From: Thomas Zimmermann tzimmermann@suse.de

[ Upstream commit 13b29cc3a722c2c0bc9ab9f72f9047d55d08a2f9 ]

Selecting DRM_FBDEV_EMULATION will include the correct settings for fbdev emulation. Drivers should not override this.

Signed-off-by: Thomas Zimmermann tzimmermann@suse.de Acked-by: Stefan Agner stefan@agner.ch Acked-by: Daniel Vetter daniel.vetter@ffwll.ch Link: https://patchwork.freedesktop.org/patch/msgid/20210415110040.23525-3-tzimmer... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/mxsfb/Kconfig | 1 - 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/mxsfb/Kconfig b/drivers/gpu/drm/mxsfb/Kconfig index 0143d539f8f8..ee22cd25d3e3 100644 --- a/drivers/gpu/drm/mxsfb/Kconfig +++ b/drivers/gpu/drm/mxsfb/Kconfig @@ -10,7 +10,6 @@ config DRM_MXSFB depends on COMMON_CLK select DRM_MXS select DRM_KMS_HELPER - select DRM_KMS_FB_HELPER select DRM_KMS_CMA_HELPER select DRM_PANEL select DRM_PANEL_BRIDGE

From: KuoHsiang Chou kuohsiang_chou@aspeedtech.com

[ Upstream commit ba4e0339a6a33e2ba341703ce14ae8ca203cb2f1 ]

[Bug][DP501] If ASPEED P2A (PCI to AHB) bridge is disabled and disallowed for CVE_2019_6260 item3, and then the monitor's EDID is unable read through Parade DP501. The reason is the DP501's FW is mapped to BMC addressing space rather than Host addressing space. The resolution is that using "pci_iomap_range()" maps to DP501's FW that stored on the end of FB (Frame Buffer). In this case, FrameBuffer reserves the last 2MB used for the image of DP501.

Signed-off-by: KuoHsiang Chou kuohsiang_chou@aspeedtech.com Reported-by: kernel test robot lkp@intel.com Signed-off-by: Thomas Zimmermann tzimmermann@suse.de Link: https://patchwork.freedesktop.org/patch/msgid/20210421085859.17761-1-kuohsia... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/ast/ast_dp501.c | 139 +++++++++++++++++++++++--------- drivers/gpu/drm/ast/ast_drv.h | 12 +++ drivers/gpu/drm/ast/ast_main.c | 11 ++- 3 files changed, 125 insertions(+), 37 deletions(-)

diff --git a/drivers/gpu/drm/ast/ast_dp501.c b/drivers/gpu/drm/ast/ast_dp501.c index 88121c0e0d05..cd93c44f2662 100644 --- a/drivers/gpu/drm/ast/ast_dp501.c +++ b/drivers/gpu/drm/ast/ast_dp501.c @@ -189,6 +189,9 @@ bool ast_backup_fw(struct drm_device *dev, u8 *addr, u32 size) u32 i, data; u32 boot_address;

+ if (ast->config_mode != ast_use_p2a) + return false; + data = ast_mindwm(ast, 0x1e6e2100) & 0x01; if (data) { boot_address = get_fw_base(ast); @@ -207,6 +210,9 @@ static bool ast_launch_m68k(struct drm_device *dev) u8 *fw_addr = NULL; u8 jreg;

+ if (ast->config_mode != ast_use_p2a) + return false; + data = ast_mindwm(ast, 0x1e6e2100) & 0x01; if (!data) {

@@ -271,25 +277,55 @@ u8 ast_get_dp501_max_clk(struct drm_device *dev) struct ast_private *ast = to_ast_private(dev); u32 boot_address, offset, data; u8 linkcap[4], linkrate, linklanes, maxclk = 0xff; + u32 *plinkcap;

- boot_address = get_fw_base(ast); - - /* validate FW version */ - offset = 0xf000; - data = ast_mindwm(ast, boot_address + offset); - if ((data & 0xf0) != 0x10) /* version: 1x */ - return maxclk; - - /* Read Link Capability */ - offset = 0xf014; - *(u32 *)linkcap = ast_mindwm(ast, boot_address + offset); - if (linkcap[2] == 0) { - linkrate = linkcap[0]; - linklanes = linkcap[1]; - data = (linkrate == 0x0a) ? (90 * linklanes) : (54 * linklanes); - if (data > 0xff) - data = 0xff; - maxclk = (u8)data; + if (ast->config_mode == ast_use_p2a) { + boot_address = get_fw_base(ast); + + /* validate FW version */ + offset = AST_DP501_GBL_VERSION; + data = ast_mindwm(ast, boot_address + offset); + if ((data & AST_DP501_FW_VERSION_MASK) != AST_DP501_FW_VERSION_1) /* version: 1x */ + return maxclk; + + /* Read Link Capability */ + offset = AST_DP501_LINKRATE; + plinkcap = (u32 *)linkcap; + *plinkcap = ast_mindwm(ast, boot_address + offset); + if (linkcap[2] == 0) { + linkrate = linkcap[0]; + linklanes = linkcap[1]; + data = (linkrate == 0x0a) ? (90 * linklanes) : (54 * linklanes); + if (data > 0xff) + data = 0xff; + maxclk = (u8)data; + } + } else { + if (!ast->dp501_fw_buf) + return AST_DP501_DEFAULT_DCLK; /* 1024x768 as default */ + + /* dummy read */ + offset = 0x0000; + data = readl(ast->dp501_fw_buf + offset); + + /* validate FW version */ + offset = AST_DP501_GBL_VERSION; + data = readl(ast->dp501_fw_buf + offset); + if ((data & AST_DP501_FW_VERSION_MASK) != AST_DP501_FW_VERSION_1) /* version: 1x */ + return maxclk; + + /* Read Link Capability */ + offset = AST_DP501_LINKRATE; + plinkcap = (u32 *)linkcap; + *plinkcap = readl(ast->dp501_fw_buf + offset); + if (linkcap[2] == 0) { + linkrate = linkcap[0]; + linklanes = linkcap[1]; + data = (linkrate == 0x0a) ? (90 * linklanes) : (54 * linklanes); + if (data > 0xff) + data = 0xff; + maxclk = (u8)data; + } } return maxclk; } @@ -298,26 +334,57 @@ bool ast_dp501_read_edid(struct drm_device *dev, u8 *ediddata) { struct ast_private *ast = to_ast_private(dev); u32 i, boot_address, offset, data; + u32 *pEDIDidx;

- boot_address = get_fw_base(ast); - - /* validate FW version */ - offset = 0xf000; - data = ast_mindwm(ast, boot_address + offset); - if ((data & 0xf0) != 0x10) - return false; - - /* validate PnP Monitor */ - offset = 0xf010; - data = ast_mindwm(ast, boot_address + offset); - if (!(data & 0x01)) - return false; + if (ast->config_mode == ast_use_p2a) { + boot_address = get_fw_base(ast);

- /* Read EDID */ - offset = 0xf020; - for (i = 0; i < 128; i += 4) { - data = ast_mindwm(ast, boot_address + offset + i); - *(u32 *)(ediddata + i) = data; + /* validate FW version */ + offset = AST_DP501_GBL_VERSION; + data = ast_mindwm(ast, boot_address + offset); + if ((data & AST_DP501_FW_VERSION_MASK) != AST_DP501_FW_VERSION_1) + return false; + + /* validate PnP Monitor */ + offset = AST_DP501_PNPMONITOR; + data = ast_mindwm(ast, boot_address + offset); + if (!(data & AST_DP501_PNP_CONNECTED)) + return false; + + /* Read EDID */ + offset = AST_DP501_EDID_DATA; + for (i = 0; i < 128; i += 4) { + data = ast_mindwm(ast, boot_address + offset + i); + pEDIDidx = (u32 *)(ediddata + i); + *pEDIDidx = data; + } + } else { + if (!ast->dp501_fw_buf) + return false; + + /* dummy read */ + offset = 0x0000; + data = readl(ast->dp501_fw_buf + offset); + + /* validate FW version */ + offset = AST_DP501_GBL_VERSION; + data = readl(ast->dp501_fw_buf + offset); + if ((data & AST_DP501_FW_VERSION_MASK) != AST_DP501_FW_VERSION_1) + return false; + + /* validate PnP Monitor */ + offset = AST_DP501_PNPMONITOR; + data = readl(ast->dp501_fw_buf + offset); + if (!(data & AST_DP501_PNP_CONNECTED)) + return false; + + /* Read EDID */ + offset = AST_DP501_EDID_DATA; + for (i = 0; i < 128; i += 4) { + data = readl(ast->dp501_fw_buf + offset + i); + pEDIDidx = (u32 *)(ediddata + i); + *pEDIDidx = data; + } }

return true; diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_drv.h index f871fc36c2f7..a3f67a34f616 100644 --- a/drivers/gpu/drm/ast/ast_drv.h +++ b/drivers/gpu/drm/ast/ast_drv.h @@ -121,6 +121,7 @@ struct ast_private {

void __iomem *regs; void __iomem *ioregs; + void __iomem *dp501_fw_buf;

enum ast_chip chip; bool vga2_clone; @@ -298,6 +299,17 @@ int ast_mode_config_init(struct ast_private *ast); #define AST_MM_ALIGN_SHIFT 4 #define AST_MM_ALIGN_MASK ((1 << AST_MM_ALIGN_SHIFT) - 1)

+#define AST_DP501_FW_VERSION_MASK GENMASK(7, 4) +#define AST_DP501_FW_VERSION_1 BIT(4) +#define AST_DP501_PNP_CONNECTED BIT(1) + +#define AST_DP501_DEFAULT_DCLK 65 + +#define AST_DP501_GBL_VERSION 0xf000 +#define AST_DP501_PNPMONITOR 0xf010 +#define AST_DP501_LINKRATE 0xf014 +#define AST_DP501_EDID_DATA 0xf020 + int ast_mm_init(struct ast_private *ast);

/* ast post */ diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c index c29cc7f19863..189d783f6e2c 100644 --- a/drivers/gpu/drm/ast/ast_main.c +++ b/drivers/gpu/drm/ast/ast_main.c @@ -99,7 +99,7 @@ static void ast_detect_config_mode(struct drm_device *dev, u32 *scu_rev) if (!(jregd0 & 0x80) || !(jregd1 & 0x10)) { /* Double check it's actually working */ data = ast_read32(ast, 0xf004); - if (data != 0xFFFFFFFF) { + if ((data != 0xFFFFFFFF) && (data != 0x00)) { /* P2A works, grab silicon revision */ ast->config_mode = ast_use_p2a;

@@ -411,6 +411,7 @@ struct ast_private *ast_device_create(const struct drm_driver *drv, return ast; dev = &ast->base;

+ dev->pdev = pdev; pci_set_drvdata(pdev, dev);

ast->regs = pcim_iomap(pdev, 1, 0); @@ -450,6 +451,14 @@ struct ast_private *ast_device_create(const struct drm_driver *drv, if (ret) return ERR_PTR(ret);

+ /* map reserved buffer */ + ast->dp501_fw_buf = NULL; + if (dev->vram_mm->vram_size < pci_resource_len(dev->pdev, 0)) { + ast->dp501_fw_buf = pci_iomap_range(dev->pdev, 0, dev->vram_mm->vram_size, 0); + if (!ast->dp501_fw_buf) + drm_info(dev, "failed to map reserved buffer!\n"); + } + ret = ast_mode_config_init(ast); if (ret) return ERR_PTR(ret);

From: Jack Zhang Jack.Zhang1@amd.com

[ Upstream commit 95ea3dbc4e9548d35ab6fbf67675cef8c293e2f5 ]

Disable all ip's hw status to false before any hw_init. Only set it to true until its hw_init is executed.

