
-
-/*FIFO for 8712*/
-#define RTL8712_DMA_BCNQ (RTL8712_IOBASE_FF + 0x10000)
-#define RTL8712_DMA_MGTQ (RTL8712_IOBASE_FF + 0x20000)
-#define RTL8712_DMA_BMCQ (RTL8712_IOBASE_FF + 0x30000)
-#define RTL8712_DMA_VOQ (RTL8712_IOBASE_FF + 0x40000)
-#define RTL8712_DMA_VIQ (RTL8712_IOBASE_FF + 0x50000)
-#define RTL8712_DMA_BEQ (RTL8712_IOBASE_FF + 0x60000)
-#define RTL8712_DMA_BKQ (RTL8712_IOBASE_FF + 0x70000)
-#define RTL8712_DMA_RX0FF (RTL8712_IOBASE_FF + 0x80000)
-#define RTL8712_DMA_H2CCMD (RTL8712_IOBASE_FF + 0x90000)
-#define RTL8712_DMA_C2HCMD (RTL8712_IOBASE_FF + 0xA0000)
-
-/*------------------------------*/
-
-/*BIT 16 15*/
-#define DID_SDIO_LOCAL 0 /* 0 0*/
-#define DID_WLAN_IOREG 1 /* 0 1*/
-#define DID_WLAN_FIFO 3 /* 1 1*/
-#define DID_UNDEFINE (-1)
-
-#define CMD_ADDR_MAPPING_SHIFT 2 /*SDIO CMD ADDR MAPPING,
- *shift 2 bit for match
- * offset[14:2]
- */
-
-/*Offset for SDIO LOCAL*/
-#define OFFSET_SDIO_LOCAL 0x0FFF
-
-/*Offset for WLAN IOREG*/
-#define OFFSET_WLAN_IOREG 0x0FFF
-
-/*Offset for WLAN FIFO*/
-#define OFFSET_TX_BCNQ 0x0300
-#define OFFSET_TX_HIQ 0x0310
-#define OFFSET_TX_CMDQ 0x0320
-#define OFFSET_TX_MGTQ 0x0330
-#define OFFSET_TX_HCCAQ 0x0340
-#define OFFSET_TX_VOQ 0x0350
-#define OFFSET_TX_VIQ 0x0360
-#define OFFSET_TX_BEQ 0x0370
-#define OFFSET_TX_BKQ 0x0380
-#define OFFSET_RX_RX0FFQ 0x0390
-#define OFFSET_RX_C2HFFQ 0x03A0
-
-#define BK_QID_01 1
-#define BK_QID_02 2
-#define BE_QID_01 0
-#define BE_QID_02 3
-#define VI_QID_01 4
-#define VI_QID_02 5
-#define VO_QID_01 6
-#define VO_QID_02 7
-#define HCCA_QID_01 8
-#define HCCA_QID_02 9
-#define HCCA_QID_03 10
-#define HCCA_QID_04 11
-#define HCCA_QID_05 12
-#define HCCA_QID_06 13
-#define HCCA_QID_07 14
-#define HCCA_QID_08 15
-#define HI_QID 17
-#define CMD_QID 19
-#define MGT_QID 18
-#define BCN_QID 16
-
-#include "rtl8712_regdef.h"
-
-#include "rtl8712_bitdef.h"
-
-#include "basic_types.h"
-
-#endif /* __RTL8712_SPEC_H__ */
-
--- a/drivers/staging/rtl8712/rtl8712_syscfg_bitdef.h
+++ /dev/null
@@ -1,163 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_SYSCFG_BITDEF_H__
-#define __RTL8712_SYSCFG_BITDEF_H__
-
-/*SYS_PWR_CTRL*/
-/*SRCTRL0*/
-/*SRCTRL1*/
-/*SYS_CLKR*/
-
-/*SYS_IOS_CTRL*/
-#define iso_LDR2RP_SHT 8 /* EE Loader to Retention Path*/
-#define iso_LDR2RP BIT(iso_LDR2RP_SHT) /* 1:isolation, 0:attach*/
-
-/*SYS_CTRL*/
-#define FEN_DIO_SDIO_SHT 0
-#define FEN_DIO_SDIO BIT(FEN_DIO_SDIO_SHT)
-#define FEN_SDIO_SHT 1
-#define FEN_SDIO BIT(FEN_SDIO_SHT)
-#define FEN_USBA_SHT 2
-#define FEN_USBA BIT(FEN_USBA_SHT)
-#define FEN_UPLL_SHT 3
-#define FEN_UPLL BIT(FEN_UPLL_SHT)
-#define FEN_USBD_SHT 4
-#define FEN_USBD BIT(FEN_USBD_SHT)
-#define FEN_DIO_PCIE_SHT 5
-#define FEN_DIO_PCIE BIT(FEN_DIO_PCIE_SHT)
-#define FEN_PCIEA_SHT 6
-#define FEN_PCIEA BIT(FEN_PCIEA_SHT)
-#define FEN_PPLL_SHT 7
-#define FEN_PPLL BIT(FEN_PPLL_SHT)
-#define FEN_PCIED_SHT 8
-#define FEN_PCIED BIT(FEN_PCIED_SHT)
-#define FEN_CPUEN_SHT 10
-#define FEN_CPUEN BIT(FEN_CPUEN_SHT)
-#define FEN_DCORE_SHT 11
-#define FEN_DCORE BIT(FEN_DCORE_SHT)
-#define FEN_ELDR_SHT 12
-#define FEN_ELDR BIT(FEN_ELDR_SHT)
-#define PWC_DV2LDR_SHT 13
-#define PWC_DV2LDR BIT(PWC_DV2LDR_SHT) /* Loader Power Enable*/
-
-/*=== SYS_CLKR ===*/
-#define SYS_CLKSEL_SHT 0
-#define SYS_CLKSEL BIT(SYS_CLKSEL_SHT) /* System Clock 80MHz*/
-#define PS_CLKSEL_SHT 1
-#define PS_CLKSEL BIT(PS_CLKSEL_SHT) /*System power save
- * clock select.
- */
-#define CPU_CLKSEL_SHT 2
-#define CPU_CLKSEL BIT(CPU_CLKSEL_SHT) /* System Clock select,
- * 1: AFE source,
- * 0: System clock(L-Bus)
- */
-#define INT32K_EN_SHT 3
-#define INT32K_EN BIT(INT32K_EN_SHT)
-#define MACSLP_SHT 4
-#define MACSLP BIT(MACSLP_SHT)
-#define MAC_CLK_EN_SHT 11
-#define MAC_CLK_EN BIT(MAC_CLK_EN_SHT) /* MAC Clock Enable.*/
-#define SYS_CLK_EN_SHT 12
-#define SYS_CLK_EN BIT(SYS_CLK_EN_SHT)
-#define RING_CLK_EN_SHT 13
-#define RING_CLK_EN BIT(RING_CLK_EN_SHT)
-#define SWHW_SEL_SHT 14
-#define SWHW_SEL BIT(SWHW_SEL_SHT) /* Load done,
- * control path switch.
- */
-#define FWHW_SEL_SHT 15
-#define FWHW_SEL BIT(FWHW_SEL_SHT) /* Sleep exit,
- * control path switch.
- */
-
-/*9346CR*/
-#define _VPDIDX_MSK 0xFF00
-#define _VPDIDX_SHT 8
-#define _EEM_MSK 0x00C0
-#define _EEM_SHT 6
-#define _EEM0 BIT(6)
-#define _EEM1 BIT(7)
-#define _EEPROM_EN BIT(5)
-#define _9356SEL BIT(4)
-#define _EECS BIT(3)
-#define _EESK BIT(2)
-#define _EEDI BIT(1)
-#define _EEDO BIT(0)
-
-/*AFE_MISC*/
-#define AFE_MISC_USB_MBEN_SHT 7
-#define AFE_MISC_USB_MBEN BIT(AFE_MISC_USB_MBEN_SHT)
-#define AFE_MISC_USB_BGEN_SHT 6
-#define AFE_MISC_USB_BGEN BIT(AFE_MISC_USB_BGEN_SHT)
-#define AFE_MISC_LD12_VDAJ_SHT 4
-#define AFE_MISC_LD12_VDAJ_MSK 0X0030
-#define AFE_MISC_LD12_VDAJ BIT(AFE_MISC_LD12_VDAJ_SHT)
-#define AFE_MISC_I32_EN_SHT 3
-#define AFE_MISC_I32_EN BIT(AFE_MISC_I32_EN_SHT)
-#define AFE_MISC_E32_EN_SHT 2
-#define AFE_MISC_E32_EN BIT(AFE_MISC_E32_EN_SHT)
-#define AFE_MISC_MBEN_SHT 1
-#define AFE_MISC_MBEN BIT(AFE_MISC_MBEN_SHT)/* Enable AFE Macro
- * Block's Mbias.
- */
-#define AFE_MISC_BGEN_SHT 0
-#define AFE_MISC_BGEN BIT(AFE_MISC_BGEN_SHT)/* Enable AFE Macro
- * Block's Bandgap.
- */
-
-/*--------------------------------------------------------------------------*/
-/* SPS1_CTRL bits (Offset 0x18-1E, 56bits)*/
-/*--------------------------------------------------------------------------*/
-#define SPS1_SWEN BIT(1) /* Enable vsps18 SW Macro Block.*/
-#define SPS1_LDEN BIT(0) /* Enable VSPS12 LDO Macro block.*/
-
-/*----------------------------------------------------------------------------*/
-/* LDOA15_CTRL bits (Offset 0x20, 8bits)*/
-/*----------------------------------------------------------------------------*/
-#define LDA15_EN BIT(0) /* Enable LDOA15 Macro Block*/
-
-/*----------------------------------------------------------------------------*/
-/* 8192S LDOV12D_CTRL bit (Offset 0x21, 8bits)*/
-/*----------------------------------------------------------------------------*/
-#define LDV12_EN BIT(0) /* Enable LDOVD12 Macro Block*/
-#define LDV12_SDBY BIT(1) /* LDOVD12 standby mode*/
-
-/*CLK_PS_CTRL*/
-#define _CLK_GATE_EN BIT(0)
-
-/* EFUSE_CTRL*/
-#define EF_FLAG BIT(31) /* Access Flag, Write:1;
- * Read:0
- */
-#define EF_PGPD 0x70000000 /* E-fuse Program time*/
-#define EF_RDT 0x0F000000 /* E-fuse read time: in the
- * unit of cycle time
- */
-#define EF_PDN_EN BIT(19) /* EFuse Power down enable*/
-#define ALD_EN BIT(18) /* Autoload Enable*/
-#define EF_ADDR 0x0003FF00 /* Access Address*/
-#define EF_DATA 0x000000FF /* Access Data*/
-
-/* EFUSE_TEST*/
-#define LDOE25_EN BIT(31) /* Enable LDOE25 Macro Block*/
-
-/* EFUSE_CLK_CTRL*/
-#define EFUSE_CLK_EN BIT(1) /* E-Fuse Clock Enable*/
-#define EFUSE_CLK_SEL BIT(0) /* E-Fuse Clock Select,
- * 0:500K, 1:40M
- */
-
-#endif /*__RTL8712_SYSCFG_BITDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_syscfg_regdef.h
+++ /dev/null
@@ -1,42 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_SYSCFG_REGDEF_H__
-#define __RTL8712_SYSCFG_REGDEF_H__
-
-#define SYS_ISO_CTRL (RTL8712_SYSCFG_ + 0x0000)
-#define SYS_FUNC_EN (RTL8712_SYSCFG_ + 0x0002)
-#define PMC_FSM (RTL8712_SYSCFG_ + 0x0004)
-#define SYS_CLKR (RTL8712_SYSCFG_ + 0x0008)
-#define EE_9346CR (RTL8712_SYSCFG_ + 0x000A)
-#define EE_VPD (RTL8712_SYSCFG_ + 0x000C)
-#define AFE_MISC (RTL8712_SYSCFG_ + 0x0010)
-#define SPS0_CTRL (RTL8712_SYSCFG_ + 0x0011)
-#define SPS1_CTRL (RTL8712_SYSCFG_ + 0x0018)
-#define RF_CTRL (RTL8712_SYSCFG_ + 0x001F)
-#define LDOA15_CTRL (RTL8712_SYSCFG_ + 0x0020)
-#define LDOV12D_CTRL (RTL8712_SYSCFG_ + 0x0021)
-#define LDOHCI12_CTRL (RTL8712_SYSCFG_ + 0x0022)
-#define LDO_USB_CTRL (RTL8712_SYSCFG_ + 0x0023)
-#define LPLDO_CTRL (RTL8712_SYSCFG_ + 0x0024)
-#define AFE_XTAL_CTRL (RTL8712_SYSCFG_ + 0x0026)
-#define AFE_PLL_CTRL (RTL8712_SYSCFG_ + 0x0028)
-#define EFUSE_CTRL (RTL8712_SYSCFG_ + 0x0030)
-#define EFUSE_TEST (RTL8712_SYSCFG_ + 0x0034)
-#define PWR_DATA (RTL8712_SYSCFG_ + 0x0038)
-#define DPS_TIMER (RTL8712_SYSCFG_ + 0x003C)
-#define RCLK_MON (RTL8712_SYSCFG_ + 0x003E)
-#define EFUSE_CLK_CTRL (RTL8712_SYSCFG_ + 0x02F8)
-
-#endif /*__RTL8712_SYSCFG_REGDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_timectrl_bitdef.h
+++ /dev/null
@@ -1,49 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_TIMECTRL_BITDEF_H__
-#define __RTL8712_TIMECTRL_BITDEF_H__
-
-/*TSFTR*/
-/*SLOT*/
-/*USTIME*/
-
-/*TUBASE*/
-#define _TUBASE_MSK 0x07FF
-
-/*SIFS_CCK*/
-#define _SIFS_CCK_TRX_MSK 0xFF00
-#define _SIFS_CCK_TRX_SHT 0x8
-#define _SIFS_CCK_CTX_MSK 0x00FF
-#define _SIFS_CCK_CTX_SHT 0
-
-/*SIFS_OFDM*/
-#define _SIFS_OFDM_TRX_MSK 0xFF00
-#define _SIFS_OFDM_TRX_SHT 0x8
-#define _SIFS_OFDM_CTX_MSK 0x00FF
-#define _SIFS_OFDM_CTX_SHT 0
-
-/*PIFS*/
-/*ACKTO*/
-/*EIFS*/
-/*BCNITV*/
-/*ATIMWND*/
-
-/*DRVERLYINT*/
-#define _ENSWBCN BIT(15)
-#define _DRVERLY_TU_MSK 0x0FF0
-#define _DRVERLY_TU_SHT 4
-#define _DRVERLY_US_MSK 0x000F
-#define _DRVERLY_US_SHT 0
-
-/*BCNDMATIM*/
-#define _BCNDMATIM_MSK 0x03FF
-
-/*BCNERRTH*/
-/*MLT*/
-
-#endif /* __RTL8712_TIMECTRL_BITDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_timectrl_regdef.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_TIMECTRL_REGDEF_H__
-#define __RTL8712_TIMECTRL_REGDEF_H__
-
-#define TSFTR (RTL8712_TIMECTRL_ + 0x00)
-#define USTIME (RTL8712_TIMECTRL_ + 0x08)
-#define SLOT (RTL8712_TIMECTRL_ + 0x09)
-#define TUBASE (RTL8712_TIMECTRL_ + 0x0A)
-#define SIFS_CCK (RTL8712_TIMECTRL_ + 0x0C)
-#define SIFS_OFDM (RTL8712_TIMECTRL_ + 0x0E)
-#define PIFS (RTL8712_TIMECTRL_ + 0x10)
-#define ACKTO (RTL8712_TIMECTRL_ + 0x11)
-#define EIFS (RTL8712_TIMECTRL_ + 0x12)
-#define BCNITV (RTL8712_TIMECTRL_ + 0x14)
-#define ATIMWND (RTL8712_TIMECTRL_ + 0x16)
-#define DRVERLYINT (RTL8712_TIMECTRL_ + 0x18)
-#define BCNDMATIM (RTL8712_TIMECTRL_ + 0x1A)
-#define BCNERRTH (RTL8712_TIMECTRL_ + 0x1C)
-#define MLT (RTL8712_TIMECTRL_ + 0x1D)
-
-#endif /* __RTL8712_TIMECTRL_REGDEF_H__ */
--- a/drivers/staging/rtl8712/rtl8712_wmac_bitdef.h
+++ /dev/null
@@ -1,49 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_WMAC_BITDEF_H__
-#define __RTL8712_WMAC_BITDEF_H__
-
-/*NAVCTRL*/
-#define _NAV_UPPER_EN BIT(18)
-#define _NAV_MTO_EN BIT(17)
-#define _NAV_UPPER BIT(16)
-#define _NAV_MTO_MSK 0xFF00
-#define _NAV_MTO_SHT 8
-#define _RTSRST_MSK 0x00FF
-#define _RTSRST_SHT 0
-
-/*BWOPMODE*/
-#define _20MHZBW BIT(2)
-
-/*BACAMCMD*/
-#define _BACAM_POLL BIT(31)
-#define _BACAM_RST BIT(17)
-#define _BACAM_RW BIT(16)
-#define _BACAM_ADDR_MSK 0x0000007F
-#define _BACAM_ADDR_SHT 0
-
-/*LBDLY*/
-#define _LBDLY_MSK 0x1F
-
-/*FWDLY*/
-#define _FWDLY_MSK 0x0F
-
-/*RXERR_RPT*/
-#define _RXERR_RPT_SEL_MSK 0xF0000000
-#define _RXERR_RPT_SEL_SHT 28
-#define _RPT_CNT_MSK 0x000FFFFF
-#define _RPT_CNT_SHT 0
-
-#endif /*__RTL8712_WMAC_BITDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_wmac_regdef.h
+++ /dev/null
@@ -1,36 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_WMAC_REGDEF_H__
-#define __RTL8712_WMAC_REGDEF_H__
-
-#define NAVCTRL (RTL8712_WMAC_ + 0x00)
-#define BWOPMODE (RTL8712_WMAC_ + 0x03)
-#define BACAMCMD (RTL8712_WMAC_ + 0x04)
-#define BACAMCONTENT (RTL8712_WMAC_ + 0x08)
-#define LBDLY (RTL8712_WMAC_ + 0x10)
-#define FWDLY (RTL8712_WMAC_ + 0x11)
-#define HWPC_RX_CTRL (RTL8712_WMAC_ + 0x18)
-#define MQ (RTL8712_WMAC_ + 0x20)
-#define MA (RTL8712_WMAC_ + 0x22)
-#define MS (RTL8712_WMAC_ + 0x24)
-#define CLM_RESULT (RTL8712_WMAC_ + 0x27)
-#define NHM_RPI_CNT (RTL8712_WMAC_ + 0x28)
-#define RXERR_RPT (RTL8712_WMAC_ + 0x30)
-#define NAV_PROT_LEN (RTL8712_WMAC_ + 0x34)
-#define CFEND_TH (RTL8712_WMAC_ + 0x36)
-#define AMPDU_MIN_SPACE (RTL8712_WMAC_ + 0x37)
-#define TXOP_STALL_CTRL (RTL8712_WMAC_ + 0x38)
-
-#endif /*__RTL8712_WMAC_REGDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_xmit.c
+++ /dev/null
@@ -1,745 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl8712_xmit.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL8712_XMIT_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "wifi.h"
-#include "osdep_intf.h"
-#include "usb_ops.h"
-
-static void dump_xframe(struct _adapter *padapter,
- struct xmit_frame *pxmitframe);
-static void update_txdesc(struct xmit_frame *pxmitframe, uint *pmem, int sz);
-
-sint _r8712_init_hw_txqueue(struct hw_txqueue *phw_txqueue, u8 ac_tag)
-{
- phw_txqueue->ac_tag = ac_tag;
- switch (ac_tag) {
- case BE_QUEUE_INX:
- phw_txqueue->ff_hwaddr = RTL8712_DMA_BEQ;
- break;
- case BK_QUEUE_INX:
- phw_txqueue->ff_hwaddr = RTL8712_DMA_BKQ;
- break;
- case VI_QUEUE_INX:
- phw_txqueue->ff_hwaddr = RTL8712_DMA_VIQ;
- break;
- case VO_QUEUE_INX:
- phw_txqueue->ff_hwaddr = RTL8712_DMA_VOQ;
- break;
- case BMC_QUEUE_INX:
- phw_txqueue->ff_hwaddr = RTL8712_DMA_BEQ;
- break;
- }
- return _SUCCESS;
-}
-
-int r8712_txframes_sta_ac_pending(struct _adapter *padapter,
- struct pkt_attrib *pattrib)
-{
- struct sta_info *psta;
- struct tx_servq *ptxservq;
- int priority = pattrib->priority;
-
- psta = pattrib->psta;
- switch (priority) {
- case 1:
- case 2:
- ptxservq = &psta->sta_xmitpriv.bk_q;
- break;
- case 4:
- case 5:
- ptxservq = &psta->sta_xmitpriv.vi_q;
- break;
- case 6:
- case 7:
- ptxservq = &psta->sta_xmitpriv.vo_q;
- break;
- case 0:
- case 3:
- default:
- ptxservq = &psta->sta_xmitpriv.be_q;
- break;
- }
- return ptxservq->qcnt;
-}
-
-static u32 get_ff_hwaddr(struct xmit_frame *pxmitframe)
-{
- u32 addr = 0;
- struct pkt_attrib *pattrib = &pxmitframe->attrib;
- struct _adapter *padapter = pxmitframe->padapter;
- struct dvobj_priv *pdvobj = &padapter->dvobjpriv;
-
- if (pxmitframe->frame_tag == TXAGG_FRAMETAG) {
- addr = RTL8712_DMA_H2CCMD;
- } else if (pxmitframe->frame_tag == MGNT_FRAMETAG) {
- addr = RTL8712_DMA_MGTQ;
- } else if (pdvobj->nr_endpoint == 6) {
- switch (pattrib->priority) {
- case 0:
- case 3:
- addr = RTL8712_DMA_BEQ;
- break;
- case 1:
- case 2:
- addr = RTL8712_DMA_BKQ;
- break;
- case 4:
- case 5:
- addr = RTL8712_DMA_VIQ;
- break;
- case 6:
- case 7:
- addr = RTL8712_DMA_VOQ;
- break;
- case 0x10:
- case 0x11:
- case 0x12:
- case 0x13:
- addr = RTL8712_DMA_H2CCMD;
- break;
- default:
- addr = RTL8712_DMA_BEQ;
- break;
- }
- } else if (pdvobj->nr_endpoint == 4) {
- switch (pattrib->qsel) {
- case 0:
- case 3:
- case 1:
- case 2:
- addr = RTL8712_DMA_BEQ;/*RTL8712_EP_LO;*/
- break;
- case 4:
- case 5:
- case 6:
- case 7:
- addr = RTL8712_DMA_VOQ;/*RTL8712_EP_HI;*/
- break;
- case 0x10:
- case 0x11:
- case 0x12:
- case 0x13:
- addr = RTL8712_DMA_H2CCMD;
- break;
- default:
- addr = RTL8712_DMA_BEQ;/*RTL8712_EP_LO;*/
- break;
- }
- }
- return addr;
-}
-
-static struct xmit_frame *dequeue_one_xmitframe(struct xmit_priv *pxmitpriv,
- struct hw_xmit *phwxmit,
- struct tx_servq *ptxservq,
- struct __queue *pframe_queue)
-{
- struct list_head *xmitframe_plist, *xmitframe_phead;
- struct xmit_frame *pxmitframe = NULL;
-
- xmitframe_phead = &pframe_queue->queue;
- xmitframe_plist = xmitframe_phead->next;
- if (!end_of_queue_search(xmitframe_phead, xmitframe_plist)) {
- pxmitframe = container_of(xmitframe_plist,
- struct xmit_frame, list);
- list_del_init(&pxmitframe->list);
- ptxservq->qcnt--;
- phwxmit->txcmdcnt++;
- }
- return pxmitframe;
-}
-
-static struct xmit_frame *dequeue_xframe_ex(struct xmit_priv *pxmitpriv,
- struct hw_xmit *phwxmit_i, sint entry)
-{
- unsigned long irqL0;
- struct list_head *sta_plist, *sta_phead;
- struct hw_xmit *phwxmit;
- struct tx_servq *ptxservq = NULL;
- struct __queue *pframe_queue = NULL;
- struct xmit_frame *pxmitframe = NULL;
- int i, inx[4];
- int j, acirp_cnt[4];
-
- /*entry indx: 0->vo, 1->vi, 2->be, 3->bk.*/
- inx[0] = 0; acirp_cnt[0] = pxmitpriv->voq_cnt;
- inx[1] = 1; acirp_cnt[1] = pxmitpriv->viq_cnt;
- inx[2] = 2; acirp_cnt[2] = pxmitpriv->beq_cnt;
- inx[3] = 3; acirp_cnt[3] = pxmitpriv->bkq_cnt;
- for (i = 0; i < 4; i++) {
- for (j = i + 1; j < 4; j++) {
- if (acirp_cnt[j] < acirp_cnt[i]) {
- swap(acirp_cnt[i], acirp_cnt[j]);
- swap(inx[i], inx[j]);
- }
- }
- }
- spin_lock_irqsave(&pxmitpriv->lock, irqL0);
- for (i = 0; i < entry; i++) {
- phwxmit = phwxmit_i + inx[i];
- sta_phead = &phwxmit->sta_queue->queue;
- sta_plist = sta_phead->next;
- while (!end_of_queue_search(sta_phead, sta_plist)) {
- ptxservq = container_of(sta_plist, struct tx_servq,
- tx_pending);
- pframe_queue = &ptxservq->sta_pending;
- pxmitframe = dequeue_one_xmitframe(pxmitpriv, phwxmit,
- ptxservq, pframe_queue);
- if (pxmitframe) {
- phwxmit->accnt--;
- goto exit_dequeue_xframe_ex;
- }
- sta_plist = sta_plist->next;
- /*Remove sta node when there are no pending packets.*/
- if (list_empty(&pframe_queue->queue)) {
- /* must be done after sta_plist->next
- * and before break
- */
- list_del_init(&ptxservq->tx_pending);
- }
- }
- }
-exit_dequeue_xframe_ex:
- spin_unlock_irqrestore(&pxmitpriv->lock, irqL0);
- return pxmitframe;
-}
-
-void r8712_do_queue_select(struct _adapter *padapter,
- struct pkt_attrib *pattrib)
-{
- unsigned int qsel = 0;
- struct dvobj_priv *pdvobj = &padapter->dvobjpriv;
-
- if (pdvobj->nr_endpoint == 6) {
- qsel = (unsigned int)pattrib->priority;
- } else if (pdvobj->nr_endpoint == 4) {
- qsel = (unsigned int)pattrib->priority;
- if (qsel == 0 || qsel == 3)
- qsel = 3;
- else if (qsel == 1 || qsel == 2)
- qsel = 1;
- else if (qsel == 4 || qsel == 5)
- qsel = 5;
- else if (qsel == 6 || qsel == 7)
- qsel = 7;
- else
- qsel = 3;
- }
- pattrib->qsel = qsel;
-}
-
-#ifdef CONFIG_R8712_TX_AGGR
-void r8712_construct_txaggr_cmd_desc(struct xmit_buf *pxmitbuf)
-{
- struct tx_desc *ptx_desc = (struct tx_desc *)pxmitbuf->pbuf;
-
- /* Fill up TxCmd Descriptor according as USB FW Tx Aaggregation info.*/
- /* dw0 */
- ptx_desc->txdw0 = cpu_to_le32(CMD_HDR_SZ & 0xffff);
- ptx_desc->txdw0 |=
- cpu_to_le32(((TXDESC_SIZE + OFFSET_SZ) << OFFSET_SHT) &
- 0x00ff0000);
- ptx_desc->txdw0 |= cpu_to_le32(OWN | FSG | LSG);
-
- /* dw1 */
- ptx_desc->txdw1 |= cpu_to_le32((0x13 << QSEL_SHT) & 0x00001f00);
-}
-
-void r8712_construct_txaggr_cmd_hdr(struct xmit_buf *pxmitbuf)
-{
- struct xmit_frame *pxmitframe = (struct xmit_frame *)
- pxmitbuf->priv_data;
- struct _adapter *padapter = pxmitframe->padapter;
- struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
- struct cmd_hdr *pcmd_hdr = (struct cmd_hdr *)
- (pxmitbuf->pbuf + TXDESC_SIZE);
-
- /* Fill up Cmd Header for USB FW Tx Aggregation.*/
- /* dw0 */
- pcmd_hdr->cmd_dw0 = cpu_to_le32((GEN_CMD_CODE(_AMSDU_TO_AMPDU) << 16) |
- (pcmdpriv->cmd_seq << 24));
- pcmdpriv->cmd_seq++;
-}
-
-void r8712_append_mpdu_unit(struct xmit_buf *pxmitbuf,
- struct xmit_frame *pxmitframe)
-{
- struct _adapter *padapter = pxmitframe->padapter;
- struct tx_desc *ptx_desc = (struct tx_desc *)pxmitbuf->pbuf;
- int last_txcmdsz = 0;
- int padding_sz = 0;
-
- /* 802.3->802.11 converter */
- r8712_xmitframe_coalesce(padapter, pxmitframe->pkt, pxmitframe);
- /* free skb struct */
- r8712_xmit_complete(padapter, pxmitframe);
- if (pxmitframe->attrib.ether_type != 0x0806) {
- if ((pxmitframe->attrib.ether_type != 0x888e) &&
- (pxmitframe->attrib.dhcp_pkt != 1)) {
- r8712_issue_addbareq_cmd(padapter,
- pxmitframe->attrib.priority);
- }
- }
- pxmitframe->last[0] = 1;
- update_txdesc(pxmitframe, (uint *)(pxmitframe->buf_addr),
- pxmitframe->attrib.last_txcmdsz);
- /*padding zero */
- last_txcmdsz = pxmitframe->attrib.last_txcmdsz;
- padding_sz = (8 - (last_txcmdsz % 8));
- if ((last_txcmdsz % 8) != 0) {
- int i;
-
- for (i = 0; i < padding_sz; i++)
- *(pxmitframe->buf_addr + TXDESC_SIZE + last_txcmdsz +
- i) = 0;
- }
- /* Add the new mpdu's length */
- ptx_desc->txdw0 = cpu_to_le32((ptx_desc->txdw0 & 0xffff0000) |
- ((ptx_desc->txdw0 & 0x0000ffff) +
- ((TXDESC_SIZE + last_txcmdsz + padding_sz) &
- 0x0000ffff)));
-}
-
-void r8712_xmitframe_aggr_1st(struct xmit_buf *pxmitbuf,
- struct xmit_frame *pxmitframe)
-{
- /* linux complete context doesn't need to protect */
- pxmitframe->pxmitbuf = pxmitbuf;
- pxmitbuf->priv_data = pxmitframe;
- pxmitframe->pxmit_urb[0] = pxmitbuf->pxmit_urb[0];
- /* buffer addr assoc */
- pxmitframe->buf_addr = pxmitbuf->pbuf + TXDESC_SIZE + CMD_HDR_SZ;
- /*RTL8712_DMA_H2CCMD */
- r8712_construct_txaggr_cmd_desc(pxmitbuf);
- r8712_construct_txaggr_cmd_hdr(pxmitbuf);
- r8712_append_mpdu_unit(pxmitbuf, pxmitframe);
- pxmitbuf->aggr_nr = 1;
-}
-
-u16 r8712_xmitframe_aggr_next(struct xmit_buf *pxmitbuf,
- struct xmit_frame *pxmitframe)
-{
- pxmitframe->pxmitbuf = pxmitbuf;
- pxmitbuf->priv_data = pxmitframe;
- pxmitframe->pxmit_urb[0] = pxmitbuf->pxmit_urb[0];
- /* buffer addr assoc */
- pxmitframe->buf_addr = pxmitbuf->pbuf + TXDESC_SIZE +
- (((struct tx_desc *)pxmitbuf->pbuf)->txdw0 & 0x0000ffff);
- r8712_append_mpdu_unit(pxmitbuf, pxmitframe);
- r8712_free_xmitframe_ex(&pxmitframe->padapter->xmitpriv,
- pxmitframe);
- pxmitbuf->aggr_nr++;
-
- return TXDESC_SIZE +
- (((struct tx_desc *)pxmitbuf->pbuf)->txdw0 & 0x0000ffff);
-}
-
-void r8712_dump_aggr_xframe(struct xmit_buf *pxmitbuf,
- struct xmit_frame *pxmitframe)
-{
- struct _adapter *padapter = pxmitframe->padapter;
- struct dvobj_priv *pdvobj = &padapter->dvobjpriv;
- struct tx_desc *ptxdesc = pxmitbuf->pbuf;
- struct cmd_hdr *pcmd_hdr = (struct cmd_hdr *)
- (pxmitbuf->pbuf + TXDESC_SIZE);
- u16 total_length = (u16)(ptxdesc->txdw0 & 0xffff);
-
- /* use 1st xmitframe as media */
- xmitframe_xmitbuf_attach(pxmitframe, pxmitbuf);
- pcmd_hdr->cmd_dw0 = cpu_to_le32(((total_length - CMD_HDR_SZ) &
- 0x0000ffff) | (pcmd_hdr->cmd_dw0 &
- 0xffff0000));
-
- /* urb length in cmd_dw1 */
- pcmd_hdr->cmd_dw1 = cpu_to_le32((pxmitbuf->aggr_nr & 0xff) |
- ((total_length + TXDESC_SIZE) << 16));
- pxmitframe->last[0] = 1;
- pxmitframe->bpending[0] = false;
- pxmitframe->mem_addr = pxmitbuf->pbuf;
-
- if ((pdvobj->ishighspeed && ((total_length + TXDESC_SIZE) % 0x200) ==
- 0) || ((!pdvobj->ishighspeed && ((total_length + TXDESC_SIZE) %
- 0x40) == 0))) {
- ptxdesc->txdw0 |= cpu_to_le32
- (((TXDESC_SIZE + OFFSET_SZ + 8) << OFFSET_SHT) &
- 0x00ff0000);
- /*32 bytes for TX Desc + 8 bytes pending*/
- } else {
- ptxdesc->txdw0 |= cpu_to_le32
- (((TXDESC_SIZE + OFFSET_SZ) << OFFSET_SHT) &
- 0x00ff0000);
- /*default = 32 bytes for TX Desc*/
- }
- r8712_write_port(pxmitframe->padapter, RTL8712_DMA_H2CCMD,
- total_length + TXDESC_SIZE, (u8 *)pxmitframe);
-}
-
-#endif
-
-static void update_txdesc(struct xmit_frame *pxmitframe, uint *pmem, int sz)
-{
- uint qsel;
- struct _adapter *padapter = pxmitframe->padapter;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct qos_priv *pqospriv = &pmlmepriv->qospriv;
- struct security_priv *psecuritypriv = &padapter->securitypriv;
- struct pkt_attrib *pattrib = &pxmitframe->attrib;
- struct tx_desc *ptxdesc = (struct tx_desc *)pmem;
- struct dvobj_priv *pdvobj = &padapter->dvobjpriv;
-#ifdef CONFIG_R8712_TX_AGGR
- struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
-#endif
- u8 blnSetTxDescOffset;
- bool bmcst = is_multicast_ether_addr(pattrib->ra);
- struct ht_priv *phtpriv = &pmlmepriv->htpriv;
- struct tx_desc txdesc_mp;
-
- memcpy(&txdesc_mp, ptxdesc, sizeof(struct tx_desc));
- memset(ptxdesc, 0, sizeof(struct tx_desc));
- /* offset 0 */
- ptxdesc->txdw0 |= cpu_to_le32(sz & 0x0000ffff);
- if (pdvobj->ishighspeed) {
- if (((sz + TXDESC_SIZE) % 512) == 0)
- blnSetTxDescOffset = 1;
- else
- blnSetTxDescOffset = 0;
- } else {
- if (((sz + TXDESC_SIZE) % 64) == 0)
- blnSetTxDescOffset = 1;
- else
- blnSetTxDescOffset = 0;
- }
- if (blnSetTxDescOffset) {
- /* 32 bytes for TX Desc + 8 bytes pending */
- ptxdesc->txdw0 |= cpu_to_le32(((TXDESC_SIZE + OFFSET_SZ + 8) <<
- OFFSET_SHT) & 0x00ff0000);
- } else {
- /* default = 32 bytes for TX Desc */
- ptxdesc->txdw0 |= cpu_to_le32(((TXDESC_SIZE + OFFSET_SZ) <<
- OFFSET_SHT) & 0x00ff0000);
- }
- ptxdesc->txdw0 |= cpu_to_le32(OWN | FSG | LSG);
- if (pxmitframe->frame_tag == DATA_FRAMETAG) {
- /* offset 4 */
- ptxdesc->txdw1 |= cpu_to_le32((pattrib->mac_id) & 0x1f);
-
-#ifdef CONFIG_R8712_TX_AGGR
- /* dirty workaround, need to check if it is aggr cmd. */
- if ((u8 *)pmem != (u8 *)pxmitframe->pxmitbuf->pbuf) {
- ptxdesc->txdw0 |= cpu_to_le32
- ((0x3 << TYPE_SHT) & TYPE_MSK);
- qsel = (uint)(pattrib->qsel & 0x0000001f);
- if (qsel == 2)
- qsel = 0;
- ptxdesc->txdw1 |= cpu_to_le32
- ((qsel << QSEL_SHT) & 0x00001f00);
- ptxdesc->txdw2 = cpu_to_le32
- ((qsel << RTS_RC_SHT) & 0x001f0000);
- ptxdesc->txdw6 |= cpu_to_le32
- ((0x5 << RSVD6_SHT) & RSVD6_MSK);
- } else {
- ptxdesc->txdw0 |= cpu_to_le32
- ((0x3 << TYPE_SHT) & TYPE_MSK);
- ptxdesc->txdw1 |= cpu_to_le32
- ((0x13 << QSEL_SHT) & 0x00001f00);
- qsel = (uint)(pattrib->qsel & 0x0000001f);
- if (qsel == 2)
- qsel = 0;
- ptxdesc->txdw2 = cpu_to_le32
- ((qsel << RTS_RC_SHT) & 0x0001f000);
- ptxdesc->txdw7 |= cpu_to_le32
- (pcmdpriv->cmd_seq << 24);
- pcmdpriv->cmd_seq++;
- }
- pattrib->qsel = 0x13;
-#else
- qsel = (uint)(pattrib->qsel & 0x0000001f);
- ptxdesc->txdw1 |= cpu_to_le32((qsel << QSEL_SHT) & 0x00001f00);
-#endif
- if (!pqospriv->qos_option)
- ptxdesc->txdw1 |= cpu_to_le32(BIT(16));/*Non-QoS*/
- if ((pattrib->encrypt > 0) && !pattrib->bswenc) {
- switch (pattrib->encrypt) { /*SEC_TYPE*/
- case _WEP40_:
- case _WEP104_:
- ptxdesc->txdw1 |= cpu_to_le32((0x01 << 22) &
- 0x00c00000);
- /*KEY_ID when WEP is used;*/
- ptxdesc->txdw1 |=
- cpu_to_le32((psecuritypriv->PrivacyKeyIndex << 17) &
- 0x00060000);
- break;
- case _TKIP_:
- case _TKIP_WTMIC_:
- ptxdesc->txdw1 |= cpu_to_le32((0x02 << 22) &
- 0x00c00000);
- break;
- case _AES_:
- ptxdesc->txdw1 |= cpu_to_le32((0x03 << 22) &
- 0x00c00000);
- break;
- case _NO_PRIVACY_:
- default:
- break;
- }
- }
- /*offset 8*/
- if (bmcst)
- ptxdesc->txdw2 |= cpu_to_le32(BMC);
-
- /*offset 12*/
- /* f/w will increase the seqnum by itself, driver pass the
- * correct priority to fw.
- * fw will check the correct priority for increasing the
- * seqnum per tid. about usb using 4-endpoint, qsel points out
- * the correct mapping between AC&Endpoint,
- * the purpose is that correct mapping lets the MAC release
- * the AC Queue list correctly.
- */
- ptxdesc->txdw3 = cpu_to_le32((pattrib->priority << SEQ_SHT) &
- 0x0fff0000);
- if ((pattrib->ether_type != 0x888e) &&
- (pattrib->ether_type != 0x0806) &&
- (pattrib->dhcp_pkt != 1)) {
- /*Not EAP & ARP type data packet*/
- if (phtpriv->ht_option == 1) { /*B/G/N Mode*/
- if (!phtpriv->ampdu_enable)
- ptxdesc->txdw2 |= cpu_to_le32(BK);
- }
- } else {
- /* EAP data packet and ARP packet.
- * Use the 1M data rate to send the EAP/ARP packet.
- * This will maybe make the handshake smooth.
- */
- /*driver uses data rate*/
- ptxdesc->txdw4 = cpu_to_le32(0x80000000);
- ptxdesc->txdw5 = cpu_to_le32(0x001f8000);/*1M*/
- }
- if (pattrib->pctrl == 1) { /* mp tx packets */
- struct tx_desc *ptxdesc_mp;
-
- ptxdesc_mp = &txdesc_mp;
- /* offset 8 */
- ptxdesc->txdw2 = ptxdesc_mp->txdw2;
- if (bmcst)
- ptxdesc->txdw2 |= cpu_to_le32(BMC);
- ptxdesc->txdw2 |= cpu_to_le32(BK);
- /* offset 16 */
- ptxdesc->txdw4 = ptxdesc_mp->txdw4;
- /* offset 20 */
- ptxdesc->txdw5 = ptxdesc_mp->txdw5;
- pattrib->pctrl = 0;/* reset to zero; */
- }
- } else if (pxmitframe->frame_tag == MGNT_FRAMETAG) {
- /* offset 4 */
- /* CAM_ID(MAC_ID), default=5; */
- ptxdesc->txdw1 |= cpu_to_le32((0x05) & 0x1f);
- qsel = (uint)(pattrib->qsel & 0x0000001f);
- ptxdesc->txdw1 |= cpu_to_le32((qsel << QSEL_SHT) & 0x00001f00);
- ptxdesc->txdw1 |= cpu_to_le32(BIT(16));/* Non-QoS */
- /* offset 8 */
- if (bmcst)
- ptxdesc->txdw2 |= cpu_to_le32(BMC);
- /* offset 12 */
- /* f/w will increase the seqnum by itself, driver pass the
- * correct priority to fw.
- * fw will check the correct priority for increasing the seqnum
- * per tid. about usb using 4-endpoint, qsel points out the
- * correct mapping between AC&Endpoint,
- * the purpose is that correct mapping let the MAC releases
- * the AC Queue list correctly.
- */
- ptxdesc->txdw3 = cpu_to_le32((pattrib->priority << SEQ_SHT) &
- 0x0fff0000);
- /* offset 16 */
- ptxdesc->txdw4 = cpu_to_le32(0x80002040);/*gtest*/
- /* offset 20 */
- ptxdesc->txdw5 = cpu_to_le32(0x001f8000);/* gtest 1M */
- } else if (pxmitframe->frame_tag == TXAGG_FRAMETAG) {
- /* offset 4 */
- qsel = 0x13;
- ptxdesc->txdw1 |= cpu_to_le32((qsel << QSEL_SHT) & 0x00001f00);
- } else {
- /* offset 4 */
- qsel = (uint)(pattrib->priority & 0x0000001f);
- ptxdesc->txdw1 |= cpu_to_le32((qsel << QSEL_SHT) & 0x00001f00);
- /*offset 8*/
- /*offset 12*/
- ptxdesc->txdw3 = cpu_to_le32((pattrib->seqnum << SEQ_SHT) &
- 0x0fff0000);
- /*offset 16*/
- ptxdesc->txdw4 = cpu_to_le32(0x80002040);/*gtest*/
- /*offset 20*/
- ptxdesc->txdw5 = cpu_to_le32(0x001f9600);/*gtest*/
- }
-}
-
-int r8712_xmitframe_complete(struct _adapter *padapter,
- struct xmit_priv *pxmitpriv,
- struct xmit_buf *pxmitbuf)
-{
- struct hw_xmit *phwxmits;
- sint hwentry;
- struct xmit_frame *pxmitframe = NULL;
-#ifdef CONFIG_R8712_TX_AGGR
- struct xmit_frame *p2ndxmitframe = NULL;
-#else
- int res = _SUCCESS, xcnt = 0;
-#endif
-
- phwxmits = pxmitpriv->hwxmits;
- hwentry = pxmitpriv->hwxmit_entry;
- if (!pxmitbuf) {
- pxmitbuf = r8712_alloc_xmitbuf(pxmitpriv);
- if (!pxmitbuf)
- return false;
-#ifdef CONFIG_R8712_TX_AGGR
- pxmitbuf->aggr_nr = 0;
-#endif
- }
- /* 1st frame dequeued */
- pxmitframe = dequeue_xframe_ex(pxmitpriv, phwxmits, hwentry);
- /* need to remember the 1st frame */
- if (pxmitframe) {
-
-#ifdef CONFIG_R8712_TX_AGGR
- /* 1. dequeue 2nd frame
- * 2. aggr if 2nd xframe is dequeued, else dump directly
- */
- if (AGGR_NR_HIGH_BOUND > 1)
- p2ndxmitframe = dequeue_xframe_ex(pxmitpriv, phwxmits,
- hwentry);
- if (pxmitframe->frame_tag != DATA_FRAMETAG) {
- r8712_free_xmitbuf(pxmitpriv, pxmitbuf);
- return false;
- }
- if (p2ndxmitframe)
- if (p2ndxmitframe->frame_tag != DATA_FRAMETAG) {
- r8712_free_xmitbuf(pxmitpriv, pxmitbuf);
- return false;
- }
- r8712_xmitframe_aggr_1st(pxmitbuf, pxmitframe);
- if (p2ndxmitframe) {
- u16 total_length;
-
- total_length = r8712_xmitframe_aggr_next(
- pxmitbuf, p2ndxmitframe);
- do {
- p2ndxmitframe = dequeue_xframe_ex(
- pxmitpriv, phwxmits, hwentry);
- if (p2ndxmitframe)
- total_length =
- r8712_xmitframe_aggr_next(
- pxmitbuf,
- p2ndxmitframe);
- else
- break;
- } while (total_length <= 0x1800 &&
- pxmitbuf->aggr_nr <= AGGR_NR_HIGH_BOUND);
- }
- if (pxmitbuf->aggr_nr > 0)
- r8712_dump_aggr_xframe(pxmitbuf, pxmitframe);
-
-#else
-
- xmitframe_xmitbuf_attach(pxmitframe, pxmitbuf);
- if (pxmitframe->frame_tag == DATA_FRAMETAG) {
- if (pxmitframe->attrib.priority <= 15)
- res = r8712_xmitframe_coalesce(padapter,
- pxmitframe->pkt, pxmitframe);
- /* always return ndis_packet after
- * r8712_xmitframe_coalesce
- */
- r8712_xmit_complete(padapter, pxmitframe);
- }
- if (res == _SUCCESS)
- dump_xframe(padapter, pxmitframe);
- else
- r8712_free_xmitframe_ex(pxmitpriv, pxmitframe);
- xcnt++;
-#endif
-
- } else { /* pxmitframe == NULL && p2ndxmitframe == NULL */
- r8712_free_xmitbuf(pxmitpriv, pxmitbuf);
- return false;
- }
- return true;
-}
-
-static void dump_xframe(struct _adapter *padapter,
- struct xmit_frame *pxmitframe)
-{
- int t, sz, w_sz;
- u8 *mem_addr;
- u32 ff_hwaddr;
- struct pkt_attrib *pattrib = &pxmitframe->attrib;
- struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
- struct security_priv *psecuritypriv = &padapter->securitypriv;
-
- if (pxmitframe->attrib.ether_type != 0x0806) {
- if (pxmitframe->attrib.ether_type != 0x888e)
- r8712_issue_addbareq_cmd(padapter, pattrib->priority);
- }
- mem_addr = pxmitframe->buf_addr;
- for (t = 0; t < pattrib->nr_frags; t++) {
- if (t != (pattrib->nr_frags - 1)) {
- sz = pxmitpriv->frag_len;
- sz = sz - 4 - (psecuritypriv->sw_encrypt ? 0 :
- pattrib->icv_len);
- pxmitframe->last[t] = 0;
- } else {
- sz = pattrib->last_txcmdsz;
- pxmitframe->last[t] = 1;
- }
- update_txdesc(pxmitframe, (uint *)mem_addr, sz);
- w_sz = sz + TXDESC_SIZE;
- pxmitframe->mem_addr = mem_addr;
- pxmitframe->bpending[t] = false;
- ff_hwaddr = get_ff_hwaddr(pxmitframe);
-#ifdef CONFIG_R8712_TX_AGGR
- r8712_write_port(padapter, RTL8712_DMA_H2CCMD, w_sz,
- (unsigned char *)pxmitframe);
-#else
- r8712_write_port(padapter, ff_hwaddr, w_sz,
- (unsigned char *)pxmitframe);
-#endif
- mem_addr += w_sz;
- mem_addr = (u8 *)RND4(((addr_t)(mem_addr)));
- }
-}
-
-void r8712_xmit_direct(struct _adapter *padapter, struct xmit_frame *pxmitframe)
-{
- int res;
-
- res = r8712_xmitframe_coalesce(padapter, pxmitframe->pkt, pxmitframe);
- pxmitframe->pkt = NULL;
- if (res == _SUCCESS)
- dump_xframe(padapter, pxmitframe);
-}
-
-int r8712_xmit_enqueue(struct _adapter *padapter, struct xmit_frame *pxmitframe)
-{
- if (r8712_xmit_classifier(padapter, pxmitframe)) {
- pxmitframe->pkt = NULL;
- return _FAIL;
- }
- return _SUCCESS;
-}
--- a/drivers/staging/rtl8712/rtl8712_xmit.h
+++ /dev/null
@@ -1,108 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _RTL8712_XMIT_H_
-#define _RTL8712_XMIT_H_
-
-#define HWXMIT_ENTRY 4
-
-#define VO_QUEUE_INX 0
-#define VI_QUEUE_INX 1
-#define BE_QUEUE_INX 2
-#define BK_QUEUE_INX 3
-#define TS_QUEUE_INX 4
-#define MGT_QUEUE_INX 5
-#define BMC_QUEUE_INX 6
-#define BCN_QUEUE_INX 7
-
-#define HW_QUEUE_ENTRY 8
-
-#define TXDESC_SIZE 32
-#define TXDESC_OFFSET TXDESC_SIZE
-
-#define NR_AMSDU_XMITFRAME 8
-#define NR_TXAGG_XMITFRAME 8
-
-#define MAX_AMSDU_XMITBUF_SZ 8704
-#define MAX_TXAGG_XMITBUF_SZ 16384 /*16k*/
-
-#define tx_cmd tx_desc
-
-/*
- *defined for TX DESC Operation
- */
-
-#define MAX_TID (15)
-
-/*OFFSET 0*/
-#define OFFSET_SZ (0)
-#define OFFSET_SHT (16)
-#define OWN BIT(31)
-#define FSG BIT(27)
-#define LSG BIT(26)
-#define TYPE_SHT (24)
-#define TYPE_MSK (0x03000000)
-
-/*OFFSET 4*/
-#define PKT_OFFSET_SZ (0)
-#define QSEL_SHT (8)
-#define HWPC BIT(31)
-
-/*OFFSET 8*/
-#define BMC BIT(7)
-#define BK BIT(30)
-#define AGG_EN BIT(29)
-#define RTS_RC_SHT (16)
-
-/*OFFSET 12*/
-#define SEQ_SHT (16)
-
-/*OFFSET 16*/
-#define TXBW BIT(18)
-
-/*OFFSET 20*/
-#define DISFB BIT(15)
-#define RSVD6_MSK (0x00E00000)
-#define RSVD6_SHT (21)
-
-struct tx_desc {
- /*DWORD 0*/
- __le32 txdw0;
- __le32 txdw1;
- __le32 txdw2;
- __le32 txdw3;
- __le32 txdw4;
- __le32 txdw5;
- __le32 txdw6;
- __le32 txdw7;
-};
-
-union txdesc {
- struct tx_desc txdesc;
- unsigned int value[TXDESC_SIZE >> 2];
-};
-
-int r8712_xmitframe_complete(struct _adapter *padapter,
- struct xmit_priv *pxmitpriv,
- struct xmit_buf *pxmitbuf);
-void r8712_do_queue_select(struct _adapter *padapter,
- struct pkt_attrib *pattrib);
-
-#ifdef CONFIG_R8712_TX_AGGR
-void r8712_xmitframe_aggr_1st(struct xmit_buf *pxmitbuf,
- struct xmit_frame *pxmitframe);
-void r8712_dump_aggr_xframe(struct xmit_buf *pxmitbuf,
- struct xmit_frame *pxmitframe);
-#endif
-
-#endif
--- a/drivers/staging/rtl8712/rtl871x_cmd.c
+++ /dev/null
@@ -1,796 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_cmd.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL871X_CMD_C_
-
-#include <linux/compiler.h>
-#include <linux/kernel.h>
-#include <linux/errno.h>
-#include <linux/slab.h>
-#include <linux/module.h>
-#include <linux/kref.h>
-#include <linux/netdevice.h>
-#include <linux/skbuff.h>
-#include <linux/usb.h>
-#include <linux/usb/ch9.h>
-#include <linux/circ_buf.h>
-#include <linux/uaccess.h>
-#include <asm/byteorder.h>
-#include <linux/atomic.h>
-#include <linux/semaphore.h>
-#include <linux/rtnetlink.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "recv_osdep.h"
-#include "mlme_osdep.h"
-
-/*
- * Caller and the r8712_cmd_thread can protect cmd_q by spin_lock.
- * No irqsave is necessary.
- */
-
-int r8712_init_cmd_priv(struct cmd_priv *pcmdpriv)
-{
- init_completion(&pcmdpriv->cmd_queue_comp);
- init_completion(&pcmdpriv->terminate_cmdthread_comp);
-
- _init_queue(&(pcmdpriv->cmd_queue));
-
- /* allocate DMA-able/Non-Page memory for cmd_buf and rsp_buf */
- pcmdpriv->cmd_seq = 1;
- pcmdpriv->cmd_allocated_buf = kmalloc(MAX_CMDSZ + CMDBUFF_ALIGN_SZ,
- GFP_ATOMIC);
- if (!pcmdpriv->cmd_allocated_buf)
- return -ENOMEM;
- pcmdpriv->cmd_buf = pcmdpriv->cmd_allocated_buf + CMDBUFF_ALIGN_SZ -
- ((addr_t)(pcmdpriv->cmd_allocated_buf) &
- (CMDBUFF_ALIGN_SZ - 1));
- pcmdpriv->rsp_allocated_buf = kmalloc(MAX_RSPSZ + 4, GFP_ATOMIC);
- if (!pcmdpriv->rsp_allocated_buf) {
- kfree(pcmdpriv->cmd_allocated_buf);
- pcmdpriv->cmd_allocated_buf = NULL;
- return -ENOMEM;
- }
- pcmdpriv->rsp_buf = pcmdpriv->rsp_allocated_buf + 4 -
- ((addr_t)(pcmdpriv->rsp_allocated_buf) & 3);
- pcmdpriv->cmd_issued_cnt = 0;
- pcmdpriv->cmd_done_cnt = 0;
- pcmdpriv->rsp_cnt = 0;
- return 0;
-}
-
-int r8712_init_evt_priv(struct evt_priv *pevtpriv)
-{
- /* allocate DMA-able/Non-Page memory for cmd_buf and rsp_buf */
- pevtpriv->event_seq = 0;
- pevtpriv->evt_allocated_buf = kmalloc(MAX_EVTSZ + 4, GFP_ATOMIC);
-
- if (!pevtpriv->evt_allocated_buf)
- return -ENOMEM;
- pevtpriv->evt_buf = pevtpriv->evt_allocated_buf + 4 -
- ((addr_t)(pevtpriv->evt_allocated_buf) & 3);
- pevtpriv->evt_done_cnt = 0;
- return 0;
-}
-
-void r8712_free_evt_priv(struct evt_priv *pevtpriv)
-{
- kfree(pevtpriv->evt_allocated_buf);
-}
-
-void r8712_free_cmd_priv(struct cmd_priv *pcmdpriv)
-{
- if (pcmdpriv) {
- kfree(pcmdpriv->cmd_allocated_buf);
- kfree(pcmdpriv->rsp_allocated_buf);
- }
-}
-
-/*
- * Calling Context:
- *
- * r8712_enqueue_cmd can only be called between kernel thread,
- * since only spin_lock is used.
- *
- * ISR/Call-Back functions can't call this sub-function.
- *
- */
-
-void r8712_enqueue_cmd(struct cmd_priv *pcmdpriv, struct cmd_obj *obj)
-{
- struct __queue *queue;
- unsigned long irqL;
-
- if (pcmdpriv->padapter->eeprompriv.bautoload_fail_flag)
- return;
- if (!obj)
- return;
- queue = &pcmdpriv->cmd_queue;
- spin_lock_irqsave(&queue->lock, irqL);
- list_add_tail(&obj->list, &queue->queue);
- spin_unlock_irqrestore(&queue->lock, irqL);
- complete(&pcmdpriv->cmd_queue_comp);
-}
-
-struct cmd_obj *r8712_dequeue_cmd(struct __queue *queue)
-{
- unsigned long irqL;
- struct cmd_obj *obj;
-
- spin_lock_irqsave(&queue->lock, irqL);
- obj = list_first_entry_or_null(&queue->queue,
- struct cmd_obj, list);
- if (obj)
- list_del_init(&obj->list);
- spin_unlock_irqrestore(&queue->lock, irqL);
- return obj;
-}
-
-void r8712_enqueue_cmd_ex(struct cmd_priv *pcmdpriv, struct cmd_obj *obj)
-{
- unsigned long irqL;
- struct __queue *queue;
-
- if (!obj)
- return;
- if (pcmdpriv->padapter->eeprompriv.bautoload_fail_flag)
- return;
- queue = &pcmdpriv->cmd_queue;
- spin_lock_irqsave(&queue->lock, irqL);
- list_add_tail(&obj->list, &queue->queue);
- spin_unlock_irqrestore(&queue->lock, irqL);
- complete(&pcmdpriv->cmd_queue_comp);
-}
-
-void r8712_free_cmd_obj(struct cmd_obj *pcmd)
-{
- if ((pcmd->cmdcode != _JoinBss_CMD_) &&
- (pcmd->cmdcode != _CreateBss_CMD_))
- kfree(pcmd->parmbuf);
- if (pcmd->rsp) {
- if (pcmd->rspsz != 0)
- kfree(pcmd->rsp);
- }
- kfree(pcmd);
-}
-
-u8 r8712_sitesurvey_cmd(struct _adapter *padapter,
- struct ndis_802_11_ssid *pssid)
- __must_hold(&padapter->mlmepriv.lock)
-{
- struct cmd_obj *ph2c;
- struct sitesurvey_parm *psurveyPara;
- struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
- if (!ph2c)
- return _FAIL;
- psurveyPara = kmalloc(sizeof(*psurveyPara), GFP_ATOMIC);
- if (!psurveyPara) {
- kfree(ph2c);
- return _FAIL;
- }
- init_h2fwcmd_w_parm_no_rsp(ph2c, psurveyPara,
- GEN_CMD_CODE(_SiteSurvey));
- psurveyPara->bsslimit = cpu_to_le32(48);
- psurveyPara->passive_mode = cpu_to_le32(pmlmepriv->passive_mode);
- psurveyPara->ss_ssidlen = 0;
- memset(psurveyPara->ss_ssid, 0, IW_ESSID_MAX_SIZE + 1);
- if (pssid && pssid->SsidLength) {
- int len = min_t(int, pssid->SsidLength, IW_ESSID_MAX_SIZE);
-
- memcpy(psurveyPara->ss_ssid, pssid->Ssid, len);
- psurveyPara->ss_ssidlen = cpu_to_le32(len);
- }
- set_fwstate(pmlmepriv, _FW_UNDER_SURVEY);
- r8712_enqueue_cmd(pcmdpriv, ph2c);
- mod_timer(&pmlmepriv->scan_to_timer,
- jiffies + msecs_to_jiffies(SCANNING_TIMEOUT));
- padapter->ledpriv.LedControlHandler(padapter, LED_CTL_SITE_SURVEY);
- complete(&padapter->rx_filter_ready);
- return _SUCCESS;
-}
-
-int r8712_setdatarate_cmd(struct _adapter *padapter, u8 *rateset)
-{
- struct cmd_obj *ph2c;
- struct setdatarate_parm *pbsetdataratepara;
- struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
-
- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
- if (!ph2c)
- return -ENOMEM;
- pbsetdataratepara = kmalloc(sizeof(*pbsetdataratepara), GFP_ATOMIC);
- if (!pbsetdataratepara) {
- kfree(ph2c);
- return -ENOMEM;
- }
- init_h2fwcmd_w_parm_no_rsp(ph2c, pbsetdataratepara,
- GEN_CMD_CODE(_SetDataRate));
- pbsetdataratepara->mac_id = 5;
- memcpy(pbsetdataratepara->datarates, rateset, NumRates);
- r8712_enqueue_cmd(pcmdpriv, ph2c);
- return 0;
-}
-
-void r8712_set_chplan_cmd(struct _adapter *padapter, int chplan)
-{
- struct cmd_obj *ph2c;
- struct SetChannelPlan_param *psetchplanpara;
- struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
-
- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
- if (!ph2c)
- return;
- psetchplanpara = kmalloc(sizeof(*psetchplanpara), GFP_ATOMIC);
- if (!psetchplanpara) {
- kfree(ph2c);
- return;
- }
- init_h2fwcmd_w_parm_no_rsp(ph2c, psetchplanpara,
- GEN_CMD_CODE(_SetChannelPlan));
- psetchplanpara->ChannelPlan = chplan;
- r8712_enqueue_cmd(pcmdpriv, ph2c);
-}
-
-int r8712_setrfreg_cmd(struct _adapter *padapter, u8 offset, u32 val)
-{
- struct cmd_obj *ph2c;
- struct writeRF_parm *pwriterfparm;
- struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
-
- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
- if (!ph2c)
- return -ENOMEM;
- pwriterfparm = kmalloc(sizeof(*pwriterfparm), GFP_ATOMIC);
- if (!pwriterfparm) {
- kfree(ph2c);
- return -ENOMEM;
- }
- init_h2fwcmd_w_parm_no_rsp(ph2c, pwriterfparm, GEN_CMD_CODE(_SetRFReg));
- pwriterfparm->offset = offset;
- pwriterfparm->value = val;
- r8712_enqueue_cmd(pcmdpriv, ph2c);
- return 0;
-}
-
-int r8712_getrfreg_cmd(struct _adapter *padapter, u8 offset, u8 *pval)
-{
- struct cmd_obj *ph2c;
- struct readRF_parm *prdrfparm;
- struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
-
- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
- if (!ph2c)
- return -ENOMEM;
- prdrfparm = kmalloc(sizeof(*prdrfparm), GFP_ATOMIC);
- if (!prdrfparm) {
- kfree(ph2c);
- return -ENOMEM;
- }
- INIT_LIST_HEAD(&ph2c->list);
- ph2c->cmdcode = GEN_CMD_CODE(_GetRFReg);
- ph2c->parmbuf = (unsigned char *)prdrfparm;
- ph2c->cmdsz = sizeof(struct readRF_parm);
- ph2c->rsp = pval;
- ph2c->rspsz = sizeof(struct readRF_rsp);
- prdrfparm->offset = offset;
- r8712_enqueue_cmd(pcmdpriv, ph2c);
- return 0;
-}
-
-void r8712_getbbrfreg_cmdrsp_callback(struct _adapter *padapter,
- struct cmd_obj *pcmd)
-{
- kfree(pcmd->parmbuf);
- kfree(pcmd);
- padapter->mppriv.workparam.bcompleted = true;
-}
-
-void r8712_readtssi_cmdrsp_callback(struct _adapter *padapter,
- struct cmd_obj *pcmd)
-{
- kfree(pcmd->parmbuf);
- kfree(pcmd);
-
- padapter->mppriv.workparam.bcompleted = true;
-}
-
-int r8712_createbss_cmd(struct _adapter *padapter)
-{
- struct cmd_obj *pcmd;
- struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
- struct wlan_bssid_ex *pdev_network =
- &padapter->registrypriv.dev_network;
-
- padapter->ledpriv.LedControlHandler(padapter, LED_CTL_START_TO_LINK);
- pcmd = kmalloc(sizeof(*pcmd), GFP_ATOMIC);
- if (!pcmd)
- return -ENOMEM;
- INIT_LIST_HEAD(&pcmd->list);
- pcmd->cmdcode = _CreateBss_CMD_;
- pcmd->parmbuf = (unsigned char *)pdev_network;
- pcmd->cmdsz = r8712_get_wlan_bssid_ex_sz(pdev_network);
- pcmd->rsp = NULL;
- pcmd->rspsz = 0;
- /* notes: translate IELength & Length after assign to cmdsz; */
- pdev_network->Length = pcmd->cmdsz;
- pdev_network->IELength = pdev_network->IELength;
- pdev_network->Ssid.SsidLength = pdev_network->Ssid.SsidLength;
- r8712_enqueue_cmd(pcmdpriv, pcmd);
- return 0;
-}
-
-int r8712_joinbss_cmd(struct _adapter *padapter, struct wlan_network *pnetwork)
-{
- struct wlan_bssid_ex *psecnetwork;
- struct cmd_obj *pcmd;
- struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct qos_priv *pqospriv = &pmlmepriv->qospriv;
- struct security_priv *psecuritypriv = &padapter->securitypriv;
- struct registry_priv *pregistrypriv = &padapter->registrypriv;
- enum NDIS_802_11_NETWORK_INFRASTRUCTURE ndis_network_mode =
- pnetwork->network.InfrastructureMode;
-
- padapter->ledpriv.LedControlHandler(padapter, LED_CTL_START_TO_LINK);
- pcmd = kmalloc(sizeof(*pcmd), GFP_ATOMIC);
- if (!pcmd)
- return -ENOMEM;
-
- /* for hidden ap to set fw_state here */
- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE | WIFI_ADHOC_STATE) !=
- true) {
- switch (ndis_network_mode) {
- case Ndis802_11IBSS:
- pmlmepriv->fw_state |= WIFI_ADHOC_STATE;
- break;
- case Ndis802_11Infrastructure:
- pmlmepriv->fw_state |= WIFI_STATION_STATE;
- break;
- case Ndis802_11APMode:
- case Ndis802_11AutoUnknown:
- case Ndis802_11InfrastructureMax:
- break;
- }
- }
- psecnetwork = &psecuritypriv->sec_bss;
- memcpy(psecnetwork, &pnetwork->network, sizeof(*psecnetwork));
- psecuritypriv->authenticator_ie[0] = (unsigned char)
- psecnetwork->IELength;
- if ((psecnetwork->IELength - 12) < (256 - 1))
- memcpy(&psecuritypriv->authenticator_ie[1],
- &psecnetwork->IEs[12], psecnetwork->IELength - 12);
- else
- memcpy(&psecuritypriv->authenticator_ie[1],
- &psecnetwork->IEs[12], (256 - 1));
- psecnetwork->IELength = 0;
- /*
- * If the driver wants to use the bssid to create the connection.
- * If not, we copy the connecting AP's MAC address to it so that
- * the driver just has the bssid information for PMKIDList searching.
- */
- if (!pmlmepriv->assoc_by_bssid)
- ether_addr_copy(&pmlmepriv->assoc_bssid[0],
- &pnetwork->network.MacAddress[0]);
- psecnetwork->IELength = r8712_restruct_sec_ie(padapter,
- &pnetwork->network.IEs[0],
- &psecnetwork->IEs[0],
- pnetwork->network.IELength);
- pqospriv->qos_option = 0;
- if (pregistrypriv->wmm_enable) {
- u32 tmp_len;
-
- tmp_len = r8712_restruct_wmm_ie(padapter,
- &pnetwork->network.IEs[0],
- &psecnetwork->IEs[0],
- pnetwork->network.IELength,
- psecnetwork->IELength);
- if (psecnetwork->IELength != tmp_len) {
- psecnetwork->IELength = tmp_len;
- pqospriv->qos_option = 1; /* WMM IE in beacon */
- } else {
- pqospriv->qos_option = 0; /* no WMM IE in beacon */
- }
- }
- if (pregistrypriv->ht_enable) {
- /*
- * For WEP mode, we will use the bg mode to do the connection
- * to avoid some IOT issues, especially for Realtek 8192u
- * SoftAP.
- */
- if ((padapter->securitypriv.PrivacyAlgrthm != _WEP40_) &&
- (padapter->securitypriv.PrivacyAlgrthm != _WEP104_)) {
- /* restructure_ht_ie */
- r8712_restructure_ht_ie(padapter,
- &pnetwork->network.IEs[0],
- &psecnetwork->IEs[0],
- pnetwork->network.IELength,
- &psecnetwork->IELength);
- }
- }
- psecuritypriv->supplicant_ie[0] = (u8)psecnetwork->IELength;
- if (psecnetwork->IELength < 255)
- memcpy(&psecuritypriv->supplicant_ie[1], &psecnetwork->IEs[0],
- psecnetwork->IELength);
- else
- memcpy(&psecuritypriv->supplicant_ie[1], &psecnetwork->IEs[0],
- 255);
- /* get cmdsz before endian conversion */
- pcmd->cmdsz = r8712_get_wlan_bssid_ex_sz(psecnetwork);
-#ifdef __BIG_ENDIAN
- /* wlan_network endian conversion */
- psecnetwork->Length = cpu_to_le32(psecnetwork->Length);
- psecnetwork->Ssid.SsidLength = cpu_to_le32(
- psecnetwork->Ssid.SsidLength);
- psecnetwork->Privacy = cpu_to_le32(psecnetwork->Privacy);
- psecnetwork->Rssi = cpu_to_le32(psecnetwork->Rssi);
- psecnetwork->NetworkTypeInUse = cpu_to_le32(
- psecnetwork->NetworkTypeInUse);
- psecnetwork->Configuration.ATIMWindow = cpu_to_le32(
- psecnetwork->Configuration.ATIMWindow);
- psecnetwork->Configuration.BeaconPeriod = cpu_to_le32(
- psecnetwork->Configuration.BeaconPeriod);
- psecnetwork->Configuration.DSConfig = cpu_to_le32(
- psecnetwork->Configuration.DSConfig);
- psecnetwork->Configuration.FHConfig.DwellTime = cpu_to_le32(
- psecnetwork->Configuration.FHConfig.DwellTime);
- psecnetwork->Configuration.FHConfig.HopPattern = cpu_to_le32(
- psecnetwork->Configuration.FHConfig.HopPattern);
- psecnetwork->Configuration.FHConfig.HopSet = cpu_to_le32(
- psecnetwork->Configuration.FHConfig.HopSet);
- psecnetwork->Configuration.FHConfig.Length = cpu_to_le32(
- psecnetwork->Configuration.FHConfig.Length);
- psecnetwork->Configuration.Length = cpu_to_le32(
- psecnetwork->Configuration.Length);
- psecnetwork->InfrastructureMode = cpu_to_le32(
- psecnetwork->InfrastructureMode);
- psecnetwork->IELength = cpu_to_le32(psecnetwork->IELength);
-#endif
- INIT_LIST_HEAD(&pcmd->list);
- pcmd->cmdcode = _JoinBss_CMD_;
- pcmd->parmbuf = (unsigned char *)psecnetwork;
- pcmd->rsp = NULL;
- pcmd->rspsz = 0;
- r8712_enqueue_cmd(pcmdpriv, pcmd);
- return 0;
-}
-
-void r8712_disassoc_cmd(struct _adapter *padapter) /* for sta_mode */
-{
- struct cmd_obj *pdisconnect_cmd;
- struct disconnect_parm *pdisconnect;
- struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
-
- pdisconnect_cmd = kmalloc(sizeof(*pdisconnect_cmd), GFP_ATOMIC);
- if (!pdisconnect_cmd)
- return;
- pdisconnect = kmalloc(sizeof(*pdisconnect), GFP_ATOMIC);
- if (!pdisconnect) {
- kfree(pdisconnect_cmd);
- return;
- }
- init_h2fwcmd_w_parm_no_rsp(pdisconnect_cmd, pdisconnect,
- _DisConnect_CMD_);
- r8712_enqueue_cmd(pcmdpriv, pdisconnect_cmd);
-}
-
-void r8712_setopmode_cmd(struct _adapter *padapter,
- enum NDIS_802_11_NETWORK_INFRASTRUCTURE networktype)
-{
- struct cmd_obj *ph2c;
- struct setopmode_parm *psetop;
-
- struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
-
- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
- if (!ph2c)
- return;
- psetop = kmalloc(sizeof(*psetop), GFP_ATOMIC);
- if (!psetop) {
- kfree(ph2c);
- return;
- }
- init_h2fwcmd_w_parm_no_rsp(ph2c, psetop, _SetOpMode_CMD_);
- psetop->mode = (u8)networktype;
- r8712_enqueue_cmd(pcmdpriv, ph2c);
-}
-
-void r8712_setstakey_cmd(struct _adapter *padapter, u8 *psta, u8 unicast_key)
-{
- struct cmd_obj *ph2c;
- struct set_stakey_parm *psetstakey_para;
- struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
- struct set_stakey_rsp *psetstakey_rsp = NULL;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct security_priv *psecuritypriv = &padapter->securitypriv;
- struct sta_info *sta = (struct sta_info *)psta;
-
- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
- if (!ph2c)
- return;
- psetstakey_para = kmalloc(sizeof(*psetstakey_para), GFP_ATOMIC);
- if (!psetstakey_para) {
- kfree(ph2c);
- return;
- }
- psetstakey_rsp = kmalloc(sizeof(*psetstakey_rsp), GFP_ATOMIC);
- if (!psetstakey_rsp) {
- kfree(ph2c);
- kfree(psetstakey_para);
- return;
- }
- init_h2fwcmd_w_parm_no_rsp(ph2c, psetstakey_para, _SetStaKey_CMD_);
- ph2c->rsp = (u8 *)psetstakey_rsp;
- ph2c->rspsz = sizeof(struct set_stakey_rsp);
- ether_addr_copy(psetstakey_para->addr, sta->hwaddr);
- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE))
- psetstakey_para->algorithm = (unsigned char)
- psecuritypriv->PrivacyAlgrthm;
- else
- GET_ENCRY_ALGO(psecuritypriv, sta,
- psetstakey_para->algorithm, false);
- if (unicast_key)
- memcpy(&psetstakey_para->key, &sta->x_UncstKey, 16);
- else
- memcpy(&psetstakey_para->key,
- &psecuritypriv->XGrpKey[
- psecuritypriv->XGrpKeyid - 1]. skey, 16);
- r8712_enqueue_cmd(pcmdpriv, ph2c);
-}
-
-void r8712_setMacAddr_cmd(struct _adapter *padapter, const u8 *mac_addr)
-{
- struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
- struct cmd_obj *ph2c;
- struct SetMacAddr_param *psetMacAddr_para;
-
- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
- if (!ph2c)
- return;
- psetMacAddr_para = kmalloc(sizeof(*psetMacAddr_para), GFP_ATOMIC);
- if (!psetMacAddr_para) {
- kfree(ph2c);
- return;
- }
- init_h2fwcmd_w_parm_no_rsp(ph2c, psetMacAddr_para,
- _SetMacAddress_CMD_);
- ether_addr_copy(psetMacAddr_para->MacAddr, mac_addr);
- r8712_enqueue_cmd(pcmdpriv, ph2c);
-}
-
-void r8712_addbareq_cmd(struct _adapter *padapter, u8 tid)
-{
- struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
- struct cmd_obj *ph2c;
- struct addBaReq_parm *paddbareq_parm;
-
- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
- if (!ph2c)
- return;
- paddbareq_parm = kmalloc(sizeof(*paddbareq_parm), GFP_ATOMIC);
- if (!paddbareq_parm) {
- kfree(ph2c);
- return;
- }
- paddbareq_parm->tid = tid;
- init_h2fwcmd_w_parm_no_rsp(ph2c, paddbareq_parm,
- GEN_CMD_CODE(_AddBAReq));
- r8712_enqueue_cmd_ex(pcmdpriv, ph2c);
-}
-
-void r8712_wdg_wk_cmd(struct _adapter *padapter)
-{
- struct cmd_obj *ph2c;
- struct drvint_cmd_parm *pdrvintcmd_param;
- struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
-
- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
- if (!ph2c)
- return;
- pdrvintcmd_param = kmalloc(sizeof(*pdrvintcmd_param), GFP_ATOMIC);
- if (!pdrvintcmd_param) {
- kfree(ph2c);
- return;
- }
- pdrvintcmd_param->i_cid = WDG_WK_CID;
- pdrvintcmd_param->sz = 0;
- pdrvintcmd_param->pbuf = NULL;
- init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvintcmd_param, _DRV_INT_CMD_);
- r8712_enqueue_cmd_ex(pcmdpriv, ph2c);
-}
-
-void r8712_survey_cmd_callback(struct _adapter *padapter, struct cmd_obj *pcmd)
-{
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
- if (pcmd->res != H2C_SUCCESS)
- clr_fwstate(pmlmepriv, _FW_UNDER_SURVEY);
- r8712_free_cmd_obj(pcmd);
-}
-
-void r8712_disassoc_cmd_callback(struct _adapter *padapter,
- struct cmd_obj *pcmd)
-{
- unsigned long irqL;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
- if (pcmd->res != H2C_SUCCESS) {
- spin_lock_irqsave(&pmlmepriv->lock, irqL);
- set_fwstate(pmlmepriv, _FW_LINKED);
- spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
- return;
- }
- r8712_free_cmd_obj(pcmd);
-}
-
-void r8712_joinbss_cmd_callback(struct _adapter *padapter, struct cmd_obj *pcmd)
-{
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
- if (pcmd->res != H2C_SUCCESS)
- mod_timer(&pmlmepriv->assoc_timer,
- jiffies + msecs_to_jiffies(1));
- r8712_free_cmd_obj(pcmd);
-}
-
-void r8712_createbss_cmd_callback(struct _adapter *padapter,
- struct cmd_obj *pcmd)
-{
- unsigned long irqL;
- struct sta_info *psta = NULL;
- struct wlan_network *pwlan = NULL;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)pcmd->parmbuf;
- struct wlan_network *tgt_network = &(pmlmepriv->cur_network);
-
- if (pcmd->res != H2C_SUCCESS)
- mod_timer(&pmlmepriv->assoc_timer,
- jiffies + msecs_to_jiffies(1));
- del_timer(&pmlmepriv->assoc_timer);
-#ifdef __BIG_ENDIAN
- /* endian_convert */
- pnetwork->Length = le32_to_cpu(pnetwork->Length);
- pnetwork->Ssid.SsidLength = le32_to_cpu(pnetwork->Ssid.SsidLength);
- pnetwork->Privacy = le32_to_cpu(pnetwork->Privacy);
- pnetwork->Rssi = le32_to_cpu(pnetwork->Rssi);
- pnetwork->NetworkTypeInUse = le32_to_cpu(pnetwork->NetworkTypeInUse);
- pnetwork->Configuration.ATIMWindow =
- le32_to_cpu(pnetwork->Configuration.ATIMWindow);
- pnetwork->Configuration.DSConfig =
- le32_to_cpu(pnetwork->Configuration.DSConfig);
- pnetwork->Configuration.FHConfig.DwellTime =
- le32_to_cpu(pnetwork->Configuration.FHConfig.DwellTime);
- pnetwork->Configuration.FHConfig.HopPattern =
- le32_to_cpu(pnetwork->Configuration.FHConfig.HopPattern);
- pnetwork->Configuration.FHConfig.HopSet =
- le32_to_cpu(pnetwork->Configuration.FHConfig.HopSet);
- pnetwork->Configuration.FHConfig.Length =
- le32_to_cpu(pnetwork->Configuration.FHConfig.Length);
- pnetwork->Configuration.Length =
- le32_to_cpu(pnetwork->Configuration.Length);
- pnetwork->InfrastructureMode =
- le32_to_cpu(pnetwork->InfrastructureMode);
- pnetwork->IELength = le32_to_cpu(pnetwork->IELength);
-#endif
- spin_lock_irqsave(&pmlmepriv->lock, irqL);
- if ((pmlmepriv->fw_state) & WIFI_AP_STATE) {
- psta = r8712_get_stainfo(&padapter->stapriv,
- pnetwork->MacAddress);
- if (!psta) {
- psta = r8712_alloc_stainfo(&padapter->stapriv,
- pnetwork->MacAddress);
- if (!psta)
- goto createbss_cmd_fail;
- }
- r8712_indicate_connect(padapter);
- } else {
- pwlan = _r8712_alloc_network(pmlmepriv);
- if (!pwlan) {
- pwlan = r8712_get_oldest_wlan_network(
- &pmlmepriv->scanned_queue);
- if (!pwlan)
- goto createbss_cmd_fail;
- pwlan->last_scanned = jiffies;
- } else {
- list_add_tail(&(pwlan->list),
- &pmlmepriv->scanned_queue.queue);
- }
- pnetwork->Length = r8712_get_wlan_bssid_ex_sz(pnetwork);
- memcpy(&(pwlan->network), pnetwork, pnetwork->Length);
- pwlan->fixed = true;
- memcpy(&tgt_network->network, pnetwork,
- (r8712_get_wlan_bssid_ex_sz(pnetwork)));
- if (pmlmepriv->fw_state & _FW_UNDER_LINKING)
- pmlmepriv->fw_state ^= _FW_UNDER_LINKING;
- /*
- * we will set _FW_LINKED when there is one more sat to
- * join us (stassoc_event_callback)
- */
- }
-createbss_cmd_fail:
- spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
- r8712_free_cmd_obj(pcmd);
-}
-
-void r8712_setstaKey_cmdrsp_callback(struct _adapter *padapter,
- struct cmd_obj *pcmd)
-{
- struct sta_priv *pstapriv = &padapter->stapriv;
- struct set_stakey_rsp *psetstakey_rsp = (struct set_stakey_rsp *)
- (pcmd->rsp);
- struct sta_info *psta = r8712_get_stainfo(pstapriv,
- psetstakey_rsp->addr);
-
- if (!psta)
- goto exit;
- psta->aid = psta->mac_id = psetstakey_rsp->keyid; /*CAM_ID(CAM_ENTRY)*/
-exit:
- r8712_free_cmd_obj(pcmd);
-}
-
-void r8712_setassocsta_cmdrsp_callback(struct _adapter *padapter,
- struct cmd_obj *pcmd)
-{
- unsigned long irqL;
- struct sta_priv *pstapriv = &padapter->stapriv;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct set_assocsta_parm *passocsta_parm =
- (struct set_assocsta_parm *)(pcmd->parmbuf);
- struct set_assocsta_rsp *passocsta_rsp =
- (struct set_assocsta_rsp *) (pcmd->rsp);
- struct sta_info *psta = r8712_get_stainfo(pstapriv,
- passocsta_parm->addr);
-
- if (!psta)
- return;
- psta->aid = psta->mac_id = passocsta_rsp->cam_id;
- spin_lock_irqsave(&pmlmepriv->lock, irqL);
- if ((check_fwstate(pmlmepriv, WIFI_MP_STATE)) &&
- (check_fwstate(pmlmepriv, _FW_UNDER_LINKING)))
- pmlmepriv->fw_state ^= _FW_UNDER_LINKING;
- set_fwstate(pmlmepriv, _FW_LINKED);
- spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
- r8712_free_cmd_obj(pcmd);
-}
-
-void r8712_disconnectCtrlEx_cmd(struct _adapter *adapter, u32 enableDrvCtrl,
- u32 tryPktCnt, u32 tryPktInterval, u32 firstStageTO)
-{
- struct cmd_obj *ph2c;
- struct DisconnectCtrlEx_param *param;
- struct cmd_priv *pcmdpriv = &adapter->cmdpriv;
-
- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
- if (!ph2c)
- return;
- param = kzalloc(sizeof(*param), GFP_ATOMIC);
- if (!param) {
- kfree(ph2c);
- return;
- }
-
- param->EnableDrvCtrl = (unsigned char)enableDrvCtrl;
- param->TryPktCnt = (unsigned char)tryPktCnt;
- param->TryPktInterval = (unsigned char)tryPktInterval;
- param->FirstStageTO = (unsigned int)firstStageTO;
-
- init_h2fwcmd_w_parm_no_rsp(ph2c, param,
- GEN_CMD_CODE(_DisconnectCtrlEx));
- r8712_enqueue_cmd(pcmdpriv, ph2c);
-}
--- a/drivers/staging/rtl8712/rtl871x_cmd.h
+++ /dev/null
@@ -1,761 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL871X_CMD_H_
-#define __RTL871X_CMD_H_
-
-#include "wlan_bssdef.h"
-#include "rtl871x_rf.h"
-#define C2H_MEM_SZ (16*1024)
-
-#include "osdep_service.h"
-#include "ieee80211.h"
-
-#define FREE_CMDOBJ_SZ 128
-#define MAX_CMDSZ 512
-#define MAX_RSPSZ 512
-#define MAX_EVTSZ 1024
-#define CMDBUFF_ALIGN_SZ 512
-
-struct cmd_obj {
- u16 cmdcode;
- u8 res;
- u8 *parmbuf;
- u32 cmdsz;
- u8 *rsp;
- u32 rspsz;
- struct list_head list;
-};
-
-struct cmd_priv {
- struct completion cmd_queue_comp;
- struct completion terminate_cmdthread_comp;
- struct __queue cmd_queue;
- u8 cmd_seq;
- u8 *cmd_buf; /*shall be non-paged, and 4 bytes aligned*/
- u8 *cmd_allocated_buf;
- u8 *rsp_buf; /*shall be non-paged, and 4 bytes aligned*/
- u8 *rsp_allocated_buf;
- u32 cmd_issued_cnt;
- u32 cmd_done_cnt;
- u32 rsp_cnt;
- struct _adapter *padapter;
-};
-
-struct evt_obj {
- u16 evtcode;
- u8 res;
- u8 *parmbuf;
- u32 evtsz;
- struct list_head list;
-};
-
-struct evt_priv {
- struct __queue evt_queue;
- u8 event_seq;
- u8 *evt_buf; /*shall be non-paged, and 4 bytes aligned*/
- u8 *evt_allocated_buf;
- u32 evt_done_cnt;
-};
-
-#define init_h2fwcmd_w_parm_no_rsp(pcmd, pparm, code) \
-do {\
- INIT_LIST_HEAD(&pcmd->list);\
- pcmd->cmdcode = code;\
- pcmd->parmbuf = (u8 *)(pparm);\
- pcmd->cmdsz = sizeof(*pparm);\
- pcmd->rsp = NULL;\
- pcmd->rspsz = 0;\
-} while (0)
-
-void r8712_enqueue_cmd(struct cmd_priv *pcmdpriv, struct cmd_obj *obj);
-void r8712_enqueue_cmd_ex(struct cmd_priv *pcmdpriv, struct cmd_obj *obj);
-struct cmd_obj *r8712_dequeue_cmd(struct __queue *queue);
-void r8712_free_cmd_obj(struct cmd_obj *pcmd);
-int r8712_cmd_thread(void *context);
-int r8712_init_cmd_priv(struct cmd_priv *pcmdpriv);
-void r8712_free_cmd_priv(struct cmd_priv *pcmdpriv);
-int r8712_init_evt_priv(struct evt_priv *pevtpriv);
-void r8712_free_evt_priv(struct evt_priv *pevtpriv);
-
-enum rtl871x_drvint_cid {
- NONE_WK_CID,
- WDG_WK_CID,
- MAX_WK_CID
-};
-
-enum RFINTFS {
- SWSI,
- HWSI,
- HWPI,
-};
-
-/*
- * Caller Mode: Infra, Ad-HoC(C)
- * Notes: To enter USB suspend mode
- * Command Mode
- */
-struct usb_suspend_parm {
- u32 action; /* 1: sleep, 0:resume */
-};
-
-/*
- * Caller Mode: Infra, Ad-HoC(C)
- * Notes: To disconnect the current associated BSS
- * Command Mode
- */
-struct disconnect_parm {
- u32 rsvd;
-};
-
-/*
- * Caller Mode: AP, Ad-HoC, Infra
- * Notes: To set the NIC mode of RTL8711
- * Command Mode
- * The definition of mode:
- *
- * #define IW_MODE_AUTO 0 // Let the driver decides which AP to join
- * #define IW_MODE_ADHOC 1 // Single cell network (Ad-Hoc Clients)
- * #define IW_MODE_INFRA 2 // Multi cell network, roaming, ..
- * #define IW_MODE_MASTER 3 // Synchronisation master or AP
- * #define IW_MODE_REPEAT 4 // Wireless Repeater (forwarder)
- * #define IW_MODE_SECOND 5 // Secondary master/repeater (backup)
- * #define IW_MODE_MONITOR 6 // Passive monitor (listen only)
- */
-struct setopmode_parm {
- u8 mode;
- u8 rsvd[3];
-};
-
-/*
- * Caller Mode: AP, Ad-HoC, Infra
- * Notes: To ask RTL8711 performing site-survey
- * Command-Event Mode
- */
-struct sitesurvey_parm {
- __le32 passive_mode; /*active: 1, passive: 0 */
- __le32 bsslimit; /* 1 ~ 48 */
- __le32 ss_ssidlen;
- u8 ss_ssid[IW_ESSID_MAX_SIZE + 1];
-};
-
-/*
- * Caller Mode: Any
- * Notes: To set the auth type of RTL8711. open/shared/802.1x
- * Command Mode
- */
-struct setauth_parm {
- u8 mode; /*0: legacy open, 1: legacy shared 2: 802.1x*/
- u8 _1x; /*0: PSK, 1: TLS*/
- u8 rsvd[2];
-};
-
-/*
- * Caller Mode: Infra
- * a. algorithm: wep40, wep104, tkip & aes
- * b. keytype: grp key/unicast key
- * c. key contents
- *
- * when shared key ==> keyid is the camid
- * when 802.1x ==> keyid [0:1] ==> grp key
- * when 802.1x ==> keyid > 2 ==> unicast key
- */
-struct setkey_parm {
- u8 algorithm; /* encryption algorithm, could be none, wep40,
- * TKIP, CCMP, wep104
- */
- u8 keyid;
- u8 grpkey; /* 1: this is the grpkey for 802.1x.
- * 0: this is the unicast key for 802.1x
- */
- u8 key[16]; /* this could be 40 or 104 */
-};
-
-/*
- * When in AP or Ad-Hoc mode, this is used to
- * allocate an sw/hw entry for a newly associated sta.
- * Command
- * when shared key ==> algorithm/keyid
- */
-struct set_stakey_parm {
- u8 addr[ETH_ALEN];
- u8 algorithm;
- u8 key[16];
-};
-
-struct set_stakey_rsp {
- u8 addr[ETH_ALEN];
- u8 keyid;
- u8 rsvd;
-};
-
-struct SetMacAddr_param {
- u8 MacAddr[ETH_ALEN];
-};
-
-/*
- * Caller Ad-Hoc/AP
- *
- * Command -Rsp(AID == CAMID) mode
- *
- * This is to force fw to add an sta_data entry per driver's request.
- *
- * FW will write an cam entry associated with it.
- *
- */
-struct set_assocsta_parm {
- u8 addr[ETH_ALEN];
-};
-
-struct set_assocsta_rsp {
- u8 cam_id;
- u8 rsvd[3];
-};
-
-/*
- * Caller Ad-Hoc/AP
- *
- * Command mode
- *
- * This is to force fw to del an sta_data entry per driver's request
- *
- * FW will invalidate the cam entry associated with it.
- *
- */
-struct del_assocsta_parm {
- u8 addr[ETH_ALEN];
-};
-
-/*
- * Caller Mode: AP/Ad-HoC(M)
- *
- * Notes: To notify fw that given staid has changed its power state
- *
- * Command Mode
- *
- */
-struct setstapwrstate_parm {
- u8 staid;
- u8 status;
- u8 hwaddr[6];
-};
-
-/*
- * Caller Mode: Any
- *
- * Notes: To setup the basic rate of RTL8711
- *
- * Command Mode
- *
- */
-struct setbasicrate_parm {
- u8 basicrates[NumRates];
-};
-
-/*
- * Caller Mode: Any
- *
- * Notes: To read the current basic rate
- *
- * Command-Rsp Mode
- *
- */
-struct getbasicrate_parm {
- u32 rsvd;
-};
-
-struct getbasicrate_rsp {
- u8 basicrates[NumRates];
-};
-
-/*
- * Caller Mode: Any
- *
- * Notes: To setup the data rate of RTL8711
- *
- * Command Mode
- *
- */
-struct setdatarate_parm {
- u8 mac_id;
- u8 datarates[NumRates];
-};
-
-enum _RT_CHANNEL_DOMAIN {
- RT_CHANNEL_DOMAIN_FCC = 0,
- RT_CHANNEL_DOMAIN_IC = 1,
- RT_CHANNEL_DOMAIN_ETSI = 2,
- RT_CHANNEL_DOMAIN_SPAIN = 3,
- RT_CHANNEL_DOMAIN_FRANCE = 4,
- RT_CHANNEL_DOMAIN_MKK = 5,
- RT_CHANNEL_DOMAIN_MKK1 = 6,
- RT_CHANNEL_DOMAIN_ISRAEL = 7,
- RT_CHANNEL_DOMAIN_TELEC = 8,
-
- /* Be compatible with old channel plan. No good! */
- RT_CHANNEL_DOMAIN_MIC = 9,
- RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN = 10,
- RT_CHANNEL_DOMAIN_WORLD_WIDE_13 = 11,
- RT_CHANNEL_DOMAIN_TELEC_NETGEAR = 12,
-
- RT_CHANNEL_DOMAIN_NCC = 13,
- RT_CHANNEL_DOMAIN_5G = 14,
- RT_CHANNEL_DOMAIN_5G_40M = 15,
- /*===== Add new channel plan above this line===============*/
- RT_CHANNEL_DOMAIN_MAX,
-};
-
-struct SetChannelPlan_param {
- enum _RT_CHANNEL_DOMAIN ChannelPlan;
-};
-
-/*
- * Caller Mode: Any
- *
- * Notes: To read the current data rate
- *
- * Command-Rsp Mode
- *
- */
-struct getdatarate_parm {
- u32 rsvd;
-
-};
-
-struct getdatarate_rsp {
- u8 datarates[NumRates];
-};
-
-/*
- * Caller Mode: Any
- * AP: AP can use the info for the contents of beacon frame
- * Infra: STA can use the info when sitesurveying
- * Ad-HoC(M): Like AP
- * Ad-HoC(C): Like STA
- *
- *
- * Notes: To set the phy capability of the NIC
- *
- * Command Mode
- *
- */
-
-/*
- * Caller Mode: Any
- *
- * Notes: To set the channel/modem/band
- * This command will be used when channel/modem/band is changed.
- *
- * Command Mode
- *
- */
-/*
- * Caller Mode: Any
- *
- * Notes: To get the current setting of channel/modem/band
- *
- * Command-Rsp Mode
- *
- */
-struct getphy_rsp {
- u8 rfchannel;
- u8 modem;
-};
-
-struct readBB_parm {
- u8 offset;
-};
-
-struct readBB_rsp {
- u8 value;
-};
-
-struct readTSSI_parm {
- u8 offset;
-};
-
-struct readTSSI_rsp {
- u8 value;
-};
-
-struct writeBB_parm {
- u8 offset;
- u8 value;
-};
-
-struct writePTM_parm {
- u8 type;
-};
-
-struct readRF_parm {
- u8 offset;
-};
-
-struct readRF_rsp {
- u32 value;
-};
-
-struct writeRF_parm {
- u32 offset;
- u32 value;
-};
-
-struct setrfintfs_parm {
- u8 rfintfs;
-};
-
-struct getrfintfs_parm {
- u8 rfintfs;
-};
-
-/*
- * Notes: This command is used for H2C/C2H loopback testing
- *
- * mac[0] == 0
- * ==> CMD mode, return H2C_SUCCESS.
- * The following condition must be true under CMD mode
- * mac[1] == mac[4], mac[2] == mac[3], mac[0]=mac[5]= 0;
- * s0 == 0x1234, s1 == 0xabcd, w0 == 0x78563412, w1 == 0x5aa5def7;
- * s2 == (b1 << 8 | b0);
- *
- * mac[0] == 1
- * ==> CMD_RSP mode, return H2C_SUCCESS_RSP
- *
- * The rsp layout shall be:
- * rsp: parm:
- * mac[0] = mac[5];
- * mac[1] = mac[4];
- * mac[2] = mac[3];
- * mac[3] = mac[2];
- * mac[4] = mac[1];
- * mac[5] = mac[0];
- * s0 = s1;
- * s1 = swap16(s0);
- * w0 = swap32(w1);
- * b0 = b1
- * s2 = s0 + s1
- * b1 = b0
- * w1 = w0
- *
- * mac[0] == 2
- * ==> CMD_EVENT mode, return H2C_SUCCESS
- * The event layout shall be:
- * event: parm:
- * mac[0] = mac[5];
- * mac[1] = mac[4];
- * mac[2] = event's sequence number, starting from 1 to parm's marc[3]
- * mac[3] = mac[2];
- * mac[4] = mac[1];
- * mac[5] = mac[0];
- * s0 = swap16(s0) - event.mac[2];
- * s1 = s1 + event.mac[2];
- * w0 = swap32(w0);
- * b0 = b1
- * s2 = s0 + event.mac[2]
- * b1 = b0
- * w1 = swap32(w1) - event.mac[2];
- *
- * parm->mac[3] is the total event counts that host requested.
- *
- *
- * event will be the same with the cmd's param.