The old 5.9 branch has this change but somehow the 5.11 kernrel does not have this fix.

Without this change, sriov tdr have gfx IB test fail.

Signed-off-by: Jack Zhang Jack.Zhang1@amd.com Review-by: Emily Deng Emily.Deng@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c index 85d90e857693..a32b41e4c24e 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c @@ -2818,7 +2818,7 @@ static int amdgpu_device_ip_reinit_early_sriov(struct amdgpu_device *adev) AMD_IP_BLOCK_TYPE_IH, };

- for (i = 0; i < ARRAY_SIZE(ip_order); i++) { + for (i = 0; i < adev->num_ip_blocks; i++) { int j; struct amdgpu_ip_block *block;

From: Liu Ying victor.liu@nxp.com

[ Upstream commit 3afb2a28fa2404d11cce1956a003f2aaca4da421 ]

This patch replaces ->mode_fixup() with ->atomic_check() so that a full modeset can be requested from there when crtc_state->active is changed to be true(which implies only connector's DPMS is brought out of "Off" status, though not necessarily). Bridge functions are added or changed to accommodate the ->atomic_check() callback. That full modeset is needed by the up-coming patch which gets MIPI DSI controller and PHY ready in ->mode_set(), because it makes sure ->mode_set() and ->atomic_disable() are called in pairs.

Cc: Andrzej Hajda a.hajda@samsung.com Cc: Neil Armstrong narmstrong@baylibre.com Cc: Robert Foss robert.foss@linaro.org Cc: Laurent Pinchart Laurent.pinchart@ideasonboard.com Cc: Jonas Karlman jonas@kwiboo.se Cc: Jernej Skrabec jernej.skrabec@siol.net Cc: David Airlie airlied@linux.ie Cc: Daniel Vetter daniel@ffwll.ch Cc: Guido Günther agx@sigxcpu.org Cc: Robert Chiras robert.chiras@nxp.com Cc: NXP Linux Team linux-imx@nxp.com Signed-off-by: Liu Ying victor.liu@nxp.com Reviewed-by: Neil Armstrong narmstrong@baylibre.com Signed-off-by: Neil Armstrong narmstrong@baylibre.com Link: https://patchwork.freedesktop.org/patch/msgid/1619170003-4817-2-git-send-ema... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/bridge/nwl-dsi.c | 61 ++++++++++++++++++++------------ 1 file changed, 39 insertions(+), 22 deletions(-)

diff --git a/drivers/gpu/drm/bridge/nwl-dsi.c b/drivers/gpu/drm/bridge/nwl-dsi.c index 66b67402f1ac..c65ca860712d 100644 --- a/drivers/gpu/drm/bridge/nwl-dsi.c +++ b/drivers/gpu/drm/bridge/nwl-dsi.c @@ -21,6 +21,7 @@ #include <linux/sys_soc.h> #include <linux/time64.h>

+#include <drm/drm_atomic_state_helper.h> #include <drm/drm_bridge.h> #include <drm/drm_mipi_dsi.h> #include <drm/drm_of.h> @@ -742,7 +743,9 @@ static int nwl_dsi_disable(struct nwl_dsi *dsi) return 0; }

-static void nwl_dsi_bridge_disable(struct drm_bridge *bridge) +static void +nwl_dsi_bridge_atomic_disable(struct drm_bridge *bridge, + struct drm_bridge_state *old_bridge_state) { struct nwl_dsi *dsi = bridge_to_dsi(bridge); int ret; @@ -803,17 +806,6 @@ static int nwl_dsi_get_dphy_params(struct nwl_dsi *dsi, return 0; }

-static bool nwl_dsi_bridge_mode_fixup(struct drm_bridge *bridge, - const struct drm_display_mode *mode, - struct drm_display_mode *adjusted_mode) -{ - /* At least LCDIF + NWL needs active high sync */ - adjusted_mode->flags |= (DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC); - adjusted_mode->flags &= ~(DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC); - - return true; -} - static enum drm_mode_status nwl_dsi_bridge_mode_valid(struct drm_bridge *bridge, const struct drm_display_info *info, @@ -831,6 +823,24 @@ nwl_dsi_bridge_mode_valid(struct drm_bridge *bridge, return MODE_OK; }

+static int nwl_dsi_bridge_atomic_check(struct drm_bridge *bridge, + struct drm_bridge_state *bridge_state, + struct drm_crtc_state *crtc_state, + struct drm_connector_state *conn_state) +{ + struct drm_display_mode *adjusted_mode = &crtc_state->adjusted_mode; + + /* At least LCDIF + NWL needs active high sync */ + adjusted_mode->flags |= (DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC); + adjusted_mode->flags &= ~(DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC); + + /* Do a full modeset if crtc_state->active is changed to be true. */ + if (crtc_state->active_changed && crtc_state->active) + crtc_state->mode_changed = true; + + return 0; +} + static void nwl_dsi_bridge_mode_set(struct drm_bridge *bridge, const struct drm_display_mode *mode, @@ -862,7 +872,9 @@ nwl_dsi_bridge_mode_set(struct drm_bridge *bridge, drm_mode_debug_printmodeline(adjusted_mode); }

-static void nwl_dsi_bridge_pre_enable(struct drm_bridge *bridge) +static void +nwl_dsi_bridge_atomic_pre_enable(struct drm_bridge *bridge, + struct drm_bridge_state *old_bridge_state) { struct nwl_dsi *dsi = bridge_to_dsi(bridge); int ret; @@ -897,7 +909,9 @@ static void nwl_dsi_bridge_pre_enable(struct drm_bridge *bridge) } }

-static void nwl_dsi_bridge_enable(struct drm_bridge *bridge) +static void +nwl_dsi_bridge_atomic_enable(struct drm_bridge *bridge, + struct drm_bridge_state *old_bridge_state) { struct nwl_dsi *dsi = bridge_to_dsi(bridge); int ret; @@ -942,14 +956,17 @@ static void nwl_dsi_bridge_detach(struct drm_bridge *bridge) }

static const struct drm_bridge_funcs nwl_dsi_bridge_funcs = { - .pre_enable = nwl_dsi_bridge_pre_enable, - .enable = nwl_dsi_bridge_enable, - .disable = nwl_dsi_bridge_disable, - .mode_fixup = nwl_dsi_bridge_mode_fixup, - .mode_set = nwl_dsi_bridge_mode_set, - .mode_valid = nwl_dsi_bridge_mode_valid, - .attach = nwl_dsi_bridge_attach, - .detach = nwl_dsi_bridge_detach, + .atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state, + .atomic_destroy_state = drm_atomic_helper_bridge_destroy_state, + .atomic_reset = drm_atomic_helper_bridge_reset, + .atomic_check = nwl_dsi_bridge_atomic_check, + .atomic_pre_enable = nwl_dsi_bridge_atomic_pre_enable, + .atomic_enable = nwl_dsi_bridge_atomic_enable, + .atomic_disable = nwl_dsi_bridge_atomic_disable, + .mode_set = nwl_dsi_bridge_mode_set, + .mode_valid = nwl_dsi_bridge_mode_valid, + .attach = nwl_dsi_bridge_attach, + .detach = nwl_dsi_bridge_detach, };

static int nwl_dsi_parse_dt(struct nwl_dsi *dsi)

From: Alex Deucher alexander.deucher@amd.com

[ Upstream commit 67387dfe0f6630f2d4f412ce77debec23a49db7a ]

Change to 60s. This matches what we already do in virtualization. Infinite timeout can lead to deadlocks in the kernel.

Reviewed-by: Christian König christian.koenig@amd.com Acked-by: Daniel Vetter daniel.vetter@ffwll.ch Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 +++----- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 4 ++-- 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c index a32b41e4c24e..1b69aa74056d 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c @@ -3141,8 +3141,8 @@ static int amdgpu_device_get_job_timeout_settings(struct amdgpu_device *adev) int ret = 0;

/* - * By default timeout for non compute jobs is 10000. - * And there is no timeout enforced on compute jobs. + * By default timeout for non compute jobs is 10000 + * and 60000 for compute jobs. * In SR-IOV or passthrough mode, timeout for compute * jobs are 60000 by default. */ @@ -3151,10 +3151,8 @@ static int amdgpu_device_get_job_timeout_settings(struct amdgpu_device *adev) if (amdgpu_sriov_vf(adev)) adev->compute_timeout = amdgpu_sriov_is_pp_one_vf(adev) ? msecs_to_jiffies(60000) : msecs_to_jiffies(10000); - else if (amdgpu_passthrough(adev)) - adev->compute_timeout = msecs_to_jiffies(60000); else - adev->compute_timeout = MAX_SCHEDULE_TIMEOUT; + adev->compute_timeout = msecs_to_jiffies(60000);

if (strnlen(input, AMDGPU_MAX_TIMEOUT_PARAM_LENGTH)) { while ((timeout_setting = strsep(&input, ",")) && diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c index e92e7dea71da..f9728ee10298 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c @@ -272,9 +272,9 @@ module_param_named(msi, amdgpu_msi, int, 0444); * for SDMA and Video. * * By default(with no lockup_timeout settings), the timeout for all non-compute(GFX, SDMA and Video) - * jobs is 10000. And there is no timeout enforced on compute jobs. + * jobs is 10000. The timeout for compute is 60000. */ -MODULE_PARM_DESC(lockup_timeout, "GPU lockup timeout in ms (default: for bare metal 10000 for non-compute jobs and infinity timeout for compute jobs; " +MODULE_PARM_DESC(lockup_timeout, "GPU lockup timeout in ms (default: for bare metal 10000 for non-compute jobs and 60000 for compute jobs; " "for passthrough or sriov, 10000 for all jobs." " 0: keep default value. negative: infinity timeout), " "format: for bare metal [Non-Compute] or [GFX,Compute,SDMA,Video]; "

From: Dinghao Liu dinghao.liu@zju.edu.cn

[ Upstream commit a20a40a8bbc2cf4b29d7248ea31e974e9103dd7f ]

The error handling paths after pm_runtime_get_sync() have no refcount decrement, which leads to refcount leak.

Signed-off-by: Dinghao Liu dinghao.liu@zju.edu.cn Link: https://lore.kernel.org/r/20210415073338.22287-1-dinghao.liu@zju.edu.cn [geert: Remove now unused variable priv] Signed-off-by: Geert Uytterhoeven geert+renesas@glider.be Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/clk/renesas/rcar-usb2-clock-sel.c | 24 ++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/drivers/clk/renesas/rcar-usb2-clock-sel.c b/drivers/clk/renesas/rcar-usb2-clock-sel.c index 3abafd78f7c8..8b4e43659023 100644 --- a/drivers/clk/renesas/rcar-usb2-clock-sel.c +++ b/drivers/clk/renesas/rcar-usb2-clock-sel.c @@ -128,10 +128,8 @@ static int rcar_usb2_clock_sel_resume(struct device *dev) static int rcar_usb2_clock_sel_remove(struct platform_device *pdev) { struct device *dev = &pdev->dev; - struct usb2_clock_sel_priv *priv = platform_get_drvdata(pdev);

of_clk_del_provider(dev->of_node); - clk_hw_unregister(&priv->hw); pm_runtime_put(dev); pm_runtime_disable(dev);

@@ -164,9 +162,6 @@ static int rcar_usb2_clock_sel_probe(struct platform_device *pdev) if (IS_ERR(priv->rsts)) return PTR_ERR(priv->rsts);

- pm_runtime_enable(dev); - pm_runtime_get_sync(dev); - clk = devm_clk_get(dev, "usb_extal"); if (!IS_ERR(clk) && !clk_prepare_enable(clk)) { priv->extal = !!clk_get_rate(clk); @@ -183,6 +178,8 @@ static int rcar_usb2_clock_sel_probe(struct platform_device *pdev) return -ENOENT; }

+ pm_runtime_enable(dev); + pm_runtime_get_sync(dev); platform_set_drvdata(pdev, priv); dev_set_drvdata(dev, priv);

@@ -193,11 +190,20 @@ static int rcar_usb2_clock_sel_probe(struct platform_device *pdev) init.num_parents = 0; priv->hw.init = &init;

- clk = clk_register(NULL, &priv->hw); - if (IS_ERR(clk)) - return PTR_ERR(clk); + ret = devm_clk_hw_register(NULL, &priv->hw); + if (ret) + goto pm_put; + + ret = of_clk_add_hw_provider(np, of_clk_hw_simple_get, &priv->hw); + if (ret) + goto pm_put; + + return 0;

- return of_clk_add_hw_provider(np, of_clk_hw_simple_get, &priv->hw); +pm_put: + pm_runtime_put(dev); + pm_runtime_disable(dev); + return ret; }

static const struct dev_pm_ops rcar_usb2_clock_sel_pm_ops = {

From: Zou Wei zou_wei@huawei.com

[ Upstream commit 1c72e6ab66b9598cac741ed397438a52065a8f1f ]

This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free.

Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself.

Reported-by: Hulk Robot hulkci@huawei.com Signed-off-by: Zou Wei zou_wei@huawei.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/atm/iphase.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c index eef637fd90b3..a59554e5b8b0 100644 --- a/drivers/atm/iphase.c +++ b/drivers/atm/iphase.c @@ -3279,7 +3279,7 @@ static void __exit ia_module_exit(void) { pci_unregister_driver(&ia_driver);

- del_timer(&ia_timer); + del_timer_sync(&ia_timer); }

module_init(ia_module_init);

From: Zou Wei zou_wei@huawei.com

[ Upstream commit 34e7434ba4e97f4b85c1423a59b2922ba7dff2ea ]

This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free.

Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself.

Reported-by: Hulk Robot hulkci@huawei.com Signed-off-by: Zou Wei zou_wei@huawei.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/atm/nicstar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c index 5c7e4df159b9..b015c3e14336 100644 --- a/drivers/atm/nicstar.c +++ b/drivers/atm/nicstar.c @@ -299,7 +299,7 @@ static void __exit nicstar_cleanup(void) { XPRINTK("nicstar: nicstar_cleanup() called.\n");

- del_timer(&ns_timer); + del_timer_sync(&ns_timer);

pci_unregister_driver(&nicstar_driver);

From: Wang Li wangli74@huawei.com

[ Upstream commit 69777e6ca396f0a7e1baff40fcad4a9d3d445b7a ]

pm_runtime_get_sync will increment pm usage counter even it failed. Forgetting to putting operation will result in reference leak here. Fix it by replacing it with pm_runtime_resume_and_get to keep usage counter balanced.

Reported-by: Hulk Robot hulkci@huawei.com Signed-off-by: Wang Li wangli74@huawei.com Signed-off-by: Chun-Kuang Hu chunkuang.hu@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c index 8b0de90156c6..69d23ce56d2c 100644 --- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c @@ -259,7 +259,7 @@ static int mtk_crtc_ddp_hw_init(struct mtk_drm_crtc *mtk_crtc) drm_connector_list_iter_end(&conn_iter); }

- ret = pm_runtime_get_sync(crtc->dev->dev); + ret = pm_runtime_resume_and_get(crtc->dev->dev); if (ret < 0) { DRM_ERROR("Failed to enable power domain: %d\n", ret); return ret;

From: Zou Wei zou_wei@huawei.com

[ Upstream commit 8d0b1fe81e18eb66a2d4406386760795fe0d77d9 ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates correct modalias for automatic loading of this driver when it is built as an external module.

Reported-by: Hulk Robot hulkci@huawei.com Signed-off-by: Zou Wei zou_wei@huawei.com Reviewed-by: Robert Foss robert.foss@linaro.org Signed-off-by: Robert Foss robert.foss@linaro.org Link: https://patchwork.freedesktop.org/patch/msgid/1620801955-19188-1-git-send-em... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/bridge/lontium-lt9611.c | 1 + 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c index d734d9402c35..c1926154eda8 100644 --- a/drivers/gpu/drm/bridge/lontium-lt9611.c +++ b/drivers/gpu/drm/bridge/lontium-lt9611.c @@ -1209,6 +1209,7 @@ static struct i2c_device_id lt9611_id[] = { { "lontium,lt9611", 0 }, {} }; +MODULE_DEVICE_TABLE(i2c, lt9611_id);

static const struct of_device_id lt9611_match_table[] = { { .compatible = "lontium,lt9611" },

From: Xie Yongji xieyongji@bytedance.com

[ Upstream commit cec7f1774605a5ef47c134af62afe7c75c30b0ee ]

The virtio_gpu_init() will free vgdev and vgdev->vbufs on failure. But such failure will be caught by virtio_gpu_probe() and then virtio_gpu_release() will be called to do some cleanup which will free vgdev and vgdev->vbufs again. So let's set dev->dev_private to NULL to avoid double free.

Signed-off-by: Xie Yongji xieyongji@bytedance.com Link: http://patchwork.freedesktop.org/patch/msgid/20210517084913.403-2-xieyongji@... Signed-off-by: Gerd Hoffmann kraxel@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/virtio/virtgpu_kms.c | 1 + 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c index b375394193be..37a21a88d674 100644 --- a/drivers/gpu/drm/virtio/virtgpu_kms.c +++ b/drivers/gpu/drm/virtio/virtgpu_kms.c @@ -234,6 +234,7 @@ err_scanouts: err_vbufs: vgdev->vdev->config->del_vqs(vgdev->vdev); err_vqs: + dev->dev_private = NULL; kfree(vgdev); return ret; }

From: Davide Caratti dcaratti@redhat.com

[ Upstream commit 05ff8435e50569a0a6b95e5ceaea43696e8827ab ]

modern userspace applications, like OVN, can configure the TC datapath to "recirculate" packets several times. If more than 4 "recirculation" rules are configured, packets can be dropped by __tcf_classify(). Changing the maximum number of reclassifications (from 4 to 16) should be sufficient to prevent drops in most use cases, and guard against loops at the same time.

Signed-off-by: Davide Caratti dcaratti@redhat.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- net/sched/cls_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c index 94f6942d7ec1..2f82ac7c0f93 100644 --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -1531,7 +1531,7 @@ static inline int __tcf_classify(struct sk_buff *skb, u32 *last_executed_chain) { #ifdef CONFIG_NET_CLS_ACT - const int max_reclassify_loop = 4; + const int max_reclassify_loop = 16; const struct tcf_proto *first_tp; int limit = 0;

From: Andrey Grodzovsky andrey.grodzovsky@amd.com

[ Upstream commit c61cdbdbffc169dc7f1e6fe94dfffaf574fe672a ]

Problem: If scheduler is already stopped by the time sched_entity is released and entity's job_queue not empty I encountred a hang in drm_sched_entity_flush. This is because drm_sched_entity_is_idle never becomes false.