- *
- */
-
-/* CMD param Formart for DRV INTERNAL CMD HDL*/
-struct drvint_cmd_parm {
- int i_cid; /*internal cmd id*/
- int sz; /* buf sz*/
- unsigned char *pbuf;
-};
-
-/*------------------- Below are used for RF/BB tuning ---------------------*/
-
-struct setantenna_parm {
- u8 tx_antset;
- u8 rx_antset;
- u8 tx_antenna;
- u8 rx_antenna;
-};
-
-struct enrateadaptive_parm {
- u32 en;
-};
-
-struct settxagctbl_parm {
- u32 txagc[MAX_RATES_LENGTH];
-};
-
-struct gettxagctbl_parm {
- u32 rsvd;
-};
-
-struct gettxagctbl_rsp {
- u32 txagc[MAX_RATES_LENGTH];
-};
-
-struct setagcctrl_parm {
- u32 agcctrl; /* 0: pure hw, 1: fw */
-};
-
-struct setssup_parm {
- u32 ss_ForceUp[MAX_RATES_LENGTH];
-};
-
-struct getssup_parm {
- u32 rsvd;
-};
-
-struct getssup_rsp {
- u8 ss_ForceUp[MAX_RATES_LENGTH];
-};
-
-struct setssdlevel_parm {
- u8 ss_DLevel[MAX_RATES_LENGTH];
-};
-
-struct getssdlevel_parm {
- u32 rsvd;
-};
-
-struct getssdlevel_rsp {
- u8 ss_DLevel[MAX_RATES_LENGTH];
-};
-
-struct setssulevel_parm {
- u8 ss_ULevel[MAX_RATES_LENGTH];
-};
-
-struct getssulevel_parm {
- u32 rsvd;
-};
-
-struct getssulevel_rsp {
- u8 ss_ULevel[MAX_RATES_LENGTH];
-};
-
-struct setcountjudge_parm {
- u8 count_judge[MAX_RATES_LENGTH];
-};
-
-struct getcountjudge_parm {
- u32 rsvd;
-};
-
-struct getcountjudge_rsp {
- u8 count_judge[MAX_RATES_LENGTH];
-};
-
-struct setpwrmode_parm {
- u8 mode;
- u8 flag_low_traffic_en;
- u8 flag_lpnav_en;
- u8 flag_rf_low_snr_en;
- u8 flag_dps_en; /* 1: dps, 0: 32k */
- u8 bcn_rx_en;
- u8 bcn_pass_cnt; /* fw report one beacon information to
- * driver when it receives bcn_pass_cnt
- * beacons.
- */
- u8 bcn_to; /* beacon TO (ms). ¡§=0¡¨ no limit.*/
- u16 bcn_itv;
- u8 app_itv; /* only for VOIP mode. */
- u8 awake_bcn_itv;
- u8 smart_ps;
- u8 bcn_pass_time; /* unit: 100ms */
-};
-
-struct setatim_parm {
- u8 op; /*0: add, 1:del*/
- u8 txid; /* id of dest station.*/
-};
-
-struct setratable_parm {
- u8 ss_ForceUp[NumRates];
- u8 ss_ULevel[NumRates];
- u8 ss_DLevel[NumRates];
- u8 count_judge[NumRates];
-};
-
-struct getratable_parm {
- uint rsvd;
-};
-
-struct getratable_rsp {
- u8 ss_ForceUp[NumRates];
- u8 ss_ULevel[NumRates];
- u8 ss_DLevel[NumRates];
- u8 count_judge[NumRates];
-};
-
-/*to get TX,RX retry count*/
-struct gettxretrycnt_parm {
- unsigned int rsvd;
-};
-
-struct gettxretrycnt_rsp {
- unsigned long tx_retrycnt;
-};
-
-struct getrxretrycnt_parm {
- unsigned int rsvd;
-};
-
-struct getrxretrycnt_rsp {
- unsigned long rx_retrycnt;
-};
-
-/*to get BCNOK,BCNERR count*/
-struct getbcnokcnt_parm {
- unsigned int rsvd;
-};
-
-struct getbcnokcnt_rsp {
- unsigned long bcnokcnt;
-};
-
-struct getbcnerrcnt_parm {
- unsigned int rsvd;
-};
-
-struct getbcnerrcnt_rsp {
- unsigned long bcnerrcnt;
-};
-
-/* to get current TX power level*/
-struct getcurtxpwrlevel_parm {
- unsigned int rsvd;
-};
-
-struct getcurtxpwrlevel_rsp {
- unsigned short tx_power;
-};
-
-/*dynamic on/off DIG*/
-struct setdig_parm {
- unsigned char dig_on; /* 1:on , 0:off */
-};
-
-/*dynamic on/off RA*/
-struct setra_parm {
- unsigned char ra_on; /* 1:on , 0:off */
-};
-
-struct setprobereqextraie_parm {
- unsigned char e_id;
- unsigned char ie_len;
- unsigned char ie[];
-};
-
-struct setassocreqextraie_parm {
- unsigned char e_id;
- unsigned char ie_len;
- unsigned char ie[];
-};
-
-struct setproberspextraie_parm {
- unsigned char e_id;
- unsigned char ie_len;
- unsigned char ie[];
-};
-
-struct setassocrspextraie_parm {
- unsigned char e_id;
- unsigned char ie_len;
- unsigned char ie[];
-};
-
-struct addBaReq_parm {
- unsigned int tid;
-};
-
-/*H2C Handler index: 46 */
-struct SetChannel_parm {
- u32 curr_ch;
-};
-
-/*H2C Handler index: 61 */
-struct DisconnectCtrlEx_param {
- /* MAXTIME = (2 * FirstStageTO) + (TryPktCnt * TryPktInterval) */
- unsigned char EnableDrvCtrl;
- unsigned char TryPktCnt;
- unsigned char TryPktInterval; /* Unit: ms */
- unsigned char rsvd;
- unsigned int FirstStageTO; /* Unit: ms */
-};
-
-#define GEN_CMD_CODE(cmd) cmd ## _CMD_
-
-/*
- * Result:
- * 0x00: success
- * 0x01: success, and check Response.
- * 0x02: cmd ignored due to duplicated sequence number
- * 0x03: cmd dropped due to invalid cmd code
- * 0x04: reserved.
- */
-
-#define H2C_RSP_OFFSET 512
-#define H2C_SUCCESS 0x00
-#define H2C_SUCCESS_RSP 0x01
-#define H2C_DUPLICATED 0x02
-#define H2C_DROPPED 0x03
-#define H2C_PARAMETERS_ERROR 0x04
-#define H2C_REJECTED 0x05
-#define H2C_CMD_OVERFLOW 0x06
-#define H2C_RESERVED 0x07
-
-void r8712_setMacAddr_cmd(struct _adapter *padapter, const u8 *mac_addr);
-u8 r8712_sitesurvey_cmd(struct _adapter *padapter,
- struct ndis_802_11_ssid *pssid);
-int r8712_createbss_cmd(struct _adapter *padapter);
-void r8712_setstakey_cmd(struct _adapter *padapter, u8 *psta, u8 unicast_key);
-int r8712_joinbss_cmd(struct _adapter *padapter,
- struct wlan_network *pnetwork);
-void r8712_disassoc_cmd(struct _adapter *padapter);
-void r8712_setopmode_cmd(struct _adapter *padapter,
- enum NDIS_802_11_NETWORK_INFRASTRUCTURE networktype);
-int r8712_setdatarate_cmd(struct _adapter *padapter, u8 *rateset);
-void r8712_set_chplan_cmd(struct _adapter *padapter, int chplan);
-int r8712_getrfreg_cmd(struct _adapter *padapter, u8 offset, u8 *pval);
-int r8712_setrfreg_cmd(struct _adapter *padapter, u8 offset, u32 val);
-void r8712_addbareq_cmd(struct _adapter *padapter, u8 tid);
-void r8712_wdg_wk_cmd(struct _adapter *padapter);
-void r8712_survey_cmd_callback(struct _adapter *padapter,
- struct cmd_obj *pcmd);
-void r8712_disassoc_cmd_callback(struct _adapter *padapter,
- struct cmd_obj *pcmd);
-void r8712_joinbss_cmd_callback(struct _adapter *padapter,
- struct cmd_obj *pcmd);
-void r8712_createbss_cmd_callback(struct _adapter *padapter,
- struct cmd_obj *pcmd);
-void r8712_getbbrfreg_cmdrsp_callback(struct _adapter *padapter,
- struct cmd_obj *pcmd);
-void r8712_readtssi_cmdrsp_callback(struct _adapter *padapter,
- struct cmd_obj *pcmd);
-void r8712_setstaKey_cmdrsp_callback(struct _adapter *padapter,
- struct cmd_obj *pcmd);
-void r8712_setassocsta_cmdrsp_callback(struct _adapter *padapter,
- struct cmd_obj *pcmd);
-void r8712_disconnectCtrlEx_cmd(struct _adapter *adapter, u32 enableDrvCtrl,
- u32 tryPktCnt, u32 tryPktInterval, u32 firstStageTO);
-
-struct _cmd_callback {
- u32 cmd_code;
- void (*callback)(struct _adapter *padapter, struct cmd_obj *cmd);
-};
-
-#include "rtl8712_cmd.h"
-
-#endif /* _CMD_H_ */
-
--- a/drivers/staging/rtl8712/rtl871x_debug.h
+++ /dev/null
@@ -1,130 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL871X_DEBUG_H__
-#define __RTL871X_DEBUG_H__
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-#define _drv_emerg_ 1
-#define _drv_alert_ 2
-#define _drv_crit_ 3
-#define _drv_err_ 4
-#define _drv_warning_ 5
-#define _drv_notice_ 6
-#define _drv_info_ 7
-#define _drv_dump_ 8
-#define _drv_debug_ 9
-
-#define _module_rtl871x_xmit_c_ BIT(0)
-#define _module_xmit_osdep_c_ BIT(1)
-#define _module_rtl871x_recv_c_ BIT(2)
-#define _module_recv_osdep_c_ BIT(3)
-#define _module_rtl871x_mlme_c_ BIT(4)
-#define _module_mlme_osdep_c_ BIT(5)
-#define _module_rtl871x_sta_mgt_c_ BIT(6)
-#define _module_rtl871x_cmd_c_ BIT(7)
-#define _module_cmd_osdep_c_ BIT(8)
-#define _module_rtl871x_io_c_ BIT(9)
-#define _module_io_osdep_c_ BIT(10)
-#define _module_os_intfs_c_ BIT(11)
-#define _module_rtl871x_security_c_ BIT(12)
-#define _module_rtl871x_eeprom_c_ BIT(13)
-#define _module_hal_init_c_ BIT(14)
-#define _module_hci_hal_init_c_ BIT(15)
-#define _module_rtl871x_ioctl_c_ BIT(16)
-#define _module_rtl871x_ioctl_set_c_ BIT(17)
-#define _module_rtl871x_pwrctrl_c_ BIT(19)
-#define _module_hci_intfs_c_ BIT(20)
-#define _module_hci_ops_c_ BIT(21)
-#define _module_osdep_service_c_ BIT(22)
-#define _module_rtl871x_mp_ioctl_c_ BIT(23)
-#define _module_hci_ops_os_c_ BIT(24)
-#define _module_rtl871x_ioctl_os_c BIT(25)
-#define _module_rtl8712_cmd_c_ BIT(26)
-#define _module_rtl871x_mp_c_ BIT(27)
-#define _module_rtl8712_xmit_c_ BIT(28)
-#define _module_rtl8712_efuse_c_ BIT(29)
-#define _module_rtl8712_recv_c_ BIT(30)
-#define _module_rtl8712_led_c_ BIT(31)
-
-#undef _MODULE_DEFINE_
-
-#if defined _RTL871X_XMIT_C_
- #define _MODULE_DEFINE_ _module_rtl871x_xmit_c_
-#elif defined _XMIT_OSDEP_C_
- #define _MODULE_DEFINE_ _module_xmit_osdep_c_
-#elif defined _RTL871X_RECV_C_
- #define _MODULE_DEFINE_ _module_rtl871x_recv_c_
-#elif defined _RECV_OSDEP_C_
- #define _MODULE_DEFINE_ _module_recv_osdep_c_
-#elif defined _RTL871X_MLME_C_
- #define _MODULE_DEFINE_ _module_rtl871x_mlme_c_
-#elif defined _MLME_OSDEP_C_
- #define _MODULE_DEFINE_ _module_mlme_osdep_c_
-#elif defined _RTL871X_STA_MGT_C_
- #define _MODULE_DEFINE_ _module_rtl871x_sta_mgt_c_
-#elif defined _RTL871X_CMD_C_
- #define _MODULE_DEFINE_ _module_rtl871x_cmd_c_
-#elif defined _CMD_OSDEP_C_
- #define _MODULE_DEFINE_ _module_cmd_osdep_c_
-#elif defined _RTL871X_IO_C_
- #define _MODULE_DEFINE_ _module_rtl871x_io_c_
-#elif defined _IO_OSDEP_C_
- #define _MODULE_DEFINE_ _module_io_osdep_c_
-#elif defined _OS_INTFS_C_
- #define _MODULE_DEFINE_ _module_os_intfs_c_
-#elif defined _RTL871X_SECURITY_C_
- #define _MODULE_DEFINE_ _module_rtl871x_security_c_
-#elif defined _RTL871X_EEPROM_C_
- #define _MODULE_DEFINE_ _module_rtl871x_eeprom_c_
-#elif defined _HAL_INIT_C_
- #define _MODULE_DEFINE_ _module_hal_init_c_
-#elif defined _HCI_HAL_INIT_C_
- #define _MODULE_DEFINE_ _module_hci_hal_init_c_
-#elif defined _RTL871X_IOCTL_C_
- #define _MODULE_DEFINE_ _module_rtl871x_ioctl_c_
-#elif defined _RTL871X_IOCTL_SET_C_
- #define _MODULE_DEFINE_ _module_rtl871x_ioctl_set_c_
-#elif defined _RTL871X_PWRCTRL_C_
- #define _MODULE_DEFINE_ _module_rtl871x_pwrctrl_c_
-#elif defined _HCI_INTF_C_
- #define _MODULE_DEFINE_ _module_hci_intfs_c_
-#elif defined _HCI_OPS_C_
- #define _MODULE_DEFINE_ _module_hci_ops_c_
-#elif defined _OSDEP_HCI_INTF_C_
- #define _MODULE_DEFINE_ _module_hci_intfs_c_
-#elif defined _OSDEP_SERVICE_C_
- #define _MODULE_DEFINE_ _module_osdep_service_c_
-#elif defined _RTL871X_MP_IOCTL_C_
- #define _MODULE_DEFINE_ _module_rtl871x_mp_ioctl_c_
-#elif defined _HCI_OPS_OS_C_
- #define _MODULE_DEFINE_ _module_hci_ops_os_c_
-#elif defined _RTL871X_IOCTL_LINUX_C_
- #define _MODULE_DEFINE_ _module_rtl871x_ioctl_os_c
-#elif defined _RTL871X_MP_C_
- #define _MODULE_DEFINE_ _module_rtl871x_mp_c_
-#elif defined _RTL8712_CMD_C_
- #define _MODULE_DEFINE_ _module_rtl8712_cmd_c_
-#elif defined _RTL8712_XMIT_C_
- #define _MODULE_DEFINE_ _module_rtl8712_xmit_c_
-#elif defined _RTL8712_EFUSE_C_
- #define _MODULE_DEFINE_ _module_rtl8712_efuse_c_
-#elif defined _RTL8712_RECV_C_
- #define _MODULE_DEFINE_ _module_rtl8712_recv_c_
-#else
- #undef _MODULE_DEFINE_
-#endif
-
-#endif /*__RTL871X_DEBUG_H__*/
--- a/drivers/staging/rtl8712/rtl871x_eeprom.c
+++ /dev/null
@@ -1,220 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_eeprom.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL871X_EEPROM_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-static void up_clk(struct _adapter *padapter, u16 *x)
-{
- *x = *x | _EESK;
- r8712_write8(padapter, EE_9346CR, (u8)*x);
- udelay(CLOCK_RATE);
-}
-
-static void down_clk(struct _adapter *padapter, u16 *x)
-{
- *x = *x & ~_EESK;
- r8712_write8(padapter, EE_9346CR, (u8)*x);
- udelay(CLOCK_RATE);
-}
-
-static void shift_out_bits(struct _adapter *padapter, u16 data, u16 count)
-{
- u16 x, mask;
-
- if (padapter->surprise_removed)
- goto out;
- mask = 0x01 << (count - 1);
- x = r8712_read8(padapter, EE_9346CR);
- x &= ~(_EEDO | _EEDI);
- do {
- x &= ~_EEDI;
- if (data & mask)
- x |= _EEDI;
- if (padapter->surprise_removed)
- goto out;
- r8712_write8(padapter, EE_9346CR, (u8)x);
- udelay(CLOCK_RATE);
- up_clk(padapter, &x);
- down_clk(padapter, &x);
- mask >>= 1;
- } while (mask);
- if (padapter->surprise_removed)
- goto out;
- x &= ~_EEDI;
- r8712_write8(padapter, EE_9346CR, (u8)x);
-out:;
-}
-
-static u16 shift_in_bits(struct _adapter *padapter)
-{
- u16 x, d = 0, i;
-
- if (padapter->surprise_removed)
- goto out;
- x = r8712_read8(padapter, EE_9346CR);
- x &= ~(_EEDO | _EEDI);
- d = 0;
- for (i = 0; i < 16; i++) {
- d <<= 1;
- up_clk(padapter, &x);
- if (padapter->surprise_removed)
- goto out;
- x = r8712_read8(padapter, EE_9346CR);
- x &= ~(_EEDI);
- if (x & _EEDO)
- d |= 1;
- down_clk(padapter, &x);
- }
-out:
- return d;
-}
-
-static void standby(struct _adapter *padapter)
-{
- u8 x;
-
- x = r8712_read8(padapter, EE_9346CR);
- x &= ~(_EECS | _EESK);
- r8712_write8(padapter, EE_9346CR, x);
- udelay(CLOCK_RATE);
- x |= _EECS;
- r8712_write8(padapter, EE_9346CR, x);
- udelay(CLOCK_RATE);
-}
-
-static u16 wait_eeprom_cmd_done(struct _adapter *padapter)
-{
- u8 x;
- u16 i;
-
- standby(padapter);
- for (i = 0; i < 200; i++) {
- x = r8712_read8(padapter, EE_9346CR);
- if (x & _EEDO)
- return true;
- udelay(CLOCK_RATE);
- }
- return false;
-}
-
-static void eeprom_clean(struct _adapter *padapter)
-{
- u16 x;
-
- if (padapter->surprise_removed)
- return;
- x = r8712_read8(padapter, EE_9346CR);
- if (padapter->surprise_removed)
- return;
- x &= ~(_EECS | _EEDI);
- r8712_write8(padapter, EE_9346CR, (u8)x);
- if (padapter->surprise_removed)
- return;
- up_clk(padapter, &x);
- if (padapter->surprise_removed)
- return;
- down_clk(padapter, &x);
-}
-
-void r8712_eeprom_write16(struct _adapter *padapter, u16 reg, u16 data)
-{
- u8 x;
- u8 tmp8_ori, tmp8_new, tmp8_clk_ori, tmp8_clk_new;
-
- tmp8_ori = r8712_read8(padapter, 0x102502f1);
- tmp8_new = tmp8_ori & 0xf7;
- if (tmp8_ori != tmp8_new)
- r8712_write8(padapter, 0x102502f1, tmp8_new);
- tmp8_clk_ori = r8712_read8(padapter, 0x10250003);
- tmp8_clk_new = tmp8_clk_ori | 0x20;
- if (tmp8_clk_new != tmp8_clk_ori)
- r8712_write8(padapter, 0x10250003, tmp8_clk_new);
- x = r8712_read8(padapter, EE_9346CR);
- x &= ~(_EEDI | _EEDO | _EESK | _EEM0);
- x |= _EEM1 | _EECS;
- r8712_write8(padapter, EE_9346CR, x);
- shift_out_bits(padapter, EEPROM_EWEN_OPCODE, 5);
- if (padapter->eeprom_address_size == 8) /*CF+ and SDIO*/
- shift_out_bits(padapter, 0, 6);
- else /* USB */
- shift_out_bits(padapter, 0, 4);
- standby(padapter);
- /* Erase this particular word. Write the erase opcode and register
- * number in that order. The opcode is 3bits in length; reg is 6
- * bits long.
- */
- standby(padapter);
- /* write the new word to the EEPROM
- * send the write opcode the EEPORM
- */
- shift_out_bits(padapter, EEPROM_WRITE_OPCODE, 3);
- /* select which word in the EEPROM that we are writing to. */
- shift_out_bits(padapter, reg, padapter->eeprom_address_size);
- /* write the data to the selected EEPROM word. */
- shift_out_bits(padapter, data, 16);
- if (wait_eeprom_cmd_done(padapter)) {
- standby(padapter);
- shift_out_bits(padapter, EEPROM_EWDS_OPCODE, 5);
- shift_out_bits(padapter, reg, 4);
- eeprom_clean(padapter);
- }
- if (tmp8_clk_new != tmp8_clk_ori)
- r8712_write8(padapter, 0x10250003, tmp8_clk_ori);
- if (tmp8_new != tmp8_ori)
- r8712_write8(padapter, 0x102502f1, tmp8_ori);
-}
-
-u16 r8712_eeprom_read16(struct _adapter *padapter, u16 reg) /*ReadEEprom*/
-{
- u16 x;
- u16 data = 0;
- u8 tmp8_ori, tmp8_new, tmp8_clk_ori, tmp8_clk_new;
-
- tmp8_ori = r8712_read8(padapter, 0x102502f1);
- tmp8_new = tmp8_ori & 0xf7;
- if (tmp8_ori != tmp8_new)
- r8712_write8(padapter, 0x102502f1, tmp8_new);
- tmp8_clk_ori = r8712_read8(padapter, 0x10250003);
- tmp8_clk_new = tmp8_clk_ori | 0x20;
- if (tmp8_clk_new != tmp8_clk_ori)
- r8712_write8(padapter, 0x10250003, tmp8_clk_new);
- if (padapter->surprise_removed)
- goto out;
- /* select EEPROM, reset bits, set _EECS */
- x = r8712_read8(padapter, EE_9346CR);
- if (padapter->surprise_removed)
- goto out;
- x &= ~(_EEDI | _EEDO | _EESK | _EEM0);
- x |= _EEM1 | _EECS;
- r8712_write8(padapter, EE_9346CR, (unsigned char)x);
- /* write the read opcode and register number in that order
- * The opcode is 3bits in length, reg is 6 bits long
- */
- shift_out_bits(padapter, EEPROM_READ_OPCODE, 3);
- shift_out_bits(padapter, reg, padapter->eeprom_address_size);
- /* Now read the data (16 bits) in from the selected EEPROM word */
- data = shift_in_bits(padapter);
- eeprom_clean(padapter);
-out:
- if (tmp8_clk_new != tmp8_clk_ori)
- r8712_write8(padapter, 0x10250003, tmp8_clk_ori);
- if (tmp8_new != tmp8_ori)
- r8712_write8(padapter, 0x102502f1, tmp8_ori);
- return data;
-}
--- a/drivers/staging/rtl8712/rtl871x_eeprom.h
+++ /dev/null
@@ -1,88 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL871X_EEPROM_H__
-#define __RTL871X_EEPROM_H__
-
-#include "osdep_service.h"
-
-#define RTL8712_EEPROM_ID 0x8712
-#define EEPROM_MAX_SIZE 256
-#define CLOCK_RATE 50 /*100us*/
-
-/*- EEPROM opcodes*/
-#define EEPROM_READ_OPCODE 06
-#define EEPROM_WRITE_OPCODE 05
-#define EEPROM_ERASE_OPCODE 07
-#define EEPROM_EWEN_OPCODE 19 /* Erase/write enable*/
-#define EEPROM_EWDS_OPCODE 16 /* Erase/write disable*/
-
-#define EEPROM_CID_DEFAULT 0x0
-#define EEPROM_CID_ALPHA 0x1
-#define EEPROM_CID_Senao 0x3
-#define EEPROM_CID_NetCore 0x5
-#define EEPROM_CID_CAMEO 0X8
-#define EEPROM_CID_SITECOM 0x9
-#define EEPROM_CID_COREGA 0xB
-#define EEPROM_CID_EDIMAX_BELKIN 0xC
-#define EEPROM_CID_SERCOMM_BELKIN 0xE
-#define EEPROM_CID_CAMEO1 0xF
-#define EEPROM_CID_WNC_COREGA 0x12
-#define EEPROM_CID_CLEVO 0x13
-#define EEPROM_CID_WHQL 0xFE
-
-enum RT_CUSTOMER_ID {
- RT_CID_DEFAULT = 0,
- RT_CID_8187_ALPHA0 = 1,
- RT_CID_8187_SERCOMM_PS = 2,
- RT_CID_8187_HW_LED = 3,
- RT_CID_8187_NETGEAR = 4,
- RT_CID_WHQL = 5,
- RT_CID_819x_CAMEO = 6,
- RT_CID_819x_RUNTOP = 7,
- RT_CID_819x_Senao = 8,
- RT_CID_TOSHIBA = 9,
- RT_CID_819x_Netcore = 10,
- RT_CID_Nettronix = 11,
- RT_CID_DLINK = 12,
- RT_CID_PRONET = 13,
- RT_CID_COREGA = 14,
- RT_CID_819x_ALPHA = 15,
- RT_CID_819x_Sitecom = 16,
- RT_CID_CCX = 17,
- RT_CID_819x_Lenovo = 18,
- RT_CID_819x_QMI = 19,
- RT_CID_819x_Edimax_Belkin = 20,
- RT_CID_819x_Sercomm_Belkin = 21,
- RT_CID_819x_CAMEO1 = 22,
- RT_CID_819x_MSI = 23,
- RT_CID_819x_Acer = 24,
- RT_CID_819x_AzWave_ASUS = 25,
- RT_CID_819x_AzWave = 26,
- RT_CID_819x_WNC_COREGA = 27,
- RT_CID_819x_CLEVO = 28,
-};
-
-struct eeprom_priv {
- u8 bautoload_fail_flag;
- u8 bempty;
- u8 sys_config;
- u8 mac_addr[6];
- u8 config0;
- u16 channel_plan;
- u8 country_string[3];
- u8 tx_power_b[15];
- u8 tx_power_g[15];
- u8 tx_power_a[201];
- u8 efuse_eeprom_data[EEPROM_MAX_SIZE];
- enum RT_CUSTOMER_ID CustomerID;
-};
-
-void r8712_eeprom_write16(struct _adapter *padapter, u16 reg, u16 data);
-u16 r8712_eeprom_read16(struct _adapter *padapter, u16 reg);
-
-#endif /*__RTL871X_EEPROM_H__*/
-
--- a/drivers/staging/rtl8712/rtl871x_event.h
+++ /dev/null
@@ -1,109 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _RTL871x_EVENT_H_
-#define _RTL871x_EVENT_H_
-
-#include "osdep_service.h"
-
-#include "wlan_bssdef.h"
-#include <linux/semaphore.h>
-#include <linux/sem.h>
-
-/*
- * Used to report a bss has been scanned
- */
-struct survey_event {
- struct wlan_bssid_ex bss;
-};
-
-/*
- * Used to report that the requested site survey has been done.
- * bss_cnt indicates the number of bss that has been reported.
- */
-struct surveydone_event {
- unsigned int bss_cnt;
-
-};
-
-/*
- * Used to report the link result of joinning the given bss
- * join_res:
- * -1: authentication fail
- * -2: association fail
- * > 0: TID
- */
-struct joinbss_event {
- struct wlan_network network;
-};
-
-/*
- * Used to report a given STA has joinned the created BSS.
- * It is used in AP/Ad-HoC(M) mode.
- */
-struct stassoc_event {
- unsigned char macaddr[6];
- unsigned char rsvd[2];
- __le32 cam_id;
-};
-
-struct stadel_event {
- unsigned char macaddr[6];
- unsigned char rsvd[2];
-};
-
-struct addba_event {
- unsigned int tid;
-};
-
-#define GEN_EVT_CODE(event) event ## _EVT_
-
-struct fwevent {
- u32 parmsize;
- void (*event_callback)(struct _adapter *dev, u8 *pbuf);
-};
-
-#define C2HEVENT_SZ 32
-struct event_node {
- unsigned char *node;
- unsigned char evt_code;
- unsigned short evt_sz;
- /*volatile*/ int *caller_ff_tail;
- int caller_ff_sz;
-};
-
-struct c2hevent_queue {
- /*volatile*/ int head;
- /*volatile*/ int tail;
- struct event_node nodes[C2HEVENT_SZ];
- unsigned char seq;
-};
-
-#define NETWORK_QUEUE_SZ 4
-
-struct network_queue {
- /*volatile*/ int head;
- /*volatile*/ int tail;
- struct wlan_bssid_ex networks[NETWORK_QUEUE_SZ];
-};
-
-struct ADDBA_Req_Report_parm {
- unsigned char MacAddress[ETH_ALEN];
- unsigned short StartSeqNum;
- unsigned char tid;
-};
-
-#include "rtl8712_event.h"
-
-#endif /* _WLANEVENT_H_ */
-
--- a/drivers/staging/rtl8712/rtl871x_ht.h
+++ /dev/null
@@ -1,33 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _RTL871X_HT_H_
-#define _RTL871X_HT_H_
-
-#include "osdep_service.h"
-#include "wifi.h"
-
-struct ht_priv {
- unsigned int ht_option;
- unsigned int ampdu_enable;/*for enable Tx A-MPDU*/
- unsigned char baddbareq_issued[16];
- unsigned int tx_amsdu_enable;/*for enable Tx A-MSDU */
- unsigned int tx_amdsu_maxlen; /* 1: 8k, 0:4k ; default:8k, for tx */
- unsigned int rx_ampdu_maxlen; /* for rx reordering ctrl win_sz,
- * updated when join_callback.
- */
- struct ieee80211_ht_cap ht_cap;
-};
-
-#endif /*_RTL871X_HT_H_ */
-
--- a/drivers/staging/rtl8712/rtl871x_io.c
+++ /dev/null
@@ -1,147 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_io.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-/*
- *
- * The purpose of rtl871x_io.c
- *
- * a. provides the API
- * b. provides the protocol engine
- * c. provides the software interface between caller and the hardware interface
- *
- * For r8712u, both sync/async operations are provided.
- *
- * Only sync read/write_mem operations are provided.
- *
- */
-
-#define _RTL871X_IO_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "rtl871x_io.h"
-#include "osdep_intf.h"
-#include "usb_ops.h"
-
-static uint _init_intf_hdl(struct _adapter *padapter,
- struct intf_hdl *pintf_hdl)
-{
- struct intf_priv *pintf_priv;
- void (*set_intf_option)(u32 *poption) = NULL;
- void (*set_intf_funs)(struct intf_hdl *pintf_hdl);
- void (*set_intf_ops)(struct _io_ops *pops);
- uint (*init_intf_priv)(struct intf_priv *pintfpriv);
-
- set_intf_option = &(r8712_usb_set_intf_option);
- set_intf_funs = &(r8712_usb_set_intf_funs);
- set_intf_ops = &r8712_usb_set_intf_ops;
- init_intf_priv = &r8712_usb_init_intf_priv;
- pintf_priv = pintf_hdl->pintfpriv = kmalloc(sizeof(struct intf_priv),
- GFP_ATOMIC);
- if (!pintf_priv)
- goto _init_intf_hdl_fail;
- pintf_hdl->adapter = (u8 *)padapter;
- set_intf_option(&pintf_hdl->intf_option);
- set_intf_funs(pintf_hdl);
- set_intf_ops(&pintf_hdl->io_ops);
- pintf_priv->intf_dev = (u8 *)&padapter->dvobjpriv;
- if (init_intf_priv(pintf_priv) == _FAIL)
- goto _init_intf_hdl_fail;
- return _SUCCESS;
-_init_intf_hdl_fail:
- kfree(pintf_priv);
- return _FAIL;
-}
-
-static void _unload_intf_hdl(struct intf_priv *pintfpriv)
-{
- void (*unload_intf_priv)(struct intf_priv *pintfpriv);
-
- unload_intf_priv = &r8712_usb_unload_intf_priv;
- unload_intf_priv(pintfpriv);
- kfree(pintfpriv);
-}
-
-static uint register_intf_hdl(u8 *dev, struct intf_hdl *pintfhdl)
-{
- struct _adapter *adapter = (struct _adapter *)dev;
-
- pintfhdl->intf_option = 0;
- pintfhdl->adapter = dev;
- pintfhdl->intf_dev = (u8 *)&adapter->dvobjpriv;
- if (!_init_intf_hdl(adapter, pintfhdl))
- goto register_intf_hdl_fail;
- return _SUCCESS;
-register_intf_hdl_fail:
- return false;
-}
-
-static void unregister_intf_hdl(struct intf_hdl *pintfhdl)
-{
- _unload_intf_hdl(pintfhdl->pintfpriv);
- memset((u8 *)pintfhdl, 0, sizeof(struct intf_hdl));
-}
-
-uint r8712_alloc_io_queue(struct _adapter *adapter)
-{
- u32 i;
- struct io_queue *pio_queue;
- struct io_req *pio_req;
-
- pio_queue = kmalloc(sizeof(*pio_queue), GFP_ATOMIC);
- if (!pio_queue)
- goto alloc_io_queue_fail;
- INIT_LIST_HEAD(&pio_queue->free_ioreqs);
- INIT_LIST_HEAD(&pio_queue->processing);
- INIT_LIST_HEAD(&pio_queue->pending);
- spin_lock_init(&pio_queue->lock);
- pio_queue->pallocated_free_ioreqs_buf = kzalloc(NUM_IOREQ *
- (sizeof(struct io_req)) + 4,
- GFP_ATOMIC);
- if ((pio_queue->pallocated_free_ioreqs_buf) == NULL)
- goto alloc_io_queue_fail;
- pio_queue->free_ioreqs_buf = pio_queue->pallocated_free_ioreqs_buf + 4
- - ((addr_t)(pio_queue->pallocated_free_ioreqs_buf)
- & 3);
- pio_req = (struct io_req *)(pio_queue->free_ioreqs_buf);
- for (i = 0; i < NUM_IOREQ; i++) {
- INIT_LIST_HEAD(&pio_req->list);
- list_add_tail(&pio_req->list, &pio_queue->free_ioreqs);
- pio_req++;
- }
- if ((register_intf_hdl((u8 *)adapter, &pio_queue->intf)) == _FAIL)
- goto alloc_io_queue_fail;
- adapter->pio_queue = pio_queue;
- return _SUCCESS;
-alloc_io_queue_fail:
- if (pio_queue) {
- kfree(pio_queue->pallocated_free_ioreqs_buf);
- kfree(pio_queue);
- }
- adapter->pio_queue = NULL;
- return _FAIL;
-}
-
-void r8712_free_io_queue(struct _adapter *adapter)
-{
- struct io_queue *pio_queue = adapter->pio_queue;
-
- if (pio_queue) {
- kfree(pio_queue->pallocated_free_ioreqs_buf);
- adapter->pio_queue = NULL;
- unregister_intf_hdl(&pio_queue->intf);
- kfree(pio_queue);
- }
-}
--- a/drivers/staging/rtl8712/rtl871x_io.h
+++ /dev/null
@@ -1,236 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _RTL871X_IO_H_
-#define _RTL871X_IO_H_
-
-#include "osdep_service.h"
-#include "osdep_intf.h"
-
-#define NUM_IOREQ 8
-
-#define MAX_PROT_SZ (64-16)
-
-#define _IOREADY 0
-#define _IO_WAIT_COMPLETE 1
-#define _IO_WAIT_RSP 2
-
-/* IO COMMAND TYPE */
-#define _IOSZ_MASK_ (0x7F)
-#define _IO_WRITE_ BIT(7)
-#define _IO_FIXED_ BIT(8)
-#define _IO_BURST_ BIT(9)
-#define _IO_BYTE_ BIT(10)
-#define _IO_HW_ BIT(11)
-#define _IO_WORD_ BIT(12)
-#define _IO_SYNC_ BIT(13)
-#define _IO_CMDMASK_ (0x1F80)
-
-/*
- * For prompt mode accessing, caller shall free io_req
- * Otherwise, io_handler will free io_req
- */
-/* IO STATUS TYPE */
-#define _IO_ERR_ BIT(2)
-#define _IO_SUCCESS_ BIT(1)
-#define _IO_DONE_ BIT(0)
-#define IO_RD32 (_IO_SYNC_ | _IO_WORD_)
-#define IO_RD16 (_IO_SYNC_ | _IO_HW_)
-#define IO_RD8 (_IO_SYNC_ | _IO_BYTE_)
-#define IO_RD32_ASYNC (_IO_WORD_)
-#define IO_RD16_ASYNC (_IO_HW_)
-#define IO_RD8_ASYNC (_IO_BYTE_)
-#define IO_WR32 (_IO_WRITE_ | _IO_SYNC_ | _IO_WORD_)
-#define IO_WR16 (_IO_WRITE_ | _IO_SYNC_ | _IO_HW_)
-#define IO_WR8 (_IO_WRITE_ | _IO_SYNC_ | _IO_BYTE_)
-#define IO_WR32_ASYNC (_IO_WRITE_ | _IO_WORD_)
-#define IO_WR16_ASYNC (_IO_WRITE_ | _IO_HW_)
-#define IO_WR8_ASYNC (_IO_WRITE_ | _IO_BYTE_)
-/*
- * Only Sync. burst accessing is provided.
- */
-#define IO_WR_BURST(x) (IO_WRITE_ | _IO_SYNC_ | _IO_BURST_ | \
- ((x) & _IOSZ_MASK_))
-#define IO_RD_BURST(x) (_IO_SYNC_ | _IO_BURST_ | ((x) & _IOSZ_MASK_))
-/*below is for the intf_option bit defition...*/
-#define _INTF_ASYNC_ BIT(0) /*support async io*/
-struct intf_priv;
-struct intf_hdl;
-struct io_queue;
-struct _io_ops {
- uint (*_sdbus_read_bytes_to_membuf)(struct intf_priv *pintfpriv,
- u32 addr, u32 cnt, u8 *pbuf);
- uint (*_sdbus_read_blocks_to_membuf)(struct intf_priv *pintfpriv,
- u32 addr, u32 cnt, u8 *pbuf);
- u8 (*_read8)(struct intf_hdl *pintfhdl, u32 addr);
- u16 (*_read16)(struct intf_hdl *pintfhdl, u32 addr);
- u32 (*_read32)(struct intf_hdl *pintfhdl, u32 addr);
- uint (*_sdbus_write_blocks_from_membuf)(struct intf_priv *pintfpriv,
- u32 addr, u32 cnt, u8 *pbuf,
- u8 async);
- uint (*_sdbus_write_bytes_from_membuf)(struct intf_priv *pintfpriv,
- u32 addr, u32 cnt, u8 *pbuf);
- u8 (*_cmd52r)(struct intf_priv *pintfpriv, u32 addr);
- void (*_cmd52w)(struct intf_priv *pintfpriv, u32 addr, u8 val8);
- u8 (*_cmdfunc152r)(struct intf_priv *pintfpriv, u32 addr);
- void (*_cmdfunc152w)(struct intf_priv *pintfpriv, u32 addr, u8 val8);
- void (*_write8)(struct intf_hdl *pintfhdl, u32 addr, u8 val);
- void (*_write16)(struct intf_hdl *pintfhdl, u32 addr, u16 val);
- void (*_write32)(struct intf_hdl *pintfhdl, u32 addr, u32 val);
- void (*_read_mem)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt,
- u8 *pmem);
- void (*_write_mem)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt,
- u8 *pmem);
- void (*_sync_irp_protocol_rw)(struct io_queue *pio_q);
- u32 (*_read_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt,
- u8 *pmem);
- u32 (*_write_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt,
- u8 *pmem);
-};
-
-struct io_req {
- struct list_head list;
- u32 addr;
- /*volatile*/ u32 val;
- u32 command;
- u32 status;
- u8 *pbuf;
- void (*_async_io_callback)(struct _adapter *padapter,
- struct io_req *pio_req, u8 *cnxt);
- u8 *cnxt;
-};
-
-struct intf_hdl {
- u32 intf_option;
- u8 *adapter;
- u8 *intf_dev;
- struct intf_priv *pintfpriv;
- void (*intf_hdl_init)(u8 *priv);
- void (*intf_hdl_unload)(u8 *priv);
- void (*intf_hdl_open)(u8 *priv);
- void (*intf_hdl_close)(u8 *priv);
- struct _io_ops io_ops;
-};
-
-struct reg_protocol_rd {
-#ifdef __LITTLE_ENDIAN
- /* DW1 */
- u32 NumOfTrans:4;
- u32 Reserved1:4;
- u32 Reserved2:24;
- /* DW2 */
- u32 ByteCount:7;
- u32 WriteEnable:1; /*0:read, 1:write*/
- u32 FixOrContinuous:1; /*0:continuous, 1: Fix*/
- u32 BurstMode:1;
- u32 Byte1Access:1;
- u32 Byte2Access:1;
- u32 Byte4Access:1;
- u32 Reserved3:3;
- u32 Reserved4:16;
- /*DW3*/
- u32 BusAddress;
- /*DW4*/
-#else
-/*DW1*/
- u32 Reserved1:4;
- u32 NumOfTrans:4;
- u32 Reserved2:24;
- /*DW2*/
- u32 WriteEnable:1;
- u32 ByteCount:7;
- u32 Reserved3:3;
- u32 Byte4Access:1;
- u32 Byte2Access:1;
- u32 Byte1Access:1;
- u32 BurstMode:1;
- u32 FixOrContinuous:1;
- u32 Reserved4:16;
- /*DW3*/
- u32 BusAddress;
- /*DW4*/
-#endif
-};
-
-struct reg_protocol_wt {
-#ifdef __LITTLE_ENDIAN
- /*DW1*/
- u32 NumOfTrans:4;
- u32 Reserved1:4;
- u32 Reserved2:24;
- /*DW2*/
- u32 ByteCount:7;
- u32 WriteEnable:1; /*0:read, 1:write*/
- u32 FixOrContinuous:1; /*0:continuous, 1: Fix*/
- u32 BurstMode:1;
- u32 Byte1Access:1;
- u32 Byte2Access:1;
- u32 Byte4Access:1;
- u32 Reserved3:3;
- u32 Reserved4:16;
- /*DW3*/
- u32 BusAddress;
- /*DW4*/
- u32 Value;
-#else
- /*DW1*/
- u32 Reserved1:4;
- u32 NumOfTrans:4;
- u32 Reserved2:24;
- /*DW2*/
- u32 WriteEnable:1;
- u32 ByteCount:7;
- u32 Reserved3:3;
- u32 Byte4Access:1;
- u32 Byte2Access:1;
- u32 Byte1Access:1;
- u32 BurstMode:1;
- u32 FixOrContinuous:1;
- u32 Reserved4:16;
- /*DW3*/
- u32 BusAddress;
- /*DW4*/
- u32 Value;
-#endif
-};
-
-/*
- * Below is the data structure used by _io_handler
- */
-
-struct io_queue {
- spinlock_t lock;
- struct list_head free_ioreqs;
- /*The io_req list that will be served in the single protocol r/w.*/
- struct list_head pending;
- struct list_head processing;
- u8 *free_ioreqs_buf; /* 4-byte aligned */
- u8 *pallocated_free_ioreqs_buf;
- struct intf_hdl intf;
-};
-
-u8 r8712_read8(struct _adapter *adapter, u32 addr);
-u16 r8712_read16(struct _adapter *adapter, u32 addr);
-u32 r8712_read32(struct _adapter *adapter, u32 addr);
-void r8712_read_mem(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
-void r8712_read_port(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
-void r8712_write8(struct _adapter *adapter, u32 addr, u8 val);
-void r8712_write16(struct _adapter *adapter, u32 addr, u16 val);
-void r8712_write32(struct _adapter *adapter, u32 addr, u32 val);
-void r8712_write_mem(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
-void r8712_write_port(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
-/*ioreq */
-uint r8712_alloc_io_queue(struct _adapter *adapter);
-void r8712_free_io_queue(struct _adapter *adapter);
-
-#endif /*_RTL871X_IO_H_*/
--- a/drivers/staging/rtl8712/rtl871x_ioctl.h
+++ /dev/null
@@ -1,94 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef __IOCTL_H
-#define __IOCTL_H
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-#ifndef OID_802_11_CAPABILITY
- #define OID_802_11_CAPABILITY 0x0d010122
-#endif
-
-#ifndef OID_802_11_PMKID
- #define OID_802_11_PMKID 0x0d010123
-#endif
-
-/* For DDK-defined OIDs*/
-#define OID_NDIS_SEG1 0x00010100
-#define OID_NDIS_SEG2 0x00010200
-#define OID_NDIS_SEG3 0x00020100
-#define OID_NDIS_SEG4 0x01010100
-#define OID_NDIS_SEG5 0x01020100
-#define OID_NDIS_SEG6 0x01020200
-#define OID_NDIS_SEG7 0xFD010100
-#define OID_NDIS_SEG8 0x0D010100
-#define OID_NDIS_SEG9 0x0D010200
-#define OID_NDIS_SEG10 0x0D020200
-#define SZ_OID_NDIS_SEG1 23
-#define SZ_OID_NDIS_SEG2 3
-#define SZ_OID_NDIS_SEG3 6
-#define SZ_OID_NDIS_SEG4 6
-#define SZ_OID_NDIS_SEG5 4
-#define SZ_OID_NDIS_SEG6 8
-#define SZ_OID_NDIS_SEG7 7
-#define SZ_OID_NDIS_SEG8 36
-#define SZ_OID_NDIS_SEG9 24
-#define SZ_OID_NDIS_SEG10 19
-
-/* For Realtek-defined OIDs*/
-#define OID_MP_SEG1 0xFF871100
-#define OID_MP_SEG2 0xFF818000
-#define OID_MP_SEG3 0xFF818700
-#define OID_MP_SEG4 0xFF011100
-
-enum oid_type {
- QUERY_OID,
- SET_OID
-};
-
-struct oid_funs_node {
- unsigned int oid_start; /*the starting number for OID*/
- unsigned int oid_end; /*the ending number for OID*/
- struct oid_obj_priv *node_array;
- unsigned int array_sz; /*the size of node_array*/
- int query_counter; /*count the number of query hits for this segment*/
- int set_counter; /*count the number of set hits for this segment*/
-};
-
-struct oid_par_priv {
- void *adapter_context;
- uint oid;
- void *information_buf;
- unsigned long information_buf_len;
- unsigned long *bytes_rw;
- unsigned long *bytes_needed;
- enum oid_type type_of_oid;
- unsigned int dbg;
-};
-
-struct oid_obj_priv {
- unsigned char dbg; /* 0: without OID debug message
- * 1: with OID debug message
- */
- uint (*oidfuns)(struct oid_par_priv *poid_par_priv);
-};
-
-uint oid_null_function(struct oid_par_priv *poid_par_priv);
-
-extern struct iw_handler_def r871x_handlers_def;
-
-uint drv_query_info(struct net_device *MiniportAdapterContext,
- uint Oid,
- void *InformationBuffer,
- u32 InformationBufferLength,
- u32 *BytesWritten,
- u32 *BytesNeeded);
-
-uint drv_set_info(struct net_device *MiniportAdapterContext,
- uint Oid,
- void *InformationBuffer,
- u32 InformationBufferLength,
- u32 *BytesRead,
- u32 *BytesNeeded);
-
-#endif
--- a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
+++ /dev/null
@@ -1,2330 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_ioctl_linux.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL871X_IOCTL_LINUX_C_
-#define _RTL871X_MP_IOCTL_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "wlan_bssdef.h"
-#include "rtl871x_debug.h"
-#include "wifi.h"
-#include "rtl871x_mlme.h"
-#include "rtl871x_ioctl.h"
-#include "rtl871x_ioctl_set.h"
-#include "rtl871x_mp_ioctl.h"
-#include "mlme_osdep.h"
-#include <linux/wireless.h>
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/io.h>
-#include <linux/semaphore.h>
-#include <net/iw_handler.h>
-#include <linux/if_arp.h>
-#include <linux/etherdevice.h>
-
-#define RTL_IOCTL_WPA_SUPPLICANT (SIOCIWFIRSTPRIV + 0x1E)
-
-#define SCAN_ITEM_SIZE 768
-#define MAX_CUSTOM_LEN 64
-#define RATE_COUNT 4
-
-static const u32 rtl8180_rates[] = {1000000, 2000000, 5500000, 11000000,
- 6000000, 9000000, 12000000, 18000000,
- 24000000, 36000000, 48000000, 54000000};
-
-static const long ieee80211_wlan_frequencies[] = {
- 2412, 2417, 2422, 2427,
- 2432, 2437, 2442, 2447,
- 2452, 2457, 2462, 2467,
- 2472, 2484
-};
-
-void r8712_indicate_wx_assoc_event(struct _adapter *padapter)
-{
- union iwreq_data wrqu;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
- wrqu.ap_addr.sa_family = ARPHRD_ETHER;
- memcpy(wrqu.ap_addr.sa_data, pmlmepriv->cur_network.network.MacAddress,
- ETH_ALEN);
- wireless_send_event(padapter->pnetdev, SIOCGIWAP, &wrqu, NULL);
-}
-
-void r8712_indicate_wx_disassoc_event(struct _adapter *padapter)
-{
- union iwreq_data wrqu;
-
- wrqu.ap_addr.sa_family = ARPHRD_ETHER;
- eth_zero_addr(wrqu.ap_addr.sa_data);
- wireless_send_event(padapter->pnetdev, SIOCGIWAP, &wrqu, NULL);
-}
-
-static inline void handle_pairwise_key(struct sta_info *psta,
- struct ieee_param *param,
- struct _adapter *padapter)
-{
- /* pairwise key */
- memcpy(psta->x_UncstKey.skey, param->u.crypt.key,
- (param->u.crypt. key_len > 16 ? 16 : param->u.crypt.key_len));
- if (strcmp(param->u.crypt.alg, "TKIP") == 0) { /* set mic key */
- memcpy(psta->tkiptxmickey. skey,
- ¶m->u.crypt.key[16], 8);
- memcpy(psta->tkiprxmickey. skey,
- ¶m->u.crypt.key[24], 8);
- padapter->securitypriv. busetkipkey = false;
- mod_timer(&padapter->securitypriv.tkip_timer,
- jiffies + msecs_to_jiffies(50));
- }
- r8712_setstakey_cmd(padapter, (unsigned char *)psta, true);
-}
-
-static inline void handle_group_key(struct ieee_param *param,
- struct _adapter *padapter)
-{
- union Keytype *gk = padapter->securitypriv.XGrpKey;
- union Keytype *gtk = padapter->securitypriv.XGrptxmickey;
- union Keytype *grk = padapter->securitypriv.XGrprxmickey;
-
- if (param->u.crypt.idx > 0 &&
- param->u.crypt.idx < 3) {
- /* group key idx is 1 or 2 */
- memcpy(gk[param->u.crypt.idx - 1].skey,
- param->u.crypt.key,
- (param->u.crypt.key_len > 16 ? 16 :
- param->u.crypt.key_len));
- memcpy(gtk[param->u.crypt.idx - 1].skey,
- ¶m->u.crypt.key[16], 8);
- memcpy(grk[param->u.crypt.idx - 1].skey,
- ¶m->u.crypt.key[24], 8);
- padapter->securitypriv.binstallGrpkey = true;
- r8712_set_key(padapter, &padapter->securitypriv,
- param->u.crypt.idx);
- if (padapter->registrypriv.power_mgnt > PS_MODE_ACTIVE) {
- if (padapter->registrypriv.power_mgnt !=
- padapter->pwrctrlpriv.pwr_mode)
- mod_timer(&padapter->mlmepriv.dhcp_timer,
- jiffies + msecs_to_jiffies(60000));
- }
- }
-}
-
-static noinline_for_stack char *translate_scan_wpa(struct iw_request_info *info,
- struct wlan_network *pnetwork,
- struct iw_event *iwe,
- char *start, char *stop)
-{
- /* parsing WPA/WPA2 IE */
- u8 buf[MAX_WPA_IE_LEN];
- u8 wpa_ie[255], rsn_ie[255];
- u16 wpa_len = 0, rsn_len = 0;
- int n, i;
-
- r8712_get_sec_ie(pnetwork->network.IEs,
- pnetwork->network.IELength, rsn_ie, &rsn_len,
- wpa_ie, &wpa_len);
- if (wpa_len > 0) {
- memset(buf, 0, MAX_WPA_IE_LEN);
- n = sprintf(buf, "wpa_ie=");
- for (i = 0; i < wpa_len; i++) {
- n += scnprintf(buf + n, MAX_WPA_IE_LEN - n,
- "%02x", wpa_ie[i]);
- if (n == MAX_WPA_IE_LEN - 1)
- break;
- }
- memset(iwe, 0, sizeof(*iwe));
- iwe->cmd = IWEVCUSTOM;
- iwe->u.data.length = (u16)strlen(buf);
- start = iwe_stream_add_point(info, start, stop,
- iwe, buf);
- memset(iwe, 0, sizeof(*iwe));
- iwe->cmd = IWEVGENIE;
- iwe->u.data.length = (u16)wpa_len;
- start = iwe_stream_add_point(info, start, stop,
- iwe, wpa_ie);
- }
- if (rsn_len > 0) {
- memset(buf, 0, MAX_WPA_IE_LEN);
- n = sprintf(buf, "rsn_ie=");
- for (i = 0; i < rsn_len; i++) {
- n += scnprintf(buf + n, MAX_WPA_IE_LEN - n,
- "%02x", rsn_ie[i]);
- if (n == MAX_WPA_IE_LEN - 1)
- break;
- }
- memset(iwe, 0, sizeof(*iwe));
- iwe->cmd = IWEVCUSTOM;
- iwe->u.data.length = strlen(buf);
- start = iwe_stream_add_point(info, start, stop,
- iwe, buf);
- memset(iwe, 0, sizeof(*iwe));
- iwe->cmd = IWEVGENIE;
- iwe->u.data.length = rsn_len;
- start = iwe_stream_add_point(info, start, stop, iwe,
- rsn_ie);
- }
-
- return start;
-}
-
-static noinline_for_stack char *translate_scan_wps(struct iw_request_info *info,
- struct wlan_network *pnetwork,
- struct iw_event *iwe,
- char *start, char *stop)
-{
- /* parsing WPS IE */
- u8 wps_ie[512];
- uint wps_ielen;
-
- if (r8712_get_wps_ie(pnetwork->network.IEs,
- pnetwork->network.IELength,
- wps_ie, &wps_ielen)) {
- if (wps_ielen > 2) {
- iwe->cmd = IWEVGENIE;
- iwe->u.data.length = (u16)wps_ielen;
- start = iwe_stream_add_point(info, start, stop,
- iwe, wps_ie);
- }
- }
-
- return start;
-}
-
-static char *translate_scan(struct _adapter *padapter,
- struct iw_request_info *info,
- struct wlan_network *pnetwork,
- char *start, char *stop)
-{
- struct iw_event iwe;
- char *current_val;
- s8 *p;
- u32 i = 0, ht_ielen = 0;
- u16 cap, ht_cap = false;
- u8 rssi;
-
- if ((pnetwork->network.Configuration.DSConfig < 1) ||
- (pnetwork->network.Configuration.DSConfig > 14)) {
- if (pnetwork->network.Configuration.DSConfig < 1)
- pnetwork->network.Configuration.DSConfig = 1;
- else
- pnetwork->network.Configuration.DSConfig = 14;
- }
- /* AP MAC address */
- iwe.cmd = SIOCGIWAP;
- iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
- ether_addr_copy(iwe.u.ap_addr.sa_data, pnetwork->network.MacAddress);
- start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_ADDR_LEN);
- /* Add the ESSID */
- iwe.cmd = SIOCGIWESSID;
- iwe.u.data.flags = 1;
- iwe.u.data.length = min_t(u32, pnetwork->network.Ssid.SsidLength, 32);
- start = iwe_stream_add_point(info, start, stop, &iwe,
- pnetwork->network.Ssid.Ssid);
- /* parsing HT_CAP_IE */
- p = r8712_get_ie(&pnetwork->network.IEs[12], WLAN_EID_HT_CAPABILITY,
- &ht_ielen, pnetwork->network.IELength - 12);
- if (p && ht_ielen > 0)
- ht_cap = true;
- /* Add the protocol name */
- iwe.cmd = SIOCGIWNAME;
- if (r8712_is_cckratesonly_included(pnetwork->network.rates)) {
- if (ht_cap)
- snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11bn");
- else
- snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11b");
- } else if (r8712_is_cckrates_included(pnetwork->network.rates)) {
- if (ht_cap)
- snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11bgn");
- else
- snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11bg");
- } else {
- if (ht_cap)
- snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11gn");
- else
- snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11g");
- }
- start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_CHAR_LEN);
- /* Add mode */
- iwe.cmd = SIOCGIWMODE;
- memcpy((u8 *)&cap, r8712_get_capability_from_ie(pnetwork->network.IEs),
- 2);
- le16_to_cpus(&cap);
- if (cap & (WLAN_CAPABILITY_IBSS | WLAN_CAPABILITY_ESS)) {
- if (cap & WLAN_CAPABILITY_ESS)
- iwe.u.mode = (u32)IW_MODE_MASTER;
- else
- iwe.u.mode = (u32)IW_MODE_ADHOC;
- start = iwe_stream_add_event(info, start, stop, &iwe,
- IW_EV_UINT_LEN);
- }
- /* Add frequency/channel */
- iwe.cmd = SIOCGIWFREQ;
- {
- /* check legal index */
- u8 dsconfig = pnetwork->network.Configuration.DSConfig;
-
- if (dsconfig >= 1 && dsconfig <= sizeof(
- ieee80211_wlan_frequencies) / sizeof(long))
- iwe.u.freq.m =
- (s32)(ieee80211_wlan_frequencies
- [dsconfig - 1] * 100000);
- else
- iwe.u.freq.m = 0;
- }
- iwe.u.freq.e = (s16)1;
- iwe.u.freq.i = (u8)pnetwork->network.Configuration.DSConfig;
- start = iwe_stream_add_event(info, start, stop, &iwe,
- IW_EV_FREQ_LEN);
- /* Add encryption capability */
- iwe.cmd = SIOCGIWENCODE;
- if (cap & WLAN_CAPABILITY_PRIVACY)
- iwe.u.data.flags = (u16)(IW_ENCODE_ENABLED |
- IW_ENCODE_NOKEY);
- else
- iwe.u.data.flags = (u16)(IW_ENCODE_DISABLED);
- iwe.u.data.length = (u16)0;
- start = iwe_stream_add_point(info, start, stop, &iwe,
- pnetwork->network.Ssid.Ssid);
- /*Add basic and extended rates */
- current_val = start + iwe_stream_lcp_len(info);
- iwe.cmd = SIOCGIWRATE;
- iwe.u.bitrate.fixed = 0;
- iwe.u.bitrate.disabled = 0;
- iwe.u.bitrate.value = 0;
- i = 0;
- while (pnetwork->network.rates[i] != 0) {
- /* Bit rate given in 500 kb/s units */
- iwe.u.bitrate.value = (pnetwork->network.rates[i++] &
- 0x7F) * 500000;
- current_val = iwe_stream_add_value(info, start, current_val,
- stop, &iwe, IW_EV_PARAM_LEN);
- }
- /* Check if we added any event */
- if ((current_val - start) > iwe_stream_lcp_len(info))
- start = current_val;
-
- start = translate_scan_wpa(info, pnetwork, &iwe, start, stop);
-
- start = translate_scan_wps(info, pnetwork, &iwe, start, stop);
-
- /* Add quality statistics */
- iwe.cmd = IWEVQUAL;
- rssi = r8712_signal_scale_mapping(pnetwork->network.Rssi);
- /* we only update signal_level (signal strength) that is rssi. */
- iwe.u.qual.updated = (u8)(IW_QUAL_QUAL_INVALID | IW_QUAL_LEVEL_UPDATED |
- IW_QUAL_NOISE_INVALID);
- iwe.u.qual.level = rssi; /* signal strength */
- iwe.u.qual.qual = 0; /* signal quality */
- iwe.u.qual.noise = 0; /* noise level */
- start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_QUAL_LEN);
- /* how to translate rssi to ?% */
- return start;
-}
-
-static int wpa_set_auth_algs(struct net_device *dev, u32 value)
-{
- struct _adapter *padapter = netdev_priv(dev);
- int ret = 0;
-
- if ((value & AUTH_ALG_SHARED_KEY) && (value & AUTH_ALG_OPEN_SYSTEM)) {
- padapter->securitypriv.ndisencryptstatus =
- Ndis802_11Encryption1Enabled;
- padapter->securitypriv.ndisauthtype =
- Ndis802_11AuthModeAutoSwitch;
- padapter->securitypriv.AuthAlgrthm = 3;
- } else if (value & AUTH_ALG_SHARED_KEY) {
- padapter->securitypriv.ndisencryptstatus =
- Ndis802_11Encryption1Enabled;
- padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeShared;
- padapter->securitypriv.AuthAlgrthm = 1;
- } else if (value & AUTH_ALG_OPEN_SYSTEM) {
- if (padapter->securitypriv.ndisauthtype <
- Ndis802_11AuthModeWPAPSK) {
- padapter->securitypriv.ndisauthtype =
- Ndis802_11AuthModeOpen;
- padapter->securitypriv.AuthAlgrthm = 0;
- }
- } else {
- ret = -EINVAL;
- }
- return ret;
-}
-
-static int wpa_set_encryption(struct net_device *dev, struct ieee_param *param,
- u32 param_len)
-{
- int ret = 0;
- u32 wep_key_idx, wep_key_len = 0;
- struct NDIS_802_11_WEP *pwep = NULL;
- struct _adapter *padapter = netdev_priv(dev);
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct security_priv *psecuritypriv = &padapter->securitypriv;
-
- param->u.crypt.err = 0;
- param->u.crypt.alg[IEEE_CRYPT_ALG_NAME_LEN - 1] = '\0';
- if (param_len != (u32)((u8 *) param->u.crypt.key - (u8 *)param) +
- param->u.crypt.key_len)
- return -EINVAL;
- if (!is_broadcast_ether_addr(param->sta_addr))
- return -EINVAL;
-
- if (param->u.crypt.idx >= WEP_KEYS) {
- /* for large key indices, set the default (0) */
- param->u.crypt.idx = 0;
- }
- if (strcmp(param->u.crypt.alg, "WEP") == 0) {
- netdev_info(dev, "r8712u: %s: crypt.alg = WEP\n", __func__);
- padapter->securitypriv.ndisencryptstatus =
- Ndis802_11Encryption1Enabled;
- padapter->securitypriv.PrivacyAlgrthm = _WEP40_;
- padapter->securitypriv.XGrpPrivacy = _WEP40_;
- wep_key_idx = param->u.crypt.idx;
- wep_key_len = param->u.crypt.key_len;
- if (wep_key_idx >= WEP_KEYS)
- wep_key_idx = 0;
- if (wep_key_len <= 0)
- return -EINVAL;
-
- wep_key_len = wep_key_len <= 5 ? 5 : 13;
- pwep = kzalloc(sizeof(*pwep), GFP_ATOMIC);
- if (!pwep)
- return -ENOMEM;
- pwep->KeyLength = wep_key_len;
- pwep->Length = wep_key_len +
- offsetof(struct NDIS_802_11_WEP, KeyMaterial);
- if (wep_key_len == 13) {
- padapter->securitypriv.PrivacyAlgrthm = _WEP104_;
- padapter->securitypriv.XGrpPrivacy = _WEP104_;
- }
- pwep->KeyIndex = wep_key_idx;
- pwep->KeyIndex |= 0x80000000;
- memcpy(pwep->KeyMaterial, param->u.crypt.key, pwep->KeyLength);
- if (param->u.crypt.set_tx) {
- if (r8712_set_802_11_add_wep(padapter, pwep))
- ret = -EOPNOTSUPP;
- } else {
- /* don't update "psecuritypriv->PrivacyAlgrthm" and
- * "psecuritypriv->PrivacyKeyIndex=keyid", but can
- * r8712_set_key to fw/cam
- */
- if (wep_key_idx >= WEP_KEYS) {
- ret = -EOPNOTSUPP;
- goto exit;
- }
- memcpy(&psecuritypriv->DefKey[wep_key_idx].skey[0],
- pwep->KeyMaterial,
- pwep->KeyLength);
- psecuritypriv->DefKeylen[wep_key_idx] =
- pwep->KeyLength;
- r8712_set_key(padapter, psecuritypriv, wep_key_idx);
- }
- goto exit;
- }
- if (padapter->securitypriv.AuthAlgrthm == 2) { /* 802_1x */
- struct sta_info *psta, *pbcmc_sta;
- struct sta_priv *pstapriv = &padapter->stapriv;
- struct security_priv *spriv = &padapter->securitypriv;
-
- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE |
- WIFI_MP_STATE)) { /* sta mode */
- psta = r8712_get_stainfo(pstapriv,
- get_bssid(pmlmepriv));
- if (psta) {
- psta->ieee8021x_blocked = false;
- if (spriv->ndisencryptstatus ==
- Ndis802_11Encryption2Enabled ||
- spriv->ndisencryptstatus ==
- Ndis802_11Encryption3Enabled)
- psta->XPrivacy = spriv->PrivacyAlgrthm;
- if (param->u.crypt.set_tx == 1)
- handle_pairwise_key(psta, param,
- padapter);
- else /* group key */
- handle_group_key(param, padapter);
- }
- pbcmc_sta = r8712_get_bcmc_stainfo(padapter);
- if (pbcmc_sta) {
- pbcmc_sta->ieee8021x_blocked = false;
- if (spriv->ndisencryptstatus ==
- Ndis802_11Encryption2Enabled ||
- spriv->ndisencryptstatus ==
- Ndis802_11Encryption3Enabled)
- pbcmc_sta->XPrivacy =
- spriv->PrivacyAlgrthm;
- }
- }
- }
-exit:
- kfree(pwep);
- return ret;
-}
-
-static int r871x_set_wpa_ie(struct _adapter *padapter, char *pie,
- unsigned short ielen)
-{
- u8 *buf = NULL;
- int group_cipher = 0, pairwise_cipher = 0;
- int ret = 0;
-
- if (ielen > MAX_WPA_IE_LEN || !pie)
- return -EINVAL;
- if (ielen) {
- buf = kmemdup(pie, ielen, GFP_ATOMIC);
- if (!buf)
- return -ENOMEM;
- if (ielen < RSN_HEADER_LEN) {
- ret = -EINVAL;
- goto exit;
- }
- if (r8712_parse_wpa_ie(buf, ielen, &group_cipher,
- &pairwise_cipher) == 0) {
- padapter->securitypriv.AuthAlgrthm = 2;
- padapter->securitypriv.ndisauthtype =
- Ndis802_11AuthModeWPAPSK;
- }
- if (r8712_parse_wpa2_ie(buf, ielen, &group_cipher,
- &pairwise_cipher) == 0) {
- padapter->securitypriv.AuthAlgrthm = 2;
- padapter->securitypriv.ndisauthtype =
- Ndis802_11AuthModeWPA2PSK;
- }
- switch (group_cipher) {
- case WPA_CIPHER_NONE:
- padapter->securitypriv.XGrpPrivacy =
- _NO_PRIVACY_;
- padapter->securitypriv.ndisencryptstatus =
- Ndis802_11EncryptionDisabled;
- break;
- case WPA_CIPHER_WEP40:
- padapter->securitypriv.XGrpPrivacy = _WEP40_;
- padapter->securitypriv.ndisencryptstatus =
- Ndis802_11Encryption1Enabled;
- break;
- case WPA_CIPHER_TKIP:
- padapter->securitypriv.XGrpPrivacy = _TKIP_;
- padapter->securitypriv.ndisencryptstatus =
- Ndis802_11Encryption2Enabled;
- break;
- case WPA_CIPHER_CCMP:
- padapter->securitypriv.XGrpPrivacy = _AES_;
- padapter->securitypriv.ndisencryptstatus =
- Ndis802_11Encryption3Enabled;
- break;
- case WPA_CIPHER_WEP104:
- padapter->securitypriv.XGrpPrivacy = _WEP104_;
- padapter->securitypriv.ndisencryptstatus =
- Ndis802_11Encryption1Enabled;
- break;
- }
- switch (pairwise_cipher) {
- case WPA_CIPHER_NONE:
- padapter->securitypriv.PrivacyAlgrthm =
- _NO_PRIVACY_;
- padapter->securitypriv.ndisencryptstatus =
- Ndis802_11EncryptionDisabled;
- break;
- case WPA_CIPHER_WEP40:
- padapter->securitypriv.PrivacyAlgrthm = _WEP40_;
- padapter->securitypriv.ndisencryptstatus =
- Ndis802_11Encryption1Enabled;
- break;
- case WPA_CIPHER_TKIP:
- padapter->securitypriv.PrivacyAlgrthm = _TKIP_;
- padapter->securitypriv.ndisencryptstatus =
- Ndis802_11Encryption2Enabled;
- break;
- case WPA_CIPHER_CCMP:
- padapter->securitypriv.PrivacyAlgrthm = _AES_;
- padapter->securitypriv.ndisencryptstatus =
- Ndis802_11Encryption3Enabled;
- break;
- case WPA_CIPHER_WEP104:
- padapter->securitypriv.PrivacyAlgrthm = _WEP104_;
- padapter->securitypriv.ndisencryptstatus =
- Ndis802_11Encryption1Enabled;
- break;
- }
- padapter->securitypriv.wps_phase = false;
- {/* set wps_ie */
- u16 cnt = 0;
- u8 eid, wps_oui[4] = {0x0, 0x50, 0xf2, 0x04};
-
- while (cnt < ielen) {
- eid = buf[cnt];
-
- if ((eid == WLAN_EID_VENDOR_SPECIFIC) &&
- (!memcmp(&buf[cnt + 2], wps_oui, 4))) {
- netdev_info(padapter->pnetdev, "r8712u: SET WPS_IE\n");
- padapter->securitypriv.wps_ie_len =
- ((buf[cnt + 1] + 2) <
- (MAX_WPA_IE_LEN << 2)) ?
- (buf[cnt + 1] + 2) :
- (MAX_WPA_IE_LEN << 2);
- memcpy(padapter->securitypriv.wps_ie,
- &buf[cnt],
- padapter->securitypriv.wps_ie_len);
- padapter->securitypriv.wps_phase =
- true;
- netdev_info(padapter->pnetdev, "r8712u: SET WPS_IE, wps_phase==true\n");
- cnt += buf[cnt + 1] + 2;
- break;
- }
-
- cnt += buf[cnt + 1] + 2;
- }
- }
- }
-exit:
- kfree(buf);
- return ret;
-}
-
-static int r8711_wx_get_name(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- struct _adapter *padapter = netdev_priv(dev);
- u32 ht_ielen = 0;
- char *p;
- u8 ht_cap = false;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct wlan_bssid_ex *pcur_bss = &pmlmepriv->cur_network.network;
- u8 *prates;
-
- if (check_fwstate(pmlmepriv, _FW_LINKED | WIFI_ADHOC_MASTER_STATE) ==
- true) {
- /* parsing HT_CAP_IE */
- p = r8712_get_ie(&pcur_bss->IEs[12], WLAN_EID_HT_CAPABILITY,
- &ht_ielen, pcur_bss->IELength - 12);
- if (p && ht_ielen > 0)
- ht_cap = true;
- prates = pcur_bss->rates;
- if (r8712_is_cckratesonly_included(prates)) {
- if (ht_cap)
- snprintf(wrqu->name, IFNAMSIZ,
- "IEEE 802.11bn");
- else
- snprintf(wrqu->name, IFNAMSIZ,
- "IEEE 802.11b");
- } else if (r8712_is_cckrates_included(prates)) {
- if (ht_cap)
- snprintf(wrqu->name, IFNAMSIZ,
- "IEEE 802.11bgn");
- else
- snprintf(wrqu->name, IFNAMSIZ,
- "IEEE 802.11bg");
- } else {
- if (ht_cap)
- snprintf(wrqu->name, IFNAMSIZ,
- "IEEE 802.11gn");
- else
- snprintf(wrqu->name, IFNAMSIZ,
- "IEEE 802.11g");
- }
- } else {
- snprintf(wrqu->name, IFNAMSIZ, "unassociated");
- }
- return 0;
-}
-
-static const long frequency_list[] = {
- 2412, 2417, 2422, 2427, 2432, 2437, 2442, 2447, 2452, 2457, 2462,
- 2467, 2472, 2484, 4915, 4920, 4925, 4935, 4940, 4945, 4960, 4980,
- 5035, 5040, 5045, 5055, 5060, 5080, 5170, 5180, 5190, 5200, 5210,
- 5220, 5230, 5240, 5260, 5280, 5300, 5320, 5500, 5520, 5540, 5560,
- 5580, 5600, 5620, 5640, 5660, 5680, 5700, 5745, 5765, 5785, 5805,
- 5825
-};
-
-static int r8711_wx_set_freq(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- struct _adapter *padapter = netdev_priv(dev);
- struct iw_freq *fwrq = &wrqu->freq;
- int rc = 0;
-
-/* If setting by frequency, convert to a channel */
- if ((fwrq->e == 1) &&
- (fwrq->m >= 241200000) &&
- (fwrq->m <= 248700000)) {
- int f = fwrq->m / 100000;
- int c = 0;
-
- while ((c < 14) && (f != frequency_list[c]))
- c++;
- fwrq->e = 0;
- fwrq->m = c + 1;
- }
- /* Setting by channel number */
- if ((fwrq->m > 14) || (fwrq->e > 0)) {
- rc = -EOPNOTSUPP;
- } else {
- int channel = fwrq->m;
-
- if ((channel < 1) || (channel > 14)) {
- rc = -EINVAL;
- } else {
- /* Yes ! We can set it !!! */
- padapter->registrypriv.channel = channel;
- }
- }
- return rc;
-}
-
-static int r8711_wx_get_freq(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- struct _adapter *padapter = netdev_priv(dev);
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct wlan_bssid_ex *pcur_bss = &pmlmepriv->cur_network.network;
-
- if (!check_fwstate(pmlmepriv, _FW_LINKED))
- return -ENOLINK;
-
- wrqu->freq.m = ieee80211_wlan_frequencies[
- pcur_bss->Configuration.DSConfig - 1] * 100000;
- wrqu->freq.e = 1;
- wrqu->freq.i = pcur_bss->Configuration.DSConfig;
-
- return 0;
-}
-
-static int r8711_wx_set_mode(struct net_device *dev,
- struct iw_request_info *a,
- union iwreq_data *wrqu, char *b)
-{
- struct _adapter *padapter = netdev_priv(dev);
- enum NDIS_802_11_NETWORK_INFRASTRUCTURE networkType;
-
- switch (wrqu->mode) {
- case IW_MODE_AUTO:
- networkType = Ndis802_11AutoUnknown;
- break;
- case IW_MODE_ADHOC:
- networkType = Ndis802_11IBSS;
- break;
- case IW_MODE_MASTER:
- networkType = Ndis802_11APMode;
- break;
- case IW_MODE_INFRA:
- networkType = Ndis802_11Infrastructure;
- break;
- default:
- return -EINVAL;
- }
- if (Ndis802_11APMode == networkType)
- r8712_setopmode_cmd(padapter, networkType);
- else
- r8712_setopmode_cmd(padapter, Ndis802_11AutoUnknown);
-
- r8712_set_802_11_infrastructure_mode(padapter, networkType);
- return 0;
-}
-
-static int r8711_wx_get_mode(struct net_device *dev, struct iw_request_info *a,
- union iwreq_data *wrqu, char *b)
-{
- struct _adapter *padapter = netdev_priv(dev);
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE))
- wrqu->mode = IW_MODE_INFRA;
- else if (check_fwstate(pmlmepriv,
- WIFI_ADHOC_MASTER_STATE | WIFI_ADHOC_STATE))
- wrqu->mode = IW_MODE_ADHOC;
- else if (check_fwstate(pmlmepriv, WIFI_AP_STATE))
- wrqu->mode = IW_MODE_MASTER;
- else
- wrqu->mode = IW_MODE_AUTO;
- return 0;
-}
-
-static int r871x_wx_set_pmkid(struct net_device *dev,
- struct iw_request_info *a,
- union iwreq_data *wrqu, char *extra)
-{
- struct _adapter *padapter = netdev_priv(dev);
- struct security_priv *psecuritypriv = &padapter->securitypriv;
- struct iw_pmksa *pPMK = (struct iw_pmksa *) extra;
- struct RT_PMKID_LIST *pl = psecuritypriv->PMKIDList;
- u8 strZeroMacAddress[ETH_ALEN] = {0x00};
- u8 strIssueBssid[ETH_ALEN] = {0x00};
- u8 j, blInserted = false;
- int intReturn = false;
-
-/*
- * There are the BSSID information in the bssid.sa_data array.
- * If cmd is IW_PMKSA_FLUSH, it means the wpa_supplicant wants to clear
- * all the PMKID information. If cmd is IW_PMKSA_ADD, it means the
- * wpa_supplicant wants to add a PMKID/BSSID to driver.
- * If cmd is IW_PMKSA_REMOVE, it means the wpa_supplicant wants to
- * remove a PMKID/BSSID from driver.
- */
- if (!pPMK)
- return -EINVAL;
- memcpy(strIssueBssid, pPMK->bssid.sa_data, ETH_ALEN);
- switch (pPMK->cmd) {
- case IW_PMKSA_ADD:
- if (!memcmp(strIssueBssid, strZeroMacAddress, ETH_ALEN))
- return intReturn;
- intReturn = true;
- blInserted = false;
- /* overwrite PMKID */
- for (j = 0; j < NUM_PMKID_CACHE; j++) {
- if (!memcmp(pl[j].Bssid, strIssueBssid, ETH_ALEN)) {
- /* BSSID is matched, the same AP => rewrite
- * with new PMKID.
- */
- netdev_info(dev, "r8712u: %s: BSSID exists in the PMKList.\n",
- __func__);
- memcpy(pl[j].PMKID, pPMK->pmkid, IW_PMKID_LEN);
- pl[j].bUsed = true;
- psecuritypriv->PMKIDIndex = j + 1;
- blInserted = true;
- break;
- }
- }
- if (!blInserted) {
- /* Find a new entry */
- netdev_info(dev, "r8712u: %s: Use the new entry index = %d for this PMKID.\n",
- __func__, psecuritypriv->PMKIDIndex);
- memcpy(pl[psecuritypriv->PMKIDIndex].Bssid,
- strIssueBssid, ETH_ALEN);
- memcpy(pl[psecuritypriv->PMKIDIndex].PMKID,
- pPMK->pmkid, IW_PMKID_LEN);
- pl[psecuritypriv->PMKIDIndex].bUsed = true;
- psecuritypriv->PMKIDIndex++;
- if (psecuritypriv->PMKIDIndex == NUM_PMKID_CACHE)
- psecuritypriv->PMKIDIndex = 0;
- }
- break;
- case IW_PMKSA_REMOVE:
- intReturn = true;
- for (j = 0; j < NUM_PMKID_CACHE; j++) {
- if (!memcmp(pl[j].Bssid, strIssueBssid, ETH_ALEN)) {
- /* BSSID is matched, the same AP => Remove
- * this PMKID information and reset it.
- */
- eth_zero_addr(pl[j].Bssid);
- pl[j].bUsed = false;
- break;
- }
- }
- break;
- case IW_PMKSA_FLUSH:
- memset(psecuritypriv->PMKIDList, 0,
- sizeof(struct RT_PMKID_LIST) * NUM_PMKID_CACHE);
- psecuritypriv->PMKIDIndex = 0;
- intReturn = true;
- break;
- default:
- netdev_info(dev, "r8712u: %s: unknown Command\n", __func__);
- intReturn = false;
- break;
- }
- return intReturn;
-}
-
-static int r8711_wx_get_sens(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- wrqu->sens.value = 0;
- wrqu->sens.fixed = 0; /* no auto select */
- wrqu->sens.disabled = 1;
- return 0;
-}
-
-static int r8711_wx_get_range(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- struct iw_range *range = (struct iw_range *)extra;
- u16 val;
- int i;
-
- wrqu->data.length = sizeof(*range);
- memset(range, 0, sizeof(*range));
- /* Let's try to keep this struct in the same order as in
- * linux/include/wireless.h
- */
-
- /* TODO: See what values we can set, and remove the ones we can't
- * set, or fill them with some default data.
- */
- /* ~5 Mb/s real (802.11b) */
- range->throughput = 5 * 1000 * 1000;
- /* TODO: 8711 sensitivity ? */
- /* signal level threshold range */
- /* percent values between 0 and 100. */
- range->max_qual.qual = 100;
- range->max_qual.level = 100;
- range->max_qual.noise = 100;
- range->max_qual.updated = 7; /* Updated all three */
- range->avg_qual.qual = 92; /* > 8% missed beacons is 'bad' */
- /* TODO: Find real 'good' to 'bad' threshold value for RSSI */
- range->avg_qual.level = 0x100 - 78;
- range->avg_qual.noise = 0;
- range->avg_qual.updated = 7; /* Updated all three */
- range->num_bitrates = RATE_COUNT;
- for (i = 0; i < RATE_COUNT && i < IW_MAX_BITRATES; i++)
- range->bitrate[i] = rtl8180_rates[i];
- range->min_frag = MIN_FRAG_THRESHOLD;
- range->max_frag = MAX_FRAG_THRESHOLD;
- range->pm_capa = 0;
- range->we_version_compiled = WIRELESS_EXT;
- range->we_version_source = 16;
- range->num_channels = 14;
- for (i = 0, val = 0; i < 14; i++) {
- /* Include only legal frequencies for some countries */
- range->freq[val].i = i + 1;
- range->freq[val].m = ieee80211_wlan_frequencies[i] * 100000;
- range->freq[val].e = 1;
- val++;
- if (val == IW_MAX_FREQUENCIES)
- break;
- }
- range->num_frequency = val;
- range->enc_capa = IW_ENC_CAPA_WPA |
- IW_ENC_CAPA_WPA2 |
- IW_ENC_CAPA_CIPHER_TKIP |
- IW_ENC_CAPA_CIPHER_CCMP;
- return 0;
-}
-
-static int r8711_wx_get_rate(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra);
-
-static int r871x_wx_set_priv(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *awrq,
- char *extra)
-{
- int ret = 0, len = 0;
- char *ext;
- struct _adapter *padapter = netdev_priv(dev);
- struct iw_point *dwrq = (struct iw_point *)awrq;
-
- len = dwrq->length;
- ext = strndup_user(dwrq->pointer, len);
- if (IS_ERR(ext))
- return PTR_ERR(ext);
-
- if (!strcasecmp(ext, "RSSI")) {
- /*Return received signal strength indicator in -db for */
- /* current AP */
- /*<ssid> Rssi xx */
- struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
- struct wlan_network *pcur_network = &pmlmepriv->cur_network;
- /*static u8 xxxx; */
- if (check_fwstate(pmlmepriv, _FW_LINKED)) {
- sprintf(ext, "%s rssi %d",
- pcur_network->network.Ssid.Ssid,
- /*(xxxx=xxxx+10) */
- ((padapter->recvpriv.fw_rssi) >> 1) - 95
- /*pcur_network->network.Rssi */
- );
- } else {
- sprintf(ext, "OK");
- }
- } else if (!strcasecmp(ext, "LINKSPEED")) {
- /*Return link speed in MBPS */
- /*LinkSpeed xx */
- union iwreq_data wrqd;
- int ret_inner;
- int mbps;
-
- ret_inner = r8711_wx_get_rate(dev, info, &wrqd, extra);
- if (ret_inner != 0)
- mbps = 0;
- else
- mbps = wrqd.bitrate.value / 1000000;
- sprintf(ext, "LINKSPEED %d", mbps);
- } else if (!strcasecmp(ext, "MACADDR")) {
- /*Return mac address of the station */
- /* Macaddr = xx:xx:xx:xx:xx:xx */
- sprintf(ext, "MACADDR = %pM", dev->dev_addr);
- } else if (!strcasecmp(ext, "SCAN-ACTIVE")) {
- /*Set scan type to active */
- /*OK if successful */
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
- pmlmepriv->passive_mode = 1;
- sprintf(ext, "OK");
- } else if (!strcasecmp(ext, "SCAN-PASSIVE")) {
- /*Set scan type to passive */
- /*OK if successful */
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
- pmlmepriv->passive_mode = 0;
- sprintf(ext, "OK");
- } else if (!strncmp(ext, "DCE-E", 5)) {
- /*Set scan type to passive */
- /*OK if successful */
- r8712_disconnectCtrlEx_cmd(padapter
- , 1 /*u32 enableDrvCtrl */
- , 5 /*u32 tryPktCnt */
- , 100 /*u32 tryPktInterval */
- , 5000 /*u32 firstStageTO */
- );
- sprintf(ext, "OK");
- } else if (!strncmp(ext, "DCE-D", 5)) {
- /*Set scan type to passive */
- /*OK if successfu */
- r8712_disconnectCtrlEx_cmd(padapter
- , 0 /*u32 enableDrvCtrl */
- , 5 /*u32 tryPktCnt */
- , 100 /*u32 tryPktInterval */
- , 5000 /*u32 firstStageTO */
- );
- sprintf(ext, "OK");
- } else {
- netdev_info(dev, "r8712u: %s: unknown Command %s.\n",
- __func__, ext);
- goto FREE_EXT;
- }
- if (copy_to_user(dwrq->pointer, ext,
- min(dwrq->length, (__u16)(strlen(ext) + 1))))
- ret = -EFAULT;
-
-FREE_EXT:
- kfree(ext);
- return ret;
-}
-
-/* set bssid flow
- * s1. set_802_11_infrastructure_mode()
- * s2. set_802_11_authentication_mode()
- * s3. set_802_11_encryption_mode()
- * s4. set_802_11_bssid()
- *
- * This function intends to handle the Set AP command, which specifies the
- * MAC# of a preferred Access Point.
- * Currently, the request comes via Wireless Extensions' SIOCSIWAP ioctl.
- *
- * For this operation to succeed, there is no need for the interface to be up.
- *
- */
-static int r8711_wx_set_wap(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *awrq,
- char *extra)
-{
- int ret = -EINPROGRESS;
- struct _adapter *padapter = netdev_priv(dev);
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct __queue *queue = &pmlmepriv->scanned_queue;
- struct sockaddr *temp = (struct sockaddr *)awrq;
- unsigned long irqL;
- struct list_head *phead;
- u8 *dst_bssid;
- struct wlan_network *pnetwork = NULL;
- enum NDIS_802_11_AUTHENTICATION_MODE authmode;
-
- if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY))
- return -EBUSY;
- if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING))
- return ret;
- if (temp->sa_family != ARPHRD_ETHER)
- return -EINVAL;
- authmode = padapter->securitypriv.ndisauthtype;
- spin_lock_irqsave(&queue->lock, irqL);
- phead = &queue->queue;
- pmlmepriv->pscanned = phead->next;
- while (1) {
- if (end_of_queue_search(phead, pmlmepriv->pscanned))
- break;
- pnetwork = container_of(pmlmepriv->pscanned,
- struct wlan_network, list);
- pmlmepriv->pscanned = pmlmepriv->pscanned->next;
- dst_bssid = pnetwork->network.MacAddress;
- if (!memcmp(dst_bssid, temp->sa_data, ETH_ALEN)) {
- r8712_set_802_11_infrastructure_mode(padapter,
- pnetwork->network.InfrastructureMode);
- break;
- }
- }
- spin_unlock_irqrestore(&queue->lock, irqL);
- if (!ret) {
- if (!r8712_set_802_11_authentication_mode(padapter, authmode)) {
- ret = -ENOMEM;
- } else {
- if (!r8712_set_802_11_bssid(padapter, temp->sa_data))
- ret = -1;
- }
- }
- return ret;
-}
-
-static int r8711_wx_get_wap(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- struct _adapter *padapter = netdev_priv(dev);
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct wlan_bssid_ex *pcur_bss = &pmlmepriv->cur_network.network;
-
- wrqu->ap_addr.sa_family = ARPHRD_ETHER;
- if (check_fwstate(pmlmepriv, _FW_LINKED | WIFI_ADHOC_MASTER_STATE |
- WIFI_AP_STATE))
- ether_addr_copy(wrqu->ap_addr.sa_data, pcur_bss->MacAddress);
- else
- eth_zero_addr(wrqu->ap_addr.sa_data);
- return 0;
-}
-
-static int r871x_wx_set_mlme(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- int ret = 0;
- struct _adapter *padapter = netdev_priv(dev);
- struct iw_mlme *mlme = (struct iw_mlme *) extra;
-
- if (!mlme)
- return -1;
- switch (mlme->cmd) {
- case IW_MLME_DEAUTH:
- if (!r8712_set_802_11_disassociate(padapter))
- ret = -1;
- break;
- case IW_MLME_DISASSOC:
- if (!r8712_set_802_11_disassociate(padapter))
- ret = -1;
- break;
- default:
- return -EOPNOTSUPP;
- }
- return ret;
-}
-
-/*
- *
- * This function intends to handle the Set Scan command.
- * Currently, the request comes via Wireless Extensions' SIOCSIWSCAN ioctl.
- *
- * For this operation to succeed, the interface is brought Up beforehand.
- *
- */
-static int r8711_wx_set_scan(struct net_device *dev,
- struct iw_request_info *a,
- union iwreq_data *wrqu, char *extra)
-{
- struct _adapter *padapter = netdev_priv(dev);
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- u8 status = true;
-
- if (padapter->driver_stopped) {
- netdev_info(dev, "In %s: driver_stopped=%d\n",
- __func__, padapter->driver_stopped);
- return -1;
- }
- if (!padapter->bup)
- return -ENETDOWN;
- if (!padapter->hw_init_completed)
- return -1;
- if ((check_fwstate(pmlmepriv, _FW_UNDER_SURVEY | _FW_UNDER_LINKING)) ||
- (pmlmepriv->sitesurveyctrl.traffic_busy))
- return 0;
- if (wrqu->data.length == sizeof(struct iw_scan_req)) {
- struct iw_scan_req *req = (struct iw_scan_req *)extra;
-
- if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
- struct ndis_802_11_ssid ssid;
- unsigned long irqL;
- u32 len = min_t(u8, req->essid_len, IW_ESSID_MAX_SIZE);
-
- memset((unsigned char *)&ssid, 0,
- sizeof(struct ndis_802_11_ssid));
- memcpy(ssid.Ssid, req->essid, len);
- ssid.SsidLength = len;
- spin_lock_irqsave(&pmlmepriv->lock, irqL);
- if ((check_fwstate(pmlmepriv, _FW_UNDER_SURVEY |
- _FW_UNDER_LINKING)) ||
- (pmlmepriv->sitesurveyctrl.traffic_busy)) {
- if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING))
- status = false;
- } else {
- status = r8712_sitesurvey_cmd(padapter, &ssid);
- }
- spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
- }
- } else {
- status = r8712_set_802_11_bssid_list_scan(padapter);
- }
- if (!status)
- return -1;
- return 0;
-}
-
-static int r8711_wx_get_scan(struct net_device *dev,
- struct iw_request_info *a,
- union iwreq_data *wrqu, char *extra)
-{
- struct _adapter *padapter = netdev_priv(dev);
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct __queue *queue = &pmlmepriv->scanned_queue;
- struct wlan_network *pnetwork = NULL;
- unsigned long irqL;
- struct list_head *plist, *phead;
- char *ev = extra;
- char *stop = ev + wrqu->data.length;
- u32 ret = 0, cnt = 0;
-
- if (padapter->driver_stopped)
- return -EINVAL;
- while (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY |
- _FW_UNDER_LINKING)) {
- msleep(30);
- cnt++;
- if (cnt > 100)
- break;
- }
- spin_lock_irqsave(&queue->lock, irqL);
- phead = &queue->queue;
- plist = phead->next;
- while (1) {
- if (end_of_queue_search(phead, plist))
- break;
- if ((stop - ev) < SCAN_ITEM_SIZE) {
- ret = -E2BIG;
- break;
- }
- pnetwork = container_of(plist, struct wlan_network, list);
- ev = translate_scan(padapter, a, pnetwork, ev, stop);
- plist = plist->next;
- }
- spin_unlock_irqrestore(&queue->lock, irqL);
- wrqu->data.length = ev - extra;
- wrqu->data.flags = 0;
- return ret;
-}
-
-/* set ssid flow
- * s1. set_802_11_infrastructure_mode()
- * s2. set_802_11_authenticaion_mode()
- * s3. set_802_11_encryption_mode()
- * s4. set_802_11_ssid()
- *
- * This function intends to handle the Set ESSID command.
- * Currently, the request comes via the Wireless Extensions' SIOCSIWESSID ioctl.
- *
- * For this operation to succeed, there is no need for the interface to be Up.
- *
- */
-static int r8711_wx_set_essid(struct net_device *dev,
- struct iw_request_info *a,
- union iwreq_data *wrqu, char *extra)
-{
- struct _adapter *padapter = netdev_priv(dev);
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct __queue *queue = &pmlmepriv->scanned_queue;
- struct wlan_network *pnetwork = NULL;
- enum NDIS_802_11_AUTHENTICATION_MODE authmode;
- struct ndis_802_11_ssid ndis_ssid;
- u8 *dst_ssid, *src_ssid;
- struct list_head *phead;
- u32 len;
-
- if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY))
- return -EBUSY;
- if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING))
- return 0;
- if (wrqu->essid.length > IW_ESSID_MAX_SIZE)
- return -E2BIG;
- authmode = padapter->securitypriv.ndisauthtype;
- if (wrqu->essid.flags && wrqu->essid.length) {
- len = (wrqu->essid.length < IW_ESSID_MAX_SIZE) ?
- wrqu->essid.length : IW_ESSID_MAX_SIZE;
- memset(&ndis_ssid, 0, sizeof(struct ndis_802_11_ssid));
- ndis_ssid.SsidLength = len;
- memcpy(ndis_ssid.Ssid, extra, len);
- src_ssid = ndis_ssid.Ssid;
- phead = &queue->queue;
- pmlmepriv->pscanned = phead->next;
- while (1) {
- if (end_of_queue_search(phead, pmlmepriv->pscanned))
- break;
- pnetwork = container_of(pmlmepriv->pscanned,
- struct wlan_network, list);
- pmlmepriv->pscanned = pmlmepriv->pscanned->next;
- dst_ssid = pnetwork->network.Ssid.Ssid;
- if ((!memcmp(dst_ssid, src_ssid, ndis_ssid.SsidLength))
- && (pnetwork->network.Ssid.SsidLength ==
- ndis_ssid.SsidLength)) {
- if (check_fwstate(pmlmepriv,
- WIFI_ADHOC_STATE)) {
- if (pnetwork->network.
- InfrastructureMode
- !=
- padapter->mlmepriv.
- cur_network.network.
- InfrastructureMode)
- continue;
- }
-
- r8712_set_802_11_infrastructure_mode(
- padapter,
- pnetwork->network.InfrastructureMode);
- break;
- }
- }
- r8712_set_802_11_authentication_mode(padapter, authmode);
- r8712_set_802_11_ssid(padapter, &ndis_ssid);
- }
- return -EINPROGRESS;
-}
-
-static int r8711_wx_get_essid(struct net_device *dev,
- struct iw_request_info *a,
- union iwreq_data *wrqu, char *extra)
-{
- struct _adapter *padapter = netdev_priv(dev);
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct wlan_bssid_ex *pcur_bss = &pmlmepriv->cur_network.network;
- u32 len, ret = 0;
-
- if (check_fwstate(pmlmepriv, _FW_LINKED | WIFI_ADHOC_MASTER_STATE)) {
- len = pcur_bss->Ssid.SsidLength;
- wrqu->essid.length = len;
- memcpy(extra, pcur_bss->Ssid.Ssid, len);
- wrqu->essid.flags = 1;
- } else {
- ret = -ENOLINK;
- }
- return ret;
-}
-
-static int r8711_wx_set_rate(struct net_device *dev,
- struct iw_request_info *a,
- union iwreq_data *wrqu, char *extra)
-{
- struct _adapter *padapter = netdev_priv(dev);
- u32 target_rate = wrqu->bitrate.value;
- u32 fixed = wrqu->bitrate.fixed;
- u32 ratevalue = 0;
- u8 datarates[NumRates];
- u8 mpdatarate[NumRates] = {11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0, 0xff};
- int i;
-
- if (target_rate == -1) {
- ratevalue = 11;
- goto set_rate;
- }
- target_rate = target_rate / 100000;
- switch (target_rate) {
- case 10:
- ratevalue = 0;
- break;
- case 20:
- ratevalue = 1;
- break;
- case 55:
- ratevalue = 2;
- break;
- case 60:
- ratevalue = 3;
- break;
- case 90:
- ratevalue = 4;
- break;
- case 110:
- ratevalue = 5;
- break;
- case 120:
- ratevalue = 6;
- break;
- case 180:
- ratevalue = 7;
- break;
- case 240:
- ratevalue = 8;
- break;
- case 360:
- ratevalue = 9;
- break;
- case 480:
- ratevalue = 10;
- break;
- case 540:
- ratevalue = 11;
- break;
- default:
- ratevalue = 11;
- break;
- }
-set_rate:
- for (i = 0; i < NumRates; i++) {
- if (ratevalue == mpdatarate[i]) {
- datarates[i] = mpdatarate[i];
- if (fixed == 0)
- break;
- } else {
- datarates[i] = 0xff;
- }
- }
- return r8712_setdatarate_cmd(padapter, datarates);
-}
-
-static int r8711_wx_get_rate(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- struct _adapter *padapter = netdev_priv(dev);
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct wlan_bssid_ex *pcur_bss = &pmlmepriv->cur_network.network;
- struct ieee80211_ht_cap *pht_capie;
- unsigned char rf_type = padapter->registrypriv.rf_config;
- int i;
- u8 *p;
- u16 rate, max_rate = 0, ht_cap = false;
- u32 ht_ielen = 0;
- u8 bw_40MHz = 0, short_GI = 0;
- u16 mcs_rate = 0;
-
- i = 0;
- if (!check_fwstate(pmlmepriv, _FW_LINKED | WIFI_ADHOC_MASTER_STATE))
- return -ENOLINK;
- p = r8712_get_ie(&pcur_bss->IEs[12], WLAN_EID_HT_CAPABILITY, &ht_ielen,
- pcur_bss->IELength - 12);
- if (p && ht_ielen > 0) {
- ht_cap = true;
- pht_capie = (struct ieee80211_ht_cap *)(p + 2);
- memcpy(&mcs_rate, &pht_capie->mcs, 2);
- bw_40MHz = (le16_to_cpu(pht_capie->cap_info) &
- IEEE80211_HT_CAP_SUP_WIDTH_20_40) ? 1 : 0;
- short_GI = (le16_to_cpu(pht_capie->cap_info) &
- (IEEE80211_HT_CAP_SGI_20 |
- IEEE80211_HT_CAP_SGI_40)) ? 1 : 0;
- }
- while ((pcur_bss->rates[i] != 0) &&
- (pcur_bss->rates[i] != 0xFF)) {
- rate = pcur_bss->rates[i] & 0x7F;
- if (rate > max_rate)
- max_rate = rate;
- wrqu->bitrate.fixed = 0; /* no auto select */
- wrqu->bitrate.value = rate * 500000;
- i++;
- }
- if (ht_cap) {
- if (mcs_rate & 0x8000 /* MCS15 */
- &&
- rf_type == RTL8712_RF_2T2R)
- max_rate = (bw_40MHz) ? ((short_GI) ? 300 : 270) :
- ((short_GI) ? 144 : 130);
- else /* default MCS7 */
- max_rate = (bw_40MHz) ? ((short_GI) ? 150 : 135) :
- ((short_GI) ? 72 : 65);
- max_rate *= 2; /* Mbps/2 */
- }
- wrqu->bitrate.value = max_rate * 500000;
- return 0;
-}
-
-static int r8711_wx_get_rts(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- struct _adapter *padapter = netdev_priv(dev);
-
- wrqu->rts.value = padapter->registrypriv.rts_thresh;
- wrqu->rts.fixed = 0; /* no auto select */
- return 0;
-}
-
-static int r8711_wx_set_frag(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- struct _adapter *padapter = netdev_priv(dev);
-
- if (wrqu->frag.disabled) {
- padapter->xmitpriv.frag_len = MAX_FRAG_THRESHOLD;
- } else {
- if (wrqu->frag.value < MIN_FRAG_THRESHOLD ||
- wrqu->frag.value > MAX_FRAG_THRESHOLD)
- return -EINVAL;
- padapter->xmitpriv.frag_len = wrqu->frag.value & ~0x1;
- }
- return 0;
-}
-
-static int r8711_wx_get_frag(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- struct _adapter *padapter = netdev_priv(dev);
-
- wrqu->frag.value = padapter->xmitpriv.frag_len;
- wrqu->frag.fixed = 0; /* no auto select */
- return 0;
-}
-
-static int r8711_wx_get_retry(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- wrqu->retry.value = 7;
- wrqu->retry.fixed = 0; /* no auto select */
- wrqu->retry.disabled = 1;
- return 0;
-}
-
-static int r8711_wx_set_enc(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *keybuf)
-{
- u32 key;
- u32 keyindex_provided;
- struct NDIS_802_11_WEP wep;
- enum NDIS_802_11_AUTHENTICATION_MODE authmode;
- struct iw_point *erq = &wrqu->encoding;
- struct _adapter *padapter = netdev_priv(dev);
-
- key = erq->flags & IW_ENCODE_INDEX;
- memset(&wep, 0, sizeof(struct NDIS_802_11_WEP));
- if (erq->flags & IW_ENCODE_DISABLED) {
- netdev_info(dev, "r8712u: %s: EncryptionDisabled\n", __func__);
- padapter->securitypriv.ndisencryptstatus =
- Ndis802_11EncryptionDisabled;
- padapter->securitypriv.PrivacyAlgrthm = _NO_PRIVACY_;
- padapter->securitypriv.XGrpPrivacy = _NO_PRIVACY_;
- padapter->securitypriv.AuthAlgrthm = 0; /* open system */
- authmode = Ndis802_11AuthModeOpen;
- padapter->securitypriv.ndisauthtype = authmode;
- return 0;
- }
- if (key) {
- if (key > WEP_KEYS)
- return -EINVAL;
- key--;
- keyindex_provided = 1;
- } else {
- keyindex_provided = 0;
- key = padapter->securitypriv.PrivacyKeyIndex;
- }
- /* set authentication mode */
- if (erq->flags & IW_ENCODE_OPEN) {
- netdev_info(dev, "r8712u: %s: IW_ENCODE_OPEN\n", __func__);
- padapter->securitypriv.ndisencryptstatus =
- Ndis802_11Encryption1Enabled;
- padapter->securitypriv.AuthAlgrthm = 0; /* open system */
- padapter->securitypriv.PrivacyAlgrthm = _NO_PRIVACY_;
- padapter->securitypriv.XGrpPrivacy = _NO_PRIVACY_;
- authmode = Ndis802_11AuthModeOpen;
- padapter->securitypriv.ndisauthtype = authmode;
- } else if (erq->flags & IW_ENCODE_RESTRICTED) {
- netdev_info(dev,
- "r8712u: %s: IW_ENCODE_RESTRICTED\n", __func__);
- padapter->securitypriv.ndisencryptstatus =
- Ndis802_11Encryption1Enabled;
- padapter->securitypriv.AuthAlgrthm = 1; /* shared system */
- padapter->securitypriv.PrivacyAlgrthm = _WEP40_;
- padapter->securitypriv.XGrpPrivacy = _WEP40_;
- authmode = Ndis802_11AuthModeShared;
- padapter->securitypriv.ndisauthtype = authmode;
- } else {
- padapter->securitypriv.ndisencryptstatus =
- Ndis802_11Encryption1Enabled;
- padapter->securitypriv.AuthAlgrthm = 0; /* open system */
- padapter->securitypriv.PrivacyAlgrthm = _NO_PRIVACY_;
- padapter->securitypriv.XGrpPrivacy = _NO_PRIVACY_;
- authmode = Ndis802_11AuthModeOpen;
- padapter->securitypriv.ndisauthtype = authmode;
- }
- wep.KeyIndex = key;
- if (erq->length > 0) {
- wep.KeyLength = erq->length <= 5 ? 5 : 13;
- wep.Length = wep.KeyLength +
- offsetof(struct NDIS_802_11_WEP, KeyMaterial);
- } else {
- wep.KeyLength = 0;
- if (keyindex_provided == 1) { /* set key_id only, no given
- * KeyMaterial(erq->length==0).
- */
- padapter->securitypriv.PrivacyKeyIndex = key;
- switch (padapter->securitypriv.DefKeylen[key]) {
- case 5:
- padapter->securitypriv.PrivacyAlgrthm =
- _WEP40_;
- break;
- case 13:
- padapter->securitypriv.PrivacyAlgrthm =
- _WEP104_;
- break;
- default:
- padapter->securitypriv.PrivacyAlgrthm =
- _NO_PRIVACY_;
- break;
- }
- return 0;
- }
- }
- wep.KeyIndex |= 0x80000000; /* transmit key */
- memcpy(wep.KeyMaterial, keybuf, wep.KeyLength);
- if (r8712_set_802_11_add_wep(padapter, &wep))
- return -EOPNOTSUPP;
- return 0;
-}
-
-static int r8711_wx_get_enc(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *keybuf)
-{
- uint key;
- struct _adapter *padapter = netdev_priv(dev);
- struct iw_point *erq = &wrqu->encoding;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- union Keytype *dk = padapter->securitypriv.DefKey;
-
- if (!check_fwstate(pmlmepriv, _FW_LINKED)) {
- if (!check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) {
- erq->length = 0;
- erq->flags |= IW_ENCODE_DISABLED;
- return 0;
- }
- }
- key = erq->flags & IW_ENCODE_INDEX;
- if (key) {
- if (key > WEP_KEYS)
- return -EINVAL;
- key--;
- } else {
- key = padapter->securitypriv.PrivacyKeyIndex;
- }
- erq->flags = key + 1;
- switch (padapter->securitypriv.ndisencryptstatus) {
- case Ndis802_11EncryptionNotSupported:
- case Ndis802_11EncryptionDisabled:
- erq->length = 0;
- erq->flags |= IW_ENCODE_DISABLED;
- break;
- case Ndis802_11Encryption1Enabled:
- erq->length = padapter->securitypriv.DefKeylen[key];
- if (erq->length) {
- memcpy(keybuf, dk[key].skey,
- padapter->securitypriv.DefKeylen[key]);
- erq->flags |= IW_ENCODE_ENABLED;
- if (padapter->securitypriv.ndisauthtype ==
- Ndis802_11AuthModeOpen)
- erq->flags |= IW_ENCODE_OPEN;
- else if (padapter->securitypriv.ndisauthtype ==
- Ndis802_11AuthModeShared)
- erq->flags |= IW_ENCODE_RESTRICTED;
- } else {
- erq->length = 0;
- erq->flags |= IW_ENCODE_DISABLED;
- }
- break;
- case Ndis802_11Encryption2Enabled:
- case Ndis802_11Encryption3Enabled:
- erq->length = 16;
- erq->flags |= (IW_ENCODE_ENABLED | IW_ENCODE_OPEN |
- IW_ENCODE_NOKEY);
- break;
- default:
- erq->length = 0;
- erq->flags |= IW_ENCODE_DISABLED;
- break;
- }
- return 0;
-}
-
-static int r8711_wx_get_power(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- wrqu->power.value = 0;
- wrqu->power.fixed = 0; /* no auto select */
- wrqu->power.disabled = 1;
- return 0;
-}
-
-static int r871x_wx_set_gen_ie(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- struct _adapter *padapter = netdev_priv(dev);
-
- return r871x_set_wpa_ie(padapter, extra, wrqu->data.length);
-}
-
-static int r871x_wx_set_auth(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- struct _adapter *padapter = netdev_priv(dev);
- struct iw_param *param = (struct iw_param *)&wrqu->param;
- int paramid;
- int paramval;
- int ret = 0;
-
- paramid = param->flags & IW_AUTH_INDEX;
- paramval = param->value;
- switch (paramid) {
- case IW_AUTH_WPA_VERSION:
- break;
- case IW_AUTH_CIPHER_PAIRWISE:
- break;
- case IW_AUTH_CIPHER_GROUP:
- break;
- case IW_AUTH_KEY_MGMT:
- /*
- * ??? does not use these parameters
- */
- break;
- case IW_AUTH_TKIP_COUNTERMEASURES:
- if (paramval) {
- /* wpa_supplicant is enabling tkip countermeasure. */
- padapter->securitypriv.btkip_countermeasure = true;
- } else {
- /* wpa_supplicant is disabling tkip countermeasure. */
- padapter->securitypriv.btkip_countermeasure = false;
- }
- break;
- case IW_AUTH_DROP_UNENCRYPTED:
- /* HACK:
- *
- * wpa_supplicant calls set_wpa_enabled when the driver
- * is loaded and unloaded, regardless of if WPA is being
- * used. No other calls are made which can be used to
- * determine if encryption will be used or not prior to
- * association being expected. If encryption is not being
- * used, drop_unencrypted is set to false, else true -- we
- * can use this to determine if the CAP_PRIVACY_ON bit should
- * be set.
- */
- if (padapter->securitypriv.ndisencryptstatus ==
- Ndis802_11Encryption1Enabled) {
- /* it means init value, or using wep,
- * ndisencryptstatus =
- * Ndis802_11Encryption1Enabled,
- * then it needn't reset it;
- */
- break;
- }
-
- if (paramval) {
- padapter->securitypriv.ndisencryptstatus =
- Ndis802_11EncryptionDisabled;
- padapter->securitypriv.PrivacyAlgrthm =
- _NO_PRIVACY_;
- padapter->securitypriv.XGrpPrivacy =
- _NO_PRIVACY_;
- padapter->securitypriv.AuthAlgrthm = 0;
- padapter->securitypriv.ndisauthtype =
- Ndis802_11AuthModeOpen;
- }
- break;
- case IW_AUTH_80211_AUTH_ALG:
- ret = wpa_set_auth_algs(dev, (u32)paramval);
- break;
- case IW_AUTH_WPA_ENABLED:
- break;
- case IW_AUTH_RX_UNENCRYPTED_EAPOL:
- break;
- case IW_AUTH_PRIVACY_INVOKED:
- break;
- default:
- return -EOPNOTSUPP;
- }
-
- return ret;
-}
-
-static int r871x_wx_set_enc_ext(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- struct iw_point *pencoding = &wrqu->encoding;
- struct iw_encode_ext *pext = (struct iw_encode_ext *)extra;
- struct ieee_param *param = NULL;
- char *alg_name;
- u32 param_len;
- int ret = 0;
-
- switch (pext->alg) {
- case IW_ENCODE_ALG_NONE:
- alg_name = "none";
- break;
- case IW_ENCODE_ALG_WEP:
- alg_name = "WEP";
- break;
- case IW_ENCODE_ALG_TKIP:
- alg_name = "TKIP";
- break;
- case IW_ENCODE_ALG_CCMP:
- alg_name = "CCMP";
- break;
- default:
- return -EINVAL;
- }
-
- param_len = sizeof(struct ieee_param) + pext->key_len;
- param = kzalloc(param_len, GFP_ATOMIC);
- if (!param)
- return -ENOMEM;
- param->cmd = IEEE_CMD_SET_ENCRYPTION;
- eth_broadcast_addr(param->sta_addr);
- strscpy((char *)param->u.crypt.alg, alg_name, IEEE_CRYPT_ALG_NAME_LEN);
- if (pext->ext_flags & IW_ENCODE_EXT_GROUP_KEY)
- param->u.crypt.set_tx = 0;
- if (pext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY)
- param->u.crypt.set_tx = 1;
- param->u.crypt.idx = (pencoding->flags & 0x00FF) - 1;
- if (pext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID)
- memcpy(param->u.crypt.seq, pext->rx_seq, 8);
- if (pext->key_len) {
- param->u.crypt.key_len = pext->key_len;
- memcpy(param + 1, pext + 1, pext->key_len);
- }
- ret = wpa_set_encryption(dev, param, param_len);
- kfree(param);
- return ret;
-}
-
-static int r871x_wx_get_nick(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- if (extra) {
- wrqu->data.length = 8;
- wrqu->data.flags = 1;
- memcpy(extra, "rtl_wifi", 8);
- }
- return 0;
-}
-
-static int r8711_wx_read32(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *keybuf)
-{
- struct _adapter *padapter = netdev_priv(dev);
- u32 addr;
- u32 data32;
-
- get_user(addr, (u32 __user *)wrqu->data.pointer);
- data32 = r8712_read32(padapter, addr);
- put_user(data32, (u32 __user *)wrqu->data.pointer);
- wrqu->data.length = (data32 & 0xffff0000) >> 16;
- wrqu->data.flags = data32 & 0xffff;
- get_user(addr, (u32 __user *)wrqu->data.pointer);
- return 0;
-}
-
-static int r8711_wx_write32(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *keybuf)
-{
- struct _adapter *padapter = netdev_priv(dev);
- u32 addr;
- u32 data32;
-
- get_user(addr, (u32 __user *)wrqu->data.pointer);
- data32 = ((u32)wrqu->data.length << 16) | (u32)wrqu->data.flags;
- r8712_write32(padapter, addr, data32);
- return 0;
-}
-
-static int dummy(struct net_device *dev,
- struct iw_request_info *a,
- union iwreq_data *wrqu, char *b)
-{
- return -EINVAL;
-}
-
-static int r8711_drvext_hdl(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- return 0;
-}
-
-static int r871x_mp_ioctl_hdl(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- struct _adapter *padapter = netdev_priv(dev);
- struct iw_point *p = &wrqu->data;
- struct oid_par_priv oid_par;
- struct mp_ioctl_handler *phandler;
- struct mp_ioctl_param *poidparam;
- unsigned long BytesRead, BytesWritten, BytesNeeded;
- u8 *pparmbuf, bset;
- u16 len;
- uint status;
- int ret = 0;
-
- if ((!p->length) || (!p->pointer))
- return -EINVAL;
-
- bset = (u8)(p->flags & 0xFFFF);
- len = p->length;
- pparmbuf = memdup_user(p->pointer, len);
- if (IS_ERR(pparmbuf))
- return PTR_ERR(pparmbuf);
-
- poidparam = (struct mp_ioctl_param *)pparmbuf;
- if (poidparam->subcode >= MAX_MP_IOCTL_SUBCODE) {
- ret = -EINVAL;
- goto _r871x_mp_ioctl_hdl_exit;
- }
- phandler = mp_ioctl_hdl + poidparam->subcode;
- if ((phandler->paramsize != 0) &&
- (poidparam->len < phandler->paramsize)) {
- ret = -EINVAL;
- goto _r871x_mp_ioctl_hdl_exit;
- }
- if (phandler->oid == 0 && phandler->handler) {
- status = phandler->handler(&oid_par);
- } else if (phandler->handler) {
- oid_par.adapter_context = padapter;
- oid_par.oid = phandler->oid;
- oid_par.information_buf = poidparam->data;
- oid_par.information_buf_len = poidparam->len;
- oid_par.dbg = 0;
- BytesWritten = 0;
- BytesNeeded = 0;
- if (bset) {
- oid_par.bytes_rw = &BytesRead;
- oid_par.bytes_needed = &BytesNeeded;
- oid_par.type_of_oid = SET_OID;
- } else {
- oid_par.bytes_rw = &BytesWritten;
- oid_par.bytes_needed = &BytesNeeded;
- oid_par.type_of_oid = QUERY_OID;
- }
- status = phandler->handler(&oid_par);
- /* todo:check status, BytesNeeded, etc. */
- } else {
- netdev_info(dev, "r8712u: %s: err!, subcode=%d, oid=%d, handler=%p\n",
- __func__, poidparam->subcode, phandler->oid,
- phandler->handler);
- ret = -EFAULT;
- goto _r871x_mp_ioctl_hdl_exit;
- }
- if (bset == 0x00) { /* query info */
- if (copy_to_user(p->pointer, pparmbuf, len))
- ret = -EFAULT;
- }
- if (status) {
- ret = -EFAULT;
- goto _r871x_mp_ioctl_hdl_exit;
- }
-_r871x_mp_ioctl_hdl_exit:
- kfree(pparmbuf);
- return ret;
-}
-
-static int r871x_get_ap_info(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- struct _adapter *padapter = netdev_priv(dev);
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct __queue *queue = &pmlmepriv->scanned_queue;
- struct iw_point *pdata = &wrqu->data;
- struct wlan_network *pnetwork = NULL;
- u32 cnt = 0, wpa_ielen;
- unsigned long irqL;
- struct list_head *plist, *phead;
- unsigned char *pbuf;
- u8 bssid[ETH_ALEN];
- char data[33];
-
- if (padapter->driver_stopped || !pdata)
- return -EINVAL;
- while (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY |
- _FW_UNDER_LINKING)) {
- msleep(30);
- cnt++;
- if (cnt > 100)
- break;
- }
- pdata->flags = 0;
- if (pdata->length < 32)
- return -EINVAL;
- if (copy_from_user(data, pdata->pointer, 32))
- return -EINVAL;
- data[32] = 0;
-
- spin_lock_irqsave(&pmlmepriv->scanned_queue.lock, irqL);
- phead = &queue->queue;
- plist = phead->next;
- while (1) {
- if (end_of_queue_search(phead, plist))
- break;
- pnetwork = container_of(plist, struct wlan_network, list);
- if (!mac_pton(data, bssid)) {
- netdev_info(dev, "r8712u: Invalid BSSID '%s'.\n",
- (u8 *)data);
- spin_unlock_irqrestore(&pmlmepriv->scanned_queue.lock,
- irqL);
- return -EINVAL;
- }
- netdev_info(dev, "r8712u: BSSID:%pM\n", bssid);
- if (ether_addr_equal(bssid, pnetwork->network.MacAddress)) {
- /* BSSID match, then check if supporting wpa/wpa2 */
- pbuf = r8712_get_wpa_ie(&pnetwork->network.IEs[12],
- &wpa_ielen, pnetwork->network.IELength - 12);
- if (pbuf && (wpa_ielen > 0)) {
- pdata->flags = 1;
- break;
- }
- pbuf = r8712_get_wpa2_ie(&pnetwork->network.IEs[12],
- &wpa_ielen, pnetwork->network.IELength - 12);
- if (pbuf && (wpa_ielen > 0)) {
- pdata->flags = 2;
- break;
- }
- }
- plist = plist->next;
- }
- spin_unlock_irqrestore(&pmlmepriv->scanned_queue.lock, irqL);
- if (pdata->length >= 34) {
- if (copy_to_user((u8 __user *)pdata->pointer + 32,
- (u8 *)&pdata->flags, 1))
- return -EINVAL;
- }
- return 0;
-}
-
-static int r871x_set_pid(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- struct _adapter *padapter = netdev_priv(dev);
- struct iw_point *pdata = &wrqu->data;
-
- if (padapter->driver_stopped || !pdata)
- return -EINVAL;
- if (copy_from_user(&padapter->pid, pdata->pointer, sizeof(int)))
- return -EINVAL;
- return 0;
-}
-
-static int r871x_set_chplan(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- int ret = 0;
- struct _adapter *padapter = netdev_priv(dev);
- struct iw_point *pdata = &wrqu->data;
- int ch_plan = -1;
-
- if (padapter->driver_stopped || !pdata) {
- ret = -EINVAL;
- goto exit;
- }
- ch_plan = (int)*extra;
- r8712_set_chplan_cmd(padapter, ch_plan);
-
-exit:
-
- return ret;
-}
-
-static int r871x_wps_start(struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- struct _adapter *padapter = netdev_priv(dev);
- struct iw_point *pdata = &wrqu->data;
- u32 u32wps_start = 0;
-
- if (padapter->driver_stopped || !pdata)
- return -EINVAL;
- if (copy_from_user((void *)&u32wps_start, pdata->pointer, 4))
- return -EFAULT;
- if (u32wps_start == 0)
- u32wps_start = *extra;
- if (u32wps_start == 1) /* WPS Start */
- padapter->ledpriv.LedControlHandler(padapter,
- LED_CTL_START_WPS);
- else if (u32wps_start == 2) /* WPS Stop because of wps success */
- padapter->ledpriv.LedControlHandler(padapter,
- LED_CTL_STOP_WPS);
- else if (u32wps_start == 3) /* WPS Stop because of wps fail */
- padapter->ledpriv.LedControlHandler(padapter,
- LED_CTL_STOP_WPS_FAIL);
- return 0;
-}
-
-static int wpa_set_param(struct net_device *dev, u8 name, u32 value)
-{
- struct _adapter *padapter = netdev_priv(dev);
-
- switch (name) {
- case IEEE_PARAM_WPA_ENABLED:
- padapter->securitypriv.AuthAlgrthm = 2; /* 802.1x */
- switch ((value) & 0xff) {
- case 1: /* WPA */
- padapter->securitypriv.ndisauthtype =
- Ndis802_11AuthModeWPAPSK; /* WPA_PSK */
- padapter->securitypriv.ndisencryptstatus =
- Ndis802_11Encryption2Enabled;
- break;
- case 2: /* WPA2 */
- padapter->securitypriv.ndisauthtype =
- Ndis802_11AuthModeWPA2PSK; /* WPA2_PSK */
- padapter->securitypriv.ndisencryptstatus =
- Ndis802_11Encryption3Enabled;
- break;
- }
- break;
- case IEEE_PARAM_TKIP_COUNTERMEASURES:
- break;
- case IEEE_PARAM_DROP_UNENCRYPTED:
- /* HACK:
- *
- * wpa_supplicant calls set_wpa_enabled when the driver
- * is loaded and unloaded, regardless of if WPA is being
- * used. No other calls are made which can be used to
- * determine if encryption will be used or not prior to
- * association being expected. If encryption is not being
- * used, drop_unencrypted is set to false, else true -- we
- * can use this to determine if the CAP_PRIVACY_ON bit should
- * be set.
- */
- break;
- case IEEE_PARAM_PRIVACY_INVOKED:
- break;
- case IEEE_PARAM_AUTH_ALGS:
- return wpa_set_auth_algs(dev, value);
- case IEEE_PARAM_IEEE_802_1X:
- break;
- case IEEE_PARAM_WPAX_SELECT:
- /* added for WPA2 mixed mode */
- break;
- default:
- return -EOPNOTSUPP;
- }
- return 0;
-}
-
-static int wpa_mlme(struct net_device *dev, u32 command, u32 reason)
-{
- struct _adapter *padapter = netdev_priv(dev);
-
- switch (command) {
- case IEEE_MLME_STA_DEAUTH:
- if (!r8712_set_802_11_disassociate(padapter))
- return -1;
- break;
- case IEEE_MLME_STA_DISASSOC:
- if (!r8712_set_802_11_disassociate(padapter))
- return -1;
- break;
- default:
- return -EOPNOTSUPP;
- }
- return 0;
-}
-
-static int wpa_supplicant_ioctl(struct net_device *dev, struct iw_point *p)
-{
- struct ieee_param *param;
- int ret = 0;
- struct _adapter *padapter = netdev_priv(dev);
-
- if (p->length < sizeof(struct ieee_param) || !p->pointer)
- return -EINVAL;
- param = memdup_user(p->pointer, p->length);
- if (IS_ERR(param))
- return PTR_ERR(param);
- switch (param->cmd) {
- case IEEE_CMD_SET_WPA_PARAM:
- ret = wpa_set_param(dev, param->u.wpa_param.name,
- param->u.wpa_param.value);
- break;
- case IEEE_CMD_SET_WPA_IE:
- ret = r871x_set_wpa_ie(padapter, (char *)param->u.wpa_ie.data,
- (u16)param->u.wpa_ie.len);
- break;
- case IEEE_CMD_SET_ENCRYPTION:
- ret = wpa_set_encryption(dev, param, p->length);
- break;
- case IEEE_CMD_MLME:
- ret = wpa_mlme(dev, param->u.mlme.command,
- param->u.mlme.reason_code);
- break;
- default:
- ret = -EOPNOTSUPP;
- break;
- }
- if (ret == 0 && copy_to_user(p->pointer, param, p->length))
- ret = -EFAULT;
- kfree(param);
- return ret;
-}
-
-/* based on "driver_ipw" and for hostapd */
-int r871x_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
-{
- struct iwreq *wrq = (struct iwreq *)rq;
-
- switch (cmd) {
- case RTL_IOCTL_WPA_SUPPLICANT:
- return wpa_supplicant_ioctl(dev, &wrq->u.data);
- default:
- return -EOPNOTSUPP;
- }
- return 0;
-}
-
-static iw_handler r8711_handlers[] = {
- NULL, /* SIOCSIWCOMMIT */
- r8711_wx_get_name, /* SIOCGIWNAME */
- dummy, /* SIOCSIWNWID */
- dummy, /* SIOCGIWNWID */
- r8711_wx_set_freq, /* SIOCSIWFREQ */
- r8711_wx_get_freq, /* SIOCGIWFREQ */
- r8711_wx_set_mode, /* SIOCSIWMODE */
- r8711_wx_get_mode, /* SIOCGIWMODE */
- dummy, /* SIOCSIWSENS */
- r8711_wx_get_sens, /* SIOCGIWSENS */
- NULL, /* SIOCSIWRANGE */
- r8711_wx_get_range, /* SIOCGIWRANGE */
- r871x_wx_set_priv, /* SIOCSIWPRIV */
- NULL, /* SIOCGIWPRIV */
- NULL, /* SIOCSIWSTATS */
- NULL, /* SIOCGIWSTATS */
- dummy, /* SIOCSIWSPY */
- dummy, /* SIOCGIWSPY */
- NULL, /* SIOCGIWTHRSPY */
- NULL, /* SIOCWIWTHRSPY */
- r8711_wx_set_wap, /* SIOCSIWAP */
- r8711_wx_get_wap, /* SIOCGIWAP */
- r871x_wx_set_mlme, /* request MLME operation;
- * uses struct iw_mlme
- */
- dummy, /* SIOCGIWAPLIST -- deprecated */
- r8711_wx_set_scan, /* SIOCSIWSCAN */
- r8711_wx_get_scan, /* SIOCGIWSCAN */
- r8711_wx_set_essid, /* SIOCSIWESSID */
- r8711_wx_get_essid, /* SIOCGIWESSID */
- dummy, /* SIOCSIWNICKN */
- r871x_wx_get_nick, /* SIOCGIWNICKN */
- NULL, /* -- hole -- */
- NULL, /* -- hole -- */
- r8711_wx_set_rate, /* SIOCSIWRATE */
- r8711_wx_get_rate, /* SIOCGIWRATE */
- dummy, /* SIOCSIWRTS */
- r8711_wx_get_rts, /* SIOCGIWRTS */
- r8711_wx_set_frag, /* SIOCSIWFRAG */
- r8711_wx_get_frag, /* SIOCGIWFRAG */
- dummy, /* SIOCSIWTXPOW */
- dummy, /* SIOCGIWTXPOW */
- dummy, /* SIOCSIWRETRY */
- r8711_wx_get_retry, /* SIOCGIWRETRY */
- r8711_wx_set_enc, /* SIOCSIWENCODE */
- r8711_wx_get_enc, /* SIOCGIWENCODE */
- dummy, /* SIOCSIWPOWER */
- r8711_wx_get_power, /* SIOCGIWPOWER */
- NULL, /*---hole---*/
- NULL, /*---hole---*/
- r871x_wx_set_gen_ie, /* SIOCSIWGENIE */
- NULL, /* SIOCGIWGENIE */
- r871x_wx_set_auth, /* SIOCSIWAUTH */
- NULL, /* SIOCGIWAUTH */
- r871x_wx_set_enc_ext, /* SIOCSIWENCODEEXT */
- NULL, /* SIOCGIWENCODEEXT */
- r871x_wx_set_pmkid, /* SIOCSIWPMKSA */
- NULL, /*---hole---*/
-};
-
-static const struct iw_priv_args r8711_private_args[] = {
- {
- SIOCIWFIRSTPRIV + 0x0,
- IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "read32"
- },
- {
- SIOCIWFIRSTPRIV + 0x1,
- IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "write32"
- },
- {
- SIOCIWFIRSTPRIV + 0x2, 0, 0, "driver_ext"
- },
- {
- SIOCIWFIRSTPRIV + 0x3, 0, 0, "mp_ioctl"
- },
- {
- SIOCIWFIRSTPRIV + 0x4,
- IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "apinfo"
- },
- {
- SIOCIWFIRSTPRIV + 0x5,
- IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "setpid"
- },
- {
- SIOCIWFIRSTPRIV + 0x6,
- IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "wps_start"
- },
- {
- SIOCIWFIRSTPRIV + 0x7,
- IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "chplan"
- }
-};
-
-static iw_handler r8711_private_handler[] = {
- r8711_wx_read32,
- r8711_wx_write32,
- r8711_drvext_hdl,
- r871x_mp_ioctl_hdl,
- r871x_get_ap_info, /*for MM DTV platform*/
- r871x_set_pid,
- r871x_wps_start,
- r871x_set_chplan
-};
-
-static struct iw_statistics *r871x_get_wireless_stats(struct net_device *dev)
-{
- struct _adapter *padapter = netdev_priv(dev);
- struct iw_statistics *piwstats = &padapter->iwstats;
- int tmp_level = 0;
- int tmp_qual = 0;
- int tmp_noise = 0;
-
- if (check_fwstate(&padapter->mlmepriv, _FW_LINKED) != true) {
- piwstats->qual.qual = 0;
- piwstats->qual.level = 0;
- piwstats->qual.noise = 0;
- } else {
- /* show percentage, we need transfer dbm to original value. */
- tmp_level = padapter->recvpriv.fw_rssi;
- tmp_qual = padapter->recvpriv.signal;
- tmp_noise = padapter->recvpriv.noise;
- piwstats->qual.level = tmp_level;
- piwstats->qual.qual = tmp_qual;
- piwstats->qual.noise = tmp_noise;
- }
- piwstats->qual.updated = IW_QUAL_ALL_UPDATED;
- return &padapter->iwstats;
-}
-
-struct iw_handler_def r871x_handlers_def = {
- .standard = r8711_handlers,
- .num_standard = ARRAY_SIZE(r8711_handlers),
- .private = r8711_private_handler,
- .private_args = (struct iw_priv_args *)r8711_private_args,
- .num_private = ARRAY_SIZE(r8711_private_handler),
- .num_private_args = sizeof(r8711_private_args) /
- sizeof(struct iw_priv_args),
- .get_wireless_stats = r871x_get_wireless_stats
-};
--- a/drivers/staging/rtl8712/rtl871x_ioctl_rtl.c
+++ /dev/null
@@ -1,519 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_ioctl_rtl.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL871X_IOCTL_RTL_C_
-
-#include <linux/rndis.h>
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "wlan_bssdef.h"
-#include "wifi.h"
-#include "rtl871x_ioctl.h"
-#include "rtl871x_ioctl_set.h"
-#include "rtl871x_ioctl_rtl.h"
-#include "mp_custom_oid.h"
-#include "rtl871x_mp.h"
-#include "rtl871x_mp_ioctl.h"
-
-uint oid_rt_get_signal_quality_hdl(struct oid_par_priv *poid_par_priv)
-{
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_small_packet_crc_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *padapter = poid_par_priv->adapter_context;
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len >= sizeof(u32)) {
- *(u32 *)poid_par_priv->information_buf =
- padapter->recvpriv.rx_smallpacket_crcerr;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- } else {
- return RNDIS_STATUS_INVALID_LENGTH;
- }
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_middle_packet_crc_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *padapter = poid_par_priv->adapter_context;
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len >= sizeof(u32)) {
- *(u32 *)poid_par_priv->information_buf =
- padapter->recvpriv.rx_middlepacket_crcerr;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- } else {
- return RNDIS_STATUS_INVALID_LENGTH;
- }
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_large_packet_crc_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *padapter = poid_par_priv->adapter_context;
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len >= sizeof(u32)) {
- *(u32 *)poid_par_priv->information_buf =
- padapter->recvpriv.rx_largepacket_crcerr;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- } else {
- return RNDIS_STATUS_INVALID_LENGTH;
- }
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_tx_retry_hdl(struct oid_par_priv *poid_par_priv)
-{
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_rx_retry_hdl(struct oid_par_priv *poid_par_priv)
-{
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_rx_total_packet_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *padapter = poid_par_priv->adapter_context;
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len >= sizeof(u32)) {
- *(u32 *)poid_par_priv->information_buf =
- padapter->recvpriv.rx_pkts +
- padapter->recvpriv.rx_drop;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- } else {
- return RNDIS_STATUS_INVALID_LENGTH;
- }
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_tx_beacon_ok_hdl(struct oid_par_priv *poid_par_priv)
-{
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_tx_beacon_err_hdl(struct oid_par_priv *poid_par_priv)
-{
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_rx_icv_err_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *padapter = poid_par_priv->adapter_context;
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len >= sizeof(u32)) {
- *(uint *)poid_par_priv->information_buf =
- padapter->recvpriv.rx_icv_err;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- } else {
- return RNDIS_STATUS_INVALID_LENGTH;
- }
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_set_encryption_algorithm_hdl(struct oid_par_priv
- *poid_par_priv)
-{
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_preamble_mode_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *padapter = poid_par_priv->adapter_context;
- u32 preamblemode = 0;
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len >= sizeof(u32)) {
- if (padapter->registrypriv.preamble == PREAMBLE_LONG)
- preamblemode = 0;
- else if (padapter->registrypriv.preamble == PREAMBLE_AUTO)
- preamblemode = 1;
- else if (padapter->registrypriv.preamble == PREAMBLE_SHORT)
- preamblemode = 2;
- *(u32 *)poid_par_priv->information_buf = preamblemode;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- } else {
- return RNDIS_STATUS_INVALID_LENGTH;
- }
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_ap_ip_hdl(struct oid_par_priv *poid_par_priv)
-{
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_channelplan_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *padapter = poid_par_priv->adapter_context;
- struct eeprom_priv *peeprompriv = &padapter->eeprompriv;
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- *(u16 *)poid_par_priv->information_buf = peeprompriv->channel_plan;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_set_channelplan_hdl(struct oid_par_priv
- *poid_par_priv)
-{
- struct _adapter *padapter = poid_par_priv->adapter_context;
- struct eeprom_priv *peeprompriv = &padapter->eeprompriv;
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- peeprompriv->channel_plan = *(u16 *)poid_par_priv->information_buf;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_set_preamble_mode_hdl(struct oid_par_priv
- *poid_par_priv)
-{
- struct _adapter *padapter = poid_par_priv->adapter_context;
- u32 preamblemode = 0;
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len >= sizeof(u32)) {
- preamblemode = *(u32 *)poid_par_priv->information_buf;
- if (preamblemode == 0)
- padapter->registrypriv.preamble = PREAMBLE_LONG;
- else if (preamblemode == 1)
- padapter->registrypriv.preamble = PREAMBLE_AUTO;
- else if (preamblemode == 2)
- padapter->registrypriv.preamble = PREAMBLE_SHORT;
- *(u32 *)poid_par_priv->information_buf = preamblemode;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- } else {
- return RNDIS_STATUS_INVALID_LENGTH;
- }
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_set_bcn_intvl_hdl(struct oid_par_priv *poid_par_priv)
-{
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_dedicate_probe_hdl(struct oid_par_priv
- *poid_par_priv)
-{
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_total_tx_bytes_hdl(struct oid_par_priv
- *poid_par_priv)
-{
- struct _adapter *padapter = poid_par_priv->adapter_context;
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len >= sizeof(u32)) {
- *(u32 *)poid_par_priv->information_buf =
- padapter->xmitpriv.tx_bytes;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- } else {
- return RNDIS_STATUS_INVALID_LENGTH;
- }
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_total_rx_bytes_hdl(struct oid_par_priv
- *poid_par_priv)
-{
- struct _adapter *padapter = poid_par_priv->adapter_context;
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len >= sizeof(u32)) {
- *(u32 *)poid_par_priv->information_buf =
- padapter->recvpriv.rx_bytes;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- } else {
- return RNDIS_STATUS_INVALID_LENGTH;
- }
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_current_tx_power_level_hdl(struct oid_par_priv
- *poid_par_priv)
-{
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_enc_key_mismatch_count_hdl(struct oid_par_priv
- *poid_par_priv)
-{
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_enc_key_match_count_hdl(struct oid_par_priv
- *poid_par_priv)
-{
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_channel_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *padapter = poid_par_priv->adapter_context;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct NDIS_802_11_CONFIGURATION *pnic_Config;
- u32 channelnum;
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (check_fwstate(pmlmepriv, _FW_LINKED) ||
- check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE))
- pnic_Config = &pmlmepriv->cur_network.network.Configuration;
- else
- pnic_Config = &padapter->registrypriv.dev_network.Configuration;
- channelnum = pnic_Config->DSConfig;
- *(u32 *)poid_par_priv->information_buf = channelnum;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_hardware_radio_off_hdl(struct oid_par_priv
- *poid_par_priv)
-{
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_key_mismatch_hdl(struct oid_par_priv *poid_par_priv)
-{
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_supported_wireless_mode_hdl(struct oid_par_priv
- *poid_par_priv)
-{
- u32 ulInfo = 0;
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len >= sizeof(u32)) {
- ulInfo |= 0x0100; /* WIRELESS_MODE_B */
- ulInfo |= 0x0200; /* WIRELESS_MODE_G */
- ulInfo |= 0x0400; /* WIRELESS_MODE_A */
- *(u32 *) poid_par_priv->information_buf = ulInfo;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- } else {
- return RNDIS_STATUS_INVALID_LENGTH;
- }
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_channel_list_hdl(struct oid_par_priv *poid_par_priv)
-{
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_scan_in_progress_hdl(struct oid_par_priv *poid_par_priv)
-{
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_forced_data_rate_hdl(struct oid_par_priv *poid_par_priv)
-{
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_wireless_mode_for_scan_list_hdl(struct oid_par_priv
- *poid_par_priv)
-{
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_bss_wireless_mode_hdl(struct oid_par_priv
- *poid_par_priv)
-{
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_scan_with_magic_packet_hdl(struct oid_par_priv
- *poid_par_priv)
-{
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_ap_get_associated_station_list_hdl(struct oid_par_priv
- *poid_par_priv)
-{
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_ap_switch_into_ap_mode_hdl(struct oid_par_priv*
- poid_par_priv)
-{
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_ap_supported_hdl(struct oid_par_priv *poid_par_priv)
-{
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_ap_set_passphrase_hdl(struct oid_par_priv *poid_par_priv)
-{
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_rf_write_registry_hdl(struct oid_par_priv*
- poid_par_priv)
-{
- uint status = RNDIS_STATUS_SUCCESS;
- struct _adapter *Adapter = poid_par_priv->adapter_context;
-
- if (poid_par_priv->type_of_oid != SET_OID) /* QUERY_OID */
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len ==
- (sizeof(unsigned long) * 3)) {
- if (r8712_setrfreg_cmd(Adapter,
- *(unsigned char *)poid_par_priv->information_buf,
- (unsigned long)(*((unsigned long *)
- poid_par_priv->information_buf + 2))))
- status = RNDIS_STATUS_NOT_ACCEPTED;
- } else {
- status = RNDIS_STATUS_INVALID_LENGTH;
- }
- return status;
-}
-
-uint oid_rt_pro_rf_read_registry_hdl(struct oid_par_priv *poid_par_priv)
-{
- uint status = RNDIS_STATUS_SUCCESS;
- struct _adapter *Adapter = poid_par_priv->adapter_context;
-
- if (poid_par_priv->type_of_oid != SET_OID) /* QUERY_OID */
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len == (sizeof(unsigned long) *
- 3)) {
- if (Adapter->mppriv.act_in_progress) {
- status = RNDIS_STATUS_NOT_ACCEPTED;
- } else {
- /* init workparam */
- Adapter->mppriv.act_in_progress = true;
- Adapter->mppriv.workparam.bcompleted = false;
- Adapter->mppriv.workparam.act_type = MPT_READ_RF;
- Adapter->mppriv.workparam.io_offset = *(unsigned long *)
- poid_par_priv->information_buf;
- Adapter->mppriv.workparam.io_value = 0xcccccccc;
-
- /* RegOffsetValue - The offset of RF register to read.
- * RegDataWidth - The data width of RF register to read.
- * RegDataValue - The value to read.
- * RegOffsetValue = *((unsigned long *)InformationBuffer);
- * RegDataWidth = *((unsigned long *)InformationBuffer+1);
- * RegDataValue = *((unsigned long *)InformationBuffer+2);
- */
- if (r8712_getrfreg_cmd(Adapter,
- *(unsigned char *)poid_par_priv->information_buf,
- (unsigned char *)&Adapter->mppriv.workparam.io_value
- ))
- status = RNDIS_STATUS_NOT_ACCEPTED;
- }
- } else {
- status = RNDIS_STATUS_INVALID_LENGTH;
- }
- return status;
-}
-
-enum _CONNECT_STATE_ {
- CHECKINGSTATUS,
- ASSOCIATED,
- ADHOCMODE,
- NOTASSOCIATED
-};
-
-uint oid_rt_get_connect_state_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *padapter = poid_par_priv->adapter_context;
- struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
- u32 ulInfo;
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- /* nStatus==0 CheckingStatus
- * nStatus==1 Associated
- * nStatus==2 AdHocMode
- * nStatus==3 NotAssociated
- */
- if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING))
- ulInfo = CHECKINGSTATUS;
- else if (check_fwstate(pmlmepriv, _FW_LINKED))
- ulInfo = ASSOCIATED;
- else if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE))
- ulInfo = ADHOCMODE;
- else
- ulInfo = NOTASSOCIATED;
- *(u32 *)poid_par_priv->information_buf = ulInfo;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_set_default_key_id_hdl(struct oid_par_priv *poid_par_priv)
-{
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- return RNDIS_STATUS_SUCCESS;
-}
--- a/drivers/staging/rtl8712/rtl871x_ioctl_rtl.h
+++ /dev/null
@@ -1,109 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _RTL871X_IOCTL_RTL_H
-#define _RTL871X_IOCTL_RTL_H
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-/*************** oid_rtl_seg_01_01 **************/
-uint oid_rt_get_signal_quality_hdl(
- struct oid_par_priv *poid_par_priv);/*84*/
-uint oid_rt_get_small_packet_crc_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_middle_packet_crc_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_large_packet_crc_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_tx_retry_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_rx_retry_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_rx_total_packet_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_tx_beacon_ok_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_tx_beacon_err_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_rx_icv_err_hdl(
- struct oid_par_priv *poid_par_priv);/*93*/
-uint oid_rt_set_encryption_algorithm_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_preamble_mode_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_ap_ip_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_channelplan_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_set_channelplan_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_set_preamble_mode_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_set_bcn_intvl_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_dedicate_probe_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_total_tx_bytes_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_total_rx_bytes_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_current_tx_power_level_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_enc_key_mismatch_count_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_enc_key_match_count_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_channel_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_hardware_radio_off_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_key_mismatch_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_supported_wireless_mode_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_channel_list_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_scan_in_progress_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_forced_data_rate_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_wireless_mode_for_scan_list_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_bss_wireless_mode_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_scan_with_magic_packet_hdl(
- struct oid_par_priv *poid_par_priv);
-
-/************** oid_rtl_seg_01_03 section start **************/
-uint oid_rt_ap_get_associated_station_list_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_ap_switch_into_ap_mode_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_ap_supported_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_ap_set_passphrase_hdl(
- struct oid_par_priv *poid_par_priv);
-/* oid_rtl_seg_01_11 */
-uint oid_rt_pro_rf_write_registry_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_rf_read_registry_hdl(
- struct oid_par_priv *poid_par_priv);
-/*************** oid_rtl_seg_03_00 section start **************/
-uint oid_rt_get_connect_state_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_set_default_key_id_hdl(
- struct oid_par_priv *poid_par_priv);
-
-#endif
-
--- a/drivers/staging/rtl8712/rtl871x_ioctl_set.c
+++ /dev/null
@@ -1,354 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_ioctl_set.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL871X_IOCTL_SET_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "rtl871x_ioctl_set.h"
-#include "usb_osintf.h"
-#include "usb_ops.h"
-
-static u8 validate_ssid(struct ndis_802_11_ssid *ssid)
-{
- u8 i;
-
- if (ssid->SsidLength > 32)
- return false;
- for (i = 0; i < ssid->SsidLength; i++) {
- /* wifi, printable ascii code must be supported */
- if (!((ssid->Ssid[i] >= 0x20) && (ssid->Ssid[i] <= 0x7e)))
- return false;
- }
- return true;
-}
-
-static u8 do_join(struct _adapter *padapter)
-{
- struct list_head *plist, *phead;
- u8 *pibss = NULL;
- struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
- struct __queue *queue = &(pmlmepriv->scanned_queue);
- int ret;
-
- phead = &queue->queue;
- plist = phead->next;
- pmlmepriv->cur_network.join_res = -2;
- pmlmepriv->fw_state |= _FW_UNDER_LINKING;
- pmlmepriv->pscanned = plist;
- pmlmepriv->to_join = true;
-
- /* adhoc mode will start with an empty queue, but skip checking */
- if (!check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) &&
- list_empty(&queue->queue)) {
- if (pmlmepriv->fw_state & _FW_UNDER_LINKING)
- pmlmepriv->fw_state ^= _FW_UNDER_LINKING;
- /* when set_ssid/set_bssid for do_join(), but scanning queue
- * is empty we try to issue sitesurvey firstly
- */
- if (!pmlmepriv->sitesurveyctrl.traffic_busy)
- r8712_sitesurvey_cmd(padapter, &pmlmepriv->assoc_ssid);
- return true;
- }
-
- ret = r8712_select_and_join_from_scan(pmlmepriv);
- if (!ret) {
- mod_timer(&pmlmepriv->assoc_timer,
- jiffies + msecs_to_jiffies(MAX_JOIN_TIMEOUT));
- } else {
- if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)) {
- /* submit r8712_createbss_cmd to change to an
- * ADHOC_MASTER pmlmepriv->lock has been
- * acquired by caller...
- */
- struct wlan_bssid_ex *pdev_network =
- &padapter->registrypriv.dev_network;
- pmlmepriv->fw_state = WIFI_ADHOC_MASTER_STATE;
- pibss = padapter->registrypriv.dev_network.MacAddress;
- memcpy(&pdev_network->Ssid,
- &pmlmepriv->assoc_ssid,
- sizeof(struct ndis_802_11_ssid));
- r8712_update_registrypriv_dev_network(padapter);
- r8712_generate_random_ibss(pibss);
- if (r8712_createbss_cmd(padapter))
- return false;
- pmlmepriv->to_join = false;
- } else {
- /* can't associate ; reset under-linking */
- if (pmlmepriv->fw_state & _FW_UNDER_LINKING)
- pmlmepriv->fw_state ^=
- _FW_UNDER_LINKING;
- /* when set_ssid/set_bssid for do_join(), but
- * there are no desired bss in scanning queue
- * we try to issue sitesurvey first
- */
- if (!pmlmepriv->sitesurveyctrl.traffic_busy)
- r8712_sitesurvey_cmd(padapter,
- &pmlmepriv->assoc_ssid);
- }
- }
- return true;
-}
-
-u8 r8712_set_802_11_bssid(struct _adapter *padapter, u8 *bssid)
-{
- unsigned long irqL;
- u8 status = true;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
- if (is_zero_ether_addr(bssid) || is_broadcast_ether_addr(bssid)) {
- status = false;
- return status;
- }
- spin_lock_irqsave(&pmlmepriv->lock, irqL);
- if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY |
- _FW_UNDER_LINKING)) {
- status = check_fwstate(pmlmepriv, _FW_UNDER_LINKING);
- goto _Abort_Set_BSSID;
- }
- if (check_fwstate(pmlmepriv,
- _FW_LINKED | WIFI_ADHOC_MASTER_STATE)) {
- if (!memcmp(&pmlmepriv->cur_network.network.MacAddress, bssid,
- ETH_ALEN)) {
- if (!check_fwstate(pmlmepriv, WIFI_STATION_STATE))
- /* driver is in
- * WIFI_ADHOC_MASTER_STATE
- */
- goto _Abort_Set_BSSID;
- } else {
- r8712_disassoc_cmd(padapter);
- if (check_fwstate(pmlmepriv, _FW_LINKED))
- r8712_ind_disconnect(padapter);
- r8712_free_assoc_resources(padapter);
- if ((check_fwstate(pmlmepriv,
- WIFI_ADHOC_MASTER_STATE))) {
- _clr_fwstate_(pmlmepriv,
- WIFI_ADHOC_MASTER_STATE);
- set_fwstate(pmlmepriv, WIFI_ADHOC_STATE);
- }
- }
- }
- memcpy(&pmlmepriv->assoc_bssid, bssid, ETH_ALEN);
- pmlmepriv->assoc_by_bssid = true;
- status = do_join(padapter);
- goto done;
-_Abort_Set_BSSID:
-done:
- spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
- return status;
-}
-
-void r8712_set_802_11_ssid(struct _adapter *padapter,
- struct ndis_802_11_ssid *ssid)
-{
- unsigned long irqL;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct wlan_network *pnetwork = &pmlmepriv->cur_network;
-
- if (!padapter->hw_init_completed)
- return;
- spin_lock_irqsave(&pmlmepriv->lock, irqL);
- if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY | _FW_UNDER_LINKING)) {
- check_fwstate(pmlmepriv, _FW_UNDER_LINKING);
- goto _Abort_Set_SSID;
- }
- if (check_fwstate(pmlmepriv, _FW_LINKED | WIFI_ADHOC_MASTER_STATE)) {
- if ((pmlmepriv->assoc_ssid.SsidLength == ssid->SsidLength) &&
- (!memcmp(&pmlmepriv->assoc_ssid.Ssid, ssid->Ssid,
- ssid->SsidLength))) {
- if (!check_fwstate(pmlmepriv, WIFI_STATION_STATE)) {
- if (!r8712_is_same_ibss(padapter,
- pnetwork)) {
- /* if in WIFI_ADHOC_MASTER_STATE or
- * WIFI_ADHOC_STATE, create bss or
- * rejoin again
- */
- r8712_disassoc_cmd(padapter);
- if (check_fwstate(pmlmepriv,
- _FW_LINKED))
- r8712_ind_disconnect(padapter);
- r8712_free_assoc_resources(padapter);
- if (check_fwstate(pmlmepriv,
- WIFI_ADHOC_MASTER_STATE)) {
- _clr_fwstate_(pmlmepriv,
- WIFI_ADHOC_MASTER_STATE);
- set_fwstate(pmlmepriv,
- WIFI_ADHOC_STATE);
- }
- } else {
- /* driver is in
- * WIFI_ADHOC_MASTER_STATE
- */
- goto _Abort_Set_SSID;
- }
- }
- } else {
- r8712_disassoc_cmd(padapter);
- if (check_fwstate(pmlmepriv, _FW_LINKED))
- r8712_ind_disconnect(padapter);
- r8712_free_assoc_resources(padapter);
- if (check_fwstate(pmlmepriv,
- WIFI_ADHOC_MASTER_STATE)) {
- _clr_fwstate_(pmlmepriv,
- WIFI_ADHOC_MASTER_STATE);
- set_fwstate(pmlmepriv, WIFI_ADHOC_STATE);
- }
- }
- }
- if (padapter->securitypriv.btkip_countermeasure)
- goto _Abort_Set_SSID;
- if (!validate_ssid(ssid))
- goto _Abort_Set_SSID;
- memcpy(&pmlmepriv->assoc_ssid, ssid, sizeof(struct ndis_802_11_ssid));
- pmlmepriv->assoc_by_bssid = false;
- do_join(padapter);
- goto done;
-_Abort_Set_SSID:
-done:
- spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-}
-
-void r8712_set_802_11_infrastructure_mode(struct _adapter *padapter,
- enum NDIS_802_11_NETWORK_INFRASTRUCTURE networktype)
-{
- unsigned long irqL;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct wlan_network *cur_network = &pmlmepriv->cur_network;
- enum NDIS_802_11_NETWORK_INFRASTRUCTURE *pold_state =
- &(cur_network->network.InfrastructureMode);
-
- if (*pold_state != networktype) {
- spin_lock_irqsave(&pmlmepriv->lock, irqL);
- if (check_fwstate(pmlmepriv, _FW_LINKED) ||
- (*pold_state == Ndis802_11IBSS))
- r8712_disassoc_cmd(padapter);
- if (check_fwstate(pmlmepriv,
- _FW_LINKED | WIFI_ADHOC_MASTER_STATE))
- r8712_free_assoc_resources(padapter);
- if (check_fwstate(pmlmepriv, _FW_LINKED) ||
- (*pold_state == Ndis802_11Infrastructure) ||
- (*pold_state == Ndis802_11IBSS)) {
- /* will clr Linked_state before this function,
- * we must have checked whether issue dis-assoc_cmd or
- * not
- */
- r8712_ind_disconnect(padapter);
- }
- *pold_state = networktype;
- /* clear WIFI_STATION_STATE; WIFI_AP_STATE; WIFI_ADHOC_STATE;
- * WIFI_ADHOC_MASTER_STATE
- */
- _clr_fwstate_(pmlmepriv, WIFI_STATION_STATE | WIFI_AP_STATE |
- WIFI_ADHOC_STATE | WIFI_ADHOC_MASTER_STATE);
- switch (networktype) {
- case Ndis802_11IBSS:
- set_fwstate(pmlmepriv, WIFI_ADHOC_STATE);
- break;
- case Ndis802_11Infrastructure:
- set_fwstate(pmlmepriv, WIFI_STATION_STATE);
- break;
- case Ndis802_11APMode:
- set_fwstate(pmlmepriv, WIFI_AP_STATE);
- break;
- case Ndis802_11AutoUnknown:
- case Ndis802_11InfrastructureMax:
- break;
- }
- spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
- }
-}
-
-u8 r8712_set_802_11_disassociate(struct _adapter *padapter)
-{
- unsigned long irqL;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
- spin_lock_irqsave(&pmlmepriv->lock, irqL);
- if (check_fwstate(pmlmepriv, _FW_LINKED)) {
- r8712_disassoc_cmd(padapter);
- r8712_ind_disconnect(padapter);
- r8712_free_assoc_resources(padapter);
- }
- spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
- return true;
-}
-
-u8 r8712_set_802_11_bssid_list_scan(struct _adapter *padapter)
-{
- struct mlme_priv *pmlmepriv = NULL;
- unsigned long irqL;
- u8 ret = true;
-
- if (!padapter)
- return false;
- pmlmepriv = &padapter->mlmepriv;
- if (!padapter->hw_init_completed)
- return false;
- spin_lock_irqsave(&pmlmepriv->lock, irqL);
- if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY | _FW_UNDER_LINKING) ||
- pmlmepriv->sitesurveyctrl.traffic_busy) {
- /* Scan or linking is in progress, do nothing. */
- ret = (u8)check_fwstate(pmlmepriv, _FW_UNDER_SURVEY);
- } else {
- r8712_free_network_queue(padapter);
- ret = r8712_sitesurvey_cmd(padapter, NULL);
- }
- spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
- return ret;
-}
-
-u8 r8712_set_802_11_authentication_mode(struct _adapter *padapter,
- enum NDIS_802_11_AUTHENTICATION_MODE authmode)
-{
- struct security_priv *psecuritypriv = &padapter->securitypriv;
- u8 ret;
-
- psecuritypriv->ndisauthtype = authmode;
- if (psecuritypriv->ndisauthtype > 3)
- psecuritypriv->AuthAlgrthm = 2; /* 802.1x */
- if (r8712_set_auth(padapter, psecuritypriv))
- ret = false;
- else
- ret = true;
- return ret;
-}
-
-int r8712_set_802_11_add_wep(struct _adapter *padapter,
- struct NDIS_802_11_WEP *wep)
-{
- sint keyid;
- struct security_priv *psecuritypriv = &padapter->securitypriv;
-
- keyid = wep->KeyIndex & 0x3fffffff;
- if (keyid >= WEP_KEYS)
- return -EINVAL;
- switch (wep->KeyLength) {
- case 5:
- psecuritypriv->PrivacyAlgrthm = _WEP40_;
- break;
- case 13:
- psecuritypriv->PrivacyAlgrthm = _WEP104_;
- break;
- default:
- psecuritypriv->PrivacyAlgrthm = _NO_PRIVACY_;
- break;
- }
- memcpy(psecuritypriv->DefKey[keyid].skey, &wep->KeyMaterial,
- wep->KeyLength);
- psecuritypriv->DefKeylen[keyid] = wep->KeyLength;
- psecuritypriv->PrivacyKeyIndex = keyid;
- return r8712_set_key(padapter, psecuritypriv, keyid);
-}
--- a/drivers/staging/rtl8712/rtl871x_ioctl_set.h
+++ /dev/null
@@ -1,45 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __IOCTL_SET_H
-#define __IOCTL_SET_H
-
-#include "drv_types.h"
-
-typedef u8 NDIS_802_11_PMKID_VALUE[16];
-
-struct BSSIDInfo {
- unsigned char BSSID[6];
- NDIS_802_11_PMKID_VALUE PMKID;
-};
-
-u8 r8712_set_802_11_authentication_mode(struct _adapter *pdapter,
- enum NDIS_802_11_AUTHENTICATION_MODE authmode);
-
-u8 r8712_set_802_11_bssid(struct _adapter *padapter, u8 *bssid);
-
-int r8712_set_802_11_add_wep(struct _adapter *padapter,
- struct NDIS_802_11_WEP *wep);
-
-u8 r8712_set_802_11_disassociate(struct _adapter *padapter);
-
-u8 r8712_set_802_11_bssid_list_scan(struct _adapter *padapter);
-
-void r8712_set_802_11_infrastructure_mode(struct _adapter *padapter,
- enum NDIS_802_11_NETWORK_INFRASTRUCTURE networktype);
-
-void r8712_set_802_11_ssid(struct _adapter *padapter,
- struct ndis_802_11_ssid *ssid);
-
-#endif
-
--- a/drivers/staging/rtl8712/rtl871x_led.h
+++ /dev/null
@@ -1,118 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_LED_H
-#define __RTL8712_LED_H
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-/*===========================================================================
- * LED customization.
- *===========================================================================
- */
-enum LED_CTL_MODE {
- LED_CTL_POWER_ON = 1,
- LED_CTL_LINK = 2,
- LED_CTL_NO_LINK = 3,
- LED_CTL_TX = 4,
- LED_CTL_RX = 5,
- LED_CTL_SITE_SURVEY = 6,
- LED_CTL_POWER_OFF = 7,
- LED_CTL_START_TO_LINK = 8,
- LED_CTL_START_WPS = 9,
- LED_CTL_STOP_WPS = 10,
- LED_CTL_START_WPS_BOTTON = 11,
- LED_CTL_STOP_WPS_FAIL = 12,
- LED_CTL_STOP_WPS_FAIL_OVERLAP = 13,
-};
-
-#define IS_LED_WPS_BLINKING(_LED_871x) \
- (((struct LED_871x *)_LED_871x)->CurrLedState == LED_BLINK_WPS \
- || ((struct LED_871x *)_LED_871x)->CurrLedState == LED_BLINK_WPS_STOP \
- || ((struct LED_871x *)_LED_871x)->bLedWPSBlinkInProgress)
-
-#define IS_LED_BLINKING(_LED_871x) \
- (((struct LED_871x *)_LED_871x)->bLedWPSBlinkInProgress \
- || ((struct LED_871x *)_LED_871x)->bLedScanBlinkInProgress)
-
-enum LED_PIN_871x {
- LED_PIN_GPIO0,
- LED_PIN_LED0,
- LED_PIN_LED1
-};
-
-/*===========================================================================
- * LED customization.
- *===========================================================================
- */
-enum LED_STRATEGY_871x {
- SW_LED_MODE0, /* SW control 1 LED via GPIO0. It is default option. */
- SW_LED_MODE1, /* 2 LEDs, through LED0 and LED1. For ALPHA. */
- SW_LED_MODE2, /* SW control 1 LED via GPIO0,
- * custom for AzWave 8187 minicard.
- */
- SW_LED_MODE3, /* SW control 1 LED via GPIO0,
- * customized for Sercomm Printer Server case.
- */
- SW_LED_MODE4, /*for Edimax / Belkin*/
- SW_LED_MODE5, /*for Sercomm / Belkin*/
- SW_LED_MODE6, /*for WNC / Corega*/
- HW_LED, /* HW control 2 LEDs, LED0 and LED1 (there are 4 different
- * control modes, see MAC.CONFIG1 for details.)
- */
-};
-
-struct LED_871x {
- struct _adapter *padapter;
- enum LED_PIN_871x LedPin; /* Implementation for this SW led. */
- u32 CurrLedState; /* Current LED state. */
- u8 bLedOn; /* true if LED is ON */
- u8 bSWLedCtrl;
- u8 bLedBlinkInProgress; /*true if blinking */
- u8 bLedNoLinkBlinkInProgress;
- u8 bLedLinkBlinkInProgress;
- u8 bLedStartToLinkBlinkInProgress;
- u8 bLedScanBlinkInProgress;
- u8 bLedWPSBlinkInProgress;
- u32 BlinkTimes; /* No. times to toggle for blink.*/
- u32 BlinkingLedState; /* Next state for blinking,
- * either LED_ON or OFF.
- */
-
- struct timer_list BlinkTimer; /* Timer object for led blinking.*/
- struct work_struct BlinkWorkItem; /* Workitem used by BlinkTimer */
-};
-
-struct led_priv {
- /* add for led control */
- struct LED_871x SwLed0;
- struct LED_871x SwLed1;
- enum LED_STRATEGY_871x LedStrategy;
- u8 bRegUseLed;
- void (*LedControlHandler)(struct _adapter *padapter,
- enum LED_CTL_MODE LedAction);
- /* add for led control */
-};
-
-/*===========================================================================
- * Interface to manipulate LED objects.
- *===========================================================================
- */
-void r8712_InitSwLeds(struct _adapter *padapter);
-void r8712_DeInitSwLeds(struct _adapter *padapter);
-void LedControl871x(struct _adapter *padapter, enum LED_CTL_MODE LedAction);
-void r8712_flush_led_works(struct _adapter *padapter);
-
-#endif
-
--- a/drivers/staging/rtl8712/rtl871x_mlme.c
+++ /dev/null
@@ -1,1709 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_mlme.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL871X_MLME_C_
-
-#include <linux/etherdevice.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "recv_osdep.h"
-#include "xmit_osdep.h"
-#include "mlme_osdep.h"
-#include "sta_info.h"
-#include "wifi.h"
-#include "wlan_bssdef.h"
-
-static void update_ht_cap(struct _adapter *padapter, u8 *pie, uint ie_len);
-
-int r8712_init_mlme_priv(struct _adapter *padapter)
-{
- sint i;
- u8 *pbuf;
- struct wlan_network *pnetwork;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
- memset((u8 *)pmlmepriv, 0, sizeof(struct mlme_priv));
- pmlmepriv->nic_hdl = (u8 *)padapter;
- pmlmepriv->pscanned = NULL;
- pmlmepriv->fw_state = 0;
- pmlmepriv->cur_network.network.InfrastructureMode =
- Ndis802_11AutoUnknown;
- /* Maybe someday we should rename this variable to "active_mode"(Jeff)*/
- pmlmepriv->passive_mode = 1; /* 1: active, 0: passive. */
- spin_lock_init(&(pmlmepriv->lock));
- spin_lock_init(&(pmlmepriv->lock2));
- _init_queue(&(pmlmepriv->free_bss_pool));
- _init_queue(&(pmlmepriv->scanned_queue));
- set_scanned_network_val(pmlmepriv, 0);
- memset(&pmlmepriv->assoc_ssid, 0, sizeof(struct ndis_802_11_ssid));
- pbuf = kmalloc_array(MAX_BSS_CNT, sizeof(struct wlan_network),
- GFP_ATOMIC);
- if (!pbuf)
- return -ENOMEM;
- pmlmepriv->free_bss_buf = pbuf;
- pnetwork = (struct wlan_network *)pbuf;
- for (i = 0; i < MAX_BSS_CNT; i++) {
- INIT_LIST_HEAD(&(pnetwork->list));
- list_add_tail(&(pnetwork->list),
- &(pmlmepriv->free_bss_pool.queue));
- pnetwork++;
- }
- pmlmepriv->sitesurveyctrl.last_rx_pkts = 0;
- pmlmepriv->sitesurveyctrl.last_tx_pkts = 0;
- pmlmepriv->sitesurveyctrl.traffic_busy = false;
- /* allocate DMA-able/Non-Page memory for cmd_buf and rsp_buf */
- r8712_init_mlme_timer(padapter);
- return 0;
-}
-
-struct wlan_network *_r8712_alloc_network(struct mlme_priv *pmlmepriv)
-{
- unsigned long irqL;
- struct wlan_network *pnetwork;
- struct __queue *free_queue = &pmlmepriv->free_bss_pool;
-
- spin_lock_irqsave(&free_queue->lock, irqL);
- pnetwork = list_first_entry_or_null(&free_queue->queue,
- struct wlan_network, list);
- if (pnetwork) {
- list_del_init(&pnetwork->list);
- pnetwork->last_scanned = jiffies;
- pmlmepriv->num_of_scanned++;
- }
- spin_unlock_irqrestore(&free_queue->lock, irqL);
- return pnetwork;
-}
-
-static void _free_network(struct mlme_priv *pmlmepriv,
- struct wlan_network *pnetwork)
-{
- u32 curr_time, delta_time;
- unsigned long irqL;
- struct __queue *free_queue = &(pmlmepriv->free_bss_pool);
-
- if (!pnetwork)
- return;
- if (pnetwork->fixed)
- return;
- curr_time = jiffies;
- delta_time = (curr_time - (u32)pnetwork->last_scanned) / HZ;
- if (delta_time < SCANQUEUE_LIFETIME)
- return;
- spin_lock_irqsave(&free_queue->lock, irqL);
- list_del_init(&pnetwork->list);
- list_add_tail(&pnetwork->list, &free_queue->queue);
- pmlmepriv->num_of_scanned--;
- spin_unlock_irqrestore(&free_queue->lock, irqL);
-}
-
-static void free_network_nolock(struct mlme_priv *pmlmepriv,
- struct wlan_network *pnetwork)
-{
- struct __queue *free_queue = &pmlmepriv->free_bss_pool;
-
- if (!pnetwork)
- return;
- if (pnetwork->fixed)
- return;
- list_del_init(&pnetwork->list);
- list_add_tail(&pnetwork->list, &free_queue->queue);
- pmlmepriv->num_of_scanned--;
-}
-
-/* return the wlan_network with the matching addr
- * Shall be called under atomic context...
- * to avoid possible racing condition...
- */
-static struct wlan_network *r8712_find_network(struct __queue *scanned_queue,
- u8 *addr)
-{
- unsigned long irqL;
- struct list_head *phead, *plist;
- struct wlan_network *pnetwork = NULL;
-
- if (is_zero_ether_addr(addr))
- return NULL;
- spin_lock_irqsave(&scanned_queue->lock, irqL);
- phead = &scanned_queue->queue;
- list_for_each(plist, phead) {
- pnetwork = list_entry(plist, struct wlan_network, list);
- if (!memcmp(addr, pnetwork->network.MacAddress, ETH_ALEN))
- break;
- }
- if (plist == phead)
- pnetwork = NULL;
- spin_unlock_irqrestore(&scanned_queue->lock, irqL);
- return pnetwork;
-}
-
-void r8712_free_network_queue(struct _adapter *padapter)
-{
- unsigned long irqL;
- struct list_head *phead, *plist;
- struct wlan_network *pnetwork;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct __queue *scanned_queue = &pmlmepriv->scanned_queue;
-
- spin_lock_irqsave(&scanned_queue->lock, irqL);
- phead = &scanned_queue->queue;
- plist = phead->next;
- while (!end_of_queue_search(phead, plist)) {
- pnetwork = container_of(plist, struct wlan_network, list);
- plist = plist->next;
- _free_network(pmlmepriv, pnetwork);
- }
- spin_unlock_irqrestore(&scanned_queue->lock, irqL);
-}
-
-sint r8712_if_up(struct _adapter *padapter)
-{
- sint res;
-
- if (padapter->driver_stopped || padapter->surprise_removed ||
- !check_fwstate(&padapter->mlmepriv, _FW_LINKED)) {
- res = false;
- } else {
- res = true;
- }
- return res;
-}
-
-void r8712_generate_random_ibss(u8 *pibss)
-{
- u32 curtime = jiffies;
-
- pibss[0] = 0x02; /*in ad-hoc mode bit1 must set to 1 */
- pibss[1] = 0x11;
- pibss[2] = 0x87;
- pibss[3] = (u8)(curtime & 0xff);
- pibss[4] = (u8)((curtime >> 8) & 0xff);
- pibss[5] = (u8)((curtime >> 16) & 0xff);
-}
-
-uint r8712_get_wlan_bssid_ex_sz(struct wlan_bssid_ex *bss)
-{
- return sizeof(*bss) + bss->IELength - MAX_IE_SZ;
-}
-
-u8 *r8712_get_capability_from_ie(u8 *ie)
-{
- return ie + 8 + 2;
-}
-
-void r8712_free_mlme_priv(struct mlme_priv *pmlmepriv)
-{
- kfree(pmlmepriv->free_bss_buf);
-}
-
-static struct wlan_network *alloc_network(struct mlme_priv *pmlmepriv)
-{
- return _r8712_alloc_network(pmlmepriv);
-}
-
-int r8712_is_same_ibss(struct _adapter *adapter, struct wlan_network *pnetwork)
-{
- int ret = true;
- struct security_priv *psecuritypriv = &adapter->securitypriv;
-
- if ((psecuritypriv->PrivacyAlgrthm != _NO_PRIVACY_) &&
- (pnetwork->network.Privacy == cpu_to_le32(0)))
- ret = false;
- else if ((psecuritypriv->PrivacyAlgrthm == _NO_PRIVACY_) &&
- (pnetwork->network.Privacy == cpu_to_le32(1)))
- ret = false;
- else
- ret = true;
- return ret;
-
-}
-
-static int is_same_network(struct wlan_bssid_ex *src,
- struct wlan_bssid_ex *dst)
-{
- u16 s_cap, d_cap;
-
- memcpy((u8 *)&s_cap, r8712_get_capability_from_ie(src->IEs), 2);
- memcpy((u8 *)&d_cap, r8712_get_capability_from_ie(dst->IEs), 2);
- return (src->Ssid.SsidLength == dst->Ssid.SsidLength) &&
- (src->Configuration.DSConfig ==
- dst->Configuration.DSConfig) &&
- ((!memcmp(src->MacAddress, dst->MacAddress,
- ETH_ALEN))) &&
- ((!memcmp(src->Ssid.Ssid,
- dst->Ssid.Ssid,
- src->Ssid.SsidLength))) &&
- ((s_cap & WLAN_CAPABILITY_IBSS) ==
- (d_cap & WLAN_CAPABILITY_IBSS)) &&
- ((s_cap & WLAN_CAPABILITY_ESS) ==
- (d_cap & WLAN_CAPABILITY_ESS));
-
-}
-
-struct wlan_network *r8712_get_oldest_wlan_network(
- struct __queue *scanned_queue)
-{
- struct list_head *plist, *phead;
- struct wlan_network *pwlan = NULL;
- struct wlan_network *oldest = NULL;
-
- phead = &scanned_queue->queue;
- plist = phead->next;
- while (1) {
- if (end_of_queue_search(phead, plist))
- break;
- pwlan = container_of(plist, struct wlan_network, list);
- if (!pwlan->fixed) {
- if (!oldest ||
- time_after((unsigned long)oldest->last_scanned,
- (unsigned long)pwlan->last_scanned))
- oldest = pwlan;
- }
- plist = plist->next;
- }
- return oldest;
-}
-
-static void update_network(struct wlan_bssid_ex *dst,
- struct wlan_bssid_ex *src,
- struct _adapter *padapter)
-{
- u32 last_evm = 0, tmpVal;
- struct smooth_rssi_data *sqd = &padapter->recvpriv.signal_qual_data;
-
- if (check_fwstate(&padapter->mlmepriv, _FW_LINKED) &&
- is_same_network(&(padapter->mlmepriv.cur_network.network), src)) {
- if (padapter->recvpriv.signal_qual_data.total_num++ >=
- PHY_LINKQUALITY_SLID_WIN_MAX) {
- padapter->recvpriv.signal_qual_data.total_num =
- PHY_LINKQUALITY_SLID_WIN_MAX;
- last_evm = sqd->elements[sqd->index];
- padapter->recvpriv.signal_qual_data.total_val -=
- last_evm;
- }
- padapter->recvpriv.signal_qual_data.total_val += src->Rssi;
-
- sqd->elements[sqd->index++] = src->Rssi;
- if (padapter->recvpriv.signal_qual_data.index >=
- PHY_LINKQUALITY_SLID_WIN_MAX)
- padapter->recvpriv.signal_qual_data.index = 0;
- /* <1> Showed on UI for user, in percentage. */
- tmpVal = padapter->recvpriv.signal_qual_data.total_val /
- padapter->recvpriv.signal_qual_data.total_num;
- padapter->recvpriv.signal = (u8)tmpVal;
-
- src->Rssi = padapter->recvpriv.signal;
- } else {
- src->Rssi = (src->Rssi + dst->Rssi) / 2;
- }
- memcpy((u8 *)dst, (u8 *)src, r8712_get_wlan_bssid_ex_sz(src));
-}
-
-static void update_current_network(struct _adapter *adapter,
- struct wlan_bssid_ex *pnetwork)
-{
- struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-
- if (is_same_network(&(pmlmepriv->cur_network.network), pnetwork)) {
- update_network(&(pmlmepriv->cur_network.network),
- pnetwork, adapter);
- r8712_update_protection(adapter,
- (pmlmepriv->cur_network.network.IEs) +
- sizeof(struct NDIS_802_11_FIXED_IEs),
- pmlmepriv->cur_network.network.IELength);
- }
-}
-
-/* Caller must hold pmlmepriv->lock first */
-static void update_scanned_network(struct _adapter *adapter,
- struct wlan_bssid_ex *target)
-{
- struct list_head *plist, *phead;
-
- u32 bssid_ex_sz;
- struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
- struct __queue *queue = &pmlmepriv->scanned_queue;
- struct wlan_network *pnetwork = NULL;
- struct wlan_network *oldest = NULL;
-
- phead = &queue->queue;
- plist = phead->next;
-
- while (1) {
- if (end_of_queue_search(phead, plist))
- break;
-
- pnetwork = container_of(plist, struct wlan_network, list);
- if (is_same_network(&pnetwork->network, target))
- break;
- if ((oldest == ((struct wlan_network *)0)) ||
- time_after((unsigned long)oldest->last_scanned,
- (unsigned long)pnetwork->last_scanned))
- oldest = pnetwork;
-
- plist = plist->next;
- }
-
- /* If we didn't find a match, then get a new network slot to initialize
- * with this beacon's information
- */
- if (end_of_queue_search(phead, plist)) {
- if (list_empty(&pmlmepriv->free_bss_pool.queue)) {
- /* If there are no more slots, expire the oldest */
- pnetwork = oldest;
- target->Rssi = (pnetwork->network.Rssi +
- target->Rssi) / 2;
- memcpy(&pnetwork->network, target,
- r8712_get_wlan_bssid_ex_sz(target));
- pnetwork->last_scanned = jiffies;
- } else {
- /* Otherwise just pull from the free list */
- /* update scan_time */
- pnetwork = alloc_network(pmlmepriv);
- if (!pnetwork)
- return;
- bssid_ex_sz = r8712_get_wlan_bssid_ex_sz(target);
- target->Length = bssid_ex_sz;
- memcpy(&pnetwork->network, target, bssid_ex_sz);
- list_add_tail(&pnetwork->list, &queue->queue);
- }
- } else {
- /* we have an entry and we are going to update it. But
- * this entry may be already expired. In this case we
- * do the same as we found a new net and call the new_net
- * handler
- */
- update_network(&pnetwork->network, target, adapter);
- pnetwork->last_scanned = jiffies;
- }
-}
-
-static void rtl8711_add_network(struct _adapter *adapter,
- struct wlan_bssid_ex *pnetwork)
-{
- unsigned long irqL;
- struct mlme_priv *pmlmepriv = &(((struct _adapter *)adapter)->mlmepriv);
- struct __queue *queue = &pmlmepriv->scanned_queue;
-
- spin_lock_irqsave(&queue->lock, irqL);
- update_current_network(adapter, pnetwork);
- update_scanned_network(adapter, pnetwork);
- spin_unlock_irqrestore(&queue->lock, irqL);
-}
-
-/*select the desired network based on the capability of the (i)bss.
- * check items: (1) security
- * (2) network_type
- * (3) WMM
- * (4) HT
- * (5) others
- */
-static int is_desired_network(struct _adapter *adapter,
- struct wlan_network *pnetwork)
-{
- u8 wps_ie[512];
- uint wps_ielen;
- int bselected = true;
- struct security_priv *psecuritypriv = &adapter->securitypriv;
-
- if (psecuritypriv->wps_phase) {
- if (r8712_get_wps_ie(pnetwork->network.IEs,
- pnetwork->network.IELength, wps_ie,
- &wps_ielen))
- return true;
- return false;
- }
- if ((psecuritypriv->PrivacyAlgrthm != _NO_PRIVACY_) &&
- (pnetwork->network.Privacy == 0))
- bselected = false;
- if (check_fwstate(&adapter->mlmepriv, WIFI_ADHOC_STATE)) {
- if (pnetwork->network.InfrastructureMode !=
- adapter->mlmepriv.cur_network.network.InfrastructureMode)
- bselected = false;
- }
- return bselected;
-}
-
-/* TODO: Perry : For Power Management */
-void r8712_atimdone_event_callback(struct _adapter *adapter, u8 *pbuf)
-{
-}
-
-void r8712_survey_event_callback(struct _adapter *adapter, u8 *pbuf)
-{
- unsigned long flags;
- u32 len;
- struct wlan_bssid_ex *pnetwork;
- struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-
- pnetwork = (struct wlan_bssid_ex *)pbuf;
-#ifdef __BIG_ENDIAN
- /* endian_convert */
- pnetwork->Length = le32_to_cpu(pnetwork->Length);
- pnetwork->Ssid.SsidLength = le32_to_cpu(pnetwork->Ssid.SsidLength);
- pnetwork->Privacy = le32_to_cpu(pnetwork->Privacy);
- pnetwork->Rssi = le32_to_cpu(pnetwork->Rssi);
- pnetwork->NetworkTypeInUse = le32_to_cpu(pnetwork->NetworkTypeInUse);
- pnetwork->Configuration.ATIMWindow =
- le32_to_cpu(pnetwork->Configuration.ATIMWindow);
- pnetwork->Configuration.BeaconPeriod =
- le32_to_cpu(pnetwork->Configuration.BeaconPeriod);
- pnetwork->Configuration.DSConfig =
- le32_to_cpu(pnetwork->Configuration.DSConfig);
- pnetwork->Configuration.FHConfig.DwellTime =
- le32_to_cpu(pnetwork->Configuration.FHConfig.DwellTime);
- pnetwork->Configuration.FHConfig.HopPattern =
- le32_to_cpu(pnetwork->Configuration.FHConfig.HopPattern);
- pnetwork->Configuration.FHConfig.HopSet =
- le32_to_cpu(pnetwork->Configuration.FHConfig.HopSet);
- pnetwork->Configuration.FHConfig.Length =
- le32_to_cpu(pnetwork->Configuration.FHConfig.Length);
- pnetwork->Configuration.Length =
- le32_to_cpu(pnetwork->Configuration.Length);
- pnetwork->InfrastructureMode =
- le32_to_cpu(pnetwork->InfrastructureMode);
- pnetwork->IELength = le32_to_cpu(pnetwork->IELength);
-#endif
- len = r8712_get_wlan_bssid_ex_sz(pnetwork);
- if (len > sizeof(struct wlan_bssid_ex))
- return;
- spin_lock_irqsave(&pmlmepriv->lock2, flags);
- /* update IBSS_network 's timestamp */
- if (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) {
- if (!memcmp(&(pmlmepriv->cur_network.network.MacAddress),
- pnetwork->MacAddress, ETH_ALEN)) {
- struct wlan_network *ibss_wlan = NULL;
-
- memcpy(pmlmepriv->cur_network.network.IEs,
- pnetwork->IEs, 8);
- ibss_wlan = r8712_find_network(
- &pmlmepriv->scanned_queue,
- pnetwork->MacAddress);
- if (ibss_wlan) {
- memcpy(ibss_wlan->network.IEs,
- pnetwork->IEs, 8);
- goto exit;
- }
- }
- }
- /* lock pmlmepriv->lock when you accessing network_q */
- if (!check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) {
- if (pnetwork->Ssid.Ssid[0] != 0) {
- rtl8711_add_network(adapter, pnetwork);
- } else {
- pnetwork->Ssid.SsidLength = 8;
- memcpy(pnetwork->Ssid.Ssid, "<hidden>", 8);
- rtl8711_add_network(adapter, pnetwork);
- }
- }
-exit:
- spin_unlock_irqrestore(&pmlmepriv->lock2, flags);
-}
-
-void r8712_surveydone_event_callback(struct _adapter *adapter, u8 *pbuf)
-{
- unsigned long irqL;
- struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-
- spin_lock_irqsave(&pmlmepriv->lock, irqL);
-
- if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY)) {
- del_timer(&pmlmepriv->scan_to_timer);
-
- _clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
- }
-
- if (pmlmepriv->to_join) {
- if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)) {
- if (!check_fwstate(pmlmepriv, _FW_LINKED)) {
- set_fwstate(pmlmepriv, _FW_UNDER_LINKING);
-
- if (!r8712_select_and_join_from_scan(pmlmepriv)) {
- mod_timer(&pmlmepriv->assoc_timer, jiffies +
- msecs_to_jiffies(MAX_JOIN_TIMEOUT));
- } else {
- struct wlan_bssid_ex *pdev_network =
- &(adapter->registrypriv.dev_network);
- u8 *pibss =
- adapter->registrypriv.dev_network.MacAddress;
- pmlmepriv->fw_state ^= _FW_UNDER_SURVEY;
- memcpy(&pdev_network->Ssid,
- &pmlmepriv->assoc_ssid,
- sizeof(struct
- ndis_802_11_ssid));
- r8712_update_registrypriv_dev_network
- (adapter);
- r8712_generate_random_ibss(pibss);
- pmlmepriv->fw_state =
- WIFI_ADHOC_MASTER_STATE;
- pmlmepriv->to_join = false;
- }
- }
- } else {
- pmlmepriv->to_join = false;
- set_fwstate(pmlmepriv, _FW_UNDER_LINKING);
- if (!r8712_select_and_join_from_scan(pmlmepriv))
- mod_timer(&pmlmepriv->assoc_timer, jiffies +
- msecs_to_jiffies(MAX_JOIN_TIMEOUT));
- else
- _clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
- }
- }
- spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-}
-
-/*
- *r8712_free_assoc_resources: the caller has to lock pmlmepriv->lock
- */
-void r8712_free_assoc_resources(struct _adapter *adapter)
-{
- unsigned long irqL;
- struct wlan_network *pwlan = NULL;
- struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
- struct sta_priv *pstapriv = &adapter->stapriv;
- struct wlan_network *tgt_network = &pmlmepriv->cur_network;
-
- pwlan = r8712_find_network(&pmlmepriv->scanned_queue,
- tgt_network->network.MacAddress);
-
- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE | WIFI_AP_STATE)) {
- struct sta_info *psta;
-
- psta = r8712_get_stainfo(&adapter->stapriv,
- tgt_network->network.MacAddress);
-
- spin_lock_irqsave(&pstapriv->sta_hash_lock, irqL);
- r8712_free_stainfo(adapter, psta);
- spin_unlock_irqrestore(&pstapriv->sta_hash_lock, irqL);
- }
-
- if (check_fwstate(pmlmepriv,
- WIFI_ADHOC_STATE | WIFI_ADHOC_MASTER_STATE | WIFI_AP_STATE))
- r8712_free_all_stainfo(adapter);
- if (pwlan)
- pwlan->fixed = false;
-
- if (((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) &&
- (adapter->stapriv.asoc_sta_count == 1)))
- free_network_nolock(pmlmepriv, pwlan);
-}
-
-/*
- * r8712_indicate_connect: the caller has to lock pmlmepriv->lock
- */
-void r8712_indicate_connect(struct _adapter *padapter)
-{
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
- pmlmepriv->to_join = false;
- set_fwstate(pmlmepriv, _FW_LINKED);
- padapter->ledpriv.LedControlHandler(padapter, LED_CTL_LINK);
- r8712_os_indicate_connect(padapter);
- if (padapter->registrypriv.power_mgnt > PS_MODE_ACTIVE)
- mod_timer(&pmlmepriv->dhcp_timer,
- jiffies + msecs_to_jiffies(60000));
-}
-
-/*
- * r8712_ind_disconnect: the caller has to lock pmlmepriv->lock
- */
-void r8712_ind_disconnect(struct _adapter *padapter)
-{
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
- if (check_fwstate(pmlmepriv, _FW_LINKED)) {
- _clr_fwstate_(pmlmepriv, _FW_LINKED);
- padapter->ledpriv.LedControlHandler(padapter, LED_CTL_NO_LINK);
- r8712_os_indicate_disconnect(padapter);
- }
- if (padapter->pwrctrlpriv.pwr_mode !=
- padapter->registrypriv.power_mgnt) {
- del_timer(&pmlmepriv->dhcp_timer);
- r8712_set_ps_mode(padapter, padapter->registrypriv.power_mgnt,
- padapter->registrypriv.smart_ps);
- }
-}
-
-/*Notes:
- *pnetwork : returns from r8712_joinbss_event_callback
- *ptarget_wlan: found from scanned_queue
- *if join_res > 0, for (fw_state==WIFI_STATION_STATE), we check if
- * "ptarget_sta" & "ptarget_wlan" exist.
- *if join_res > 0, for (fw_state==WIFI_ADHOC_STATE), we only check
- * if "ptarget_wlan" exist.
- *if join_res > 0, update "cur_network->network" from
- * "pnetwork->network" if (ptarget_wlan !=NULL).
- */
-void r8712_joinbss_event_callback(struct _adapter *adapter, u8 *pbuf)
-{
- unsigned long irqL = 0, irqL2;
- struct sta_info *ptarget_sta = NULL, *pcur_sta = NULL;
- struct sta_priv *pstapriv = &adapter->stapriv;
- struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
- struct wlan_network *cur_network = &pmlmepriv->cur_network;
- struct wlan_network *pcur_wlan = NULL, *ptarget_wlan = NULL;
- unsigned int the_same_macaddr = false;
- struct wlan_network *pnetwork;
-
- if (sizeof(struct list_head) == 4 * sizeof(u32)) {
- pnetwork = kmalloc(sizeof(struct wlan_network), GFP_ATOMIC);
- if (!pnetwork)
- return;
- memcpy((u8 *)pnetwork + 16, (u8 *)pbuf + 8,
- sizeof(struct wlan_network) - 16);
- } else {
- pnetwork = (struct wlan_network *)pbuf;
- }
-
-#ifdef __BIG_ENDIAN
- /* endian_convert */
- pnetwork->join_res = le32_to_cpu(pnetwork->join_res);
- pnetwork->network_type = le32_to_cpu(pnetwork->network_type);
- pnetwork->network.Length = le32_to_cpu(pnetwork->network.Length);
- pnetwork->network.Ssid.SsidLength =
- le32_to_cpu(pnetwork->network.Ssid.SsidLength);
- pnetwork->network.Privacy = le32_to_cpu(pnetwork->network.Privacy);
- pnetwork->network.Rssi = le32_to_cpu(pnetwork->network.Rssi);
- pnetwork->network.NetworkTypeInUse =
- le32_to_cpu(pnetwork->network.NetworkTypeInUse);
- pnetwork->network.Configuration.ATIMWindow =
- le32_to_cpu(pnetwork->network.Configuration.ATIMWindow);
- pnetwork->network.Configuration.BeaconPeriod =
- le32_to_cpu(pnetwork->network.Configuration.BeaconPeriod);
- pnetwork->network.Configuration.DSConfig =
- le32_to_cpu(pnetwork->network.Configuration.DSConfig);
- pnetwork->network.Configuration.FHConfig.DwellTime =
- le32_to_cpu(pnetwork->network.Configuration.FHConfig.DwellTime);
- pnetwork->network.Configuration.FHConfig.HopPattern =
- le32_to_cpu(pnetwork->network.Configuration.FHConfig.HopPattern);
- pnetwork->network.Configuration.FHConfig.HopSet =
- le32_to_cpu(pnetwork->network.Configuration.FHConfig.HopSet);
- pnetwork->network.Configuration.FHConfig.Length =
- le32_to_cpu(pnetwork->network.Configuration.FHConfig.Length);
- pnetwork->network.Configuration.Length =
- le32_to_cpu(pnetwork->network.Configuration.Length);
- pnetwork->network.InfrastructureMode =
- le32_to_cpu(pnetwork->network.InfrastructureMode);
- pnetwork->network.IELength = le32_to_cpu(pnetwork->network.IELength);
-#endif
-
- the_same_macaddr = !memcmp(pnetwork->network.MacAddress,
- cur_network->network.MacAddress, ETH_ALEN);
- pnetwork->network.Length =
- r8712_get_wlan_bssid_ex_sz(&pnetwork->network);
- spin_lock_irqsave(&pmlmepriv->lock, irqL);
- if (pnetwork->network.Length > sizeof(struct wlan_bssid_ex))
- goto ignore_joinbss_callback;
- if (pnetwork->join_res > 0) {
- if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) {
- /*s1. find ptarget_wlan*/
- if (check_fwstate(pmlmepriv, _FW_LINKED)) {
- if (the_same_macaddr) {
- ptarget_wlan =
- r8712_find_network(&pmlmepriv->scanned_queue,
- cur_network->network.MacAddress);
- } else {
- pcur_wlan =
- r8712_find_network(&pmlmepriv->scanned_queue,
- cur_network->network.MacAddress);
- if (pcur_wlan)
- pcur_wlan->fixed = false;
-
- pcur_sta = r8712_get_stainfo(pstapriv,
- cur_network->network.MacAddress);
- spin_lock_irqsave(&pstapriv->sta_hash_lock, irqL2);
- r8712_free_stainfo(adapter, pcur_sta);
- spin_unlock_irqrestore(&(pstapriv->sta_hash_lock), irqL2);
-
- ptarget_wlan =
- r8712_find_network(&pmlmepriv->scanned_queue,
- pnetwork->network.MacAddress);
- if (ptarget_wlan)
- ptarget_wlan->fixed = true;
- }
- } else {
- ptarget_wlan = r8712_find_network(&pmlmepriv->scanned_queue,
- pnetwork->network.MacAddress);
- if (ptarget_wlan)
- ptarget_wlan->fixed = true;
- }
-
- if (!ptarget_wlan) {
- if (check_fwstate(pmlmepriv,
- _FW_UNDER_LINKING))
- pmlmepriv->fw_state ^=
- _FW_UNDER_LINKING;
- goto ignore_joinbss_callback;
- }
-
- /*s2. find ptarget_sta & update ptarget_sta*/
- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) {
- if (the_same_macaddr) {
- ptarget_sta =
- r8712_get_stainfo(pstapriv,
- pnetwork->network.MacAddress);
- if (!ptarget_sta)
- ptarget_sta =
- r8712_alloc_stainfo(pstapriv,
- pnetwork->network.MacAddress);
- } else {
- ptarget_sta =
- r8712_alloc_stainfo(pstapriv,
- pnetwork->network.MacAddress);
- }
- if (ptarget_sta) /*update ptarget_sta*/ {
- ptarget_sta->aid = pnetwork->join_res;
- ptarget_sta->qos_option = 1;
- ptarget_sta->mac_id = 5;
- if (adapter->securitypriv.AuthAlgrthm == 2) {
- adapter->securitypriv.binstallGrpkey = false;
- adapter->securitypriv.busetkipkey = false;
- adapter->securitypriv.bgrpkey_handshake = false;
- ptarget_sta->ieee8021x_blocked = true;
- ptarget_sta->XPrivacy = adapter->
- securitypriv.PrivacyAlgrthm;
- memset((u8 *)&ptarget_sta->x_UncstKey,
- 0,
- sizeof(union Keytype));
- memset((u8 *)&ptarget_sta->tkiprxmickey,
- 0,
- sizeof(union Keytype));
- memset((u8 *)&ptarget_sta->tkiptxmickey,
- 0,
- sizeof(union Keytype));
- memset((u8 *)&ptarget_sta->txpn, 0,
- sizeof(union pn48));
- memset((u8 *)&ptarget_sta->rxpn, 0,
- sizeof(union pn48));
- }
- } else {
- if (check_fwstate(pmlmepriv,
- _FW_UNDER_LINKING))
- pmlmepriv->fw_state ^=
- _FW_UNDER_LINKING;
- goto ignore_joinbss_callback;
- }
- }
-
- /*s3. update cur_network & indicate connect*/
- memcpy(&cur_network->network, &pnetwork->network,
- pnetwork->network.Length);
- cur_network->aid = pnetwork->join_res;
- /*update fw_state will clr _FW_UNDER_LINKING*/
- switch (pnetwork->network.InfrastructureMode) {
- case Ndis802_11Infrastructure:
- pmlmepriv->fw_state = WIFI_STATION_STATE;
- break;
- case Ndis802_11IBSS:
- pmlmepriv->fw_state = WIFI_ADHOC_STATE;
- break;
- default:
- pmlmepriv->fw_state = WIFI_NULL_STATE;
- break;
- }
- r8712_update_protection(adapter,
- (cur_network->network.IEs) +
- sizeof(struct NDIS_802_11_FIXED_IEs),
- (cur_network->network.IELength));
- /*TODO: update HT_Capability*/
- update_ht_cap(adapter, cur_network->network.IEs,
- cur_network->network.IELength);
- /*indicate connect*/
- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE))
- r8712_indicate_connect(adapter);
- del_timer(&pmlmepriv->assoc_timer);
- } else {
- goto ignore_joinbss_callback;
- }
- } else {
- if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) {
- mod_timer(&pmlmepriv->assoc_timer,
- jiffies + msecs_to_jiffies(1));
- _clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
- }
- }
-ignore_joinbss_callback:
- spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
- if (sizeof(struct list_head) == 4 * sizeof(u32))
- kfree(pnetwork);
-}
-
-void r8712_stassoc_event_callback(struct _adapter *adapter, u8 *pbuf)
-{
- unsigned long irqL;
- struct sta_info *psta;
- struct mlme_priv *pmlmepriv = &(adapter->mlmepriv);
- struct stassoc_event *pstassoc = (struct stassoc_event *)pbuf;
-
- /* to do: */
- if (!r8712_access_ctrl(&adapter->acl_list, pstassoc->macaddr))
- return;
- psta = r8712_get_stainfo(&adapter->stapriv, pstassoc->macaddr);
- if (psta) {
- /*the sta have been in sta_info_queue => do nothing
- *(between drv has received this event before and
- * fw have not yet to set key to CAM_ENTRY)
- */
- return;
- }
-
- psta = r8712_alloc_stainfo(&adapter->stapriv, pstassoc->macaddr);
- if (!psta)
- return;
- /* to do : init sta_info variable */
- psta->qos_option = 0;
- psta->mac_id = le32_to_cpu(pstassoc->cam_id);
- /* psta->aid = (uint)pstassoc->cam_id; */
-
- if (adapter->securitypriv.AuthAlgrthm == 2)
- psta->XPrivacy = adapter->securitypriv.PrivacyAlgrthm;
- psta->ieee8021x_blocked = false;
- spin_lock_irqsave(&pmlmepriv->lock, irqL);
- if (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) ||
- check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)) {
- if (adapter->stapriv.asoc_sta_count == 2) {
- /* a sta + bc/mc_stainfo (not Ibss_stainfo) */
- r8712_indicate_connect(adapter);
- }
- }
- spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-}
-
-void r8712_stadel_event_callback(struct _adapter *adapter, u8 *pbuf)
-{
- unsigned long irqL, irqL2;
- struct sta_info *psta;
- struct wlan_network *pwlan = NULL;
- struct wlan_bssid_ex *pdev_network = NULL;
- u8 *pibss = NULL;
- struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
- struct stadel_event *pstadel = (struct stadel_event *)pbuf;
- struct sta_priv *pstapriv = &adapter->stapriv;
- struct wlan_network *tgt_network = &pmlmepriv->cur_network;
-
- spin_lock_irqsave(&pmlmepriv->lock, irqL2);
- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) {
- r8712_ind_disconnect(adapter);
- r8712_free_assoc_resources(adapter);
- }
- if (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE |
- WIFI_ADHOC_STATE)) {
- psta = r8712_get_stainfo(&adapter->stapriv, pstadel->macaddr);
- spin_lock_irqsave(&pstapriv->sta_hash_lock, irqL);
- r8712_free_stainfo(adapter, psta);
- spin_unlock_irqrestore(&pstapriv->sta_hash_lock, irqL);
- if (adapter->stapriv.asoc_sta_count == 1) {
- /*a sta + bc/mc_stainfo (not Ibss_stainfo) */
- pwlan = r8712_find_network(&pmlmepriv->scanned_queue,
- tgt_network->network.MacAddress);
- if (pwlan) {
- pwlan->fixed = false;
- free_network_nolock(pmlmepriv, pwlan);
- }
- /*re-create ibss*/
- pdev_network = &(adapter->registrypriv.dev_network);
- pibss = adapter->registrypriv.dev_network.MacAddress;
- memcpy(pdev_network, &tgt_network->network,
- r8712_get_wlan_bssid_ex_sz(&tgt_network->network));
- memcpy(&pdev_network->Ssid,
- &pmlmepriv->assoc_ssid,
- sizeof(struct ndis_802_11_ssid));
- r8712_update_registrypriv_dev_network(adapter);
- r8712_generate_random_ibss(pibss);
- if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)) {
- _clr_fwstate_(pmlmepriv, WIFI_ADHOC_STATE);
- set_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE);
- }
- }
- }
- spin_unlock_irqrestore(&pmlmepriv->lock, irqL2);
-}
-
-void r8712_cpwm_event_callback(struct _adapter *adapter, u8 *pbuf)
-{
- struct reportpwrstate_parm *preportpwrstate =
- (struct reportpwrstate_parm *)pbuf;
-
- preportpwrstate->state |= (u8)(adapter->pwrctrlpriv.cpwm_tog + 0x80);
- r8712_cpwm_int_hdl(adapter, preportpwrstate);
-}
-
-/* When the Netgear 3500 AP is with WPA2PSK-AES mode, it will send
- * the ADDBA req frame with start seq control = 0 to wifi client after
- * the WPA handshake and the seqence number of following data packet
- * will be 0. In this case, the Rx reorder sequence is not longer than 0
- * and the WiFi client will drop the data with seq number 0.