Fix: In drm_sched_fini detach all sched_entities from the scheduler's run queues. This will satisfy drm_sched_entity_is_idle. Also wakeup all those processes stuck in sched_entity flushing as the scheduler main thread which wakes them up is stopped by now.

v2: Reverse order of drm_sched_rq_remove_entity and marking s_entity as stopped to prevent reinserion back to rq due to race.

v3: Drop drm_sched_rq_remove_entity, only modify entity->stopped and check for it in drm_sched_entity_is_idle

Signed-off-by: Andrey Grodzovsky andrey.grodzovsky@amd.com Reviewed-by: Christian König christian.koenig@amd.com Link: https://patchwork.freedesktop.org/patch/msgid/20210512142648.666476-14-andre... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/scheduler/sched_entity.c | 3 ++- drivers/gpu/drm/scheduler/sched_main.c | 24 ++++++++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c index c1ac3e4003c6..72c39608236b 100644 --- a/drivers/gpu/drm/scheduler/sched_entity.c +++ b/drivers/gpu/drm/scheduler/sched_entity.c @@ -116,7 +116,8 @@ static bool drm_sched_entity_is_idle(struct drm_sched_entity *entity) rmb(); /* for list_empty to work without lock */

if (list_empty(&entity->list) || - spsc_queue_count(&entity->job_queue) == 0) + spsc_queue_count(&entity->job_queue) == 0 || + entity->stopped) return true;

return false; diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c index 92637b70c9bf..16244e9669b9 100644 --- a/drivers/gpu/drm/scheduler/sched_main.c +++ b/drivers/gpu/drm/scheduler/sched_main.c @@ -896,9 +896,33 @@ EXPORT_SYMBOL(drm_sched_init); */ void drm_sched_fini(struct drm_gpu_scheduler *sched) { + struct drm_sched_entity *s_entity; + int i; + if (sched->thread) kthread_stop(sched->thread);

+ for (i = DRM_SCHED_PRIORITY_COUNT - 1; i >= DRM_SCHED_PRIORITY_MIN; i--) { + struct drm_sched_rq *rq = &sched->sched_rq[i]; + + if (!rq) + continue; + + spin_lock(&rq->lock); + list_for_each_entry(s_entity, &rq->entities, list) + /* + * Prevents reinsertion and marks job_queue as idle, + * it will removed from rq in drm_sched_entity_fini + * eventually + */ + s_entity->stopped = true; + spin_unlock(&rq->lock); + + } + + /* Wakeup everyone stuck in drm_sched_entity_flush for this scheduler */ + wake_up_all(&sched->job_scheduled); + /* Confirm no work left behind accessing device structures */ cancel_delayed_work_sync(&sched->work_tdr);

From: Arturo Giusti koredump@protonmail.com

[ Upstream commit fa236c2b2d4436d9f19ee4e5d5924e90ffd7bb43 ]

In function udf_symlink, epos.bh is assigned with the value returned by udf_tgetblk. The function udf_tgetblk is defined in udf/misc.c and returns the value of sb_getblk function that could be NULL. Then, epos.bh is used without any check, causing a possible NULL pointer dereference when sb_getblk fails.

This fix adds a check to validate the value of epos.bh.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=213083 Signed-off-by: Arturo Giusti koredump@protonmail.com Signed-off-by: Jan Kara jack@suse.cz Signed-off-by: Sasha Levin sashal@kernel.org --- fs/udf/namei.c | 4 ++++ 1 file changed, 4 insertions(+)

diff --git a/fs/udf/namei.c b/fs/udf/namei.c index f146b3089f3d..6c5692ad42b5 100644 --- a/fs/udf/namei.c +++ b/fs/udf/namei.c @@ -934,6 +934,10 @@ static int udf_symlink(struct user_namespace *mnt_userns, struct inode *dir, iinfo->i_location.partitionReferenceNum, 0); epos.bh = udf_tgetblk(sb, block); + if (unlikely(!epos.bh)) { + err = -ENOMEM; + goto out_no_entry; + } lock_buffer(epos.bh); memset(epos.bh->b_data, 0x00, bsize); set_buffer_uptodate(epos.bh);

From: Mateusz Kwiatkowski kfyatek+publicgit@gmail.com

[ Upstream commit fc7a8abcee2225d6279ff785d33e24d70c738c6e ]

On the BCM2711 (Raspberry Pi 4), the VEC is actually connected to output 2 of pixelvalve3.

NOTE: This contradicts the Broadcom docs, but has been empirically tested and confirmed by Raspberry Pi firmware devs.

Signed-off-by: Mateusz Kwiatkowski kfyatek+publicgit@gmail.com Signed-off-by: Maxime Ripard maxime@cerno.tech Reviewed-by: Dave Stevenson dave.stevenson@raspberrypi.com Link: https://patchwork.freedesktop.org/patch/msgid/20210520150344.273900-2-maxime... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/vc4/vc4_crtc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c index 1f36b67cd6ce..e0fd9b74baae 100644 --- a/drivers/gpu/drm/vc4/vc4_crtc.c +++ b/drivers/gpu/drm/vc4/vc4_crtc.c @@ -1035,7 +1035,7 @@ static const struct vc4_pv_data bcm2711_pv3_data = { .fifo_depth = 64, .pixels_per_clock = 1, .encoder_types = { - [0] = VC4_ENCODER_TYPE_VEC, + [PV_CONTROL_CLK_SELECT_VEC] = VC4_ENCODER_TYPE_VEC, }, };

From: Jesse Brandeburg jesse.brandeburg@intel.com

[ Upstream commit d4ef55288aa2e1b76033717242728ac98ddc4721 ]

Sparse tool was warning on some implicit conversions from little endian data read from the EEPROM on the e100 cards.

Fix these by being explicit about the conversions using le16_to_cpu().

Signed-off-by: Jesse Brandeburg jesse.brandeburg@intel.com Signed-off-by: Tony Nguyen anthony.l.nguyen@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/intel/e100.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c index f8d78af76d7d..1b0958bd24f6 100644 --- a/drivers/net/ethernet/intel/e100.c +++ b/drivers/net/ethernet/intel/e100.c @@ -1395,7 +1395,7 @@ static int e100_phy_check_without_mii(struct nic *nic) u8 phy_type; int without_mii;

- phy_type = (nic->eeprom[eeprom_phy_iface] >> 8) & 0x0f; + phy_type = (le16_to_cpu(nic->eeprom[eeprom_phy_iface]) >> 8) & 0x0f;

switch (phy_type) { case NoSuchPhy: /* Non-MII PHY; UNTESTED! */ @@ -1515,7 +1515,7 @@ static int e100_phy_init(struct nic *nic) mdio_write(netdev, nic->mii.phy_id, MII_BMCR, bmcr); } else if ((nic->mac >= mac_82550_D102) || ((nic->flags & ich) && (mdio_read(netdev, nic->mii.phy_id, MII_TPISTATUS) & 0x8000) && - (nic->eeprom[eeprom_cnfg_mdix] & eeprom_mdix_enabled))) { + (le16_to_cpu(nic->eeprom[eeprom_cnfg_mdix]) & eeprom_mdix_enabled))) { /* enable/disable MDI/MDI-X auto-switching. */ mdio_write(netdev, nic->mii.phy_id, MII_NCONFIG, nic->mii.force_media ? 0 : NCONFIG_AUTO_SWITCH); @@ -2269,9 +2269,9 @@ static int e100_asf(struct nic *nic) { /* ASF can be enabled from eeprom */ return (nic->pdev->device >= 0x1050) && (nic->pdev->device <= 0x1057) && - (nic->eeprom[eeprom_config_asf] & eeprom_asf) && - !(nic->eeprom[eeprom_config_asf] & eeprom_gcl) && - ((nic->eeprom[eeprom_smbus_addr] & 0xFF) != 0xFE); + (le16_to_cpu(nic->eeprom[eeprom_config_asf]) & eeprom_asf) && + !(le16_to_cpu(nic->eeprom[eeprom_config_asf]) & eeprom_gcl) && + ((le16_to_cpu(nic->eeprom[eeprom_smbus_addr]) & 0xFF) != 0xFE); }

static int e100_up(struct nic *nic) @@ -2926,7 +2926,7 @@ static int e100_probe(struct pci_dev *pdev, const struct pci_device_id *ent)

/* Wol magic packet can be enabled from eeprom */ if ((nic->mac >= mac_82558_D101_A4) && - (nic->eeprom[eeprom_id] & eeprom_id_wol)) { + (le16_to_cpu(nic->eeprom[eeprom_id]) & eeprom_id_wol)) { nic->flags |= wol_magic; device_set_wakeup_enable(&pdev->dev, true); }

From: Jesse Brandeburg jesse.brandeburg@intel.com

[ Upstream commit b514958dd1a3bd57638b0e63b8e5152b1960e6aa ]

The igb driver was trying hard to be sparse correct, but somehow ended up converting a variable into little endian order and then tries to OR something with it.

A much plainer way of doing things is to leave all variables and OR operations in CPU (non-endian) mode, and then convert to little endian only once, which is what this change does.

This probably fixes a bug that might have been seen only on big endian systems.

Signed-off-by: Jesse Brandeburg jesse.brandeburg@intel.com Tested-by: Dave Switzer david.switzer@intel.com Signed-off-by: Tony Nguyen anthony.l.nguyen@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/intel/igb/igb_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c index 894b9b87dba1..434220a342df 100644 --- a/drivers/net/ethernet/intel/igb/igb_main.c +++ b/drivers/net/ethernet/intel/igb/igb_main.c @@ -6277,12 +6277,12 @@ int igb_xmit_xdp_ring(struct igb_adapter *adapter, cmd_type |= len | IGB_TXD_DCMD; tx_desc->read.cmd_type_len = cpu_to_le32(cmd_type);

- olinfo_status = cpu_to_le32(len << E1000_ADVTXD_PAYLEN_SHIFT); + olinfo_status = len << E1000_ADVTXD_PAYLEN_SHIFT; /* 82575 requires a unique index per ring */ if (test_bit(IGB_RING_FLAG_TX_CTX_IDX, &tx_ring->flags)) olinfo_status |= tx_ring->reg_idx << 4;

- tx_desc->read.olinfo_status = olinfo_status; + tx_desc->read.olinfo_status = cpu_to_le32(olinfo_status);

netdev_tx_sent_queue(txring_txq(tx_ring), tx_buffer->bytecount);

From: Kuninori Morimoto kuninori.morimoto.gx@renesas.com

[ Upstream commit 790c06cc5df263cdaff748670cc65958c81b0951 ]

R-Car D3 ZA2 clock is from PLL0D3 or S0, and it can be controlled by ZA2CKCR. It is needed for R-Car Sound, but is not used so far. Using default settings is very enough at this point. This patch adds it by DEF_FIXED().

Signed-off-by: Kuninori Morimoto kuninori.morimoto.gx@renesas.com Link: https://lore.kernel.org/r/87pmxclrmy.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Geert Uytterhoeven geert+renesas@glider.be Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/clk/renesas/r8a77995-cpg-mssr.c | 1 + 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/renesas/r8a77995-cpg-mssr.c b/drivers/clk/renesas/r8a77995-cpg-mssr.c index 9cfd00cf4e69..81c0bc1e78af 100644 --- a/drivers/clk/renesas/r8a77995-cpg-mssr.c +++ b/drivers/clk/renesas/r8a77995-cpg-mssr.c @@ -75,6 +75,7 @@ static const struct cpg_core_clk r8a77995_core_clks[] __initconst = { DEF_RATE(".oco", CLK_OCO, 8 * 1000 * 1000),

/* Core Clock Outputs */ + DEF_FIXED("za2", R8A77995_CLK_ZA2, CLK_PLL0D3, 2, 1), DEF_FIXED("z2", R8A77995_CLK_Z2, CLK_PLL0D3, 1, 1), DEF_FIXED("ztr", R8A77995_CLK_ZTR, CLK_PLL1, 6, 1), DEF_FIXED("zt", R8A77995_CLK_ZT, CLK_PLL1, 4, 1),

From: Huy Nguyen huyn@nvidia.com

[ Upstream commit c07274ab1ab2c38fb128e32643c22c89cb319384 ]

rep_tc copy REG_C1 to REG_B. IPsec crypto utilizes the whole REG_B register with BIT31 as IPsec marker. rep_tc_update_skb drops IPsec because it thought REG_B contains bad value.