- * So, the 8712 firmware has to inform driver with receiving the
- * ADDBA-Req frame so that the driver can reset the
- * sequence value of Rx reorder control.
- */
-void r8712_got_addbareq_event_callback(struct _adapter *adapter, u8 *pbuf)
-{
- struct ADDBA_Req_Report_parm *pAddbareq_pram =
- (struct ADDBA_Req_Report_parm *)pbuf;
- struct sta_info *psta;
- struct sta_priv *pstapriv = &adapter->stapriv;
- struct recv_reorder_ctrl *precvreorder_ctrl = NULL;
-
- psta = r8712_get_stainfo(pstapriv, pAddbareq_pram->MacAddress);
- if (psta) {
- precvreorder_ctrl =
- &psta->recvreorder_ctrl[pAddbareq_pram->tid];
- /* set the indicate_seq to 0xffff so that the rx reorder
- * can store any following data packet.
- */
- precvreorder_ctrl->indicate_seq = 0xffff;
- }
-}
-
-void r8712_wpspbc_event_callback(struct _adapter *adapter, u8 *pbuf)
-{
- if (!adapter->securitypriv.wps_hw_pbc_pressed)
- adapter->securitypriv.wps_hw_pbc_pressed = true;
-}
-
-void _r8712_sitesurvey_ctrl_handler(struct _adapter *adapter)
-{
- struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
- struct sitesurvey_ctrl *psitesurveyctrl = &pmlmepriv->sitesurveyctrl;
- struct registry_priv *pregistrypriv = &adapter->registrypriv;
- u64 current_tx_pkts;
- uint current_rx_pkts;
-
- current_tx_pkts = (adapter->xmitpriv.tx_pkts) -
- (psitesurveyctrl->last_tx_pkts);
- current_rx_pkts = (adapter->recvpriv.rx_pkts) -
- (psitesurveyctrl->last_rx_pkts);
- psitesurveyctrl->last_tx_pkts = adapter->xmitpriv.tx_pkts;
- psitesurveyctrl->last_rx_pkts = adapter->recvpriv.rx_pkts;
- if ((current_tx_pkts > pregistrypriv->busy_thresh) ||
- (current_rx_pkts > pregistrypriv->busy_thresh))
- psitesurveyctrl->traffic_busy = true;
- else
- psitesurveyctrl->traffic_busy = false;
-}
-
-void _r8712_join_timeout_handler(struct _adapter *adapter)
-{
- unsigned long irqL;
- struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-
- if (adapter->driver_stopped || adapter->surprise_removed)
- return;
- spin_lock_irqsave(&pmlmepriv->lock, irqL);
- _clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
- pmlmepriv->to_join = false;
- if (check_fwstate(pmlmepriv, _FW_LINKED)) {
- r8712_os_indicate_disconnect(adapter);
- _clr_fwstate_(pmlmepriv, _FW_LINKED);
- }
- if (adapter->pwrctrlpriv.pwr_mode != adapter->registrypriv.power_mgnt) {
- r8712_set_ps_mode(adapter, adapter->registrypriv.power_mgnt,
- adapter->registrypriv.smart_ps);
- }
- spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-}
-
-void r8712_scan_timeout_handler (struct _adapter *adapter)
-{
- unsigned long irqL;
- struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-
- spin_lock_irqsave(&pmlmepriv->lock, irqL);
- _clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
- pmlmepriv->to_join = false; /* scan fail, so clear to_join flag */
- spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-}
-
-void _r8712_dhcp_timeout_handler (struct _adapter *adapter)
-{
- if (adapter->driver_stopped || adapter->surprise_removed)
- return;
- if (adapter->pwrctrlpriv.pwr_mode != adapter->registrypriv.power_mgnt)
- r8712_set_ps_mode(adapter, adapter->registrypriv.power_mgnt,
- adapter->registrypriv.smart_ps);
-}
-
-int r8712_select_and_join_from_scan(struct mlme_priv *pmlmepriv)
-{
- struct list_head *phead;
- unsigned char *dst_ssid, *src_ssid;
- struct _adapter *adapter;
- struct __queue *queue = NULL;
- struct wlan_network *pnetwork = NULL;
- struct wlan_network *pnetwork_max_rssi = NULL;
-
- adapter = (struct _adapter *)pmlmepriv->nic_hdl;
- queue = &pmlmepriv->scanned_queue;
- phead = &queue->queue;
- pmlmepriv->pscanned = phead->next;
- while (1) {
- if (end_of_queue_search(phead, pmlmepriv->pscanned)) {
- if (pmlmepriv->assoc_by_rssi && pnetwork_max_rssi) {
- pnetwork = pnetwork_max_rssi;
- goto ask_for_joinbss;
- }
- return -EINVAL;
- }
- pnetwork = container_of(pmlmepriv->pscanned,
- struct wlan_network, list);
- pmlmepriv->pscanned = pmlmepriv->pscanned->next;
- if (pmlmepriv->assoc_by_bssid) {
- dst_ssid = pnetwork->network.MacAddress;
- src_ssid = pmlmepriv->assoc_bssid;
- if (!memcmp(dst_ssid, src_ssid, ETH_ALEN)) {
- if (check_fwstate(pmlmepriv, _FW_LINKED)) {
- if (is_same_network(&pmlmepriv->cur_network.network,
- &pnetwork->network)) {
- _clr_fwstate_(pmlmepriv,
- _FW_UNDER_LINKING);
- /*r8712_indicate_connect again*/
- r8712_indicate_connect(adapter);
- return 2;
- }
- r8712_disassoc_cmd(adapter);
- r8712_ind_disconnect(adapter);
- r8712_free_assoc_resources(adapter);
- }
- goto ask_for_joinbss;
- }
- } else if (pmlmepriv->assoc_ssid.SsidLength == 0) {
- goto ask_for_joinbss;
- }
- dst_ssid = pnetwork->network.Ssid.Ssid;
- src_ssid = pmlmepriv->assoc_ssid.Ssid;
- if ((pnetwork->network.Ssid.SsidLength ==
- pmlmepriv->assoc_ssid.SsidLength) &&
- (!memcmp(dst_ssid, src_ssid,
- pmlmepriv->assoc_ssid.SsidLength))) {
- if (pmlmepriv->assoc_by_rssi) {
- /* if the ssid is the same, select the bss
- * which has the max rssi
- */
- if (pnetwork_max_rssi) {
- if (pnetwork->network.Rssi >
- pnetwork_max_rssi->network.Rssi)
- pnetwork_max_rssi = pnetwork;
- } else {
- pnetwork_max_rssi = pnetwork;
- }
- } else if (is_desired_network(adapter, pnetwork)) {
- if (check_fwstate(pmlmepriv, _FW_LINKED)) {
- r8712_disassoc_cmd(adapter);
- r8712_free_assoc_resources(adapter);
- }
- goto ask_for_joinbss;
- }
- }
- }
-
-ask_for_joinbss:
- return r8712_joinbss_cmd(adapter, pnetwork);
-}
-
-int r8712_set_auth(struct _adapter *adapter,
- struct security_priv *psecuritypriv)
-{
- struct cmd_priv *pcmdpriv = &adapter->cmdpriv;
- struct cmd_obj *pcmd;
- struct setauth_parm *psetauthparm;
-
- pcmd = kmalloc(sizeof(*pcmd), GFP_ATOMIC);
- if (!pcmd)
- return -ENOMEM;
-
- psetauthparm = kzalloc(sizeof(*psetauthparm), GFP_ATOMIC);
- if (!psetauthparm) {
- kfree(pcmd);
- return -ENOMEM;
- }
- psetauthparm->mode = (u8)psecuritypriv->AuthAlgrthm;
- pcmd->cmdcode = _SetAuth_CMD_;
- pcmd->parmbuf = (unsigned char *)psetauthparm;
- pcmd->cmdsz = sizeof(struct setauth_parm);
- pcmd->rsp = NULL;
- pcmd->rspsz = 0;
- INIT_LIST_HEAD(&pcmd->list);
- r8712_enqueue_cmd(pcmdpriv, pcmd);
- return 0;
-}
-
-int r8712_set_key(struct _adapter *adapter,
- struct security_priv *psecuritypriv,
- sint keyid)
-{
- struct cmd_priv *pcmdpriv = &adapter->cmdpriv;
- struct cmd_obj *pcmd;
- struct setkey_parm *psetkeyparm;
- u8 keylen;
- int ret;
-
- pcmd = kmalloc(sizeof(*pcmd), GFP_ATOMIC);
- if (!pcmd)
- return -ENOMEM;
- psetkeyparm = kzalloc(sizeof(*psetkeyparm), GFP_ATOMIC);
- if (!psetkeyparm) {
- ret = -ENOMEM;
- goto err_free_cmd;
- }
- if (psecuritypriv->AuthAlgrthm == 2) { /* 802.1X */
- psetkeyparm->algorithm =
- (u8)psecuritypriv->XGrpPrivacy;
- } else { /* WEP */
- psetkeyparm->algorithm =
- (u8)psecuritypriv->PrivacyAlgrthm;
- }
- psetkeyparm->keyid = (u8)keyid;
-
- switch (psetkeyparm->algorithm) {
- case _WEP40_:
- keylen = 5;
- memcpy(psetkeyparm->key,
- psecuritypriv->DefKey[keyid].skey, keylen);
- break;
- case _WEP104_:
- keylen = 13;
- memcpy(psetkeyparm->key,
- psecuritypriv->DefKey[keyid].skey, keylen);
- break;
- case _TKIP_:
- if (keyid < 1 || keyid > 2) {
- ret = -EINVAL;
- goto err_free_parm;
- }
- keylen = 16;
- memcpy(psetkeyparm->key,
- &psecuritypriv->XGrpKey[keyid - 1], keylen);
- psetkeyparm->grpkey = 1;
- break;
- case _AES_:
- if (keyid < 1 || keyid > 2) {
- ret = -EINVAL;
- goto err_free_parm;
- }
- keylen = 16;
- memcpy(psetkeyparm->key,
- &psecuritypriv->XGrpKey[keyid - 1], keylen);
- psetkeyparm->grpkey = 1;
- break;
- default:
- ret = -EINVAL;
- goto err_free_parm;
- }
- pcmd->cmdcode = _SetKey_CMD_;
- pcmd->parmbuf = (u8 *)psetkeyparm;
- pcmd->cmdsz = (sizeof(struct setkey_parm));
- pcmd->rsp = NULL;
- pcmd->rspsz = 0;
- INIT_LIST_HEAD(&pcmd->list);
- r8712_enqueue_cmd(pcmdpriv, pcmd);
- return 0;
-
-err_free_parm:
- kfree(psetkeyparm);
-err_free_cmd:
- kfree(pcmd);
- return ret;
-}
-
-/* adjust IEs for r8712_joinbss_cmd in WMM */
-int r8712_restruct_wmm_ie(struct _adapter *adapter, u8 *in_ie, u8 *out_ie,
- uint in_len, uint initial_out_len)
-{
- unsigned int ielength = 0;
- unsigned int i, j;
-
- i = 12; /* after the fixed IE */
- while (i < in_len) {
- ielength = initial_out_len;
- if (in_ie[i] == 0xDD && in_ie[i + 2] == 0x00 &&
- in_ie[i + 3] == 0x50 && in_ie[i + 4] == 0xF2 &&
- in_ie[i + 5] == 0x02 && i + 5 < in_len) {
- /*WMM element ID and OUI*/
- for (j = i; j < i + 9; j++) {
- out_ie[ielength] = in_ie[j];
- ielength++;
- }
- out_ie[initial_out_len + 1] = 0x07;
- out_ie[initial_out_len + 6] = 0x00;
- out_ie[initial_out_len + 8] = 0x00;
- break;
- }
- i += (in_ie[i + 1] + 2); /* to the next IE element */
- }
- return ielength;
-}
-
-/*
- * Ported from 8185: IsInPreAuthKeyList().
- *
- * Search by BSSID,
- * Return Value:
- * -1 :if there is no pre-auth key in the table
- * >=0 :if there is pre-auth key, and return the entry id
- */
-static int SecIsInPMKIDList(struct _adapter *Adapter, u8 *bssid)
-{
- struct security_priv *p = &Adapter->securitypriv;
- int i;
-
- for (i = 0; i < NUM_PMKID_CACHE; i++)
- if (p->PMKIDList[i].bUsed && !memcmp(p->PMKIDList[i].Bssid, bssid, ETH_ALEN))
- return i;
- return -1;
-}
-
-sint r8712_restruct_sec_ie(struct _adapter *adapter, u8 *in_ie,
- u8 *out_ie, uint in_len)
-{
- u8 authmode = 0, match;
- u8 sec_ie[IW_CUSTOM_MAX], uncst_oui[4], bkup_ie[255];
- u8 wpa_oui[4] = {0x0, 0x50, 0xf2, 0x01};
- uint ielength, cnt, remove_cnt;
- int iEntry;
- struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
- struct security_priv *psecuritypriv = &adapter->securitypriv;
- uint ndisauthmode = psecuritypriv->ndisauthtype;
- uint ndissecuritytype = psecuritypriv->ndisencryptstatus;
-
- if ((ndisauthmode == Ndis802_11AuthModeWPA) ||
- (ndisauthmode == Ndis802_11AuthModeWPAPSK)) {
- authmode = _WPA_IE_ID_;
- uncst_oui[0] = 0x0;
- uncst_oui[1] = 0x50;
- uncst_oui[2] = 0xf2;
- }
- if ((ndisauthmode == Ndis802_11AuthModeWPA2) ||
- (ndisauthmode == Ndis802_11AuthModeWPA2PSK)) {
- authmode = _WPA2_IE_ID_;
- uncst_oui[0] = 0x0;
- uncst_oui[1] = 0x0f;
- uncst_oui[2] = 0xac;
- }
- switch (ndissecuritytype) {
- case Ndis802_11Encryption1Enabled:
- case Ndis802_11Encryption1KeyAbsent:
- uncst_oui[3] = 0x1;
- break;
- case Ndis802_11Encryption2Enabled:
- case Ndis802_11Encryption2KeyAbsent:
- uncst_oui[3] = 0x2;
- break;
- case Ndis802_11Encryption3Enabled:
- case Ndis802_11Encryption3KeyAbsent:
- uncst_oui[3] = 0x4;
- break;
- default:
- break;
- }
- /*Search required WPA or WPA2 IE and copy to sec_ie[] */
- cnt = 12;
- match = false;
- while (cnt < in_len) {
- if (in_ie[cnt] == authmode) {
- if ((authmode == _WPA_IE_ID_) &&
- (!memcmp(&in_ie[cnt + 2], &wpa_oui[0], 4))) {
- memcpy(&sec_ie[0], &in_ie[cnt],
- in_ie[cnt + 1] + 2);
- match = true;
- break;
- }
- if (authmode == _WPA2_IE_ID_) {
- memcpy(&sec_ie[0], &in_ie[cnt],
- in_ie[cnt + 1] + 2);
- match = true;
- break;
- }
- if (((authmode == _WPA_IE_ID_) &&
- (!memcmp(&in_ie[cnt + 2], &wpa_oui[0], 4))) ||
- (authmode == _WPA2_IE_ID_))
- memcpy(&bkup_ie[0], &in_ie[cnt],
- in_ie[cnt + 1] + 2);
- }
- cnt += in_ie[cnt + 1] + 2; /*get next*/
- }
- /*restruct WPA IE or WPA2 IE in sec_ie[] */
- if (match) {
- if (sec_ie[0] == _WPA_IE_ID_) {
- /* parsing SSN IE to select required encryption
- * algorithm, and set the bc/mc encryption algorithm
- */
- while (true) {
- /*check wpa_oui tag*/
- if (memcmp(&sec_ie[2], &wpa_oui[0], 4)) {
- match = false;
- break;
- }
- if ((sec_ie[6] != 0x01) || (sec_ie[7] != 0x0)) {
- /*IE Ver error*/
- match = false;
- break;
- }
- if (!memcmp(&sec_ie[8], &wpa_oui[0], 3)) {
- /* get bc/mc encryption type (group
- * key type)
- */
- switch (sec_ie[11]) {
- case 0x0: /*none*/
- psecuritypriv->XGrpPrivacy =
- _NO_PRIVACY_;
- break;
- case 0x1: /*WEP_40*/
- psecuritypriv->XGrpPrivacy =
- _WEP40_;
- break;
- case 0x2: /*TKIP*/
- psecuritypriv->XGrpPrivacy =
- _TKIP_;
- break;
- case 0x3: /*AESCCMP*/
- case 0x4:
- psecuritypriv->XGrpPrivacy =
- _AES_;
- break;
- case 0x5: /*WEP_104*/
- psecuritypriv->XGrpPrivacy =
- _WEP104_;
- break;
- }
- } else {
- match = false;
- break;
- }
- if (sec_ie[12] == 0x01) {
- /*check the unicast encryption type*/
- if (memcmp(&sec_ie[14],
- &uncst_oui[0], 4)) {
- match = false;
- break;
-
- } /*else the uncst_oui is match*/
- } else { /*mixed mode, unicast_enc_type > 1*/
- /*select the uncst_oui and remove
- * the other uncst_oui
- */
- cnt = sec_ie[12];
- remove_cnt = (cnt - 1) * 4;
- sec_ie[12] = 0x01;
- memcpy(&sec_ie[14], &uncst_oui[0], 4);
- /*remove the other unicast suit*/
- memcpy(&sec_ie[18],
- &sec_ie[18 + remove_cnt],
- sec_ie[1] - 18 + 2 -
- remove_cnt);
- sec_ie[1] = sec_ie[1] - remove_cnt;
- }
- break;
- }
- }
- if (authmode == _WPA2_IE_ID_) {
- /* parsing RSN IE to select required encryption
- * algorithm, and set the bc/mc encryption algorithm
- */
- while (true) {
- if ((sec_ie[2] != 0x01) || (sec_ie[3] != 0x0)) {
- /*IE Ver error*/
- match = false;
- break;
- }
- if (!memcmp(&sec_ie[4], &uncst_oui[0], 3)) {
- /*get bc/mc encryption type*/
- switch (sec_ie[7]) {
- case 0x1: /*WEP_40*/
- psecuritypriv->XGrpPrivacy =
- _WEP40_;
- break;
- case 0x2: /*TKIP*/
- psecuritypriv->XGrpPrivacy =
- _TKIP_;
- break;
- case 0x4: /*AESWRAP*/
- psecuritypriv->XGrpPrivacy =
- _AES_;
- break;
- case 0x5: /*WEP_104*/
- psecuritypriv->XGrpPrivacy =
- _WEP104_;
- break;
- default: /*one*/
- psecuritypriv->XGrpPrivacy =
- _NO_PRIVACY_;
- break;
- }
- } else {
- match = false;
- break;
- }
- if (sec_ie[8] == 0x01) {
- /*check the unicast encryption type*/
- if (memcmp(&sec_ie[10],
- &uncst_oui[0], 4)) {
- match = false;
- break;
- } /*else the uncst_oui is match*/
- } else { /*mixed mode, unicast_enc_type > 1*/
- /*select the uncst_oui and remove the
- * other uncst_oui
- */
- cnt = sec_ie[8];
- remove_cnt = (cnt - 1) * 4;
- sec_ie[8] = 0x01;
- memcpy(&sec_ie[10], &uncst_oui[0], 4);
- /*remove the other unicast suit*/
- memcpy(&sec_ie[14],
- &sec_ie[14 + remove_cnt],
- (sec_ie[1] - 14 + 2 -
- remove_cnt));
- sec_ie[1] = sec_ie[1] - remove_cnt;
- }
- break;
- }
- }
- }
- if ((authmode == _WPA_IE_ID_) || (authmode == _WPA2_IE_ID_)) {
- /*copy fixed ie*/
- memcpy(out_ie, in_ie, 12);
- ielength = 12;
- /*copy RSN or SSN*/
- if (match) {
- memcpy(&out_ie[ielength], &sec_ie[0], sec_ie[1] + 2);
- ielength += sec_ie[1] + 2;
- if (authmode == _WPA2_IE_ID_) {
- /*the Pre-Authentication bit should be zero*/
- out_ie[ielength - 1] = 0;
- out_ie[ielength - 2] = 0;
- }
- r8712_report_sec_ie(adapter, authmode, sec_ie);
- }
- } else {
- /*copy fixed ie only*/
- memcpy(out_ie, in_ie, 12);
- ielength = 12;
- if (psecuritypriv->wps_phase) {
- memcpy(out_ie + ielength, psecuritypriv->wps_ie,
- psecuritypriv->wps_ie_len);
- ielength += psecuritypriv->wps_ie_len;
- }
- }
- iEntry = SecIsInPMKIDList(adapter, pmlmepriv->assoc_bssid);
- if (iEntry < 0)
- return ielength;
- if (authmode == _WPA2_IE_ID_) {
- out_ie[ielength] = 1;
- ielength++;
- out_ie[ielength] = 0; /*PMKID count = 0x0100*/
- ielength++;
- memcpy(&out_ie[ielength],
- &psecuritypriv->PMKIDList[iEntry].PMKID, 16);
- ielength += 16;
- out_ie[13] += 18;/*PMKID length = 2+16*/
- }
- return ielength;
-}
-
-void r8712_init_registrypriv_dev_network(struct _adapter *adapter)
-{
- struct registry_priv *pregistrypriv = &adapter->registrypriv;
- struct eeprom_priv *peepriv = &adapter->eeprompriv;
- struct wlan_bssid_ex *pdev_network = &pregistrypriv->dev_network;
- u8 *myhwaddr = myid(peepriv);
-
- memcpy(pdev_network->MacAddress, myhwaddr, ETH_ALEN);
- memcpy(&pdev_network->Ssid, &pregistrypriv->ssid,
- sizeof(struct ndis_802_11_ssid));
- pdev_network->Configuration.Length =
- sizeof(struct NDIS_802_11_CONFIGURATION);
- pdev_network->Configuration.BeaconPeriod = 100;
- pdev_network->Configuration.FHConfig.Length = 0;
- pdev_network->Configuration.FHConfig.HopPattern = 0;
- pdev_network->Configuration.FHConfig.HopSet = 0;
- pdev_network->Configuration.FHConfig.DwellTime = 0;
-}
-
-void r8712_update_registrypriv_dev_network(struct _adapter *adapter)
-{
- int sz = 0;
- struct registry_priv *pregistrypriv = &adapter->registrypriv;
- struct wlan_bssid_ex *pdev_network = &pregistrypriv->dev_network;
- struct security_priv *psecuritypriv = &adapter->securitypriv;
- struct wlan_network *cur_network = &adapter->mlmepriv.cur_network;
-
- pdev_network->Privacy = cpu_to_le32(psecuritypriv->PrivacyAlgrthm
- > 0 ? 1 : 0); /* adhoc no 802.1x */
- pdev_network->Rssi = 0;
- switch (pregistrypriv->wireless_mode) {
- case WIRELESS_11B:
- pdev_network->NetworkTypeInUse = Ndis802_11DS;
- break;
- case WIRELESS_11G:
- case WIRELESS_11BG:
- pdev_network->NetworkTypeInUse = Ndis802_11OFDM24;
- break;
- case WIRELESS_11A:
- pdev_network->NetworkTypeInUse = Ndis802_11OFDM5;
- break;
- default:
- /* TODO */
- break;
- }
- pdev_network->Configuration.DSConfig = pregistrypriv->channel;
- if (cur_network->network.InfrastructureMode == Ndis802_11IBSS)
- pdev_network->Configuration.ATIMWindow = 3;
- pdev_network->InfrastructureMode = cur_network->network.InfrastructureMode;
- /* 1. Supported rates
- * 2. IE
- */
- sz = r8712_generate_ie(pregistrypriv);
- pdev_network->IELength = sz;
- pdev_network->Length = r8712_get_wlan_bssid_ex_sz(pdev_network);
-}
-
-/*the function is at passive_level*/
-void r8712_joinbss_reset(struct _adapter *padapter)
-{
- int i;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct ht_priv *phtpriv = &pmlmepriv->htpriv;
-
- /* todo: if you want to do something io/reg/hw setting before join_bss,
- * please add code here
- */
- phtpriv->ampdu_enable = false;/*reset to disabled*/
- for (i = 0; i < 16; i++)
- phtpriv->baddbareq_issued[i] = false;/*reset it*/
- if (phtpriv->ht_option) {
- /* validate usb rx aggregation */
- r8712_write8(padapter, 0x102500D9, 48);/*TH = 48 pages, 6k*/
- } else {
- /* invalidate usb rx aggregation */
- /* TH=1 => means that invalidate usb rx aggregation */
- r8712_write8(padapter, 0x102500D9, 1);
- }
-}
-
-/*the function is >= passive_level*/
-unsigned int r8712_restructure_ht_ie(struct _adapter *padapter, u8 *in_ie,
- u8 *out_ie, uint in_len, uint *pout_len)
-{
- u32 ielen, out_len;
- unsigned char *p;
- struct ieee80211_ht_cap ht_capie;
- unsigned char WMM_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01, 0x00};
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct qos_priv *pqospriv = &pmlmepriv->qospriv;
- struct ht_priv *phtpriv = &pmlmepriv->htpriv;
-
- phtpriv->ht_option = 0;
- p = r8712_get_ie(in_ie + 12, WLAN_EID_HT_CAPABILITY, &ielen, in_len - 12);
- if (p && (ielen > 0)) {
- if (pqospriv->qos_option == 0) {
- out_len = *pout_len;
- r8712_set_ie(out_ie + out_len, WLAN_EID_VENDOR_SPECIFIC,
- _WMM_IE_Length_, WMM_IE, pout_len);
- pqospriv->qos_option = 1;
- }
- out_len = *pout_len;
- memset(&ht_capie, 0, sizeof(struct ieee80211_ht_cap));
- ht_capie.cap_info = cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
- IEEE80211_HT_CAP_SGI_20 |
- IEEE80211_HT_CAP_SGI_40 |
- IEEE80211_HT_CAP_TX_STBC |
- IEEE80211_HT_CAP_MAX_AMSDU |
- IEEE80211_HT_CAP_DSSSCCK40);
- ht_capie.ampdu_params_info = (IEEE80211_HT_AMPDU_PARM_FACTOR &
- 0x03) | (IEEE80211_HT_AMPDU_PARM_DENSITY & 0x00);
- r8712_set_ie(out_ie + out_len, WLAN_EID_HT_CAPABILITY,
- sizeof(struct ieee80211_ht_cap),
- (unsigned char *)&ht_capie, pout_len);
- phtpriv->ht_option = 1;
- }
- return phtpriv->ht_option;
-}
-
-/* the function is > passive_level (in critical_section) */
-static void update_ht_cap(struct _adapter *padapter, u8 *pie, uint ie_len)
-{
- u8 *p, max_ampdu_sz;
- int i;
- uint len;
- struct sta_info *bmc_sta, *psta;
- struct ieee80211_ht_cap *pht_capie;
- struct recv_reorder_ctrl *preorder_ctrl;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct ht_priv *phtpriv = &pmlmepriv->htpriv;
- struct registry_priv *pregistrypriv = &padapter->registrypriv;
- struct wlan_network *pcur_network = &(pmlmepriv->cur_network);
-
- if (!phtpriv->ht_option)
- return;
- /* maybe needs check if ap supports rx ampdu. */
- if (!phtpriv->ampdu_enable &&
- (pregistrypriv->ampdu_enable == 1))
- phtpriv->ampdu_enable = true;
- /*check Max Rx A-MPDU Size*/
- len = 0;
- p = r8712_get_ie(pie + sizeof(struct NDIS_802_11_FIXED_IEs),
- WLAN_EID_HT_CAPABILITY,
- &len, ie_len -
- sizeof(struct NDIS_802_11_FIXED_IEs));
- if (p && len > 0) {
- pht_capie = (struct ieee80211_ht_cap *)(p + 2);
- max_ampdu_sz = (pht_capie->ampdu_params_info &
- IEEE80211_HT_AMPDU_PARM_FACTOR);
- /* max_ampdu_sz (kbytes); */
- max_ampdu_sz = 1 << (max_ampdu_sz + 3);
- phtpriv->rx_ampdu_maxlen = max_ampdu_sz;
- }
- /* for A-MPDU Rx reordering buffer control for bmc_sta & sta_info
- * if A-MPDU Rx is enabled, resetting rx_ordering_ctrl
- * wstart_b(indicate_seq) to default value=0xffff
- * todo: check if AP can send A-MPDU packets
- */
- bmc_sta = r8712_get_bcmc_stainfo(padapter);
- if (bmc_sta) {
- for (i = 0; i < 16; i++) {
- preorder_ctrl = &bmc_sta->recvreorder_ctrl[i];
- preorder_ctrl->indicate_seq = 0xffff;
- preorder_ctrl->wend_b = 0xffff;
- }
- }
- psta = r8712_get_stainfo(&padapter->stapriv,
- pcur_network->network.MacAddress);
- if (psta) {
- for (i = 0; i < 16; i++) {
- preorder_ctrl = &psta->recvreorder_ctrl[i];
- preorder_ctrl->indicate_seq = 0xffff;
- preorder_ctrl->wend_b = 0xffff;
- }
- }
- len = 0;
- p = r8712_get_ie(pie + sizeof(struct NDIS_802_11_FIXED_IEs),
- WLAN_EID_HT_OPERATION, &len,
- ie_len - sizeof(struct NDIS_802_11_FIXED_IEs));
-}
-
-void r8712_issue_addbareq_cmd(struct _adapter *padapter, int priority)
-{
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct ht_priv *phtpriv = &pmlmepriv->htpriv;
-
- if ((phtpriv->ht_option == 1) && (phtpriv->ampdu_enable)) {
- if (!phtpriv->baddbareq_issued[priority]) {
- r8712_addbareq_cmd(padapter, (u8)priority);
- phtpriv->baddbareq_issued[priority] = true;
- }
- }
-}
--- a/drivers/staging/rtl8712/rtl871x_mlme.h
+++ /dev/null
@@ -1,205 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL871X_MLME_H_
-#define __RTL871X_MLME_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "wlan_bssdef.h"
-
-#define MAX_BSS_CNT 64
-#define MAX_JOIN_TIMEOUT 6000
-
-#define SCANNING_TIMEOUT 4500
-
-#define SCANQUEUE_LIFETIME 20 /* unit:sec */
-
-#define WIFI_NULL_STATE 0x00000000
-#define WIFI_ASOC_STATE 0x00000001 /* Under Linked state...*/
-#define WIFI_REASOC_STATE 0x00000002
-#define WIFI_SLEEP_STATE 0x00000004
-#define WIFI_STATION_STATE 0x00000008
-#define WIFI_AP_STATE 0x00000010
-#define WIFI_ADHOC_STATE 0x00000020
-#define WIFI_ADHOC_MASTER_STATE 0x00000040
-#define WIFI_UNDER_LINKING 0x00000080
-#define WIFI_SITE_MONITOR 0x00000800 /* to indicate the station
- * is under site surveying
- */
-#define WIFI_MP_STATE 0x00010000
-#define WIFI_MP_CTX_BACKGROUND 0x00020000 /* in cont. tx background*/
-#define WIFI_MP_CTX_ST 0x00040000 /* in cont. tx with
- * single-tone
- */
-#define WIFI_MP_CTX_BACKGROUND_PENDING 0x00080000 /* pending in cont, tx
- * background due
- * to out of skb
- */
-#define WIFI_MP_CTX_CCK_HW 0x00100000 /* in continuous tx*/
-#define WIFI_MP_CTX_CCK_CS 0x00200000 /* in cont, tx with carrier
- * suppression
- */
-#define WIFI_MP_LPBK_STATE 0x00400000
-
-#define _FW_UNDER_LINKING WIFI_UNDER_LINKING
-#define _FW_LINKED WIFI_ASOC_STATE
-#define _FW_UNDER_SURVEY WIFI_SITE_MONITOR
-
-/*
- * there are several "locks" in mlme_priv,
- * since mlme_priv is a shared resource between many threads,
- * like ISR/Call-Back functions, the OID handlers, and even timer functions.
- * Each _queue has its own locks, already.
- * Other items are protected by mlme_priv.lock.
- * To avoid possible dead lock, any thread trying to modify mlme_priv
- * SHALL not lock up more than one lock at a time!
- */
-
-#define traffic_threshold 10
-#define traffic_scan_period 500
-
-struct sitesurvey_ctrl {
- u64 last_tx_pkts;
- uint last_rx_pkts;
- sint traffic_busy;
- struct timer_list sitesurvey_ctrl_timer;
-};
-
-struct mlme_priv {
- spinlock_t lock;
- spinlock_t lock2;
- sint fw_state; /*shall we protect this variable? */
- u8 to_join; /*flag*/
- u8 *nic_hdl;
- struct list_head *pscanned;
- struct __queue free_bss_pool;
- struct __queue scanned_queue;
- u8 *free_bss_buf;
- unsigned long num_of_scanned;
- u8 passive_mode; /*add for Android's SCAN-ACTIVE/SCAN-PASSIVE */
- struct ndis_802_11_ssid assoc_ssid;
- u8 assoc_bssid[6];
- struct wlan_network cur_network;
- struct sitesurvey_ctrl sitesurveyctrl;
- struct timer_list assoc_timer;
- uint assoc_by_bssid;
- uint assoc_by_rssi;
- struct timer_list scan_to_timer; /* driver handles scan_timeout.*/
- struct timer_list dhcp_timer; /* set dhcp to if driver in ps mode.*/
- struct qos_priv qospriv;
- struct ht_priv htpriv;
- struct timer_list wdg_timer; /*watchdog periodic timer*/
-};
-
-static inline u8 *get_bssid(struct mlme_priv *pmlmepriv)
-{
- return pmlmepriv->cur_network.network.MacAddress;
-}
-
-static inline u8 check_fwstate(struct mlme_priv *pmlmepriv, sint state)
-{
- if (pmlmepriv->fw_state & state)
- return true;
- return false;
-}
-
-static inline sint get_fwstate(struct mlme_priv *pmlmepriv)
-{
- return pmlmepriv->fw_state;
-}
-
-/*
- * No Limit on the calling context,
- * therefore set it to be the critical section...
- *
- * ### NOTE:#### (!!!!)
- * TAKE CARE BEFORE CALLING THIS FUNC, LOCK pmlmepriv->lock
- */
-static inline void set_fwstate(struct mlme_priv *pmlmepriv, sint state)
-{
- pmlmepriv->fw_state |= state;
-}
-
-static inline void _clr_fwstate_(struct mlme_priv *pmlmepriv, sint state)
-{
- pmlmepriv->fw_state &= ~state;
-}
-
-/*
- * No Limit on the calling context,
- * therefore set it to be the critical section...
- */
-static inline void clr_fwstate(struct mlme_priv *pmlmepriv, sint state)
-{
- unsigned long irqL;
-
- spin_lock_irqsave(&pmlmepriv->lock, irqL);
- if (check_fwstate(pmlmepriv, state))
- pmlmepriv->fw_state ^= state;
- spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-}
-
-static inline void set_scanned_network_val(struct mlme_priv *pmlmepriv,
- sint val)
-{
- unsigned long irqL;
-
- spin_lock_irqsave(&pmlmepriv->lock, irqL);
- pmlmepriv->num_of_scanned = val;
- spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-}
-
-void r8712_survey_event_callback(struct _adapter *adapter, u8 *pbuf);
-void r8712_surveydone_event_callback(struct _adapter *adapter, u8 *pbuf);
-void r8712_joinbss_event_callback(struct _adapter *adapter, u8 *pbuf);
-void r8712_stassoc_event_callback(struct _adapter *adapter, u8 *pbuf);
-void r8712_stadel_event_callback(struct _adapter *adapter, u8 *pbuf);
-void r8712_atimdone_event_callback(struct _adapter *adapter, u8 *pbuf);
-void r8712_cpwm_event_callback(struct _adapter *adapter, u8 *pbuf);
-void r8712_wpspbc_event_callback(struct _adapter *adapter, u8 *pbuf);
-void r8712_free_network_queue(struct _adapter *adapter);
-int r8712_init_mlme_priv(struct _adapter *adapter);
-void r8712_free_mlme_priv(struct mlme_priv *pmlmepriv);
-int r8712_select_and_join_from_scan(struct mlme_priv *pmlmepriv);
-int r8712_set_key(struct _adapter *adapter,
- struct security_priv *psecuritypriv, sint keyid);
-int r8712_set_auth(struct _adapter *adapter,
- struct security_priv *psecuritypriv);
-uint r8712_get_wlan_bssid_ex_sz(struct wlan_bssid_ex *bss);
-void r8712_generate_random_ibss(u8 *pibss);
-u8 *r8712_get_capability_from_ie(u8 *ie);
-struct wlan_network *r8712_get_oldest_wlan_network(
- struct __queue *scanned_queue);
-void r8712_free_assoc_resources(struct _adapter *adapter);
-void r8712_ind_disconnect(struct _adapter *adapter);
-void r8712_indicate_connect(struct _adapter *adapter);
-int r8712_restruct_sec_ie(struct _adapter *adapter, u8 *in_ie,
- u8 *out_ie, uint in_len);
-int r8712_restruct_wmm_ie(struct _adapter *adapter, u8 *in_ie,
- u8 *out_ie, uint in_len, uint initial_out_len);
-void r8712_init_registrypriv_dev_network(struct _adapter *adapter);
-void r8712_update_registrypriv_dev_network(struct _adapter *adapter);
-void _r8712_sitesurvey_ctrl_handler(struct _adapter *adapter);
-void _r8712_join_timeout_handler(struct _adapter *adapter);
-void r8712_scan_timeout_handler(struct _adapter *adapter);
-void _r8712_dhcp_timeout_handler(struct _adapter *adapter);
-struct wlan_network *_r8712_alloc_network(struct mlme_priv *pmlmepriv);
-sint r8712_if_up(struct _adapter *padapter);
-void r8712_joinbss_reset(struct _adapter *padapter);
-unsigned int r8712_restructure_ht_ie(struct _adapter *padapter, u8 *in_ie,
- u8 *out_ie, uint in_len, uint *pout_len);
-void r8712_issue_addbareq_cmd(struct _adapter *padapter, int priority);
-int r8712_is_same_ibss(struct _adapter *adapter, struct wlan_network *pnetwork);
-
-#endif /*__RTL871X_MLME_H_*/
--- a/drivers/staging/rtl8712/rtl871x_mp.c
+++ /dev/null
@@ -1,724 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#define _RTL871X_MP_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "rtl871x_mp_phy_regdef.h"
-#include "rtl8712_cmd.h"
-
-static void _init_mp_priv_(struct mp_priv *pmp_priv)
-{
- pmp_priv->mode = _LOOPBOOK_MODE_;
- pmp_priv->curr_ch = 1;
- pmp_priv->curr_modem = MIXED_PHY;
- pmp_priv->curr_rateidx = 0;
- pmp_priv->curr_txpoweridx = 0x14;
- pmp_priv->antenna_tx = ANTENNA_A;
- pmp_priv->antenna_rx = ANTENNA_AB;
- pmp_priv->check_mp_pkt = 0;
- pmp_priv->tx_pktcount = 0;
- pmp_priv->rx_pktcount = 0;
- pmp_priv->rx_crcerrpktcount = 0;
-}
-
-static int init_mp_priv(struct mp_priv *pmp_priv)
-{
- int i;
- struct mp_xmit_frame *pmp_xmitframe;
-
- _init_mp_priv_(pmp_priv);
- _init_queue(&pmp_priv->free_mp_xmitqueue);
- pmp_priv->pallocated_mp_xmitframe_buf = NULL;
- pmp_priv->pallocated_mp_xmitframe_buf = kmalloc(NR_MP_XMITFRAME *
- sizeof(struct mp_xmit_frame) + 4,
- GFP_ATOMIC);
- if (!pmp_priv->pallocated_mp_xmitframe_buf)
- return -ENOMEM;
-
- pmp_priv->pmp_xmtframe_buf = pmp_priv->pallocated_mp_xmitframe_buf +
- 4 -
- ((addr_t)(pmp_priv->pallocated_mp_xmitframe_buf) & 3);
- pmp_xmitframe = (struct mp_xmit_frame *)pmp_priv->pmp_xmtframe_buf;
- for (i = 0; i < NR_MP_XMITFRAME; i++) {
- INIT_LIST_HEAD(&(pmp_xmitframe->list));
- list_add_tail(&(pmp_xmitframe->list),
- &(pmp_priv->free_mp_xmitqueue.queue));
- pmp_xmitframe->pkt = NULL;
- pmp_xmitframe->frame_tag = MP_FRAMETAG;
- pmp_xmitframe->padapter = pmp_priv->papdater;
- pmp_xmitframe++;
- }
- pmp_priv->free_mp_xmitframe_cnt = NR_MP_XMITFRAME;
- return 0;
-}
-
-static int free_mp_priv(struct mp_priv *pmp_priv)
-{
- kfree(pmp_priv->pallocated_mp_xmitframe_buf);
- return 0;
-}
-
-void mp871xinit(struct _adapter *padapter)
-{
- struct mp_priv *pmppriv = &padapter->mppriv;
-
- pmppriv->papdater = padapter;
- init_mp_priv(pmppriv);
-}
-
-void mp871xdeinit(struct _adapter *padapter)
-{
- struct mp_priv *pmppriv = &padapter->mppriv;
-
- free_mp_priv(pmppriv);
-}
-
-/*
- * Special for bb and rf reg read/write
- */
-static u32 fw_iocmd_read(struct _adapter *pAdapter, struct IOCMD_STRUCT iocmd)
-{
- u32 cmd32 = 0, val32 = 0;
- u8 iocmd_class = iocmd.cmdclass;
- u16 iocmd_value = iocmd.value;
- u8 iocmd_idx = iocmd.index;
-
- cmd32 = (iocmd_class << 24) | (iocmd_value << 8) | iocmd_idx;
- if (r8712_fw_cmd(pAdapter, cmd32))
- r8712_fw_cmd_data(pAdapter, &val32, 1);
- else
- val32 = 0;
- return val32;
-}
-
-static u8 fw_iocmd_write(struct _adapter *pAdapter,
- struct IOCMD_STRUCT iocmd, u32 value)
-{
- u32 cmd32 = 0;
- u8 iocmd_class = iocmd.cmdclass;
- u32 iocmd_value = iocmd.value;
- u8 iocmd_idx = iocmd.index;
-
- r8712_fw_cmd_data(pAdapter, &value, 0);
- msleep(100);
- cmd32 = (iocmd_class << 24) | (iocmd_value << 8) | iocmd_idx;
- return r8712_fw_cmd(pAdapter, cmd32);
-}
-
-/* offset : 0X800~0XFFF */
-u32 r8712_bb_reg_read(struct _adapter *pAdapter, u16 offset)
-{
- u8 shift = offset & 0x0003; /* 4 byte access */
- u16 bb_addr = offset & 0x0FFC; /* 4 byte access */
- u32 bb_val = 0;
- struct IOCMD_STRUCT iocmd;
-
- iocmd.cmdclass = IOCMD_CLASS_BB_RF;
- iocmd.value = bb_addr;
- iocmd.index = IOCMD_BB_READ_IDX;
- bb_val = fw_iocmd_read(pAdapter, iocmd);
- if (shift != 0) {
- u32 bb_val2 = 0;
-
- bb_val >>= (shift * 8);
- iocmd.value += 4;
- bb_val2 = fw_iocmd_read(pAdapter, iocmd);
- bb_val2 <<= ((4 - shift) * 8);
- bb_val |= bb_val2;
- }
- return bb_val;
-}
-
-/* offset : 0X800~0XFFF */
-u8 r8712_bb_reg_write(struct _adapter *pAdapter, u16 offset, u32 value)
-{
- u8 shift = offset & 0x0003; /* 4 byte access */
- u16 bb_addr = offset & 0x0FFC; /* 4 byte access */
- struct IOCMD_STRUCT iocmd;
-
- iocmd.cmdclass = IOCMD_CLASS_BB_RF;
- iocmd.value = bb_addr;
- iocmd.index = IOCMD_BB_WRITE_IDX;
- if (shift != 0) {
- u32 oldValue = 0;
- u32 newValue = value;
-
- oldValue = r8712_bb_reg_read(pAdapter, iocmd.value);
- oldValue &= (0xFFFFFFFF >> ((4 - shift) * 8));
- value = oldValue | (newValue << (shift * 8));
- if (!fw_iocmd_write(pAdapter, iocmd, value))
- return false;
- iocmd.value += 4;
- oldValue = r8712_bb_reg_read(pAdapter, iocmd.value);
- oldValue &= (0xFFFFFFFF << (shift * 8));
- value = oldValue | (newValue >> ((4 - shift) * 8));
- }
- return fw_iocmd_write(pAdapter, iocmd, value);
-}
-
-/* offset : 0x00 ~ 0xFF */
-u32 r8712_rf_reg_read(struct _adapter *pAdapter, u8 path, u8 offset)
-{
- u16 rf_addr = (path << 8) | offset;
- struct IOCMD_STRUCT iocmd;
-
- iocmd.cmdclass = IOCMD_CLASS_BB_RF;
- iocmd.value = rf_addr;
- iocmd.index = IOCMD_RF_READ_IDX;
- return fw_iocmd_read(pAdapter, iocmd);
-}
-
-u8 r8712_rf_reg_write(struct _adapter *pAdapter, u8 path, u8 offset, u32 value)
-{
- u16 rf_addr = (path << 8) | offset;
- struct IOCMD_STRUCT iocmd;
-
- iocmd.cmdclass = IOCMD_CLASS_BB_RF;
- iocmd.value = rf_addr;
- iocmd.index = IOCMD_RF_WRIT_IDX;
- return fw_iocmd_write(pAdapter, iocmd, value);
-}
-
-static u32 bitshift(u32 bitmask)
-{
- u32 i;
-
- for (i = 0; i <= 31; i++)
- if (((bitmask >> i) & 0x1) == 1)
- break;
- return i;
-}
-
-static u32 get_bb_reg(struct _adapter *pAdapter, u16 offset, u32 bitmask)
-{
- u32 org_value, bit_shift;
-
- org_value = r8712_bb_reg_read(pAdapter, offset);
- bit_shift = bitshift(bitmask);
- return (org_value & bitmask) >> bit_shift;
-}
-
-static u8 set_bb_reg(struct _adapter *pAdapter,
- u16 offset,
- u32 bitmask,
- u32 value)
-{
- u32 org_value, bit_shift, new_value;
-
- if (bitmask != bMaskDWord) {
- org_value = r8712_bb_reg_read(pAdapter, offset);
- bit_shift = bitshift(bitmask);
- new_value = (org_value & (~bitmask)) | (value << bit_shift);
- } else {
- new_value = value;
- }
- return r8712_bb_reg_write(pAdapter, offset, new_value);
-}
-
-static u32 get_rf_reg(struct _adapter *pAdapter, u8 path, u8 offset,
- u32 bitmask)
-{
- u32 org_value, bit_shift;
-
- org_value = r8712_rf_reg_read(pAdapter, path, offset);
- bit_shift = bitshift(bitmask);
- return (org_value & bitmask) >> bit_shift;
-}
-
-static u8 set_rf_reg(struct _adapter *pAdapter, u8 path, u8 offset, u32 bitmask,
- u32 value)
-{
- u32 org_value, bit_shift, new_value;
-
- if (bitmask != bMaskDWord) {
- org_value = r8712_rf_reg_read(pAdapter, path, offset);
- bit_shift = bitshift(bitmask);
- new_value = (org_value & (~bitmask)) | (value << bit_shift);
- } else {
- new_value = value;
- }
- return r8712_rf_reg_write(pAdapter, path, offset, new_value);
-}
-
-/*
- * SetChannel
- * Description
- * Use H2C command to change channel,
- * not only modify rf register, but also other setting need to be done.
- */
-void r8712_SetChannel(struct _adapter *pAdapter)
-{
- struct cmd_priv *pcmdpriv = &pAdapter->cmdpriv;
- struct cmd_obj *pcmd = NULL;
- struct SetChannel_parm *pparm = NULL;
- u16 code = GEN_CMD_CODE(_SetChannel);
-
- pcmd = kmalloc(sizeof(*pcmd), GFP_ATOMIC);
- if (!pcmd)
- return;
- pparm = kmalloc(sizeof(*pparm), GFP_ATOMIC);
- if (!pparm) {
- kfree(pcmd);
- return;
- }
- pparm->curr_ch = pAdapter->mppriv.curr_ch;
- init_h2fwcmd_w_parm_no_rsp(pcmd, pparm, code);
- r8712_enqueue_cmd(pcmdpriv, pcmd);
-}
-
-static void SetCCKTxPower(struct _adapter *pAdapter, u8 TxPower)
-{
- u16 TxAGC = 0;
-
- TxAGC = TxPower;
- set_bb_reg(pAdapter, rTxAGC_CCK_Mcs32, bTxAGCRateCCK, TxAGC);
-}
-
-static void SetOFDMTxPower(struct _adapter *pAdapter, u8 TxPower)
-{
- u32 TxAGC = 0;
-
- TxAGC |= ((TxPower << 24) | (TxPower << 16) | (TxPower << 8) |
- TxPower);
- set_bb_reg(pAdapter, rTxAGC_Rate18_06, bTxAGCRate18_06, TxAGC);
- set_bb_reg(pAdapter, rTxAGC_Rate54_24, bTxAGCRate54_24, TxAGC);
- set_bb_reg(pAdapter, rTxAGC_Mcs03_Mcs00, bTxAGCRateMCS3_MCS0, TxAGC);
- set_bb_reg(pAdapter, rTxAGC_Mcs07_Mcs04, bTxAGCRateMCS7_MCS4, TxAGC);
- set_bb_reg(pAdapter, rTxAGC_Mcs11_Mcs08, bTxAGCRateMCS11_MCS8, TxAGC);
- set_bb_reg(pAdapter, rTxAGC_Mcs15_Mcs12, bTxAGCRateMCS15_MCS12, TxAGC);
-}
-
-void r8712_SetTxPower(struct _adapter *pAdapter)
-{
- u8 TxPower = pAdapter->mppriv.curr_txpoweridx;
-
- SetCCKTxPower(pAdapter, TxPower);
- SetOFDMTxPower(pAdapter, TxPower);
-}
-
-void r8712_SetTxAGCOffset(struct _adapter *pAdapter, u32 ulTxAGCOffset)
-{
- u32 TxAGCOffset_B, TxAGCOffset_C, TxAGCOffset_D, tmpAGC;
-
- TxAGCOffset_B = ulTxAGCOffset & 0x000000ff;
- TxAGCOffset_C = (ulTxAGCOffset & 0x0000ff00) >> 8;
- TxAGCOffset_D = (ulTxAGCOffset & 0x00ff0000) >> 16;
- tmpAGC = TxAGCOffset_D << 8 | TxAGCOffset_C << 4 | TxAGCOffset_B;
- set_bb_reg(pAdapter, rFPGA0_TxGainStage,
- (bXBTxAGC | bXCTxAGC | bXDTxAGC), tmpAGC);
-}
-
-void r8712_SetDataRate(struct _adapter *pAdapter)
-{
- u8 path = RF_PATH_A;
- u8 offset = RF_SYN_G2;
- u32 value;
-
- value = (pAdapter->mppriv.curr_rateidx < 4) ? 0x4440 : 0xF200;
- r8712_rf_reg_write(pAdapter, path, offset, value);
-}
-
-void r8712_SwitchBandwidth(struct _adapter *pAdapter)
-{
- /* 3 1.Set MAC register : BWOPMODE bit2:1 20MhzBW */
- u8 regBwOpMode = 0;
- u8 Bandwidth = pAdapter->mppriv.curr_bandwidth;
-
- regBwOpMode = r8712_read8(pAdapter, 0x10250203);
- if (Bandwidth == HT_CHANNEL_WIDTH_20)
- regBwOpMode |= BIT(2);
- else
- regBwOpMode &= ~(BIT(2));
- r8712_write8(pAdapter, 0x10250203, regBwOpMode);
- /* 3 2.Set PHY related register */
- switch (Bandwidth) {
- /* 20 MHz channel*/
- case HT_CHANNEL_WIDTH_20:
- set_bb_reg(pAdapter, rFPGA0_RFMOD, bRFMOD, 0x0);
- set_bb_reg(pAdapter, rFPGA1_RFMOD, bRFMOD, 0x0);
- /* Use PHY_REG.txt default value. Do not need to change.
- * Correct the tx power for CCK rate in 40M.
- * It is set in Tx descriptor for 8192x series
- */
- set_bb_reg(pAdapter, rFPGA0_AnalogParameter2, bMaskDWord, 0x58);
- break;
- /* 40 MHz channel*/
- case HT_CHANNEL_WIDTH_40:
- set_bb_reg(pAdapter, rFPGA0_RFMOD, bRFMOD, 0x1);
- set_bb_reg(pAdapter, rFPGA1_RFMOD, bRFMOD, 0x1);
- /* Use PHY_REG.txt default value. Do not need to change.
- * Correct the tx power for CCK rate in 40M.
- * Set Control channel to upper or lower. These settings are
- * required only for 40MHz
- */
- set_bb_reg(pAdapter, rCCK0_System, bCCKSideBand,
- (HAL_PRIME_CHNL_OFFSET_DONT_CARE >> 1));
- set_bb_reg(pAdapter, rOFDM1_LSTF, 0xC00,
- HAL_PRIME_CHNL_OFFSET_DONT_CARE);
- set_bb_reg(pAdapter, rFPGA0_AnalogParameter2, bMaskDWord, 0x18);
- break;
- default:
- break;
- }
-
- /* 3 3.Set RF related register */
- switch (Bandwidth) {
- case HT_CHANNEL_WIDTH_20:
- set_rf_reg(pAdapter, RF_PATH_A, RF_CHNLBW,
- BIT(10) | BIT(11), 0x01);
- break;
- case HT_CHANNEL_WIDTH_40:
- set_rf_reg(pAdapter, RF_PATH_A, RF_CHNLBW,
- BIT(10) | BIT(11), 0x00);
- break;
- default:
- break;
- }
-}
-
-/*------------------------------Define structure----------------------------*/
-struct R_ANTENNA_SELECT_OFDM {
- u32 r_tx_antenna:4;
- u32 r_ant_l:4;
- u32 r_ant_non_ht:4;
- u32 r_ant_ht1:4;
- u32 r_ant_ht2:4;
- u32 r_ant_ht_s1:4;
- u32 r_ant_non_ht_s1:4;
- u32 OFDM_TXSC:2;
- u32 Reserved:2;
-};
-
-struct R_ANTENNA_SELECT_CCK {
- u8 r_cckrx_enable_2:2;
- u8 r_cckrx_enable:2;
- u8 r_ccktx_enable:4;
-};
-
-void r8712_SwitchAntenna(struct _adapter *pAdapter)
-{
- u32 ofdm_tx_en_val = 0, ofdm_tx_ant_sel_val = 0;
- u8 ofdm_rx_ant_sel_val = 0;
- u8 cck_ant_select_val = 0;
- u32 cck_ant_sel_val = 0;
- struct R_ANTENNA_SELECT_CCK *p_cck_txrx;
-
- p_cck_txrx = (struct R_ANTENNA_SELECT_CCK *)&cck_ant_select_val;
-
- switch (pAdapter->mppriv.antenna_tx) {
- case ANTENNA_A:
- /* From SD3 Willis suggestion !!! Set RF A=TX and B as standby*/
- set_bb_reg(pAdapter, rFPGA0_XA_HSSIParameter2, 0xe, 2);
- set_bb_reg(pAdapter, rFPGA0_XB_HSSIParameter2, 0xe, 1);
- ofdm_tx_en_val = 0x3;
- ofdm_tx_ant_sel_val = 0x11111111;/* Power save */
- p_cck_txrx->r_ccktx_enable = 0x8;
- break;
- case ANTENNA_B:
- set_bb_reg(pAdapter, rFPGA0_XA_HSSIParameter2, 0xe, 1);
- set_bb_reg(pAdapter, rFPGA0_XB_HSSIParameter2, 0xe, 2);
- ofdm_tx_en_val = 0x3;
- ofdm_tx_ant_sel_val = 0x22222222;/* Power save */
- p_cck_txrx->r_ccktx_enable = 0x4;
- break;
- case ANTENNA_AB: /* For 8192S */
- set_bb_reg(pAdapter, rFPGA0_XA_HSSIParameter2, 0xe, 2);
- set_bb_reg(pAdapter, rFPGA0_XB_HSSIParameter2, 0xe, 2);
- ofdm_tx_en_val = 0x3;
- ofdm_tx_ant_sel_val = 0x3321333; /* Disable Power save */
- p_cck_txrx->r_ccktx_enable = 0xC;
- break;
- default:
- break;
- }
- /*OFDM Tx*/
- set_bb_reg(pAdapter, rFPGA1_TxInfo, 0xffffffff, ofdm_tx_ant_sel_val);
- /*OFDM Tx*/
- set_bb_reg(pAdapter, rFPGA0_TxInfo, 0x0000000f, ofdm_tx_en_val);
- switch (pAdapter->mppriv.antenna_rx) {
- case ANTENNA_A:
- ofdm_rx_ant_sel_val = 0x1; /* A */
- p_cck_txrx->r_cckrx_enable = 0x0; /* default: A */
- p_cck_txrx->r_cckrx_enable_2 = 0x0; /* option: A */
- break;
- case ANTENNA_B:
- ofdm_rx_ant_sel_val = 0x2; /* B */
- p_cck_txrx->r_cckrx_enable = 0x1; /* default: B */
- p_cck_txrx->r_cckrx_enable_2 = 0x1; /* option: B */
- break;
- case ANTENNA_AB:
- ofdm_rx_ant_sel_val = 0x3; /* AB */
- p_cck_txrx->r_cckrx_enable = 0x0; /* default:A */
- p_cck_txrx->r_cckrx_enable_2 = 0x1; /* option:B */
- break;
- default:
- break;
- }
- /*OFDM Rx*/
- set_bb_reg(pAdapter, rOFDM0_TRxPathEnable, 0x0000000f,
- ofdm_rx_ant_sel_val);
- /*OFDM Rx*/
- set_bb_reg(pAdapter, rOFDM1_TRxPathEnable, 0x0000000f,
- ofdm_rx_ant_sel_val);
-
- cck_ant_sel_val = cck_ant_select_val;
- /*CCK TxRx*/
- set_bb_reg(pAdapter, rCCK0_AFESetting, bMaskByte3, cck_ant_sel_val);
-}
-
-static void TriggerRFThermalMeter(struct _adapter *pAdapter)
-{
- /* 0x24: RF Reg[6:5] */
- set_rf_reg(pAdapter, RF_PATH_A, RF_T_METER, bRFRegOffsetMask, 0x60);
-}
-
-static u32 ReadRFThermalMeter(struct _adapter *pAdapter)
-{
- /* 0x24: RF Reg[4:0] */
- return get_rf_reg(pAdapter, RF_PATH_A, RF_T_METER, 0x1F);
-}
-
-void r8712_GetThermalMeter(struct _adapter *pAdapter, u32 *value)
-{
- TriggerRFThermalMeter(pAdapter);
- msleep(1000);
- *value = ReadRFThermalMeter(pAdapter);
-}
-
-void r8712_SetSingleCarrierTx(struct _adapter *pAdapter, u8 bStart)
-{
- if (bStart) { /* Start Single Carrier. */
- /* 1. if OFDM block on? */
- if (!get_bb_reg(pAdapter, rFPGA0_RFMOD, bOFDMEn))
- /*set OFDM block on*/
- set_bb_reg(pAdapter, rFPGA0_RFMOD, bOFDMEn, bEnable);
- /* 2. set CCK test mode off, set to CCK normal mode */
- set_bb_reg(pAdapter, rCCK0_System, bCCKBBMode, bDisable);
- /* 3. turn on scramble setting */
- set_bb_reg(pAdapter, rCCK0_System, bCCKScramble, bEnable);
- /* 4. Turn On Single Carrier Tx and off the other test modes. */
- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable);
- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bEnable);
- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
- } else { /* Stop Single Carrier.*/
- /* Turn off all test modes.*/
- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable);
- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier,
- bDisable);
- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
- msleep(20);
- /*BB Reset*/
- set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x0);
- set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x1);
- }
-}
-
-void r8712_SetSingleToneTx(struct _adapter *pAdapter, u8 bStart)
-{
- u8 rfPath;
-
- switch (pAdapter->mppriv.antenna_tx) {
- case ANTENNA_B:
- rfPath = RF_PATH_B;
- break;
- case ANTENNA_A:
- default:
- rfPath = RF_PATH_A;
- break;
- }
- if (bStart) { /* Start Single Tone.*/
- set_bb_reg(pAdapter, rFPGA0_RFMOD, bCCKEn, bDisable);
- set_bb_reg(pAdapter, rFPGA0_RFMOD, bOFDMEn, bDisable);
- set_rf_reg(pAdapter, rfPath, RF_TX_G2, bRFRegOffsetMask,
- 0xd4000);
- msleep(100);
- /* PAD all on.*/
- set_rf_reg(pAdapter, rfPath, RF_AC, bRFRegOffsetMask, 0x2001f);
- msleep(100);
- } else { /* Stop Single Tone.*/
- set_bb_reg(pAdapter, rFPGA0_RFMOD, bCCKEn, bEnable);
- set_bb_reg(pAdapter, rFPGA0_RFMOD, bOFDMEn, bEnable);
- set_rf_reg(pAdapter, rfPath, RF_TX_G2, bRFRegOffsetMask,
- 0x54000);
- msleep(100);
- /* PAD all on.*/
- set_rf_reg(pAdapter, rfPath, RF_AC, bRFRegOffsetMask, 0x30000);
- msleep(100);
- }
-}
-
-void r8712_SetCarrierSuppressionTx(struct _adapter *pAdapter, u8 bStart)
-{
- if (bStart) { /* Start Carrier Suppression.*/
- if (pAdapter->mppriv.curr_rateidx <= MPT_RATE_11M) {
- /* 1. if CCK block on? */
- if (!get_bb_reg(pAdapter, rFPGA0_RFMOD, bCCKEn)) {
- /*set CCK block on*/
- set_bb_reg(pAdapter, rFPGA0_RFMOD, bCCKEn,
- bEnable);
- }
- /* Turn Off All Test Mode */
- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx,
- bDisable);
- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier,
- bDisable);
- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone,
- bDisable);
- /*transmit mode*/
- set_bb_reg(pAdapter, rCCK0_System, bCCKBBMode, 0x2);
- /*turn off scramble setting*/
- set_bb_reg(pAdapter, rCCK0_System, bCCKScramble,
- bDisable);
- /*Set CCK Tx Test Rate*/
- /*Set FTxRate to 1Mbps*/
- set_bb_reg(pAdapter, rCCK0_System, bCCKTxRate, 0x0);
- }
- } else { /* Stop Carrier Suppression. */
- if (pAdapter->mppriv.curr_rateidx <= MPT_RATE_11M) {
- /*normal mode*/
- set_bb_reg(pAdapter, rCCK0_System, bCCKBBMode, 0x0);
- /*turn on scramble setting*/
- set_bb_reg(pAdapter, rCCK0_System, bCCKScramble,
- bEnable);
- /*BB Reset*/
- set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x0);
- set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x1);
- }
- }
-}
-
-static void SetCCKContinuousTx(struct _adapter *pAdapter, u8 bStart)
-{
- u32 cckrate;
-
- if (bStart) {
- /* 1. if CCK block on? */
- if (!get_bb_reg(pAdapter, rFPGA0_RFMOD, bCCKEn)) {
- /*set CCK block on*/
- set_bb_reg(pAdapter, rFPGA0_RFMOD, bCCKEn, bEnable);
- }
- /* Turn Off All Test Mode */
- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable);
- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bDisable);
- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
- /*Set CCK Tx Test Rate*/
- cckrate = pAdapter->mppriv.curr_rateidx;
- set_bb_reg(pAdapter, rCCK0_System, bCCKTxRate, cckrate);
- /*transmit mode*/
- set_bb_reg(pAdapter, rCCK0_System, bCCKBBMode, 0x2);
- /*turn on scramble setting*/
- set_bb_reg(pAdapter, rCCK0_System, bCCKScramble, bEnable);
- } else {
- /*normal mode*/
- set_bb_reg(pAdapter, rCCK0_System, bCCKBBMode, 0x0);
- /*turn on scramble setting*/
- set_bb_reg(pAdapter, rCCK0_System, bCCKScramble, bEnable);
- /*BB Reset*/
- set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x0);
- set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x1);
- }
-} /* mpt_StartCckContTx */
-
-static void SetOFDMContinuousTx(struct _adapter *pAdapter, u8 bStart)
-{
- if (bStart) {
- /* 1. if OFDM block on? */
- if (!get_bb_reg(pAdapter, rFPGA0_RFMOD, bOFDMEn)) {
- /*set OFDM block on*/
- set_bb_reg(pAdapter, rFPGA0_RFMOD, bOFDMEn, bEnable);
- }
- /* 2. set CCK test mode off, set to CCK normal mode*/
- set_bb_reg(pAdapter, rCCK0_System, bCCKBBMode, bDisable);
- /* 3. turn on scramble setting */
- set_bb_reg(pAdapter, rCCK0_System, bCCKScramble, bEnable);
- /* 4. Turn On Continue Tx and turn off the other test modes.*/
- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bEnable);
- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bDisable);
- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
- } else {
- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable);
- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier,
- bDisable);
- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
- msleep(20);
- /*BB Reset*/
- set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x0);
- set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x1);
- }
-} /* mpt_StartOfdmContTx */
-
-void r8712_SetContinuousTx(struct _adapter *pAdapter, u8 bStart)
-{
- /* ADC turn off [bit24-21] adc port0 ~ port1 */
- if (bStart) {
- r8712_bb_reg_write(pAdapter, rRx_Wait_CCCA,
- r8712_bb_reg_read(pAdapter,
- rRx_Wait_CCCA) & 0xFE1FFFFF);
- msleep(100);
- }
- if (pAdapter->mppriv.curr_rateidx <= MPT_RATE_11M)
- SetCCKContinuousTx(pAdapter, bStart);
- else if ((pAdapter->mppriv.curr_rateidx >= MPT_RATE_6M) &&
- (pAdapter->mppriv.curr_rateidx <= MPT_RATE_MCS15))
- SetOFDMContinuousTx(pAdapter, bStart);
- /* ADC turn on [bit24-21] adc port0 ~ port1 */
- if (!bStart)
- r8712_bb_reg_write(pAdapter, rRx_Wait_CCCA,
- r8712_bb_reg_read(pAdapter,
- rRx_Wait_CCCA) | 0x01E00000);
-}
-
-void r8712_ResetPhyRxPktCount(struct _adapter *pAdapter)
-{
- u32 i, phyrx_set = 0;
-
- for (i = OFDM_PPDU_BIT; i <= HT_MPDU_FAIL_BIT; i++) {
- phyrx_set = 0;
- phyrx_set |= (i << 28); /*select*/
- phyrx_set |= 0x08000000; /* set counter to zero*/
- r8712_write32(pAdapter, RXERR_RPT, phyrx_set);
- }
-}
-
-static u32 GetPhyRxPktCounts(struct _adapter *pAdapter, u32 selbit)
-{
- /*selection*/
- u32 phyrx_set = 0;
- u32 SelectBit;
-
- SelectBit = selbit << 28;
- phyrx_set |= (SelectBit & 0xF0000000);
- r8712_write32(pAdapter, RXERR_RPT, phyrx_set);
- /*Read packet count*/
- return r8712_read32(pAdapter, RXERR_RPT) & RPTMaxCount;
-}
-
-u32 r8712_GetPhyRxPktReceived(struct _adapter *pAdapter)
-{
- u32 OFDM_cnt = GetPhyRxPktCounts(pAdapter, OFDM_MPDU_OK_BIT);
- u32 CCK_cnt = GetPhyRxPktCounts(pAdapter, CCK_MPDU_OK_BIT);
- u32 HT_cnt = GetPhyRxPktCounts(pAdapter, HT_MPDU_OK_BIT);
-
- return OFDM_cnt + CCK_cnt + HT_cnt;
-}
-
-u32 r8712_GetPhyRxPktCRC32Error(struct _adapter *pAdapter)
-{
- u32 OFDM_cnt = GetPhyRxPktCounts(pAdapter, OFDM_MPDU_FAIL_BIT);
- u32 CCK_cnt = GetPhyRxPktCounts(pAdapter, CCK_MPDU_FAIL_BIT);
- u32 HT_cnt = GetPhyRxPktCounts(pAdapter, HT_MPDU_FAIL_BIT);
-
- return OFDM_cnt + CCK_cnt + HT_cnt;
-}
--- a/drivers/staging/rtl8712/rtl871x_mp.h
+++ /dev/null
@@ -1,275 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL871X_MP_H_
-#define __RTL871X_MP_H_
-
-#define MPT_NOOP 0
-#define MPT_READ_MAC_1BYTE 1
-#define MPT_READ_MAC_2BYTE 2
-#define MPT_READ_MAC_4BYTE 3
-#define MPT_WRITE_MAC_1BYTE 4
-#define MPT_WRITE_MAC_2BYTE 5
-#define MPT_WRITE_MAC_4BYTE 6
-#define MPT_READ_BB_CCK 7
-#define MPT_WRITE_BB_CCK 8
-#define MPT_READ_BB_OFDM 9
-#define MPT_WRITE_BB_OFDM 10
-#define MPT_READ_RF 11
-#define MPT_WRITE_RF 12
-#define MPT_READ_EEPROM_1BYTE 13
-#define MPT_WRITE_EEPROM_1BYTE 14
-#define MPT_READ_EEPROM_2BYTE 15
-#define MPT_WRITE_EEPROM_2BYTE 16
-#define MPT_SET_CSTHRESHOLD 21
-#define MPT_SET_INITGAIN 22
-#define MPT_SWITCH_BAND 23
-#define MPT_SWITCH_CHANNEL 24
-#define MPT_SET_DATARATE 25
-#define MPT_SWITCH_ANTENNA 26
-#define MPT_SET_TX_POWER 27
-#define MPT_SET_CONT_TX 28
-#define MPT_SET_SINGLE_CARRIER 29
-#define MPT_SET_CARRIER_SUPPRESSION 30
-#define MPT_GET_RATE_TABLE 31
-#define MPT_READ_TSSI 32
-#define MPT_GET_THERMAL_METER 33
-#define MAX_MP_XMITBUF_SZ 2048
-#define NR_MP_XMITFRAME 8
-
-struct mp_xmit_frame {
- struct list_head list;
- struct pkt_attrib attrib;
- _pkt *pkt;
- int frame_tag;
- struct _adapter *padapter;
- u8 *mem_addr;
- u16 sz[8];
- struct urb *pxmit_urb[8];
- u8 bpending[8];
- u8 last[8];
-};
-
-struct mp_wiparam {
- u32 bcompleted;
- u32 act_type;
- u32 io_offset;
- u32 io_value;
-};
-
-struct mp_priv {
- struct _adapter *papdater;
- /*OID cmd handler*/
- struct mp_wiparam workparam;
- u8 act_in_progress;
- /*Tx Section*/
- u8 TID;
- u32 tx_pktcount;
- /*Rx Section*/
- u32 rx_pktcount;
- u32 rx_crcerrpktcount;
- u32 rx_pktloss;
- struct recv_stat rxstat;
- /*RF/BB relative*/
- u32 curr_ch;
- u32 curr_rateidx;
- u8 curr_bandwidth;
- u8 curr_modem;
- u8 curr_txpoweridx;
- u32 curr_crystalcap;
- u16 antenna_tx;
- u16 antenna_rx;
- u8 curr_rfpath;
- u8 check_mp_pkt;
- uint ForcedDataRate;
- struct wlan_network mp_network;
- unsigned char network_macaddr[6];
- /*Testing Flag*/
- u32 mode;/*0 for normal type packet,
- * 1 for loopback packet (16bytes TXCMD)
- */
- sint prev_fw_state;
- u8 *pallocated_mp_xmitframe_buf;
- u8 *pmp_xmtframe_buf;
- struct __queue free_mp_xmitqueue;
- u32 free_mp_xmitframe_cnt;
-};
-
-struct IOCMD_STRUCT {
- u8 cmdclass;
- u16 value;
- u8 index;
-};
-
-struct rf_reg_param {
- u32 path;
- u32 offset;
- u32 value;
-};
-
-struct bb_reg_param {
- u32 offset;
- u32 value;
-};
-
-/* ======================================================================= */
-
-#define LOWER true
-#define RAISE false
-#define IOCMD_CTRL_REG 0x10250370
-#define IOCMD_DATA_REG 0x10250374
-#define IOCMD_GET_THERMAL_METER 0xFD000028
-#define IOCMD_CLASS_BB_RF 0xF0
-#define IOCMD_BB_READ_IDX 0x00
-#define IOCMD_BB_WRITE_IDX 0x01
-#define IOCMD_RF_READ_IDX 0x02
-#define IOCMD_RF_WRIT_IDX 0x03
-#define BB_REG_BASE_ADDR 0x800
-#define RF_PATH_A 0
-#define RF_PATH_B 1
-#define RF_PATH_C 2
-#define RF_PATH_D 3
-#define MAX_RF_PATH_NUMS 2
-#define _2MAC_MODE_ 0
-#define _LOOPBOOK_MODE_ 1
-
-/* MP set force data rate base on the definition. */
-enum {
- /* CCK rate. */
- MPT_RATE_1M, /* 0 */
- MPT_RATE_2M,
- MPT_RATE_55M,
- MPT_RATE_11M, /* 3 */
-
- /* OFDM rate. */
- MPT_RATE_6M, /* 4 */
- MPT_RATE_9M,
- MPT_RATE_12M,
- MPT_RATE_18M,
- MPT_RATE_24M,
- MPT_RATE_36M,
- MPT_RATE_48M,
- MPT_RATE_54M, /* 11 */
-
- /* HT rate. */
- MPT_RATE_MCS0, /* 12 */
- MPT_RATE_MCS1,
- MPT_RATE_MCS2,
- MPT_RATE_MCS3,
- MPT_RATE_MCS4,
- MPT_RATE_MCS5,
- MPT_RATE_MCS6,
- MPT_RATE_MCS7, /* 19 */
- MPT_RATE_MCS8,
- MPT_RATE_MCS9,
- MPT_RATE_MCS10,
- MPT_RATE_MCS11,
- MPT_RATE_MCS12,
- MPT_RATE_MCS13,
- MPT_RATE_MCS14,
- MPT_RATE_MCS15, /* 27 */
- MPT_RATE_LAST
-};
-
-/* Represent Channel Width in HT Capabilities */
-enum HT_CHANNEL_WIDTH {
- HT_CHANNEL_WIDTH_20 = 0,
- HT_CHANNEL_WIDTH_40 = 1,
-};
-
-#define MAX_TX_PWR_INDEX_N_MODE 64 /* 0x3F */
-
-enum POWER_MODE {
- POWER_LOW = 0,
- POWER_NORMAL
-};
-
-#define RX_PKT_BROADCAST 1
-#define RX_PKT_DEST_ADDR 2
-#define RX_PKT_PHY_MATCH 3
-
-#define RPTMaxCount 0x000FFFFF
-
-/* parameter 1 : BitMask
- * bit 0 : OFDM PPDU
- * bit 1 : OFDM False Alarm
- * bit 2 : OFDM MPDU OK
- * bit 3 : OFDM MPDU Fail
- * bit 4 : CCK PPDU
- * bit 5 : CCK False Alarm
- * bit 6 : CCK MPDU ok
- * bit 7 : CCK MPDU fail
- * bit 8 : HT PPDU counter
- * bit 9 : HT false alarm
- * bit 10 : HT MPDU total
- * bit 11 : HT MPDU OK
- * bit 12 : HT MPDU fail
- * bit 15 : RX full drop
- */
-enum RXPHY_BITMASK {
- OFDM_PPDU_BIT = 0,
- OFDM_MPDU_OK_BIT,
- OFDM_MPDU_FAIL_BIT,
- CCK_PPDU_BIT,
- CCK_MPDU_OK_BIT,
- CCK_MPDU_FAIL_BIT,
- HT_PPDU_BIT,
- HT_MPDU_BIT,
- HT_MPDU_OK_BIT,
- HT_MPDU_FAIL_BIT,
-};
-
-enum ENCRY_CTRL_STATE {
- HW_CONTROL, /*hw encryption& decryption*/
- SW_CONTROL, /*sw encryption& decryption*/
- HW_ENCRY_SW_DECRY, /*hw encryption & sw decryption*/
- SW_ENCRY_HW_DECRY /*sw encryption & hw decryption*/
-};
-
-/* Bandwidth Offset */
-#define HAL_PRIME_CHNL_OFFSET_DONT_CARE 0
-#define HAL_PRIME_CHNL_OFFSET_LOWER 1
-#define HAL_PRIME_CHNL_OFFSET_UPPER 2
-/*=======================================================================*/
-void mp871xinit(struct _adapter *padapter);
-void mp871xdeinit(struct _adapter *padapter);
-u32 r8712_bb_reg_read(struct _adapter *Adapter, u16 offset);
-u8 r8712_bb_reg_write(struct _adapter *Adapter, u16 offset, u32 value);
-u32 r8712_rf_reg_read(struct _adapter *Adapter, u8 path, u8 offset);
-u8 r8712_rf_reg_write(struct _adapter *Adapter, u8 path,
- u8 offset, u32 value);
-u32 r8712_get_bb_reg(struct _adapter *Adapter, u16 offset, u32 bitmask);
-u8 r8712_set_bb_reg(struct _adapter *Adapter, u16 offset,
- u32 bitmask, u32 value);
-u32 r8712_get_rf_reg(struct _adapter *Adapter, u8 path, u8 offset,
- u32 bitmask);
-u8 r8712_set_rf_reg(struct _adapter *Adapter, u8 path, u8 offset,
- u32 bitmask, u32 value);
-
-void r8712_SetChannel(struct _adapter *pAdapter);
-void r8712_SetTxPower(struct _adapter *pAdapte);
-void r8712_SetTxAGCOffset(struct _adapter *pAdapter, u32 ulTxAGCOffset);
-void r8712_SetDataRate(struct _adapter *pAdapter);
-void r8712_SwitchBandwidth(struct _adapter *pAdapter);
-void r8712_SwitchAntenna(struct _adapter *pAdapter);
-void r8712_GetThermalMeter(struct _adapter *pAdapter, u32 *value);
-void r8712_SetContinuousTx(struct _adapter *pAdapter, u8 bStart);
-void r8712_SetSingleCarrierTx(struct _adapter *pAdapter, u8 bStart);
-void r8712_SetSingleToneTx(struct _adapter *pAdapter, u8 bStart);
-void r8712_SetCarrierSuppressionTx(struct _adapter *pAdapter, u8 bStart);
-void r8712_ResetPhyRxPktCount(struct _adapter *pAdapter);
-u32 r8712_GetPhyRxPktReceived(struct _adapter *pAdapter);
-u32 r8712_GetPhyRxPktCRC32Error(struct _adapter *pAdapter);
-
-#endif /*__RTL871X_MP_H_*/
-
--- a/drivers/staging/rtl8712/rtl871x_mp_ioctl.c
+++ /dev/null
@@ -1,883 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_mp_ioctl.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#include <linux/rndis.h>
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "mlme_osdep.h"
-#include "rtl871x_mp.h"
-#include "rtl871x_mp_ioctl.h"
-
-uint oid_null_function(struct oid_par_priv *poid_par_priv)
-{
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_wireless_mode_hdl(struct oid_par_priv *poid_par_priv)
-{
- uint status = RNDIS_STATUS_SUCCESS;
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
-
- if (poid_par_priv->type_of_oid == SET_OID) {
- if (poid_par_priv->information_buf_len >= sizeof(u8))
- Adapter->registrypriv.wireless_mode =
- *(u8 *)poid_par_priv->information_buf;
- else
- status = RNDIS_STATUS_INVALID_LENGTH;
- } else if (poid_par_priv->type_of_oid == QUERY_OID) {
- if (poid_par_priv->information_buf_len >= sizeof(u8)) {
- *(u8 *)poid_par_priv->information_buf =
- Adapter->registrypriv.wireless_mode;
- *poid_par_priv->bytes_rw =
- poid_par_priv->information_buf_len;
- } else {
- status = RNDIS_STATUS_INVALID_LENGTH;
- }
- } else {
- status = RNDIS_STATUS_NOT_ACCEPTED;
- }
- return status;
-}
-
-uint oid_rt_pro_write_bb_reg_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
- struct bb_reg_param *pbbreg;
- u16 offset;
- u32 value;
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len < sizeof(struct bb_reg_param))
- return RNDIS_STATUS_INVALID_LENGTH;
- pbbreg = (struct bb_reg_param *)(poid_par_priv->information_buf);
- offset = (u16)(pbbreg->offset) & 0xFFF; /*0ffset :0x800~0xfff*/
- if (offset < BB_REG_BASE_ADDR)
- offset |= BB_REG_BASE_ADDR;
- value = pbbreg->value;
- r8712_bb_reg_write(Adapter, offset, value);
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_read_bb_reg_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
- struct bb_reg_param *pbbreg;
- u16 offset;
- u32 value;
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len < sizeof(struct bb_reg_param))
- return RNDIS_STATUS_INVALID_LENGTH;
- pbbreg = (struct bb_reg_param *)(poid_par_priv->information_buf);
- offset = (u16)(pbbreg->offset) & 0xFFF; /*0ffset :0x800~0xfff*/
- if (offset < BB_REG_BASE_ADDR)
- offset |= BB_REG_BASE_ADDR;
- value = r8712_bb_reg_read(Adapter, offset);
- pbbreg->value = value;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_write_rf_reg_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
- struct rf_reg_param *pbbreg;
- u8 path;
- u8 offset;
- u32 value;
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len < sizeof(struct rf_reg_param))
- return RNDIS_STATUS_INVALID_LENGTH;
- pbbreg = (struct rf_reg_param *)(poid_par_priv->information_buf);
- path = (u8)pbbreg->path;
- if (path > RF_PATH_B)
- return RNDIS_STATUS_NOT_ACCEPTED;
- offset = (u8)pbbreg->offset;
- value = pbbreg->value;
- r8712_rf_reg_write(Adapter, path, offset, value);
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_read_rf_reg_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
- struct rf_reg_param *pbbreg;
- u8 path;
- u8 offset;
- u32 value;
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len < sizeof(struct rf_reg_param))
- return RNDIS_STATUS_INVALID_LENGTH;
- pbbreg = (struct rf_reg_param *)(poid_par_priv->information_buf);
- path = (u8)pbbreg->path;
- if (path > RF_PATH_B) /* 1T2R path_a /path_b */
- return RNDIS_STATUS_NOT_ACCEPTED;
- offset = (u8)pbbreg->offset;
- value = r8712_rf_reg_read(Adapter, path, offset);
- pbbreg->value = value;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- return RNDIS_STATUS_SUCCESS;
-}
-
-/*This function initializes the DUT to the MP test mode*/
-static int mp_start_test(struct _adapter *padapter)
-{
- struct mp_priv *pmppriv = &padapter->mppriv;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct wlan_network *tgt_network = &pmlmepriv->cur_network;
- struct wlan_bssid_ex *bssid;
- struct sta_info *psta;
- unsigned long length;
- unsigned long irqL;
- int res = 0;
-
- bssid = kzalloc(sizeof(*bssid), GFP_KERNEL);
- if (!bssid)
- return -ENOMEM;
-
- /* 3 1. initialize a new struct wlan_bssid_ex */
- memcpy(bssid->MacAddress, pmppriv->network_macaddr, ETH_ALEN);
- bssid->Ssid.SsidLength = 16;
- memcpy(bssid->Ssid.Ssid, (unsigned char *)"mp_pseudo_adhoc",
- bssid->Ssid.SsidLength);
- bssid->InfrastructureMode = Ndis802_11IBSS;
- bssid->NetworkTypeInUse = Ndis802_11DS;
- bssid->IELength = 0;
- length = r8712_get_wlan_bssid_ex_sz(bssid);
- if (length % 4) {
- /*round up to multiple of 4 bytes.*/
- bssid->Length = ((length >> 2) + 1) << 2;
- } else {
- bssid->Length = length;
- }
- spin_lock_irqsave(&pmlmepriv->lock, irqL);
- if (check_fwstate(pmlmepriv, WIFI_MP_STATE))
- goto end_of_mp_start_test;
- /*init mp_start_test status*/
- pmppriv->prev_fw_state = get_fwstate(pmlmepriv);
- pmlmepriv->fw_state = WIFI_MP_STATE;
- if (pmppriv->mode == _LOOPBOOK_MODE_)
- set_fwstate(pmlmepriv, WIFI_MP_LPBK_STATE); /*append txdesc*/
- set_fwstate(pmlmepriv, _FW_UNDER_LINKING);
- /* 3 2. create a new psta for mp driver */
- /* clear psta in the cur_network, if any */
- psta = r8712_get_stainfo(&padapter->stapriv,
- tgt_network->network.MacAddress);
- if (psta)
- r8712_free_stainfo(padapter, psta);
- psta = r8712_alloc_stainfo(&padapter->stapriv, bssid->MacAddress);
- if (!psta) {
- res = -ENOMEM;
- goto end_of_mp_start_test;
- }
- /* 3 3. join pseudo AdHoc */
- tgt_network->join_res = 1;
- tgt_network->aid = psta->aid = 1;
- memcpy(&tgt_network->network, bssid, length);
- _clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
- r8712_os_indicate_connect(padapter);
- /* Set to LINKED STATE for MP TRX Testing */
- set_fwstate(pmlmepriv, _FW_LINKED);
-end_of_mp_start_test:
- spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
- kfree(bssid);
- return res;
-}
-
-/*This function change the DUT from the MP test mode into normal mode */
-static int mp_stop_test(struct _adapter *padapter)
-{
- struct mp_priv *pmppriv = &padapter->mppriv;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct wlan_network *tgt_network = &pmlmepriv->cur_network;
- struct sta_info *psta;
- unsigned long irqL;
-
- spin_lock_irqsave(&pmlmepriv->lock, irqL);
- if (!check_fwstate(pmlmepriv, WIFI_MP_STATE))
- goto end_of_mp_stop_test;
- /* 3 1. disconnect pseudo AdHoc */
- r8712_os_indicate_disconnect(padapter);
- /* 3 2. clear psta used in mp test mode. */
- psta = r8712_get_stainfo(&padapter->stapriv,
- tgt_network->network.MacAddress);
- if (psta)
- r8712_free_stainfo(padapter, psta);
- /* 3 3. return to normal state (default:station mode) */
- pmlmepriv->fw_state = pmppriv->prev_fw_state; /* WIFI_STATION_STATE;*/
- /*flush the cur_network*/
- memset(tgt_network, 0, sizeof(struct wlan_network));
-end_of_mp_stop_test:
- spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
- return _SUCCESS;
-}
-
-uint oid_rt_pro_set_data_rate_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
- u32 ratevalue;
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len != sizeof(u32))
- return RNDIS_STATUS_INVALID_LENGTH;
- ratevalue = *((u32 *)poid_par_priv->information_buf);
- if (ratevalue >= MPT_RATE_LAST)
- return RNDIS_STATUS_INVALID_DATA;
- Adapter->mppriv.curr_rateidx = ratevalue;
- r8712_SetDataRate(Adapter);
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_start_test_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
- uint status = RNDIS_STATUS_SUCCESS;
- u32 mode;
- u8 val8;
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- mode = *((u32 *)poid_par_priv->information_buf);
- Adapter->mppriv.mode = mode;/* 1 for loopback*/
- if (mp_start_test(Adapter))
- status = RNDIS_STATUS_NOT_ACCEPTED;
- r8712_write8(Adapter, MSR, 1); /* Link in ad hoc network, 0x1025004C */
- r8712_write8(Adapter, RCR, 0); /* RCR : disable all pkt, 0x10250048 */
- /* RCR disable Check BSSID, 0x1025004a */
- r8712_write8(Adapter, RCR + 2, 0x57);
- /* disable RX filter map , mgt frames will put in RX FIFO 0 */
- r8712_write16(Adapter, RXFLTMAP0, 0x0);
- val8 = r8712_read8(Adapter, EE_9346CR);
- if (!(val8 & _9356SEL)) { /*boot from EFUSE*/
- r8712_efuse_reg_init(Adapter);
- r8712_efuse_change_max_size(Adapter);
- r8712_efuse_reg_uninit(Adapter);
- }
- return status;
-}
-
-uint oid_rt_pro_stop_test_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (mp_stop_test(Adapter) == _FAIL)
- return RNDIS_STATUS_NOT_ACCEPTED;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_set_channel_direct_call_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
- u32 Channel;
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len != sizeof(u32))
- return RNDIS_STATUS_INVALID_LENGTH;
- Channel = *((u32 *)poid_par_priv->information_buf);
- if (Channel > 14)
- return RNDIS_STATUS_NOT_ACCEPTED;
- Adapter->mppriv.curr_ch = Channel;
- r8712_SetChannel(Adapter);
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_set_antenna_bb_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
- u32 antenna;
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len != sizeof(u32))
- return RNDIS_STATUS_INVALID_LENGTH;
- antenna = *((u32 *)poid_par_priv->information_buf);
- Adapter->mppriv.antenna_tx = (u16)((antenna & 0xFFFF0000) >> 16);
- Adapter->mppriv.antenna_rx = (u16)(antenna & 0x0000FFFF);
- r8712_SwitchAntenna(Adapter);
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_set_tx_power_control_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
- u32 tx_pwr_idx;
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len != sizeof(u32))
- return RNDIS_STATUS_INVALID_LENGTH;
- tx_pwr_idx = *((u32 *)poid_par_priv->information_buf);
- if (tx_pwr_idx > MAX_TX_PWR_INDEX_N_MODE)
- return RNDIS_STATUS_NOT_ACCEPTED;
- Adapter->mppriv.curr_txpoweridx = (u8)tx_pwr_idx;
- r8712_SetTxPower(Adapter);
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_query_tx_packet_sent_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
-
- if (poid_par_priv->information_buf_len == sizeof(u32)) {
- *(u32 *)poid_par_priv->information_buf =
- Adapter->mppriv.tx_pktcount;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- } else {
- return RNDIS_STATUS_INVALID_LENGTH;
- }
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_query_rx_packet_received_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
-
- if (poid_par_priv->information_buf_len == sizeof(u32)) {
- *(u32 *)poid_par_priv->information_buf =
- Adapter->mppriv.rx_pktcount;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- } else {
- return RNDIS_STATUS_INVALID_LENGTH;
- }
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_query_rx_packet_crc32_error_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
-
- if (poid_par_priv->information_buf_len == sizeof(u32)) {
- *(u32 *)poid_par_priv->information_buf =
- Adapter->mppriv.rx_crcerrpktcount;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- } else {
- return RNDIS_STATUS_INVALID_LENGTH;
- }
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_reset_tx_packet_sent_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- Adapter->mppriv.tx_pktcount = 0;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_reset_rx_packet_received_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len == sizeof(u32)) {
- Adapter->mppriv.rx_pktcount = 0;
- Adapter->mppriv.rx_crcerrpktcount = 0;
- } else {
- return RNDIS_STATUS_INVALID_LENGTH;
- }
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_reset_phy_rx_packet_count_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- r8712_ResetPhyRxPktCount(Adapter);
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_phy_rx_packet_received_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len != sizeof(u32))
- return RNDIS_STATUS_INVALID_LENGTH;
- *(u32 *)poid_par_priv->information_buf =
- r8712_GetPhyRxPktReceived(Adapter);
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_phy_rx_packet_crc32_error_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len != sizeof(u32))
- return RNDIS_STATUS_INVALID_LENGTH;
- *(u32 *)poid_par_priv->information_buf =
- r8712_GetPhyRxPktCRC32Error(Adapter);
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_set_modulation_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
-
- Adapter->mppriv.curr_modem = *((u8 *)poid_par_priv->information_buf);
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_set_continuous_tx_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
- u32 bStartTest;
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- bStartTest = *((u32 *)poid_par_priv->information_buf);
- r8712_SetContinuousTx(Adapter, (u8)bStartTest);
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_set_single_carrier_tx_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
- u32 bStartTest;
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- bStartTest = *((u32 *)poid_par_priv->information_buf);
- r8712_SetSingleCarrierTx(Adapter, (u8)bStartTest);
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_set_carrier_suppression_tx_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
- u32 bStartTest;
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- bStartTest = *((u32 *)poid_par_priv->information_buf);
- r8712_SetCarrierSuppressionTx(Adapter, (u8)bStartTest);
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_set_single_tone_tx_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
- u32 bStartTest;
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- bStartTest = *((u32 *)poid_par_priv->information_buf);
- r8712_SetSingleToneTx(Adapter, (u8)bStartTest);
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_read_register_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
- uint status = RNDIS_STATUS_SUCCESS;
- struct mp_rw_reg *RegRWStruct;
- u16 offset;
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- RegRWStruct = (struct mp_rw_reg *)poid_par_priv->information_buf;
- if ((RegRWStruct->offset >= 0x10250800) &&
- (RegRWStruct->offset <= 0x10250FFF)) {
- /*baseband register*/
- /*0ffset :0x800~0xfff*/
- offset = (u16)(RegRWStruct->offset) & 0xFFF;
- RegRWStruct->value = r8712_bb_reg_read(Adapter, offset);
- } else {
- switch (RegRWStruct->width) {
- case 1:
- RegRWStruct->value = r8712_read8(Adapter,
- RegRWStruct->offset);
- break;
- case 2:
- RegRWStruct->value = r8712_read16(Adapter,
- RegRWStruct->offset);
- break;
- case 4:
- RegRWStruct->value = r8712_read32(Adapter,
- RegRWStruct->offset);
- break;
- default:
- status = RNDIS_STATUS_NOT_ACCEPTED;
- break;
- }
- }
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- return status;
-}
-
-uint oid_rt_pro_write_register_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
- uint status = RNDIS_STATUS_SUCCESS;
- struct mp_rw_reg *RegRWStruct;
- u16 offset;
- u32 value;
- u32 oldValue = 0;
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- RegRWStruct = (struct mp_rw_reg *)poid_par_priv->information_buf;
- if ((RegRWStruct->offset >= 0x10250800) &&
- (RegRWStruct->offset <= 0x10250FFF)) {
- /*baseband register*/
- offset = (u16)(RegRWStruct->offset) & 0xFFF;
- value = RegRWStruct->value;
- switch (RegRWStruct->width) {
- case 1:
- oldValue = r8712_bb_reg_read(Adapter, offset);
- oldValue &= 0xFFFFFF00;
- value &= 0x000000FF;
- value |= oldValue;
- break;
- case 2:
- oldValue = r8712_bb_reg_read(Adapter, offset);
- oldValue &= 0xFFFF0000;
- value &= 0x0000FFFF;
- value |= oldValue;
- break;
- }
- r8712_bb_reg_write(Adapter, offset, value);
- } else {
- switch (RegRWStruct->width) {
- case 1:
- r8712_write8(Adapter, RegRWStruct->offset,
- (unsigned char)RegRWStruct->value);
- break;
- case 2:
- r8712_write16(Adapter, RegRWStruct->offset,
- (unsigned short)RegRWStruct->value);
- break;
- case 4:
- r8712_write32(Adapter, RegRWStruct->offset,
- (unsigned int)RegRWStruct->value);
- break;
- default:
- status = RNDIS_STATUS_NOT_ACCEPTED;
- break;
- }
- }
- return status;
-}
-
-uint oid_rt_get_thermal_meter_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
-
- if (Adapter->mppriv.act_in_progress)
- return RNDIS_STATUS_NOT_ACCEPTED;
-
- if (poid_par_priv->information_buf_len < sizeof(u8))
- return RNDIS_STATUS_INVALID_LENGTH;
- /*init workparam*/
- Adapter->mppriv.act_in_progress = true;
- Adapter->mppriv.workparam.bcompleted = false;
- Adapter->mppriv.workparam.act_type = MPT_GET_THERMAL_METER;
- Adapter->mppriv.workparam.io_offset = 0;
- Adapter->mppriv.workparam.io_value = 0xFFFFFFFF;
- r8712_GetThermalMeter(Adapter, &Adapter->mppriv.workparam.io_value);
- Adapter->mppriv.workparam.bcompleted = true;
- Adapter->mppriv.act_in_progress = false;
- *(u32 *)poid_par_priv->information_buf =
- Adapter->mppriv.workparam.io_value;
- *poid_par_priv->bytes_rw = sizeof(u32);
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_read_efuse_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
-
- uint status = RNDIS_STATUS_SUCCESS;
-
- struct EFUSE_ACCESS_STRUCT *pefuse;
- u8 *data;
- u16 addr = 0, cnts = 0;
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len <
- sizeof(struct EFUSE_ACCESS_STRUCT))
- return RNDIS_STATUS_INVALID_LENGTH;
- pefuse = (struct EFUSE_ACCESS_STRUCT *)poid_par_priv->information_buf;
- addr = pefuse->start_addr;
- cnts = pefuse->cnts;
- data = pefuse->data;
- memset(data, 0xFF, cnts);
- if ((addr > 511) || (cnts < 1) || (cnts > 512) || (addr + cnts) >
- EFUSE_MAX_SIZE)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (!r8712_efuse_access(Adapter, true, addr, cnts, data))
- status = RNDIS_STATUS_FAILURE;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- return status;
-}
-
-/*------------------------------------------------------------------------*/
-uint oid_rt_pro_write_efuse_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
-
- uint status = RNDIS_STATUS_SUCCESS;
-
- struct EFUSE_ACCESS_STRUCT *pefuse;
- u8 *data;
- u16 addr = 0, cnts = 0;
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
-
- pefuse = (struct EFUSE_ACCESS_STRUCT *)poid_par_priv->information_buf;
- addr = pefuse->start_addr;
- cnts = pefuse->cnts;
- data = pefuse->data;
-
- if ((addr > 511) || (cnts < 1) || (cnts > 512) ||
- (addr + cnts) > r8712_efuse_get_max_size(Adapter))
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (!r8712_efuse_access(Adapter, false, addr, cnts, data))
- status = RNDIS_STATUS_FAILURE;
- return status;
-}
-
-/*----------------------------------------------------------------------*/
-
-uint oid_rt_get_efuse_current_size_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len < sizeof(int))
- return RNDIS_STATUS_INVALID_LENGTH;
- r8712_efuse_reg_init(Adapter);
- *(int *)poid_par_priv->information_buf =
- r8712_efuse_get_current_size(Adapter);
- r8712_efuse_reg_uninit(Adapter);
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_efuse_max_size_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len < sizeof(u32))
- return RNDIS_STATUS_INVALID_LENGTH;
- *(int *)poid_par_priv->information_buf =
- r8712_efuse_get_max_size(Adapter);
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_efuse_hdl(struct oid_par_priv *poid_par_priv)
-{
- uint status = RNDIS_STATUS_SUCCESS;
-
- if (poid_par_priv->type_of_oid == QUERY_OID)
- status = oid_rt_pro_read_efuse_hdl(poid_par_priv);
- else
- status = oid_rt_pro_write_efuse_hdl(poid_par_priv);
- return status;
-}
-
-uint oid_rt_pro_efuse_map_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
- uint status = RNDIS_STATUS_SUCCESS;
- u8 *data;
-
- *poid_par_priv->bytes_rw = 0;
- if (poid_par_priv->information_buf_len < EFUSE_MAP_MAX_SIZE)
- return RNDIS_STATUS_INVALID_LENGTH;
- data = (u8 *)poid_par_priv->information_buf;
- if (poid_par_priv->type_of_oid == QUERY_OID) {
- if (r8712_efuse_map_read(Adapter, 0, EFUSE_MAP_MAX_SIZE, data))
- *poid_par_priv->bytes_rw = EFUSE_MAP_MAX_SIZE;
- else
- status = RNDIS_STATUS_FAILURE;
- } else {
- /* SET_OID */
- if (r8712_efuse_reg_init(Adapter)) {
- if (r8712_efuse_map_write(Adapter, 0,
- EFUSE_MAP_MAX_SIZE, data))
- *poid_par_priv->bytes_rw = EFUSE_MAP_MAX_SIZE;
- else
- status = RNDIS_STATUS_FAILURE;
- r8712_efuse_reg_uninit(Adapter);
- } else {
- status = RNDIS_STATUS_FAILURE;
- }
- }
- return status;
-}
-
-uint oid_rt_set_bandwidth_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
- u32 bandwidth;
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len < sizeof(u32))
- return RNDIS_STATUS_INVALID_LENGTH;
- bandwidth = *((u32 *)poid_par_priv->information_buf);/*4*/
- if (bandwidth != HT_CHANNEL_WIDTH_20)
- bandwidth = HT_CHANNEL_WIDTH_40;
- Adapter->mppriv.curr_bandwidth = (u8)bandwidth;
- r8712_SwitchBandwidth(Adapter);
- return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_set_rx_packet_type_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
- u8 rx_pkt_type;
- u32 rcr_val32;
-
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len < sizeof(u8))
- return RNDIS_STATUS_INVALID_LENGTH;
- rx_pkt_type = *((u8 *)poid_par_priv->information_buf);/*4*/
- rcr_val32 = r8712_read32(Adapter, RCR);/*RCR = 0x10250048*/
- rcr_val32 &= ~(RCR_CBSSID | RCR_AB | RCR_AM | RCR_APM | RCR_AAP);
- switch (rx_pkt_type) {
- case RX_PKT_BROADCAST:
- rcr_val32 |= (RCR_AB | RCR_AM | RCR_APM | RCR_AAP | RCR_ACRC32);
- break;
- case RX_PKT_DEST_ADDR:
- rcr_val32 |= (RCR_AB | RCR_AM | RCR_APM | RCR_AAP | RCR_ACRC32);
- break;
- case RX_PKT_PHY_MATCH:
- rcr_val32 |= (RCR_APM | RCR_ACRC32);
- break;
- default:
- rcr_val32 &= ~(RCR_AAP |
- RCR_APM |
- RCR_AM |
- RCR_AB |
- RCR_ACRC32);
- break;
- }
- if (rx_pkt_type == RX_PKT_DEST_ADDR)
- Adapter->mppriv.check_mp_pkt = 1;
- else
- Adapter->mppriv.check_mp_pkt = 0;
- r8712_write32(Adapter, RCR, rcr_val32);
- return RNDIS_STATUS_SUCCESS;
-}
-
-/*--------------------------------------------------------------------------*/
-/*Linux*/
-unsigned int mp_ioctl_xmit_packet_hdl(struct oid_par_priv *poid_par_priv)
-{
- return _SUCCESS;
-}
-
-/*-------------------------------------------------------------------------*/
-uint oid_rt_set_power_down_hdl(struct oid_par_priv *poid_par_priv)
-{
- if (poid_par_priv->type_of_oid != SET_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- /*CALL the power_down function*/
- return RNDIS_STATUS_SUCCESS;
-}
-
-/*-------------------------------------------------------------------------- */
-uint oid_rt_get_power_mode_hdl(struct oid_par_priv *poid_par_priv)
-{
- struct _adapter *Adapter = (struct _adapter *)
- (poid_par_priv->adapter_context);
-
- if (poid_par_priv->type_of_oid != QUERY_OID)
- return RNDIS_STATUS_NOT_ACCEPTED;
- if (poid_par_priv->information_buf_len < sizeof(u32))
- return RNDIS_STATUS_INVALID_LENGTH;
- *(int *)poid_par_priv->information_buf =
- Adapter->registrypriv.low_power ? POWER_LOW : POWER_NORMAL;
- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
- return RNDIS_STATUS_SUCCESS;
-}
--- a/drivers/staging/rtl8712/rtl871x_mp_ioctl.h
+++ /dev/null
@@ -1,328 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _RTL871X_MP_IOCTL_H
-#define _RTL871X_MP_IOCTL_H
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "mp_custom_oid.h"
-#include "rtl871x_ioctl.h"
-#include "rtl871x_ioctl_rtl.h"
-#include "rtl8712_efuse.h"
-
-#define TESTFWCMDNUMBER 1000000
-#define TEST_H2CINT_WAIT_TIME 500
-#define TEST_C2HINT_WAIT_TIME 500
-#define HCI_TEST_SYSCFG_HWMASK 1
-#define _BUSCLK_40M (4 << 2)
-
-struct CFG_DBG_MSG_STRUCT {
- u32 DebugLevel;
- u32 DebugComponent_H32;
- u32 DebugComponent_L32;
-};
-
-struct mp_rw_reg {
- uint offset;
- uint width;
- u32 value;
-};
-
-/* for OID_RT_PRO_READ16_EEPROM & OID_RT_PRO_WRITE16_EEPROM */
-struct eeprom_rw_param {
- uint offset;
- u16 value;
-};
-
-struct EFUSE_ACCESS_STRUCT {
- u16 start_addr;
- u16 cnts;
- u8 data[];
-};
-
-struct burst_rw_reg {
- uint offset;
- uint len;
- u8 Data[256];
-};
-
-struct usb_vendor_req {
- u8 bRequest;
- u16 wValue;
- u16 wIndex;
- u16 wLength;
- u8 u8Dir;/*0:OUT, 1:IN */
- u8 u8InData;
-};
-
-struct DR_VARIABLE_STRUCT {
- u8 offset;
- u32 variable;
-};
-
-/* oid_rtl_seg_87_11_00 */
-uint oid_rt_pro_read_register_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_write_register_hdl(struct oid_par_priv *poid_par_priv);
-/* oid_rtl_seg_81_80_00 */
-uint oid_rt_pro_set_data_rate_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_start_test_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_stop_test_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_set_channel_direct_call_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_set_antenna_bb_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_set_tx_power_control_hdl(
- struct oid_par_priv *poid_par_priv);
-/* oid_rtl_seg_81_80_20 */
-uint oid_rt_pro_query_tx_packet_sent_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_query_rx_packet_received_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_query_rx_packet_crc32_error_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_reset_tx_packet_sent_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_reset_rx_packet_received_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_set_modulation_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_set_continuous_tx_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_set_single_carrier_tx_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_set_carrier_suppression_tx_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_set_single_tone_tx_hdl(
- struct oid_par_priv *poid_par_priv);
-/* oid_rtl_seg_81_87 */
-uint oid_rt_pro_write_bb_reg_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_read_bb_reg_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_write_rf_reg_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_read_rf_reg_hdl(struct oid_par_priv *poid_par_priv);
-/* oid_rtl_seg_81_85 */
-uint oid_rt_wireless_mode_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_read_efuse_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_write_efuse_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_efuse_current_size_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_efuse_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_efuse_map_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_set_bandwidth_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_set_rx_packet_type_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_efuse_max_size_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_thermal_meter_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_reset_phy_rx_packet_count_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_phy_rx_packet_received_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_phy_rx_packet_crc32_error_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_set_power_down_hdl(
- struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_power_mode_hdl(
- struct oid_par_priv *poid_par_priv);
-#ifdef _RTL871X_MP_IOCTL_C_ /* CAUTION!!! */
-/* This ifdef _MUST_ be left in!! */
-
-#else /* _RTL871X_MP_IOCTL_C_ */
-extern struct oid_obj_priv oid_rtl_seg_81_87[5];
-extern struct oid_obj_priv oid_rtl_seg_87_11_00[32];
-extern struct oid_obj_priv oid_rtl_seg_87_11_20[5];
-extern struct oid_obj_priv oid_rtl_seg_87_11_50[2];
-extern struct oid_obj_priv oid_rtl_seg_87_11_80[1];
-extern struct oid_obj_priv oid_rtl_seg_87_11_B0[1];
-extern struct oid_obj_priv oid_rtl_seg_87_11_F0[16];
-extern struct oid_obj_priv oid_rtl_seg_87_12_00[32];
-
-#endif /* _RTL871X_MP_IOCTL_C_ */
-
-enum MP_MODE {
- MP_START_MODE,
- MP_STOP_MODE,
- MP_ERR_MODE
-};
-
-struct rwreg_param {
- unsigned int offset;
- unsigned int width;
- unsigned int value;
-};
-
-struct bbreg_param {
- unsigned int offset;
- unsigned int phymask;
- unsigned int value;
-};
-
-struct txpower_param {
- unsigned int pwr_index;
-};
-
-struct datarate_param {
- unsigned int rate_index;
-};
-
-struct rfintfs_parm {
- unsigned int rfintfs;
-};
-
-struct mp_xmit_packet {
- unsigned int len;
-};
-
-struct psmode_param {
- unsigned int ps_mode;
- unsigned int smart_ps;
-};
-
-struct mp_ioctl_handler {
- unsigned int paramsize;
- unsigned int (*handler)(struct oid_par_priv *poid_par_priv);
- unsigned int oid;
-};
-
-struct mp_ioctl_param {
- unsigned int subcode;
- unsigned int len;
- unsigned char data[];
-};
-
-#define GEN_MP_IOCTL_SUBCODE(code) _MP_IOCTL_ ## code ## _CMD_
-
-enum RTL871X_MP_IOCTL_SUBCODE {
- GEN_MP_IOCTL_SUBCODE(MP_START), /*0*/
- GEN_MP_IOCTL_SUBCODE(MP_STOP), /*1*/
- GEN_MP_IOCTL_SUBCODE(READ_REG), /*2*/
- GEN_MP_IOCTL_SUBCODE(WRITE_REG),
- GEN_MP_IOCTL_SUBCODE(SET_CHANNEL), /*4*/
- GEN_MP_IOCTL_SUBCODE(SET_TXPOWER), /*5*/
- GEN_MP_IOCTL_SUBCODE(SET_DATARATE), /*6*/
- GEN_MP_IOCTL_SUBCODE(READ_BB_REG), /*7*/
- GEN_MP_IOCTL_SUBCODE(WRITE_BB_REG),
- GEN_MP_IOCTL_SUBCODE(READ_RF_REG), /*9*/
- GEN_MP_IOCTL_SUBCODE(WRITE_RF_REG),
- GEN_MP_IOCTL_SUBCODE(SET_RF_INTFS),
- GEN_MP_IOCTL_SUBCODE(IOCTL_XMIT_PACKET), /*12*/
- GEN_MP_IOCTL_SUBCODE(PS_STATE), /*13*/
- GEN_MP_IOCTL_SUBCODE(READ16_EEPROM), /*14*/
- GEN_MP_IOCTL_SUBCODE(WRITE16_EEPROM), /*15*/
- GEN_MP_IOCTL_SUBCODE(SET_PTM), /*16*/
- GEN_MP_IOCTL_SUBCODE(READ_TSSI), /*17*/
- GEN_MP_IOCTL_SUBCODE(CNTU_TX), /*18*/
- GEN_MP_IOCTL_SUBCODE(SET_BANDWIDTH), /*19*/
- GEN_MP_IOCTL_SUBCODE(SET_RX_PKT_TYPE), /*20*/
- GEN_MP_IOCTL_SUBCODE(RESET_PHY_RX_PKT_CNT), /*21*/
- GEN_MP_IOCTL_SUBCODE(GET_PHY_RX_PKT_RECV), /*22*/
- GEN_MP_IOCTL_SUBCODE(GET_PHY_RX_PKT_ERROR), /*23*/
- GEN_MP_IOCTL_SUBCODE(SET_POWER_DOWN), /*24*/
- GEN_MP_IOCTL_SUBCODE(GET_THERMAL_METER), /*25*/
- GEN_MP_IOCTL_SUBCODE(GET_POWER_MODE), /*26*/
- GEN_MP_IOCTL_SUBCODE(EFUSE), /*27*/
- GEN_MP_IOCTL_SUBCODE(EFUSE_MAP), /*28*/
- GEN_MP_IOCTL_SUBCODE(GET_EFUSE_MAX_SIZE), /*29*/
- GEN_MP_IOCTL_SUBCODE(GET_EFUSE_CURRENT_SIZE), /*30*/
- GEN_MP_IOCTL_SUBCODE(SC_TX), /*31*/
- GEN_MP_IOCTL_SUBCODE(CS_TX), /*32*/
- GEN_MP_IOCTL_SUBCODE(ST_TX), /*33*/
- GEN_MP_IOCTL_SUBCODE(SET_ANTENNA), /*34*/
- MAX_MP_IOCTL_SUBCODE,
-};
-
-unsigned int mp_ioctl_xmit_packet_hdl(struct oid_par_priv *poid_par_priv);
-
-#ifdef _RTL871X_MP_IOCTL_C_ /* CAUTION!!! */
-/* This ifdef _MUST_ be left in!! */
-
-static struct mp_ioctl_handler mp_ioctl_hdl[] = {
- {sizeof(u32), oid_rt_pro_start_test_hdl,
- OID_RT_PRO_START_TEST},/*0*/
- {sizeof(u32), oid_rt_pro_stop_test_hdl,
- OID_RT_PRO_STOP_TEST},/*1*/
- {sizeof(struct rwreg_param),
- oid_rt_pro_read_register_hdl,
- OID_RT_PRO_READ_REGISTER},/*2*/
- {sizeof(struct rwreg_param),
- oid_rt_pro_write_register_hdl,
- OID_RT_PRO_WRITE_REGISTER},
- {sizeof(u32),
- oid_rt_pro_set_channel_direct_call_hdl,
- OID_RT_PRO_SET_CHANNEL_DIRECT_CALL},
- {sizeof(struct txpower_param),
- oid_rt_pro_set_tx_power_control_hdl,
- OID_RT_PRO_SET_TX_POWER_CONTROL},
- {sizeof(u32),
- oid_rt_pro_set_data_rate_hdl,
- OID_RT_PRO_SET_DATA_RATE},
- {sizeof(struct bb_reg_param),
- oid_rt_pro_read_bb_reg_hdl,
- OID_RT_PRO_READ_BB_REG},/*7*/
- {sizeof(struct bb_reg_param),
- oid_rt_pro_write_bb_reg_hdl,
- OID_RT_PRO_WRITE_BB_REG},
- {sizeof(struct rwreg_param),
- oid_rt_pro_read_rf_reg_hdl,
- OID_RT_PRO_RF_READ_REGISTRY},/*9*/
- {sizeof(struct rwreg_param),
- oid_rt_pro_write_rf_reg_hdl,
- OID_RT_PRO_RF_WRITE_REGISTRY},
- {sizeof(struct rfintfs_parm), NULL, 0},
- {0, mp_ioctl_xmit_packet_hdl, 0},/*12*/
- {sizeof(struct psmode_param), NULL, 0},/*13*/
- {sizeof(struct eeprom_rw_param), NULL, 0},/*14*/
- {sizeof(struct eeprom_rw_param), NULL, 0},/*15*/
- {sizeof(unsigned char), NULL, 0},/*16*/
- {sizeof(u32), NULL, 0},/*17*/
- {sizeof(u32), oid_rt_pro_set_continuous_tx_hdl,
- OID_RT_PRO_SET_CONTINUOUS_TX},/*18*/
- {sizeof(u32), oid_rt_set_bandwidth_hdl,
- OID_RT_SET_BANDWIDTH},/*19*/
- {sizeof(u32), oid_rt_set_rx_packet_type_hdl,
- OID_RT_SET_RX_PACKET_TYPE},/*20*/
- {0, oid_rt_reset_phy_rx_packet_count_hdl,
- OID_RT_RESET_PHY_RX_PACKET_COUNT},/*21*/
- {sizeof(u32), oid_rt_get_phy_rx_packet_received_hdl,
- OID_RT_GET_PHY_RX_PACKET_RECEIVED},/*22*/
- {sizeof(u32), oid_rt_get_phy_rx_packet_crc32_error_hdl,
- OID_RT_GET_PHY_RX_PACKET_CRC32_ERROR},/*23*/
- {sizeof(unsigned char), oid_rt_set_power_down_hdl,
- OID_RT_SET_POWER_DOWN},/*24*/
- {sizeof(u32), oid_rt_get_thermal_meter_hdl,
- OID_RT_PRO_GET_THERMAL_METER},/*25*/
- {sizeof(u32), oid_rt_get_power_mode_hdl,
- OID_RT_GET_POWER_MODE},/*26*/
- {sizeof(struct EFUSE_ACCESS_STRUCT),
- oid_rt_pro_efuse_hdl, OID_RT_PRO_EFUSE},/*27*/
- {EFUSE_MAP_MAX_SIZE, oid_rt_pro_efuse_map_hdl,
- OID_RT_PRO_EFUSE_MAP},/*28*/
- {sizeof(u32), oid_rt_get_efuse_max_size_hdl,
- OID_RT_GET_EFUSE_MAX_SIZE},/*29*/
- {sizeof(u32), oid_rt_get_efuse_current_size_hdl,
- OID_RT_GET_EFUSE_CURRENT_SIZE},/*30*/
- {sizeof(u32), oid_rt_pro_set_single_carrier_tx_hdl,
- OID_RT_PRO_SET_SINGLE_CARRIER_TX},/*31*/
- {sizeof(u32), oid_rt_pro_set_carrier_suppression_tx_hdl,
- OID_RT_PRO_SET_CARRIER_SUPPRESSION_TX},/*32*/
- {sizeof(u32), oid_rt_pro_set_single_tone_tx_hdl,
- OID_RT_PRO_SET_SINGLE_TONE_TX},/*33*/
- {sizeof(u32), oid_rt_pro_set_antenna_bb_hdl,
- OID_RT_PRO_SET_ANTENNA_BB},/*34*/
-};
-
-#else /* _RTL871X_MP_IOCTL_C_ */
-extern struct mp_ioctl_handler mp_ioctl_hdl[];
-#endif /* _RTL871X_MP_IOCTL_C_ */
-
-#endif
-
--- a/drivers/staging/rtl8712/rtl871x_mp_phy_regdef.h
+++ /dev/null
@@ -1,1034 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/*****************************************************************************
- * Copyright(c) 2008, RealTEK Technology Inc. All Right Reserved.
- *
- * Module: __INC_HAL8192SPHYREG_H
- *
- *
- * Note: 1. Define PMAC/BB register map
- * 2. Define RF register map
- * 3. PMAC/BB register bit mask.
- * 4. RF reg bit mask.
- * 5. Other BB/RF relative definition.
- *
- *
- * Export: Constants, macro, functions(API), global variables(None).
- *
- * Abbrev:
- *
- * History:
- * Data Who Remark
- * 08/07/2007 MHC 1. Porting from 9x series PHYCFG.h.
- * 2. Reorganize code architecture.
- * 09/25/2008 MH 1. Add RL6052 register definition
- *
- *****************************************************************************/
-#ifndef __RTL871X_MP_PHY_REGDEF_H
-#define __RTL871X_MP_PHY_REGDEF_H
-
-/*--------------------------Define Parameters-------------------------------*/
-
-/*============================================================
- * 8192S Register offset definition
- *============================================================
- *
- *
- * BB-PHY register PMAC 0x100 PHY 0x800 - 0xEFF
- * 1. PMAC duplicate register due to connection: RF_Mode, TRxRN, NumOf L-STF
- * 2. 0x800/0x900/0xA00/0xC00/0xD00/0xE00
- * 3. RF register 0x00-2E
- * 4. Bit Mask for BB/RF register
- * 5. Other definition for BB/RF R/W
- *
- * 1. PMAC duplicate register due to connection: RF_Mode, TRxRN, NumOf L-STF
- * 1. Page1(0x100)
- */
-#define rPMAC_Reset 0x100
-#define rPMAC_TxStart 0x104
-#define rPMAC_TxLegacySIG 0x108
-#define rPMAC_TxHTSIG1 0x10c
-#define rPMAC_TxHTSIG2 0x110
-#define rPMAC_PHYDebug 0x114
-#define rPMAC_TxPacketNum 0x118
-#define rPMAC_TxIdle 0x11c
-#define rPMAC_TxMACHeader0 0x120
-#define rPMAC_TxMACHeader1 0x124
-#define rPMAC_TxMACHeader2 0x128
-#define rPMAC_TxMACHeader3 0x12c
-#define rPMAC_TxMACHeader4 0x130
-#define rPMAC_TxMACHeader5 0x134
-#define rPMAC_TxDataType 0x138
-#define rPMAC_TxRandomSeed 0x13c
-#define rPMAC_CCKPLCPPreamble 0x140
-#define rPMAC_CCKPLCPHeader 0x144
-#define rPMAC_CCKCRC16 0x148
-#define rPMAC_OFDMRxCRC32OK 0x170
-#define rPMAC_OFDMRxCRC32Er 0x174
-#define rPMAC_OFDMRxParityEr 0x178
-#define rPMAC_OFDMRxCRC8Er 0x17c
-#define rPMAC_CCKCRxRC16Er 0x180
-#define rPMAC_CCKCRxRC32Er 0x184
-#define rPMAC_CCKCRxRC32OK 0x188
-#define rPMAC_TxStatus 0x18c
-
-/*
- * 2. Page2(0x200)
- *
- * The following two definition are only used for USB interface.
- *#define RF_BB_CMD_ADDR 0x02c0 // RF/BB read/write command address.
- *#define RF_BB_CMD_DATA 0x02c4 // RF/BB read/write command data.
- *
- *
- * 3. Page8(0x800)
- */
-#define rFPGA0_RFMOD 0x800 /*RF mode & CCK TxSC RF
- * BW Setting??
- */
-#define rFPGA0_TxInfo 0x804 /* Status report?? */
-#define rFPGA0_PSDFunction 0x808
-#define rFPGA0_TxGainStage 0x80c /* Set TX PWR init gain? */
-#define rFPGA0_RFTiming1 0x810 /* Useless now */
-#define rFPGA0_RFTiming2 0x814
-#define rFPGA0_XA_HSSIParameter1 0x820 /* RF 3 wire register */
-#define rFPGA0_XA_HSSIParameter2 0x824
-#define rFPGA0_XB_HSSIParameter1 0x828
-#define rFPGA0_XB_HSSIParameter2 0x82c
-#define rFPGA0_XC_HSSIParameter1 0x830
-#define rFPGA0_XC_HSSIParameter2 0x834
-#define rFPGA0_XD_HSSIParameter1 0x838
-#define rFPGA0_XD_HSSIParameter2 0x83c
-#define rFPGA0_XA_LSSIParameter 0x840
-#define rFPGA0_XB_LSSIParameter 0x844
-#define rFPGA0_XC_LSSIParameter 0x848
-#define rFPGA0_XD_LSSIParameter 0x84c
-
-#define rFPGA0_RFWakeUpParameter 0x850 /* Useless now */
-#define rFPGA0_RFSleepUpParameter 0x854
-
-#define rFPGA0_XAB_SwitchControl 0x858 /* RF Channel switch */
-#define rFPGA0_XCD_SwitchControl 0x85c
-
-#define rFPGA0_XA_RFInterfaceOE 0x860 /* RF Channel switch */
-#define rFPGA0_XB_RFInterfaceOE 0x864
-#define rFPGA0_XC_RFInterfaceOE 0x868
-#define rFPGA0_XD_RFInterfaceOE 0x86c
-#define rFPGA0_XAB_RFInterfaceSW 0x870 /* RF Interface Software Ctrl */
-#define rFPGA0_XCD_RFInterfaceSW 0x874
-
-#define rFPGA0_XAB_RFParameter 0x878 /* RF Parameter */
-#define rFPGA0_XCD_RFParameter 0x87c
-
-#define rFPGA0_AnalogParameter1 0x880 /* Crystal cap setting
- * RF-R/W protection
- * for parameter4??
- */
-#define rFPGA0_AnalogParameter2 0x884
-#define rFPGA0_AnalogParameter3 0x888 /* Useless now */
-#define rFPGA0_AnalogParameter4 0x88c
-
-#define rFPGA0_XA_LSSIReadBack 0x8a0 /* Tranceiver LSSI Readback */
-#define rFPGA0_XB_LSSIReadBack 0x8a4
-#define rFPGA0_XC_LSSIReadBack 0x8a8
-#define rFPGA0_XD_LSSIReadBack 0x8ac
-
-#define rFPGA0_PSDReport 0x8b4 /* Useless now */
-#define rFPGA0_XAB_RFInterfaceRB 0x8e0 /* Useless now */
-#define rFPGA0_XCD_RFInterfaceRB 0x8e4 /* Useless now */
-
-/*
- * 4. Page9(0x900)
- */
-#define rFPGA1_RFMOD 0x900 /* RF mode & OFDM TxSC */
-
-#define rFPGA1_TxBlock 0x904 /* Useless now */
-#define rFPGA1_DebugSelect 0x908 /* Useless now */
-#define rFPGA1_TxInfo 0x90c /* Useless now */
-
-/*
- * 5. PageA(0xA00)
- *
- * Set Control channel to upper or lower.
- * These settings are required only for 40MHz
- */
-#define rCCK0_System 0xa00
-
-#define rCCK0_AFESetting 0xa04 /* Disable init gain now */
-#define rCCK0_CCA 0xa08 /* Disable init gain now */
-
-#define rCCK0_RxAGC1 0xa0c
-/* AGC default value, saturation level
- * Antenna Diversity, RX AGC, LNA Threshold, RX LNA Threshold useless now.
- * Not the same as 90 series
- */
-#define rCCK0_RxAGC2 0xa10 /* AGC & DAGC */
-
-#define rCCK0_RxHP 0xa14
-
-#define rCCK0_DSPParameter1 0xa18 /* Timing recovery & Channel
- * estimation threshold
- */
-#define rCCK0_DSPParameter2 0xa1c /* SQ threshold */
-
-#define rCCK0_TxFilter1 0xa20
-#define rCCK0_TxFilter2 0xa24
-#define rCCK0_DebugPort 0xa28 /* debug port and Tx filter3 */
-#define rCCK0_FalseAlarmReport 0xa2c /* 0xa2d useless now 0xa30-a4f
- * channel report
- */
-#define rCCK0_TRSSIReport 0xa50
-#define rCCK0_RxReport 0xa54 /* 0xa57 */
-#define rCCK0_FACounterLower 0xa5c /* 0xa5b */
-#define rCCK0_FACounterUpper 0xa58 /* 0xa5c */
-
-/*
- * 6. PageC(0xC00)
- */
-#define rOFDM0_LSTF 0xc00
-#define rOFDM0_TRxPathEnable 0xc04
-#define rOFDM0_TRMuxPar 0xc08
-#define rOFDM0_TRSWIsolation 0xc0c
-
-/*RxIQ DC offset, Rx digital filter, DC notch filter */
-#define rOFDM0_XARxAFE 0xc10
-#define rOFDM0_XARxIQImbalance 0xc14 /* RxIQ imbalance matrix */
-#define rOFDM0_XBRxAFE 0xc18
-#define rOFDM0_XBRxIQImbalance 0xc1c
-#define rOFDM0_XCRxAFE 0xc20
-#define rOFDM0_XCRxIQImbalance 0xc24
-#define rOFDM0_XDRxAFE 0xc28
-#define rOFDM0_XDRxIQImbalance 0xc2c
-
-#define rOFDM0_RxDetector1 0xc30 /* PD,BW & SBD DM tune
- * init gain
- */
-#define rOFDM0_RxDetector2 0xc34 /* SBD & Fame Sync. */
-#define rOFDM0_RxDetector3 0xc38 /* Frame Sync. */
-#define rOFDM0_RxDetector4 0xc3c /* PD, SBD, Frame Sync &
- * Short-GI
- */
-
-#define rOFDM0_RxDSP 0xc40 /* Rx Sync Path */
-#define rOFDM0_CFOandDAGC 0xc44 /* CFO & DAGC */
-#define rOFDM0_CCADropThreshold 0xc48 /* CCA Drop threshold */
-#define rOFDM0_ECCAThreshold 0xc4c /* energy CCA */
-
-#define rOFDM0_XAAGCCore1 0xc50 /* DIG */
-#define rOFDM0_XAAGCCore2 0xc54
-#define rOFDM0_XBAGCCore1 0xc58
-#define rOFDM0_XBAGCCore2 0xc5c
-#define rOFDM0_XCAGCCore1 0xc60
-#define rOFDM0_XCAGCCore2 0xc64
-#define rOFDM0_XDAGCCore1 0xc68
-#define rOFDM0_XDAGCCore2 0xc6c
-#define rOFDM0_AGCParameter1 0xc70
-#define rOFDM0_AGCParameter2 0xc74
-#define rOFDM0_AGCRSSITable 0xc78
-#define rOFDM0_HTSTFAGC 0xc7c
-
-#define rOFDM0_XATxIQImbalance 0xc80 /* TX PWR TRACK and DIG */
-#define rOFDM0_XATxAFE 0xc84
-#define rOFDM0_XBTxIQImbalance 0xc88
-#define rOFDM0_XBTxAFE 0xc8c
-#define rOFDM0_XCTxIQImbalance 0xc90
-#define rOFDM0_XCTxAFE 0xc94
-#define rOFDM0_XDTxIQImbalance 0xc98
-#define rOFDM0_XDTxAFE 0xc9c
-
-#define rOFDM0_RxHPParameter 0xce0
-#define rOFDM0_TxPseudoNoiseWgt 0xce4
-#define rOFDM0_FrameSync 0xcf0
-#define rOFDM0_DFSReport 0xcf4
-#define rOFDM0_TxCoeff1 0xca4
-#define rOFDM0_TxCoeff2 0xca8
-#define rOFDM0_TxCoeff3 0xcac
-#define rOFDM0_TxCoeff4 0xcb0
-#define rOFDM0_TxCoeff5 0xcb4
-#define rOFDM0_TxCoeff6 0xcb8
-
-/*
- * 7. PageD(0xD00)
- */
-#define rOFDM1_LSTF 0xd00
-#define rOFDM1_TRxPathEnable 0xd04
-
-#define rOFDM1_CFO 0xd08 /* No setting now */
-#define rOFDM1_CSI1 0xd10
-#define rOFDM1_SBD 0xd14
-#define rOFDM1_CSI2 0xd18
-#define rOFDM1_CFOTracking 0xd2c
-#define rOFDM1_TRxMesaure1 0xd34
-#define rOFDM1_IntfDet 0xd3c
-#define rOFDM1_PseudoNoiseStateAB 0xd50
-#define rOFDM1_PseudoNoiseStateCD 0xd54
-#define rOFDM1_RxPseudoNoiseWgt 0xd58
-
-#define rOFDM_PHYCounter1 0xda0 /* cca, parity fail */
-#define rOFDM_PHYCounter2 0xda4 /* rate illegal, crc8 fail */
-#define rOFDM_PHYCounter3 0xda8 /* MCS not support */
-#define rOFDM_ShortCFOAB 0xdac /* No setting now */
-#define rOFDM_ShortCFOCD 0xdb0
-#define rOFDM_LongCFOAB 0xdb4
-#define rOFDM_LongCFOCD 0xdb8
-#define rOFDM_TailCFOAB 0xdbc
-#define rOFDM_TailCFOCD 0xdc0
-#define rOFDM_PWMeasure1 0xdc4
-#define rOFDM_PWMeasure2 0xdc8
-#define rOFDM_BWReport 0xdcc
-#define rOFDM_AGCReport 0xdd0
-#define rOFDM_RxSNR 0xdd4
-#define rOFDM_RxEVMCSI 0xdd8
-#define rOFDM_SIGReport 0xddc
-
-/*
- * 8. PageE(0xE00)
- */
-#define rTxAGC_Rate18_06 0xe00
-#define rTxAGC_Rate54_24 0xe04
-#define rTxAGC_CCK_Mcs32 0xe08
-#define rTxAGC_Mcs03_Mcs00 0xe10
-#define rTxAGC_Mcs07_Mcs04 0xe14
-#define rTxAGC_Mcs11_Mcs08 0xe18
-#define rTxAGC_Mcs15_Mcs12 0xe1c
-
-/* Analog- control in RX_WAIT_CCA : REG: EE0
- * [Analog- Power & Control Register]
- */
-#define rRx_Wait_CCCA 0xe70
-#define rAnapar_Ctrl_BB 0xee0
-
-/*
- * 7. RF Register 0x00-0x2E (RF 8256)
- * RF-0222D 0x00-3F
- *
- * Zebra1
- */
-#define rZebra1_HSSIEnable 0x0 /* Useless now */
-#define rZebra1_TRxEnable1 0x1
-#define rZebra1_TRxEnable2 0x2
-#define rZebra1_AGC 0x4
-#define rZebra1_ChargePump 0x5
-#define rZebra1_Channel 0x7 /* RF channel switch */
-#define rZebra1_TxGain 0x8 /* Useless now */
-#define rZebra1_TxLPF 0x9
-#define rZebra1_RxLPF 0xb
-#define rZebra1_RxHPFCorner 0xc
-
-/* Zebra4 */
-#define rGlobalCtrl 0 /* Useless now */
-#define rRTL8256_TxLPF 19
-#define rRTL8256_RxLPF 11
-
-/* RTL8258 */
-#define rRTL8258_TxLPF 0x11 /* Useless now */
-#define rRTL8258_RxLPF 0x13
-#define rRTL8258_RSSILPF 0xa
-
-/* RL6052 Register definition */
-#define RF_AC 0x00
-#define RF_IQADJ_G1 0x01
-#define RF_IQADJ_G2 0x02
-#define RF_POW_TRSW 0x05
-
-#define RF_GAIN_RX 0x06
-#define RF_GAIN_TX 0x07
-
-#define RF_TXM_IDAC 0x08
-#define RF_BS_IQGEN 0x0F
-
-#define RF_MODE1 0x10
-#define RF_MODE2 0x11
-
-#define RF_RX_AGC_HP 0x12
-#define RF_TX_AGC 0x13
-#define RF_BIAS 0x14
-#define RF_IPA 0x15
-#define RF_POW_ABILITY 0x17
-#define RF_MODE_AG 0x18
-#define rRfChannel 0x18 /* RF channel and BW switch */
-#define RF_CHNLBW 0x18 /* RF channel and BW switch */
-#define RF_TOP 0x19
-#define RF_RX_G1 0x1A
-#define RF_RX_G2 0x1B
-#define RF_RX_BB2 0x1C
-#define RF_RX_BB1 0x1D
-
-#define RF_RCK1 0x1E
-#define RF_RCK2 0x1F
-
-#define RF_TX_G1 0x20
-#define RF_TX_G2 0x21
-#define RF_TX_G3 0x22
-
-#define RF_TX_BB1 0x23
-#define RF_T_METER 0x24
-
-#define RF_SYN_G1 0x25 /* RF TX Power control */
-#define RF_SYN_G2 0x26 /* RF TX Power control */
-#define RF_SYN_G3 0x27 /* RF TX Power control */
-#define RF_SYN_G4 0x28 /* RF TX Power control */
-#define RF_SYN_G5 0x29 /* RF TX Power control */
-#define RF_SYN_G6 0x2A /* RF TX Power control */
-#define RF_SYN_G7 0x2B /* RF TX Power control */
-#define RF_SYN_G8 0x2C /* RF TX Power control */
-
-#define RF_RCK_OS 0x30 /* RF TX PA control */
-
-#define RF_TXPA_G1 0x31 /* RF TX PA control */
-#define RF_TXPA_G2 0x32 /* RF TX PA control */
-#define RF_TXPA_G3 0x33 /* RF TX PA control */
-
-/*
- * Bit Mask
- *
- * 1. Page1(0x100)
- */
-#define bBBResetB 0x100 /* Useless now? */
-#define bGlobalResetB 0x200
-#define bOFDMTxStart 0x4
-#define bCCKTxStart 0x8
-#define bCRC32Debug 0x100
-#define bPMACLoopback 0x10
-#define bTxLSIG 0xffffff
-#define bOFDMTxRate 0xf
-#define bOFDMTxReserved 0x10
-#define bOFDMTxLength 0x1ffe0
-#define bOFDMTxParity 0x20000
-#define bTxHTSIG1 0xffffff
-#define bTxHTMCSRate 0x7f
-#define bTxHTBW 0x80
-#define bTxHTLength 0xffff00
-#define bTxHTSIG2 0xffffff
-#define bTxHTSmoothing 0x1
-#define bTxHTSounding 0x2
-#define bTxHTReserved 0x4
-#define bTxHTAggreation 0x8
-#define bTxHTSTBC 0x30
-#define bTxHTAdvanceCoding 0x40
-#define bTxHTShortGI 0x80
-#define bTxHTNumberHT_LTF 0x300
-#define bTxHTCRC8 0x3fc00
-#define bCounterReset 0x10000
-#define bNumOfOFDMTx 0xffff
-#define bNumOfCCKTx 0xffff0000
-#define bTxIdleInterval 0xffff
-#define bOFDMService 0xffff0000
-#define bTxMACHeader 0xffffffff
-#define bTxDataInit 0xff
-#define bTxHTMode 0x100
-#define bTxDataType 0x30000
-#define bTxRandomSeed 0xffffffff
-#define bCCKTxPreamble 0x1
-#define bCCKTxSFD 0xffff0000
-#define bCCKTxSIG 0xff
-#define bCCKTxService 0xff00
-#define bCCKLengthExt 0x8000
-#define bCCKTxLength 0xffff0000
-#define bCCKTxCRC16 0xffff
-#define bCCKTxStatus 0x1
-#define bOFDMTxStatus 0x2
-#define IS_BB_REG_OFFSET_92S(_Offset) ((_Offset >= 0x800) && \
- (_Offset <= 0xfff))
-
-/* 2. Page8(0x800) */
-#define bRFMOD 0x1 /* Reg 0x800 rFPGA0_RFMOD */
-#define bJapanMode 0x2
-#define bCCKTxSC 0x30
-#define bCCKEn 0x1000000
-#define bOFDMEn 0x2000000
-
-#define bOFDMRxADCPhase 0x10000 /* Useless now */
-#define bOFDMTxDACPhase 0x40000
-#define bXATxAGC 0x3f
-#define bXBTxAGC 0xf00 /* Reg 80c rFPGA0_TxGainStage */
-#define bXCTxAGC 0xf000
-#define bXDTxAGC 0xf0000
-
-#define bPAStart 0xf0000000 /* Useless now */
-#define bTRStart 0x00f00000
-#define bRFStart 0x0000f000
-#define bBBStart 0x000000f0
-#define bBBCCKStart 0x0000000f
-#define bPAEnd 0xf /* Reg0x814 */
-#define bTREnd 0x0f000000
-#define bRFEnd 0x000f0000
-#define bCCAMask 0x000000f0 /* T2R */
-#define bR2RCCAMask 0x00000f00
-#define bHSSI_R2TDelay 0xf8000000
-#define bHSSI_T2RDelay 0xf80000
-#define bContTxHSSI 0x400 /* change gain at continue Tx */
-#define bIGFromCCK 0x200
-#define bAGCAddress 0x3f
-#define bRxHPTx 0x7000
-#define bRxHPT2R 0x38000
-#define bRxHPCCKIni 0xc0000
-#define bAGCTxCode 0xc00000
-#define bAGCRxCode 0x300000
-#define b3WireDataLength 0x800 /* Reg 0x820~84f rFPGA0_XA_HSSIParm1 */
-#define b3WireAddressLength 0x400
-#define b3WireRFPowerDown 0x1 /* Useless now */
-#define b5GPAPEPolarity 0x40000000
-#define b2GPAPEPolarity 0x80000000
-#define bRFSW_TxDefaultAnt 0x3
-#define bRFSW_TxOptionAnt 0x30
-#define bRFSW_RxDefaultAnt 0x300
-#define bRFSW_RxOptionAnt 0x3000
-#define bRFSI_3WireData 0x1
-#define bRFSI_3WireClock 0x2
-#define bRFSI_3WireLoad 0x4
-#define bRFSI_3WireRW 0x8
-#define bRFSI_3Wire 0xf
-#define bRFSI_RFENV 0x10 /* Reg 0x870 rFPGA0_XAB_RFInterfaceSW */
-#define bRFSI_TRSW 0x20 /* Useless now */
-#define bRFSI_TRSWB 0x40
-#define bRFSI_ANTSW 0x100
-#define bRFSI_ANTSWB 0x200
-#define bRFSI_PAPE 0x400
-#define bRFSI_PAPE5G 0x800
-#define bBandSelect 0x1
-#define bHTSIG2_GI 0x80
-#define bHTSIG2_Smoothing 0x01
-#define bHTSIG2_Sounding 0x02
-#define bHTSIG2_Aggreaton 0x08
-#define bHTSIG2_STBC 0x30
-#define bHTSIG2_AdvCoding 0x40
-#define bHTSIG2_NumOfHTLTF 0x300
-#define bHTSIG2_CRC8 0x3fc
-#define bHTSIG1_MCS 0x7f
-#define bHTSIG1_BandWidth 0x80
-#define bHTSIG1_HTLength 0xffff
-#define bLSIG_Rate 0xf
-#define bLSIG_Reserved 0x10
-#define bLSIG_Length 0x1fffe
-#define bLSIG_Parity 0x20
-#define bCCKRxPhase 0x4
-#define bLSSIReadAddress 0x7f800000 /* T65 RF */
-#define bLSSIReadEdge 0x80000000 /* LSSI "Read" edge signal */
-#define bLSSIReadBackData 0xfffff /* T65 RF */
-#define bLSSIReadOKFlag 0x1000 /* Useless now */
-#define bCCKSampleRate 0x8 /*0: 44MHz, 1:88MHz*/
-#define bRegulator0Standby 0x1
-#define bRegulatorPLLStandby 0x2
-#define bRegulator1Standby 0x4
-#define bPLLPowerUp 0x8
-#define bDPLLPowerUp 0x10
-#define bDA10PowerUp 0x20
-#define bAD7PowerUp 0x200
-#define bDA6PowerUp 0x2000
-#define bXtalPowerUp 0x4000
-#define b40MDClkPowerUP 0x8000
-#define bDA6DebugMode 0x20000
-#define bDA6Swing 0x380000
-
-/* Reg 0x880 rFPGA0_AnalogParameter1 20/40 CCK support switch 40/80 BB MHZ */
-#define bADClkPhase 0x4000000
-
-#define b80MClkDelay 0x18000000 /* Useless */
-#define bAFEWatchDogEnable 0x20000000
-
-/* Reg 0x884 rFPGA0_AnalogParameter2 Crystal cap */
-#define bXtalCap01 0xc0000000
-#define bXtalCap23 0x3
-#define bXtalCap92x 0x0f000000
-#define bXtalCap 0x0f000000
-#define bIntDifClkEnable 0x400 /* Useless */
-#define bExtSigClkEnable 0x800
-#define bBandgapMbiasPowerUp 0x10000
-#define bAD11SHGain 0xc0000
-#define bAD11InputRange 0x700000
-#define bAD11OPCurrent 0x3800000
-#define bIPathLoopback 0x4000000
-#define bQPathLoopback 0x8000000
-#define bAFELoopback 0x10000000
-#define bDA10Swing 0x7e0
-#define bDA10Reverse 0x800
-#define bDAClkSource 0x1000
-#define bAD7InputRange 0x6000
-#define bAD7Gain 0x38000
-#define bAD7OutputCMMode 0x40000
-#define bAD7InputCMMode 0x380000
-#define bAD7Current 0xc00000
-#define bRegulatorAdjust 0x7000000
-#define bAD11PowerUpAtTx 0x1
-#define bDA10PSAtTx 0x10
-#define bAD11PowerUpAtRx 0x100
-#define bDA10PSAtRx 0x1000
-#define bCCKRxAGCFormat 0x200
-#define bPSDFFTSamplepPoint 0xc000
-#define bPSDAverageNum 0x3000
-#define bIQPathControl 0xc00
-#define bPSDFreq 0x3ff
-#define bPSDAntennaPath 0x30
-#define bPSDIQSwitch 0x40
-#define bPSDRxTrigger 0x400000
-#define bPSDTxTrigger 0x80000000
-#define bPSDSineToneScale 0x7f000000
-#define bPSDReport 0xffff
-
-/* 3. Page9(0x900) */
-#define bOFDMTxSC 0x30000000 /* Useless */
-#define bCCKTxOn 0x1
-#define bOFDMTxOn 0x2
-#define bDebugPage 0xfff /* reset debug page and HWord, LWord */
-#define bDebugItem 0xff /* reset debug page and LWord */
-#define bAntL 0x10
-#define bAntNonHT 0x100
-#define bAntHT1 0x1000
-#define bAntHT2 0x10000
-#define bAntHT1S1 0x100000
-#define bAntNonHTS1 0x1000000
-
-/* 4. PageA(0xA00) */
-#define bCCKBBMode 0x3 /* Useless */
-#define bCCKTxPowerSaving 0x80
-#define bCCKRxPowerSaving 0x40
-
-#define bCCKSideBand 0x10 /* Reg 0xa00 rCCK0_System 20/40 switch*/
-#define bCCKScramble 0x8 /* Useless */
-#define bCCKAntDiversity 0x8000
-#define bCCKCarrierRecovery 0x4000
-#define bCCKTxRate 0x3000
-#define bCCKDCCancel 0x0800
-#define bCCKISICancel 0x0400
-#define bCCKMatchFilter 0x0200
-#define bCCKEqualizer 0x0100
-#define bCCKPreambleDetect 0x800000
-#define bCCKFastFalseCCA 0x400000
-#define bCCKChEstStart 0x300000
-#define bCCKCCACount 0x080000
-#define bCCKcs_lim 0x070000
-#define bCCKBistMode 0x80000000
-#define bCCKCCAMask 0x40000000
-#define bCCKTxDACPhase 0x4
-#define bCCKRxADCPhase 0x20000000 /* r_rx_clk */
-#define bCCKr_cp_mode0 0x0100
-#define bCCKTxDCOffset 0xf0
-#define bCCKRxDCOffset 0xf
-#define bCCKCCAMode 0xc000
-#define bCCKFalseCS_lim 0x3f00
-#define bCCKCS_ratio 0xc00000
-#define bCCKCorgBit_sel 0x300000
-#define bCCKPD_lim 0x0f0000
-#define bCCKNewCCA 0x80000000
-#define bCCKRxHPofIG 0x8000
-#define bCCKRxIG 0x7f00
-#define bCCKLNAPolarity 0x800000
-#define bCCKRx1stGain 0x7f0000
-#define bCCKRFExtend 0x20000000 /* CCK Rx initial gain polarity */
-#define bCCKRxAGCSatLevel 0x1f000000
-#define bCCKRxAGCSatCount 0xe0
-#define bCCKRxRFSettle 0x1f /* AGCsamp_dly */
-#define bCCKFixedRxAGC 0x8000
-#define bCCKAntennaPolarity 0x2000
-#define bCCKTxFilterType 0x0c00
-#define bCCKRxAGCReportType 0x0300
-#define bCCKRxDAGCEn 0x80000000
-#define bCCKRxDAGCPeriod 0x20000000
-#define bCCKRxDAGCSatLevel 0x1f000000
-#define bCCKTimingRecovery 0x800000
-#define bCCKTxC0 0x3f0000
-#define bCCKTxC1 0x3f000000
-#define bCCKTxC2 0x3f
-#define bCCKTxC3 0x3f00
-#define bCCKTxC4 0x3f0000
-#define bCCKTxC5 0x3f000000
-#define bCCKTxC6 0x3f
-#define bCCKTxC7 0x3f00
-#define bCCKDebugPort 0xff0000
-#define bCCKDACDebug 0x0f000000
-#define bCCKFalseAlarmEnable 0x8000
-#define bCCKFalseAlarmRead 0x4000
-#define bCCKTRSSI 0x7f
-#define bCCKRxAGCReport 0xfe
-#define bCCKRxReport_AntSel 0x80000000
-#define bCCKRxReport_MFOff 0x40000000
-#define bCCKRxRxReport_SQLoss 0x20000000
-#define bCCKRxReport_Pktloss 0x10000000
-#define bCCKRxReport_Lockedbit 0x08000000
-#define bCCKRxReport_RateError 0x04000000
-#define bCCKRxReport_RxRate 0x03000000
-#define bCCKRxFACounterLower 0xff
-#define bCCKRxFACounterUpper 0xff000000
-#define bCCKRxHPAGCStart 0xe000
-#define bCCKRxHPAGCFinal 0x1c00
-#define bCCKRxFalseAlarmEnable 0x8000
-#define bCCKFACounterFreeze 0x4000
-#define bCCKTxPathSel 0x10000000
-#define bCCKDefaultRxPath 0xc000000
-#define bCCKOptionRxPath 0x3000000
-
-/* 5. PageC(0xC00) */
-#define bNumOfSTF 0x3 /* Useless */
-#define bShift_L 0xc0
-#define bGI_TH 0xc
-#define bRxPathA 0x1
-#define bRxPathB 0x2
-#define bRxPathC 0x4
-#define bRxPathD 0x8
-#define bTxPathA 0x1
-#define bTxPathB 0x2
-#define bTxPathC 0x4
-#define bTxPathD 0x8
-#define bTRSSIFreq 0x200
-#define bADCBackoff 0x3000
-#define bDFIRBackoff 0xc000
-#define bTRSSILatchPhase 0x10000
-#define bRxIDCOffset 0xff
-#define bRxQDCOffset 0xff00
-#define bRxDFIRMode 0x1800000
-#define bRxDCNFType 0xe000000
-#define bRXIQImb_A 0x3ff
-#define bRXIQImb_B 0xfc00
-#define bRXIQImb_C 0x3f0000
-#define bRXIQImb_D 0xffc00000
-#define bDC_dc_Notch 0x60000
-#define bRxNBINotch 0x1f000000
-#define bPD_TH 0xf
-#define bPD_TH_Opt2 0xc000
-#define bPWED_TH 0x700
-#define bIfMF_Win_L 0x800
-#define bPD_Option 0x1000
-#define bMF_Win_L 0xe000
-#define bBW_Search_L 0x30000
-#define bwin_enh_L 0xc0000
-#define bBW_TH 0x700000
-#define bED_TH2 0x3800000
-#define bBW_option 0x4000000
-#define bRatio_TH 0x18000000
-#define bWindow_L 0xe0000000
-#define bSBD_Option 0x1
-#define bFrame_TH 0x1c
-#define bFS_Option 0x60
-#define bDC_Slope_check 0x80
-#define bFGuard_Counter_DC_L 0xe00
-#define bFrame_Weight_Short 0x7000
-#define bSub_Tune 0xe00000
-#define bFrame_DC_Length 0xe000000
-#define bSBD_start_offset 0x30000000
-#define bFrame_TH_2 0x7
-#define bFrame_GI2_TH 0x38
-#define bGI2_Sync_en 0x40
-#define bSarch_Short_Early 0x300
-#define bSarch_Short_Late 0xc00
-#define bSarch_GI2_Late 0x70000
-#define bCFOAntSum 0x1
-#define bCFOAcc 0x2
-#define bCFOStartOffset 0xc
-#define bCFOLookBack 0x70
-#define bCFOSumWeight 0x80
-#define bDAGCEnable 0x10000
-#define bTXIQImb_A 0x3ff
-#define bTXIQImb_B 0xfc00
-#define bTXIQImb_C 0x3f0000
-#define bTXIQImb_D 0xffc00000
-#define bTxIDCOffset 0xff
-#define bTxQDCOffset 0xff00
-#define bTxDFIRMode 0x10000
-#define bTxPesudoNoiseOn 0x4000000
-#define bTxPesudoNoise_A 0xff
-#define bTxPesudoNoise_B 0xff00
-#define bTxPesudoNoise_C 0xff0000
-#define bTxPesudoNoise_D 0xff000000
-#define bCCADropOption 0x20000
-#define bCCADropThres 0xfff00000
-#define bEDCCA_H 0xf
-#define bEDCCA_L 0xf0
-#define bLambda_ED 0x300
-#define bRxInitialGain 0x7f
-#define bRxAntDivEn 0x80
-#define bRxAGCAddressForLNA 0x7f00
-#define bRxHighPowerFlow 0x8000
-#define bRxAGCFreezeThres 0xc0000
-#define bRxFreezeStep_AGC1 0x300000
-#define bRxFreezeStep_AGC2 0xc00000
-#define bRxFreezeStep_AGC3 0x3000000
-#define bRxFreezeStep_AGC0 0xc000000
-#define bRxRssi_Cmp_En 0x10000000
-#define bRxQuickAGCEn 0x20000000
-#define bRxAGCFreezeThresMode 0x40000000
-#define bRxOverFlowCheckType 0x80000000
-#define bRxAGCShift 0x7f
-#define bTRSW_Tri_Only 0x80
-#define bPowerThres 0x300
-#define bRxAGCEn 0x1
-#define bRxAGCTogetherEn 0x2
-#define bRxAGCMin 0x4
-#define bRxHP_Ini 0x7
-#define bRxHP_TRLNA 0x70
-#define bRxHP_RSSI 0x700
-#define bRxHP_BBP1 0x7000
-#define bRxHP_BBP2 0x70000
-#define bRxHP_BBP3 0x700000
-#define bRSSI_H 0x7f0000 /* the threshold for high power */
-#define bRSSI_Gen 0x7f000000 /* the threshold for ant divers */
-#define bRxSettle_TRSW 0x7
-#define bRxSettle_LNA 0x38
-#define bRxSettle_RSSI 0x1c0
-#define bRxSettle_BBP 0xe00
-#define bRxSettle_RxHP 0x7000
-#define bRxSettle_AntSW_RSSI 0x38000
-#define bRxSettle_AntSW 0xc0000
-#define bRxProcessTime_DAGC 0x300000
-#define bRxSettle_HSSI 0x400000
-#define bRxProcessTime_BBPPW 0x800000
-#define bRxAntennaPowerShift 0x3000000
-#define bRSSITableSelect 0xc000000
-#define bRxHP_Final 0x7000000
-#define bRxHTSettle_BBP 0x7
-#define bRxHTSettle_HSSI 0x8
-#define bRxHTSettle_RxHP 0x70
-#define bRxHTSettle_BBPPW 0x80
-#define bRxHTSettle_Idle 0x300
-#define bRxHTSettle_Reserved 0x1c00
-#define bRxHTRxHPEn 0x8000
-#define bRxHTAGCFreezeThres 0x30000
-#define bRxHTAGCTogetherEn 0x40000
-#define bRxHTAGCMin 0x80000
-#define bRxHTAGCEn 0x100000
-#define bRxHTDAGCEn 0x200000
-#define bRxHTRxHP_BBP 0x1c00000
-#define bRxHTRxHP_Final 0xe0000000
-#define bRxPWRatioTH 0x3
-#define bRxPWRatioEn 0x4
-#define bRxMFHold 0x3800
-#define bRxPD_Delay_TH1 0x38
-#define bRxPD_Delay_TH2 0x1c0
-#define bRxPD_DC_COUNT_MAX 0x600
-#define bRxPD_Delay_TH 0x8000
-#define bRxProcess_Delay 0xf0000
-#define bRxSearchrange_GI2_Early 0x700000
-#define bRxFrame_Guard_Counter_L 0x3800000
-#define bRxSGI_Guard_L 0xc000000
-#define bRxSGI_Search_L 0x30000000
-#define bRxSGI_TH 0xc0000000
-#define bDFSCnt0 0xff
-#define bDFSCnt1 0xff00
-#define bDFSFlag 0xf0000
-#define bMFWeightSum 0x300000
-#define bMinIdxTH 0x7f000000
-#define bDAFormat 0x40000
-#define bTxChEmuEnable 0x01000000
-#define bTRSWIsolation_A 0x7f
-#define bTRSWIsolation_B 0x7f00
-#define bTRSWIsolation_C 0x7f0000
-#define bTRSWIsolation_D 0x7f000000
-#define bExtLNAGain 0x7c00
-
-/* 6. PageE(0xE00) */
-#define bSTBCEn 0x4 /* Useless */
-#define bAntennaMapping 0x10
-#define bNss 0x20
-#define bCFOAntSumD 0x200
-#define bPHYCounterReset 0x8000000
-#define bCFOReportGet 0x4000000
-#define bOFDMContinueTx 0x10000000
-#define bOFDMSingleCarrier 0x20000000
-#define bOFDMSingleTone 0x40000000
-#define bHTDetect 0x100
-#define bCFOEn 0x10000
-#define bCFOValue 0xfff00000
-#define bSigTone_Re 0x3f
-#define bSigTone_Im 0x7f00
-#define bCounter_CCA 0xffff
-#define bCounter_ParityFail 0xffff0000
-#define bCounter_RateIllegal 0xffff
-#define bCounter_CRC8Fail 0xffff0000
-#define bCounter_MCSNoSupport 0xffff
-#define bCounter_FastSync 0xffff
-#define bShortCFO 0xfff
-#define bShortCFOTLength 12 /* total */
-#define bShortCFOFLength 11 /* fraction */
-#define bLongCFO 0x7ff
-#define bLongCFOTLength 11
-#define bLongCFOFLength 11
-#define bTailCFO 0x1fff
-#define bTailCFOTLength 13
-#define bTailCFOFLength 12
-#define bmax_en_pwdB 0xffff
-#define bCC_power_dB 0xffff0000
-#define bnoise_pwdB 0xffff
-#define bPowerMeasTLength 10
-#define bPowerMeasFLength 3
-#define bRx_HT_BW 0x1
-#define bRxSC 0x6
-#define bRx_HT 0x8
-#define bNB_intf_det_on 0x1
-#define bIntf_win_len_cfg 0x30
-#define bNB_Intf_TH_cfg 0x1c0
-#define bRFGain 0x3f
-#define bTableSel 0x40
-#define bTRSW 0x80
-#define bRxSNR_A 0xff
-#define bRxSNR_B 0xff00
-#define bRxSNR_C 0xff0000
-#define bRxSNR_D 0xff000000
-#define bSNREVMTLength 8
-#define bSNREVMFLength 1
-#define bCSI1st 0xff
-#define bCSI2nd 0xff00
-#define bRxEVM1st 0xff0000
-#define bRxEVM2nd 0xff000000
-#define bSIGEVM 0xff
-#define bPWDB 0xff00
-#define bSGIEN 0x10000
-
-#define bSFactorQAM1 0xf /* Useless */
-#define bSFactorQAM2 0xf0
-#define bSFactorQAM3 0xf00
-#define bSFactorQAM4 0xf000
-#define bSFactorQAM5 0xf0000
-#define bSFactorQAM6 0xf0000
-#define bSFactorQAM7 0xf00000
-#define bSFactorQAM8 0xf000000
-#define bSFactorQAM9 0xf0000000
-#define bCSIScheme 0x100000
-
-#define bNoiseLvlTopSet 0x3 /* Useless */
-#define bChSmooth 0x4
-#define bChSmoothCfg1 0x38
-#define bChSmoothCfg2 0x1c0
-#define bChSmoothCfg3 0xe00
-#define bChSmoothCfg4 0x7000
-#define bMRCMode 0x800000
-#define bTHEVMCfg 0x7000000
-
-#define bLoopFitType 0x1 /* Useless */
-#define bUpdCFO 0x40
-#define bUpdCFOOffData 0x80
-#define bAdvUpdCFO 0x100
-#define bAdvTimeCtrl 0x800
-#define bUpdClko 0x1000
-#define bFC 0x6000
-#define bTrackingMode 0x8000
-#define bPhCmpEnable 0x10000
-#define bUpdClkoLTF 0x20000
-#define bComChCFO 0x40000
-#define bCSIEstiMode 0x80000
-#define bAdvUpdEqz 0x100000
-#define bUChCfg 0x7000000
-#define bUpdEqz 0x8000000
-
-#define bTxAGCRate18_06 0x7f7f7f7f /* Useless */
-#define bTxAGCRate54_24 0x7f7f7f7f
-#define bTxAGCRateMCS32 0x7f
-#define bTxAGCRateCCK 0x7f00
-#define bTxAGCRateMCS3_MCS0 0x7f7f7f7f
-#define bTxAGCRateMCS7_MCS4 0x7f7f7f7f
-#define bTxAGCRateMCS11_MCS8 0x7f7f7f7f
-#define bTxAGCRateMCS15_MCS12 0x7f7f7f7f
-
-/* Rx Pseduo noise */
-#define bRxPesudoNoiseOn 0x20000000 /* Useless */
-#define bRxPesudoNoise_A 0xff
-#define bRxPesudoNoise_B 0xff00
-#define bRxPesudoNoise_C 0xff0000
-#define bRxPesudoNoise_D 0xff000000
-#define bPesudoNoiseState_A 0xffff
-#define bPesudoNoiseState_B 0xffff0000
-#define bPesudoNoiseState_C 0xffff
-#define bPesudoNoiseState_D 0xffff0000
-
-/* 7. RF Register
- * Zebra1
- */
-#define bZebra1_HSSIEnable 0x8 /* Useless */
-#define bZebra1_TRxControl 0xc00
-#define bZebra1_TRxGainSetting 0x07f
-#define bZebra1_RxCorner 0xc00
-#define bZebra1_TxChargePump 0x38
-#define bZebra1_RxChargePump 0x7
-#define bZebra1_ChannelNum 0xf80
-#define bZebra1_TxLPFBW 0x400
-#define bZebra1_RxLPFBW 0x600
-
-/*Zebra4 */
-#define bRTL8256RegModeCtrl1 0x100 /* Useless */
-#define bRTL8256RegModeCtrl0 0x40
-#define bRTL8256_TxLPFBW 0x18
-#define bRTL8256_RxLPFBW 0x600
-
-/* RTL8258 */
-#define bRTL8258_TxLPFBW 0xc /* Useless */
-#define bRTL8258_RxLPFBW 0xc00
-#define bRTL8258_RSSILPFBW 0xc0
-
-/*
- * Other Definition
- */
-
-/* byte endable for sb_write */
-#define bByte0 0x1 /* Useless */
-#define bByte1 0x2
-#define bByte2 0x4
-#define bByte3 0x8
-#define bWord0 0x3
-#define bWord1 0xc
-#define bDWord 0xf
-
-/* for PutRegsetting & GetRegSetting BitMask */
-#define bMaskByte0 0xff /* Reg 0xc50 rOFDM0_XAAGCCore~0xC6f */
-#define bMaskByte1 0xff00
-#define bMaskByte2 0xff0000
-#define bMaskByte3 0xff000000
-#define bMaskHWord 0xffff0000
-#define bMaskLWord 0x0000ffff
-#define bMaskDWord 0xffffffff
-
-/* for PutRFRegsetting & GetRFRegSetting BitMask */
-#define bRFRegOffsetMask 0xfffff
-#define bEnable 0x1 /* Useless */
-#define bDisable 0x0
-
-#define LeftAntenna 0x0 /* Useless */
-#define RightAntenna 0x1
-
-#define tCheckTxStatus 500 /* 500ms Useless */
-#define tUpdateRxCounter 100 /* 100ms */
-
-#define rateCCK 0 /* Useless */
-#define rateOFDM 1
-#define rateHT 2
-
-/* define Register-End */
-#define bPMAC_End 0x1ff /* Useless */
-#define bFPGAPHY0_End 0x8ff
-#define bFPGAPHY1_End 0x9ff
-#define bCCKPHY0_End 0xaff
-#define bOFDMPHY0_End 0xcff
-#define bOFDMPHY1_End 0xdff
-
-#define bPMACControl 0x0 /* Useless */
-#define bWMACControl 0x1
-#define bWNICControl 0x2
-
-#define ANTENNA_A 0x1 /* Useless */
-#define ANTENNA_B 0x2
-#define ANTENNA_AB 0x3 /* ANTENNA_A |ANTENNA_B */
-
-#define ANTENNA_C 0x4
-#define ANTENNA_D 0x8
-
-/* accept all physical address */
-#define RCR_AAP BIT(0)
-#define RCR_APM BIT(1) /* accept physical match */
-#define RCR_AM BIT(2) /* accept multicast */
-#define RCR_AB BIT(3) /* accept broadcast */
-#define RCR_ACRC32 BIT(5) /* accept error packet */
-#define RCR_9356SEL BIT(6)
-#define RCR_AICV BIT(12) /* Accept ICV error packet */
-#define RCR_RXFTH0 (BIT(13)|BIT(14)|BIT(15)) /* Rx FIFO threshold */
-#define RCR_ADF BIT(18) /* Accept Data(frame type) frame */
-#define RCR_ACF BIT(19) /* Accept control frame */
-#define RCR_AMF BIT(20) /* Accept management frame */
-#define RCR_ADD3 BIT(21)
-#define RCR_APWRMGT BIT(22) /* Accept power management packet */
-#define RCR_CBSSID BIT(23) /* Accept BSSID match packet */
-#define RCR_ENMARP BIT(28) /* enable mac auto reset phy */
-#define RCR_EnCS1 BIT(29) /* enable carrier sense method 1 */
-#define RCR_EnCS2 BIT(30) /* enable carrier sense method 2 */
-/* Rx Early mode is performed for packet size greater than 1536 */
-#define RCR_OnlyErlPkt BIT(31)
-
-/*--------------------------Define Parameters-------------------------------*/
-
-#endif /*__INC_HAL8192SPHYREG_H */
-
--- a/drivers/staging/rtl8712/rtl871x_pwrctrl.c
+++ /dev/null
@@ -1,234 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_pwrctrl.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL871X_PWRCTRL_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "osdep_intf.h"
-
-#define RTL8712_SDIO_LOCAL_BASE 0X10100000
-#define SDIO_HCPWM (RTL8712_SDIO_LOCAL_BASE + 0x0081)
-
-void r8712_set_rpwm(struct _adapter *padapter, u8 val8)
-{
- u8 rpwm;
- struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
-
- if (pwrpriv->rpwm == val8) {
- if (pwrpriv->rpwm_retry == 0)
- return;
- }
- if (padapter->driver_stopped || padapter->surprise_removed)
- return;
- rpwm = val8 | pwrpriv->tog;
- switch (val8) {
- case PS_STATE_S1:
- pwrpriv->cpwm = val8;
- break;
- case PS_STATE_S2:/* only for USB normal powersave mode use,
- * temp mark some code.
- */
- case PS_STATE_S3:
- case PS_STATE_S4:
- pwrpriv->cpwm = val8;
- break;
- default:
- break;
- }
- pwrpriv->rpwm_retry = 0;
- pwrpriv->rpwm = val8;
- r8712_write8(padapter, 0x1025FE58, rpwm);
- pwrpriv->tog += 0x80;
-}
-
-void r8712_set_ps_mode(struct _adapter *padapter, uint ps_mode, uint smart_ps)
-{
- struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
-
- if (ps_mode > PM_Card_Disable)
- return;
- /* if driver is in active state, we dont need set smart_ps.*/
- if (ps_mode == PS_MODE_ACTIVE)
- smart_ps = 0;
- if ((pwrpriv->pwr_mode != ps_mode) || (pwrpriv->smart_ps != smart_ps)) {
- if (pwrpriv->pwr_mode == PS_MODE_ACTIVE)
- pwrpriv->bSleep = true;
- else
- pwrpriv->bSleep = false;
- pwrpriv->pwr_mode = ps_mode;
- pwrpriv->smart_ps = smart_ps;
- schedule_work(&pwrpriv->SetPSModeWorkItem);
- }
-}
-
-/*
- * Caller:ISR handler...
- *
- * This will be called when CPWM interrupt is up.
- *
- * using to update cpwn of drv; and drv will make a decision to up or
- * down pwr level
- */
-void r8712_cpwm_int_hdl(struct _adapter *padapter,
- struct reportpwrstate_parm *preportpwrstate)
-{
- struct pwrctrl_priv *pwrpriv = &(padapter->pwrctrlpriv);
- struct cmd_priv *pcmdpriv = &(padapter->cmdpriv);
-
- if (pwrpriv->cpwm_tog == ((preportpwrstate->state) & 0x80))
- return;
- del_timer(&padapter->pwrctrlpriv.rpwm_check_timer);
- mutex_lock(&pwrpriv->mutex_lock);
- pwrpriv->cpwm = (preportpwrstate->state) & 0xf;
- if (pwrpriv->cpwm >= PS_STATE_S2) {
- if (pwrpriv->alives & CMD_ALIVE)
- complete(&(pcmdpriv->cmd_queue_comp));
- }
- pwrpriv->cpwm_tog = (preportpwrstate->state) & 0x80;
- mutex_unlock(&pwrpriv->mutex_lock);
-}
-
-static inline void register_task_alive(struct pwrctrl_priv *pwrctrl, uint tag)
-{
- pwrctrl->alives |= tag;
-}
-
-static inline void unregister_task_alive(struct pwrctrl_priv *pwrctrl, uint tag)
-{
- if (pwrctrl->alives & tag)
- pwrctrl->alives ^= tag;
-}
-
-static void _rpwm_check_handler (struct _adapter *padapter)
-{
- struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
-
- if (padapter->driver_stopped || padapter->surprise_removed)
- return;
- if (pwrpriv->cpwm != pwrpriv->rpwm)
- schedule_work(&pwrpriv->rpwm_workitem);
-}
-
-static void SetPSModeWorkItemCallback(struct work_struct *work)
-{
- struct pwrctrl_priv *pwrpriv = container_of(work,
- struct pwrctrl_priv, SetPSModeWorkItem);
- struct _adapter *padapter = container_of(pwrpriv,
- struct _adapter, pwrctrlpriv);
- if (!pwrpriv->bSleep) {
- mutex_lock(&pwrpriv->mutex_lock);
- if (pwrpriv->pwr_mode == PS_MODE_ACTIVE)
- r8712_set_rpwm(padapter, PS_STATE_S4);
- mutex_unlock(&pwrpriv->mutex_lock);
- }
-}
-
-static void rpwm_workitem_callback(struct work_struct *work)
-{
- struct pwrctrl_priv *pwrpriv = container_of(work,
- struct pwrctrl_priv, rpwm_workitem);
- struct _adapter *padapter = container_of(pwrpriv,
- struct _adapter, pwrctrlpriv);
- if (pwrpriv->cpwm != pwrpriv->rpwm) {
- mutex_lock(&pwrpriv->mutex_lock);
- r8712_read8(padapter, SDIO_HCPWM);
- pwrpriv->rpwm_retry = 1;
- r8712_set_rpwm(padapter, pwrpriv->rpwm);
- mutex_unlock(&pwrpriv->mutex_lock);
- }
-}
-
-static void rpwm_check_handler (struct timer_list *t)
-{
- struct _adapter *adapter =
- from_timer(adapter, t, pwrctrlpriv.rpwm_check_timer);
-
- _rpwm_check_handler(adapter);
-}
-
-void r8712_init_pwrctrl_priv(struct _adapter *padapter)
-{
- struct pwrctrl_priv *pwrctrlpriv = &padapter->pwrctrlpriv;
-
- memset((unsigned char *)pwrctrlpriv, 0, sizeof(struct pwrctrl_priv));
- mutex_init(&pwrctrlpriv->mutex_lock);
- pwrctrlpriv->cpwm = PS_STATE_S4;
- pwrctrlpriv->pwr_mode = PS_MODE_ACTIVE;
- pwrctrlpriv->smart_ps = 0;
- pwrctrlpriv->tog = 0x80;
-/* clear RPWM to ensure driver and fw back to initial state. */
- r8712_write8(padapter, 0x1025FE58, 0);
- INIT_WORK(&pwrctrlpriv->SetPSModeWorkItem, SetPSModeWorkItemCallback);
- INIT_WORK(&pwrctrlpriv->rpwm_workitem, rpwm_workitem_callback);
- timer_setup(&pwrctrlpriv->rpwm_check_timer, rpwm_check_handler, 0);
-}
-
-/*
- * Caller: r8712_cmd_thread
- * Check if the fw_pwrstate is okay for issuing cmd.
- * If not (cpwm should be is less than P2 state), then the sub-routine
- * will raise the cpwm to be greater than or equal to P2.
- * Calling Context: Passive
- * Return Value:
- * 0: r8712_cmd_thread can issue cmds to firmware afterwards.
- * -EINVAL: r8712_cmd_thread can not do anything.
- */
-int r8712_register_cmd_alive(struct _adapter *padapter)
-{
- int res = 0;
- struct pwrctrl_priv *pwrctrl = &padapter->pwrctrlpriv;
-
- mutex_lock(&pwrctrl->mutex_lock);
- register_task_alive(pwrctrl, CMD_ALIVE);
- if (pwrctrl->cpwm < PS_STATE_S2) {
- r8712_set_rpwm(padapter, PS_STATE_S3);
- res = -EINVAL;
- }
- mutex_unlock(&pwrctrl->mutex_lock);
- return res;
-}
-
-/*
- * Caller: ISR
- * If ISR's txdone,
- * No more pkts for TX,
- * Then driver shall call this fun. to power down firmware again.
- */
-void r8712_unregister_cmd_alive(struct _adapter *padapter)
-{
- struct pwrctrl_priv *pwrctrl = &padapter->pwrctrlpriv;
-
- mutex_lock(&pwrctrl->mutex_lock);
- unregister_task_alive(pwrctrl, CMD_ALIVE);
- if ((pwrctrl->cpwm > PS_STATE_S2) &&
- (pwrctrl->pwr_mode > PS_MODE_ACTIVE)) {
- if ((pwrctrl->alives == 0) &&
- (check_fwstate(&padapter->mlmepriv,
- _FW_UNDER_LINKING) != true)) {
- r8712_set_rpwm(padapter, PS_STATE_S0);
- }
- }
- mutex_unlock(&pwrctrl->mutex_lock);
-}
-
-void r8712_flush_rwctrl_works(struct _adapter *padapter)
-{
- struct pwrctrl_priv *pwrctrl = &padapter->pwrctrlpriv;
-
- flush_work(&pwrctrl->SetPSModeWorkItem);
- flush_work(&pwrctrl->rpwm_workitem);
-}
--- a/drivers/staging/rtl8712/rtl871x_pwrctrl.h
+++ /dev/null
@@ -1,113 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL871X_PWRCTRL_H_
-#define __RTL871X_PWRCTRL_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-#define CMD_ALIVE BIT(2)
-
-enum Power_Mgnt {
- PS_MODE_ACTIVE = 0,
- PS_MODE_MIN,
- PS_MODE_MAX,
- PS_MODE_DTIM,
- PS_MODE_VOIP,
- PS_MODE_UAPSD_WMM,
- PS_MODE_UAPSD,
- PS_MODE_IBSS,
- PS_MODE_WWLAN,
- PM_Radio_Off,
- PM_Card_Disable,
- PS_MODE_NUM
-};
-
-/*
- * BIT[2:0] = HW state
- * BIT[3] = Protocol PS state, 0: register active state,
- * 1: register sleep state
- * BIT[4] = sub-state
- */
-
-#define PS_DPS BIT(0)
-#define PS_LCLK (PS_DPS)
-#define PS_RF_OFF BIT(1)
-#define PS_ALL_ON BIT(2)
-#define PS_ST_ACTIVE BIT(3)
-#define PS_LP BIT(4) /* low performance */
-
-#define PS_STATE_MASK (0x0F)
-#define PS_STATE_HW_MASK (0x07)
-#define PS_SEQ_MASK (0xc0)
-
-#define PS_STATE(x) (PS_STATE_MASK & (x))
-#define PS_STATE_HW(x) (PS_STATE_HW_MASK & (x))
-#define PS_SEQ(x) (PS_SEQ_MASK & (x))
-
-#define PS_STATE_S0 (PS_DPS)
-#define PS_STATE_S1 (PS_LCLK)
-#define PS_STATE_S2 (PS_RF_OFF)
-#define PS_STATE_S3 (PS_ALL_ON)
-#define PS_STATE_S4 ((PS_ST_ACTIVE) | (PS_ALL_ON))
-
-#define PS_IS_RF_ON(x) ((x) & (PS_ALL_ON))
-#define PS_IS_ACTIVE(x) ((x) & (PS_ST_ACTIVE))
-#define CLR_PS_STATE(x) ((x) = ((x) & (0xF0)))
-
-struct reportpwrstate_parm {
- unsigned char mode;
- unsigned char state; /* the CPWM value */
- unsigned short rsvd;
-};
-
-struct pwrctrl_priv {
- struct mutex mutex_lock;
- /*volatile*/ u8 rpwm; /* requested power state for fw */
- /* fw current power state. updated when 1. read from HCPWM or
- * 2. driver lowers power level
- */
- /*volatile*/ u8 cpwm;
- /*volatile*/ u8 tog; /* toggling */
- /*volatile*/ u8 cpwm_tog; /* toggling */
- /*volatile*/ u8 tgt_rpwm; /* wanted power state */
- uint pwr_mode;
- uint smart_ps;
- uint alives;
- uint ImrContent; /* used to store original imr. */
- uint bSleep; /* sleep -> active is different from active -> sleep. */
-
- struct work_struct SetPSModeWorkItem;
- struct work_struct rpwm_workitem;
- struct timer_list rpwm_check_timer;
- u8 rpwm_retry;
- uint bSetPSModeWorkItemInProgress;
-
- spinlock_t pnp_pwr_mgnt_lock;
- s32 pnp_current_pwr_state;
- u8 pnp_bstop_trx;
- u8 pnp_wwirp_pending;
-};
-
-void r8712_init_pwrctrl_priv(struct _adapter *adapter);
-int r8712_register_cmd_alive(struct _adapter *padapter);
-void r8712_unregister_cmd_alive(struct _adapter *padapter);
-void r8712_cpwm_int_hdl(struct _adapter *padapter,
- struct reportpwrstate_parm *preportpwrstate);
-void r8712_set_ps_mode(struct _adapter *padapter, uint ps_mode,
- uint smart_ps);
-void r8712_set_rpwm(struct _adapter *padapter, u8 val8);
-void r8712_flush_rwctrl_works(struct _adapter *padapter);
-
-#endif /* __RTL871X_PWRCTRL_H_ */
--- a/drivers/staging/rtl8712/rtl871x_recv.c
+++ /dev/null
@@ -1,669 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_recv.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL871X_RECV_C_
-
-#include <linux/ip.h>
-#include <linux/slab.h>
-#include <linux/if_ether.h>
-#include <linux/kmemleak.h>
-#include <linux/etherdevice.h>
-#include <linux/ieee80211.h>
-#include <net/cfg80211.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "recv_osdep.h"
-#include "mlme_osdep.h"
-#include "ethernet.h"
-#include "usb_ops.h"
-#include "wifi.h"
-
-static const u8 SNAP_ETH_TYPE_IPX[2] = {0x81, 0x37};
-
-/* Datagram Delivery Protocol */
-static const u8 SNAP_ETH_TYPE_APPLETALK_AARP[2] = {0x80, 0xf3};
-
-void _r8712_init_sta_recv_priv(struct sta_recv_priv *psta_recvpriv)
-{
- memset((u8 *)psta_recvpriv, 0, sizeof(struct sta_recv_priv));
- spin_lock_init(&psta_recvpriv->lock);
- _init_queue(&psta_recvpriv->defrag_q);
-}
-
-void _r8712_init_recv_priv(struct recv_priv *precvpriv,
- struct _adapter *padapter)
-{
- sint i;
- union recv_frame *precvframe;
-
- memset((unsigned char *)precvpriv, 0, sizeof(struct recv_priv));
- spin_lock_init(&precvpriv->lock);
- _init_queue(&precvpriv->free_recv_queue);
- _init_queue(&precvpriv->recv_pending_queue);
- precvpriv->adapter = padapter;
- precvpriv->free_recvframe_cnt = NR_RECVFRAME;
- precvpriv->pallocated_frame_buf = kzalloc(NR_RECVFRAME *
- sizeof(union recv_frame) + RXFRAME_ALIGN_SZ,
- GFP_ATOMIC);
- if (!precvpriv->pallocated_frame_buf)
- return;
- kmemleak_not_leak(precvpriv->pallocated_frame_buf);
- precvpriv->precv_frame_buf = precvpriv->pallocated_frame_buf +
- RXFRAME_ALIGN_SZ -
- ((addr_t)(precvpriv->pallocated_frame_buf) &
- (RXFRAME_ALIGN_SZ - 1));
- precvframe = (union recv_frame *)precvpriv->precv_frame_buf;
- for (i = 0; i < NR_RECVFRAME; i++) {
- INIT_LIST_HEAD(&(precvframe->u.list));
- list_add_tail(&(precvframe->u.list),
- &(precvpriv->free_recv_queue.queue));
- r8712_os_recv_resource_alloc(padapter, precvframe);
- precvframe->u.hdr.adapter = padapter;
- precvframe++;
- }
- precvpriv->rx_pending_cnt = 1;
- r8712_init_recv_priv(precvpriv, padapter);
-}
-
-void _r8712_free_recv_priv(struct recv_priv *precvpriv)
-{
- kfree(precvpriv->pallocated_frame_buf);
- r8712_free_recv_priv(precvpriv);
-}
-
-union recv_frame *r8712_alloc_recvframe(struct __queue *pfree_recv_queue)
-{
- unsigned long irqL;
- union recv_frame *precvframe;
- struct _adapter *padapter;
- struct recv_priv *precvpriv;
-
- spin_lock_irqsave(&pfree_recv_queue->lock, irqL);
- precvframe = list_first_entry_or_null(&pfree_recv_queue->queue,
- union recv_frame, u.hdr.list);
- if (precvframe) {
- list_del_init(&precvframe->u.hdr.list);
- padapter = precvframe->u.hdr.adapter;
- if (padapter) {
- precvpriv = &padapter->recvpriv;
- if (pfree_recv_queue == &precvpriv->free_recv_queue)
- precvpriv->free_recvframe_cnt--;
- }
- }
- spin_unlock_irqrestore(&pfree_recv_queue->lock, irqL);
- return precvframe;
-}
-
-/*
- * caller : defrag; recvframe_chk_defrag in recv_thread (passive)
- * pframequeue: defrag_queue : will be accessed in recv_thread (passive)
- * using spin_lock to protect
- */
-void r8712_free_recvframe_queue(struct __queue *pframequeue,
- struct __queue *pfree_recv_queue)
-{
- union recv_frame *precvframe;
- struct list_head *plist, *phead;
-
- spin_lock(&pframequeue->lock);
- phead = &pframequeue->queue;
- plist = phead->next;
- while (!end_of_queue_search(phead, plist)) {
- precvframe = container_of(plist, union recv_frame, u.list);
- plist = plist->next;
- r8712_free_recvframe(precvframe, pfree_recv_queue);
- }
- spin_unlock(&pframequeue->lock);
-}
-
-sint r8712_recvframe_chkmic(struct _adapter *adapter,
- union recv_frame *precvframe)
-{
- sint i, res = _SUCCESS;
- u32 datalen;
- u8 miccode[8];
- u8 bmic_err = false;
- u8 *pframe, *payload, *pframemic;
- u8 *mickey, idx, *iv;
- struct sta_info *stainfo;
- struct rx_pkt_attrib *prxattrib = &precvframe->u.hdr.attrib;
- struct security_priv *psecuritypriv = &adapter->securitypriv;
-
- stainfo = r8712_get_stainfo(&adapter->stapriv, &prxattrib->ta[0]);
- if (prxattrib->encrypt == _TKIP_) {
- /* calculate mic code */
- if (stainfo) {
- if (is_multicast_ether_addr(prxattrib->ra)) {
- iv = precvframe->u.hdr.rx_data +
- prxattrib->hdrlen;
- idx = iv[3];
- mickey = &psecuritypriv->XGrprxmickey[(((idx >>
- 6) & 0x3)) - 1].skey[0];
- if (!psecuritypriv->binstallGrpkey)
- return _FAIL;
- } else {
- mickey = &stainfo->tkiprxmickey.skey[0];
- }
- /*icv_len included the mic code*/
- datalen = precvframe->u.hdr.len - prxattrib->hdrlen -
- prxattrib->iv_len - prxattrib->icv_len - 8;
- pframe = precvframe->u.hdr.rx_data;
- payload = pframe + prxattrib->hdrlen +
- prxattrib->iv_len;
- seccalctkipmic(mickey, pframe, payload, datalen,
- &miccode[0],
- (unsigned char)prxattrib->priority);
- pframemic = payload + datalen;
- bmic_err = false;
- for (i = 0; i < 8; i++) {
- if (miccode[i] != *(pframemic + i))
- bmic_err = true;
- }
- if (bmic_err) {
- if (prxattrib->bdecrypted)
- r8712_handle_tkip_mic_err(adapter,
- (u8)is_multicast_ether_addr(prxattrib->ra));
- res = _FAIL;
- } else {
- /* mic checked ok */
- if (!psecuritypriv->bcheck_grpkey &&
- is_multicast_ether_addr(prxattrib->ra))
- psecuritypriv->bcheck_grpkey = true;
- }
- recvframe_pull_tail(precvframe, 8);
- }
- }
- return res;
-}
-
-/* decrypt and set the ivlen,icvlen of the recv_frame */
-union recv_frame *r8712_decryptor(struct _adapter *padapter,
- union recv_frame *precv_frame)
-{
- struct rx_pkt_attrib *prxattrib = &precv_frame->u.hdr.attrib;
- struct security_priv *psecuritypriv = &padapter->securitypriv;
- union recv_frame *return_packet = precv_frame;
-
- if ((prxattrib->encrypt > 0) && ((prxattrib->bdecrypted == 0) ||
- psecuritypriv->sw_decrypt)) {
- psecuritypriv->hw_decrypted = false;
- switch (prxattrib->encrypt) {
- case _WEP40_:
- case _WEP104_:
- r8712_wep_decrypt(padapter, (u8 *)precv_frame);
- break;
- case _TKIP_:
- r8712_tkip_decrypt(padapter, (u8 *)precv_frame);
- break;
- case _AES_:
- r8712_aes_decrypt(padapter, (u8 *)precv_frame);
- break;
- default:
- break;
- }
- } else if (prxattrib->bdecrypted == 1) {
- psecuritypriv->hw_decrypted = true;
- }
- return return_packet;
-}
-
-/*###set the security information in the recv_frame */
-union recv_frame *r8712_portctrl(struct _adapter *adapter,
- union recv_frame *precv_frame)
-{
- u8 *psta_addr, *ptr;
- uint auth_alg;
- struct recv_frame_hdr *pfhdr;
- struct sta_info *psta;
- struct sta_priv *pstapriv;
- union recv_frame *prtnframe;
- u16 ether_type;
-
- pstapriv = &adapter->stapriv;
- ptr = precv_frame->u.hdr.rx_data;
- pfhdr = &precv_frame->u.hdr;
- psta_addr = pfhdr->attrib.ta;
- psta = r8712_get_stainfo(pstapriv, psta_addr);
- auth_alg = adapter->securitypriv.AuthAlgrthm;
- if (auth_alg == 2) {
- /* get ether_type */
- ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE;
- ether_type = get_unaligned_be16(ptr);
-
- if (psta && psta->ieee8021x_blocked) {
- /* blocked
- * only accept EAPOL frame
- */
- if (ether_type == 0x888e) {
- prtnframe = precv_frame;
- } else {
- /*free this frame*/
- r8712_free_recvframe(precv_frame,
- &adapter->recvpriv.free_recv_queue);
- prtnframe = NULL;
- }
- } else {
- /* allowed
- * check decryption status, and decrypt the
- * frame if needed
- */
- prtnframe = precv_frame;
- /* check is the EAPOL frame or not (Rekey) */
- if (ether_type == 0x888e) {
- /* check Rekey */
- prtnframe = precv_frame;
- }
- }
- } else {
- prtnframe = precv_frame;
- }
- return prtnframe;
-}
-
-static sint recv_decache(union recv_frame *precv_frame, u8 bretry,
- struct stainfo_rxcache *prxcache)
-{
- sint tid = precv_frame->u.hdr.attrib.priority;
- u16 seq_ctrl = ((precv_frame->u.hdr.attrib.seq_num & 0xffff) << 4) |
- (precv_frame->u.hdr.attrib.frag_num & 0xf);
-
- if (tid > 15)
- return _FAIL;
- if (seq_ctrl == prxcache->tid_rxseq[tid])
- return _FAIL;
- prxcache->tid_rxseq[tid] = seq_ctrl;
- return _SUCCESS;
-}
-
-static sint sta2sta_data_frame(struct _adapter *adapter,
- union recv_frame *precv_frame,
- struct sta_info **psta)
-{
- u8 *ptr = precv_frame->u.hdr.rx_data;
- sint ret = _SUCCESS;
- struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
- struct sta_priv *pstapriv = &adapter->stapriv;
- struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
- u8 *mybssid = get_bssid(pmlmepriv);
- u8 *myhwaddr = myid(&adapter->eeprompriv);
- u8 *sta_addr = NULL;
- bool bmcast = is_multicast_ether_addr(pattrib->dst);
-
- if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) ||
- check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) {
- /* filter packets that SA is myself or multicast or broadcast */
- if (!memcmp(myhwaddr, pattrib->src, ETH_ALEN))
- return _FAIL;
- if ((memcmp(myhwaddr, pattrib->dst, ETH_ALEN)) && (!bmcast))
- return _FAIL;
- if (is_zero_ether_addr(pattrib->bssid) ||
- is_zero_ether_addr(mybssid) ||
- (memcmp(pattrib->bssid, mybssid, ETH_ALEN)))
- return _FAIL;
- sta_addr = pattrib->src;
- } else if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) {
- /* For Station mode, sa and bssid should always be BSSID,
- * and DA is my mac-address
- */
- if (memcmp(pattrib->bssid, pattrib->src, ETH_ALEN))
- return _FAIL;
- sta_addr = pattrib->bssid;
- } else if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
- if (bmcast) {
- /* For AP mode, if DA == MCAST, then BSSID should
- * be also MCAST
- */
- if (!is_multicast_ether_addr(pattrib->bssid))
- return _FAIL;
- } else { /* not mc-frame */
- /* For AP mode, if DA is non-MCAST, then it must be
- * BSSID, and bssid == BSSID
- */
- if (memcmp(pattrib->bssid, pattrib->dst, ETH_ALEN))
- return _FAIL;
- sta_addr = pattrib->src;
- }
- } else if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) {
- memcpy(pattrib->dst, GetAddr1Ptr(ptr), ETH_ALEN);
- memcpy(pattrib->src, GetAddr2Ptr(ptr), ETH_ALEN);
- memcpy(pattrib->bssid, GetAddr3Ptr(ptr), ETH_ALEN);
- memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
- memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
- sta_addr = mybssid;
- } else {
- ret = _FAIL;
- }
- if (bmcast)
- *psta = r8712_get_bcmc_stainfo(adapter);
- else
- *psta = r8712_get_stainfo(pstapriv, sta_addr); /* get ap_info */
- if (!*psta) {
- if (check_fwstate(pmlmepriv, WIFI_MP_STATE))
- adapter->mppriv.rx_pktloss++;
- return _FAIL;
- }
- return ret;
-}
-
-static sint ap2sta_data_frame(struct _adapter *adapter,
- union recv_frame *precv_frame,
- struct sta_info **psta)
-{
- u8 *ptr = precv_frame->u.hdr.rx_data;
- struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
- struct sta_priv *pstapriv = &adapter->stapriv;
- struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
- u8 *mybssid = get_bssid(pmlmepriv);
- u8 *myhwaddr = myid(&adapter->eeprompriv);
- bool bmcast = is_multicast_ether_addr(pattrib->dst);
-
- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE) &&
- check_fwstate(pmlmepriv, _FW_LINKED)) {
- /* if NULL-frame, drop packet */
- if ((GetFrameSubType(ptr)) == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC))
- return _FAIL;
- /* drop QoS-SubType Data, including QoS NULL,
- * excluding QoS-Data
- */
- if ((GetFrameSubType(ptr) & WIFI_QOS_DATA_TYPE) ==
- WIFI_QOS_DATA_TYPE) {
- if (GetFrameSubType(ptr) & (BIT(4) | BIT(5) | BIT(6)))
- return _FAIL;
- }
-
- /* filter packets that SA is myself or multicast or broadcast */
- if (!memcmp(myhwaddr, pattrib->src, ETH_ALEN))
- return _FAIL;
-
- /* da should be for me */
- if ((memcmp(myhwaddr, pattrib->dst, ETH_ALEN)) && (!bmcast))
- return _FAIL;
- /* check BSSID */
- if (is_zero_ether_addr(pattrib->bssid) ||
- is_zero_ether_addr(mybssid) ||
- (memcmp(pattrib->bssid, mybssid, ETH_ALEN)))
- return _FAIL;
- if (bmcast)
- *psta = r8712_get_bcmc_stainfo(adapter);
- else
- *psta = r8712_get_stainfo(pstapriv, pattrib->bssid);
- if (!*psta)
- return _FAIL;
- } else if (check_fwstate(pmlmepriv, WIFI_MP_STATE) &&
- check_fwstate(pmlmepriv, _FW_LINKED)) {
- memcpy(pattrib->dst, GetAddr1Ptr(ptr), ETH_ALEN);
- memcpy(pattrib->src, GetAddr2Ptr(ptr), ETH_ALEN);
- memcpy(pattrib->bssid, GetAddr3Ptr(ptr), ETH_ALEN);
- memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
- memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
- memcpy(pattrib->bssid, mybssid, ETH_ALEN);
- *psta = r8712_get_stainfo(pstapriv, pattrib->bssid);
- if (!*psta)
- return _FAIL;
- } else {
- return _FAIL;
- }
- return _SUCCESS;
-}
-
-static sint sta2ap_data_frame(struct _adapter *adapter,
- union recv_frame *precv_frame,
- struct sta_info **psta)
-{
- struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
- struct sta_priv *pstapriv = &adapter->stapriv;
- struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
- unsigned char *mybssid = get_bssid(pmlmepriv);
-
- if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
- /* For AP mode, if DA is non-MCAST, then it must be BSSID,
- * and bssid == BSSID
- * For AP mode, RA=BSSID, TX=STA(SRC_ADDR), A3=DST_ADDR
- */
- if (memcmp(pattrib->bssid, mybssid, ETH_ALEN))
- return _FAIL;
- *psta = r8712_get_stainfo(pstapriv, pattrib->src);
- if (!*psta)
- return _FAIL;
- }
- return _SUCCESS;
-}
-
-static sint validate_recv_ctrl_frame(struct _adapter *adapter,
- union recv_frame *precv_frame)
-{
- return _FAIL;
-}
-
-static sint validate_recv_mgnt_frame(struct _adapter *adapter,
- union recv_frame *precv_frame)
-{
- return _FAIL;
-}
-
-static sint validate_recv_data_frame(struct _adapter *adapter,
- union recv_frame *precv_frame)
-{
- int res;
- u8 bretry;
- u8 *psa, *pda, *pbssid;
- struct sta_info *psta = NULL;
- u8 *ptr = precv_frame->u.hdr.rx_data;
- struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
- struct security_priv *psecuritypriv = &adapter->securitypriv;
-
- bretry = GetRetry(ptr);
- pda = ieee80211_get_DA((struct ieee80211_hdr *)ptr);
- psa = ieee80211_get_SA((struct ieee80211_hdr *)ptr);
- pbssid = get_hdr_bssid(ptr);
- if (!pbssid)
- return _FAIL;
- memcpy(pattrib->dst, pda, ETH_ALEN);
- memcpy(pattrib->src, psa, ETH_ALEN);
- memcpy(pattrib->bssid, pbssid, ETH_ALEN);
- switch (pattrib->to_fr_ds) {
- case 0:
- memcpy(pattrib->ra, pda, ETH_ALEN);
- memcpy(pattrib->ta, psa, ETH_ALEN);
- res = sta2sta_data_frame(adapter, precv_frame, &psta);
- break;
- case 1:
- memcpy(pattrib->ra, pda, ETH_ALEN);
- memcpy(pattrib->ta, pbssid, ETH_ALEN);
- res = ap2sta_data_frame(adapter, precv_frame, &psta);
- break;
- case 2:
- memcpy(pattrib->ra, pbssid, ETH_ALEN);
- memcpy(pattrib->ta, psa, ETH_ALEN);
- res = sta2ap_data_frame(adapter, precv_frame, &psta);
- break;
- case 3:
- memcpy(pattrib->ra, GetAddr1Ptr(ptr), ETH_ALEN);
- memcpy(pattrib->ta, GetAddr2Ptr(ptr), ETH_ALEN);
- return _FAIL;
- default:
- return _FAIL;
- }
- if (res == _FAIL)
- return _FAIL;
- if (!psta)
- return _FAIL;
- precv_frame->u.hdr.psta = psta;
- pattrib->amsdu = 0;
- /* parsing QC field */
- if (pattrib->qos == 1) {
- pattrib->priority = GetPriority((ptr + 24));
- pattrib->ack_policy = GetAckpolicy((ptr + 24));
- pattrib->amsdu = GetAMsdu((ptr + 24));
- pattrib->hdrlen = pattrib->to_fr_ds == 3 ? 32 : 26;
- } else {
- pattrib->priority = 0;
- pattrib->hdrlen = (pattrib->to_fr_ds == 3) ? 30 : 24;
- }
-
- if (pattrib->order)/*HT-CTRL 11n*/
- pattrib->hdrlen += 4;
- precv_frame->u.hdr.preorder_ctrl =
- &psta->recvreorder_ctrl[pattrib->priority];
-
- /* decache, drop duplicate recv packets */
- if (recv_decache(precv_frame, bretry, &psta->sta_recvpriv.rxcache) ==
- _FAIL)
- return _FAIL;
-
- if (pattrib->privacy) {
- GET_ENCRY_ALGO(psecuritypriv, psta, pattrib->encrypt,
- is_multicast_ether_addr(pattrib->ra));
- SET_ICE_IV_LEN(pattrib->iv_len, pattrib->icv_len,
- pattrib->encrypt);
- } else {
- pattrib->encrypt = 0;
- pattrib->iv_len = pattrib->icv_len = 0;
- }
- return _SUCCESS;
-}
-
-sint r8712_validate_recv_frame(struct _adapter *adapter,
- union recv_frame *precv_frame)
-{
- /*shall check frame subtype, to / from ds, da, bssid */
- /*then call check if rx seq/frag. duplicated.*/
-
- u8 type;
- u8 subtype;
- sint retval = _SUCCESS;
- struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
-
- u8 *ptr = precv_frame->u.hdr.rx_data;
- u8 ver = (unsigned char)(*ptr) & 0x3;
-
- /*add version chk*/
- if (ver != 0)
- return _FAIL;
- type = GetFrameType(ptr);
- subtype = GetFrameSubType(ptr); /*bit(7)~bit(2)*/
- pattrib->to_fr_ds = get_tofr_ds(ptr);
- pattrib->frag_num = GetFragNum(ptr);
- pattrib->seq_num = GetSequence(ptr);
- pattrib->pw_save = GetPwrMgt(ptr);
- pattrib->mfrag = GetMFrag(ptr);
- pattrib->mdata = GetMData(ptr);
- pattrib->privacy = GetPrivacy(ptr);
- pattrib->order = GetOrder(ptr);
- switch (type) {
- case IEEE80211_FTYPE_MGMT:
- retval = validate_recv_mgnt_frame(adapter, precv_frame);
- break;
- case IEEE80211_FTYPE_CTL:
- retval = validate_recv_ctrl_frame(adapter, precv_frame);
- break;
- case IEEE80211_FTYPE_DATA:
- pattrib->qos = (subtype & BIT(7)) ? 1 : 0;
- retval = validate_recv_data_frame(adapter, precv_frame);
- break;
- default:
- return _FAIL;
- }
- return retval;
-}
-
-int r8712_wlanhdr_to_ethhdr(union recv_frame *precvframe)
-{
- /*remove the wlanhdr and add the eth_hdr*/
- sint rmv_len;
- u16 len;
- u8 bsnaphdr;
- u8 *psnap_type;
- struct ieee80211_snap_hdr *psnap;
- struct _adapter *adapter = precvframe->u.hdr.adapter;
- struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-
- u8 *ptr = precvframe->u.hdr.rx_data; /*point to frame_ctrl field*/
- struct rx_pkt_attrib *pattrib = &precvframe->u.hdr.attrib;
-
- if (pattrib->encrypt)
- recvframe_pull_tail(precvframe, pattrib->icv_len);
- psnap = (struct ieee80211_snap_hdr *)(ptr + pattrib->hdrlen +
- pattrib->iv_len);
- psnap_type = ptr + pattrib->hdrlen + pattrib->iv_len + SNAP_SIZE;
- /* convert hdr + possible LLC headers into Ethernet header */
- if ((!memcmp(psnap, (void *)rfc1042_header, SNAP_SIZE) &&
- (memcmp(psnap_type, (void *)SNAP_ETH_TYPE_IPX, 2)) &&
- (memcmp(psnap_type, (void *)SNAP_ETH_TYPE_APPLETALK_AARP, 2))) ||
- !memcmp(psnap, (void *)bridge_tunnel_header, SNAP_SIZE)) {
- /* remove RFC1042 or Bridge-Tunnel encapsulation and
- * replace EtherType
- */
- bsnaphdr = true;
- } else {
- /* Leave Ethernet header part of hdr and full payload */
- bsnaphdr = false;
- }
- rmv_len = pattrib->hdrlen + pattrib->iv_len +
- (bsnaphdr ? SNAP_SIZE : 0);
- len = precvframe->u.hdr.len - rmv_len;
- if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) {
- ptr += rmv_len;
- *ptr = 0x87;
- *(ptr + 1) = 0x12;
- /* append rx status for mp test packets */
- ptr = recvframe_pull(precvframe, (rmv_len -
- sizeof(struct ethhdr) + 2) - 24);
- if (!ptr)
- return -ENOMEM;
- memcpy(ptr, get_rxmem(precvframe), 24);
- ptr += 24;
- } else {
- ptr = recvframe_pull(precvframe, (rmv_len -
- sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));
- if (!ptr)
- return -ENOMEM;
- }
-
- memcpy(ptr, pattrib->dst, ETH_ALEN);
- memcpy(ptr + ETH_ALEN, pattrib->src, ETH_ALEN);
- if (!bsnaphdr) {
- __be16 be_tmp = htons(len);
-
- memcpy(ptr + 12, &be_tmp, 2);
- }
- return 0;
-}
-
-void r8712_recv_entry(union recv_frame *precvframe)
-{
- struct _adapter *padapter;
- struct recv_priv *precvpriv;
-
- s32 ret = _SUCCESS;
-
- padapter = precvframe->u.hdr.adapter;
- precvpriv = &(padapter->recvpriv);
-
- padapter->ledpriv.LedControlHandler(padapter, LED_CTL_RX);
-
- ret = recv_func(padapter, precvframe);
- if (ret == _FAIL)
- goto _recv_entry_drop;
- precvpriv->rx_pkts++;
- precvpriv->rx_bytes += (uint)(precvframe->u.hdr.rx_tail -
- precvframe->u.hdr.rx_data);
- return;
-_recv_entry_drop:
- precvpriv->rx_drop++;
- padapter->mppriv.rx_pktloss = precvpriv->rx_drop;
-}
--- a/drivers/staging/rtl8712/rtl871x_recv.h
+++ /dev/null
@@ -1,208 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef _RTL871X_RECV_H_
-#define _RTL871X_RECV_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-#define NR_RECVFRAME 256
-
-#define RXFRAME_ALIGN 8
-#define RXFRAME_ALIGN_SZ (1 << RXFRAME_ALIGN)
-
-#define MAX_SUBFRAME_COUNT 64
-
-/* for Rx reordering buffer control */
-struct recv_reorder_ctrl {
- struct _adapter *padapter;
- u16 indicate_seq; /* =wstart_b, init_value=0xffff */
- u16 wend_b;
- u8 wsize_b;
- struct __queue pending_recvframe_queue;
- struct timer_list reordering_ctrl_timer;
-};
-
-struct stainfo_rxcache {
- u16 tid_rxseq[16];
-};
-
-#define PHY_RSSI_SLID_WIN_MAX 100
-#define PHY_LINKQUALITY_SLID_WIN_MAX 20
-
-struct smooth_rssi_data {
- u32 elements[100]; /* array to store values */
- u32 index; /* index to current array to store */
- u32 total_num; /* num of valid elements */
- u32 total_val; /* sum of valid elements */
-};
-
-struct rx_pkt_attrib {
- u8 amsdu;
- u8 order;
- u8 qos;
- u8 to_fr_ds;
- u8 frag_num;
- u16 seq_num;
- u8 pw_save;
- u8 mfrag;
- u8 mdata;
- u8 privacy; /* in frame_ctrl field */
- u8 bdecrypted;
- int hdrlen; /* the WLAN Header Len */
- int encrypt; /* 0 no encrypt. != 0 encrypt algorithm */
- int iv_len;
- int icv_len;
- int priority;
- int ack_policy;
- u8 crc_err;
- u8 dst[ETH_ALEN];
- u8 src[ETH_ALEN];
- u8 ta[ETH_ALEN];
- u8 ra[ETH_ALEN];
- u8 bssid[ETH_ALEN];
- u8 tcpchk_valid; /* 0: invalid, 1: valid */
- u8 ip_chkrpt; /* 0: incorrect, 1: correct */
- u8 tcp_chkrpt; /* 0: incorrect, 1: correct */
- u8 signal_qual;
- s8 rx_mimo_signal_qual[2];
- u8 mcs_rate;
- u8 htc;
- u8 signal_strength;
-};
-
-/*
- * accesser of recv_priv: recv_entry(dispatch / passive level);
- * recv_thread(passive) ; returnpkt(dispatch)
- * ; halt(passive) ;
- *
- * using enter_critical section to protect
- */
-struct recv_priv {
- spinlock_t lock;
- struct __queue free_recv_queue;
- struct __queue recv_pending_queue;
- u8 *pallocated_frame_buf;
- u8 *precv_frame_buf;
- uint free_recvframe_cnt;
- struct _adapter *adapter;
- uint rx_bytes;
- uint rx_pkts;
- uint rx_drop;
- uint rx_icv_err;
- uint rx_largepacket_crcerr;
- uint rx_smallpacket_crcerr;
- uint rx_middlepacket_crcerr;
- u8 rx_pending_cnt;
- uint ff_hwaddr;
- struct tasklet_struct recv_tasklet;
- struct sk_buff_head free_recv_skb_queue;
- struct sk_buff_head rx_skb_queue;
- u8 *pallocated_recv_buf;
- u8 *precv_buf; /* 4 alignment */
- struct __queue free_recv_buf_queue;
- u32 free_recv_buf_queue_cnt;
- /* For the phy information */
- s8 rssi;
- u8 signal;
- u8 noise;
- u8 fw_rssi;
- struct smooth_rssi_data signal_qual_data;
- struct smooth_rssi_data signal_strength_data;
-};
-
-struct sta_recv_priv {
- spinlock_t lock;
- sint option;
- struct __queue defrag_q; /* keeping the fragment frame until defrag */
- struct stainfo_rxcache rxcache;
- uint sta_rx_bytes;
- uint sta_rx_pkts;
- uint sta_rx_fail;
-};
-
-#include "rtl8712_recv.h"
-
-/* get a free recv_frame from pfree_recv_queue */
-union recv_frame *r8712_alloc_recvframe(struct __queue *pfree_recv_queue);
-void r8712_free_recvframe(union recv_frame *precvframe,
- struct __queue *pfree_recv_queue);
-void r8712_free_recvframe_queue(struct __queue *pframequeue,
- struct __queue *pfree_recv_queue);
-int r8712_wlanhdr_to_ethhdr(union recv_frame *precvframe);
-int recv_func(struct _adapter *padapter, void *pcontext);
-
-static inline u8 *get_rxmem(union recv_frame *precvframe)
-{
- /* always return rx_head... */
- if (!precvframe)
- return NULL;
- return precvframe->u.hdr.rx_head;
-}
-
-static inline u8 *recvframe_pull(union recv_frame *precvframe, sint sz)
-{
- /* used for extract sz bytes from rx_data, update rx_data and return
- * the updated rx_data to the caller
- */
- if (!precvframe)
- return NULL;
- precvframe->u.hdr.rx_data += sz;
- if (precvframe->u.hdr.rx_data > precvframe->u.hdr.rx_tail) {
- precvframe->u.hdr.rx_data -= sz;
- return NULL;
- }
- precvframe->u.hdr.len -= sz;
- return precvframe->u.hdr.rx_data;
-}
-
-static inline u8 *recvframe_put(union recv_frame *precvframe, sint sz)
-{
- /* used for append sz bytes from ptr to rx_tail, update rx_tail and
- * return the updated rx_tail to the caller
- * after putting, rx_tail must be still larger than rx_end.