In previous patch, BIT 31 of REG_C1 is reserved for IPsec. Skip the rep_tc_update_skb if BIT31 of REG_B is set.

Signed-off-by: Huy Nguyen huyn@nvidia.com Signed-off-by: Raed Salem raeds@nvidia.com Signed-off-by: Saeed Mahameed saeedm@nvidia.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c index 249d8905e644..e7528fa7e187 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c @@ -1308,7 +1308,8 @@ static void mlx5e_handle_rx_cqe_rep(struct mlx5e_rq *rq, struct mlx5_cqe64 *cqe) if (rep->vlan && skb_vlan_tag_present(skb)) skb_vlan_pop(skb);

- if (!mlx5e_rep_tc_update_skb(cqe, skb, &tc_priv)) { + if (unlikely(!mlx5_ipsec_is_rx_flow(cqe) && + !mlx5e_rep_tc_update_skb(cqe, skb, &tc_priv))) { dev_kfree_skb_any(skb); goto free_wqe; } @@ -1365,7 +1366,8 @@ static void mlx5e_handle_rx_cqe_mpwrq_rep(struct mlx5e_rq *rq, struct mlx5_cqe64

mlx5e_complete_rx_cqe(rq, cqe, cqe_bcnt, skb);

- if (!mlx5e_rep_tc_update_skb(cqe, skb, &tc_priv)) { + if (unlikely(!mlx5_ipsec_is_rx_flow(cqe) && + !mlx5e_rep_tc_update_skb(cqe, skb, &tc_priv))) { dev_kfree_skb_any(skb); goto mpwrq_cqe_out; }

From: Alex Bee knaerzche@gmail.com

[ Upstream commit ab64b448a175b8a5a4bd323b8f74758c2574482c ]

Add dither_up, dsp_lut_en and data_blank registers to enable their respective functionality for RK3188's VOP. While at that also fix .dsp_blank register which is (only) set with BIT24 (same as RK3066)

Signed-off-by: Alex Bee knaerzche@gmail.com Signed-off-by: Heiko Stuebner heiko@sntech.de Link: https://patchwork.freedesktop.org/patch/msgid/20210528130554.72191-3-knaerzc... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/rockchip/rockchip_vop_reg.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c index 80053d91a301..b8dcee64a1f7 100644 --- a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c +++ b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c @@ -505,7 +505,10 @@ static const struct vop_common rk3188_common = { .dither_down_sel = VOP_REG(RK3188_DSP_CTRL0, 0x1, 27), .dither_down_en = VOP_REG(RK3188_DSP_CTRL0, 0x1, 11), .dither_down_mode = VOP_REG(RK3188_DSP_CTRL0, 0x1, 10), - .dsp_blank = VOP_REG(RK3188_DSP_CTRL1, 0x3, 24), + .dsp_blank = VOP_REG(RK3188_DSP_CTRL1, 0x1, 24), + .dither_up = VOP_REG(RK3188_DSP_CTRL0, 0x1, 9), + .dsp_lut_en = VOP_REG(RK3188_SYS_CTRL, 0x1, 28), + .data_blank = VOP_REG(RK3188_DSP_CTRL1, 0x1, 25), };

static const struct vop_win_data rk3188_vop_win_data[] = {

From: Vladimir Oltean vladimir.oltean@nxp.com

[ Upstream commit 4751d2aa321f2828d8c5d2f7ce4ed18a01e47f46 ]

stmmac_mdio_register() has logic to search for PHYs on the MDIO bus and assign them IRQ lines, as well as to set priv->plat->phy_addr.

If no PHY is found, the "found" variable remains set to 0 and the function errors out.

After the introduction of commit f213bbe8a9d6 ("net: stmmac: Integrate it with DesignWare XPCS"), the "found" variable was immediately reused for searching for a PCS on the same MDIO bus.

This can result in 2 types of potential problems (none of them seems to be seen on the only Intel system that sets has_xpcs = true, otherwise it would have been reported):

1. If a PCS is found but a PHY is not, then the code happily exits with no error. One might say "yes, but this is not possible, because of_mdiobus_register will probe a PHY for all MDIO addresses, including for the XPCS, so if an XPCS exists, then a PHY certainly exists too". Well, that is not true, see intel_mgbe_common_data():

/* Ensure mdio bus scan skips intel serdes and pcs-xpcs */ plat->mdio_bus_data->phy_mask = 1 << INTEL_MGBE_ADHOC_ADDR; plat->mdio_bus_data->phy_mask |= 1 << INTEL_MGBE_XPCS_ADDR;

2. A PHY is found but an MDIO device with the XPCS PHY ID isn't, and in that case, the error message will be "No PHY found". Confusing.

Signed-off-by: Vladimir Oltean vladimir.oltean@nxp.com Link: https://lore.kernel.org/r/20210527155959.3270478-1-olteanv@gmail.com Signed-off-by: Jakub Kicinski kuba@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- .../net/ethernet/stmicro/stmmac/stmmac_mdio.c | 21 +++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c index d64116e0543e..a4ba27bf3131 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c @@ -444,6 +444,12 @@ int stmmac_mdio_register(struct net_device *ndev) found = 1; }

+ if (!found && !mdio_node) { + dev_warn(dev, "No PHY found\n"); + err = -ENODEV; + goto no_phy_found; + } + /* Try to probe the XPCS by scanning all addresses. */ if (priv->hw->xpcs) { struct mdio_xpcs_args *xpcs = &priv->hw->xpcs_args; @@ -452,6 +458,7 @@ int stmmac_mdio_register(struct net_device *ndev)

xpcs->bus = new_bus;

+ found = 0; for (addr = 0; addr < max_addr; addr++) { xpcs->addr = addr;

@@ -461,13 +468,12 @@ int stmmac_mdio_register(struct net_device *ndev) break; } } - }

- if (!found && !mdio_node) { - dev_warn(dev, "No PHY found\n"); - mdiobus_unregister(new_bus); - mdiobus_free(new_bus); - return -ENODEV; + if (!found && !mdio_node) { + dev_warn(dev, "No XPCS found\n"); + err = -ENODEV; + goto no_xpcs_found; + } }

bus_register_done: @@ -475,6 +481,9 @@ bus_register_done:

return 0;

+no_xpcs_found: +no_phy_found: + mdiobus_unregister(new_bus); bus_register_fail: mdiobus_free(new_bus); return err;

From: Dmitry Osipenko digetx@gmail.com

[ Upstream commit c592c8a28f5821e880ac6675781cd8a151b0737c ]

The refcounting of the gate clocks has a bug causing the enable_refcnt to underflow when unused clocks are disabled. This happens because clk provider erroneously bumps the refcount if clock is enabled at a boot time, which it shouldn't be doing, and it does this only for the gate clocks, while peripheral clocks are using the same gate ops and the peripheral clocks are missing the initial bump. Hence the refcount of the peripheral clocks is 0 when unused clocks are disabled and then the counter is decremented further by the gate ops, causing the integer underflow.

Fix this problem by removing the erroneous bump and by implementing the disable_unused() callback, which disables the unused gates properly.

The visible effect of the bug is such that the unused clocks are never gated if a loaded kernel module grabs the unused clocks and starts to use them. In practice this shouldn't cause any real problems for the drivers and boards supported by the kernel today.

Acked-by: Thierry Reding treding@nvidia.com Signed-off-by: Dmitry Osipenko digetx@gmail.com Signed-off-by: Thierry Reding treding@nvidia.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/clk/tegra/clk-periph-gate.c | 72 +++++++++++++++++++---------- drivers/clk/tegra/clk-periph.c | 11 +++++ 2 files changed, 58 insertions(+), 25 deletions(-)

diff --git a/drivers/clk/tegra/clk-periph-gate.c b/drivers/clk/tegra/clk-periph-gate.c index 4b31beefc9fc..dc3f92678407 100644 --- a/drivers/clk/tegra/clk-periph-gate.c +++ b/drivers/clk/tegra/clk-periph-gate.c @@ -48,18 +48,9 @@ static int clk_periph_is_enabled(struct clk_hw *hw) return state; }

-static int clk_periph_enable(struct clk_hw *hw) +static void clk_periph_enable_locked(struct clk_hw *hw) { struct tegra_clk_periph_gate *gate = to_clk_periph_gate(hw); - unsigned long flags = 0; - - spin_lock_irqsave(&periph_ref_lock, flags); - - gate->enable_refcnt[gate->clk_num]++; - if (gate->enable_refcnt[gate->clk_num] > 1) { - spin_unlock_irqrestore(&periph_ref_lock, flags); - return 0; - }

write_enb_set(periph_clk_to_bit(gate), gate); udelay(2); @@ -78,6 +69,32 @@ static int clk_periph_enable(struct clk_hw *hw) udelay(1); writel_relaxed(0, gate->clk_base + LVL2_CLK_GATE_OVRE); } +} + +static void clk_periph_disable_locked(struct clk_hw *hw) +{ + struct tegra_clk_periph_gate *gate = to_clk_periph_gate(hw); + + /* + * If peripheral is in the APB bus then read the APB bus to + * flush the write operation in apb bus. This will avoid the + * peripheral access after disabling clock + */ + if (gate->flags & TEGRA_PERIPH_ON_APB) + tegra_read_chipid(); + + write_enb_clr(periph_clk_to_bit(gate), gate); +} + +static int clk_periph_enable(struct clk_hw *hw) +{ + struct tegra_clk_periph_gate *gate = to_clk_periph_gate(hw); + unsigned long flags = 0; + + spin_lock_irqsave(&periph_ref_lock, flags); + + if (!gate->enable_refcnt[gate->clk_num]++) + clk_periph_enable_locked(hw);

spin_unlock_irqrestore(&periph_ref_lock, flags);

@@ -91,21 +108,28 @@ static void clk_periph_disable(struct clk_hw *hw)

spin_lock_irqsave(&periph_ref_lock, flags);