- */
- if (!precvframe)
- return NULL;
- precvframe->u.hdr.rx_tail += sz;
- if (precvframe->u.hdr.rx_tail > precvframe->u.hdr.rx_end) {
- precvframe->u.hdr.rx_tail -= sz;
- return NULL;
- }
- precvframe->u.hdr.len += sz;
- return precvframe->u.hdr.rx_tail;
-}
-
-static inline u8 *recvframe_pull_tail(union recv_frame *precvframe, sint sz)
-{
- /* rmv data from rx_tail (by yitsen)
- * used for extract sz bytes from rx_end, update rx_end and return the
- * updated rx_end to the caller
- * after pulling, rx_end must be still larger than rx_data.
- */
- if (!precvframe)
- return NULL;
- precvframe->u.hdr.rx_tail -= sz;
- if (precvframe->u.hdr.rx_tail < precvframe->u.hdr.rx_data) {
- precvframe->u.hdr.rx_tail += sz;
- return NULL;
- }
- precvframe->u.hdr.len -= sz;
- return precvframe->u.hdr.rx_tail;
-}
-
-struct sta_info;
-
-void _r8712_init_sta_recv_priv(struct sta_recv_priv *psta_recvpriv);
-sint r8712_recvframe_chkmic(struct _adapter *adapter,
- union recv_frame *precvframe);
-union recv_frame *r8712_decryptor(struct _adapter *adapter,
- union recv_frame *precv_frame);
-union recv_frame *r8712_recvframe_chk_defrag(struct _adapter *adapter,
- union recv_frame *precv_frame);
-int r8712_validate_recv_frame(struct _adapter *adapter,
- union recv_frame *precv_frame);
-union recv_frame *r8712_portctrl(struct _adapter *adapter,
- union recv_frame *precv_frame);
-
-#endif
-
--- a/drivers/staging/rtl8712/rtl871x_rf.h
+++ /dev/null
@@ -1,55 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL871X_RF_H_
-#define __RTL871X_RF_H_
-
-#include "rtl871x_cmd.h"
-#include "rtl871x_mp_phy_regdef.h"
-
-#define OFDM_PHY 1
-#define MIXED_PHY 2
-#define CCK_PHY 3
-#define NumRates (13)
-#define RTL8711_RF_MAX_SENS 6
-#define RTL8711_RF_DEF_SENS 4
-#define NUM_CHANNELS 15
-
-struct regulatory_class {
- u32 starting_freq; /*MHz, */
- u8 channel_set[NUM_CHANNELS];
- u8 channel_cck_power[NUM_CHANNELS]; /*dbm*/
- u8 channel_ofdm_power[NUM_CHANNELS];/*dbm*/
- u8 txpower_limit; /*dbm*/
- u8 channel_spacing; /*MHz*/
- u8 modem;
-};
-
-enum _REG_PREAMBLE_MODE {
- PREAMBLE_LONG = 1,
- PREAMBLE_AUTO = 2,
- PREAMBLE_SHORT = 3,
-};
-
-enum {
- RTL8712_RFC_1T = 0x10,
- RTL8712_RFC_2T = 0x20,
- RTL8712_RFC_1R = 0x01,
- RTL8712_RFC_2R = 0x02,
- RTL8712_RFC_1T1R = 0x11,
- RTL8712_RFC_1T2R = 0x12,
- RTL8712_RFC_TURBO = 0x92,
- RTL8712_RFC_2T2R = 0x22
-};
-
-#endif /*__RTL871X_RF_H_*/
--- a/drivers/staging/rtl8712/rtl871x_security.c
+++ /dev/null
@@ -1,1386 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_security.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL871X_SECURITY_C_
-
-#include <linux/compiler.h>
-#include <linux/kernel.h>
-#include <linux/errno.h>
-#include <linux/slab.h>
-#include <linux/module.h>
-#include <linux/kref.h>
-#include <linux/netdevice.h>
-#include <linux/skbuff.h>
-#include <linux/circ_buf.h>
-#include <linux/uaccess.h>
-#include <asm/byteorder.h>
-#include <linux/atomic.h>
-#include <linux/crc32poly.h>
-#include <linux/semaphore.h>
-#include <linux/ieee80211.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "osdep_intf.h"
-
-/* =====WEP related===== */
-
-struct arc4context {
- u32 x;
- u32 y;
- u8 state[256];
-};
-
-static void arcfour_init(struct arc4context *parc4ctx, u8 *key, u32 key_len)
-{
- u32 t, u;
- u32 keyindex;
- u32 stateindex;
- u8 *state;
- u32 counter;
-
- state = parc4ctx->state;
- parc4ctx->x = 0;
- parc4ctx->y = 0;
- for (counter = 0; counter < 256; counter++)
- state[counter] = (u8)counter;
- keyindex = 0;
- stateindex = 0;
- for (counter = 0; counter < 256; counter++) {
- t = state[counter];
- stateindex = (stateindex + key[keyindex] + t) & 0xff;
- u = state[stateindex];
- state[stateindex] = (u8)t;
- state[counter] = (u8)u;
- if (++keyindex >= key_len)
- keyindex = 0;
- }
-}
-
-static u32 arcfour_byte(struct arc4context *parc4ctx)
-{
- u32 x;
- u32 y;
- u32 sx, sy;
- u8 *state;
-
- state = parc4ctx->state;
- x = (parc4ctx->x + 1) & 0xff;
- sx = state[x];
- y = (sx + parc4ctx->y) & 0xff;
- sy = state[y];
- parc4ctx->x = x;
- parc4ctx->y = y;
- state[y] = (u8)sx;
- state[x] = (u8)sy;
- return state[(sx + sy) & 0xff];
-}
-
-static void arcfour_encrypt(struct arc4context *parc4ctx,
- u8 *dest, u8 *src, u32 len)
-{
- u32 i;
-
- for (i = 0; i < len; i++)
- dest[i] = src[i] ^ (unsigned char)arcfour_byte(parc4ctx);
-}
-
-static sint bcrc32initialized;
-static u32 crc32_table[256];
-
-static u8 crc32_reverseBit(u8 data)
-{
- return ((u8)(data << 7) & 0x80) | ((data << 5) & 0x40) | ((data << 3)
- & 0x20) | ((data << 1) & 0x10) | ((data >> 1) & 0x08) |
- ((data >> 3) & 0x04) | ((data >> 5) & 0x02) | ((data >> 7) &
- 0x01);
-}
-
-static void crc32_init(void)
-{
- sint i, j;
- u32 c;
- u8 *p = (u8 *)&c, *p1;
- u8 k;
-
- if (bcrc32initialized == 1)
- return;
-
- for (i = 0; i < 256; ++i) {
- k = crc32_reverseBit((u8)i);
- for (c = ((u32)k) << 24, j = 8; j > 0; --j)
- c = c & 0x80000000 ? (c << 1) ^ CRC32_POLY_BE : (c << 1);
- p1 = (u8 *)&crc32_table[i];
- p1[0] = crc32_reverseBit(p[3]);
- p1[1] = crc32_reverseBit(p[2]);
- p1[2] = crc32_reverseBit(p[1]);
- p1[3] = crc32_reverseBit(p[0]);
- }
- bcrc32initialized = 1;
-}
-
-static u32 getcrc32(u8 *buf, u32 len)
-{
- u8 *p;
- u32 crc;
-
- if (!bcrc32initialized)
- crc32_init();
- crc = 0xffffffff; /* preload shift register, per CRC-32 spec */
- for (p = buf; len > 0; ++p, --len)
- crc = crc32_table[(crc ^ *p) & 0xff] ^ (crc >> 8);
- return ~crc; /* transmit complement, per CRC-32 spec */
-}
-
-/*
- * Need to consider the fragment situation
- */
-void r8712_wep_encrypt(struct _adapter *padapter, u8 *pxmitframe)
-{ /* exclude ICV */
- unsigned char crc[4];
- struct arc4context mycontext;
- u32 curfragnum, length, keylength, pki;
- u8 *pframe, *payload, *iv; /*,*wepkey*/
- u8 wepkey[16];
- struct pkt_attrib *pattrib = &((struct xmit_frame *)
- pxmitframe)->attrib;
- struct security_priv *psecuritypriv = &padapter->securitypriv;
- struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
-
- if (((struct xmit_frame *)pxmitframe)->buf_addr == NULL)
- return;
- pframe = ((struct xmit_frame *)pxmitframe)->buf_addr + TXDESC_OFFSET;
- /*start to encrypt each fragment*/
- if ((pattrib->encrypt == _WEP40_) || (pattrib->encrypt == _WEP104_)) {
- pki = psecuritypriv->PrivacyKeyIndex;
- keylength = psecuritypriv->DefKeylen[pki];
- for (curfragnum = 0; curfragnum < pattrib->nr_frags;
- curfragnum++) {
- iv = pframe + pattrib->hdrlen;
- memcpy(&wepkey[0], iv, 3);
- memcpy(&wepkey[3], &psecuritypriv->DefKey[
- psecuritypriv->PrivacyKeyIndex].skey[0],
- keylength);
- payload = pframe + pattrib->iv_len + pattrib->hdrlen;
- if ((curfragnum + 1) == pattrib->nr_frags) {
- length = pattrib->last_txcmdsz -
- pattrib->hdrlen -
- pattrib->iv_len -
- pattrib->icv_len;
- *((__le32 *)crc) = cpu_to_le32(getcrc32(
- payload, length));
- arcfour_init(&mycontext, wepkey, 3 + keylength);
- arcfour_encrypt(&mycontext, payload, payload,
- length);
- arcfour_encrypt(&mycontext, payload + length,
- crc, 4);
- } else {
- length = pxmitpriv->frag_len -
- pattrib->hdrlen - pattrib->iv_len -
- pattrib->icv_len;
- *((__le32 *)crc) = cpu_to_le32(getcrc32(
- payload, length));
- arcfour_init(&mycontext, wepkey, 3 + keylength);
- arcfour_encrypt(&mycontext, payload, payload,
- length);
- arcfour_encrypt(&mycontext, payload + length,
- crc, 4);
- pframe += pxmitpriv->frag_len;
- pframe = (u8 *)RND4((addr_t)(pframe));
- }
- }
- }
-}
-
-void r8712_wep_decrypt(struct _adapter *padapter, u8 *precvframe)
-{
- /* exclude ICV */
- u8 crc[4];
- struct arc4context mycontext;
- u32 length, keylength;
- u8 *pframe, *payload, *iv, wepkey[16];
- u8 keyindex;
- struct rx_pkt_attrib *prxattrib = &(((union recv_frame *)
- precvframe)->u.hdr.attrib);
- struct security_priv *psecuritypriv = &padapter->securitypriv;
-
- pframe = (unsigned char *)((union recv_frame *)precvframe)->
- u.hdr.rx_data;
- /* start to decrypt recvframe */
- if ((prxattrib->encrypt == _WEP40_) || (prxattrib->encrypt ==
- _WEP104_)) {
- iv = pframe + prxattrib->hdrlen;
- keyindex = (iv[3] & 0x3);
- keylength = psecuritypriv->DefKeylen[keyindex];
- memcpy(&wepkey[0], iv, 3);
- memcpy(&wepkey[3], &psecuritypriv->DefKey[
- psecuritypriv->PrivacyKeyIndex].skey[0],
- keylength);
- length = ((union recv_frame *)precvframe)->
- u.hdr.len - prxattrib->hdrlen - prxattrib->iv_len;
- payload = pframe + prxattrib->iv_len + prxattrib->hdrlen;
- /* decrypt payload include icv */
- arcfour_init(&mycontext, wepkey, 3 + keylength);
- arcfour_encrypt(&mycontext, payload, payload, length);
- /* calculate icv and compare the icv */
- *((__le32 *)crc) = cpu_to_le32(getcrc32(payload, length - 4));
- }
-}
-
-/* 3 =====TKIP related===== */
-
-static u32 secmicgetuint32(u8 *p)
-/* Convert from Byte[] to Us4Byte32 in a portable way */
-{
- s32 i;
- u32 res = 0;
-
- for (i = 0; i < 4; i++)
- res |= ((u32)(*p++)) << (8 * i);
- return res;
-}
-
-static void secmicputuint32(u8 *p, u32 val)
-/* Convert from Us4Byte32 to Byte[] in a portable way */
-{
- long i;
-
- for (i = 0; i < 4; i++) {
- *p++ = (u8)(val & 0xff);
- val >>= 8;
- }
-}
-
-static void secmicclear(struct mic_data *pmicdata)
-{
-/* Reset the state to the empty message. */
- pmicdata->L = pmicdata->K0;
- pmicdata->R = pmicdata->K1;
- pmicdata->nBytesInM = 0;
- pmicdata->M = 0;
-}
-
-void r8712_secmicsetkey(struct mic_data *pmicdata, u8 *key)
-{
- /* Set the key */
- pmicdata->K0 = secmicgetuint32(key);
- pmicdata->K1 = secmicgetuint32(key + 4);
- /* and reset the message */
- secmicclear(pmicdata);
-}
-
-static void secmicappendbyte(struct mic_data *pmicdata, u8 b)
-{
- /* Append the byte to our word-sized buffer */
- pmicdata->M |= ((u32)b) << (8 * pmicdata->nBytesInM);
- pmicdata->nBytesInM++;
- /* Process the word if it is full. */
- if (pmicdata->nBytesInM >= 4) {
- pmicdata->L ^= pmicdata->M;
- pmicdata->R ^= ROL32(pmicdata->L, 17);
- pmicdata->L += pmicdata->R;
- pmicdata->R ^= ((pmicdata->L & 0xff00ff00) >> 8) |
- ((pmicdata->L & 0x00ff00ff) << 8);
- pmicdata->L += pmicdata->R;
- pmicdata->R ^= ROL32(pmicdata->L, 3);
- pmicdata->L += pmicdata->R;
- pmicdata->R ^= ROR32(pmicdata->L, 2);
- pmicdata->L += pmicdata->R;
- /* Clear the buffer */
- pmicdata->M = 0;
- pmicdata->nBytesInM = 0;
- }
-}
-
-void r8712_secmicappend(struct mic_data *pmicdata, u8 *src, u32 nbytes)
-{
- /* This is simple */
- while (nbytes > 0) {
- secmicappendbyte(pmicdata, *src++);
- nbytes--;
- }
-}
-
-void r8712_secgetmic(struct mic_data *pmicdata, u8 *dst)
-{
- /* Append the minimum padding */
- secmicappendbyte(pmicdata, 0x5a);
- secmicappendbyte(pmicdata, 0);
- secmicappendbyte(pmicdata, 0);
- secmicappendbyte(pmicdata, 0);
- secmicappendbyte(pmicdata, 0);
- /* and then zeroes until the length is a multiple of 4 */
- while (pmicdata->nBytesInM != 0)
- secmicappendbyte(pmicdata, 0);
- /* The appendByte function has already computed the result. */
- secmicputuint32(dst, pmicdata->L);
- secmicputuint32(dst + 4, pmicdata->R);
- /* Reset to the empty message. */
- secmicclear(pmicdata);
-}
-
-void seccalctkipmic(u8 *key, u8 *header, u8 *data, u32 data_len, u8 *mic_code,
- u8 pri)
-{
-
- struct mic_data micdata;
- u8 priority[4] = {0x0, 0x0, 0x0, 0x0};
-
- r8712_secmicsetkey(&micdata, key);
- priority[0] = pri;
- /* Michael MIC pseudo header: DA, SA, 3 x 0, Priority */
- if (header[1] & 1) { /* ToDS==1 */
- r8712_secmicappend(&micdata, &header[16], 6); /* DA */
- if (header[1] & 2) /* From Ds==1 */
- r8712_secmicappend(&micdata, &header[24], 6);
- else
- r8712_secmicappend(&micdata, &header[10], 6);
- } else { /* ToDS==0 */
- r8712_secmicappend(&micdata, &header[4], 6); /* DA */
- if (header[1] & 2) /* From Ds==1 */
- r8712_secmicappend(&micdata, &header[16], 6);
- else
- r8712_secmicappend(&micdata, &header[10], 6);
- }
- r8712_secmicappend(&micdata, &priority[0], 4);
- r8712_secmicappend(&micdata, data, data_len);
- r8712_secgetmic(&micdata, mic_code);
-}
-
-/* macros for extraction/creation of unsigned char/unsigned short values */
-#define RotR1(v16) ((((v16) >> 1) & 0x7FFF) ^ (((v16) & 1) << 15))
-#define Lo8(v16) ((u8)((v16) & 0x00FF))
-#define Hi8(v16) ((u8)(((v16) >> 8) & 0x00FF))
-#define Lo16(v32) ((u16)((v32) & 0xFFFF))
-#define Hi16(v32) ((u16)(((v32) >> 16) & 0xFFFF))
-#define Mk16(hi, lo) ((lo) ^ (((u16)(hi)) << 8))
-
-/* select the Nth 16-bit word of the temporal key unsigned char array TK[] */
-#define TK16(N) Mk16(tk[2 * (N) + 1], tk[2 * (N)])
-
-/* S-box lookup: 16 bits --> 16 bits */
-#define _S_(v16) (Sbox1[0][Lo8(v16)] ^ Sbox1[1][Hi8(v16)])
-
-/* fixed algorithm "parameters" */
-#define PHASE1_LOOP_CNT 8 /* this needs to be "big enough" */
-#define TA_SIZE 6 /* 48-bit transmitter address */
-#define TK_SIZE 16 /* 128-bit temporal key */
-#define P1K_SIZE 10 /* 80-bit Phase1 key */
-#define RC4_KEY_SIZE 16 /* 128-bit RC4KEY (104 bits unknown) */
-
-/* 2-unsigned char by 2-unsigned char subset of the full AES S-box table */
-static const unsigned short Sbox1[2][256] = {/* Sbox for hash (can be in ROM) */
- {
- 0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154,
- 0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A,
- 0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B,
- 0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B,
- 0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F,
- 0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F,
- 0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5,
- 0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F,
- 0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB,
- 0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397,
- 0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED,
- 0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A,
- 0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194,
- 0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3,
- 0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104,
- 0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D,
- 0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39,
- 0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695,
- 0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83,
- 0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76,
- 0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4,
- 0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B,
- 0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0,
- 0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018,
- 0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751,
- 0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85,
- 0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12,
- 0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9,
- 0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7,
- 0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A,
- 0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8,
- 0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A,
- },
- { /* second half is unsigned char-reversed version of first! */
- 0xA5C6, 0x84F8, 0x99EE, 0x8DF6, 0x0DFF, 0xBDD6, 0xB1DE, 0x5491,
- 0x5060, 0x0302, 0xA9CE, 0x7D56, 0x19E7, 0x62B5, 0xE64D, 0x9AEC,
- 0x458F, 0x9D1F, 0x4089, 0x87FA, 0x15EF, 0xEBB2, 0xC98E, 0x0BFB,
- 0xEC41, 0x67B3, 0xFD5F, 0xEA45, 0xBF23, 0xF753, 0x96E4, 0x5B9B,
- 0xC275, 0x1CE1, 0xAE3D, 0x6A4C, 0x5A6C, 0x417E, 0x02F5, 0x4F83,
- 0x5C68, 0xF451, 0x34D1, 0x08F9, 0x93E2, 0x73AB, 0x5362, 0x3F2A,
- 0x0C08, 0x5295, 0x6546, 0x5E9D, 0x2830, 0xA137, 0x0F0A, 0xB52F,
- 0x090E, 0x3624, 0x9B1B, 0x3DDF, 0x26CD, 0x694E, 0xCD7F, 0x9FEA,
- 0x1B12, 0x9E1D, 0x7458, 0x2E34, 0x2D36, 0xB2DC, 0xEEB4, 0xFB5B,
- 0xF6A4, 0x4D76, 0x61B7, 0xCE7D, 0x7B52, 0x3EDD, 0x715E, 0x9713,
- 0xF5A6, 0x68B9, 0x0000, 0x2CC1, 0x6040, 0x1FE3, 0xC879, 0xEDB6,
- 0xBED4, 0x468D, 0xD967, 0x4B72, 0xDE94, 0xD498, 0xE8B0, 0x4A85,
- 0x6BBB, 0x2AC5, 0xE54F, 0x16ED, 0xC586, 0xD79A, 0x5566, 0x9411,
- 0xCF8A, 0x10E9, 0x0604, 0x81FE, 0xF0A0, 0x4478, 0xBA25, 0xE34B,
- 0xF3A2, 0xFE5D, 0xC080, 0x8A05, 0xAD3F, 0xBC21, 0x4870, 0x04F1,
- 0xDF63, 0xC177, 0x75AF, 0x6342, 0x3020, 0x1AE5, 0x0EFD, 0x6DBF,
- 0x4C81, 0x1418, 0x3526, 0x2FC3, 0xE1BE, 0xA235, 0xCC88, 0x392E,
- 0x5793, 0xF255, 0x82FC, 0x477A, 0xACC8, 0xE7BA, 0x2B32, 0x95E6,
- 0xA0C0, 0x9819, 0xD19E, 0x7FA3, 0x6644, 0x7E54, 0xAB3B, 0x830B,
- 0xCA8C, 0x29C7, 0xD36B, 0x3C28, 0x79A7, 0xE2BC, 0x1D16, 0x76AD,
- 0x3BDB, 0x5664, 0x4E74, 0x1E14, 0xDB92, 0x0A0C, 0x6C48, 0xE4B8,
- 0x5D9F, 0x6EBD, 0xEF43, 0xA6C4, 0xA839, 0xA431, 0x37D3, 0x8BF2,
- 0x32D5, 0x438B, 0x596E, 0xB7DA, 0x8C01, 0x64B1, 0xD29C, 0xE049,
- 0xB4D8, 0xFAAC, 0x07F3, 0x25CF, 0xAFCA, 0x8EF4, 0xE947, 0x1810,
- 0xD56F, 0x88F0, 0x6F4A, 0x725C, 0x2438, 0xF157, 0xC773, 0x5197,
- 0x23CB, 0x7CA1, 0x9CE8, 0x213E, 0xDD96, 0xDC61, 0x860D, 0x850F,
- 0x90E0, 0x427C, 0xC471, 0xAACC, 0xD890, 0x0506, 0x01F7, 0x121C,
- 0xA3C2, 0x5F6A, 0xF9AE, 0xD069, 0x9117, 0x5899, 0x273A, 0xB927,
- 0x38D9, 0x13EB, 0xB32B, 0x3322, 0xBBD2, 0x70A9, 0x8907, 0xA733,
- 0xB62D, 0x223C, 0x9215, 0x20C9, 0x4987, 0xFFAA, 0x7850, 0x7AA5,
- 0x8F03, 0xF859, 0x8009, 0x171A, 0xDA65, 0x31D7, 0xC684, 0xB8D0,
- 0xC382, 0xB029, 0x775A, 0x111E, 0xCB7B, 0xFCA8, 0xD66D, 0x3A2C,
- }
-};
-
-/*
- **********************************************************************
- * Routine: Phase 1 -- generate P1K, given TA, TK, IV32
- *
- * Inputs:
- * tk[] = temporal key [128 bits]
- * ta[] = transmitter's MAC address [ 48 bits]
- * iv32 = upper 32 bits of IV [ 32 bits]
- * Output:
- * p1k[] = Phase 1 key [ 80 bits]
- *
- * Note:
- * This function only needs to be called every 2**16 packets,
- * although in theory it could be called every packet.
- *
- **********************************************************************
- */
-static void phase1(u16 *p1k, const u8 *tk, const u8 *ta, u32 iv32)
-{
- sint i;
-
- /* Initialize the 80 bits of P1K[] from IV32 and TA[0..5] */
- p1k[0] = Lo16(iv32);
- p1k[1] = Hi16(iv32);
- p1k[2] = Mk16(ta[1], ta[0]); /* use TA[] as little-endian */
- p1k[3] = Mk16(ta[3], ta[2]);
- p1k[4] = Mk16(ta[5], ta[4]);
- /* Now compute an unbalanced Feistel cipher with 80-bit block */
- /* size on the 80-bit block P1K[], using the 128-bit key TK[] */
- for (i = 0; i < PHASE1_LOOP_CNT; i++) { /* Each add is mod 2**16 */
- p1k[0] += _S_(p1k[4] ^ TK16((i & 1) + 0));
- p1k[1] += _S_(p1k[0] ^ TK16((i & 1) + 2));
- p1k[2] += _S_(p1k[1] ^ TK16((i & 1) + 4));
- p1k[3] += _S_(p1k[2] ^ TK16((i & 1) + 6));
- p1k[4] += _S_(p1k[3] ^ TK16((i & 1) + 0));
- p1k[4] += (unsigned short)i; /* avoid "slide attacks" */
- }
-}
-
-/*
- **********************************************************************
- * Routine: Phase 2 -- generate RC4KEY, given TK, P1K, IV16
- *
- * Inputs:
- * tk[] = Temporal key [128 bits]
- * p1k[] = Phase 1 output key [ 80 bits]
- * iv16 = low 16 bits of IV counter [ 16 bits]
- * Output:
- * rc4key[] = the key used to encrypt the packet [128 bits]
- *
- * Note:
- * The value {TA,IV32,IV16} for Phase1/Phase2 must be unique
- * across all packets using the same key TK value. Then, for a
- * given value of TK[], this TKIP48 construction guarantees that
- * the final RC4KEY value is unique across all packets.
- *
- * Suggested implementation optimization: if PPK[] is "overlaid"
- * appropriately on RC4KEY[], there is no need for the final
- * for loop below that copies the PPK[] result into RC4KEY[].
- *
- **********************************************************************
- */
-static void phase2(u8 *rc4key, const u8 *tk, const u16 *p1k, u16 iv16)
-{
- sint i;
- u16 PPK[6]; /* temporary key for mixing */
-
- /* Note: all adds in the PPK[] equations below are mod 2**16 */
- for (i = 0; i < 5; i++)
- PPK[i] = p1k[i]; /* first, copy P1K to PPK */
- PPK[5] = p1k[4] + iv16; /* next, add in IV16 */
- /* Bijective non-linear mixing of the 96 bits of PPK[0..5] */
- PPK[0] += _S_(PPK[5] ^ TK16(0)); /* Mix key in each "round" */
- PPK[1] += _S_(PPK[0] ^ TK16(1));
- PPK[2] += _S_(PPK[1] ^ TK16(2));
- PPK[3] += _S_(PPK[2] ^ TK16(3));
- PPK[4] += _S_(PPK[3] ^ TK16(4));
- PPK[5] += _S_(PPK[4] ^ TK16(5)); /* Total # S-box lookups == 6 */
- /* Final sweep: bijective, "linear". Rotates kill LSB correlations */
- PPK[0] += RotR1(PPK[5] ^ TK16(6));
- PPK[1] += RotR1(PPK[0] ^ TK16(7)); /* Use all of TK[] in Phase2 */
- PPK[2] += RotR1(PPK[1]);
- PPK[3] += RotR1(PPK[2]);
- PPK[4] += RotR1(PPK[3]);
- PPK[5] += RotR1(PPK[4]);
- /* Note: At this point, for a given key TK[0..15], the 96-bit output */
- /* value PPK[0..5] is guaranteed to be unique, as a function */
- /* of the 96-bit "input" value {TA,IV32,IV16}. That is, P1K */
- /* is now a keyed permutation of {TA,IV32,IV16}. */
- /* Set RC4KEY[0..3], which includes "cleartext" portion of RC4 key */
- rc4key[0] = Hi8(iv16); /* RC4KEY[0..2] is the WEP IV */
- rc4key[1] = (Hi8(iv16) | 0x20) & 0x7F; /* Help avoid weak (FMS) keys */
- rc4key[2] = Lo8(iv16);
- rc4key[3] = Lo8((PPK[5] ^ TK16(0)) >> 1);
- /* Copy 96 bits of PPK[0..5] to RC4KEY[4..15] (little-endian) */
- for (i = 0; i < 6; i++) {
- rc4key[4 + 2 * i] = Lo8(PPK[i]);
- rc4key[5 + 2 * i] = Hi8(PPK[i]);
- }
-}
-
-/*The hlen isn't include the IV*/
-u32 r8712_tkip_encrypt(struct _adapter *padapter, u8 *pxmitframe)
-{ /* exclude ICV */
- u16 pnl;
- u32 pnh;
- u8 rc4key[16];
- u8 ttkey[16];
- u8 crc[4];
- struct arc4context mycontext;
- u32 curfragnum, length;
-
- u8 *pframe, *payload, *iv, *prwskey;
- union pn48 txpn;
- struct sta_info *stainfo;
- struct pkt_attrib *pattrib = &((struct xmit_frame *)pxmitframe)->attrib;
- struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
- u32 res = _SUCCESS;
-
- if (((struct xmit_frame *)pxmitframe)->buf_addr == NULL)
- return _FAIL;
-
- pframe = ((struct xmit_frame *)pxmitframe)->buf_addr + TXDESC_OFFSET;
- /* 4 start to encrypt each fragment */
- if (pattrib->encrypt == _TKIP_) {
- if (pattrib->psta)
- stainfo = pattrib->psta;
- else
- stainfo = r8712_get_stainfo(&padapter->stapriv,
- &pattrib->ra[0]);
- if (stainfo) {
- prwskey = &stainfo->x_UncstKey.skey[0];
- for (curfragnum = 0; curfragnum < pattrib->nr_frags;
- curfragnum++) {
- iv = pframe + pattrib->hdrlen;
- payload = pframe + pattrib->iv_len +
- pattrib->hdrlen;
- GET_TKIP_PN(iv, txpn);
- pnl = (u16)(txpn.val);
- pnh = (u32)(txpn.val >> 16);
- phase1((u16 *)&ttkey[0], prwskey,
- &pattrib->ta[0], pnh);
- phase2(&rc4key[0], prwskey, (u16 *)&ttkey[0],
- pnl);
- if ((curfragnum + 1) == pattrib->nr_frags) {
- /* 4 the last fragment */
- length = pattrib->last_txcmdsz -
- pattrib->hdrlen -
- pattrib->iv_len -
- pattrib->icv_len;
- *((__le32 *)crc) = cpu_to_le32(
- getcrc32(payload, length));
- arcfour_init(&mycontext, rc4key, 16);
- arcfour_encrypt(&mycontext, payload,
- payload, length);
- arcfour_encrypt(&mycontext, payload +
- length, crc, 4);
- } else {
- length = pxmitpriv->frag_len -
- pattrib->hdrlen -
- pattrib->iv_len -
- pattrib->icv_len;
- *((__le32 *)crc) = cpu_to_le32(getcrc32(
- payload, length));
- arcfour_init(&mycontext, rc4key, 16);
- arcfour_encrypt(&mycontext, payload,
- payload, length);
- arcfour_encrypt(&mycontext,
- payload + length, crc,
- 4);
- pframe += pxmitpriv->frag_len;
- pframe = (u8 *)RND4((addr_t)(pframe));
- }
- }
- } else {
- res = _FAIL;
- }
- }
- return res;
-}
-
-/* The hlen doesn't include the IV */
-void r8712_tkip_decrypt(struct _adapter *padapter, u8 *precvframe)
-{ /* exclude ICV */
- u16 pnl;
- u32 pnh;
- u8 rc4key[16];
- u8 ttkey[16];
- u8 crc[4];
- struct arc4context mycontext;
- u32 length;
- u8 *pframe, *payload, *iv, *prwskey, idx = 0;
- union pn48 txpn;
- struct sta_info *stainfo;
- struct rx_pkt_attrib *prxattrib = &((union recv_frame *)
- precvframe)->u.hdr.attrib;
- struct security_priv *psecuritypriv = &padapter->securitypriv;
-
- pframe = (unsigned char *)((union recv_frame *)
- precvframe)->u.hdr.rx_data;
- /* 4 start to decrypt recvframe */
- if (prxattrib->encrypt == _TKIP_) {
- stainfo = r8712_get_stainfo(&padapter->stapriv,
- &prxattrib->ta[0]);
- if (stainfo) {
- iv = pframe + prxattrib->hdrlen;
- payload = pframe + prxattrib->iv_len +
- prxattrib->hdrlen;
- length = ((union recv_frame *)precvframe)->
- u.hdr.len - prxattrib->hdrlen -
- prxattrib->iv_len;
- if (is_multicast_ether_addr(prxattrib->ra)) {
- idx = iv[3];
- prwskey = &psecuritypriv->XGrpKey[
- ((idx >> 6) & 0x3) - 1].skey[0];
- if (!psecuritypriv->binstallGrpkey)
- return;
- } else {
- prwskey = &stainfo->x_UncstKey.skey[0];
- }
- GET_TKIP_PN(iv, txpn);
- pnl = (u16)(txpn.val);
- pnh = (u32)(txpn.val >> 16);
- phase1((u16 *)&ttkey[0], prwskey, &prxattrib->ta[0],
- pnh);
- phase2(&rc4key[0], prwskey, (unsigned short *)
- &ttkey[0], pnl);
- /* 4 decrypt payload include icv */
- arcfour_init(&mycontext, rc4key, 16);
- arcfour_encrypt(&mycontext, payload, payload, length);
- *((__le32 *)crc) = cpu_to_le32(getcrc32(payload,
- length - 4));
- }
- }
-}
-
-/* 3 =====AES related===== */
-
-#define MAX_MSG_SIZE 2048
-/*****************************/
-/******** SBOX Table *********/
-/*****************************/
-
-static const u8 sbox_table[256] = {
- 0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5,
- 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
- 0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0,
- 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,
- 0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc,
- 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
- 0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a,
- 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,
- 0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0,
- 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,
- 0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b,
- 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
- 0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85,
- 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8,
- 0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5,
- 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2,
- 0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17,
- 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
- 0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88,
- 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb,
- 0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c,
- 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79,
- 0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9,
- 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
- 0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6,
- 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a,
- 0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e,
- 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e,
- 0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94,
- 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
- 0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68,
- 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16
-};
-
-/****************************************/
-/* aes128k128d() */
-/* Performs a 128 bit AES encrypt with */
-/* 128 bit data. */
-/****************************************/
-static void xor_128(u8 *a, u8 *b, u8 *out)
-{
- sint i;
-
- for (i = 0; i < 16; i++)
- out[i] = a[i] ^ b[i];
-}
-
-static void xor_32(u8 *a, u8 *b, u8 *out)
-{
- sint i;
-
- for (i = 0; i < 4; i++)
- out[i] = a[i] ^ b[i];
-}
-
-static u8 sbox(u8 a)
-{
- return sbox_table[(sint)a];
-}
-
-static void next_key(u8 *key, sint round)
-{
- u8 rcon;
- u8 sbox_key[4];
- static const u8 rcon_table[12] = {
- 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80,
- 0x1b, 0x36, 0x36, 0x36
- };
-
- sbox_key[0] = sbox(key[13]);
- sbox_key[1] = sbox(key[14]);
- sbox_key[2] = sbox(key[15]);
- sbox_key[3] = sbox(key[12]);
- rcon = rcon_table[round];
- xor_32(&key[0], sbox_key, &key[0]);
- key[0] = key[0] ^ rcon;
- xor_32(&key[4], &key[0], &key[4]);
- xor_32(&key[8], &key[4], &key[8]);
- xor_32(&key[12], &key[8], &key[12]);
-}
-
-static void byte_sub(u8 *in, u8 *out)
-{
- sint i;
-
- for (i = 0; i < 16; i++)
- out[i] = sbox(in[i]);
-}
-
-static void shift_row(u8 *in, u8 *out)
-{
- out[0] = in[0];
- out[1] = in[5];
- out[2] = in[10];
- out[3] = in[15];
- out[4] = in[4];
- out[5] = in[9];
- out[6] = in[14];
- out[7] = in[3];
- out[8] = in[8];
- out[9] = in[13];
- out[10] = in[2];
- out[11] = in[7];
- out[12] = in[12];
- out[13] = in[1];
- out[14] = in[6];
- out[15] = in[11];
-}
-
-static void mix_column(u8 *in, u8 *out)
-{
- sint i;
- u8 add1b[4];
- u8 add1bf7[4];
- u8 rotl[4];
- u8 swap_halves[4];
- u8 andf7[4];
- u8 rotr[4];
- u8 temp[4];
- u8 tempb[4];
-
- for (i = 0; i < 4; i++) {
- if ((in[i] & 0x80) == 0x80)
- add1b[i] = 0x1b;
- else
- add1b[i] = 0x00;
- }
- swap_halves[0] = in[2]; /* Swap halves */
- swap_halves[1] = in[3];
- swap_halves[2] = in[0];
- swap_halves[3] = in[1];
- rotl[0] = in[3]; /* Rotate left 8 bits */
- rotl[1] = in[0];
- rotl[2] = in[1];
- rotl[3] = in[2];
- andf7[0] = in[0] & 0x7f;
- andf7[1] = in[1] & 0x7f;
- andf7[2] = in[2] & 0x7f;
- andf7[3] = in[3] & 0x7f;
- for (i = 3; i > 0; i--) { /* logical shift left 1 bit */
- andf7[i] = andf7[i] << 1;
- if ((andf7[i - 1] & 0x80) == 0x80)
- andf7[i] = (andf7[i] | 0x01);
- }
- andf7[0] = andf7[0] << 1;
- andf7[0] = andf7[0] & 0xfe;
- xor_32(add1b, andf7, add1bf7);
- xor_32(in, add1bf7, rotr);
- temp[0] = rotr[0]; /* Rotate right 8 bits */
- rotr[0] = rotr[1];
- rotr[1] = rotr[2];
- rotr[2] = rotr[3];
- rotr[3] = temp[0];
- xor_32(add1bf7, rotr, temp);
- xor_32(swap_halves, rotl, tempb);
- xor_32(temp, tempb, out);
-}
-
-static void aes128k128d(u8 *key, u8 *data, u8 *ciphertext)
-{
- sint round;
- sint i;
- u8 intermediatea[16];
- u8 intermediateb[16];
- u8 round_key[16];
-
- for (i = 0; i < 16; i++)
- round_key[i] = key[i];
- for (round = 0; round < 11; round++) {
- if (round == 0) {
- xor_128(round_key, data, ciphertext);
- next_key(round_key, round);
- } else if (round == 10) {
- byte_sub(ciphertext, intermediatea);
- shift_row(intermediatea, intermediateb);
- xor_128(intermediateb, round_key, ciphertext);
- } else { /* 1 - 9 */
- byte_sub(ciphertext, intermediatea);
- shift_row(intermediatea, intermediateb);
- mix_column(&intermediateb[0], &intermediatea[0]);
- mix_column(&intermediateb[4], &intermediatea[4]);
- mix_column(&intermediateb[8], &intermediatea[8]);
- mix_column(&intermediateb[12], &intermediatea[12]);
- xor_128(intermediatea, round_key, ciphertext);
- next_key(round_key, round);
- }
- }
-}
-
-/************************************************/
-/* construct_mic_iv() */
-/* Builds the MIC IV from header fields and PN */
-/************************************************/
-static void construct_mic_iv(u8 *mic_iv, sint qc_exists, sint a4_exists,
- u8 *mpdu, uint payload_length, u8 *pn_vector)
-{
- sint i;
-
- mic_iv[0] = 0x59;
- if (qc_exists && a4_exists)
- mic_iv[1] = mpdu[30] & 0x0f; /* QoS_TC */
- if (qc_exists && !a4_exists)
- mic_iv[1] = mpdu[24] & 0x0f; /* mute bits 7-4 */
- if (!qc_exists)
- mic_iv[1] = 0x00;
- for (i = 2; i < 8; i++)
- mic_iv[i] = mpdu[i + 8];
- for (i = 8; i < 14; i++)
- mic_iv[i] = pn_vector[13 - i]; /* mic_iv[8:13] = PN[5:0] */
- mic_iv[14] = (unsigned char)(payload_length / 256);
- mic_iv[15] = (unsigned char)(payload_length % 256);
-}
-
-/************************************************/
-/* construct_mic_header1() */
-/* Builds the first MIC header block from */
-/* header fields. */
-/************************************************/
-static void construct_mic_header1(u8 *mic_header1, sint header_length, u8 *mpdu)
-{
- mic_header1[0] = (u8)((header_length - 2) / 256);
- mic_header1[1] = (u8)((header_length - 2) % 256);
- mic_header1[2] = mpdu[0] & 0xcf; /* Mute CF poll & CF ack bits */
- /* Mute retry, more data and pwr mgt bits */
- mic_header1[3] = mpdu[1] & 0xc7;
- mic_header1[4] = mpdu[4]; /* A1 */
- mic_header1[5] = mpdu[5];
- mic_header1[6] = mpdu[6];
- mic_header1[7] = mpdu[7];
- mic_header1[8] = mpdu[8];
- mic_header1[9] = mpdu[9];
- mic_header1[10] = mpdu[10]; /* A2 */
- mic_header1[11] = mpdu[11];
- mic_header1[12] = mpdu[12];
- mic_header1[13] = mpdu[13];
- mic_header1[14] = mpdu[14];
- mic_header1[15] = mpdu[15];
-}
-
-/************************************************/
-/* construct_mic_header2() */
-/* Builds the last MIC header block from */
-/* header fields. */
-/************************************************/
-static void construct_mic_header2(u8 *mic_header2, u8 *mpdu, sint a4_exists,
- sint qc_exists)
-{
- sint i;
-
- for (i = 0; i < 16; i++)
- mic_header2[i] = 0x00;
- mic_header2[0] = mpdu[16]; /* A3 */
- mic_header2[1] = mpdu[17];
- mic_header2[2] = mpdu[18];
- mic_header2[3] = mpdu[19];
- mic_header2[4] = mpdu[20];
- mic_header2[5] = mpdu[21];
- mic_header2[6] = 0x00;
- mic_header2[7] = 0x00; /* mpdu[23]; */
- if (!qc_exists && a4_exists)
- for (i = 0; i < 6; i++)
- mic_header2[8 + i] = mpdu[24 + i]; /* A4 */
- if (qc_exists && !a4_exists) {
- mic_header2[8] = mpdu[24] & 0x0f; /* mute bits 15 - 4 */
- mic_header2[9] = mpdu[25] & 0x00;
- }
- if (qc_exists && a4_exists) {
- for (i = 0; i < 6; i++)
- mic_header2[8 + i] = mpdu[24 + i]; /* A4 */
- mic_header2[14] = mpdu[30] & 0x0f;
- mic_header2[15] = mpdu[31] & 0x00;
- }
-}
-
-/************************************************/
-/* construct_mic_header2() */
-/* Builds the last MIC header block from */
-/* header fields. */
-/************************************************/
-static void construct_ctr_preload(u8 *ctr_preload,
- sint a4_exists, sint qc_exists,
- u8 *mpdu, u8 *pn_vector, sint c)
-{
- sint i;
-
- for (i = 0; i < 16; i++)
- ctr_preload[i] = 0x00;
- i = 0;
- ctr_preload[0] = 0x01; /* flag */
- if (qc_exists && a4_exists)
- ctr_preload[1] = mpdu[30] & 0x0f;
- if (qc_exists && !a4_exists)
- ctr_preload[1] = mpdu[24] & 0x0f;
- for (i = 2; i < 8; i++)
- ctr_preload[i] = mpdu[i + 8];
- for (i = 8; i < 14; i++)
- ctr_preload[i] = pn_vector[13 - i];
- ctr_preload[14] = (unsigned char)(c / 256); /* Ctr */
- ctr_preload[15] = (unsigned char)(c % 256);
-}
-
-/************************************/
-/* bitwise_xor() */
-/* A 128 bit, bitwise exclusive or */
-/************************************/
-static void bitwise_xor(u8 *ina, u8 *inb, u8 *out)
-{
- sint i;
-
- for (i = 0; i < 16; i++)
- out[i] = ina[i] ^ inb[i];
-}
-
-static void aes_cipher(u8 *key, uint hdrlen,
- u8 *pframe, uint plen)
-{
- uint qc_exists, a4_exists, i, j, payload_remainder;
- uint num_blocks, payload_index;
-
- u8 pn_vector[6];
- u8 mic_iv[16];
- u8 mic_header1[16];
- u8 mic_header2[16];
- u8 ctr_preload[16];
-
- /* Intermediate Buffers */
- u8 chain_buffer[16];
- u8 aes_out[16];
- u8 padded_buffer[16];
- u8 mic[8];
- u16 frtype = GetFrameType(pframe);
- u16 frsubtype = GetFrameSubType(pframe);
-
- frsubtype >>= 4;
- memset((void *)mic_iv, 0, 16);
- memset((void *)mic_header1, 0, 16);
- memset((void *)mic_header2, 0, 16);
- memset((void *)ctr_preload, 0, 16);
- memset((void *)chain_buffer, 0, 16);
- memset((void *)aes_out, 0, 16);
- memset((void *)padded_buffer, 0, 16);
-
- if ((hdrlen == WLAN_HDR_A3_LEN) || (hdrlen == WLAN_HDR_A3_QOS_LEN))
- a4_exists = 0;
- else
- a4_exists = 1;
-
- if ((frtype == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA_CFACK)) ||
- (frtype == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA_CFPOLL)) ||
- (frtype == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA_CFACKPOLL))) {
- qc_exists = 1;
- if (hdrlen != WLAN_HDR_A3_QOS_LEN)
- hdrlen += 2;
- } else if ((frsubtype == 0x08) ||
- (frsubtype == 0x09) ||
- (frsubtype == 0x0a) ||
- (frsubtype == 0x0b)) {
- if (hdrlen != WLAN_HDR_A3_QOS_LEN)
- hdrlen += 2;
- qc_exists = 1;
- } else {
- qc_exists = 0;
- }
- pn_vector[0] = pframe[hdrlen];
- pn_vector[1] = pframe[hdrlen + 1];
- pn_vector[2] = pframe[hdrlen + 4];
- pn_vector[3] = pframe[hdrlen + 5];
- pn_vector[4] = pframe[hdrlen + 6];
- pn_vector[5] = pframe[hdrlen + 7];
- construct_mic_iv(mic_iv, qc_exists, a4_exists, pframe, plen, pn_vector);
- construct_mic_header1(mic_header1, hdrlen, pframe);
- construct_mic_header2(mic_header2, pframe, a4_exists, qc_exists);
- payload_remainder = plen % 16;
- num_blocks = plen / 16;
- /* Find start of payload */
- payload_index = hdrlen + 8;
- /* Calculate MIC */
- aes128k128d(key, mic_iv, aes_out);
- bitwise_xor(aes_out, mic_header1, chain_buffer);
- aes128k128d(key, chain_buffer, aes_out);
- bitwise_xor(aes_out, mic_header2, chain_buffer);
- aes128k128d(key, chain_buffer, aes_out);
- for (i = 0; i < num_blocks; i++) {
- bitwise_xor(aes_out, &pframe[payload_index], chain_buffer);
- payload_index += 16;
- aes128k128d(key, chain_buffer, aes_out);
- }
- /* Add on the final payload block if it needs padding */
- if (payload_remainder > 0) {
- for (j = 0; j < 16; j++)
- padded_buffer[j] = 0x00;
- for (j = 0; j < payload_remainder; j++)
- padded_buffer[j] = pframe[payload_index++];
- bitwise_xor(aes_out, padded_buffer, chain_buffer);
- aes128k128d(key, chain_buffer, aes_out);
- }
- for (j = 0; j < 8; j++)
- mic[j] = aes_out[j];
- /* Insert MIC into payload */
- for (j = 0; j < 8; j++)
- pframe[payload_index + j] = mic[j];
- payload_index = hdrlen + 8;
- for (i = 0; i < num_blocks; i++) {
- construct_ctr_preload(ctr_preload, a4_exists, qc_exists,
- pframe, pn_vector, i + 1);
- aes128k128d(key, ctr_preload, aes_out);
- bitwise_xor(aes_out, &pframe[payload_index], chain_buffer);
- for (j = 0; j < 16; j++)
- pframe[payload_index++] = chain_buffer[j];
- }
- if (payload_remainder > 0) { /* If short final block, then pad it,*/
- /* encrypt and copy unpadded part back */
- construct_ctr_preload(ctr_preload, a4_exists, qc_exists,
- pframe, pn_vector, num_blocks + 1);
- for (j = 0; j < 16; j++)
- padded_buffer[j] = 0x00;
- for (j = 0; j < payload_remainder; j++)
- padded_buffer[j] = pframe[payload_index + j];
- aes128k128d(key, ctr_preload, aes_out);
- bitwise_xor(aes_out, padded_buffer, chain_buffer);
- for (j = 0; j < payload_remainder; j++)
- pframe[payload_index++] = chain_buffer[j];
- }
- /* Encrypt the MIC */
- construct_ctr_preload(ctr_preload, a4_exists, qc_exists,
- pframe, pn_vector, 0);
- for (j = 0; j < 16; j++)
- padded_buffer[j] = 0x00;
- for (j = 0; j < 8; j++)
- padded_buffer[j] = pframe[j + hdrlen + 8 + plen];
- aes128k128d(key, ctr_preload, aes_out);
- bitwise_xor(aes_out, padded_buffer, chain_buffer);
- for (j = 0; j < 8; j++)
- pframe[payload_index++] = chain_buffer[j];
-}
-
-u32 r8712_aes_encrypt(struct _adapter *padapter, u8 *pxmitframe)
-{ /* exclude ICV */
- /* Intermediate Buffers */
- sint curfragnum, length;
- u8 *pframe, *prwskey;
- struct sta_info *stainfo;
- struct pkt_attrib *pattrib = &((struct xmit_frame *)
- pxmitframe)->attrib;
- struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
- u32 res = _SUCCESS;
-
- if (((struct xmit_frame *)pxmitframe)->buf_addr == NULL)
- return _FAIL;
- pframe = ((struct xmit_frame *)pxmitframe)->buf_addr + TXDESC_OFFSET;
- /* 4 start to encrypt each fragment */
- if (pattrib->encrypt == _AES_) {
- if (pattrib->psta)
- stainfo = pattrib->psta;
- else
- stainfo = r8712_get_stainfo(&padapter->stapriv,
- &pattrib->ra[0]);
- if (stainfo) {
- prwskey = &stainfo->x_UncstKey.skey[0];
- for (curfragnum = 0; curfragnum < pattrib->nr_frags;
- curfragnum++) {
- if ((curfragnum + 1) == pattrib->nr_frags) {
- length = pattrib->last_txcmdsz -
- pattrib->hdrlen -
- pattrib->iv_len -
- pattrib->icv_len;
- aes_cipher(prwskey, pattrib->hdrlen,
- pframe, length);
- } else {
- length = pxmitpriv->frag_len -
- pattrib->hdrlen -
- pattrib->iv_len -
- pattrib->icv_len;
- aes_cipher(prwskey, pattrib->hdrlen,
- pframe, length);
- pframe += pxmitpriv->frag_len;
- pframe = (u8 *)RND4((addr_t)(pframe));
- }
- }
- } else {
- res = _FAIL;
- }
- }
- return res;
-}
-
-static void aes_decipher(u8 *key, uint hdrlen,
- u8 *pframe, uint plen)
-{
- static u8 message[MAX_MSG_SIZE];
- uint qc_exists, a4_exists, i, j, payload_remainder;
- uint num_blocks, payload_index;
- u8 pn_vector[6];
- u8 mic_iv[16];
- u8 mic_header1[16];
- u8 mic_header2[16];
- u8 ctr_preload[16];
- /* Intermediate Buffers */
- u8 chain_buffer[16];
- u8 aes_out[16];
- u8 padded_buffer[16];
- u8 mic[8];
- uint frtype = GetFrameType(pframe);
- uint frsubtype = GetFrameSubType(pframe);
-
- frsubtype >>= 4;
- memset((void *)mic_iv, 0, 16);
- memset((void *)mic_header1, 0, 16);
- memset((void *)mic_header2, 0, 16);
- memset((void *)ctr_preload, 0, 16);
- memset((void *)chain_buffer, 0, 16);
- memset((void *)aes_out, 0, 16);
- memset((void *)padded_buffer, 0, 16);
- /* start to decrypt the payload */
- /*(plen including llc, payload and mic) */
- num_blocks = (plen - 8) / 16;
- payload_remainder = (plen - 8) % 16;
- pn_vector[0] = pframe[hdrlen];
- pn_vector[1] = pframe[hdrlen + 1];
- pn_vector[2] = pframe[hdrlen + 4];
- pn_vector[3] = pframe[hdrlen + 5];
- pn_vector[4] = pframe[hdrlen + 6];
- pn_vector[5] = pframe[hdrlen + 7];
- if ((hdrlen == WLAN_HDR_A3_LEN) || (hdrlen == WLAN_HDR_A3_QOS_LEN))
- a4_exists = 0;
- else
- a4_exists = 1;
- if ((frtype == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA_CFACK)) ||
- (frtype == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA_CFPOLL)) ||
- (frtype == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA_CFACKPOLL))) {
- qc_exists = 1;
- if (hdrlen != WLAN_HDR_A3_QOS_LEN)
- hdrlen += 2;
- } else if ((frsubtype == 0x08) ||
- (frsubtype == 0x09) ||
- (frsubtype == 0x0a) ||
- (frsubtype == 0x0b)) {
- if (hdrlen != WLAN_HDR_A3_QOS_LEN)
- hdrlen += 2;
- qc_exists = 1;
- } else {
- qc_exists = 0;
- }
- /* now, decrypt pframe with hdrlen offset and plen long */
- payload_index = hdrlen + 8; /* 8 is for extiv */
- for (i = 0; i < num_blocks; i++) {
- construct_ctr_preload(ctr_preload, a4_exists, qc_exists,
- pframe, pn_vector, i + 1);
- aes128k128d(key, ctr_preload, aes_out);
- bitwise_xor(aes_out, &pframe[payload_index], chain_buffer);
- for (j = 0; j < 16; j++)
- pframe[payload_index++] = chain_buffer[j];
- }
- if (payload_remainder > 0) { /* If short final block, pad it,*/
- /* encrypt it and copy the unpadded part back */
- construct_ctr_preload(ctr_preload, a4_exists, qc_exists,
- pframe, pn_vector, num_blocks + 1);
- for (j = 0; j < 16; j++)
- padded_buffer[j] = 0x00;
- for (j = 0; j < payload_remainder; j++)
- padded_buffer[j] = pframe[payload_index + j];
- aes128k128d(key, ctr_preload, aes_out);
- bitwise_xor(aes_out, padded_buffer, chain_buffer);
- for (j = 0; j < payload_remainder; j++)
- pframe[payload_index++] = chain_buffer[j];
- }
- /* start to calculate the mic */
- memcpy((void *)message, pframe, (hdrlen + plen + 8));
- pn_vector[0] = pframe[hdrlen];
- pn_vector[1] = pframe[hdrlen + 1];
- pn_vector[2] = pframe[hdrlen + 4];
- pn_vector[3] = pframe[hdrlen + 5];
- pn_vector[4] = pframe[hdrlen + 6];
- pn_vector[5] = pframe[hdrlen + 7];
- construct_mic_iv(mic_iv, qc_exists, a4_exists, message, plen - 8,
- pn_vector);
- construct_mic_header1(mic_header1, hdrlen, message);
- construct_mic_header2(mic_header2, message, a4_exists, qc_exists);
- payload_remainder = (plen - 8) % 16;
- num_blocks = (plen - 8) / 16;
- /* Find start of payload */
- payload_index = hdrlen + 8;
- /* Calculate MIC */
- aes128k128d(key, mic_iv, aes_out);
- bitwise_xor(aes_out, mic_header1, chain_buffer);
- aes128k128d(key, chain_buffer, aes_out);
- bitwise_xor(aes_out, mic_header2, chain_buffer);
- aes128k128d(key, chain_buffer, aes_out);
- for (i = 0; i < num_blocks; i++) {
- bitwise_xor(aes_out, &message[payload_index], chain_buffer);
- payload_index += 16;
- aes128k128d(key, chain_buffer, aes_out);
- }
- /* Add on the final payload block if it needs padding */
- if (payload_remainder > 0) {
- for (j = 0; j < 16; j++)
- padded_buffer[j] = 0x00;
- for (j = 0; j < payload_remainder; j++)
- padded_buffer[j] = message[payload_index++];
- bitwise_xor(aes_out, padded_buffer, chain_buffer);
- aes128k128d(key, chain_buffer, aes_out);
- }
- for (j = 0; j < 8; j++)
- mic[j] = aes_out[j];
- /* Insert MIC into payload */
- for (j = 0; j < 8; j++)
- message[payload_index + j] = mic[j];
- payload_index = hdrlen + 8;
- for (i = 0; i < num_blocks; i++) {
- construct_ctr_preload(ctr_preload, a4_exists, qc_exists,
- message, pn_vector, i + 1);
- aes128k128d(key, ctr_preload, aes_out);
- bitwise_xor(aes_out, &message[payload_index], chain_buffer);
- for (j = 0; j < 16; j++)
- message[payload_index++] = chain_buffer[j];
- }
- if (payload_remainder > 0) { /* If short final block, pad it,*/
- /* encrypt and copy unpadded part back */
- construct_ctr_preload(ctr_preload, a4_exists, qc_exists,
- message, pn_vector, num_blocks + 1);
- for (j = 0; j < 16; j++)
- padded_buffer[j] = 0x00;
- for (j = 0; j < payload_remainder; j++)
- padded_buffer[j] = message[payload_index + j];
- aes128k128d(key, ctr_preload, aes_out);
- bitwise_xor(aes_out, padded_buffer, chain_buffer);
- for (j = 0; j < payload_remainder; j++)
- message[payload_index++] = chain_buffer[j];
- }
- /* Encrypt the MIC */
- construct_ctr_preload(ctr_preload, a4_exists, qc_exists, message,
- pn_vector, 0);
- for (j = 0; j < 16; j++)
- padded_buffer[j] = 0x00;
- for (j = 0; j < 8; j++)
- padded_buffer[j] = message[j + hdrlen + plen];
- aes128k128d(key, ctr_preload, aes_out);
- bitwise_xor(aes_out, padded_buffer, chain_buffer);
- for (j = 0; j < 8; j++)
- message[payload_index++] = chain_buffer[j];
- /* compare the mic */
-}
-
-void r8712_aes_decrypt(struct _adapter *padapter, u8 *precvframe)
-{ /* exclude ICV */
- /* Intermediate Buffers */
- sint length;
- u8 *pframe, *prwskey, *iv, idx;
- struct sta_info *stainfo;
- struct rx_pkt_attrib *prxattrib = &((union recv_frame *)
- precvframe)->u.hdr.attrib;
- struct security_priv *psecuritypriv = &padapter->securitypriv;
-
- pframe = (unsigned char *)((union recv_frame *)precvframe)->
- u.hdr.rx_data;
- /* 4 start to encrypt each fragment */
- if (prxattrib->encrypt == _AES_) {
- stainfo = r8712_get_stainfo(&padapter->stapriv,
- &prxattrib->ta[0]);
- if (stainfo) {
- if (is_multicast_ether_addr(prxattrib->ra)) {
- iv = pframe + prxattrib->hdrlen;
- idx = iv[3];
- prwskey = &psecuritypriv->XGrpKey[
- ((idx >> 6) & 0x3) - 1].skey[0];
- if (!psecuritypriv->binstallGrpkey)
- return;
-
- } else {
- prwskey = &stainfo->x_UncstKey.skey[0];
- }
- length = ((union recv_frame *)precvframe)->
- u.hdr.len - prxattrib->hdrlen -
- prxattrib->iv_len;
- aes_decipher(prwskey, prxattrib->hdrlen, pframe,
- length);
- }
- }
-}
-
-void r8712_use_tkipkey_handler(struct timer_list *t)
-{
- struct _adapter *padapter =
- from_timer(padapter, t, securitypriv.tkip_timer);
-
- padapter->securitypriv.busetkipkey = true;
-}
--- a/drivers/staging/rtl8712/rtl871x_security.h
+++ /dev/null
@@ -1,218 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL871X_SECURITY_H_
-#define __RTL871X_SECURITY_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-#define _NO_PRIVACY_ 0x0
-#define _WEP40_ 0x1
-#define _TKIP_ 0x2
-#define _TKIP_WTMIC_ 0x3
-#define _AES_ 0x4
-#define _WEP104_ 0x5
-
-#define _WPA_IE_ID_ 0xdd
-#define _WPA2_IE_ID_ 0x30
-
-#ifndef Ndis802_11AuthModeWPA2
-#define Ndis802_11AuthModeWPA2 (Ndis802_11AuthModeWPANone + 1)
-#endif
-
-#ifndef Ndis802_11AuthModeWPA2PSK
-#define Ndis802_11AuthModeWPA2PSK (Ndis802_11AuthModeWPANone + 2)
-#endif
-
-union pn48 {
- u64 val;
-#if defined(__BIG_ENDIAN)
- struct {
- u8 TSC7;
- u8 TSC6;
- u8 TSC5;
- u8 TSC4;
- u8 TSC3;
- u8 TSC2;
- u8 TSC1;
- u8 TSC0;
- } _byte_;
-#else
- struct {
- u8 TSC0;
- u8 TSC1;
- u8 TSC2;
- u8 TSC3;
- u8 TSC4;
- u8 TSC5;
- u8 TSC6;
- u8 TSC7;
- } _byte_;
-#endif
-};
-
-union Keytype {
- u8 skey[16];
- u32 lkey[4];
-};
-
-struct RT_PMKID_LIST {
- u8 bUsed;
- u8 Bssid[6];
- u8 PMKID[16];
- u8 SsidBuf[33];
- u8 *ssid_octet;
- u16 ssid_length;
-};
-
-struct security_priv {
- u32 AuthAlgrthm; /* 802.11 auth, could be open, shared,
- * 8021x and authswitch
- */
- u32 PrivacyAlgrthm; /* This specify the privacy for shared
- * auth. algorithm.
- */
- u32 PrivacyKeyIndex; /* this is only valid for legendary
- * wep, 0~3 for key id.
- */
- union Keytype DefKey[4]; /* this is only valid for def. key */
- u32 DefKeylen[4];
- u32 XGrpPrivacy; /* This specify the privacy algthm.
- * used for Grp key
- */
- u32 XGrpKeyid; /* key id used for Grp Key */
- union Keytype XGrpKey[2]; /* 802.1x Group Key, for
- * inx0 and inx1
- */
- union Keytype XGrptxmickey[2];
- union Keytype XGrprxmickey[2];
- union pn48 Grptxpn; /* PN48 used for Grp Key xmit. */
- union pn48 Grprxpn; /* PN48 used for Grp Key recv. */
- u8 wps_hw_pbc_pressed;/*for hw pbc pressed*/
- u8 wps_phase;/*for wps*/
- u8 wps_ie[MAX_WPA_IE_LEN << 2];
- int wps_ie_len;
- u8 binstallGrpkey;
- u8 busetkipkey;
- struct timer_list tkip_timer;
- u8 bcheck_grpkey;
- u8 bgrpkey_handshake;
- s32 sw_encrypt; /* from registry_priv */
- s32 sw_decrypt; /* from registry_priv */
- s32 hw_decrypted; /* if the rx packets is hw_decrypted==false,
- * it means the hw has not been ready.
- */
- u32 ndisauthtype; /* keeps the auth_type & enc_status from upper
- * layer ioctl(wpa_supplicant or wzc)
- */
- u32 ndisencryptstatus;
- struct wlan_bssid_ex sec_bss; /* for joinbss (h2c buffer) usage */
- struct NDIS_802_11_WEP ndiswep;
- u8 assoc_info[600];
- u8 szofcapability[256]; /* for wpa2 usage */
- u8 oidassociation[512]; /* for wpa/wpa2 usage */
- u8 authenticator_ie[256]; /* store ap security information element */
- u8 supplicant_ie[256]; /* store sta security information element */
- /* for tkip countermeasure */
- u32 last_mic_err_time;
- u8 btkip_countermeasure;
- u8 btkip_wait_report;
- u32 btkip_countermeasure_time;
- /*-------------------------------------------------------------------
- * For WPA2 Pre-Authentication.
- *------------------------------------------------------------------
- **/
- struct RT_PMKID_LIST PMKIDList[NUM_PMKID_CACHE];
- u8 PMKIDIndex;
-};
-
-#define GET_ENCRY_ALGO(psecuritypriv, psta, encry_algo, bmcst) \
-do { \
- switch (psecuritypriv->AuthAlgrthm) { \
- case 0: \
- case 1: \
- case 3: \
- encry_algo = (u8)psecuritypriv->PrivacyAlgrthm; \
- break; \
- case 2: \
- if (bmcst) \
- encry_algo = (u8)psecuritypriv->XGrpPrivacy; \
- else \
- encry_algo = (u8)psta->XPrivacy; \
- break; \
- } \
-} while (0)
-#define SET_ICE_IV_LEN(iv_len, icv_len, encrypt)\
-do {\
- switch (encrypt) { \
- case _WEP40_: \
- case _WEP104_: \
- iv_len = 4; \
- icv_len = 4; \
- break; \
- case _TKIP_: \
- iv_len = 8; \
- icv_len = 4; \
- break; \
- case _AES_: \
- iv_len = 8; \
- icv_len = 8; \
- break; \
- default: \
- iv_len = 0; \
- icv_len = 0; \
- break; \
- } \
-} while (0)
-#define GET_TKIP_PN(iv, txpn) \
-do {\
- txpn._byte_.TSC0 = iv[2];\
- txpn._byte_.TSC1 = iv[0];\
- txpn._byte_.TSC2 = iv[4];\
- txpn._byte_.TSC3 = iv[5];\
- txpn._byte_.TSC4 = iv[6];\
- txpn._byte_.TSC5 = iv[7];\
-} while (0)
-
-#define ROL32(A, n) (((A) << (n)) | (((A) >> (32 - (n))) & ((1UL << (n)) - 1)))
-#define ROR32(A, n) ROL32((A), 32 - (n))
-
-struct mic_data {
- u32 K0, K1; /* Key */
- u32 L, R; /* Current state */
- u32 M; /* Message accumulator (single word) */
- u32 nBytesInM; /* # bytes in M */
-};
-
-void seccalctkipmic(
- u8 *key,
- u8 *header,
- u8 *data,
- u32 data_len,
- u8 *Miccode,
- u8 priority);
-
-void r8712_secmicsetkey(struct mic_data *pmicdata, u8 *key);
-void r8712_secmicappend(struct mic_data *pmicdata, u8 *src, u32 nBytes);
-void r8712_secgetmic(struct mic_data *pmicdata, u8 *dst);
-u32 r8712_aes_encrypt(struct _adapter *padapter, u8 *pxmitframe);
-u32 r8712_tkip_encrypt(struct _adapter *padapter, u8 *pxmitframe);
-void r8712_wep_encrypt(struct _adapter *padapter, u8 *pxmitframe);
-void r8712_aes_decrypt(struct _adapter *padapter, u8 *precvframe);
-void r8712_tkip_decrypt(struct _adapter *padapter, u8 *precvframe);
-void r8712_wep_decrypt(struct _adapter *padapter, u8 *precvframe);
-void r8712_use_tkipkey_handler(struct timer_list *t);
-
-#endif /*__RTL871X_SECURITY_H_ */
-
--- a/drivers/staging/rtl8712/rtl871x_sta_mgt.c
+++ /dev/null
@@ -1,263 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_sta_mgt.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL871X_STA_MGT_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "recv_osdep.h"
-#include "xmit_osdep.h"
-#include "sta_info.h"
-
-static void _init_stainfo(struct sta_info *psta)
-{
- memset((u8 *)psta, 0, sizeof(struct sta_info));
- spin_lock_init(&psta->lock);
- INIT_LIST_HEAD(&psta->list);
- INIT_LIST_HEAD(&psta->hash_list);
- _r8712_init_sta_xmit_priv(&psta->sta_xmitpriv);
- _r8712_init_sta_recv_priv(&psta->sta_recvpriv);
- INIT_LIST_HEAD(&psta->asoc_list);
- INIT_LIST_HEAD(&psta->auth_list);
-}
-
-int _r8712_init_sta_priv(struct sta_priv *pstapriv)
-{
- struct sta_info *psta;
- s32 i;
-
- pstapriv->pallocated_stainfo_buf = kmalloc(sizeof(struct sta_info) *
- NUM_STA + 4, GFP_ATOMIC);
- if (!pstapriv->pallocated_stainfo_buf)
- return -ENOMEM;
- pstapriv->pstainfo_buf = pstapriv->pallocated_stainfo_buf + 4 -
- ((addr_t)(pstapriv->pallocated_stainfo_buf) & 3);
- _init_queue(&pstapriv->free_sta_queue);
- spin_lock_init(&pstapriv->sta_hash_lock);
- pstapriv->asoc_sta_count = 0;
- _init_queue(&pstapriv->sleep_q);
- _init_queue(&pstapriv->wakeup_q);
- psta = (struct sta_info *)(pstapriv->pstainfo_buf);
- for (i = 0; i < NUM_STA; i++) {
- _init_stainfo(psta);
- INIT_LIST_HEAD(&(pstapriv->sta_hash[i]));
- list_add_tail(&psta->list, &pstapriv->free_sta_queue.queue);
- psta++;
- }
- INIT_LIST_HEAD(&pstapriv->asoc_list);
- INIT_LIST_HEAD(&pstapriv->auth_list);
- return 0;
-}
-
-/* this function is used to free the memory of lock || sema for all stainfos */
-static void mfree_all_stainfo(struct sta_priv *pstapriv)
-{
- unsigned long irqL;
- struct list_head *plist, *phead;
-
- spin_lock_irqsave(&pstapriv->sta_hash_lock, irqL);
- phead = &pstapriv->free_sta_queue.queue;
- plist = phead->next;
- while (!end_of_queue_search(phead, plist))
- plist = plist->next;
-
- spin_unlock_irqrestore(&pstapriv->sta_hash_lock, irqL);
-}
-
-void _r8712_free_sta_priv(struct sta_priv *pstapriv)
-{
- if (pstapriv) {
- /* be done before free sta_hash_lock */
- mfree_all_stainfo(pstapriv);
- kfree(pstapriv->pallocated_stainfo_buf);
- }
-}
-
-struct sta_info *r8712_alloc_stainfo(struct sta_priv *pstapriv, u8 *hwaddr)
-{
- s32 index;
- struct list_head *phash_list;
- struct sta_info *psta;
- struct __queue *pfree_sta_queue;
- struct recv_reorder_ctrl *preorder_ctrl;
- int i = 0;
- u16 wRxSeqInitialValue = 0xffff;
- unsigned long flags;
-
- pfree_sta_queue = &pstapriv->free_sta_queue;
- spin_lock_irqsave(&pfree_sta_queue->lock, flags);
- psta = list_first_entry_or_null(&pfree_sta_queue->queue,
- struct sta_info, list);
- if (psta) {
- list_del_init(&psta->list);
- _init_stainfo(psta);
- memcpy(psta->hwaddr, hwaddr, ETH_ALEN);
- index = wifi_mac_hash(hwaddr);
- if (index >= NUM_STA) {
- psta = NULL;
- goto exit;
- }
- phash_list = &pstapriv->sta_hash[index];
- list_add_tail(&psta->hash_list, phash_list);
- pstapriv->asoc_sta_count++;
-
-/* For the SMC router, the sequence number of first packet of WPS handshake
- * will be 0. In this case, this packet will be dropped by recv_decache function
- * if we use the 0x00 as the default value for tid_rxseq variable. So, we
- * initialize the tid_rxseq variable as the 0xffff.
- */
- for (i = 0; i < 16; i++)
- memcpy(&psta->sta_recvpriv.rxcache.tid_rxseq[i],
- &wRxSeqInitialValue, 2);
- /* for A-MPDU Rx reordering buffer control */
- for (i = 0; i < 16; i++) {
- preorder_ctrl = &psta->recvreorder_ctrl[i];
- preorder_ctrl->padapter = pstapriv->padapter;
- preorder_ctrl->indicate_seq = 0xffff;
- preorder_ctrl->wend_b = 0xffff;
- preorder_ctrl->wsize_b = 64;
- _init_queue(&preorder_ctrl->pending_recvframe_queue);
- r8712_init_recv_timer(preorder_ctrl);
- }
- }
-exit:
- spin_unlock_irqrestore(&pfree_sta_queue->lock, flags);
- return psta;
-}
-
-/* using pstapriv->sta_hash_lock to protect */
-void r8712_free_stainfo(struct _adapter *padapter, struct sta_info *psta)
-{
- int i;
- unsigned long irqL0;
- struct __queue *pfree_sta_queue;
- struct recv_reorder_ctrl *preorder_ctrl;
- struct sta_xmit_priv *pstaxmitpriv;
- struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
- struct sta_priv *pstapriv = &padapter->stapriv;
-
- if (!psta)
- return;
- pfree_sta_queue = &pstapriv->free_sta_queue;
- pstaxmitpriv = &psta->sta_xmitpriv;
- spin_lock_irqsave(&(pxmitpriv->vo_pending.lock), irqL0);
- r8712_free_xmitframe_queue(pxmitpriv, &pstaxmitpriv->vo_q.sta_pending);
- list_del_init(&(pstaxmitpriv->vo_q.tx_pending));
- spin_unlock_irqrestore(&(pxmitpriv->vo_pending.lock), irqL0);
- spin_lock_irqsave(&(pxmitpriv->vi_pending.lock), irqL0);
- r8712_free_xmitframe_queue(pxmitpriv, &pstaxmitpriv->vi_q.sta_pending);
- list_del_init(&(pstaxmitpriv->vi_q.tx_pending));
- spin_unlock_irqrestore(&(pxmitpriv->vi_pending.lock), irqL0);
- spin_lock_irqsave(&(pxmitpriv->bk_pending.lock), irqL0);
- r8712_free_xmitframe_queue(pxmitpriv, &pstaxmitpriv->bk_q.sta_pending);
- list_del_init(&(pstaxmitpriv->bk_q.tx_pending));
- spin_unlock_irqrestore(&(pxmitpriv->bk_pending.lock), irqL0);
- spin_lock_irqsave(&(pxmitpriv->be_pending.lock), irqL0);
- r8712_free_xmitframe_queue(pxmitpriv, &pstaxmitpriv->be_q.sta_pending);
- list_del_init(&(pstaxmitpriv->be_q.tx_pending));
- spin_unlock_irqrestore(&(pxmitpriv->be_pending.lock), irqL0);
- list_del_init(&psta->hash_list);
- pstapriv->asoc_sta_count--;
- /* re-init sta_info; 20061114 */
- _r8712_init_sta_xmit_priv(&psta->sta_xmitpriv);
- _r8712_init_sta_recv_priv(&psta->sta_recvpriv);
- /* for A-MPDU Rx reordering buffer control,
- * cancel reordering_ctrl_timer
- */
- for (i = 0; i < 16; i++) {
- preorder_ctrl = &psta->recvreorder_ctrl[i];
- del_timer(&preorder_ctrl->reordering_ctrl_timer);
- }
- spin_lock(&(pfree_sta_queue->lock));
- /* insert into free_sta_queue; 20061114 */
- list_add_tail(&psta->list, &pfree_sta_queue->queue);
- spin_unlock(&(pfree_sta_queue->lock));
-}
-
-/* free all stainfo which in sta_hash[all] */
-void r8712_free_all_stainfo(struct _adapter *padapter)
-{
- unsigned long irqL;
- struct list_head *plist, *phead;
- s32 index;
- struct sta_info *psta = NULL;
- struct sta_priv *pstapriv = &padapter->stapriv;
- struct sta_info *pbcmc_stainfo = r8712_get_bcmc_stainfo(padapter);
-
- if (pstapriv->asoc_sta_count == 1)
- return;
- spin_lock_irqsave(&pstapriv->sta_hash_lock, irqL);
- for (index = 0; index < NUM_STA; index++) {
- phead = &(pstapriv->sta_hash[index]);
- plist = phead->next;
- while (!end_of_queue_search(phead, plist)) {
- psta = container_of(plist,
- struct sta_info, hash_list);
- plist = plist->next;
- if (pbcmc_stainfo != psta)
- r8712_free_stainfo(padapter, psta);
- }
- }
- spin_unlock_irqrestore(&pstapriv->sta_hash_lock, irqL);
-}
-
-/* any station allocated can be searched by hash list */
-struct sta_info *r8712_get_stainfo(struct sta_priv *pstapriv, u8 *hwaddr)
-{
- unsigned long irqL;
- struct list_head *plist, *phead;
- struct sta_info *psta = NULL;
- u32 index;
-
- if (!hwaddr)
- return NULL;
- index = wifi_mac_hash(hwaddr);
- spin_lock_irqsave(&pstapriv->sta_hash_lock, irqL);
- phead = &(pstapriv->sta_hash[index]);
- plist = phead->next;
- while (!end_of_queue_search(phead, plist)) {
- psta = container_of(plist, struct sta_info, hash_list);
- if ((!memcmp(psta->hwaddr, hwaddr, ETH_ALEN))) {
- /* if found the matched address */
- break;
- }
- psta = NULL;
- plist = plist->next;
- }
- spin_unlock_irqrestore(&pstapriv->sta_hash_lock, irqL);
- return psta;
-}
-
-void r8712_init_bcmc_stainfo(struct _adapter *padapter)
-{
- unsigned char bcast_addr[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
- struct sta_priv *pstapriv = &padapter->stapriv;
-
- r8712_alloc_stainfo(pstapriv, bcast_addr);
-}
-
-struct sta_info *r8712_get_bcmc_stainfo(struct _adapter *padapter)
-{
- struct sta_priv *pstapriv = &padapter->stapriv;
- u8 bc_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-
- return r8712_get_stainfo(pstapriv, bc_addr);
-}
-
-u8 r8712_access_ctrl(struct wlan_acl_pool *pacl_list, u8 *mac_addr)
-{
- return true;
-}
--- a/drivers/staging/rtl8712/rtl871x_wlan_sme.h
+++ /dev/null
@@ -1,35 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _RTL871X_WLAN_SME_H_
-#define _RTL871X_WLAN_SME_H_
-
-#define MSR_APMODE 0x0C
-#define MSR_STAMODE 0x08
-#define MSR_ADHOCMODE 0x04
-#define MSR_NOLINKMODE 0x00
-#define _1M_RATE_ 0
-#define _2M_RATE_ 1
-#define _5M_RATE_ 2
-#define _11M_RATE_ 3
-#define _6M_RATE_ 4
-#define _9M_RATE_ 5
-#define _12M_RATE_ 6
-#define _18M_RATE_ 7
-#define _24M_RATE_ 8
-#define _36M_RATE_ 9
-#define _48M_RATE_ 10
-#define _54M_RATE_ 11
-
-#endif
-
--- a/drivers/staging/rtl8712/rtl871x_xmit.c
+++ /dev/null
@@ -1,1059 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_xmit.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL871X_XMIT_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "osdep_intf.h"
-#include "usb_ops.h"
-
-#include <linux/usb.h>
-#include <linux/ieee80211.h>
-
-static const u8 P802_1H_OUI[P80211_OUI_LEN] = {0x00, 0x00, 0xf8};
-static const u8 RFC1042_OUI[P80211_OUI_LEN] = {0x00, 0x00, 0x00};
-static void init_hwxmits(struct hw_xmit *phwxmit, sint entry);
-static void alloc_hwxmits(struct _adapter *padapter);
-static void free_hwxmits(struct _adapter *padapter);
-
-static void _init_txservq(struct tx_servq *ptxservq)
-{
- INIT_LIST_HEAD(&ptxservq->tx_pending);
- _init_queue(&ptxservq->sta_pending);
- ptxservq->qcnt = 0;
-}
-
-void _r8712_init_sta_xmit_priv(struct sta_xmit_priv *psta_xmitpriv)
-{
- memset((unsigned char *)psta_xmitpriv, 0,
- sizeof(struct sta_xmit_priv));
- spin_lock_init(&psta_xmitpriv->lock);
- _init_txservq(&psta_xmitpriv->be_q);
- _init_txservq(&psta_xmitpriv->bk_q);
- _init_txservq(&psta_xmitpriv->vi_q);
- _init_txservq(&psta_xmitpriv->vo_q);
- INIT_LIST_HEAD(&psta_xmitpriv->legacy_dz);
- INIT_LIST_HEAD(&psta_xmitpriv->apsd);
-}
-
-int _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv,
- struct _adapter *padapter)
-{
- sint i;
- struct xmit_buf *pxmitbuf;
- struct xmit_frame *pxframe;
- int j;
-
- memset((unsigned char *)pxmitpriv, 0, sizeof(struct xmit_priv));
- spin_lock_init(&pxmitpriv->lock);
- /*
- *Please insert all the queue initialization using _init_queue below
- */
- pxmitpriv->adapter = padapter;
- _init_queue(&pxmitpriv->be_pending);
- _init_queue(&pxmitpriv->bk_pending);
- _init_queue(&pxmitpriv->vi_pending);
- _init_queue(&pxmitpriv->vo_pending);
- _init_queue(&pxmitpriv->bm_pending);
- _init_queue(&pxmitpriv->legacy_dz_queue);
- _init_queue(&pxmitpriv->apsd_queue);
- _init_queue(&pxmitpriv->free_xmit_queue);
- /*
- * Please allocate memory with sz = (struct xmit_frame) * NR_XMITFRAME,
- * and initialize free_xmit_frame below.
- * Please also apply free_txobj to link_up all the xmit_frames...
- */
- pxmitpriv->pallocated_frame_buf =
- kmalloc(NR_XMITFRAME * sizeof(struct xmit_frame) + 4,
- GFP_ATOMIC);
- if (!pxmitpriv->pallocated_frame_buf) {
- pxmitpriv->pxmit_frame_buf = NULL;
- return -ENOMEM;
- }
- pxmitpriv->pxmit_frame_buf = pxmitpriv->pallocated_frame_buf + 4 -
- ((addr_t) (pxmitpriv->pallocated_frame_buf) & 3);
- pxframe = (struct xmit_frame *) pxmitpriv->pxmit_frame_buf;
- for (i = 0; i < NR_XMITFRAME; i++) {
- INIT_LIST_HEAD(&(pxframe->list));
- pxframe->padapter = padapter;
- pxframe->frame_tag = DATA_FRAMETAG;
- pxframe->pkt = NULL;
- pxframe->buf_addr = NULL;
- pxframe->pxmitbuf = NULL;
- list_add_tail(&(pxframe->list),
- &(pxmitpriv->free_xmit_queue.queue));
- pxframe++;
- }
- pxmitpriv->free_xmitframe_cnt = NR_XMITFRAME;
- /*
- * init xmit hw_txqueue
- */
- _r8712_init_hw_txqueue(&pxmitpriv->be_txqueue, BE_QUEUE_INX);
- _r8712_init_hw_txqueue(&pxmitpriv->bk_txqueue, BK_QUEUE_INX);
- _r8712_init_hw_txqueue(&pxmitpriv->vi_txqueue, VI_QUEUE_INX);
- _r8712_init_hw_txqueue(&pxmitpriv->vo_txqueue, VO_QUEUE_INX);
- _r8712_init_hw_txqueue(&pxmitpriv->bmc_txqueue, BMC_QUEUE_INX);
- pxmitpriv->frag_len = MAX_FRAG_THRESHOLD;
- pxmitpriv->txirp_cnt = 1;
- /*per AC pending irp*/
- pxmitpriv->beq_cnt = 0;
- pxmitpriv->bkq_cnt = 0;
- pxmitpriv->viq_cnt = 0;
- pxmitpriv->voq_cnt = 0;
- /*init xmit_buf*/
- _init_queue(&pxmitpriv->free_xmitbuf_queue);
- _init_queue(&pxmitpriv->pending_xmitbuf_queue);
- pxmitpriv->pallocated_xmitbuf =
- kmalloc(NR_XMITBUFF * sizeof(struct xmit_buf) + 4, GFP_ATOMIC);
- if (!pxmitpriv->pallocated_xmitbuf)
- goto clean_up_frame_buf;
- pxmitpriv->pxmitbuf = pxmitpriv->pallocated_xmitbuf + 4 -
- ((addr_t)(pxmitpriv->pallocated_xmitbuf) & 3);
- pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmitbuf;
- for (i = 0; i < NR_XMITBUFF; i++) {
- INIT_LIST_HEAD(&pxmitbuf->list);
- pxmitbuf->pallocated_buf =
- kmalloc(MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ, GFP_ATOMIC);
- if (!pxmitbuf->pallocated_buf) {
- j = 0;
- goto clean_up_alloc_buf;
- }
- pxmitbuf->pbuf = pxmitbuf->pallocated_buf + XMITBUF_ALIGN_SZ -
- ((addr_t) (pxmitbuf->pallocated_buf) &
- (XMITBUF_ALIGN_SZ - 1));
- if (r8712_xmit_resource_alloc(padapter, pxmitbuf)) {
- j = 1;
- goto clean_up_alloc_buf;
- }
- list_add_tail(&pxmitbuf->list,
- &(pxmitpriv->free_xmitbuf_queue.queue));
- pxmitbuf++;
- }
- pxmitpriv->free_xmitbuf_cnt = NR_XMITBUFF;
- INIT_WORK(&padapter->wk_filter_rx_ff0, r8712_SetFilter);
- alloc_hwxmits(padapter);
- init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
- tasklet_setup(&pxmitpriv->xmit_tasklet, r8712_xmit_bh);
- return 0;
-
-clean_up_alloc_buf:
- if (j) {
- /* failure happened in r8712_xmit_resource_alloc()
- * delete extra pxmitbuf->pallocated_buf
- */
- kfree(pxmitbuf->pallocated_buf);
- }
- for (j = 0; j < i; j++) {
- int k;
-
- pxmitbuf--; /* reset pointer */
- kfree(pxmitbuf->pallocated_buf);
- for (k = 0; k < 8; k++) /* delete xmit urb's */
- usb_free_urb(pxmitbuf->pxmit_urb[k]);
- }
- kfree(pxmitpriv->pallocated_xmitbuf);
- pxmitpriv->pallocated_xmitbuf = NULL;
-clean_up_frame_buf:
- kfree(pxmitpriv->pallocated_frame_buf);
- pxmitpriv->pallocated_frame_buf = NULL;
- return -ENOMEM;
-}
-
-void _free_xmit_priv(struct xmit_priv *pxmitpriv)
-{
- int i;
- struct _adapter *padapter = pxmitpriv->adapter;
- struct xmit_frame *pxmitframe = (struct xmit_frame *)
- pxmitpriv->pxmit_frame_buf;
- struct xmit_buf *pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmitbuf;
-
- if (!pxmitpriv->pxmit_frame_buf)
- return;
- for (i = 0; i < NR_XMITFRAME; i++) {
- r8712_xmit_complete(padapter, pxmitframe);
- pxmitframe++;
- }
- for (i = 0; i < NR_XMITBUFF; i++) {
- r8712_xmit_resource_free(padapter, pxmitbuf);
- kfree(pxmitbuf->pallocated_buf);
- pxmitbuf++;
- }
- kfree(pxmitpriv->pallocated_frame_buf);
- kfree(pxmitpriv->pallocated_xmitbuf);
- free_hwxmits(padapter);
-}
-
-int r8712_update_attrib(struct _adapter *padapter, _pkt *pkt,
- struct pkt_attrib *pattrib)
-{
- struct pkt_file pktfile;
- struct sta_info *psta = NULL;
- struct ethhdr etherhdr;
-
- struct tx_cmd txdesc;
-
- bool bmcast;
- struct sta_priv *pstapriv = &padapter->stapriv;
- struct security_priv *psecuritypriv = &padapter->securitypriv;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct qos_priv *pqospriv = &pmlmepriv->qospriv;
-
- _r8712_open_pktfile(pkt, &pktfile);
-
- _r8712_pktfile_read(&pktfile, (unsigned char *)ðerhdr, ETH_HLEN);
-
- pattrib->ether_type = ntohs(etherhdr.h_proto);
-
- /*
- * If driver xmit ARP packet, driver can set ps mode to initial
- * setting. It stands for getting DHCP or fix IP.
- */
- if (pattrib->ether_type == 0x0806) {
- if (padapter->pwrctrlpriv.pwr_mode !=
- padapter->registrypriv.power_mgnt) {
- del_timer_sync(&pmlmepriv->dhcp_timer);
- r8712_set_ps_mode(padapter,
- padapter->registrypriv.power_mgnt,
- padapter->registrypriv.smart_ps);
- }
- }
-
- memcpy(pattrib->dst, ðerhdr.h_dest, ETH_ALEN);
- memcpy(pattrib->src, ðerhdr.h_source, ETH_ALEN);
- pattrib->pctrl = 0;
- if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) ||
- check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) {
- memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
- memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
- } else if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) {
- memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
- memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
- } else if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
- memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
- memcpy(pattrib->ta, get_bssid(pmlmepriv), ETH_ALEN);
- } else if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) {
- /*firstly, filter packet not belongs to mp*/
- if (pattrib->ether_type != 0x8712)
- return -EINVAL;
- /* for mp storing the txcmd per packet,
- * according to the info of txcmd to update pattrib
- */
- /*get MP_TXDESC_SIZE bytes txcmd per packet*/
- _r8712_pktfile_read(&pktfile, (u8 *)&txdesc, TXDESC_SIZE);
- memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
- memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
- pattrib->pctrl = 1;
- }
- /* r8712_xmitframe_coalesce() overwrite this!*/
- pattrib->pktlen = pktfile.pkt_len;
- if (pattrib->ether_type == ETH_P_IP) {
- /* The following is for DHCP and ARP packet, we use cck1M to
- * tx these packets and let LPS awake some time
- * to prevent DHCP protocol fail
- */
- u8 tmp[24];
-
- _r8712_pktfile_read(&pktfile, &tmp[0], 24);
- pattrib->dhcp_pkt = 0;
- if (pktfile.pkt_len > 282) {/*MINIMUM_DHCP_PACKET_SIZE)*/
- if (pattrib->ether_type == ETH_P_IP) {/* IP header*/
- if (((tmp[21] == 68) && (tmp[23] == 67)) ||
- ((tmp[21] == 67) && (tmp[23] == 68))) {
- /* 68 : UDP BOOTP client
- * 67 : UDP BOOTP server
- * Use low rate to send DHCP packet.
- */
- pattrib->dhcp_pkt = 1;
- }
- }
- }
- }
- bmcast = is_multicast_ether_addr(pattrib->ra);
- /* get sta_info*/
- if (bmcast) {
- psta = r8712_get_bcmc_stainfo(padapter);
- pattrib->mac_id = 4;
- } else {
- if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) {
- psta = r8712_get_stainfo(pstapriv,
- get_bssid(pmlmepriv));
- pattrib->mac_id = 5;
- } else {
- psta = r8712_get_stainfo(pstapriv, pattrib->ra);
- if (!psta) /* drop the pkt */
- return -ENOMEM;
- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE))
- pattrib->mac_id = 5;
- else
- pattrib->mac_id = psta->mac_id;
- }
- }
-
- if (psta) {
- pattrib->psta = psta;
- } else {
- /* if we cannot get psta => drrp the pkt */
- return -ENOMEM;
- }
-
- pattrib->ack_policy = 0;
- /* get ether_hdr_len */
- pattrib->pkt_hdrlen = ETH_HLEN;
-
- if (pqospriv->qos_option) {
- r8712_set_qos(&pktfile, pattrib);
- } else {
- pattrib->hdrlen = WLAN_HDR_A3_LEN;
- pattrib->subtype = IEEE80211_FTYPE_DATA;
- pattrib->priority = 0;
- }
- if (psta->ieee8021x_blocked) {
- pattrib->encrypt = 0;
- if ((pattrib->ether_type != 0x888e) &&
- !check_fwstate(pmlmepriv, WIFI_MP_STATE))
- return -EINVAL;
- } else {
- GET_ENCRY_ALGO(psecuritypriv, psta, pattrib->encrypt, bmcast);
- }
- switch (pattrib->encrypt) {
- case _WEP40_:
- case _WEP104_:
- pattrib->iv_len = 4;
- pattrib->icv_len = 4;
- break;
- case _TKIP_:
- pattrib->iv_len = 8;
- pattrib->icv_len = 4;
- if (padapter->securitypriv.busetkipkey == _FAIL)
- return -EINVAL;
- break;
- case _AES_:
- pattrib->iv_len = 8;
- pattrib->icv_len = 8;
- break;
- default:
- pattrib->iv_len = 0;
- pattrib->icv_len = 0;
- break;
- }
-
- if (pattrib->encrypt &&
- (padapter->securitypriv.sw_encrypt ||
- !psecuritypriv->hw_decrypted))
- pattrib->bswenc = true;
- else
- pattrib->bswenc = false;
- /* if in MP_STATE, update pkt_attrib from mp_txcmd, and overwrite
- * some settings above.
- */
- if (check_fwstate(pmlmepriv, WIFI_MP_STATE))
- pattrib->priority =
- (le32_to_cpu(txdesc.txdw1) >> QSEL_SHT) & 0x1f;
- return 0;
-}
-
-static int xmitframe_addmic(struct _adapter *padapter,
- struct xmit_frame *pxmitframe)
-{
- u32 curfragnum, length;
- u8 *pframe, *payload, mic[8];
- struct mic_data micdata;
- struct sta_info *stainfo;
- struct qos_priv *pqospriv = &(padapter->mlmepriv.qospriv);
- struct pkt_attrib *pattrib = &pxmitframe->attrib;
- struct security_priv *psecpriv = &padapter->securitypriv;
- struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
- u8 priority[4] = {};
- bool bmcst = is_multicast_ether_addr(pattrib->ra);
-
- if (pattrib->psta)
- stainfo = pattrib->psta;
- else
- stainfo = r8712_get_stainfo(&padapter->stapriv,
- &pattrib->ra[0]);
- if (pattrib->encrypt == _TKIP_) {
- /*encode mic code*/
- if (stainfo) {
- u8 null_key[16] = {};
-
- pframe = pxmitframe->buf_addr + TXDESC_OFFSET;
- if (bmcst) {
- if (!memcmp(psecpriv->XGrptxmickey
- [psecpriv->XGrpKeyid].skey,
- null_key, 16))
- return -ENOMEM;
- /*start to calculate the mic code*/
- r8712_secmicsetkey(&micdata,
- psecpriv->XGrptxmickey
- [psecpriv->XGrpKeyid].skey);
- } else {
- if (!memcmp(&stainfo->tkiptxmickey.skey[0],
- null_key, 16))
- return -ENOMEM;
- /* start to calculate the mic code */
- r8712_secmicsetkey(&micdata,
- &stainfo->tkiptxmickey.skey[0]);
- }
- if (pframe[1] & 1) { /* ToDS==1 */
- r8712_secmicappend(&micdata,
- &pframe[16], 6); /*DA*/
- if (pframe[1] & 2) /* From Ds==1 */
- r8712_secmicappend(&micdata,
- &pframe[24], 6);
- else
- r8712_secmicappend(&micdata,
- &pframe[10], 6);
- } else { /* ToDS==0 */
- r8712_secmicappend(&micdata,
- &pframe[4], 6); /* DA */
- if (pframe[1] & 2) /* From Ds==1 */
- r8712_secmicappend(&micdata,
- &pframe[16], 6);
- else
- r8712_secmicappend(&micdata,
- &pframe[10], 6);
- }
- if (pqospriv->qos_option == 1)
- priority[0] = (u8)pxmitframe->attrib.priority;
- r8712_secmicappend(&micdata, &priority[0], 4);
- payload = pframe;
- for (curfragnum = 0; curfragnum < pattrib->nr_frags;
- curfragnum++) {
- payload = (u8 *)RND4((addr_t)(payload));
- payload += pattrib->hdrlen + pattrib->iv_len;
- if ((curfragnum + 1) == pattrib->nr_frags) {
- length = pattrib->last_txcmdsz -
- pattrib->hdrlen -
- pattrib->iv_len -
- ((psecpriv->sw_encrypt)
- ? pattrib->icv_len : 0);
- r8712_secmicappend(&micdata, payload,
- length);
- payload = payload + length;
- } else {
- length = pxmitpriv->frag_len -
- pattrib->hdrlen - pattrib->iv_len -
- ((psecpriv->sw_encrypt) ?
- pattrib->icv_len : 0);
- r8712_secmicappend(&micdata, payload,
- length);
- payload = payload + length +
- pattrib->icv_len;
- }
- }
- r8712_secgetmic(&micdata, &(mic[0]));
- /* add mic code and add the mic code length in
- * last_txcmdsz
- */
- memcpy(payload, &(mic[0]), 8);
- pattrib->last_txcmdsz += 8;
- payload = payload - pattrib->last_txcmdsz + 8;
- }
- }
- return 0;
-}
-
-static sint xmitframe_swencrypt(struct _adapter *padapter,
- struct xmit_frame *pxmitframe)
-{
- struct pkt_attrib *pattrib = &pxmitframe->attrib;
-
- if (pattrib->bswenc) {
- switch (pattrib->encrypt) {
- case _WEP40_:
- case _WEP104_:
- r8712_wep_encrypt(padapter, (u8 *)pxmitframe);
- break;
- case _TKIP_:
- r8712_tkip_encrypt(padapter, (u8 *)pxmitframe);
- break;
- case _AES_:
- r8712_aes_encrypt(padapter, (u8 *)pxmitframe);
- break;
- default:
- break;
- }
- }
- return _SUCCESS;
-}
-
-static int make_wlanhdr(struct _adapter *padapter, u8 *hdr,
- struct pkt_attrib *pattrib)
-{
- u16 *qc;
-
- struct ieee80211_hdr *pwlanhdr = (struct ieee80211_hdr *)hdr;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct qos_priv *pqospriv = &pmlmepriv->qospriv;
- __le16 *fctrl = &pwlanhdr->frame_control;
- u8 *bssid;
-
- memset(hdr, 0, WLANHDR_OFFSET);
- SetFrameSubType(fctrl, pattrib->subtype);
- if (!(pattrib->subtype & IEEE80211_FTYPE_DATA))
- return 0;
-
- bssid = get_bssid(pmlmepriv);
-
- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) {
- /* to_ds = 1, fr_ds = 0; */
- SetToDs(fctrl);
- ether_addr_copy(pwlanhdr->addr1, bssid);
- ether_addr_copy(pwlanhdr->addr2, pattrib->src);
- ether_addr_copy(pwlanhdr->addr3, pattrib->dst);
- } else if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
- /* to_ds = 0, fr_ds = 1; */
- SetFrDs(fctrl);
- ether_addr_copy(pwlanhdr->addr1, pattrib->dst);
- ether_addr_copy(pwlanhdr->addr2, bssid);
- ether_addr_copy(pwlanhdr->addr3, pattrib->src);
- } else if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) ||
- check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) {
- ether_addr_copy(pwlanhdr->addr1, pattrib->dst);
- ether_addr_copy(pwlanhdr->addr2, pattrib->src);
- ether_addr_copy(pwlanhdr->addr3, bssid);
- } else if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) {
- ether_addr_copy(pwlanhdr->addr1, pattrib->dst);
- ether_addr_copy(pwlanhdr->addr2, pattrib->src);
- ether_addr_copy(pwlanhdr->addr3, bssid);
- } else {
- return -EINVAL;
- }
-
- if (pattrib->encrypt)
- SetPrivacy(fctrl);
- if (pqospriv->qos_option) {
- qc = (unsigned short *)(hdr + pattrib->hdrlen - 2);
- if (pattrib->priority)
- SetPriority(qc, pattrib->priority);
- SetAckpolicy(qc, pattrib->ack_policy);
- }
- /* TODO: fill HT Control Field */
- /* Update Seq Num will be handled by f/w */
- {
- struct sta_info *psta;
- bool bmcst = is_multicast_ether_addr(pattrib->ra);
-
- if (pattrib->psta)
- psta = pattrib->psta;
- else if (bmcst)
- psta = r8712_get_bcmc_stainfo(padapter);
- else
- psta = r8712_get_stainfo(&padapter->stapriv,
- pattrib->ra);
-
- if (psta) {
- u16 *txtid = psta->sta_xmitpriv.txseq_tid;
-
- txtid[pattrib->priority]++;
- txtid[pattrib->priority] &= 0xFFF;
- pattrib->seqnum = txtid[pattrib->priority];
- SetSeqNum(hdr, pattrib->seqnum);
- }
- }
-
- return 0;
-}
-
-static sint r8712_put_snap(u8 *data, u16 h_proto)
-{
- struct ieee80211_snap_hdr *snap;
- const u8 *oui;
-
- snap = (struct ieee80211_snap_hdr *)data;
- snap->dsap = 0xaa;
- snap->ssap = 0xaa;
- snap->ctrl = 0x03;
- if (h_proto == 0x8137 || h_proto == 0x80f3)
- oui = P802_1H_OUI;
- else
- oui = RFC1042_OUI;
- snap->oui[0] = oui[0];
- snap->oui[1] = oui[1];
- snap->oui[2] = oui[2];
- *(__be16 *)(data + SNAP_SIZE) = htons(h_proto);
- return SNAP_SIZE + sizeof(u16);
-}
-
-/*
- * This sub-routine will perform all the following:
- * 1. remove 802.3 header.
- * 2. create wlan_header, based on the info in pxmitframe
- * 3. append sta's iv/ext-iv
- * 4. append LLC
- * 5. move frag chunk from pframe to pxmitframe->mem
- * 6. apply sw-encrypt, if necessary.
- */
-sint r8712_xmitframe_coalesce(struct _adapter *padapter, _pkt *pkt,
- struct xmit_frame *pxmitframe)
-{
- struct pkt_file pktfile;
-
- sint frg_len, mpdu_len, llc_sz;
- u32 mem_sz;
- u8 frg_inx;
- addr_t addr;
- u8 *pframe, *mem_start, *ptxdesc;
- struct sta_info *psta;
- struct security_priv *psecpriv = &padapter->securitypriv;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
- struct pkt_attrib *pattrib = &pxmitframe->attrib;
- u8 *pbuf_start;
- bool bmcst = is_multicast_ether_addr(pattrib->ra);
-
- if (!pattrib->psta)
- return _FAIL;
- psta = pattrib->psta;
- if (!pxmitframe->buf_addr)
- return _FAIL;
- pbuf_start = pxmitframe->buf_addr;
- ptxdesc = pbuf_start;
- mem_start = pbuf_start + TXDESC_OFFSET;
- if (make_wlanhdr(padapter, mem_start, pattrib))
- return _FAIL;
- _r8712_open_pktfile(pkt, &pktfile);
- _r8712_pktfile_read(&pktfile, NULL, (uint) pattrib->pkt_hdrlen);
- if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) {
- /* truncate TXDESC_SIZE bytes txcmd if at mp mode for 871x */
- if (pattrib->ether_type == 0x8712) {
- /* take care - update_txdesc overwrite this */
- _r8712_pktfile_read(&pktfile, ptxdesc, TXDESC_SIZE);
- }
- }
- pattrib->pktlen = pktfile.pkt_len;
- frg_inx = 0;
- frg_len = pxmitpriv->frag_len - 4;
- while (1) {
- llc_sz = 0;
- mpdu_len = frg_len;
- pframe = mem_start;
- SetMFrag(mem_start);
- pframe += pattrib->hdrlen;
- mpdu_len -= pattrib->hdrlen;
- /* adding icv, if necessary...*/
- if (pattrib->iv_len) {
- if (psta) {
- switch (pattrib->encrypt) {
- case _WEP40_:
- case _WEP104_:
- WEP_IV(pattrib->iv, psta->txpn,
- (u8)psecpriv->PrivacyKeyIndex);
- break;
- case _TKIP_:
- if (bmcst)
- TKIP_IV(pattrib->iv,
- psta->txpn,
- (u8)psecpriv->XGrpKeyid);
- else
- TKIP_IV(pattrib->iv, psta->txpn,
- 0);
- break;
- case _AES_:
- if (bmcst)
- AES_IV(pattrib->iv, psta->txpn,
- (u8)psecpriv->XGrpKeyid);
- else
- AES_IV(pattrib->iv, psta->txpn,
- 0);
- break;
- }
- }
- memcpy(pframe, pattrib->iv, pattrib->iv_len);
- pframe += pattrib->iv_len;
- mpdu_len -= pattrib->iv_len;
- }
- if (frg_inx == 0) {
- llc_sz = r8712_put_snap(pframe, pattrib->ether_type);
- pframe += llc_sz;
- mpdu_len -= llc_sz;
- }
- if ((pattrib->icv_len > 0) && (pattrib->bswenc))
- mpdu_len -= pattrib->icv_len;
- if (bmcst)
- mem_sz = _r8712_pktfile_read(&pktfile, pframe,
- pattrib->pktlen);
- else
- mem_sz = _r8712_pktfile_read(&pktfile, pframe,
- mpdu_len);
- pframe += mem_sz;
- if ((pattrib->icv_len > 0) && (pattrib->bswenc)) {
- memcpy(pframe, pattrib->icv, pattrib->icv_len);
- pframe += pattrib->icv_len;
- }
- frg_inx++;
- if (bmcst || r8712_endofpktfile(&pktfile)) {
- pattrib->nr_frags = frg_inx;
- pattrib->last_txcmdsz = pattrib->hdrlen +
- pattrib->iv_len +
- ((pattrib->nr_frags == 1) ?
- llc_sz : 0) +
- ((pattrib->bswenc) ?
- pattrib->icv_len : 0) + mem_sz;
- ClearMFrag(mem_start);
- break;
- }
- addr = (addr_t)(pframe);
- mem_start = (unsigned char *)RND4(addr) + TXDESC_OFFSET;
- memcpy(mem_start, pbuf_start + TXDESC_OFFSET, pattrib->hdrlen);
- }
-
- if (xmitframe_addmic(padapter, pxmitframe))
- return _FAIL;
- xmitframe_swencrypt(padapter, pxmitframe);
- return _SUCCESS;
-}
-
-void r8712_update_protection(struct _adapter *padapter, u8 *ie, uint ie_len)
-{
- uint protection;
- u8 *perp;
- uint erp_len;
- struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
- struct registry_priv *pregistrypriv = &padapter->registrypriv;
-
- switch (pxmitpriv->vcs_setting) {
- case DISABLE_VCS:
- pxmitpriv->vcs = NONE_VCS;
- break;
- case ENABLE_VCS:
- break;
- case AUTO_VCS:
- default:
- perp = r8712_get_ie(ie, WLAN_EID_ERP_INFO, &erp_len, ie_len);
- if (!perp) {
- pxmitpriv->vcs = NONE_VCS;
- } else {
- protection = (*(perp + 2)) & BIT(1);
- if (protection) {
- if (pregistrypriv->vcs_type == RTS_CTS)
- pxmitpriv->vcs = RTS_CTS;
- else
- pxmitpriv->vcs = CTS_TO_SELF;
- } else {
- pxmitpriv->vcs = NONE_VCS;
- }
- }
- break;
- }
-}
-
-struct xmit_buf *r8712_alloc_xmitbuf(struct xmit_priv *pxmitpriv)
-{
- unsigned long irqL;
- struct xmit_buf *pxmitbuf;
- struct __queue *pfree_xmitbuf_queue = &pxmitpriv->free_xmitbuf_queue;
-
- spin_lock_irqsave(&pfree_xmitbuf_queue->lock, irqL);
- pxmitbuf = list_first_entry_or_null(&pfree_xmitbuf_queue->queue,
- struct xmit_buf, list);
- if (pxmitbuf) {
- list_del_init(&pxmitbuf->list);
- pxmitpriv->free_xmitbuf_cnt--;
- }
- spin_unlock_irqrestore(&pfree_xmitbuf_queue->lock, irqL);
- return pxmitbuf;
-}
-
-void r8712_free_xmitbuf(struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf)
-{
- unsigned long irqL;
- struct __queue *pfree_xmitbuf_queue = &pxmitpriv->free_xmitbuf_queue;
-
- if (!pxmitbuf)
- return;
- spin_lock_irqsave(&pfree_xmitbuf_queue->lock, irqL);
- list_del_init(&pxmitbuf->list);
- list_add_tail(&(pxmitbuf->list), &pfree_xmitbuf_queue->queue);
- pxmitpriv->free_xmitbuf_cnt++;
- spin_unlock_irqrestore(&pfree_xmitbuf_queue->lock, irqL);
-}
-
-/*
- * Calling context:
- * 1. OS_TXENTRY
- * 2. RXENTRY (rx_thread or RX_ISR/RX_CallBack)
- *
- * If we turn on USE_RXTHREAD, then, no need for critical section.
- * Otherwise, we must use _enter/_exit critical to protect free_xmit_queue...
- *
- * Must be very very cautious...
- *
- */
-struct xmit_frame *r8712_alloc_xmitframe(struct xmit_priv *pxmitpriv)
-{
- /*
- * Please remember to use all the osdep_service api,
- * and lock/unlock or _enter/_exit critical to protect
- * pfree_xmit_queue
- */
- unsigned long irqL;
- struct xmit_frame *pxframe;
- struct __queue *pfree_xmit_queue = &pxmitpriv->free_xmit_queue;
-
- spin_lock_irqsave(&pfree_xmit_queue->lock, irqL);
- pxframe = list_first_entry_or_null(&pfree_xmit_queue->queue,
- struct xmit_frame, list);
- if (pxframe) {
- list_del_init(&pxframe->list);
- pxmitpriv->free_xmitframe_cnt--;
- pxframe->buf_addr = NULL;
- pxframe->pxmitbuf = NULL;
- pxframe->attrib.psta = NULL;
- pxframe->pkt = NULL;
- }
- spin_unlock_irqrestore(&pfree_xmit_queue->lock, irqL);
- return pxframe;
-}
-
-void r8712_free_xmitframe(struct xmit_priv *pxmitpriv,
- struct xmit_frame *pxmitframe)
-{
- unsigned long irqL;
- struct __queue *pfree_xmit_queue = &pxmitpriv->free_xmit_queue;
- struct _adapter *padapter = pxmitpriv->adapter;
-
- if (!pxmitframe)
- return;
- spin_lock_irqsave(&pfree_xmit_queue->lock, irqL);
- list_del_init(&pxmitframe->list);
- if (pxmitframe->pkt)
- pxmitframe->pkt = NULL;
- list_add_tail(&pxmitframe->list, &pfree_xmit_queue->queue);
- pxmitpriv->free_xmitframe_cnt++;
- spin_unlock_irqrestore(&pfree_xmit_queue->lock, irqL);
- if (netif_queue_stopped(padapter->pnetdev))
- netif_wake_queue(padapter->pnetdev);
-}
-
-void r8712_free_xmitframe_ex(struct xmit_priv *pxmitpriv,
- struct xmit_frame *pxmitframe)
-{
- if (!pxmitframe)
- return;
- if (pxmitframe->frame_tag == DATA_FRAMETAG)
- r8712_free_xmitframe(pxmitpriv, pxmitframe);
-}
-
-void r8712_free_xmitframe_queue(struct xmit_priv *pxmitpriv,
- struct __queue *pframequeue)
-{
- unsigned long irqL;
- struct list_head *plist, *phead;
- struct xmit_frame *pxmitframe;
-
- spin_lock_irqsave(&(pframequeue->lock), irqL);
- phead = &pframequeue->queue;
- plist = phead->next;
- while (!end_of_queue_search(phead, plist)) {
- pxmitframe = container_of(plist, struct xmit_frame, list);
- plist = plist->next;
- r8712_free_xmitframe(pxmitpriv, pxmitframe);
- }
- spin_unlock_irqrestore(&(pframequeue->lock), irqL);
-}
-
-static inline struct tx_servq *get_sta_pending(struct _adapter *padapter,
- struct __queue **ppstapending,
- struct sta_info *psta, sint up)
-{
- struct tx_servq *ptxservq;
- struct hw_xmit *phwxmits = padapter->xmitpriv.hwxmits;
-
- switch (up) {
- case 1:
- case 2:
- ptxservq = &(psta->sta_xmitpriv.bk_q);
- *ppstapending = &padapter->xmitpriv.bk_pending;
- (phwxmits + 3)->accnt++;
- break;
- case 4:
- case 5:
- ptxservq = &(psta->sta_xmitpriv.vi_q);
- *ppstapending = &padapter->xmitpriv.vi_pending;
- (phwxmits + 1)->accnt++;
- break;
- case 6:
- case 7:
- ptxservq = &(psta->sta_xmitpriv.vo_q);
- *ppstapending = &padapter->xmitpriv.vo_pending;
- (phwxmits + 0)->accnt++;
- break;
- case 0:
- case 3:
- default:
- ptxservq = &(psta->sta_xmitpriv.be_q);
- *ppstapending = &padapter->xmitpriv.be_pending;
- (phwxmits + 2)->accnt++;
- break;
- }
- return ptxservq;
-}
-
-/*
- * Will enqueue pxmitframe to the proper queue, and indicate it
- * to xx_pending list.....
- */
-int r8712_xmit_classifier(struct _adapter *padapter,
- struct xmit_frame *pxmitframe)
-{
- unsigned long irqL0;
- struct __queue *pstapending;
- struct sta_info *psta;
- struct tx_servq *ptxservq;
- struct pkt_attrib *pattrib = &pxmitframe->attrib;
- struct sta_priv *pstapriv = &padapter->stapriv;
- struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
- bool bmcst = is_multicast_ether_addr(pattrib->ra);
-
- if (pattrib->psta) {
- psta = pattrib->psta;
- } else {
- if (bmcst) {
- psta = r8712_get_bcmc_stainfo(padapter);
- } else {
- if (check_fwstate(pmlmepriv, WIFI_MP_STATE))
- psta = r8712_get_stainfo(pstapriv,
- get_bssid(pmlmepriv));
- else
- psta = r8712_get_stainfo(pstapriv, pattrib->ra);
- }
- }
- if (!psta)
- return -EINVAL;
- ptxservq = get_sta_pending(padapter, &pstapending,
- psta, pattrib->priority);
- spin_lock_irqsave(&pstapending->lock, irqL0);
- if (list_empty(&ptxservq->tx_pending))
- list_add_tail(&ptxservq->tx_pending, &pstapending->queue);
- list_add_tail(&pxmitframe->list, &ptxservq->sta_pending.queue);
- ptxservq->qcnt++;
- spin_unlock_irqrestore(&pstapending->lock, irqL0);
- return 0;
-}
-
-static void alloc_hwxmits(struct _adapter *padapter)
-{
- struct hw_xmit *hwxmits;
- struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
-
- pxmitpriv->hwxmit_entry = HWXMIT_ENTRY;
- pxmitpriv->hwxmits = kmalloc_array(pxmitpriv->hwxmit_entry,
- sizeof(struct hw_xmit), GFP_ATOMIC);
- if (!pxmitpriv->hwxmits)
- return;
- hwxmits = pxmitpriv->hwxmits;
- if (pxmitpriv->hwxmit_entry == 5) {
- pxmitpriv->bmc_txqueue.head = 0;
- hwxmits[0] .phwtxqueue = &pxmitpriv->bmc_txqueue;
- hwxmits[0] .sta_queue = &pxmitpriv->bm_pending;
- pxmitpriv->vo_txqueue.head = 0;
- hwxmits[1] .phwtxqueue = &pxmitpriv->vo_txqueue;
- hwxmits[1] .sta_queue = &pxmitpriv->vo_pending;
- pxmitpriv->vi_txqueue.head = 0;
- hwxmits[2] .phwtxqueue = &pxmitpriv->vi_txqueue;
- hwxmits[2] .sta_queue = &pxmitpriv->vi_pending;
- pxmitpriv->bk_txqueue.head = 0;
- hwxmits[3] .phwtxqueue = &pxmitpriv->bk_txqueue;
- hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
- pxmitpriv->be_txqueue.head = 0;
- hwxmits[4] .phwtxqueue = &pxmitpriv->be_txqueue;
- hwxmits[4] .sta_queue = &pxmitpriv->be_pending;
- } else if (pxmitpriv->hwxmit_entry == 4) {
- pxmitpriv->vo_txqueue.head = 0;
- hwxmits[0] .phwtxqueue = &pxmitpriv->vo_txqueue;
- hwxmits[0] .sta_queue = &pxmitpriv->vo_pending;
- pxmitpriv->vi_txqueue.head = 0;
- hwxmits[1] .phwtxqueue = &pxmitpriv->vi_txqueue;
- hwxmits[1] .sta_queue = &pxmitpriv->vi_pending;
- pxmitpriv->be_txqueue.head = 0;
- hwxmits[2] .phwtxqueue = &pxmitpriv->be_txqueue;
- hwxmits[2] .sta_queue = &pxmitpriv->be_pending;
- pxmitpriv->bk_txqueue.head = 0;
- hwxmits[3] .phwtxqueue = &pxmitpriv->bk_txqueue;
- hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
- }
-}
-
-static void free_hwxmits(struct _adapter *padapter)
-{
- struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
-
- kfree(pxmitpriv->hwxmits);
-}
-
-static void init_hwxmits(struct hw_xmit *phwxmit, sint entry)
-{
- sint i;
-
- for (i = 0; i < entry; i++, phwxmit++) {
- spin_lock_init(&phwxmit->xmit_lock);
- INIT_LIST_HEAD(&phwxmit->pending);
- phwxmit->txcmdcnt = 0;
- phwxmit->accnt = 0;
- }
-}
-
-void xmitframe_xmitbuf_attach(struct xmit_frame *pxmitframe,
- struct xmit_buf *pxmitbuf)
-{
- /* pxmitbuf attach to pxmitframe */
- pxmitframe->pxmitbuf = pxmitbuf;
- /* urb and irp connection */
- pxmitframe->pxmit_urb[0] = pxmitbuf->pxmit_urb[0];
- /* buffer addr assoc */
- pxmitframe->buf_addr = pxmitbuf->pbuf;
- /* pxmitframe attach to pxmitbuf */
- pxmitbuf->priv_data = pxmitframe;
-}
-
-/*
- * tx_action == 0 == no frames to transmit
- * tx_action > 0 ==> we have frames to transmit
- * tx_action < 0 ==> we have frames to transmit, but TXFF is not even enough
- * to transmit 1 frame.
- */
-
-int r8712_pre_xmit(struct _adapter *padapter, struct xmit_frame *pxmitframe)
-{
- unsigned long irqL;
- int ret;
- struct xmit_buf *pxmitbuf = NULL;
- struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
- struct pkt_attrib *pattrib = &pxmitframe->attrib;
-
- r8712_do_queue_select(padapter, pattrib);
- spin_lock_irqsave(&pxmitpriv->lock, irqL);
- if (r8712_txframes_sta_ac_pending(padapter, pattrib) > 0) {
- ret = false;
- r8712_xmit_enqueue(padapter, pxmitframe);
- spin_unlock_irqrestore(&pxmitpriv->lock, irqL);
- return ret;
- }
- pxmitbuf = r8712_alloc_xmitbuf(pxmitpriv);
- if (!pxmitbuf) { /*enqueue packet*/
- ret = false;
- r8712_xmit_enqueue(padapter, pxmitframe);
- spin_unlock_irqrestore(&pxmitpriv->lock, irqL);
- } else { /*dump packet directly*/
- spin_unlock_irqrestore(&pxmitpriv->lock, irqL);
- ret = true;
- xmitframe_xmitbuf_attach(pxmitframe, pxmitbuf);
- r8712_xmit_direct(padapter, pxmitframe);
- }
- return ret;
-}
--- a/drivers/staging/rtl8712/rtl871x_xmit.h
+++ /dev/null
@@ -1,288 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _RTL871X_XMIT_H_
-#define _RTL871X_XMIT_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "xmit_osdep.h"
-
-#ifdef CONFIG_R8712_TX_AGGR
-#define MAX_XMITBUF_SZ (16384)
-#else
-#define MAX_XMITBUF_SZ (2048)
-#endif
-
-#define NR_XMITBUFF (4)
-
-#ifdef CONFIG_R8712_TX_AGGR
-#define AGGR_NR_HIGH_BOUND (4) /*(8) */
-#define AGGR_NR_LOW_BOUND (2)
-#endif
-
-#define XMITBUF_ALIGN_SZ 512
-#define TX_GUARD_BAND 5
-#define MAX_NUMBLKS (1)
-
-/* Fixed the Big Endian bug when using the software driver encryption.*/
-#define WEP_IV(pattrib_iv, txpn, keyidx)\
-do { \
- pattrib_iv[0] = txpn._byte_.TSC0;\
- pattrib_iv[1] = txpn._byte_.TSC1;\
- pattrib_iv[2] = txpn._byte_.TSC2;\
- pattrib_iv[3] = ((keyidx & 0x3) << 6);\
- txpn.val = (txpn.val == 0xffffff) ? 0 : (txpn.val + 1);\
-} while (0)
-
-/* Fixed the Big Endian bug when doing the Tx.
- * The Linksys WRH54G will check this.
- */
-#define TKIP_IV(pattrib_iv, txpn, keyidx)\
-do { \
- pattrib_iv[0] = txpn._byte_.TSC1;\
- pattrib_iv[1] = (txpn._byte_.TSC1 | 0x20) & 0x7f;\
- pattrib_iv[2] = txpn._byte_.TSC0;\
- pattrib_iv[3] = BIT(5) | ((keyidx & 0x3) << 6);\
- pattrib_iv[4] = txpn._byte_.TSC2;\
- pattrib_iv[5] = txpn._byte_.TSC3;\
- pattrib_iv[6] = txpn._byte_.TSC4;\
- pattrib_iv[7] = txpn._byte_.TSC5;\
- txpn.val = txpn.val == 0xffffffffffffULL ? 0 : \
- (txpn.val + 1);\
-} while (0)
-
-#define AES_IV(pattrib_iv, txpn, keyidx)\
-do { \
- pattrib_iv[0] = txpn._byte_.TSC0;\
- pattrib_iv[1] = txpn._byte_.TSC1;\
- pattrib_iv[2] = 0;\
- pattrib_iv[3] = BIT(5) | ((keyidx & 0x3) << 6);\
- pattrib_iv[4] = txpn._byte_.TSC2;\
- pattrib_iv[5] = txpn._byte_.TSC3;\
- pattrib_iv[6] = txpn._byte_.TSC4;\
- pattrib_iv[7] = txpn._byte_.TSC5;\
- txpn.val = txpn.val == 0xffffffffffffULL ? 0 : \
- (txpn.val + 1);\
-} while (0)
-
-struct hw_xmit {
- spinlock_t xmit_lock;
- struct list_head pending;
- struct __queue *sta_queue;
- struct hw_txqueue *phwtxqueue;
- sint txcmdcnt;
- int accnt;
-};
-
-struct pkt_attrib {
- u8 type;
- u8 subtype;
- u8 bswenc;
- u8 dhcp_pkt;
-
- u16 seqnum;
- u16 ether_type;
- u16 pktlen; /* the original 802.3 pkt raw_data len
- * (not include ether_hdr data)
- */
- u16 last_txcmdsz;
-
- u8 pkt_hdrlen; /*the original 802.3 pkt header len*/
- u8 hdrlen; /*the WLAN Header Len*/
- u8 nr_frags;
- u8 ack_policy;
- u8 mac_id;
- u8 vcs_mode; /*virtual carrier sense method*/
- u8 pctrl;/*per packet txdesc control enable*/
- u8 qsel;
-
- u8 priority;
- u8 encrypt; /* when 0 indicate no encrypt. when non-zero,
- * indicate the encrypt algorithm
- */
- u8 iv_len;
- u8 icv_len;
- unsigned char iv[8];
- unsigned char icv[8];
- u8 dst[ETH_ALEN] __aligned(2); /* for ether_addr_copy */
- u8 src[ETH_ALEN];
- u8 ta[ETH_ALEN];
- u8 ra[ETH_ALEN];
- struct sta_info *psta;
-};
-
-#define WLANHDR_OFFSET 64
-#define DATA_FRAMETAG 0x01
-#define L2_FRAMETAG 0x02
-#define MGNT_FRAMETAG 0x03
-#define AMSDU_FRAMETAG 0x04
-#define EII_FRAMETAG 0x05
-#define IEEE8023_FRAMETAG 0x06
-#define MP_FRAMETAG 0x07
-#define TXAGG_FRAMETAG 0x08
-
-struct xmit_buf {
- struct list_head list;
-
- u8 *pallocated_buf;
- u8 *pbuf;
- void *priv_data;
- struct urb *pxmit_urb[8];
- u32 aggr_nr;
-};
-
-struct xmit_frame {
- struct list_head list;
- struct pkt_attrib attrib;
- _pkt *pkt;
- int frame_tag;
- struct _adapter *padapter;
- u8 *buf_addr;
- struct xmit_buf *pxmitbuf;
- u8 *mem_addr;
- u16 sz[8];
- struct urb *pxmit_urb[8];
- u8 bpending[8];
- u8 last[8];
-};
-
-struct tx_servq {
- struct list_head tx_pending;
- struct __queue sta_pending;
- int qcnt;
-};
-
-struct sta_xmit_priv {
- spinlock_t lock;
- sint option;
- sint apsd_setting; /* When bit mask is on, the associated edca
- * queue supports APSD.
- */
- struct tx_servq be_q; /* priority == 0,3 */
- struct tx_servq bk_q; /* priority == 1,2*/
- struct tx_servq vi_q; /*priority == 4,5*/
- struct tx_servq vo_q; /*priority == 6,7*/
- struct list_head legacy_dz;
- struct list_head apsd;
- u16 txseq_tid[16];
- uint sta_tx_bytes;
- u64 sta_tx_pkts;
- uint sta_tx_fail;
-};
-
-struct hw_txqueue {
- sint head;
- sint tail;
- sint free_sz; /* in units of 64 bytes */
- sint free_cmdsz;
- sint txsz[8];
- uint ff_hwaddr;
- uint cmd_hwaddr;
- sint ac_tag;
-};
-
-struct xmit_priv {
- spinlock_t lock;
- struct __queue be_pending;
- struct __queue bk_pending;
- struct __queue vi_pending;
- struct __queue vo_pending;
- struct __queue bm_pending;
- struct __queue legacy_dz_queue;
- struct __queue apsd_queue;
- u8 *pallocated_frame_buf;
- u8 *pxmit_frame_buf;
- uint free_xmitframe_cnt;
- uint mapping_addr;
- uint pkt_sz;
- struct __queue free_xmit_queue;
- struct hw_txqueue be_txqueue;
- struct hw_txqueue bk_txqueue;
- struct hw_txqueue vi_txqueue;
- struct hw_txqueue vo_txqueue;
- struct hw_txqueue bmc_txqueue;
- uint frag_len;
- struct _adapter *adapter;
- u8 vcs_setting;
- u8 vcs;
- u8 vcs_type;
- u16 rts_thresh;
- uint tx_bytes;
- u64 tx_pkts;
- uint tx_drop;
- struct hw_xmit *hwxmits;
- u8 hwxmit_entry;
- u8 txirp_cnt;
- struct tasklet_struct xmit_tasklet;
- struct work_struct xmit_pipe4_reset_wi;
- struct work_struct xmit_pipe6_reset_wi;
- struct work_struct xmit_piped_reset_wi;
- /*per AC pending irp*/
- int beq_cnt;
- int bkq_cnt;
- int viq_cnt;
- int voq_cnt;
- struct __queue free_amsdu_xmit_queue;
- u8 *pallocated_amsdu_frame_buf;
- u8 *pxmit_amsdu_frame_buf;
- uint free_amsdu_xmitframe_cnt;
- struct __queue free_txagg_xmit_queue;
- u8 *pallocated_txagg_frame_buf;
- u8 *pxmit_txagg_frame_buf;
- uint free_txagg_xmitframe_cnt;
- int cmdseq;
- struct __queue free_xmitbuf_queue;
- struct __queue pending_xmitbuf_queue;
- u8 *pallocated_xmitbuf;
- u8 *pxmitbuf;
- uint free_xmitbuf_cnt;
-};
-
-void r8712_free_xmitbuf(struct xmit_priv *pxmitpriv,
- struct xmit_buf *pxmitbuf);
-struct xmit_buf *r8712_alloc_xmitbuf(struct xmit_priv *pxmitpriv);
-void r8712_update_protection(struct _adapter *padapter, u8 *ie, uint ie_len);
-struct xmit_frame *r8712_alloc_xmitframe(struct xmit_priv *pxmitpriv);
-void r8712_free_xmitframe(struct xmit_priv *pxmitpriv,
- struct xmit_frame *pxmitframe);
-void r8712_free_xmitframe_queue(struct xmit_priv *pxmitpriv,
- struct __queue *pframequeue);
-int r8712_xmit_classifier(struct _adapter *padapter,
- struct xmit_frame *pxmitframe);
-sint r8712_xmitframe_coalesce(struct _adapter *padapter, _pkt *pkt,
- struct xmit_frame *pxmitframe);
-sint _r8712_init_hw_txqueue(struct hw_txqueue *phw_txqueue, u8 ac_tag);
-void _r8712_init_sta_xmit_priv(struct sta_xmit_priv *psta_xmitpriv);
-int r8712_update_attrib(struct _adapter *padapter, _pkt *pkt,
- struct pkt_attrib *pattrib);
-int r8712_txframes_sta_ac_pending(struct _adapter *padapter,
- struct pkt_attrib *pattrib);
-int _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv,
- struct _adapter *padapter);
-void _free_xmit_priv(struct xmit_priv *pxmitpriv);
-void r8712_free_xmitframe_ex(struct xmit_priv *pxmitpriv,
- struct xmit_frame *pxmitframe);
-int r8712_pre_xmit(struct _adapter *padapter, struct xmit_frame *pxmitframe);
-int r8712_xmit_enqueue(struct _adapter *padapter,
- struct xmit_frame *pxmitframe);
-void r8712_xmit_direct(struct _adapter *padapter, struct xmit_frame *pxmitframe);
-void r8712_xmit_bh(struct tasklet_struct *t);
-
-void xmitframe_xmitbuf_attach(struct xmit_frame *pxmitframe,
- struct xmit_buf *pxmitbuf);
-
-#include "rtl8712_xmit.h"
-
-#endif /*_RTL871X_XMIT_H_*/
-
--- a/drivers/staging/rtl8712/sta_info.h
+++ /dev/null
@@ -1,132 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __STA_INFO_H_
-#define __STA_INFO_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "wifi.h"
-
-#define NUM_STA 32
-#define NUM_ACL 64
-
-/* if mode ==0, then the sta is allowed once the addr is hit.
- * if mode ==1, then the sta is rejected once the addr is non-hit.
- */
-struct wlan_acl_node {
- struct list_head list;
- u8 addr[ETH_ALEN];
- u8 mode;
-};
-
-struct wlan_acl_pool {
- struct wlan_acl_node aclnode[NUM_ACL];
-};
-
-struct stainfo_stats {
- uint rx_pkts;
- uint rx_bytes;
- u64 tx_pkts;
- uint tx_bytes;
-};
-
-struct sta_info {
- spinlock_t lock;
- struct list_head list; /*free_sta_queue*/
- struct list_head hash_list; /*sta_hash*/
- struct sta_xmit_priv sta_xmitpriv;
- struct sta_recv_priv sta_recvpriv;
- uint state;
- uint aid;
- uint mac_id;
- uint qos_option;
- u8 hwaddr[ETH_ALEN];
- uint ieee8021x_blocked; /*0: allowed, 1:blocked */
- uint XPrivacy; /*aes, tkip...*/
- union Keytype tkiptxmickey;
- union Keytype tkiprxmickey;
- union Keytype x_UncstKey;
- union pn48 txpn; /* PN48 used for Unicast xmit.*/
- union pn48 rxpn; /* PN48 used for Unicast recv.*/
- u8 bssrateset[16];
- uint bssratelen;
- s32 rssi;
- s32 signal_quality;
- struct stainfo_stats sta_stats;
- /*for A-MPDU Rx reordering buffer control */
- struct recv_reorder_ctrl recvreorder_ctrl[16];
- struct ht_priv htpriv;
- /* Notes:
- * STA_Mode:
- * curr_network(mlme_priv/security_priv/qos/ht)
- * + sta_info: (STA & AP) CAP/INFO
- * scan_q: AP CAP/INFO
- * AP_Mode:
- * curr_network(mlme_priv/security_priv/qos/ht) : AP CAP/INFO
- * sta_info: (AP & STA) CAP/INFO
- */
- struct list_head asoc_list;
- struct list_head auth_list;
- unsigned int expire_to;
- unsigned int auth_seq;
- unsigned int authalg;
- unsigned char chg_txt[128];
- unsigned int tx_ra_bitmap;
-};
-
-struct sta_priv {
- u8 *pallocated_stainfo_buf;
- u8 *pstainfo_buf;
- struct __queue free_sta_queue;
- spinlock_t sta_hash_lock;
- struct list_head sta_hash[NUM_STA];
- int asoc_sta_count;
- struct __queue sleep_q;
- struct __queue wakeup_q;
- struct _adapter *padapter;
- struct list_head asoc_list;
- struct list_head auth_list;
- unsigned int auth_to; /* sec, time to expire in authenticating. */
- unsigned int assoc_to; /* sec, time to expire before associating. */
- unsigned int expire_to; /* sec , time to expire after associated. */
-};
-
-static inline u32 wifi_mac_hash(u8 *mac)
-{
- u32 x;
-
- x = mac[0];
- x = (x << 2) ^ mac[1];
- x = (x << 2) ^ mac[2];
- x = (x << 2) ^ mac[3];
- x = (x << 2) ^ mac[4];
- x = (x << 2) ^ mac[5];
- x ^= x >> 8;
- x = x & (NUM_STA - 1);
- return x;
-}
-
-int _r8712_init_sta_priv(struct sta_priv *pstapriv);
-void _r8712_free_sta_priv(struct sta_priv *pstapriv);
-struct sta_info *r8712_alloc_stainfo(struct sta_priv *pstapriv,
- u8 *hwaddr);
-void r8712_free_stainfo(struct _adapter *padapter, struct sta_info *psta);
-void r8712_free_all_stainfo(struct _adapter *padapter);
-struct sta_info *r8712_get_stainfo(struct sta_priv *pstapriv, u8 *hwaddr);
-void r8712_init_bcmc_stainfo(struct _adapter *padapter);
-struct sta_info *r8712_get_bcmc_stainfo(struct _adapter *padapter);
-u8 r8712_access_ctrl(struct wlan_acl_pool *pacl_list, u8 *mac_addr);
-
-#endif /* _STA_INFO_H_ */
-
--- a/drivers/staging/rtl8712/usb_halinit.c
+++ /dev/null
@@ -1,307 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * usb_halinit.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _HCI_HAL_INIT_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "usb_ops.h"
-#include "usb_osintf.h"
-
-u8 r8712_usb_hal_bus_init(struct _adapter *adapter)
-{
- u8 val8 = 0;
- u8 ret = _SUCCESS;
- int PollingCnt = 20;
- struct registry_priv *registrypriv = &adapter->registrypriv;
-
- if (registrypriv->chip_version == RTL8712_FPGA) {
- val8 = 0x01;
- /* switch to 80M clock */
- r8712_write8(adapter, SYS_CLKR, val8);
- val8 = r8712_read8(adapter, SPS1_CTRL);
- val8 = val8 | 0x01;
- /* enable VSPS12 LDO Macro block */
- r8712_write8(adapter, SPS1_CTRL, val8);
- val8 = r8712_read8(adapter, AFE_MISC);
- val8 = val8 | 0x01;
- /* Enable AFE Macro Block's Bandgap */
- r8712_write8(adapter, AFE_MISC, val8);
- val8 = r8712_read8(adapter, LDOA15_CTRL);
- val8 = val8 | 0x01;
- /* enable LDOA15 block */
- r8712_write8(adapter, LDOA15_CTRL, val8);
- val8 = r8712_read8(adapter, SPS1_CTRL);
- val8 = val8 | 0x02;
- /* Enable VSPS12_SW Macro Block */
- r8712_write8(adapter, SPS1_CTRL, val8);
- val8 = r8712_read8(adapter, AFE_MISC);
- val8 = val8 | 0x02;
- /* Enable AFE Macro Block's Mbias */
- r8712_write8(adapter, AFE_MISC, val8);
- val8 = r8712_read8(adapter, SYS_ISO_CTRL + 1);
- val8 = val8 | 0x08;
- /* isolate PCIe Analog 1.2V to PCIe 3.3V and PCIE Digital */
- r8712_write8(adapter, SYS_ISO_CTRL + 1, val8);
- val8 = r8712_read8(adapter, SYS_ISO_CTRL + 1);
- val8 = val8 & 0xEF;
- /* attach AFE PLL to MACTOP/BB/PCIe Digital */
- r8712_write8(adapter, SYS_ISO_CTRL + 1, val8);
- val8 = r8712_read8(adapter, AFE_XTAL_CTRL + 1);
- val8 = val8 & 0xFB;
- /* enable AFE clock */
- r8712_write8(adapter, AFE_XTAL_CTRL + 1, val8);
- val8 = r8712_read8(adapter, AFE_PLL_CTRL);
- val8 = val8 | 0x01;
- /* Enable AFE PLL Macro Block */
- r8712_write8(adapter, AFE_PLL_CTRL, val8);
- val8 = 0xEE;
- /* release isolation AFE PLL & MD */
- r8712_write8(adapter, SYS_ISO_CTRL, val8);
- val8 = r8712_read8(adapter, SYS_CLKR + 1);
- val8 = val8 | 0x08;
- /* enable MAC clock */
- r8712_write8(adapter, SYS_CLKR + 1, val8);
- val8 = r8712_read8(adapter, SYS_FUNC_EN + 1);
- val8 = val8 | 0x08;
- /* enable Core digital and enable IOREG R/W */
- r8712_write8(adapter, SYS_FUNC_EN + 1, val8);
- val8 = val8 | 0x80;
- /* enable REG_EN */
- r8712_write8(adapter, SYS_FUNC_EN + 1, val8);
- val8 = r8712_read8(adapter, SYS_CLKR + 1);
- val8 = (val8 | 0x80) & 0xBF;
- /* switch the control path */
- r8712_write8(adapter, SYS_CLKR + 1, val8);
- val8 = 0xFC;
- r8712_write8(adapter, CR, val8);
- val8 = 0x37;
- r8712_write8(adapter, CR + 1, val8);
- /* reduce EndPoint & init it */
- r8712_write8(adapter, 0x102500ab, r8712_read8(adapter,
- 0x102500ab) | BIT(6) | BIT(7));
- /* consideration of power consumption - init */
- r8712_write8(adapter, 0x10250008, r8712_read8(adapter,
- 0x10250008) & 0xfffffffb);
- } else if (registrypriv->chip_version == RTL8712_1stCUT) {
- /* Initialization for power on sequence, */
- r8712_write8(adapter, SPS0_CTRL + 1, 0x53);
- r8712_write8(adapter, SPS0_CTRL, 0x57);
- /* Enable AFE Macro Block's Bandgap and Enable AFE Macro
- * Block's Mbias
- */
- val8 = r8712_read8(adapter, AFE_MISC);
- r8712_write8(adapter, AFE_MISC, (val8 | AFE_MISC_BGEN |
- AFE_MISC_MBEN));
- /* Enable LDOA15 block */
- val8 = r8712_read8(adapter, LDOA15_CTRL);
- r8712_write8(adapter, LDOA15_CTRL, (val8 | LDA15_EN));
- val8 = r8712_read8(adapter, SPS1_CTRL);
- r8712_write8(adapter, SPS1_CTRL, (val8 | SPS1_LDEN));
- msleep(20);
- /* Enable Switch Regulator Block */
- val8 = r8712_read8(adapter, SPS1_CTRL);
- r8712_write8(adapter, SPS1_CTRL, (val8 | SPS1_SWEN));
- r8712_write32(adapter, SPS1_CTRL, 0x00a7b267);
- val8 = r8712_read8(adapter, SYS_ISO_CTRL + 1);
- r8712_write8(adapter, SYS_ISO_CTRL + 1, (val8 | 0x08));
- /* Engineer Packet CP test Enable */
- val8 = r8712_read8(adapter, SYS_FUNC_EN + 1);
- r8712_write8(adapter, SYS_FUNC_EN + 1, (val8 | 0x20));
- val8 = r8712_read8(adapter, SYS_ISO_CTRL + 1);
- r8712_write8(adapter, SYS_ISO_CTRL + 1, (val8 & 0x6F));
- /* Enable AFE clock */
- val8 = r8712_read8(adapter, AFE_XTAL_CTRL + 1);
- r8712_write8(adapter, AFE_XTAL_CTRL + 1, (val8 & 0xfb));
- /* Enable AFE PLL Macro Block */
- val8 = r8712_read8(adapter, AFE_PLL_CTRL);
- r8712_write8(adapter, AFE_PLL_CTRL, (val8 | 0x11));
- /* Attach AFE PLL to MACTOP/BB/PCIe Digital */
- val8 = r8712_read8(adapter, SYS_ISO_CTRL);
- r8712_write8(adapter, SYS_ISO_CTRL, (val8 & 0xEE));
- /* Switch to 40M clock */
- val8 = r8712_read8(adapter, SYS_CLKR);
- r8712_write8(adapter, SYS_CLKR, val8 & (~SYS_CLKSEL));
- /* SSC Disable */
- val8 = r8712_read8(adapter, SYS_CLKR);
- /* Enable MAC clock */
- val8 = r8712_read8(adapter, SYS_CLKR + 1);
- r8712_write8(adapter, SYS_CLKR + 1, (val8 | 0x18));
- /* Revised POS, */
- r8712_write8(adapter, PMC_FSM, 0x02);
- /* Enable Core digital and enable IOREG R/W */
- val8 = r8712_read8(adapter, SYS_FUNC_EN + 1);
- r8712_write8(adapter, SYS_FUNC_EN + 1, (val8 | 0x08));
- /* Enable REG_EN */
- val8 = r8712_read8(adapter, SYS_FUNC_EN + 1);
- r8712_write8(adapter, SYS_FUNC_EN + 1, (val8 | 0x80));
- /* Switch the control path to FW */
- val8 = r8712_read8(adapter, SYS_CLKR + 1);
- r8712_write8(adapter, SYS_CLKR + 1, (val8 | 0x80) & 0xBF);
- r8712_write8(adapter, CR, 0xFC);
- r8712_write8(adapter, CR + 1, 0x37);
- /* Fix the RX FIFO issue(usb error), */
- val8 = r8712_read8(adapter, 0x1025FE5c);
- r8712_write8(adapter, 0x1025FE5c, (val8 | BIT(7)));
- val8 = r8712_read8(adapter, 0x102500ab);
- r8712_write8(adapter, 0x102500ab, (val8 | BIT(6) | BIT(7)));
- /* For power save, used this in the bit file after 970621 */
- val8 = r8712_read8(adapter, SYS_CLKR);
- r8712_write8(adapter, SYS_CLKR, val8 & (~CPU_CLKSEL));
- } else if (registrypriv->chip_version == RTL8712_2ndCUT ||
- registrypriv->chip_version == RTL8712_3rdCUT) {
- /* Initialization for power on sequence,
- * E-Fuse leakage prevention sequence
- */
- r8712_write8(adapter, 0x37, 0xb0);
- msleep(20);
- r8712_write8(adapter, 0x37, 0x30);
- /* Set control path switch to HW control and reset Digital Core,
- * CPU Core and MAC I/O to solve FW download fail when system
- * from resume sate.
- */
- val8 = r8712_read8(adapter, SYS_CLKR + 1);
- if (val8 & 0x80) {
- val8 &= 0x3f;
- r8712_write8(adapter, SYS_CLKR + 1, val8);
- }
- val8 = r8712_read8(adapter, SYS_FUNC_EN + 1);
- val8 &= 0x73;
- r8712_write8(adapter, SYS_FUNC_EN + 1, val8);
- msleep(20);
- /* Revised POS, */
- /* Enable AFE Macro Block's Bandgap and Enable AFE Macro
- * Block's Mbias
- */
- r8712_write8(adapter, SPS0_CTRL + 1, 0x53);
- r8712_write8(adapter, SPS0_CTRL, 0x57);
- val8 = r8712_read8(adapter, AFE_MISC);
- /*Bandgap*/
- r8712_write8(adapter, AFE_MISC, (val8 | AFE_MISC_BGEN));
- r8712_write8(adapter, AFE_MISC, (val8 | AFE_MISC_BGEN |
- AFE_MISC_MBEN | AFE_MISC_I32_EN));
- /* Enable PLL Power (LDOA15V) */
- val8 = r8712_read8(adapter, LDOA15_CTRL);
- r8712_write8(adapter, LDOA15_CTRL, (val8 | LDA15_EN));
- /* Enable LDOV12D block */
- val8 = r8712_read8(adapter, LDOV12D_CTRL);
- r8712_write8(adapter, LDOV12D_CTRL, (val8 | LDV12_EN));
- val8 = r8712_read8(adapter, SYS_ISO_CTRL + 1);
- r8712_write8(adapter, SYS_ISO_CTRL + 1, (val8 | 0x08));
- /* Engineer Packet CP test Enable */
- val8 = r8712_read8(adapter, SYS_FUNC_EN + 1);
- r8712_write8(adapter, SYS_FUNC_EN + 1, (val8 | 0x20));
- /* Support 64k IMEM */
- val8 = r8712_read8(adapter, SYS_ISO_CTRL + 1);
- r8712_write8(adapter, SYS_ISO_CTRL + 1, (val8 & 0x68));
- /* Enable AFE clock */
- val8 = r8712_read8(adapter, AFE_XTAL_CTRL + 1);
- r8712_write8(adapter, AFE_XTAL_CTRL + 1, (val8 & 0xfb));
- /* Enable AFE PLL Macro Block */
- val8 = r8712_read8(adapter, AFE_PLL_CTRL);
- r8712_write8(adapter, AFE_PLL_CTRL, (val8 | 0x11));
- /* Some sample will download fw failure. The clock will be
- * stable with 500 us delay after reset the PLL
- * TODO: When usleep is added to kernel, change next 3
- * udelay(500) to usleep(500)
- */
- udelay(500);
- r8712_write8(adapter, AFE_PLL_CTRL, (val8 | 0x51));
- udelay(500);
- r8712_write8(adapter, AFE_PLL_CTRL, (val8 | 0x11));
- udelay(500);
- /* Attach AFE PLL to MACTOP/BB/PCIe Digital */
- val8 = r8712_read8(adapter, SYS_ISO_CTRL);
- r8712_write8(adapter, SYS_ISO_CTRL, (val8 & 0xEE));
- /* Switch to 40M clock */
- r8712_write8(adapter, SYS_CLKR, 0x00);
- /* CPU Clock and 80M Clock SSC Disable to overcome FW download
- * fail timing issue.
- */
- val8 = r8712_read8(adapter, SYS_CLKR);
- r8712_write8(adapter, SYS_CLKR, (val8 | 0xa0));
- /* Enable MAC clock */
- val8 = r8712_read8(adapter, SYS_CLKR + 1);
- r8712_write8(adapter, SYS_CLKR + 1, (val8 | 0x18));
- /* Revised POS, */
- r8712_write8(adapter, PMC_FSM, 0x02);
- /* Enable Core digital and enable IOREG R/W */
- val8 = r8712_read8(adapter, SYS_FUNC_EN + 1);
- r8712_write8(adapter, SYS_FUNC_EN + 1, (val8 | 0x08));
- /* Enable REG_EN */
- val8 = r8712_read8(adapter, SYS_FUNC_EN + 1);
- r8712_write8(adapter, SYS_FUNC_EN + 1, (val8 | 0x80));
- /* Switch the control path to FW */
- val8 = r8712_read8(adapter, SYS_CLKR + 1);
- r8712_write8(adapter, SYS_CLKR + 1, (val8 | 0x80) & 0xBF);
- r8712_write8(adapter, CR, 0xFC);
- r8712_write8(adapter, CR + 1, 0x37);
- /* Fix the RX FIFO issue(usb error), 970410 */
- val8 = r8712_read8(adapter, 0x1025FE5c);
- r8712_write8(adapter, 0x1025FE5c, (val8 | BIT(7)));
- /* For power save, used this in the bit file after 970621 */
- val8 = r8712_read8(adapter, SYS_CLKR);
- r8712_write8(adapter, SYS_CLKR, val8 & (~CPU_CLKSEL));
- /* Revised for 8051 ROM code wrong operation. */
- r8712_write8(adapter, 0x1025fe1c, 0x80);
- /* To make sure that TxDMA can ready to download FW.
- * We should reset TxDMA if IMEM RPT was not ready.
- */
- do {
- val8 = r8712_read8(adapter, TCR);
- if ((val8 & _TXDMA_INIT_VALUE) == _TXDMA_INIT_VALUE)
- break;
- udelay(5); /* PlatformStallExecution(5); */
- } while (PollingCnt--); /* Delay 1ms */
-
- if (PollingCnt <= 0) {
- val8 = r8712_read8(adapter, CR);
- r8712_write8(adapter, CR, val8 & (~_TXDMA_EN));
- udelay(2); /* PlatformStallExecution(2); */
- /* Reset TxDMA */
- r8712_write8(adapter, CR, val8 | _TXDMA_EN);
- }
- } else {
- ret = _FAIL;
- }
- return ret;
-}
-
-unsigned int r8712_usb_inirp_init(struct _adapter *adapter)
-{
- u8 i;
- struct recv_buf *recvbuf;
- struct intf_hdl *intfhdl = &adapter->pio_queue->intf;
- struct recv_priv *recvpriv = &(adapter->recvpriv);
-
- recvpriv->ff_hwaddr = RTL8712_DMA_RX0FF; /* mapping rx fifo address */
- /* issue Rx irp to receive data */
- recvbuf = (struct recv_buf *)recvpriv->precv_buf;
- for (i = 0; i < NR_RECVBUFF; i++) {
- if (r8712_usb_read_port(intfhdl, recvpriv->ff_hwaddr, 0,
- (unsigned char *)recvbuf) == false)
- return _FAIL;
- recvbuf++;
- recvpriv->free_recv_buf_queue_cnt--;
- }
- return _SUCCESS;
-}
-
-unsigned int r8712_usb_inirp_deinit(struct _adapter *adapter)
-{
- r8712_usb_read_port_cancel(adapter);
- return _SUCCESS;
-}
--- a/drivers/staging/rtl8712/usb_intf.c
+++ /dev/null
@@ -1,638 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * usb_intf.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _HCI_INTF_C_
-
-#include <linux/usb.h>
-#include <linux/module.h>
-#include <linux/firmware.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "recv_osdep.h"
-#include "xmit_osdep.h"
-#include "rtl8712_efuse.h"
-#include "usb_ops.h"
-#include "usb_osintf.h"
-
-static struct usb_interface *pintf;
-
-static int r871xu_drv_init(struct usb_interface *pusb_intf,
- const struct usb_device_id *pdid);
-
-static void r871xu_dev_remove(struct usb_interface *pusb_intf);
-
-static const struct usb_device_id rtl871x_usb_id_tbl[] = {
-/* RTL8188SU */
- /* Realtek */
- {USB_DEVICE(0x0BDA, 0x8171)},
- {USB_DEVICE(0x0bda, 0x8173)},
- {USB_DEVICE(0x0bda, 0x8712)},
- {USB_DEVICE(0x0bda, 0x8713)},
- {USB_DEVICE(0x0bda, 0xC512)},
- /* Abocom */
- {USB_DEVICE(0x07B8, 0x8188)},
- /* ASUS */
- {USB_DEVICE(0x0B05, 0x1786)},
- {USB_DEVICE(0x0B05, 0x1791)}, /* 11n mode disable */
- /* Belkin */
- {USB_DEVICE(0x050D, 0x945A)},
- /* ISY IWL - Belkin clone */
- {USB_DEVICE(0x050D, 0x11F1)},
- /* Corega */
- {USB_DEVICE(0x07AA, 0x0047)},
- /* D-Link */
- {USB_DEVICE(0x2001, 0x3306)},
- {USB_DEVICE(0x07D1, 0x3306)}, /* 11n mode disable */
- /* Edimax */
- {USB_DEVICE(0x7392, 0x7611)},
- /* EnGenius */
- {USB_DEVICE(0x1740, 0x9603)},
- /* Hawking */
- {USB_DEVICE(0x0E66, 0x0016)},
- /* Hercules */
- {USB_DEVICE(0x06F8, 0xE034)},
- {USB_DEVICE(0x06F8, 0xE032)},
- /* Logitec */
- {USB_DEVICE(0x0789, 0x0167)},
- /* PCI */
- {USB_DEVICE(0x2019, 0xAB28)},
- {USB_DEVICE(0x2019, 0xED16)},
- /* Sitecom */
- {USB_DEVICE(0x0DF6, 0x0057)},
- {USB_DEVICE(0x0DF6, 0x0045)},
- {USB_DEVICE(0x0DF6, 0x0059)}, /* 11n mode disable */
- {USB_DEVICE(0x0DF6, 0x004B)},
- {USB_DEVICE(0x0DF6, 0x005B)},
- {USB_DEVICE(0x0DF6, 0x005D)},
- {USB_DEVICE(0x0DF6, 0x0063)},
- /* Sweex */
- {USB_DEVICE(0x177F, 0x0154)},
- /* Thinkware */
- {USB_DEVICE(0x0BDA, 0x5077)},
- /* Toshiba */
- {USB_DEVICE(0x1690, 0x0752)},
- /* - */
- {USB_DEVICE(0x20F4, 0x646B)},
- {USB_DEVICE(0x083A, 0xC512)},
- {USB_DEVICE(0x25D4, 0x4CA1)},
- {USB_DEVICE(0x25D4, 0x4CAB)},
-
-/* RTL8191SU */
- /* Realtek */
- {USB_DEVICE(0x0BDA, 0x8172)},
- {USB_DEVICE(0x0BDA, 0x8192)},
- /* Amigo */
- {USB_DEVICE(0x0EB0, 0x9061)},
- /* ASUS/EKB */
- {USB_DEVICE(0x13D3, 0x3323)},
- {USB_DEVICE(0x13D3, 0x3311)}, /* 11n mode disable */
- {USB_DEVICE(0x13D3, 0x3342)},
- /* ASUS/EKBLenovo */
- {USB_DEVICE(0x13D3, 0x3333)},
- {USB_DEVICE(0x13D3, 0x3334)},
- {USB_DEVICE(0x13D3, 0x3335)}, /* 11n mode disable */
- {USB_DEVICE(0x13D3, 0x3336)}, /* 11n mode disable */
- /* ASUS/Media BOX */
- {USB_DEVICE(0x13D3, 0x3309)},
- /* Belkin */
- {USB_DEVICE(0x050D, 0x815F)},
- /* D-Link */
- {USB_DEVICE(0x07D1, 0x3302)},
- {USB_DEVICE(0x07D1, 0x3300)},
- {USB_DEVICE(0x07D1, 0x3303)},
- /* Edimax */
- {USB_DEVICE(0x7392, 0x7612)},
- /* EnGenius */
- {USB_DEVICE(0x1740, 0x9605)},
- /* Guillemot */
- {USB_DEVICE(0x06F8, 0xE031)},
- /* Hawking */
- {USB_DEVICE(0x0E66, 0x0015)},
- /* Mediao */
- {USB_DEVICE(0x13D3, 0x3306)},
- /* PCI */
- {USB_DEVICE(0x2019, 0xED18)},
- {USB_DEVICE(0x2019, 0x4901)},
- /* Sitecom */
- {USB_DEVICE(0x0DF6, 0x0058)},
- {USB_DEVICE(0x0DF6, 0x0049)},
- {USB_DEVICE(0x0DF6, 0x004C)},
- {USB_DEVICE(0x0DF6, 0x006C)},
- {USB_DEVICE(0x0DF6, 0x0064)},
- /* Skyworth */
- {USB_DEVICE(0x14b2, 0x3300)},
- {USB_DEVICE(0x14b2, 0x3301)},
- {USB_DEVICE(0x14B2, 0x3302)},
- /* - */
- {USB_DEVICE(0x04F2, 0xAFF2)},
- {USB_DEVICE(0x04F2, 0xAFF5)},
- {USB_DEVICE(0x04F2, 0xAFF6)},
- {USB_DEVICE(0x13D3, 0x3339)},
- {USB_DEVICE(0x13D3, 0x3340)}, /* 11n mode disable */
- {USB_DEVICE(0x13D3, 0x3341)}, /* 11n mode disable */
- {USB_DEVICE(0x13D3, 0x3310)},
- {USB_DEVICE(0x13D3, 0x3325)},
-
-/* RTL8192SU */
- /* Realtek */
- {USB_DEVICE(0x0BDA, 0x8174)},
- /* Belkin */
- {USB_DEVICE(0x050D, 0x845A)},
- /* Corega */
- {USB_DEVICE(0x07AA, 0x0051)},
- /* Edimax */
- {USB_DEVICE(0x7392, 0x7622)},
- /* NEC */
- {USB_DEVICE(0x0409, 0x02B6)},
- {}
-};
-
-MODULE_DEVICE_TABLE(usb, rtl871x_usb_id_tbl);
-
-static struct specific_device_id specific_device_id_tbl[] = {
- {.idVendor = 0x0b05, .idProduct = 0x1791,
- .flags = SPEC_DEV_ID_DISABLE_HT},
- {.idVendor = 0x0df6, .idProduct = 0x0059,
- .flags = SPEC_DEV_ID_DISABLE_HT},
- {.idVendor = 0x13d3, .idProduct = 0x3306,
- .flags = SPEC_DEV_ID_DISABLE_HT},
- {.idVendor = 0x13D3, .idProduct = 0x3311,
- .flags = SPEC_DEV_ID_DISABLE_HT},
- {.idVendor = 0x13d3, .idProduct = 0x3335,
- .flags = SPEC_DEV_ID_DISABLE_HT},
- {.idVendor = 0x13d3, .idProduct = 0x3336,
- .flags = SPEC_DEV_ID_DISABLE_HT},
- {.idVendor = 0x13d3, .idProduct = 0x3340,
- .flags = SPEC_DEV_ID_DISABLE_HT},
- {.idVendor = 0x13d3, .idProduct = 0x3341,
- .flags = SPEC_DEV_ID_DISABLE_HT},
- {}
-};
-
-struct drv_priv {
- struct usb_driver r871xu_drv;
- int drv_registered;
-};
-
-#ifdef CONFIG_PM
-static int r871x_suspend(struct usb_interface *pusb_intf, pm_message_t state)
-{
- struct net_device *pnetdev = usb_get_intfdata(pusb_intf);
- struct _adapter *padapter = netdev_priv(pnetdev);
-
- netdev_info(pnetdev, "Suspending...\n");
- padapter->suspended = true;
- rtl871x_intf_stop(padapter);
- if (pnetdev->netdev_ops->ndo_stop)
- pnetdev->netdev_ops->ndo_stop(pnetdev);
- mdelay(10);
- netif_device_detach(pnetdev);
- return 0;
-}
-
-static void rtl871x_intf_resume(struct _adapter *padapter)
-{
- if (padapter->dvobjpriv.inirp_init)
- padapter->dvobjpriv.inirp_init(padapter);
-}
-
-static int r871x_resume(struct usb_interface *pusb_intf)
-{
- struct net_device *pnetdev = usb_get_intfdata(pusb_intf);
- struct _adapter *padapter = netdev_priv(pnetdev);
-
- netdev_info(pnetdev, "Resuming...\n");
- netif_device_attach(pnetdev);
- if (pnetdev->netdev_ops->ndo_open)
- pnetdev->netdev_ops->ndo_open(pnetdev);
- padapter->suspended = false;
- rtl871x_intf_resume(padapter);
- return 0;
-}
-#endif
-
-static struct drv_priv drvpriv = {
- .r871xu_drv.name = "r8712u",
- .r871xu_drv.id_table = rtl871x_usb_id_tbl,
- .r871xu_drv.probe = r871xu_drv_init,
- .r871xu_drv.disconnect = r871xu_dev_remove,
-#ifdef CONFIG_PM
- .r871xu_drv.suspend = r871x_suspend,
- .r871xu_drv.resume = r871x_resume,
-#endif
-};
-
-static uint r8712_usb_dvobj_init(struct _adapter *padapter)
-{
- uint status = _SUCCESS;
- struct usb_host_interface *phost_iface;
- struct usb_interface_descriptor *piface_desc;
- struct dvobj_priv *pdvobjpriv = &padapter->dvobjpriv;
- struct usb_device *pusbd = pdvobjpriv->pusbdev;
-
- pdvobjpriv->padapter = padapter;
- padapter->eeprom_address_size = 6;
- phost_iface = pintf->cur_altsetting;
- piface_desc = &phost_iface->desc;
- pdvobjpriv->nr_endpoint = piface_desc->bNumEndpoints;
- if (pusbd->speed == USB_SPEED_HIGH) {
- pdvobjpriv->ishighspeed = true;
- dev_info(&pusbd->dev, "r8712u: USB_SPEED_HIGH with %d endpoints\n",
- pdvobjpriv->nr_endpoint);
- } else {
- pdvobjpriv->ishighspeed = false;
- dev_info(&pusbd->dev, "r8712u: USB_SPEED_LOW with %d endpoints\n",
- pdvobjpriv->nr_endpoint);
- }
- if ((r8712_alloc_io_queue(padapter)) == _FAIL)
- status = _FAIL;
- return status;
-}
-
-static void r8712_usb_dvobj_deinit(struct _adapter *padapter)
-{
- r8712_free_io_queue(padapter);
-}
-
-void rtl871x_intf_stop(struct _adapter *padapter)
-{
- /*disable_hw_interrupt*/
- if (!padapter->surprise_removed) {
- /*device still exists, so driver can do i/o operation
- * TODO:
- */
- }
-
- /* cancel in irp */
- if (padapter->dvobjpriv.inirp_deinit)
- padapter->dvobjpriv.inirp_deinit(padapter);
- /* cancel out irp */
- r8712_usb_write_port_cancel(padapter);
- /* TODO:cancel other irps */
-}
-
-void r871x_dev_unload(struct _adapter *padapter)
-{
- if (padapter->bup) {
- /*s1.*/
- padapter->driver_stopped = true;
-
- /*s3.*/
- rtl871x_intf_stop(padapter);
-
- /*s4.*/
- r8712_stop_drv_threads(padapter);
-
- /*s5.*/
- if (!padapter->surprise_removed) {
- padapter->hw_init_completed = false;
- rtl8712_hal_deinit(padapter);
- }
-
- padapter->bup = false;
- }
-}
-
-static void disable_ht_for_spec_devid(const struct usb_device_id *pdid,
- struct _adapter *padapter)
-{
- u16 vid, pid;
- u32 flags;
- int i;
- int num = ARRAY_SIZE(specific_device_id_tbl);
-
- for (i = 0; i < num; i++) {
- vid = specific_device_id_tbl[i].idVendor;
- pid = specific_device_id_tbl[i].idProduct;
- flags = specific_device_id_tbl[i].flags;
-
- if ((pdid->idVendor == vid) && (pdid->idProduct == pid) &&
- (flags & SPEC_DEV_ID_DISABLE_HT)) {
- padapter->registrypriv.ht_enable = 0;
- padapter->registrypriv.cbw40_enable = 0;
- padapter->registrypriv.ampdu_enable = 0;
- }
- }
-}
-
-static const struct device_type wlan_type = {
- .name = "wlan",
-};
-
-/*
- * drv_init() - a device potentially for us
- *
- * notes: drv_init() is called when the bus driver has located a card for us
- * to support. We accept the new device by returning 0.
- */
-static int r871xu_drv_init(struct usb_interface *pusb_intf,
- const struct usb_device_id *pdid)
-{
- uint status;
- struct _adapter *padapter = NULL;
- struct dvobj_priv *pdvobjpriv;
- struct net_device *pnetdev;
- struct usb_device *udev;
-
- /* In this probe function, O.S. will provide the usb interface pointer
- * to driver. We have to increase the reference count of the usb device
- * structure by using the usb_get_dev function.
- */
- udev = interface_to_usbdev(pusb_intf);
- usb_get_dev(udev);
- pintf = pusb_intf;
- /* step 1. */
- pnetdev = r8712_init_netdev();
- if (!pnetdev)
- goto put_dev;
- padapter = netdev_priv(pnetdev);
- disable_ht_for_spec_devid(pdid, padapter);
- pdvobjpriv = &padapter->dvobjpriv;
- pdvobjpriv->padapter = padapter;
- padapter->dvobjpriv.pusbdev = udev;
- padapter->pusb_intf = pusb_intf;
- usb_set_intfdata(pusb_intf, pnetdev);
- SET_NETDEV_DEV(pnetdev, &pusb_intf->dev);
- pnetdev->dev.type = &wlan_type;
- /* step 2. */
- padapter->dvobj_init = r8712_usb_dvobj_init;
- padapter->dvobj_deinit = r8712_usb_dvobj_deinit;
- padapter->halpriv.hal_bus_init = r8712_usb_hal_bus_init;
- padapter->dvobjpriv.inirp_init = r8712_usb_inirp_init;
- padapter->dvobjpriv.inirp_deinit = r8712_usb_inirp_deinit;
- /* step 3.
- * initialize the dvobj_priv
- */
-
- status = padapter->dvobj_init(padapter);
- if (status != _SUCCESS)
- goto free_netdev;
-
- /* step 4. */
- status = r8712_init_drv_sw(padapter);
- if (status)
- goto dvobj_deinit;
- /* step 5. read efuse/eeprom data and get mac_addr */
- {
- int i, offset;
- u8 mac[6];
- u8 tmpU1b, AutoloadFail, eeprom_CustomerID;
- u8 *pdata = padapter->eeprompriv.efuse_eeprom_data;
-
- tmpU1b = r8712_read8(padapter, EE_9346CR);/*CR9346*/
-
- /* To check system boot selection.*/
- dev_info(&udev->dev, "r8712u: Boot from %s: Autoload %s\n",
- (tmpU1b & _9356SEL) ? "EEPROM" : "EFUSE",
- (tmpU1b & _EEPROM_EN) ? "OK" : "Failed");
-
- /* To check autoload success or not.*/
- if (tmpU1b & _EEPROM_EN) {
- AutoloadFail = true;
- /* The following operations prevent Efuse leakage by
- * turning on 2.5V.
- */
- tmpU1b = r8712_read8(padapter, EFUSE_TEST + 3);
- r8712_write8(padapter, EFUSE_TEST + 3, tmpU1b | 0x80);
- msleep(20);
- r8712_write8(padapter, EFUSE_TEST + 3,
- (tmpU1b & (~BIT(7))));
-
- /* Retrieve Chip version.
- * Recognize IC version by Reg0x4 BIT15.
- */
- tmpU1b = (u8)((r8712_read32(padapter, PMC_FSM) >> 15) &
- 0x1F);
- if (tmpU1b == 0x3)
- padapter->registrypriv.chip_version =
- RTL8712_3rdCUT;
- else
- padapter->registrypriv.chip_version =
- (tmpU1b >> 1) + 1;
- switch (padapter->registrypriv.chip_version) {
- case RTL8712_1stCUT:
- case RTL8712_2ndCUT:
- case RTL8712_3rdCUT:
- break;
- default:
- padapter->registrypriv.chip_version =
- RTL8712_2ndCUT;
- break;
- }
-
- for (i = 0, offset = 0; i < 128; i += 8, offset++)
- r8712_efuse_pg_packet_read(padapter, offset,
- &pdata[i]);
-
- if (!r8712_initmac || !mac_pton(r8712_initmac, mac)) {
- /* Use the mac address stored in the Efuse
- * offset = 0x12 for usb in efuse
- */
- ether_addr_copy(mac, &pdata[0x12]);
- }
- eeprom_CustomerID = pdata[0x52];
- switch (eeprom_CustomerID) {
- case EEPROM_CID_ALPHA:
- padapter->eeprompriv.CustomerID =
- RT_CID_819x_ALPHA;
- break;
- case EEPROM_CID_CAMEO:
- padapter->eeprompriv.CustomerID =
- RT_CID_819x_CAMEO;
- break;
- case EEPROM_CID_SITECOM:
- padapter->eeprompriv.CustomerID =
- RT_CID_819x_Sitecom;
- break;
- case EEPROM_CID_COREGA:
- padapter->eeprompriv.CustomerID =
- RT_CID_COREGA;
- break;
- case EEPROM_CID_Senao:
- padapter->eeprompriv.CustomerID =
- RT_CID_819x_Senao;
- break;
- case EEPROM_CID_EDIMAX_BELKIN:
- padapter->eeprompriv.CustomerID =
- RT_CID_819x_Edimax_Belkin;
- break;
- case EEPROM_CID_SERCOMM_BELKIN:
- padapter->eeprompriv.CustomerID =
- RT_CID_819x_Sercomm_Belkin;
- break;
- case EEPROM_CID_WNC_COREGA:
- padapter->eeprompriv.CustomerID =
- RT_CID_819x_WNC_COREGA;
- break;
- case EEPROM_CID_WHQL:
- break;
- case EEPROM_CID_NetCore:
- padapter->eeprompriv.CustomerID =
- RT_CID_819x_Netcore;
- break;
- case EEPROM_CID_CAMEO1:
- padapter->eeprompriv.CustomerID =
- RT_CID_819x_CAMEO1;
- break;
- case EEPROM_CID_CLEVO:
- padapter->eeprompriv.CustomerID =
- RT_CID_819x_CLEVO;
- break;
- default:
- padapter->eeprompriv.CustomerID =
- RT_CID_DEFAULT;
- break;
- }
- dev_info(&udev->dev, "r8712u: CustomerID = 0x%.4x\n",
- padapter->eeprompriv.CustomerID);
- /* Led mode */
- switch (padapter->eeprompriv.CustomerID) {
- case RT_CID_DEFAULT:
- case RT_CID_819x_ALPHA:
- case RT_CID_819x_CAMEO:
- padapter->ledpriv.LedStrategy = SW_LED_MODE1;
- padapter->ledpriv.bRegUseLed = true;
- break;
- case RT_CID_819x_Sitecom:
- padapter->ledpriv.LedStrategy = SW_LED_MODE2;
- padapter->ledpriv.bRegUseLed = true;
- break;
- case RT_CID_COREGA:
- case RT_CID_819x_Senao:
- padapter->ledpriv.LedStrategy = SW_LED_MODE3;
- padapter->ledpriv.bRegUseLed = true;
- break;
- case RT_CID_819x_Edimax_Belkin:
- padapter->ledpriv.LedStrategy = SW_LED_MODE4;
- padapter->ledpriv.bRegUseLed = true;
- break;
- case RT_CID_819x_Sercomm_Belkin:
- padapter->ledpriv.LedStrategy = SW_LED_MODE5;
- padapter->ledpriv.bRegUseLed = true;
- break;
- case RT_CID_819x_WNC_COREGA:
- padapter->ledpriv.LedStrategy = SW_LED_MODE6;
- padapter->ledpriv.bRegUseLed = true;
- break;
- default:
- padapter->ledpriv.LedStrategy = SW_LED_MODE0;
- padapter->ledpriv.bRegUseLed = false;
- break;
- }
- } else {
- AutoloadFail = false;
- }
- if ((!AutoloadFail) ||
- ((mac[0] == 0xff) && (mac[1] == 0xff) &&
- (mac[2] == 0xff) && (mac[3] == 0xff) &&
- (mac[4] == 0xff) && (mac[5] == 0xff)) ||
- ((mac[0] == 0x00) && (mac[1] == 0x00) &&
- (mac[2] == 0x00) && (mac[3] == 0x00) &&
- (mac[4] == 0x00) && (mac[5] == 0x00))) {
- mac[0] = 0x00;
- mac[1] = 0xe0;
- mac[2] = 0x4c;
- mac[3] = 0x87;
- mac[4] = 0x00;
- mac[5] = 0x00;
- }
- if (r8712_initmac) {
- /* Make sure the user did not select a multicast
- * address by setting bit 1 of first octet.
- */
- mac[0] &= 0xFE;
- dev_info(&udev->dev,
- "r8712u: MAC Address from user = %pM\n", mac);
- } else {
- dev_info(&udev->dev,
- "r8712u: MAC Address from efuse = %pM\n", mac);
- }
- eth_hw_addr_set(pnetdev, mac);
- }
- /* step 6. Load the firmware asynchronously */
- if (rtl871x_load_fw(padapter))
- goto deinit_drv_sw;
- init_completion(&padapter->rx_filter_ready);
- return 0;
-
-deinit_drv_sw:
- r8712_free_drv_sw(padapter);
-dvobj_deinit:
- padapter->dvobj_deinit(padapter);
-free_netdev:
- free_netdev(pnetdev);
-put_dev:
- usb_put_dev(udev);
- usb_set_intfdata(pusb_intf, NULL);
- return -ENODEV;
-}
-
-/* rmmod module & unplug(SurpriseRemoved) will call r871xu_dev_remove()
- * => how to recognize both
- */
-static void r871xu_dev_remove(struct usb_interface *pusb_intf)
-{
- struct net_device *pnetdev = usb_get_intfdata(pusb_intf);
- struct usb_device *udev = interface_to_usbdev(pusb_intf);
- struct _adapter *padapter = netdev_priv(pnetdev);
-
- /* never exit with a firmware callback pending */
- wait_for_completion(&padapter->rtl8712_fw_ready);
- if (pnetdev->reg_state != NETREG_UNINITIALIZED)
- unregister_netdev(pnetdev); /* will call netdev_close() */
- usb_set_intfdata(pusb_intf, NULL);
- release_firmware(padapter->fw);
- if (drvpriv.drv_registered)
- padapter->surprise_removed = true;
- r8712_flush_rwctrl_works(padapter);
- r8712_flush_led_works(padapter);
- udelay(1);
- /* Stop driver mlme relation timer */
- r8712_stop_drv_timers(padapter);
- r871x_dev_unload(padapter);
- if (padapter->dvobj_deinit)
- padapter->dvobj_deinit(padapter);
- r8712_free_drv_sw(padapter);
- free_netdev(pnetdev);
-
- /* decrease the reference count of the usb device structure
- * when disconnect
- */
- usb_put_dev(udev);
-
- /* If we didn't unplug usb dongle and remove/insert module, driver
- * fails on sitesurvey for the first time when device is up.
- * Reset usb port for sitesurvey fail issue.