- gate->enable_refcnt[gate->clk_num]--; - if (gate->enable_refcnt[gate->clk_num] > 0) { - spin_unlock_irqrestore(&periph_ref_lock, flags); - return; - } + WARN_ON(!gate->enable_refcnt[gate->clk_num]); + + if (--gate->enable_refcnt[gate->clk_num] == 0) + clk_periph_disable_locked(hw); + + spin_unlock_irqrestore(&periph_ref_lock, flags); +} + +static void clk_periph_disable_unused(struct clk_hw *hw) +{ + struct tegra_clk_periph_gate *gate = to_clk_periph_gate(hw); + unsigned long flags = 0; + + spin_lock_irqsave(&periph_ref_lock, flags);

/* - * If peripheral is in the APB bus then read the APB bus to - * flush the write operation in apb bus. This will avoid the - * peripheral access after disabling clock + * Some clocks are duplicated and some of them are marked as critical, + * like fuse and fuse_burn for example, thus the enable_refcnt will + * be non-zero here if the "unused" duplicate is disabled by CCF. */ - if (gate->flags & TEGRA_PERIPH_ON_APB) - tegra_read_chipid(); - - write_enb_clr(periph_clk_to_bit(gate), gate); + if (!gate->enable_refcnt[gate->clk_num]) + clk_periph_disable_locked(hw);

spin_unlock_irqrestore(&periph_ref_lock, flags); } @@ -114,6 +138,7 @@ const struct clk_ops tegra_clk_periph_gate_ops = { .is_enabled = clk_periph_is_enabled, .enable = clk_periph_enable, .disable = clk_periph_disable, + .disable_unused = clk_periph_disable_unused, };

struct clk *tegra_clk_register_periph_gate(const char *name, @@ -148,9 +173,6 @@ struct clk *tegra_clk_register_periph_gate(const char *name, gate->enable_refcnt = enable_refcnt; gate->regs = pregs;

- if (read_enb(gate) & periph_clk_to_bit(gate)) - enable_refcnt[clk_num]++; - /* Data in .init is copied by clk_register(), so stack variable OK */ gate->hw.init = &init;

diff --git a/drivers/clk/tegra/clk-periph.c b/drivers/clk/tegra/clk-periph.c index 67620c7ecd9e..79ca3aa072b7 100644 --- a/drivers/clk/tegra/clk-periph.c +++ b/drivers/clk/tegra/clk-periph.c @@ -100,6 +100,15 @@ static void clk_periph_disable(struct clk_hw *hw) gate_ops->disable(gate_hw); }

+static void clk_periph_disable_unused(struct clk_hw *hw) +{ + struct tegra_clk_periph *periph = to_clk_periph(hw); + const struct clk_ops *gate_ops = periph->gate_ops; + struct clk_hw *gate_hw = &periph->gate.hw; + + gate_ops->disable_unused(gate_hw); +} + static void clk_periph_restore_context(struct clk_hw *hw) { struct tegra_clk_periph *periph = to_clk_periph(hw); @@ -126,6 +135,7 @@ const struct clk_ops tegra_clk_periph_ops = { .is_enabled = clk_periph_is_enabled, .enable = clk_periph_enable, .disable = clk_periph_disable, + .disable_unused = clk_periph_disable_unused, .restore_context = clk_periph_restore_context, };

@@ -135,6 +145,7 @@ static const struct clk_ops tegra_clk_periph_nodiv_ops = { .is_enabled = clk_periph_is_enabled, .enable = clk_periph_enable, .disable = clk_periph_disable, + .disable_unused = clk_periph_disable_unused, .restore_context = clk_periph_restore_context, };

From: Yu Kuai yukuai3@huawei.com

[ Upstream commit f674555ee5444c8987dfea0922f1cf6bf0c12847 ]

pm_runtime_get_sync will increment pm usage counter even it failed. Forgetting to putting operation will result in reference leak here. Fix it by replacing it with pm_runtime_resume_and_get to keep usage counter balanced.

Reported-by: Hulk Robot hulkci@huawei.com Signed-off-by: Yu Kuai yukuai3@huawei.com Reviewed-by: Robert Foss robert.foss@linaro.org Signed-off-by: Robert Foss robert.foss@linaro.org Link: https://patchwork.freedesktop.org/patch/msgid/20210531135622.3348252-1-yukua... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c index d0c65610ebb5..f56ff97c9899 100644 --- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c @@ -2369,9 +2369,9 @@ static int cdns_mhdp_probe(struct platform_device *pdev) clk_prepare_enable(clk);

pm_runtime_enable(dev); - ret = pm_runtime_get_sync(dev); + ret = pm_runtime_resume_and_get(dev); if (ret < 0) { - dev_err(dev, "pm_runtime_get_sync failed\n"); + dev_err(dev, "pm_runtime_resume_and_get failed\n"); pm_runtime_disable(dev); goto clk_disable; }

From: Willy Tarreau w@1wt.eu

[ Upstream commit 62f20e068ccc50d6ab66fdb72ba90da2b9418c99 ]

This is a complement to commit aa6dd211e4b1 ("inet: use bigger hash table for IP ID generation"), but focusing on some specific aspects of IPv6.

Contary to IPv4, IPv6 only uses packet IDs with fragments, and with a minimum MTU of 1280, it's much less easy to force a remote peer to produce many fragments to explore its ID sequence. In addition packet IDs are 32-bit in IPv6, which further complicates their analysis. On the other hand, it is often easier to choose among plenty of possible source addresses and partially work around the bigger hash table the commit above permits, which leaves IPv6 partially exposed to some possibilities of remote analysis at the risk of weakening some protocols like DNS if some IDs can be predicted with a good enough probability.

Given the wide range of permitted IDs, the risk of collision is extremely low so there's no need to rely on the positive increment algorithm that is shared with the IPv4 code via ip_idents_reserve(). We have a fast PRNG, so let's simply call prandom_u32() and be done with it.

Performance measurements at 10 Gbps couldn't show any difference with the previous code, even when using a single core, because due to the large fragments, we're limited to only ~930 kpps at 10 Gbps and the cost of the random generation is completely offset by other operations and by the network transfer time. In addition, this change removes the need to update a shared entry in the idents table so it may even end up being slightly faster on large scale systems where this matters.

The risk of at least one collision here is about 1/80 million among 10 IDs, 1/850k among 100 IDs, and still only 1/8.5k among 1000 IDs, which remains very low compared to IPv4 where all IDs are reused every 4 to 80ms on a 10 Gbps flow depending on packet sizes.

Reported-by: Amit Klein aksecurity@gmail.com Signed-off-by: Willy Tarreau w@1wt.eu Reviewed-by: Eric Dumazet edumazet@google.com Link: https://lore.kernel.org/r/20210529110746.6796-1-w@1wt.eu Signed-off-by: Jakub Kicinski kuba@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- net/ipv6/output_core.c | 28 +++++----------------------- 1 file changed, 5 insertions(+), 23 deletions(-)

diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c index af36acc1a644..2880dc7d9a49 100644 --- a/net/ipv6/output_core.c +++ b/net/ipv6/output_core.c @@ -15,29 +15,11 @@ static u32 __ipv6_select_ident(struct net *net, const struct in6_addr *dst, const struct in6_addr *src) { - const struct { - struct in6_addr dst; - struct in6_addr src; - } __aligned(SIPHASH_ALIGNMENT) combined = { - .dst = *dst, - .src = *src, - }; - u32 hash, id; - - /* Note the following code is not safe, but this is okay. */ - if (unlikely(siphash_key_is_zero(&net->ipv4.ip_id_key))) - get_random_bytes(&net->ipv4.ip_id_key, - sizeof(net->ipv4.ip_id_key)); - - hash = siphash(&combined, sizeof(combined), &net->ipv4.ip_id_key); - - /* Treat id of 0 as unset and if we get 0 back from ip_idents_reserve, - * set the hight order instead thus minimizing possible future - * collisions. - */ - id = ip_idents_reserve(hash, 1); - if (unlikely(!id)) - id = 1 << 31; + u32 id; + + do { + id = prandom_u32(); + } while (!id);

return id; }

From: Paul Cercueil paul@crapouillou.net

[ Upstream commit eb3849370ae32b571e1f9a63ba52c61adeaf88f7 ]

The clock driving the XBurst CPUs in Ingenic SoCs is integer divided from the main PLL. As such, it is possible to control the frequency of the CPU, either by changing the divider, or by changing the rate of the main PLL.

The XBurst CPUs also lack the CP0 timer; the TCU, a separate piece of hardware in the SoC, provides this functionality.

Signed-off-by: Paul Cercueil paul@crapouillou.net Signed-off-by: Thomas Bogendoerfer tsbogend@alpha.franken.de Signed-off-by: Sasha Levin sashal@kernel.org --- arch/mips/Kconfig | 2 ++ 1 file changed, 2 insertions(+)

diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig index e89d63cd92d1..ab73622b14dd 100644 --- a/arch/mips/Kconfig +++ b/arch/mips/Kconfig @@ -425,6 +425,8 @@ config MACH_INGENIC_SOC select MIPS_GENERIC select MACH_INGENIC select SYS_SUPPORTS_ZBOOT_UART16550 + select CPU_SUPPORTS_CPUFREQ + select MIPS_EXTERNAL_TIMER

config LANTIQ bool "Lantiq based platforms"

From: Kees Cook keescook@chromium.org

[ Upstream commit 06888d571b513cbfc0b41949948def6cb81021b2 ]

Instead of reading the desired 5 bytes of the actual target field, the code was reading 8. This could result in a corrupted value if the trailing 3 bytes were non-zero, so instead use an appropriately sized and zero-initialized bounce buffer, and read only 5 bytes before casting to u64.

Signed-off-by: Kees Cook keescook@chromium.org Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c index 73ca49f05bd3..eb56526ec32c 100644 --- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c +++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c @@ -29,8 +29,10 @@ static inline enum mod_hdcp_status validate_bksv(struct mod_hdcp *hdcp) { uint64_t n = 0; uint8_t count = 0; + u8 bksv[sizeof(n)] = { };

- memcpy(&n, hdcp->auth.msg.hdcp1.bksv, sizeof(uint64_t)); + memcpy(bksv, hdcp->auth.msg.hdcp1.bksv, sizeof(hdcp->auth.msg.hdcp1.bksv)); + n = *(uint64_t *)bksv;

while (n) { count++;

From: Yang Yingliang yangyingliang@huawei.com

[ Upstream commit f13570e7e830ca4fbf4869015af8492b8918445e ]

After calling clk_prepare_enable(), clk_disable_unprepare() needs be called when prepare_timing_change() failed.