- */
- if (udev->state != USB_STATE_NOTATTACHED)
- usb_reset_device(udev);
-}
-
-static int __init r8712u_drv_entry(void)
-{
- drvpriv.drv_registered = true;
- return usb_register(&drvpriv.r871xu_drv);
-}
-
-static void __exit r8712u_drv_halt(void)
-{
- drvpriv.drv_registered = false;
- usb_deregister(&drvpriv.r871xu_drv);
-}
-
-module_init(r8712u_drv_entry);
-module_exit(r8712u_drv_halt);
--- a/drivers/staging/rtl8712/usb_ops.c
+++ /dev/null
@@ -1,195 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * usb_ops.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _HCI_OPS_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "osdep_intf.h"
-#include "usb_ops.h"
-#include "recv_osdep.h"
-
-static u8 usb_read8(struct intf_hdl *intfhdl, u32 addr)
-{
- u8 request;
- u8 requesttype;
- u16 wvalue;
- u16 index;
- u16 len;
- int status;
- __le32 data = 0;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
- requesttype = 0x01; /* read_in */
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 1;
- status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
- &data, len, requesttype);
- if (status < 0)
- return 0;
- return (u8)(le32_to_cpu(data) & 0x0ff);
-}
-
-static u16 usb_read16(struct intf_hdl *intfhdl, u32 addr)
-{
- u8 request;
- u8 requesttype;
- u16 wvalue;
- u16 index;
- u16 len;
- int status;
- __le32 data = 0;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
- requesttype = 0x01; /* read_in */
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 2;
- status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
- &data, len, requesttype);
- if (status < 0)
- return 0;
- return (u16)(le32_to_cpu(data) & 0xffff);
-}
-
-static u32 usb_read32(struct intf_hdl *intfhdl, u32 addr)
-{
- u8 request;
- u8 requesttype;
- u16 wvalue;
- u16 index;
- u16 len;
- int status;
- __le32 data = 0;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
- requesttype = 0x01; /* read_in */
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 4;
- status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
- &data, len, requesttype);
- if (status < 0)
- return 0;
- return le32_to_cpu(data);
-}
-
-static void usb_write8(struct intf_hdl *intfhdl, u32 addr, u8 val)
-{
- u8 request;
- u8 requesttype;
- u16 wvalue;
- u16 index;
- u16 len;
- __le32 data;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
- requesttype = 0x00; /* write_out */
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 1;
- data = cpu_to_le32((u32)val & 0x000000ff);
- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
- requesttype);
-}
-
-static void usb_write16(struct intf_hdl *intfhdl, u32 addr, u16 val)
-{
- u8 request;
- u8 requesttype;
- u16 wvalue;
- u16 index;
- u16 len;
- __le32 data;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
- requesttype = 0x00; /* write_out */
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 2;
- data = cpu_to_le32((u32)val & 0x0000ffff);
- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
- requesttype);
-}
-
-static void usb_write32(struct intf_hdl *intfhdl, u32 addr, u32 val)
-{
- u8 request;
- u8 requesttype;
- u16 wvalue;
- u16 index;
- u16 len;
- __le32 data;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
- requesttype = 0x00; /* write_out */
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 4;
- data = cpu_to_le32(val);
- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
- requesttype);
-}
-
-void r8712_usb_set_intf_option(u32 *option)
-{
- *option = ((*option) | _INTF_ASYNC_);
-}
-
-static void usb_intf_hdl_init(u8 *priv)
-{
-}
-
-static void usb_intf_hdl_unload(u8 *priv)
-{
-}
-
-static void usb_intf_hdl_open(u8 *priv)
-{
-}
-
-static void usb_intf_hdl_close(u8 *priv)
-{
-}
-
-void r8712_usb_set_intf_funs(struct intf_hdl *intfhdl)
-{
- intfhdl->intf_hdl_init = usb_intf_hdl_init;
- intfhdl->intf_hdl_unload = usb_intf_hdl_unload;
- intfhdl->intf_hdl_open = usb_intf_hdl_open;
- intfhdl->intf_hdl_close = usb_intf_hdl_close;
-}
-
-void r8712_usb_set_intf_ops(struct _io_ops *ops)
-{
- memset((u8 *)ops, 0, sizeof(struct _io_ops));
- ops->_read8 = usb_read8;
- ops->_read16 = usb_read16;
- ops->_read32 = usb_read32;
- ops->_read_port = r8712_usb_read_port;
- ops->_write8 = usb_write8;
- ops->_write16 = usb_write16;
- ops->_write32 = usb_write32;
- ops->_write_mem = r8712_usb_write_mem;
- ops->_write_port = r8712_usb_write_port;
-}
--- a/drivers/staging/rtl8712/usb_ops.h
+++ /dev/null
@@ -1,38 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __USB_OPS_H_
-#define __USB_OPS_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "osdep_intf.h"
-
-void r8712_usb_write_mem(struct intf_hdl *pintfhdl, u32 addr,
- u32 cnt, u8 *wmem);
-u32 r8712_usb_write_port(struct intf_hdl *pintfhdl, u32 addr,
- u32 cnt, u8 *wmem);
-u32 r8712_usb_read_port(struct intf_hdl *pintfhdl, u32 addr,
- u32 cnt, u8 *rmem);
-void r8712_usb_set_intf_option(u32 *poption);
-void r8712_usb_set_intf_funs(struct intf_hdl *pintf_hdl);
-uint r8712_usb_init_intf_priv(struct intf_priv *pintfpriv);
-void r8712_usb_unload_intf_priv(struct intf_priv *pintfpriv);
-void r8712_usb_set_intf_ops(struct _io_ops *pops);
-void r8712_usb_read_port_cancel(struct _adapter *padapter);
-void r8712_usb_write_port_cancel(struct _adapter *padapter);
-int r8712_usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value,
- u16 index, void *pdata, u16 len, u8 requesttype);
-
-#endif
-
--- a/drivers/staging/rtl8712/usb_ops_linux.c
+++ /dev/null
@@ -1,515 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * usb_ops_linux.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _HCI_OPS_OS_C_
-
-#include <linux/usb.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "osdep_intf.h"
-#include "usb_ops.h"
-
-#define RTL871X_VENQT_READ 0xc0
-#define RTL871X_VENQT_WRITE 0x40
-
-struct zero_bulkout_context {
- void *pbuf;
- void *purb;
- void *pirp;
- void *padapter;
-};
-
-uint r8712_usb_init_intf_priv(struct intf_priv *pintfpriv)
-{
- pintfpriv->piorw_urb = usb_alloc_urb(0, GFP_ATOMIC);
- if (!pintfpriv->piorw_urb)
- return _FAIL;
- init_completion(&pintfpriv->io_retevt_comp);
- return _SUCCESS;
-}
-
-void r8712_usb_unload_intf_priv(struct intf_priv *pintfpriv)
-{
- if (pintfpriv->piorw_urb) {
- usb_kill_urb(pintfpriv->piorw_urb);
- usb_free_urb(pintfpriv->piorw_urb);
- }
-}
-
-static unsigned int ffaddr2pipehdl(struct dvobj_priv *pdvobj, u32 addr)
-{
- unsigned int pipe = 0;
- struct usb_device *pusbd = pdvobj->pusbdev;
-
- if (pdvobj->nr_endpoint == 11) {
- switch (addr) {
- case RTL8712_DMA_BKQ:
- pipe = usb_sndbulkpipe(pusbd, 0x07);
- break;
- case RTL8712_DMA_BEQ:
- pipe = usb_sndbulkpipe(pusbd, 0x06);
- break;
- case RTL8712_DMA_VIQ:
- pipe = usb_sndbulkpipe(pusbd, 0x05);
- break;
- case RTL8712_DMA_VOQ:
- pipe = usb_sndbulkpipe(pusbd, 0x04);
- break;
- case RTL8712_DMA_BCNQ:
- pipe = usb_sndbulkpipe(pusbd, 0x0a);
- break;
- case RTL8712_DMA_BMCQ: /* HI Queue */
- pipe = usb_sndbulkpipe(pusbd, 0x0b);
- break;
- case RTL8712_DMA_MGTQ:
- pipe = usb_sndbulkpipe(pusbd, 0x0c);
- break;
- case RTL8712_DMA_RX0FF:
- pipe = usb_rcvbulkpipe(pusbd, 0x03); /* in */
- break;
- case RTL8712_DMA_C2HCMD:
- pipe = usb_rcvbulkpipe(pusbd, 0x09); /* in */
- break;
- case RTL8712_DMA_H2CCMD:
- pipe = usb_sndbulkpipe(pusbd, 0x0d);
- break;
- }
- } else if (pdvobj->nr_endpoint == 6) {
- switch (addr) {
- case RTL8712_DMA_BKQ:
- pipe = usb_sndbulkpipe(pusbd, 0x07);
- break;
- case RTL8712_DMA_BEQ:
- pipe = usb_sndbulkpipe(pusbd, 0x06);
- break;
- case RTL8712_DMA_VIQ:
- pipe = usb_sndbulkpipe(pusbd, 0x05);
- break;
- case RTL8712_DMA_VOQ:
- pipe = usb_sndbulkpipe(pusbd, 0x04);
- break;
- case RTL8712_DMA_RX0FF:
- case RTL8712_DMA_C2HCMD:
- pipe = usb_rcvbulkpipe(pusbd, 0x03); /* in */
- break;
- case RTL8712_DMA_H2CCMD:
- case RTL8712_DMA_BCNQ:
- case RTL8712_DMA_BMCQ:
- case RTL8712_DMA_MGTQ:
- pipe = usb_sndbulkpipe(pusbd, 0x0d);
- break;
- }
- } else if (pdvobj->nr_endpoint == 4) {
- switch (addr) {
- case RTL8712_DMA_BEQ:
- pipe = usb_sndbulkpipe(pusbd, 0x06);
- break;
- case RTL8712_DMA_VOQ:
- pipe = usb_sndbulkpipe(pusbd, 0x04);
- break;
- case RTL8712_DMA_RX0FF:
- case RTL8712_DMA_C2HCMD:
- pipe = usb_rcvbulkpipe(pusbd, 0x03); /* in */
- break;
- case RTL8712_DMA_H2CCMD:
- case RTL8712_DMA_BCNQ:
- case RTL8712_DMA_BMCQ:
- case RTL8712_DMA_MGTQ:
- pipe = usb_sndbulkpipe(pusbd, 0x0d);
- break;
- }
- } else {
- pipe = 0;
- }
- return pipe;
-}
-
-static void usb_write_mem_complete(struct urb *purb)
-{
- struct io_queue *pio_q = (struct io_queue *)purb->context;
- struct intf_hdl *pintf = &(pio_q->intf);
- struct intf_priv *pintfpriv = pintf->pintfpriv;
- struct _adapter *padapter = (struct _adapter *)pintf->adapter;
-
- if (purb->status != 0) {
- if (purb->status == (-ESHUTDOWN))
- padapter->driver_stopped = true;
- else
- padapter->surprise_removed = true;
- }
- complete(&pintfpriv->io_retevt_comp);
-}
-
-void r8712_usb_write_mem(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem)
-{
- unsigned int pipe;
- struct _adapter *padapter = (struct _adapter *)pintfhdl->adapter;
- struct intf_priv *pintfpriv = pintfhdl->pintfpriv;
- struct io_queue *pio_queue = padapter->pio_queue;
- struct dvobj_priv *pdvobj = (struct dvobj_priv *)pintfpriv->intf_dev;
- struct usb_device *pusbd = pdvobj->pusbdev;
- struct urb *piorw_urb = pintfpriv->piorw_urb;
-
- if ((padapter->driver_stopped) || (padapter->surprise_removed) ||
- (padapter->pwrctrlpriv.pnp_bstop_trx))
- return;
- /* translate DMA FIFO addr to pipehandle */
- pipe = ffaddr2pipehdl(pdvobj, addr);
- if (pipe == 0)
- return;
- usb_fill_bulk_urb(piorw_urb, pusbd, pipe,
- wmem, cnt, usb_write_mem_complete,
- pio_queue);
- usb_submit_urb(piorw_urb, GFP_ATOMIC);
- wait_for_completion_interruptible(&pintfpriv->io_retevt_comp);
-}
-
-static void r8712_usb_read_port_complete(struct urb *purb)
-{
- uint isevt;
- __le32 *pbuf;
- struct recv_buf *precvbuf = (struct recv_buf *)purb->context;
- struct _adapter *padapter = (struct _adapter *)precvbuf->adapter;
- struct recv_priv *precvpriv = &padapter->recvpriv;
-
- if (padapter->surprise_removed || padapter->driver_stopped)
- return;
- if (purb->status == 0) { /* SUCCESS */
- if ((purb->actual_length > (MAX_RECVBUF_SZ)) ||
- (purb->actual_length < RXDESC_SIZE)) {
- r8712_read_port(padapter, precvpriv->ff_hwaddr, 0,
- (unsigned char *)precvbuf);
- } else {
- _pkt *pskb = precvbuf->pskb;
-
- precvbuf->transfer_len = purb->actual_length;
- pbuf = (__le32 *)precvbuf->pbuf;
- isevt = le32_to_cpu(*(pbuf + 1)) & 0x1ff;
- if ((isevt & 0x1ff) == 0x1ff) {
- r8712_rxcmd_event_hdl(padapter, pbuf);
- skb_queue_tail(&precvpriv->rx_skb_queue, pskb);
- r8712_read_port(padapter, precvpriv->ff_hwaddr,
- 0, (unsigned char *)precvbuf);
- } else {
- skb_put(pskb, purb->actual_length);
- skb_queue_tail(&precvpriv->rx_skb_queue, pskb);
- tasklet_hi_schedule(&precvpriv->recv_tasklet);
- r8712_read_port(padapter, precvpriv->ff_hwaddr,
- 0, (unsigned char *)precvbuf);
- }
- }
- } else {
- switch (purb->status) {
- case -EINVAL:
- case -EPIPE:
- case -ENODEV:
- case -ESHUTDOWN:
- padapter->driver_stopped = true;
- break;
- case -ENOENT:
- if (!padapter->suspended) {
- padapter->driver_stopped = true;
- break;
- }
- fallthrough;
- case -EPROTO:
- r8712_read_port(padapter, precvpriv->ff_hwaddr, 0,
- (unsigned char *)precvbuf);
- break;
- case -EINPROGRESS:
- netdev_err(padapter->pnetdev, "ERROR: URB IS IN PROGRESS!\n");
- break;
- default:
- break;
- }
- }
-}
-
-u32 r8712_usb_read_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *rmem)
-{
- unsigned int pipe;
- int err;
- u32 tmpaddr = 0;
- int alignment = 0;
- u32 ret = _SUCCESS;
- struct urb *purb = NULL;
- struct recv_buf *precvbuf = (struct recv_buf *)rmem;
- struct intf_priv *pintfpriv = pintfhdl->pintfpriv;
- struct dvobj_priv *pdvobj = (struct dvobj_priv *)pintfpriv->intf_dev;
- struct _adapter *adapter = pdvobj->padapter;
- struct recv_priv *precvpriv = &adapter->recvpriv;
- struct usb_device *pusbd = pdvobj->pusbdev;
-
- if (adapter->driver_stopped || adapter->surprise_removed ||
- adapter->pwrctrlpriv.pnp_bstop_trx || !precvbuf)
- return _FAIL;
- r8712_init_recvbuf(adapter, precvbuf);
- /* Try to use skb from the free queue */
- precvbuf->pskb = skb_dequeue(&precvpriv->free_recv_skb_queue);
-
- if (!precvbuf->pskb) {
- precvbuf->pskb = netdev_alloc_skb(adapter->pnetdev,
- MAX_RECVBUF_SZ + RECVBUFF_ALIGN_SZ);
- if (!precvbuf->pskb)
- return _FAIL;
- tmpaddr = (addr_t)precvbuf->pskb->data;
- alignment = tmpaddr & (RECVBUFF_ALIGN_SZ - 1);
- skb_reserve(precvbuf->pskb,
- (RECVBUFF_ALIGN_SZ - alignment));
- precvbuf->phead = precvbuf->pskb->head;
- precvbuf->pdata = precvbuf->pskb->data;
- precvbuf->ptail = skb_tail_pointer(precvbuf->pskb);
- precvbuf->pend = skb_end_pointer(precvbuf->pskb);
- precvbuf->pbuf = precvbuf->pskb->data;
- } else { /* skb is reused */
- precvbuf->phead = precvbuf->pskb->head;
- precvbuf->pdata = precvbuf->pskb->data;
- precvbuf->ptail = skb_tail_pointer(precvbuf->pskb);
- precvbuf->pend = skb_end_pointer(precvbuf->pskb);
- precvbuf->pbuf = precvbuf->pskb->data;
- }
- purb = precvbuf->purb;
- /* translate DMA FIFO addr to pipehandle */
- pipe = ffaddr2pipehdl(pdvobj, addr);
- usb_fill_bulk_urb(purb, pusbd, pipe,
- precvbuf->pbuf, MAX_RECVBUF_SZ,
- r8712_usb_read_port_complete,
- precvbuf);
- err = usb_submit_urb(purb, GFP_ATOMIC);
- if ((err) && (err != (-EPERM)))
- ret = _FAIL;
- return ret;
-}
-
-void r8712_usb_read_port_cancel(struct _adapter *padapter)
-{
- int i;
- struct recv_buf *precvbuf;
-
- precvbuf = (struct recv_buf *)padapter->recvpriv.precv_buf;
- for (i = 0; i < NR_RECVBUFF; i++) {
- if (precvbuf->purb)
- usb_kill_urb(precvbuf->purb);
- precvbuf++;
- }
-}
-
-void r8712_xmit_bh(struct tasklet_struct *t)
-{
- int ret = false;
- struct _adapter *padapter = from_tasklet(padapter, t,
- xmitpriv.xmit_tasklet);
- struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
-
- if (padapter->driver_stopped ||
- padapter->surprise_removed) {
- netdev_err(padapter->pnetdev, "xmit_bh => driver_stopped or surprise_removed\n");
- return;
- }
- ret = r8712_xmitframe_complete(padapter, pxmitpriv, NULL);
- if (!ret)
- return;
- tasklet_hi_schedule(&pxmitpriv->xmit_tasklet);
-}
-
-static void usb_write_port_complete(struct urb *purb)
-{
- int i;
- struct xmit_frame *pxmitframe = (struct xmit_frame *)purb->context;
- struct xmit_buf *pxmitbuf = pxmitframe->pxmitbuf;
- struct _adapter *padapter = pxmitframe->padapter;
- struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
- struct pkt_attrib *pattrib = &pxmitframe->attrib;
-
- switch (pattrib->priority) {
- case 1:
- case 2:
- pxmitpriv->bkq_cnt--;
- break;
- case 4:
- case 5:
- pxmitpriv->viq_cnt--;
- break;
- case 6:
- case 7:
- pxmitpriv->voq_cnt--;
- break;
- case 0:
- case 3:
- default:
- pxmitpriv->beq_cnt--;
- break;
- }
- pxmitpriv->txirp_cnt--;
- for (i = 0; i < 8; i++) {
- if (purb == pxmitframe->pxmit_urb[i]) {
- pxmitframe->bpending[i] = false;
- break;
- }
- }
- if (padapter->surprise_removed)
- return;
- switch (purb->status) {
- case 0:
- break;
- default:
- netdev_warn(padapter->pnetdev,
- "r8712u: pipe error: (%d)\n", purb->status);
- break;
- }
- /* not to consider tx fragment */
- r8712_free_xmitframe_ex(pxmitpriv, pxmitframe);
- r8712_free_xmitbuf(pxmitpriv, pxmitbuf);
- tasklet_hi_schedule(&pxmitpriv->xmit_tasklet);
-}
-
-u32 r8712_usb_write_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem)
-{
- unsigned long irqL;
- int i, status;
- unsigned int pipe;
- u32 ret, bwritezero;
- struct urb *purb = NULL;
- struct _adapter *padapter = (struct _adapter *)pintfhdl->adapter;
- struct dvobj_priv *pdvobj = &padapter->dvobjpriv;
- struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
- struct xmit_frame *pxmitframe = (struct xmit_frame *)wmem;
- struct usb_device *pusbd = pdvobj->pusbdev;
- struct pkt_attrib *pattrib = &pxmitframe->attrib;
-
- if ((padapter->driver_stopped) || (padapter->surprise_removed) ||
- (padapter->pwrctrlpriv.pnp_bstop_trx))
- return _FAIL;
- for (i = 0; i < 8; i++) {
- if (!pxmitframe->bpending[i]) {
- spin_lock_irqsave(&pxmitpriv->lock, irqL);
- pxmitpriv->txirp_cnt++;
- pxmitframe->bpending[i] = true;
- switch (pattrib->priority) {
- case 1:
- case 2:
- pxmitpriv->bkq_cnt++;
- break;
- case 4:
- case 5:
- pxmitpriv->viq_cnt++;
- break;
- case 6:
- case 7:
- pxmitpriv->voq_cnt++;
- break;
- case 0:
- case 3:
- default:
- pxmitpriv->beq_cnt++;
- break;
- }
- spin_unlock_irqrestore(&pxmitpriv->lock, irqL);
- pxmitframe->sz[i] = (u16)cnt;
- purb = pxmitframe->pxmit_urb[i];
- break;
- }
- }
- bwritezero = false;
- if (pdvobj->ishighspeed) {
- if (cnt > 0 && cnt % 512 == 0)
- bwritezero = true;
- } else {
- if (cnt > 0 && cnt % 64 == 0)
- bwritezero = true;
- }
- /* translate DMA FIFO addr to pipehandle */
- pipe = ffaddr2pipehdl(pdvobj, addr);
- if (pxmitpriv->free_xmitbuf_cnt % NR_XMITBUFF == 0)
- purb->transfer_flags &= (~URB_NO_INTERRUPT);
- else
- purb->transfer_flags |= URB_NO_INTERRUPT;
- if (bwritezero)
- cnt += 8;
- usb_fill_bulk_urb(purb, pusbd, pipe,
- pxmitframe->mem_addr,
- cnt, usb_write_port_complete,
- pxmitframe); /* context is xmit_frame */
- status = usb_submit_urb(purb, GFP_ATOMIC);
- if (!status)
- ret = _SUCCESS;
- else
- ret = _FAIL;
- return ret;
-}
-
-void r8712_usb_write_port_cancel(struct _adapter *padapter)
-{
- int i, j;
- struct xmit_buf *pxmitbuf = (struct xmit_buf *)
- padapter->xmitpriv.pxmitbuf;
-
- for (i = 0; i < NR_XMITBUFF; i++) {
- for (j = 0; j < 8; j++) {
- if (pxmitbuf->pxmit_urb[j])
- usb_kill_urb(pxmitbuf->pxmit_urb[j]);
- }
- pxmitbuf++;
- }
-}
-
-int r8712_usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value,
- u16 index, void *pdata, u16 len, u8 requesttype)
-{
- unsigned int pipe;
- int status;
- u8 reqtype;
- struct dvobj_priv *pdvobjpriv = (struct dvobj_priv *)
- pintfpriv->intf_dev;
- struct usb_device *udev = pdvobjpriv->pusbdev;
- /* For mstar platform, mstar suggests the address for USB IO
- * should be 16 bytes alignment. Trying to fix it here.
- */
- u8 *palloc_buf, *pIo_buf;
-
- palloc_buf = kmalloc((u32)len + 16, GFP_ATOMIC);
- if (!palloc_buf)
- return -ENOMEM;
- pIo_buf = palloc_buf + 16 - ((addr_t)(palloc_buf) & 0x0f);
- if (requesttype == 0x01) {
- pipe = usb_rcvctrlpipe(udev, 0); /* read_in */
- reqtype = RTL871X_VENQT_READ;
- } else {
- pipe = usb_sndctrlpipe(udev, 0); /* write_out */
- reqtype = RTL871X_VENQT_WRITE;
- memcpy(pIo_buf, pdata, len);
- }
- status = usb_control_msg(udev, pipe, request, reqtype, value, index,
- pIo_buf, len, 500);
- if (status < 0)
- goto free;
- if (status != len) {
- status = -EREMOTEIO;
- goto free;
- }
- /* Success this control transfer. */
- if (requesttype == 0x01) {
- /* For Control read transfer, we have to copy the read
- * data from pIo_buf to pdata.
- */
- memcpy(pdata, pIo_buf, status);
- }
-
-free:
- kfree(palloc_buf);
- return status;
-}
--- a/drivers/staging/rtl8712/usb_osintf.h
+++ /dev/null
@@ -1,35 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __USB_OSINTF_H
-#define __USB_OSINTF_H
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-extern char *r8712_initmac;
-
-unsigned int r8712_usb_inirp_init(struct _adapter *padapter);
-unsigned int r8712_usb_inirp_deinit(struct _adapter *padapter);
-uint rtl871x_hal_init(struct _adapter *padapter);
-uint rtl8712_hal_deinit(struct _adapter *padapter);
-
-void rtl871x_intf_stop(struct _adapter *padapter);
-void r871x_dev_unload(struct _adapter *padapter);
-void r8712_stop_drv_threads(struct _adapter *padapter);
-void r8712_stop_drv_timers(struct _adapter *padapter);
-int r8712_init_drv_sw(struct _adapter *padapter);
-void r8712_free_drv_sw(struct _adapter *padapter);
-struct net_device *r8712_init_netdev(void);
-
-#endif
--- a/drivers/staging/rtl8712/wifi.h
+++ /dev/null
@@ -1,196 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _WIFI_H_
-#define _WIFI_H_
-
-#include <linux/compiler.h>
-#include <linux/ieee80211.h>
-
-#define WLAN_HDR_A3_LEN 24
-#define WLAN_HDR_A3_QOS_LEN 26
-
-enum WIFI_FRAME_TYPE {
- WIFI_QOS_DATA_TYPE = (BIT(7) | BIT(3)), /*!< QoS Data */
-};
-
-#define SetToDs(pbuf) ({ \
- *(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_TODS); \
-})
-
-#define GetToDs(pbuf) (((*(__le16 *)(pbuf)) & cpu_to_le16(IEEE80211_FCTL_TODS)) != 0)
-
-#define ClearToDs(pbuf) ({ \
- *(__le16 *)(pbuf) &= (~cpu_to_le16(IEEE80211_FCTL_TODS)); \
-})
-
-#define SetFrDs(pbuf) ({ \
- *(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_FROMDS); \
-})
-
-#define GetFrDs(pbuf) (((*(__le16 *)(pbuf)) & cpu_to_le16(IEEE80211_FCTL_FROMDS)) != 0)
-
-#define ClearFrDs(pbuf) ({ \
- *(__le16 *)(pbuf) &= (~cpu_to_le16(IEEE80211_FCTL_FROMDS)); \
-})
-
-static inline unsigned char get_tofr_ds(unsigned char *pframe)
-{
- return ((GetToDs(pframe) << 1) | GetFrDs(pframe));
-}
-
-#define SetMFrag(pbuf) ({ \
- *(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_MOREFRAGS); \
-})
-
-#define GetMFrag(pbuf) (((*(__le16 *)(pbuf)) & cpu_to_le16(IEEE80211_FCTL_MOREFRAGS)) != 0)
-
-#define ClearMFrag(pbuf) ({ \
- *(__le16 *)(pbuf) &= (~cpu_to_le16(IEEE80211_FCTL_MOREFRAGS)); \
-})
-
-#define SetRetry(pbuf) ({ \
- *(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_RETRY); \
-})
-
-#define GetRetry(pbuf) (((*(__le16 *)(pbuf)) & cpu_to_le16(IEEE80211_FCTL_RETRY)) != 0)
-
-#define ClearRetry(pbuf) ({ \
- *(__le16 *)(pbuf) &= (~cpu_to_le16(IEEE80211_FCTL_RETRY)); \
-})
-
-#define SetPwrMgt(pbuf) ({ \
- *(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_PM); \
-})
-
-#define GetPwrMgt(pbuf) (((*(__le16 *)(pbuf)) & \
- cpu_to_le16(IEEE80211_FCTL_PM)) != 0)
-
-#define ClearPwrMgt(pbuf) ({ \
- *(__le16 *)(pbuf) &= (~cpu_to_le16(IEEE80211_FCTL_PM)); \
-})
-
-#define SetMData(pbuf) ({ \
- *(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_MOREDATA); \
-})
-
-#define GetMData(pbuf) (((*(__le16 *)(pbuf)) & \
- cpu_to_le16(IEEE80211_FCTL_MOREDATA)) != 0)
-
-#define ClearMData(pbuf) ({ \
- *(__le16 *)(pbuf) &= (~cpu_to_le16(IEEE80211_FCTL_MOREDATA)); \
-})
-
-#define SetPrivacy(pbuf) ({ \
- *(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_PROTECTED); \
-})
-
-#define GetPrivacy(pbuf) (((*(__le16 *)(pbuf)) & \
- cpu_to_le16(IEEE80211_FCTL_PROTECTED)) != 0)
-
-#define GetOrder(pbuf) (((*(__le16 *)(pbuf)) & \
- cpu_to_le16(IEEE80211_FCTL_ORDER)) != 0)
-
-#define GetFrameType(pbuf) (le16_to_cpu(*(__le16 *)(pbuf)) & \
- (BIT(3) | BIT(2)))
-
-#define SetFrameType(pbuf, type) \
- do { \
- *(__le16 *)(pbuf) &= cpu_to_le16(~(BIT(3) | \
- BIT(2))); \
- *(__le16 *)(pbuf) |= cpu_to_le16(type); \
- } while (0)
-
-#define GetFrameSubType(pbuf) (le16_to_cpu(*(__le16 *)(pbuf)) & \
- (BIT(7) | BIT(6) | BIT(5) | BIT(4) | BIT(3) | \
- BIT(2)))
-
-#define SetFrameSubType(pbuf, type) \
- do { \
- *(__le16 *)(pbuf) &= cpu_to_le16(~(BIT(7) | BIT(6) | \
- BIT(5) | BIT(4) | BIT(3) | BIT(2))); \
- *(__le16 *)(pbuf) |= cpu_to_le16(type); \
- } while (0)
-
-#define GetSequence(pbuf) (le16_to_cpu(*(__le16 *)\
- ((addr_t)(pbuf) + 22)) >> 4)
-
-#define GetFragNum(pbuf) (le16_to_cpu(*(__le16 *)((addr_t)\
- (pbuf) + 22)) & 0x0f)
-
-#define SetSeqNum(pbuf, num) ({ \
- *(__le16 *)((addr_t)(pbuf) + 22) = \
- cpu_to_le16((le16_to_cpu(*(__le16 *)((addr_t)(pbuf) + 22)) & \
- 0x000f) | (0xfff0 & (num << 4))); \
-})
-
-#define SetPriority(pbuf, tid) ({ \
- *(__le16 *)(pbuf) |= cpu_to_le16(tid & 0xf); \
-})
-
-#define GetPriority(pbuf) ((le16_to_cpu(*(__le16 *)(pbuf))) & 0xf)
-
-#define SetAckpolicy(pbuf, ack) ({ \
- *(__le16 *)(pbuf) |= cpu_to_le16((ack & 3) << 5); \
-})
-
-#define GetAckpolicy(pbuf) (((le16_to_cpu(*(__le16 *)pbuf)) >> 5) & 0x3)
-
-#define GetAMsdu(pbuf) (((le16_to_cpu(*(__le16 *)pbuf)) >> 7) & 0x1)
-
-#define GetAddr1Ptr(pbuf) ((unsigned char *)((addr_t)(pbuf) + 4))
-
-#define GetAddr2Ptr(pbuf) ((unsigned char *)((addr_t)(pbuf) + 10))
-
-#define GetAddr3Ptr(pbuf) ((unsigned char *)((addr_t)(pbuf) + 16))
-
-#define GetAddr4Ptr(pbuf) ((unsigned char *)((addr_t)(pbuf) + 24))
-
-static inline unsigned char *get_hdr_bssid(unsigned char *pframe)
-{
- unsigned char *sa;
- unsigned int to_fr_ds = (GetToDs(pframe) << 1) | GetFrDs(pframe);
-
- switch (to_fr_ds) {
- case 0x00: /* ToDs=0, FromDs=0 */
- sa = GetAddr3Ptr(pframe);
- break;
- case 0x01: /* ToDs=0, FromDs=1 */
- sa = GetAddr2Ptr(pframe);
- break;
- case 0x02: /* ToDs=1, FromDs=0 */
- sa = GetAddr1Ptr(pframe);
- break;
- default: /* ToDs=1, FromDs=1 */
- sa = NULL;
- break;
- }
- return sa;
-}
-
-/* ---------------------------------------------------------------------------
- * Below is the fixed elements...
- * ---------------------------------------------------------------------------
- */
-#define _BEACON_ITERVAL_ 2
-#define _CAPABILITY_ 2
-#define _TIMESTAMP_ 8
-
-/*-----------------------------------------------------------------------------
- * Below is the definition for WMM
- *------------------------------------------------------------------------------
- */
-#define _WMM_IE_Length_ 7 /* for WMM STA */
-
-#endif /* _WIFI_H_ */
-
--- a/drivers/staging/rtl8712/wlan_bssdef.h
+++ /dev/null
@@ -1,223 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __WLAN_BSSDEF_H__
-#define __WLAN_BSSDEF_H__
-
-#define MAX_IE_SZ 768
-
-#define NDIS_802_11_LENGTH_SSID 32
-#define NDIS_802_11_LENGTH_RATES 8
-#define NDIS_802_11_LENGTH_RATES_EX 16
-
-struct ndis_802_11_ssid {
- u32 SsidLength;
- u8 Ssid[32];
-};
-
-enum NDIS_802_11_NETWORK_TYPE {
- Ndis802_11FH,
- Ndis802_11DS,
- Ndis802_11OFDM5,
- Ndis802_11OFDM24,
- Ndis802_11NetworkTypeMax /* not a real type, defined as an upper bound*/
-};
-
-struct NDIS_802_11_CONFIGURATION_FH {
- u32 Length; /* Length of structure */
- u32 HopPattern; /* As defined by 802.11, MSB set */
- u32 HopSet; /* to one if non-802.11 */
- u32 DwellTime; /* units are Kusec */
-};
-
-/*
- * FW will only save the channel number in DSConfig.
- * ODI Handler will convert the channel number to freq. number.
- */
-struct NDIS_802_11_CONFIGURATION {
- u32 Length; /* Length of structure */
- u32 BeaconPeriod; /* units are Kusec */
- u32 ATIMWindow; /* units are Kusec */
- u32 DSConfig; /* Frequency, units are kHz */
- struct NDIS_802_11_CONFIGURATION_FH FHConfig;
-};
-
-enum NDIS_802_11_NETWORK_INFRASTRUCTURE {
- Ndis802_11IBSS,
- Ndis802_11Infrastructure,
- Ndis802_11AutoUnknown,
- Ndis802_11InfrastructureMax, /*Not a real value,defined as upper bound*/
- Ndis802_11APMode
-};
-
-struct NDIS_802_11_FIXED_IEs {
- u8 Timestamp[8];
- u16 BeaconInterval;
- u16 Capabilities;
-};
-
-struct wlan_bssid_ex {
- u32 Length;
- unsigned char MacAddress[6];
- u8 Reserved[2];
- struct ndis_802_11_ssid Ssid;
- __le32 Privacy;
- s32 Rssi;
- enum NDIS_802_11_NETWORK_TYPE NetworkTypeInUse;
- struct NDIS_802_11_CONFIGURATION Configuration;
- enum NDIS_802_11_NETWORK_INFRASTRUCTURE InfrastructureMode;
- u8 rates[NDIS_802_11_LENGTH_RATES_EX];
- /* number of content bytes in EIs, which varies */
- u32 IELength;
- /*(timestamp, beacon interval, and capability information) */
- u8 IEs[MAX_IE_SZ];
-};
-
-enum NDIS_802_11_AUTHENTICATION_MODE {
- Ndis802_11AuthModeOpen,
- Ndis802_11AuthModeShared,
- Ndis802_11AuthModeAutoSwitch,
- Ndis802_11AuthModeWPA,
- Ndis802_11AuthModeWPAPSK,
- Ndis802_11AuthModeWPANone,
- Ndis802_11AuthModeMax /* Not a real mode, defined as upper bound */
-};
-
-enum {
- Ndis802_11WEPEnabled,
- Ndis802_11Encryption1Enabled = Ndis802_11WEPEnabled,
- Ndis802_11WEPDisabled,
- Ndis802_11EncryptionDisabled = Ndis802_11WEPDisabled,
- Ndis802_11WEPKeyAbsent,
- Ndis802_11Encryption1KeyAbsent = Ndis802_11WEPKeyAbsent,
- Ndis802_11WEPNotSupported,
- Ndis802_11EncryptionNotSupported = Ndis802_11WEPNotSupported,
- Ndis802_11Encryption2Enabled,
- Ndis802_11Encryption2KeyAbsent,
- Ndis802_11Encryption3Enabled,
- Ndis802_11Encryption3KeyAbsent
-};
-
-#define NDIS_802_11_AI_REQFI_CAPABILITIES 1
-#define NDIS_802_11_AI_REQFI_LISTENINTERVAL 2
-#define NDIS_802_11_AI_REQFI_CURRENTAPADDRESS 4
-
-#define NDIS_802_11_AI_RESFI_CAPABILITIES 1
-#define NDIS_802_11_AI_RESFI_STATUSCODE 2
-#define NDIS_802_11_AI_RESFI_ASSOCIATIONID 4
-
-struct NDIS_802_11_AI_REQFI {
- u16 Capabilities;
- u16 ListenInterval;
- unsigned char CurrentAPAddress[6];
-};
-
-struct NDIS_802_11_AI_RESFI {
- u16 Capabilities;
- u16 StatusCode;
- u16 AssociationId;
-};
-
-struct NDIS_802_11_ASSOCIATION_INFORMATION {
- u32 Length;
- u16 AvailableRequestFixedIEs;
- struct NDIS_802_11_AI_REQFI RequestFixedIEs;
- u32 RequestIELength;
- u32 OffsetRequestIEs;
- u16 AvailableResponseFixedIEs;
- struct NDIS_802_11_AI_RESFI ResponseFixedIEs;
- u32 ResponseIELength;
- u32 OffsetResponseIEs;
-};
-
-/* Key mapping keys require a BSSID*/
-struct NDIS_802_11_KEY {
- u32 Length; /* Length of this structure */
- u32 KeyIndex;
- u32 KeyLength; /* length of key in bytes */
- unsigned char BSSID[6];
- unsigned long long KeyRSC;
- u8 KeyMaterial[32]; /* variable length */
-};
-
-struct NDIS_802_11_REMOVE_KEY {
- u32 Length; /* Length of this structure */
- u32 KeyIndex;
- unsigned char BSSID[6];
-};
-
-struct NDIS_802_11_WEP {
- u32 Length; /* Length of this structure */
- u32 KeyIndex; /* 0 is the per-client key,
- * 1-N are the global keys
- */
- u32 KeyLength; /* length of key in bytes */
- u8 KeyMaterial[16]; /* variable length depending on above field */
-};
-
-/* mask for authentication/integrity fields */
-#define NDIS_802_11_AUTH_REQUEST_AUTH_FIELDS 0x0f
-#define NDIS_802_11_AUTH_REQUEST_REAUTH 0x01
-#define NDIS_802_11_AUTH_REQUEST_KEYUPDATE 0x02
-#define NDIS_802_11_AUTH_REQUEST_PAIRWISE_ERROR 0x06
-#define NDIS_802_11_AUTH_REQUEST_GROUP_ERROR 0x0E
-
-/* MIC check time, 60 seconds. */
-#define MIC_CHECK_TIME 60000000
-
-#ifndef Ndis802_11APMode
-#define Ndis802_11APMode (Ndis802_11InfrastructureMax + 1)
-#endif
-
-struct wlan_network {
- struct list_head list;
- int network_type; /*refer to ieee80211.h for WIRELESS_11A/B/G */
- int fixed; /* set to fixed when not to be removed asi
- * site-surveying
- */
- unsigned int last_scanned; /*timestamp for the network */
- int aid; /*will only be valid when a BSS is joined. */
- int join_res;
- struct wlan_bssid_ex network; /*must be the last item */
-};
-
-enum VRTL_CARRIER_SENSE {
- DISABLE_VCS,
- ENABLE_VCS,
- AUTO_VCS
-};
-
-enum VCS_TYPE {
- NONE_VCS,
- RTS_CTS,
- CTS_TO_SELF
-};
-
-#define PWR_CAM 0
-#define PWR_MINPS 1
-#define PWR_MAXPS 2
-#define PWR_UAPSD 3
-#define PWR_VOIP 4
-
-enum UAPSD_MAX_SP {
- NO_LIMIT,
- TWO_MSDU,
- FOUR_MSDU,
- SIX_MSDU
-};
-
-#define NUM_PRE_AUTH_KEY 16
-#define NUM_PMKID_CACHE NUM_PRE_AUTH_KEY
-
-#endif /* #ifndef WLAN_BSSDEF_H_ */
-
--- a/drivers/staging/rtl8712/xmit_linux.c
+++ /dev/null
@@ -1,181 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * xmit_linux.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _XMIT_OSDEP_C_
-
-#include <linux/usb.h>
-#include <linux/ip.h>
-#include <linux/if_ether.h>
-#include <linux/kmemleak.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-#include "wifi.h"
-#include "mlme_osdep.h"
-#include "xmit_osdep.h"
-#include "osdep_intf.h"
-
-static uint remainder_len(struct pkt_file *pfile)
-{
- return (uint)(pfile->buf_len - ((addr_t)(pfile->cur_addr) -
- (addr_t)(pfile->buf_start)));
-}
-
-void _r8712_open_pktfile(_pkt *pktptr, struct pkt_file *pfile)
-{
- pfile->pkt = pktptr;
- pfile->cur_addr = pfile->buf_start = pktptr->data;
- pfile->pkt_len = pfile->buf_len = pktptr->len;
- pfile->cur_buffer = pfile->buf_start;
-}
-
-uint _r8712_pktfile_read(struct pkt_file *pfile, u8 *rmem, uint rlen)
-{
- uint len;
-
- len = remainder_len(pfile);
- len = (rlen > len) ? len : rlen;
- if (rmem)
- skb_copy_bits(pfile->pkt, pfile->buf_len - pfile->pkt_len,
- rmem, len);
- pfile->cur_addr += len;
- pfile->pkt_len -= len;
- return len;
-}
-
-sint r8712_endofpktfile(struct pkt_file *pfile)
-{
- return (pfile->pkt_len == 0);
-}
-
-void r8712_set_qos(struct pkt_file *ppktfile, struct pkt_attrib *pattrib)
-{
- struct ethhdr etherhdr;
- struct iphdr ip_hdr;
- u16 user_priority = 0;
-
- _r8712_open_pktfile(ppktfile->pkt, ppktfile);
- _r8712_pktfile_read(ppktfile, (unsigned char *)ðerhdr, ETH_HLEN);
-
- /* get user_priority from IP hdr*/
- if (pattrib->ether_type == 0x0800) {
- _r8712_pktfile_read(ppktfile, (u8 *)&ip_hdr, sizeof(ip_hdr));
- /*user_priority = (ntohs(ip_hdr.tos) >> 5) & 0x3 ;*/
- user_priority = ip_hdr.tos >> 5;
- } else {
- /* "When priority processing of data frames is supported,
- * a STA's SME should send EAPOL-Key frames at the highest
- * priority."
- */
-
- if (pattrib->ether_type == 0x888e)
- user_priority = 7;
- }
- pattrib->priority = user_priority;
- pattrib->hdrlen = WLAN_HDR_A3_QOS_LEN;
- pattrib->subtype = WIFI_QOS_DATA_TYPE;
-}
-
-void r8712_SetFilter(struct work_struct *work)
-{
- struct _adapter *adapter = container_of(work, struct _adapter,
- wk_filter_rx_ff0);
- u8 oldvalue = 0x00, newvalue = 0x00;
-
- oldvalue = r8712_read8(adapter, 0x117);
- newvalue = oldvalue & 0xfe;
- r8712_write8(adapter, 0x117, newvalue);
-
- wait_for_completion(&adapter->rx_filter_ready);
- r8712_write8(adapter, 0x117, oldvalue);
-}
-
-int r8712_xmit_resource_alloc(struct _adapter *padapter,
- struct xmit_buf *pxmitbuf)
-{
- int i;
-
- for (i = 0; i < 8; i++) {
- pxmitbuf->pxmit_urb[i] = usb_alloc_urb(0, GFP_KERNEL);
- if (!pxmitbuf->pxmit_urb[i]) {
- int k;
-
- for (k = i - 1; k >= 0; k--) {
- /* handle allocation errors part way through loop */
- usb_free_urb(pxmitbuf->pxmit_urb[k]);
- }
- netdev_err(padapter->pnetdev, "pxmitbuf->pxmit_urb[i] == NULL\n");
- return -ENOMEM;
- }
- kmemleak_not_leak(pxmitbuf->pxmit_urb[i]);
- }
- return 0;
-}
-
-void r8712_xmit_resource_free(struct _adapter *padapter,
- struct xmit_buf *pxmitbuf)
-{
- int i;
-
- for (i = 0; i < 8; i++) {
- if (pxmitbuf->pxmit_urb[i]) {
- usb_kill_urb(pxmitbuf->pxmit_urb[i]);
- usb_free_urb(pxmitbuf->pxmit_urb[i]);
- }
- }
-}
-
-void r8712_xmit_complete(struct _adapter *padapter, struct xmit_frame *pxframe)
-{
- if (pxframe->pkt)
- dev_kfree_skb_any(pxframe->pkt);
- pxframe->pkt = NULL;
-}
-
-netdev_tx_t r8712_xmit_entry(_pkt *pkt, struct net_device *netdev)
-{
- struct xmit_frame *xmitframe = NULL;
- struct _adapter *adapter = netdev_priv(netdev);
- struct xmit_priv *xmitpriv = &(adapter->xmitpriv);
-
- if (!r8712_if_up(adapter))
- goto _xmit_entry_drop;
-
- xmitframe = r8712_alloc_xmitframe(xmitpriv);
- if (!xmitframe)
- goto _xmit_entry_drop;
-
- if (r8712_update_attrib(adapter, pkt, &xmitframe->attrib))
- goto _xmit_entry_drop;
-
- adapter->ledpriv.LedControlHandler(adapter, LED_CTL_TX);
- xmitframe->pkt = pkt;
- if (r8712_pre_xmit(adapter, xmitframe)) {
- /*dump xmitframe directly or drop xframe*/
- dev_kfree_skb_any(pkt);
- xmitframe->pkt = NULL;
- }
- xmitpriv->tx_pkts++;
- xmitpriv->tx_bytes += xmitframe->attrib.last_txcmdsz;
- return NETDEV_TX_OK;
-_xmit_entry_drop:
- if (xmitframe)
- r8712_free_xmitframe(xmitpriv, xmitframe);
- xmitpriv->tx_drop++;
- dev_kfree_skb_any(pkt);
- return NETDEV_TX_OK;
-}
--- a/drivers/staging/rtl8712/xmit_osdep.h
+++ /dev/null
@@ -1,52 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __XMIT_OSDEP_H_
-#define __XMIT_OSDEP_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-struct pkt_file {
- _pkt *pkt;
- u32 pkt_len; /*the remainder length of the open_file*/
- _buffer *cur_buffer;
- u8 *buf_start;
- u8 *cur_addr;
- u32 buf_len;
-};
-
-#define NR_XMITFRAME 256
-
-struct xmit_priv;
-struct pkt_attrib;
-struct sta_xmit_priv;
-struct xmit_frame;
-struct xmit_buf;
-
-netdev_tx_t r8712_xmit_entry(_pkt *pkt, struct net_device *pnetdev);
-void r8712_SetFilter(struct work_struct *work);
-int r8712_xmit_resource_alloc(struct _adapter *padapter,
- struct xmit_buf *pxmitbuf);
-void r8712_xmit_resource_free(struct _adapter *padapter,
- struct xmit_buf *pxmitbuf);
-
-void r8712_set_qos(struct pkt_file *ppktfile,
- struct pkt_attrib *pattrib);
-void _r8712_open_pktfile(_pkt *pktptr, struct pkt_file *pfile);
-uint _r8712_pktfile_read(struct pkt_file *pfile, u8 *rmem, uint rlen);
-sint r8712_endofpktfile(struct pkt_file *pfile);
-void r8712_xmit_complete(struct _adapter *padapter,
- struct xmit_frame *pxframe);
-
-#endif
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 562/568] ksmbd: fix use-after-free in session logoff
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (560 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 561/568] staging: rtl8712: Remove driver using deprecated API wext Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 563/568] usb: typec: ucsi: psy: Set max current to zero when disconnected Greg Kroah-Hartman
` (12 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Heelan, Namjae Jeon,
Steve French, Nazar Kalashnikov
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Heelan <seanheelan@gmail.com>
commit 2fc9feff45d92a92cd5f96487655d5be23fb7e2b upstream.
The sess->user object can currently be in use by another thread, for
example if another connection has sent a session setup request to
bind to the session being free'd. The handler for that connection could
be in the smb2_sess_setup function which makes use of sess->user.
Signed-off-by: Sean Heelan <seanheelan@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Nazar Kalashnikov <sivartiwe@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
v2: Fix duplicate From: header
Backport fix for CVE-2025-37899
fs/smb/server/smb2pdu.c | 4 ----
1 file changed, 4 deletions(-)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -2253,10 +2253,6 @@ int smb2_session_logoff(struct ksmbd_wor
sess->state = SMB2_SESSION_EXPIRED;
up_write(&conn->session_lock);
- if (sess->user) {
- ksmbd_free_user(sess->user);
- sess->user = NULL;
- }
ksmbd_all_conn_set_status(sess_id, KSMBD_SESS_NEED_NEGOTIATE);
rsp->StructureSize = cpu_to_le16(4);
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 563/568] usb: typec: ucsi: psy: Set max current to zero when disconnected
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (561 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 562/568] ksmbd: fix use-after-free in session logoff Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 564/568] usb: udc: Add trace event for usb_gadget_set_state Greg Kroah-Hartman
` (11 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jameson Thies, Benson Leung,
Heikki Krogerus, Sebastian Reichel, Kenneth R. Crudup,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jameson Thies <jthies@google.com>
[ Upstream commit 23379a17334fc24c4a9cbd9967d33dcd9323cc7c ]
The ucsi_psy_get_current_max function defaults to 0.1A when it is not
clear how much current the partner device can support. But this does
not check the port is connected, and will report 0.1A max current when
nothing is connected. Update ucsi_psy_get_current_max to report 0A when
there is no connection.
Fixes: af833e7f7db3 ("usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default")
Cc: stable@vger.kernel.org
Signed-off-by: Jameson Thies <jthies@google.com>
Reviewed-by: Benson Leung <bleung@chromium.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Tested-by: Kenneth R. Crudup <kenny@panix.com>
Rule: add
Link: https://lore.kernel.org/stable/20251017000051.2094101-1-jthies%40google.com
Link: https://patch.msgid.link/20251106011446.2052583-1-jthies@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ adapted UCSI_CONSTAT() macro to direct flag access ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/ucsi/psy.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/usb/typec/ucsi/psy.c
+++ b/drivers/usb/typec/ucsi/psy.c
@@ -144,6 +144,11 @@ static int ucsi_psy_get_current_max(stru
{
u32 pdo;
+ if (!(con->status.flags & UCSI_CONSTAT_CONNECTED)) {
+ val->intval = 0;
+ return 0;
+ }
+
switch (UCSI_CONSTAT_PWR_OPMODE(con->status.flags)) {
case UCSI_CONSTAT_PWR_OPMODE_PD:
if (con->num_pdos > 0) {
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 564/568] usb: udc: Add trace event for usb_gadget_set_state
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (562 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 563/568] usb: typec: ucsi: psy: Set max current to zero when disconnected Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 565/568] usb: gadget: udc: fix use-after-free in usb_gadget_state_work Greg Kroah-Hartman
` (10 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kuen-Han Tsai, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <khtsai@google.com>
[ Upstream commit 7bf1158514e410310aec975e630cec99d4e4092f ]
While the userspace program can be notified of gadget state changes,
timing issue can lead to missed transitions when reading the state
value.
Introduce a trace event for usb_gadget_set_state to reliably track state
transitions.
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
Link: https://lore.kernel.org/r/20250818082722.2952867-1-khtsai@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: baeb66fbd420 ("usb: gadget: udc: fix use-after-free in usb_gadget_state_work")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/udc/core.c | 1 +
drivers/usb/gadget/udc/trace.h | 5 +++++
2 files changed, 6 insertions(+)
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -1123,6 +1123,7 @@ void usb_gadget_set_state(struct usb_gad
{
gadget->state = state;
schedule_work(&gadget->work);
+ trace_usb_gadget_set_state(gadget, 0);
}
EXPORT_SYMBOL_GPL(usb_gadget_set_state);
--- a/drivers/usb/gadget/udc/trace.h
+++ b/drivers/usb/gadget/udc/trace.h
@@ -81,6 +81,11 @@ DECLARE_EVENT_CLASS(udc_log_gadget,
__entry->ret)
);
+DEFINE_EVENT(udc_log_gadget, usb_gadget_set_state,
+ TP_PROTO(struct usb_gadget *g, int ret),
+ TP_ARGS(g, ret)
+);
+
DEFINE_EVENT(udc_log_gadget, usb_gadget_frame_number,
TP_PROTO(struct usb_gadget *g, int ret),
TP_ARGS(g, ret)
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 565/568] usb: gadget: udc: fix use-after-free in usb_gadget_state_work
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (563 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 564/568] usb: udc: Add trace event for usb_gadget_set_state Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 566/568] scsi: pm80xx: Set phy->enable_completion only when we Greg Kroah-Hartman
` (9 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Jimmy Hu, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jimmy Hu <hhhuuu@google.com>
[ Upstream commit baeb66fbd4201d1c4325074e78b1f557dff89b5b ]
A race condition during gadget teardown can lead to a use-after-free
in usb_gadget_state_work(), as reported by KASAN:
BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0
Workqueue: events usb_gadget_state_work
The fundamental race occurs because a concurrent event (e.g., an
interrupt) can call usb_gadget_set_state() and schedule gadget->work
at any time during the cleanup process in usb_del_gadget().
Commit 399a45e5237c ("usb: gadget: core: flush gadget workqueue after
device removal") attempted to fix this by moving flush_work() to after
device_del(). However, this does not fully solve the race, as a new
work item can still be scheduled *after* flush_work() completes but
before the gadget's memory is freed, leading to the same use-after-free.
This patch fixes the race condition robustly by introducing a 'teardown'
flag and a 'state_lock' spinlock to the usb_gadget struct. The flag is
set during cleanup in usb_del_gadget() *before* calling flush_work() to
prevent any new work from being scheduled once cleanup has commenced.
The scheduling site, usb_gadget_set_state(), now checks this flag under
the lock before queueing the work, thus safely closing the race window.
Fixes: 5702f75375aa9 ("usb: gadget: udc-core: move sysfs_notify() to a workqueue")
Cc: stable <stable@kernel.org>
Signed-off-by: Jimmy Hu <hhhuuu@google.com>
Link: https://patch.msgid.link/20251023054945.233861-1-hhhuuu@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/udc/core.c | 17 ++++++++++++++++-
include/linux/usb/gadget.h | 5 +++++
2 files changed, 21 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -1121,8 +1121,13 @@ static void usb_gadget_state_work(struct
void usb_gadget_set_state(struct usb_gadget *gadget,
enum usb_device_state state)
{
+ unsigned long flags;
+
+ spin_lock_irqsave(&gadget->state_lock, flags);
gadget->state = state;
- schedule_work(&gadget->work);
+ if (!gadget->teardown)
+ schedule_work(&gadget->work);
+ spin_unlock_irqrestore(&gadget->state_lock, flags);
trace_usb_gadget_set_state(gadget, 0);
}
EXPORT_SYMBOL_GPL(usb_gadget_set_state);
@@ -1356,6 +1361,8 @@ static void usb_udc_nop_release(struct d
void usb_initialize_gadget(struct device *parent, struct usb_gadget *gadget,
void (*release)(struct device *dev))
{
+ spin_lock_init(&gadget->state_lock);
+ gadget->teardown = false;
INIT_WORK(&gadget->work, usb_gadget_state_work);
gadget->dev.parent = parent;
@@ -1530,6 +1537,7 @@ EXPORT_SYMBOL_GPL(usb_add_gadget_udc);
void usb_del_gadget(struct usb_gadget *gadget)
{
struct usb_udc *udc = gadget->udc;
+ unsigned long flags;
if (!udc)
return;
@@ -1543,6 +1551,13 @@ void usb_del_gadget(struct usb_gadget *g
kobject_uevent(&udc->dev.kobj, KOBJ_REMOVE);
sysfs_remove_link(&udc->dev.kobj, "gadget");
device_del(&gadget->dev);
+ /*
+ * Set the teardown flag before flushing the work to prevent new work
+ * from being scheduled while we are cleaning up.
+ */
+ spin_lock_irqsave(&gadget->state_lock, flags);
+ gadget->teardown = true;
+ spin_unlock_irqrestore(&gadget->state_lock, flags);
flush_work(&gadget->work);
ida_free(&gadget_id_numbers, gadget->id_number);
cancel_work_sync(&udc->vbus_work);
--- a/include/linux/usb/gadget.h
+++ b/include/linux/usb/gadget.h
@@ -373,6 +373,9 @@ struct usb_gadget_ops {
* can handle. The UDC must support this and all slower speeds and lower
* number of lanes.
* @state: the state we are now (attached, suspended, configured, etc)
+ * @state_lock: Spinlock protecting the `state` and `teardown` members.
+ * @teardown: True if the device is undergoing teardown, used to prevent
+ * new work from being scheduled during cleanup.
* @name: Identifies the controller hardware type. Used in diagnostics
* and sometimes configuration.
* @dev: Driver model state for this abstract device.
@@ -448,6 +451,8 @@ struct usb_gadget {
enum usb_ssp_rate max_ssp_rate;
enum usb_device_state state;
+ spinlock_t state_lock;
+ bool teardown;
const char *name;
struct device dev;
unsigned isoch_delay;
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 566/568] scsi: pm80xx: Set phy->enable_completion only when we
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (564 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 565/568] usb: gadget: udc: fix use-after-free in usb_gadget_state_work Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 567/568] i2c: xgene-slimpro: Migrate to use generic PCC shmem related macros Greg Kroah-Hartman
` (8 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Igor Pylypiv, Terrence Adams,
Jack Wang, Martin K. Petersen, Nazar Kalashnikov
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Pylypiv <ipylypiv@google.com>
[ Upstream commit e4f949ef1516c0d74745ee54a0f4882c1f6c7aea ]
pm8001_phy_control() populates the enable_completion pointer with a stack
address, sends a PHY_LINK_RESET / PHY_HARD_RESET, waits 300 ms, and
returns. The problem arises when a phy control response comes late. After
300 ms the pm8001_phy_control() function returns and the passed
enable_completion stack address is no longer valid. Late phy control
response invokes complete() on a dangling enable_completion pointer which
leads to a kernel crash.
Signed-off-by: Igor Pylypiv <ipylypiv@google.com>
Signed-off-by: Terrence Adams <tadamsjr@google.com>
Link: https://lore.kernel.org/r/20240627155924.2361370-2-tadamsjr@google.com
Acked-by: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Nazar Kalashnikov <sivartiwe@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Backport fix for CVE-2024-47666
drivers/scsi/pm8001/pm8001_sas.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -168,7 +168,6 @@ int pm8001_phy_control(struct asd_sas_ph
unsigned long flags;
pm8001_ha = sas_phy->ha->lldd_ha;
phy = &pm8001_ha->phy[phy_id];
- pm8001_ha->phy[phy_id].enable_completion = &completion;
switch (func) {
case PHY_FUNC_SET_LINK_RATE:
rates = funcdata;
@@ -181,6 +180,7 @@ int pm8001_phy_control(struct asd_sas_ph
rates->maximum_linkrate;
}
if (pm8001_ha->phy[phy_id].phy_state == PHY_LINK_DISABLE) {
+ pm8001_ha->phy[phy_id].enable_completion = &completion;
PM8001_CHIP_DISP->phy_start_req(pm8001_ha, phy_id);
wait_for_completion(&completion);
}
@@ -189,6 +189,7 @@ int pm8001_phy_control(struct asd_sas_ph
break;
case PHY_FUNC_HARD_RESET:
if (pm8001_ha->phy[phy_id].phy_state == PHY_LINK_DISABLE) {
+ pm8001_ha->phy[phy_id].enable_completion = &completion;
PM8001_CHIP_DISP->phy_start_req(pm8001_ha, phy_id);
wait_for_completion(&completion);
}
@@ -197,6 +198,7 @@ int pm8001_phy_control(struct asd_sas_ph
break;
case PHY_FUNC_LINK_RESET:
if (pm8001_ha->phy[phy_id].phy_state == PHY_LINK_DISABLE) {
+ pm8001_ha->phy[phy_id].enable_completion = &completion;
PM8001_CHIP_DISP->phy_start_req(pm8001_ha, phy_id);
wait_for_completion(&completion);
}
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 567/568] i2c: xgene-slimpro: Migrate to use generic PCC shmem related macros
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (565 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 566/568] scsi: pm80xx: Set phy->enable_completion only when we Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 15:29 ` [PATCH 6.1 568/568] HID: core: Harden s32ton() against conversion to 0 bits Greg Kroah-Hartman
` (7 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andi Shyti, Wolfram Sang,
Sudeep Holla
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@arm.com>
commit 89a4ad1f437c049534891c3d83cd96d7c7debd2a upstream.
Use the newly defined common and generic PCC shared memory region
related macros in this driver to replace the locally defined ones.
Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
Acked-by: Wolfram Sang <wsa@kernel.org>
Link: https://lore.kernel.org/r/20230927-pcc_defines-v2-2-0b8ffeaef2e5@arm.com
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-xgene-slimpro.c | 16 ++++------------
1 file changed, 4 insertions(+), 12 deletions(-)
--- a/drivers/i2c/busses/i2c-xgene-slimpro.c
+++ b/drivers/i2c/busses/i2c-xgene-slimpro.c
@@ -91,14 +91,6 @@
#define SLIMPRO_IIC_MSG_DWORD_COUNT 3
-/* PCC related defines */
-#define PCC_SIGNATURE 0x50424300
-#define PCC_STS_CMD_COMPLETE BIT(0)
-#define PCC_STS_SCI_DOORBELL BIT(1)
-#define PCC_STS_ERR BIT(2)
-#define PCC_STS_PLAT_NOTIFY BIT(3)
-#define PCC_CMD_GENERATE_DB_INT BIT(15)
-
struct slimpro_i2c_dev {
struct i2c_adapter adapter;
struct device *dev;
@@ -160,11 +152,11 @@ static void slimpro_i2c_pcc_rx_cb(struct
/* Check if platform sends interrupt */
if (!xgene_word_tst_and_clr(&generic_comm_base->status,
- PCC_STS_SCI_DOORBELL))
+ PCC_STATUS_SCI_DOORBELL))
return;
if (xgene_word_tst_and_clr(&generic_comm_base->status,
- PCC_STS_CMD_COMPLETE)) {
+ PCC_STATUS_CMD_COMPLETE)) {
msg = generic_comm_base + 1;
/* Response message msg[1] contains the return value. */
@@ -186,10 +178,10 @@ static void slimpro_i2c_pcc_tx_prepare(s
cpu_to_le32(PCC_SIGNATURE | ctx->mbox_idx));
WRITE_ONCE(generic_comm_base->command,
- cpu_to_le16(SLIMPRO_MSG_TYPE(msg[0]) | PCC_CMD_GENERATE_DB_INT));
+ cpu_to_le16(SLIMPRO_MSG_TYPE(msg[0]) | PCC_CMD_GENERATE_DB_INTR));
status = le16_to_cpu(READ_ONCE(generic_comm_base->status));
- status &= ~PCC_STS_CMD_COMPLETE;
+ status &= ~PCC_STATUS_CMD_COMPLETE;
WRITE_ONCE(generic_comm_base->status, cpu_to_le16(status));
/* Copy the message to the PCC comm space */
^ permalink raw reply [flat|nested] 588+ messages in thread* [PATCH 6.1 568/568] HID: core: Harden s32ton() against conversion to 0 bits
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (566 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 567/568] i2c: xgene-slimpro: Migrate to use generic PCC shmem related macros Greg Kroah-Hartman
@ 2025-12-03 15:29 ` Greg Kroah-Hartman
2025-12-03 16:52 ` [PATCH 6.1 000/568] 6.1.159-rc1 review Pavel Machek
` (6 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alan Stern,
syzbot+b63d677d63bcac06cf90, Benjamin Tissoires, Wenshan Lan
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
[ Upstream commit a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd ]
Testing by the syzbot fuzzer showed that the HID core gets a
shift-out-of-bounds exception when it tries to convert a 32-bit
quantity to a 0-bit quantity. Ideally this should never occur, but
there are buggy devices and some might have a report field with size
set to zero; we shouldn't reject the report or the device just because
of that.
Instead, harden the s32ton() routine so that it returns a reasonable
result instead of crashing when it is called with the number of bits
set to 0 -- the same as what snto32() does.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: syzbot+b63d677d63bcac06cf90@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/68753a08.050a0220.33d347.0008.GAE@google.com/
Tested-by: syzbot+b63d677d63bcac06cf90@syzkaller.appspotmail.com
Fixes: dde5845a529f ("[PATCH] Generic HID layer - code split")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/613a66cd-4309-4bce-a4f7-2905f9bce0c9@rowland.harvard.edu
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
[ s32ton() was moved by c653ffc28340 ("HID: stop exporting hid_snto32()").
Minor context change fixed. ]
Signed-off-by: Wenshan Lan <jetlan9@163.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-core.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1354,7 +1354,12 @@ EXPORT_SYMBOL_GPL(hid_snto32);
static u32 s32ton(__s32 value, unsigned n)
{
- s32 a = value >> (n - 1);
+ s32 a;
+ if (!value || !n)
+ return 0;
+
+ a = value >> (n - 1);
+
if (a && a != -1)
return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
return value & ((1 << n) - 1);
^ permalink raw reply [flat|nested] 588+ messages in thread* Re: [PATCH 6.1 000/568] 6.1.159-rc1 review
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (567 preceding siblings ...)
2025-12-03 15:29 ` [PATCH 6.1 568/568] HID: core: Harden s32ton() against conversion to 0 bits Greg Kroah-Hartman
@ 2025-12-03 16:52 ` Pavel Machek
2025-12-03 18:01 ` Florian Fainelli
` (5 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Pavel Machek @ 2025-12-03 16:52 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
[-- Attachment #1: Type: text/plain, Size: 1818 bytes --]
Hi!
> This is the start of the stable review cycle for the 6.1.159 release.
> There are 568 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
We have similar situation to 5.10 here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/jobs/12309717631
drivers/soc/tegra/fuse/fuse-tegra30.c:250:10: error: 'const struct tegra_fuse_soc' has no member named 'cells'
2898
250 | .cells = tegra114_fuse_cells,
2899
| ^~~~~
2900
drivers/soc/tegra/fuse/fuse-tegra30.c:250:18: error: initialization of 'const struct attribute_group *' from incompatible pointer type 'const struct nvmem_cell_info *' [-Werror=incompatible-pointer-types]
2901
250 | .cells = tegra114_fuse_cells,
2902
| ^~~~~~~~~~~~~~~~~~~
2903
drivers/soc/tegra/fuse/fuse-tegra30.c:250:18: note: (near initialization for 'tegra114_fuse_soc.soc_attr_group')
2904
drivers/soc/tegra/fuse/fuse-tegra30.c:251:10: error: 'const struct tegra_fuse_soc' has no member named 'num_cells'
2905
251 | .num_cells = ARRAY_SIZE(tegra114_fuse_cells),
2906
| ^~~~~~~~~
2907
cc1: some warnings being treated as errors
2908
make[5]: *** [scripts/Makefile.build:250: drivers/soc/tegra/fuse/fuse-tegra30.o] Error 1
2909
make[4]: *** [scripts/Makefile.build:503: drivers/soc/tegra/fuse] Error 2
2910
make[3]: *** [scripts/Makefile.build:503: drivers/soc/tegra] Error 2
2911
make[2]: *** [scripts/Makefile.build:503: drivers/soc] Error 2
2912
make[2]: *** Waiting for unfinished jobs....
Best regards,
Pavel
--
In cooperation with DENX Software Engineering GmbH, HRB 165235 Munich,
Office: Kirchenstr.5, D-82194 Groebenzell, Germany
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 588+ messages in thread* Re: [PATCH 6.1 000/568] 6.1.159-rc1 review
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (568 preceding siblings ...)
2025-12-03 16:52 ` [PATCH 6.1 000/568] 6.1.159-rc1 review Pavel Machek
@ 2025-12-03 18:01 ` Florian Fainelli
2025-12-03 23:10 ` Hardik Garg
` (4 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Florian Fainelli @ 2025-12-03 18:01 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, rwarsow, conor,
hargar, broonie, achill, sr
On 12/3/25 07:20, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.159 release.
> There are 568 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.159-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on
BMIPS_GENERIC:
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 588+ messages in thread* Re: [PATCH 6.1 000/568] 6.1.159-rc1 review
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (569 preceding siblings ...)
2025-12-03 18:01 ` Florian Fainelli
@ 2025-12-03 23:10 ` Hardik Garg
2025-12-03 23:55 ` Shuah Khan
` (3 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Hardik Garg @ 2025-12-03 23:10 UTC (permalink / raw)
To: gregkh
Cc: achill, akpm, broonie, conor, f.fainelli, hargar, jonathanh,
linux-kernel, linux, lkft-triage, patches, patches, pavel,
rwarsow, shuah, sr, stable, sudipm.mukherjee, torvalds
The kernel, bpf tool, perf tool, and kselftest builds fine for v6.1.159-rc1 on x86 and arm64 Azure VM.
Tested-by: Hardik Garg <hargar@linux.microsoft.com>
Thanks,
Hardik
^ permalink raw reply [flat|nested] 588+ messages in thread* Re: [PATCH 6.1 000/568] 6.1.159-rc1 review
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (570 preceding siblings ...)
2025-12-03 23:10 ` Hardik Garg
@ 2025-12-03 23:55 ` Shuah Khan
2025-12-04 5:59 ` Peter Schneider
` (2 subsequent siblings)
574 siblings, 0 replies; 588+ messages in thread
From: Shuah Khan @ 2025-12-03 23:55 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr, Shuah Khan
On 12/3/25 08:20, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.159 release.
> There are 568 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.159-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 588+ messages in thread* Re: [PATCH 6.1 000/568] 6.1.159-rc1 review
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (571 preceding siblings ...)
2025-12-03 23:55 ` Shuah Khan
@ 2025-12-04 5:59 ` Peter Schneider
2025-12-04 10:43 ` Naresh Kamboju
2025-12-04 12:06 ` Mark Brown
574 siblings, 0 replies; 588+ messages in thread
From: Peter Schneider @ 2025-12-04 5:59 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
Am 03.12.2025 um 16:20 schrieb Greg Kroah-Hartman:
> This is the start of the stable review cycle for the 6.1.159 release.
> There are 568 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Tested-by: Peter Schneider <pschneider1968@googlemail.com>
Beste Grüße,
Peter Schneider
--
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you. -- David McCullough Jr.
OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com
^ permalink raw reply [flat|nested] 588+ messages in thread* Re: [PATCH 6.1 000/568] 6.1.159-rc1 review
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (572 preceding siblings ...)
2025-12-04 5:59 ` Peter Schneider
@ 2025-12-04 10:43 ` Naresh Kamboju
2025-12-04 13:54 ` Adrian Hunter
2025-12-04 16:24 ` Greg Kroah-Hartman
2025-12-04 12:06 ` Mark Brown
574 siblings, 2 replies; 588+ messages in thread
From: Naresh Kamboju @ 2025-12-04 10:43 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr,
Adrian Hunter, Svyatoslav Ryhel, Mikko Perttunen, Thierry Reding,
Arnd Bergmann, Dan Carpenter, Anders Roxell, Ben Copeland,
sparclinux
On Wed, 3 Dec 2025 at 21:48, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.1.159 release.
> There are 568 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.159-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
The arm and sparc builds failed on the stable-rc 6.1.159-rc1.
Build regressions: arm, fuse-tegra30.c:250:10: error: 'const struct
tegra_fuse_soc' has no member named 'cells'
Build regressions: arm, fuse-tegra30.c:250:18: error: initialization
of 'const struct attribute_group *' from incompatible pointer type
'const struct nvmem_cell_info *' [-Wincompatible-pointer-types]
Build regressions: arm, fuse-tegra30.c:251:10: error: 'const struct
tegra_fuse_soc' has no member named 'num_cells'
Build regressions: sparc, allmodconfig, ERROR: modpost:
"pm_suspend_target_state" [drivers/ufs/host/ufshcd-pci.ko] undefined!
### arm build error
drivers/soc/tegra/fuse/fuse-tegra30.c:250:10: error: 'const struct
tegra_fuse_soc' has no member named 'cells'
250 | .cells = tegra114_fuse_cells,
| ^~~~~
drivers/soc/tegra/fuse/fuse-tegra30.c:250:18: error: initialization of
'const struct attribute_group *' from incompatible pointer type 'const
struct nvmem_cell_info *' [-Wincompatible-pointer-types]
250 | .cells = tegra114_fuse_cells,
| ^~~~~~~~~~~~~~~~~~~
drivers/soc/tegra/fuse/fuse-tegra30.c:250:18: note: (near
initialization for 'tegra114_fuse_soc.soc_attr_group')
drivers/soc/tegra/fuse/fuse-tegra30.c:251:10: error: 'const struct
tegra_fuse_soc' has no member named 'num_cells'
251 | .num_cells = ARRAY_SIZE(tegra114_fuse_cells),
| ^~~~~~~~~
### sparc build error
ERROR: modpost: "pm_suspend_target_state"
[drivers/ufs/host/ufshcd-pci.ko] undefined!
### Commit pointing to arm build errors
soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
[ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
### commit pointing to sparc build errors
scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers
commit bb44826c3bdbf1fa3957008a04908f45e5666463 upstream.
## Build
* kernel: 6.1.159-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: abd89c70c9382759c14c5e7e0b383c2a19594c5c
* git describe: v6.1.158-569-gabd89c70c938
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.1.y/build/v6.1.158-569-gabd89c70c938
## Test Regressions (compared to v6.1.157-158-gf6fcaf2c6b7f)
* arm, build
- clang-21-defconfig
- clang-21-lkftconfig
- clang-21-lkftconfig-no-kselftest-frag
- clang-nightly-defconfig
- clang-nightly-lkftconfig
- gcc-14-allmodconfig
- gcc-14-defconfig
- gcc-14-lkftconfig
- gcc-14-lkftconfig-debug
- gcc-14-lkftconfig-kasan
- gcc-14-lkftconfig-kunit
- gcc-14-lkftconfig-libgpiod
- gcc-14-lkftconfig-no-kselftest-frag
- gcc-14-lkftconfig-perf
- gcc-14-lkftconfig-rcutorture
- gcc-8-defconfig
* sparc, build
- gcc-11-allmodconfig
## Metric Regressions (compared to v6.1.157-158-gf6fcaf2c6b7f)
## Test Fixes (compared to v6.1.157-158-gf6fcaf2c6b7f)
## Metric Fixes (compared to v6.1.157-158-gf6fcaf2c6b7f)
## Test result summary
total: 80660, pass: 60774, fail: 9871, skip: 9886, xfail: 129
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 133 total, 115 passed, 18 failed
* arm64: 41 total, 38 passed, 3 failed
* i386: 21 total, 21 passed, 0 failed
* mips: 26 total, 25 passed, 1 failed
* parisc: 4 total, 4 passed, 0 failed
* powerpc: 32 total, 31 passed, 1 failed
* riscv: 11 total, 10 passed, 1 failed
* s390: 14 total, 13 passed, 1 failed
* sh: 10 total, 10 passed, 0 failed
* sparc: 7 total, 6 passed, 1 failed
* x86_64: 33 total, 32 passed, 1 failed
## Test suites summary
* boot
* commands
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-exec
* kselftest-fpu
* kselftest-futex
* kselftest-intel_pstate
* kselftest-kcmp
* kselftest-kvm
* kselftest-livepatch
* kselftest-membarrier
* kselftest-mincore
* kselftest-mqueue
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-sigaltstack
* kselftest-size
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-x86
* kunit
* kvm-unit-tests
* lava
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-build-clang
* log-parser-build-gcc
* log-parser-test
* ltp-capability
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 588+ messages in thread* Re: [PATCH 6.1 000/568] 6.1.159-rc1 review
2025-12-04 10:43 ` Naresh Kamboju
@ 2025-12-04 13:54 ` Adrian Hunter
2025-12-04 16:22 ` Greg Kroah-Hartman
2025-12-04 16:24 ` Greg Kroah-Hartman
1 sibling, 1 reply; 588+ messages in thread
From: Adrian Hunter @ 2025-12-04 13:54 UTC (permalink / raw)
To: Naresh Kamboju, Greg Kroah-Hartman, Rafael J. Wysocki,
kai.heng.feng
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr,
Svyatoslav Ryhel, Mikko Perttunen, Thierry Reding, Arnd Bergmann,
Dan Carpenter, Anders Roxell, Ben Copeland, sparclinux
On 04/12/2025 12:43, Naresh Kamboju wrote:
> On Wed, 3 Dec 2025 at 21:48, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
>>
>> This is the start of the stable review cycle for the 6.1.159 release.
>> There are 568 patches in this series, all will be posted as a response
>> to this one. If anyone has any issues with these being applied, please
>> let me know.
> Build regressions: sparc, allmodconfig, ERROR: modpost:
> "pm_suspend_target_state" [drivers/ufs/host/ufshcd-pci.ko] undefined!
>
> ### sparc build error
> ERROR: modpost: "pm_suspend_target_state"
> [drivers/ufs/host/ufshcd-pci.ko] undefined!
>
> ### commit pointing to sparc build errors
> scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers
> commit bb44826c3bdbf1fa3957008a04908f45e5666463 upstream.
For that issue, cherry-picking the following provides the
needed definition:
commit 2e41e3ca4729455e002bcb585f0d3749ee66d572
Author: Kai-Heng Feng <kai.heng.feng@canonical.com>
Date: Tue May 2 17:04:34 2023 +0200
PM: suspend: Fix pm_suspend_target_state handling for !CONFIG_PM
Move the pm_suspend_target_state definition for CONFIG_SUSPEND
unset from the wakeup code into the headers so as to allow it
to still be used elsewhere when CONFIG_SUSPEND is not set.
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
[ rjw: Changelog and subject edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index 7cc0c0cf8eaa..a917219feea6 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -19,11 +19,6 @@
#include "power.h"
-#ifndef CONFIG_SUSPEND
-suspend_state_t pm_suspend_target_state;
-#define pm_suspend_target_state (PM_SUSPEND_ON)
-#endif
-
#define list_for_each_entry_rcu_locked(pos, head, member) \
list_for_each_entry_rcu(pos, head, member, \
srcu_read_lock_held(&wakeup_srcu))
diff --git a/include/linux/suspend.h b/include/linux/suspend.h
index d0d4598a7b3f..474ecfbbaa62 100644
--- a/include/linux/suspend.h
+++ b/include/linux/suspend.h
@@ -202,6 +202,7 @@ struct platform_s2idle_ops {
};
#ifdef CONFIG_SUSPEND
+extern suspend_state_t pm_suspend_target_state;
extern suspend_state_t mem_sleep_current;
extern suspend_state_t mem_sleep_default;
@@ -337,6 +338,8 @@ extern bool sync_on_suspend_enabled;
#else /* !CONFIG_SUSPEND */
#define suspend_valid_only_mem NULL
+#define pm_suspend_target_state (PM_SUSPEND_ON)
+
static inline void pm_suspend_clear_flags(void) {}
static inline void pm_set_suspend_via_firmware(void) {}
static inline void pm_set_resume_via_firmware(void) {}
@@ -503,7 +506,6 @@ extern void pm_report_max_hw_sleep(u64 t);
/* drivers/base/power/wakeup.c */
extern bool events_check_enabled;
-extern suspend_state_t pm_suspend_target_state;
extern bool pm_wakeup_pending(void);
extern void pm_system_wakeup(void);
^ permalink raw reply related [flat|nested] 588+ messages in thread* Re: [PATCH 6.1 000/568] 6.1.159-rc1 review
2025-12-04 13:54 ` Adrian Hunter
@ 2025-12-04 16:22 ` Greg Kroah-Hartman
0 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-04 16:22 UTC (permalink / raw)
To: Adrian Hunter
Cc: Naresh Kamboju, Rafael J. Wysocki, kai.heng.feng, stable, patches,
linux-kernel, torvalds, akpm, linux, shuah, patches, lkft-triage,
pavel, jonathanh, f.fainelli, sudipm.mukherjee, rwarsow, conor,
hargar, broonie, achill, sr, Svyatoslav Ryhel, Mikko Perttunen,
Thierry Reding, Arnd Bergmann, Dan Carpenter, Anders Roxell,
Ben Copeland, sparclinux
On Thu, Dec 04, 2025 at 03:54:15PM +0200, Adrian Hunter wrote:
> On 04/12/2025 12:43, Naresh Kamboju wrote:
> > On Wed, 3 Dec 2025 at 21:48, Greg Kroah-Hartman
> > <gregkh@linuxfoundation.org> wrote:
> >>
> >> This is the start of the stable review cycle for the 6.1.159 release.
> >> There are 568 patches in this series, all will be posted as a response
> >> to this one. If anyone has any issues with these being applied, please
> >> let me know.
>
> > Build regressions: sparc, allmodconfig, ERROR: modpost:
> > "pm_suspend_target_state" [drivers/ufs/host/ufshcd-pci.ko] undefined!
> >
> > ### sparc build error
> > ERROR: modpost: "pm_suspend_target_state"
> > [drivers/ufs/host/ufshcd-pci.ko] undefined!
> >
> > ### commit pointing to sparc build errors
> > scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers
> > commit bb44826c3bdbf1fa3957008a04908f45e5666463 upstream.
>
> For that issue, cherry-picking the following provides the
> needed definition:
>
> commit 2e41e3ca4729455e002bcb585f0d3749ee66d572
> Author: Kai-Heng Feng <kai.heng.feng@canonical.com>
> Date: Tue May 2 17:04:34 2023 +0200
>
> PM: suspend: Fix pm_suspend_target_state handling for !CONFIG_PM
>
> Move the pm_suspend_target_state definition for CONFIG_SUSPEND
> unset from the wakeup code into the headers so as to allow it
> to still be used elsewhere when CONFIG_SUSPEND is not set.
>
> Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
> [ rjw: Changelog and subject edits ]
> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Thanks, will go queue that up now.
greg k-h
^ permalink raw reply [flat|nested] 588+ messages in thread
* Re: [PATCH 6.1 000/568] 6.1.159-rc1 review
2025-12-04 10:43 ` Naresh Kamboju
2025-12-04 13:54 ` Adrian Hunter
@ 2025-12-04 16:24 ` Greg Kroah-Hartman
1 sibling, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-04 16:24 UTC (permalink / raw)
To: Naresh Kamboju
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr,
Adrian Hunter, Svyatoslav Ryhel, Mikko Perttunen, Thierry Reding,
Arnd Bergmann, Dan Carpenter, Anders Roxell, Ben Copeland,
sparclinux
On Thu, Dec 04, 2025 at 04:13:58PM +0530, Naresh Kamboju wrote:
> ### Commit pointing to arm build errors
> soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
> [ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
Now dropped from all queues, thanks!
greg k-h
^ permalink raw reply [flat|nested] 588+ messages in thread
* Re: [PATCH 6.1 000/568] 6.1.159-rc1 review
2025-12-03 15:20 [PATCH 6.1 000/568] 6.1.159-rc1 review Greg Kroah-Hartman
` (573 preceding siblings ...)
2025-12-04 10:43 ` Naresh Kamboju
@ 2025-12-04 12:06 ` Mark Brown
2025-12-04 13:51 ` Ron Economos
2025-12-04 14:28 ` Naresh Kamboju
574 siblings, 2 replies; 588+ messages in thread
From: Mark Brown @ 2025-12-04 12:06 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, achill, sr,
Kiryl Shutsemau
[-- Attachment #1: Type: text/plain, Size: 3703 bytes --]
On Wed, Dec 03, 2025 at 04:20:02PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.159 release.
> There are 568 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
I'm seeing a bunch of systems start failing with this release, they
start OOMing when previously they ran OK. Most of them aren't exactly
overburned with memory. These failures bisect to 61717acddadf66
(mm/memory: do not populate page table entries beyond i_size), sample
bisect from one of the systems including links to test jobs (the bisects
for other systems/test sets look very similar):
# bad: [abd89c70c9382759c14c5e7e0b383c2a19594c5c] Linux 6.1.159-rc1
# good: [f6e38ae624cf7eb96fb444a8ca2d07caa8d9c8fe] Linux 6.1.158
git bisect start 'abd89c70c9382759c14c5e7e0b383c2a19594c5c' 'f6e38ae624cf7eb96fb444a8ca2d07caa8d9c8fe'
# test job: [abd89c70c9382759c14c5e7e0b383c2a19594c5c] https://lava.sirena.org.uk/scheduler/job/2168338
# bad: [abd89c70c9382759c14c5e7e0b383c2a19594c5c] Linux 6.1.159-rc1
git bisect bad abd89c70c9382759c14c5e7e0b383c2a19594c5c
# test job: [43c650106e8558fa7cfec5a2e9c8de29233b6552] https://lava.sirena.org.uk/scheduler/job/2168373
# good: [43c650106e8558fa7cfec5a2e9c8de29233b6552] rtc: pcf2127: clear minute/second interrupt
git bisect good 43c650106e8558fa7cfec5a2e9c8de29233b6552
# test job: [b56fbe428919e8c1a548f331d20b8c4608008845] https://lava.sirena.org.uk/scheduler/job/2168393
# good: [b56fbe428919e8c1a548f331d20b8c4608008845] net/mlx5e: Preserve shared buffer capacity during headroom updates
git bisect good b56fbe428919e8c1a548f331d20b8c4608008845
# test job: [445097729a995f87ff7c80d5a161c7e1b5456628] https://lava.sirena.org.uk/scheduler/job/2169640
# bad: [445097729a995f87ff7c80d5a161c7e1b5456628] platform/x86: intel: punit_ipc: fix memory corruption
git bisect bad 445097729a995f87ff7c80d5a161c7e1b5456628
# test job: [ad3b2ce45cce79ddaff01c977d0867d079fa8349] https://lava.sirena.org.uk/scheduler/job/2169710
# good: [ad3b2ce45cce79ddaff01c977d0867d079fa8349] kernel.h: Move ARRAY_SIZE() to a separate header
git bisect good ad3b2ce45cce79ddaff01c977d0867d079fa8349
# test job: [de07228674e9cee27f679ebcf8562f7e3b2cda21] https://lava.sirena.org.uk/scheduler/job/2169731
# good: [de07228674e9cee27f679ebcf8562f7e3b2cda21] mptcp: decouple mptcp fastclose from tcp close
git bisect good de07228674e9cee27f679ebcf8562f7e3b2cda21
# test job: [dca2a95e4ed753ed33da11d7bb78157441d69bad] https://lava.sirena.org.uk/scheduler/job/2169741
# good: [dca2a95e4ed753ed33da11d7bb78157441d69bad] pmdomain: samsung: plug potential memleak during probe
git bisect good dca2a95e4ed753ed33da11d7bb78157441d69bad
# test job: [61717acddadf660fa6969027bfa0d6fd38f8e3e2] https://lava.sirena.org.uk/scheduler/job/2170912
# bad: [61717acddadf660fa6969027bfa0d6fd38f8e3e2] mm/memory: do not populate page table entries beyond i_size
git bisect bad 61717acddadf660fa6969027bfa0d6fd38f8e3e2
# test job: [0de5c14c8e753a547d158530c37efb245f7b40ec] https://lava.sirena.org.uk/scheduler/job/2171171
# good: [0de5c14c8e753a547d158530c37efb245f7b40ec] pmdomain: imx: Fix reference count leak in imx_gpc_remove
git bisect good 0de5c14c8e753a547d158530c37efb245f7b40ec
# test job: [1457e122dd70574a0ca895eea6d6c12ba91312bf] https://lava.sirena.org.uk/scheduler/job/2171268
# good: [1457e122dd70574a0ca895eea6d6c12ba91312bf] filemap: cap PTE range to be created to allowed zero fill in folio_map_range()
git bisect good 1457e122dd70574a0ca895eea6d6c12ba91312bf
# first bad commit: [61717acddadf660fa6969027bfa0d6fd38f8e3e2] mm/memory: do not populate page table entries beyond i_size
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 588+ messages in thread* Re: [PATCH 6.1 000/568] 6.1.159-rc1 review
2025-12-04 12:06 ` Mark Brown
@ 2025-12-04 13:51 ` Ron Economos
2025-12-04 16:28 ` Greg Kroah-Hartman
2025-12-04 14:28 ` Naresh Kamboju
1 sibling, 1 reply; 588+ messages in thread
From: Ron Economos @ 2025-12-04 13:51 UTC (permalink / raw)
To: Mark Brown, Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, achill, sr,
Kiryl Shutsemau
On 12/4/25 04:06, Mark Brown wrote:
> On Wed, Dec 03, 2025 at 04:20:02PM +0100, Greg Kroah-Hartman wrote:
>> This is the start of the stable review cycle for the 6.1.159 release.
>> There are 568 patches in this series, all will be posted as a response
>> to this one. If anyone has any issues with these being applied, please
>> let me know.
> I'm seeing a bunch of systems start failing with this release, they
> start OOMing when previously they ran OK. Most of them aren't exactly
> overburned with memory. These failures bisect to 61717acddadf66
> (mm/memory: do not populate page table entries beyond i_size), sample
> bisect from one of the systems including links to test jobs (the bisects
> for other systems/test sets look very similar):
>
> # bad: [abd89c70c9382759c14c5e7e0b383c2a19594c5c] Linux 6.1.159-rc1
> # good: [f6e38ae624cf7eb96fb444a8ca2d07caa8d9c8fe] Linux 6.1.158
> git bisect start 'abd89c70c9382759c14c5e7e0b383c2a19594c5c' 'f6e38ae624cf7eb96fb444a8ca2d07caa8d9c8fe'
> # test job: [abd89c70c9382759c14c5e7e0b383c2a19594c5c] https://lava.sirena.org.uk/scheduler/job/2168338
> # bad: [abd89c70c9382759c14c5e7e0b383c2a19594c5c] Linux 6.1.159-rc1
> git bisect bad abd89c70c9382759c14c5e7e0b383c2a19594c5c
> # test job: [43c650106e8558fa7cfec5a2e9c8de29233b6552] https://lava.sirena.org.uk/scheduler/job/2168373
> # good: [43c650106e8558fa7cfec5a2e9c8de29233b6552] rtc: pcf2127: clear minute/second interrupt
> git bisect good 43c650106e8558fa7cfec5a2e9c8de29233b6552
> # test job: [b56fbe428919e8c1a548f331d20b8c4608008845] https://lava.sirena.org.uk/scheduler/job/2168393
> # good: [b56fbe428919e8c1a548f331d20b8c4608008845] net/mlx5e: Preserve shared buffer capacity during headroom updates
> git bisect good b56fbe428919e8c1a548f331d20b8c4608008845
> # test job: [445097729a995f87ff7c80d5a161c7e1b5456628] https://lava.sirena.org.uk/scheduler/job/2169640
> # bad: [445097729a995f87ff7c80d5a161c7e1b5456628] platform/x86: intel: punit_ipc: fix memory corruption
> git bisect bad 445097729a995f87ff7c80d5a161c7e1b5456628
> # test job: [ad3b2ce45cce79ddaff01c977d0867d079fa8349] https://lava.sirena.org.uk/scheduler/job/2169710
> # good: [ad3b2ce45cce79ddaff01c977d0867d079fa8349] kernel.h: Move ARRAY_SIZE() to a separate header
> git bisect good ad3b2ce45cce79ddaff01c977d0867d079fa8349
> # test job: [de07228674e9cee27f679ebcf8562f7e3b2cda21] https://lava.sirena.org.uk/scheduler/job/2169731
> # good: [de07228674e9cee27f679ebcf8562f7e3b2cda21] mptcp: decouple mptcp fastclose from tcp close
> git bisect good de07228674e9cee27f679ebcf8562f7e3b2cda21
> # test job: [dca2a95e4ed753ed33da11d7bb78157441d69bad] https://lava.sirena.org.uk/scheduler/job/2169741
> # good: [dca2a95e4ed753ed33da11d7bb78157441d69bad] pmdomain: samsung: plug potential memleak during probe
> git bisect good dca2a95e4ed753ed33da11d7bb78157441d69bad
> # test job: [61717acddadf660fa6969027bfa0d6fd38f8e3e2] https://lava.sirena.org.uk/scheduler/job/2170912
> # bad: [61717acddadf660fa6969027bfa0d6fd38f8e3e2] mm/memory: do not populate page table entries beyond i_size
> git bisect bad 61717acddadf660fa6969027bfa0d6fd38f8e3e2
> # test job: [0de5c14c8e753a547d158530c37efb245f7b40ec] https://lava.sirena.org.uk/scheduler/job/2171171
> # good: [0de5c14c8e753a547d158530c37efb245f7b40ec] pmdomain: imx: Fix reference count leak in imx_gpc_remove
> git bisect good 0de5c14c8e753a547d158530c37efb245f7b40ec
> # test job: [1457e122dd70574a0ca895eea6d6c12ba91312bf] https://lava.sirena.org.uk/scheduler/job/2171268
> # good: [1457e122dd70574a0ca895eea6d6c12ba91312bf] filemap: cap PTE range to be created to allowed zero fill in folio_map_range()
> git bisect good 1457e122dd70574a0ca895eea6d6c12ba91312bf
> # first bad commit: [61717acddadf660fa6969027bfa0d6fd38f8e3e2] mm/memory: do not populate page table entries beyond i_size
This patch "mm/memory: do not populate page table entries beyond i_size"
also causes an Oops on RISC-V.
[ 5.940397] Unable to handle kernel paging request at virtual address
ffffffc6fe000028
[ 5.947616] Oops [#1]
[ 5.949814] Modules linked in:
[ 5.952857] CPU: 0 PID: 147 Comm: exe Not tainted 6.1.158 #2
[ 5.958500] Hardware name: SiFive HiFive Unmatched A00 (DT)
[ 5.964060] epc : _raw_spin_lock+0x12/0x84
[ 5.968141] ra : filemap_map_pages+0x23e/0x524
[ 5.972658] epc : ffffffff80b4d500 ra : ffffffff801e3d60 sp :
ffffffd88c923c80
[ 5.979870] gp : ffffffff81a3f228 tp : ffffffd88c8c1a80 t0 :
0000000000000000
[ 5.987078] t1 : 0000000000000000 t2 : 0000000000000000 s0 :
ffffffd88c923c90
[ 5.994287] s1 : 0000000000000000 a0 : ffffffc6fe000028 a1 :
ffffffc800000000
[ 6.001497] a2 : 0000000100000000 a3 : 0000000000080000 a4 :
0000000000000ff8
[ 6.008706] a5 : 0000000000010000 a6 : ffffffff813d5858 a7 :
0000000000000000
[ 6.015915] s2 : 0000003f807ff000 s3 : ffffffd88c923d98 s4 :
0000000000000000
[ 6.023125] s5 : ffffffd77fe00ff8 s6 : 0000000000000000 s7 :
0000000000000000
[ 6.030333] s8 : 0000003f80829008 s9 : fffffffffffffffe s10:
ffffffd880f866f8
[ 6.037543] s11: ffffffc7020b67c0 t3 : ffffffffffffffff t4 :
0000003f807ff000
[ 6.044752] t5 : 0000000000000000 t6 : 0000000000000000
[ 6.050047] status: 0000000200000120 badaddr: ffffffc6fe000028 cause:
000000000000000f
[ 6.057957] [<ffffffff80b4d500>] _raw_spin_lock+0x12/0x84
[ 6.063338] [<ffffffff801e3d60>] filemap_map_pages+0x23e/0x524
[ 6.069157] [<ffffffff80229ffc>] __handle_mm_fault+0xd44/0x1818
[ 6.075064] [<ffffffff8022ab84>] handle_mm_fault+0xb4/0x1b8
[ 6.080622] [<ffffffff8000cd54>] do_page_fault+0x142/0x462
[ 6.086095] [<ffffffff80003f20>] ret_from_exception+0x0/0x16
[ 6.091798] ---[ end trace 0000000000000000 ]---
^ permalink raw reply [flat|nested] 588+ messages in thread
* Re: [PATCH 6.1 000/568] 6.1.159-rc1 review
2025-12-04 13:51 ` Ron Economos
@ 2025-12-04 16:28 ` Greg Kroah-Hartman
0 siblings, 0 replies; 588+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-04 16:28 UTC (permalink / raw)
To: Ron Economos
Cc: Mark Brown, stable, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, achill, sr,
Kiryl Shutsemau
On Thu, Dec 04, 2025 at 05:51:18AM -0800, Ron Economos wrote:
> On 12/4/25 04:06, Mark Brown wrote:
> > On Wed, Dec 03, 2025 at 04:20:02PM +0100, Greg Kroah-Hartman wrote:
> > > This is the start of the stable review cycle for the 6.1.159 release.
> > > There are 568 patches in this series, all will be posted as a response
> > > to this one. If anyone has any issues with these being applied, please
> > > let me know.
> > I'm seeing a bunch of systems start failing with this release, they
> > start OOMing when previously they ran OK. Most of them aren't exactly
> > overburned with memory. These failures bisect to 61717acddadf66
> > (mm/memory: do not populate page table entries beyond i_size), sample
> > bisect from one of the systems including links to test jobs (the bisects
> > for other systems/test sets look very similar):
> >
> > # bad: [abd89c70c9382759c14c5e7e0b383c2a19594c5c] Linux 6.1.159-rc1
> > # good: [f6e38ae624cf7eb96fb444a8ca2d07caa8d9c8fe] Linux 6.1.158
> > git bisect start 'abd89c70c9382759c14c5e7e0b383c2a19594c5c' 'f6e38ae624cf7eb96fb444a8ca2d07caa8d9c8fe'
> > # test job: [abd89c70c9382759c14c5e7e0b383c2a19594c5c] https://lava.sirena.org.uk/scheduler/job/2168338
> > # bad: [abd89c70c9382759c14c5e7e0b383c2a19594c5c] Linux 6.1.159-rc1
> > git bisect bad abd89c70c9382759c14c5e7e0b383c2a19594c5c
> > # test job: [43c650106e8558fa7cfec5a2e9c8de29233b6552] https://lava.sirena.org.uk/scheduler/job/2168373
> > # good: [43c650106e8558fa7cfec5a2e9c8de29233b6552] rtc: pcf2127: clear minute/second interrupt
> > git bisect good 43c650106e8558fa7cfec5a2e9c8de29233b6552
> > # test job: [b56fbe428919e8c1a548f331d20b8c4608008845] https://lava.sirena.org.uk/scheduler/job/2168393
> > # good: [b56fbe428919e8c1a548f331d20b8c4608008845] net/mlx5e: Preserve shared buffer capacity during headroom updates
> > git bisect good b56fbe428919e8c1a548f331d20b8c4608008845
> > # test job: [445097729a995f87ff7c80d5a161c7e1b5456628] https://lava.sirena.org.uk/scheduler/job/2169640
> > # bad: [445097729a995f87ff7c80d5a161c7e1b5456628] platform/x86: intel: punit_ipc: fix memory corruption
> > git bisect bad 445097729a995f87ff7c80d5a161c7e1b5456628
> > # test job: [ad3b2ce45cce79ddaff01c977d0867d079fa8349] https://lava.sirena.org.uk/scheduler/job/2169710
> > # good: [ad3b2ce45cce79ddaff01c977d0867d079fa8349] kernel.h: Move ARRAY_SIZE() to a separate header
> > git bisect good ad3b2ce45cce79ddaff01c977d0867d079fa8349
> > # test job: [de07228674e9cee27f679ebcf8562f7e3b2cda21] https://lava.sirena.org.uk/scheduler/job/2169731
> > # good: [de07228674e9cee27f679ebcf8562f7e3b2cda21] mptcp: decouple mptcp fastclose from tcp close
> > git bisect good de07228674e9cee27f679ebcf8562f7e3b2cda21
> > # test job: [dca2a95e4ed753ed33da11d7bb78157441d69bad] https://lava.sirena.org.uk/scheduler/job/2169741
> > # good: [dca2a95e4ed753ed33da11d7bb78157441d69bad] pmdomain: samsung: plug potential memleak during probe
> > git bisect good dca2a95e4ed753ed33da11d7bb78157441d69bad
> > # test job: [61717acddadf660fa6969027bfa0d6fd38f8e3e2] https://lava.sirena.org.uk/scheduler/job/2170912
> > # bad: [61717acddadf660fa6969027bfa0d6fd38f8e3e2] mm/memory: do not populate page table entries beyond i_size
> > git bisect bad 61717acddadf660fa6969027bfa0d6fd38f8e3e2
> > # test job: [0de5c14c8e753a547d158530c37efb245f7b40ec] https://lava.sirena.org.uk/scheduler/job/2171171
> > # good: [0de5c14c8e753a547d158530c37efb245f7b40ec] pmdomain: imx: Fix reference count leak in imx_gpc_remove
> > git bisect good 0de5c14c8e753a547d158530c37efb245f7b40ec
> > # test job: [1457e122dd70574a0ca895eea6d6c12ba91312bf] https://lava.sirena.org.uk/scheduler/job/2171268
> > # good: [1457e122dd70574a0ca895eea6d6c12ba91312bf] filemap: cap PTE range to be created to allowed zero fill in folio_map_range()
> > git bisect good 1457e122dd70574a0ca895eea6d6c12ba91312bf
> > # first bad commit: [61717acddadf660fa6969027bfa0d6fd38f8e3e2] mm/memory: do not populate page table entries beyond i_size
>
> This patch "mm/memory: do not populate page table entries beyond i_size"
> also causes an Oops on RISC-V.
>
> [ 5.940397] Unable to handle kernel paging request at virtual address
> ffffffc6fe000028
> [ 5.947616] Oops [#1]
> [ 5.949814] Modules linked in:
> [ 5.952857] CPU: 0 PID: 147 Comm: exe Not tainted 6.1.158 #2
> [ 5.958500] Hardware name: SiFive HiFive Unmatched A00 (DT)
> [ 5.964060] epc : _raw_spin_lock+0x12/0x84
> [ 5.968141] ra : filemap_map_pages+0x23e/0x524
> [ 5.972658] epc : ffffffff80b4d500 ra : ffffffff801e3d60 sp :
> ffffffd88c923c80
> [ 5.979870] gp : ffffffff81a3f228 tp : ffffffd88c8c1a80 t0 :
> 0000000000000000
> [ 5.987078] t1 : 0000000000000000 t2 : 0000000000000000 s0 :
> ffffffd88c923c90
> [ 5.994287] s1 : 0000000000000000 a0 : ffffffc6fe000028 a1 :
> ffffffc800000000
> [ 6.001497] a2 : 0000000100000000 a3 : 0000000000080000 a4 :
> 0000000000000ff8
> [ 6.008706] a5 : 0000000000010000 a6 : ffffffff813d5858 a7 :
> 0000000000000000
> [ 6.015915] s2 : 0000003f807ff000 s3 : ffffffd88c923d98 s4 :
> 0000000000000000
> [ 6.023125] s5 : ffffffd77fe00ff8 s6 : 0000000000000000 s7 :
> 0000000000000000
> [ 6.030333] s8 : 0000003f80829008 s9 : fffffffffffffffe s10:
> ffffffd880f866f8
> [ 6.037543] s11: ffffffc7020b67c0 t3 : ffffffffffffffff t4 :
> 0000003f807ff000
> [ 6.044752] t5 : 0000000000000000 t6 : 0000000000000000
> [ 6.050047] status: 0000000200000120 badaddr: ffffffc6fe000028 cause:
> 000000000000000f
> [ 6.057957] [<ffffffff80b4d500>] _raw_spin_lock+0x12/0x84
> [ 6.063338] [<ffffffff801e3d60>] filemap_map_pages+0x23e/0x524
> [ 6.069157] [<ffffffff80229ffc>] __handle_mm_fault+0xd44/0x1818
> [ 6.075064] [<ffffffff8022ab84>] handle_mm_fault+0xb4/0x1b8
> [ 6.080622] [<ffffffff8000cd54>] do_page_fault+0x142/0x462
> [ 6.086095] [<ffffffff80003f20>] ret_from_exception+0x0/0x16
> [ 6.091798] ---[ end trace 0000000000000000 ]---
Thanks all, I'll go drop this now and push out a -rc2 soon.
greg k-h
^ permalink raw reply [flat|nested] 588+ messages in thread
* Re: [PATCH 6.1 000/568] 6.1.159-rc1 review
2025-12-04 12:06 ` Mark Brown
2025-12-04 13:51 ` Ron Economos
@ 2025-12-04 14:28 ` Naresh Kamboju
1 sibling, 0 replies; 588+ messages in thread
From: Naresh Kamboju @ 2025-12-04 14:28 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, Mark Brown, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, achill, sr,
Kiryl Shutsemau, Dan Carpenter, Arnd Bergmann, Anders Roxell,
Ben Copeland
On Thu, 4 Dec 2025 at 17:36, Mark Brown <broonie@kernel.org> wrote:
>
> On Wed, Dec 03, 2025 at 04:20:02PM +0100, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 6.1.159 release.
> > There are 568 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
>
> I'm seeing a bunch of systems start failing with this release, they
> start OOMing when previously they ran OK. Most of them aren't exactly
> overburned with memory. These failures bisect to 61717acddadf66
> (mm/memory: do not populate page table entries beyond i_size), sample
> bisect from one of the systems including links to test jobs (the bisects
> for other systems/test sets look very similar):
As Mark’s reported, the LKFT reproduced the same regression on Juno-r2,
FVP and qemu-arm64 during boot.
### boot log
<0>[ 42.433802] Internal error: Oops: 0000000096000046 [#1] PREEMPT SMP"}
<4>[ 42.434147] Modules linked in: fuse drm ip_tables x_tables"}
<4>[ 42.434573] CPU: 1 PID: 374 Comm: skipgen Not tainted 6.1.159-rc1 #1"}
<4>[ 42.435344] Hardware name: linux,dummy-virt (DT)"}
<4>[ 42.436140] pstate: 42402009 (nZcv daif +PAN -UAO +TCO -DIT
-SSBS BTYPE=--)"}
<4>[ 42.437004] pc : _raw_spin_lock+0x3c/0x8c"}
<4>[ 42.438173] lr : _raw_spin_lock+0x28/0x8c"}
Boot regression: Juno-r2, FVP, Internal error: Oops: _raw_spin_lock
filemap_map_pages
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
## commit point to,
mm/memory: do not populate page table entries beyond i_size
[ Upstream commit 74207de2ba10c2973334906822dc94d2e859ffc5 ]
### Links,
- https://regressions.linaro.org/lkft/linux-stable-rc-linux-6.1.y/v6.1.158-569-gabd89c70c938/log-parser-test/internal-error-oops-Oops_PREEMPT_SMP___raw_spin_lock-a94221fb/
- https://lkft.validation.linaro.org/scheduler/job/8540690#L1835
- https://tuxapi.tuxsuite.com/v1/groups/linaro/projects/lkft/tests/36LJeldPNf0LMr3PSr7WYaPqCFa
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 588+ messages in thread