Reported-by: Hulk Robot hulkci@huawei.com Signed-off-by: Yang Yingliang yangyingliang@huawei.com Signed-off-by: Thierry Reding treding@nvidia.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/clk/tegra/clk-tegra124-emc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/tegra/clk-tegra124-emc.c b/drivers/clk/tegra/clk-tegra124-emc.c index bdf6f4a51617..74c1d894cca8 100644 --- a/drivers/clk/tegra/clk-tegra124-emc.c +++ b/drivers/clk/tegra/clk-tegra124-emc.c @@ -249,8 +249,10 @@ static int emc_set_timing(struct tegra_clk_emc *tegra, div = timing->parent_rate / (timing->rate / 2) - 2;

err = tegra->prepare_timing_change(emc, timing->rate); - if (err) + if (err) { + clk_disable_unprepare(timing->parent); return err; + }

spin_lock_irqsave(tegra->lock, flags);

From: Jiapeng Chong jiapeng.chong@linux.alibaba.com

[ Upstream commit aeb27bb76ad8197eb47890b1ff470d5faf8ec9a5 ]

The error code is missing in this code scenario so 0 will be returned. Add the error code '-EINVAL' to the return value 'ret'.

Eliminates the follow smatch warning:

drivers/infiniband/hw/cxgb4/qp.c:298 create_qp() warn: missing error code 'ret'.

Link: https://lore.kernel.org/r/1622545669-20625-1-git-send-email-jiapeng.chong@li... Reported-by: Abaci Robot abaci@linux.alibaba.com Signed-off-by: Jiapeng Chong jiapeng.chong@linux.alibaba.com Signed-off-by: Jason Gunthorpe jgg@nvidia.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/hw/cxgb4/qp.c | 1 + 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c index d109bb3822a5..c9403743346e 100644 --- a/drivers/infiniband/hw/cxgb4/qp.c +++ b/drivers/infiniband/hw/cxgb4/qp.c @@ -295,6 +295,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq, if (user && (!wq->sq.bar2_pa || (need_rq && !wq->rq.bar2_pa))) { pr_warn("%s: sqid %u or rqid %u not in BAR2 range\n", pci_name(rdev->lldi.pdev), wq->sq.qid, wq->rq.qid); + ret = -EINVAL; goto free_dma; }

From: Mikulas Patocka mpatocka@redhat.com

[ Upstream commit ee50cc19d80e9b9a8283d1fb517a778faf2f6899 ]

If dm-writecache overwrites existing cached data, it splits the incoming bio into many block-sized bios. The I/O scheduler does merge these bios into one large request but this needless splitting and merging causes performance degradation.

Fix this by avoiding bio splitting if the cache target area that is being overwritten is contiguous.

Signed-off-by: Mikulas Patocka mpatocka@redhat.com Signed-off-by: Mike Snitzer snitzer@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/md/dm-writecache.c | 38 ++++++++++++++++++++++++++++++-------- 1 file changed, 30 insertions(+), 8 deletions(-)

diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c index 4f72b6f66c3a..7bb4d83e90cc 100644 --- a/drivers/md/dm-writecache.c +++ b/drivers/md/dm-writecache.c @@ -1360,14 +1360,18 @@ read_next_block: } else { do { bool found_entry = false; + bool search_used = false; if (writecache_has_error(wc)) goto unlock_error; e = writecache_find_entry(wc, bio->bi_iter.bi_sector, 0); if (e) { - if (!writecache_entry_is_committed(wc, e)) + if (!writecache_entry_is_committed(wc, e)) { + search_used = true; goto bio_copy; + } if (!WC_MODE_PMEM(wc) && !e->write_in_progress) { wc->overwrote_committed = true; + search_used = true; goto bio_copy; } found_entry = true; @@ -1404,13 +1408,31 @@ bio_copy: sector_t current_cache_sec = start_cache_sec + (bio_size >> SECTOR_SHIFT);

while (bio_size < bio->bi_iter.bi_size) { - struct wc_entry *f = writecache_pop_from_freelist(wc, current_cache_sec); - if (!f) - break; - write_original_sector_seq_count(wc, f, bio->bi_iter.bi_sector + - (bio_size >> SECTOR_SHIFT), wc->seq_count); - writecache_insert_entry(wc, f); - wc->uncommitted_blocks++; + if (!search_used) { + struct wc_entry *f = writecache_pop_from_freelist(wc, current_cache_sec); + if (!f) + break; + write_original_sector_seq_count(wc, f, bio->bi_iter.bi_sector + + (bio_size >> SECTOR_SHIFT), wc->seq_count); + writecache_insert_entry(wc, f); + wc->uncommitted_blocks++; + } else { + struct wc_entry *f; + struct rb_node *next = rb_next(&e->rb_node); + if (!next) + break; + f = container_of(next, struct wc_entry, rb_node); + if (f != e + 1) + break; + if (read_original_sector(wc, f) != + read_original_sector(wc, e) + (wc->block_size >> SECTOR_SHIFT)) + break; + if (unlikely(f->write_in_progress)) + break; + if (writecache_entry_is_committed(wc, f)) + wc->overwrote_committed = true; + e = f; + } bio_size += wc->block_size; current_cache_sec += wc->block_size >> SECTOR_SHIFT; }

From: Damien Le Moal damien.lemoal@wdc.com

[ Upstream commit 9ffbbb435d8f566a0924ce4b5dc7fc1bceb6dbf8 ]

Introduce the BIO flag BIO_ZONE_WRITE_LOCKED to indicate that a BIO owns the write lock of the zone it is targeting. This is the counterpart of the struct request flag RQF_ZONE_WRITE_LOCKED.

This new BIO flag is reserved for now for zone write locking control for device mapper targets exposing a zoned block device. Since in this case, the lock flag must not be propagated to the struct request that will be used to process the BIO, a BIO private flag is used rather than changing the RQF_ZONE_WRITE_LOCKED request flag into a common REQ_XXX flag that could be used for both BIO and request. This avoids conflicts down the stack with the block IO scheduler zone write locking (in mq-deadline).

Signed-off-by: Damien Le Moal damien.lemoal@wdc.com Reviewed-by: Christoph Hellwig hch@lst.de Reviewed-by: Hannes Reinecke hare@suse.de Reviewed-by: Chaitanya Kulkarni chaitanya.kulkarni@wdc.com Reviewed-by: Himanshu Madhani himanshu.madhani@oracle.com Acked-by: Jens Axboe axboe@kernel.dk Signed-off-by: Mike Snitzer snitzer@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- include/linux/blk_types.h | 1 + 1 file changed, 1 insertion(+)

diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h index db026b6ec15a..e5cf12f102a2 100644 --- a/include/linux/blk_types.h +++ b/include/linux/blk_types.h @@ -304,6 +304,7 @@ enum { BIO_CGROUP_ACCT, /* has been accounted to a cgroup */ BIO_TRACKED, /* set if bio goes through the rq_qos path */ BIO_REMAPPED, + BIO_ZONE_WRITE_LOCKED, /* Owns a zoned device zone write lock */ BIO_FLAG_LAST };

From: Radim Pavlik radim.pavlik@tbs-biometrics.com

[ Upstream commit 897120d41e7afd9da435cb00041a142aeeb53c07 ]

Checking value of MCP_INTF in mcp23s08_irq suggests that the handler may be called even when there is no interrupt pending.

But the actual interrupt could happened between reading MCP_INTF and MCP_GPIO. In this situation we got nothing from MCP_INTF, but the event gets acknowledged on the expander by reading MCP_GPIO. This leads to losing events.

Fix the problem by not reading any register until we see something in MCP_INTF.

The error was reproduced and fix tested on MCP23017.

Signed-off-by: Radim Pavlik radim.pavlik@tbs-biometrics.com Link: https://lore.kernel.org/r/AM7PR06MB6769E1183F68DEBB252F665ABA3E9@AM7PR06MB67... Signed-off-by: Linus Walleij linus.walleij@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/pinctrl/pinctrl-mcp23s08.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c index ce2d8014b7e0..799d596a1a4b 100644 --- a/drivers/pinctrl/pinctrl-mcp23s08.c +++ b/drivers/pinctrl/pinctrl-mcp23s08.c @@ -351,6 +351,11 @@ static irqreturn_t mcp23s08_irq(int irq, void *data) if (mcp_read(mcp, MCP_INTF, &intf)) goto unlock;

+ if (intf == 0) { + /* There is no interrupt pending */ + return IRQ_HANDLED; + } + if (mcp_read(mcp, MCP_INTCAP, &intcap)) goto unlock;

@@ -368,11 +373,6 @@ static irqreturn_t mcp23s08_irq(int irq, void *data) mcp->cached_gpio = gpio; mutex_unlock(&mcp->lock);

- if (intf == 0) { - /* There is no interrupt pending */ - return IRQ_HANDLED; - } - dev_dbg(mcp->chip.parent, "intcap 0x%04X intf 0x%04X gpio_orig 0x%04X gpio 0x%04X\n", intcap, intf, gpio_orig, gpio);

From: Paul M Stillwell Jr paul.m.stillwell.jr@intel.com

[ Upstream commit 7e94090ae13e1ae5fe8bd3a9cd08136260bb7039 ]

clang generates deadcode.DeadStores warnings when a variable is used to read a value, but then that value isn't used later in the code. Fix this warning.

Signed-off-by: Paul M Stillwell Jr paul.m.stillwell.jr@intel.com Tested-by: Tony Brelinski tonyx.brelinski@intel.com Signed-off-by: Tony Nguyen anthony.l.nguyen@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/intel/ice/ice_ethtool.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c index f80fff97d8dc..0d136708f960 100644 --- a/drivers/net/ethernet/intel/ice/ice_ethtool.c +++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c @@ -3492,13 +3492,9 @@ static int ice_get_rc_coalesce(struct ethtool_coalesce *ec, enum ice_container_type c_type, struct ice_ring_container *rc) { - struct ice_pf *pf; - if (!rc->ring) return -EINVAL;

- pf = rc->ring->vsi->back; - switch (c_type) { case ICE_RX_CONTAINER: ec->use_adaptive_rx_coalesce = ITR_IS_DYNAMIC(rc->itr_setting); @@ -3510,7 +3506,7 @@ ice_get_rc_coalesce(struct ethtool_coalesce *ec, enum ice_container_type c_type, ec->tx_coalesce_usecs = rc->itr_setting & ~ICE_ITR_DYNAMIC; break; default: - dev_dbg(ice_pf_to_dev(pf), "Invalid c_type %d\n", c_type); + dev_dbg(ice_pf_to_dev(rc->ring->vsi->back), "Invalid c_type %d\n", c_type); return -EINVAL; }

From: Yang Yingliang yangyingliang@huawei.com

[ Upstream commit f1fe19c2cb3fdc92a614cf330ced1613f8f1a681 ]

It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value.

Signed-off-by: Yang Yingliang yangyingliang@huawei.com Reviewed-by: Vladimir Oltean vladimir.oltean@nxp.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/dsa/ocelot/seville_vsc9953.c | 5 +++++ 1 file changed, 5 insertions(+)

diff --git a/drivers/net/dsa/ocelot/seville_vsc9953.c b/drivers/net/dsa/ocelot/seville_vsc9953.c index 84f93a874d50..deae923c8b7a 100644 --- a/drivers/net/dsa/ocelot/seville_vsc9953.c +++ b/drivers/net/dsa/ocelot/seville_vsc9953.c @@ -1206,6 +1206,11 @@ static int seville_probe(struct platform_device *pdev) felix->info = &seville_info_vsc9953;

res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (!res) { + err = -EINVAL; + dev_err(&pdev->dev, "Invalid resource\n"); + goto err_alloc_felix; + } felix->switch_base = res->start;

ds = kzalloc(sizeof(struct dsa_switch), GFP_KERNEL);

From: Yang Yingliang yangyingliang@huawei.com

[ Upstream commit 0bb51a3a385790a4be20085494cf78f70dadf646 ]

It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value.

Signed-off-by: Yang Yingliang yangyingliang@huawei.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 4 ++++ 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c index bf06f2d785db..fbee581d02b4 100644 --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c @@ -7388,6 +7388,10 @@ static int mvpp2_probe(struct platform_device *pdev) return PTR_ERR(priv->lms_base); } else { res = platform_get_resource(pdev, IORESOURCE_MEM, 1); + if (!res) { + dev_err(&pdev->dev, "Invalid resource\n"); + return -EINVAL; + } if (has_acpi_companion(&pdev->dev)) { /* In case the MDIO memory region is declared in * the ACPI, it can already appear as 'in-use'

From: Yang Yingliang yangyingliang@huawei.com

[ Upstream commit 35cba15a504bf4f585bb9d78f47b22b28a1a06b2 ]

Use devm_platform_get_and_ioremap_resource() to simplify code and avoid a null-ptr-deref by checking 'res' in it.

Signed-off-by: Yang Yingliang yangyingliang@huawei.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/moxa/moxart_ether.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c index 49fd843c4c8a..a4380c45f668 100644 --- a/drivers/net/ethernet/moxa/moxart_ether.c +++ b/drivers/net/ethernet/moxa/moxart_ether.c @@ -481,14 +481,13 @@ static int moxart_mac_probe(struct platform_device *pdev) priv->ndev = ndev; priv->pdev = pdev;

- res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - ndev->base_addr = res->start; - priv->base = devm_ioremap_resource(p_dev, res); + priv->base = devm_platform_get_and_ioremap_resource(pdev, 0, &res); if (IS_ERR(priv->base)) { dev_err(p_dev, "devm_ioremap_resource failed\n"); ret = PTR_ERR(priv->base); goto init_fail; } + ndev->base_addr = res->start;

spin_lock_init(&priv->txlock);

From: Roman Li roman.li@amd.com

[ Upstream commit c521fc316d12fb9ea7b7680e301d673bceda922e ]

[Why] We update scaling settings when scaling mode has been changed. However when changing mode from native resolution the scaling mode previously set gets ignored.

[How] Perform scaling settings update on modeset.

Signed-off-by: Roman Li roman.li@amd.com Reviewed-by: Nicholas Kazlauskas Nicholas.Kazlauskas@amd.com Acked-by: Stylon Wang stylon.wang@amd.com Tested-by: Daniel Wheeler daniel.wheeler@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 0858e0c7b7a1..74e74971df74 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -8939,7 +8939,8 @@ skip_modeset: BUG_ON(dm_new_crtc_state->stream == NULL);

/* Scaling or underscan settings */ - if (is_scaling_state_different(dm_old_conn_state, dm_new_conn_state)) + if (is_scaling_state_different(dm_old_conn_state, dm_new_conn_state) || + drm_atomic_crtc_needs_modeset(new_crtc_state)) update_stream_scaling_settings( &new_crtc_state->mode, dm_new_conn_state, dm_new_crtc_state->stream);

From: Wesley Chalmers Wesley.Chalmers@amd.com

[ Upstream commit 3577e1678772ce3ede92af3a75b44a4b76f9b4ad ]

[WHY] DISPCLK_MAX_ERRDET_CYCLES must be 7 to prevent connection loss when changing DENTIST_DISPCLK_WDIVIDER from 126 to 127 and back.

Signed-off-by: Wesley Chalmers Wesley.Chalmers@amd.com Reviewed-by: Dmytro Laktyushkin Dmytro.Laktyushkin@amd.com Acked-by: Stylon Wang stylon.wang@amd.com Tested-by: Daniel Wheeler daniel.wheeler@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c index aece1103331d..d8a03d825623 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c @@ -243,7 +243,7 @@ void dcn20_dccg_init(struct dce_hwseq *hws) REG_WRITE(MILLISECOND_TIME_BASE_DIV, 0x1186a0);

/* This value is dependent on the hardware pipeline delay so set once per SOC */ - REG_WRITE(DISPCLK_FREQ_CHANGE_CNTL, 0x801003c); + REG_WRITE(DISPCLK_FREQ_CHANGE_CNTL, 0xe01003c); }

void dcn20_disable_vga(

From: Aric Cyr aric.cyr@amd.com

[ Upstream commit 665f28507a2a3d8d72ed9afa9a2b9b17fd43add1 ]

[Why] When calculating recout width for an MPO plane on a mode that's using ODM combine, driver can calculate a negative value, resulting in a crash.

[How] For negative widths, use zero such that validation will prune the configuration correctly and disallow MPO.

Signed-off-by: Aric Cyr aric.cyr@amd.com Reviewed-by: Krunoslav Kovac Krunoslav.Kovac@amd.com Acked-by: Stylon Wang stylon.wang@amd.com Tested-by: Daniel Wheeler daniel.wheeler@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 5 +++++ 1 file changed, 5 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c index 325e0d656d6a..749189eb20ba 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c @@ -733,6 +733,11 @@ static void calculate_recout(struct pipe_ctx *pipe_ctx) if (split_idx == split_count) { /* rightmost pipe is the remainder recout */ data->recout.width -= data->h_active * split_count - data->recout.x; + + /* ODM combine cases with MPO we can get negative widths */ + if (data->recout.width < 0) + data->recout.width = 0; + data->recout.x = 0; } else data->recout.width = data->h_active - data->recout.x;

From: Amit Cohen amcohen@nvidia.com

[ Upstream commit e67dfb8d15deb33c425d0b0ee22f2e5eef54c162 ]

Several tests do not set some ports down as part of their cleanup(), resulting in IPv6 link-local addresses and associated routes not being deleted.

These leaks were found using a BPF tool that monitors ASIC resources.

Solve this by setting the ports down at the end of the tests.

Signed-off-by: Amit Cohen amcohen@nvidia.com Reviewed-by: Petr Machata petrm@nvidia.com Signed-off-by: Ido Schimmel idosch@nvidia.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- .../selftests/drivers/net/mlxsw/devlink_trap_l3_drops.sh | 3 +++ .../selftests/drivers/net/mlxsw/devlink_trap_l3_exceptions.sh | 3 +++ tools/testing/selftests/drivers/net/mlxsw/qos_dscp_bridge.sh | 2 ++ tools/testing/selftests/net/forwarding/pedit_dsfield.sh | 2 ++ tools/testing/selftests/net/forwarding/pedit_l4port.sh | 2 ++ tools/testing/selftests/net/forwarding/skbedit_priority.sh | 2 ++ 6 files changed, 14 insertions(+)

diff --git a/tools/testing/selftests/drivers/net/mlxsw/devlink_trap_l3_drops.sh b/tools/testing/selftests/drivers/net/mlxsw/devlink_trap_l3_drops.sh index 4029833f7e27..160891dcb4bc 100755 --- a/tools/testing/selftests/drivers/net/mlxsw/devlink_trap_l3_drops.sh +++ b/tools/testing/selftests/drivers/net/mlxsw/devlink_trap_l3_drops.sh @@ -109,6 +109,9 @@ router_destroy() __addr_add_del $rp1 del 192.0.2.2/24 2001:db8:1::2/64

tc qdisc del dev $rp2 clsact + + ip link set dev $rp2 down + ip link set dev $rp1 down }

setup_prepare() diff --git a/tools/testing/selftests/drivers/net/mlxsw/devlink_trap_l3_exceptions.sh b/tools/testing/selftests/drivers/net/mlxsw/devlink_trap_l3_exceptions.sh index 1fedfc9da434..1d157b1bd838 100755 --- a/tools/testing/selftests/drivers/net/mlxsw/devlink_trap_l3_exceptions.sh +++ b/tools/testing/selftests/drivers/net/mlxsw/devlink_trap_l3_exceptions.sh @@ -111,6 +111,9 @@ router_destroy() __addr_add_del $rp1 del 192.0.2.2/24 2001:db8:1::2/64

tc qdisc del dev $rp2 clsact + + ip link set dev $rp2 down + ip link set dev $rp1 down }

setup_prepare() diff --git a/tools/testing/selftests/drivers/net/mlxsw/qos_dscp_bridge.sh b/tools/testing/selftests/drivers/net/mlxsw/qos_dscp_bridge.sh index 5cbff8038f84..28a570006d4d 100755 --- a/tools/testing/selftests/drivers/net/mlxsw/qos_dscp_bridge.sh +++ b/tools/testing/selftests/drivers/net/mlxsw/qos_dscp_bridge.sh @@ -93,7 +93,9 @@ switch_destroy() lldptool -T -i $swp1 -V APP -d $(dscp_map 10) >/dev/null lldpad_app_wait_del

+ ip link set dev $swp2 down ip link set dev $swp2 nomaster + ip link set dev $swp1 down ip link set dev $swp1 nomaster ip link del dev br1 } diff --git a/tools/testing/selftests/net/forwarding/pedit_dsfield.sh b/tools/testing/selftests/net/forwarding/pedit_dsfield.sh index 55eeacf59241..64fbd211d907 100755 --- a/tools/testing/selftests/net/forwarding/pedit_dsfield.sh +++ b/tools/testing/selftests/net/forwarding/pedit_dsfield.sh @@ -75,7 +75,9 @@ switch_destroy() tc qdisc del dev $swp2 clsact tc qdisc del dev $swp1 clsact

+ ip link set dev $swp2 down ip link set dev $swp2 nomaster + ip link set dev $swp1 down ip link set dev $swp1 nomaster ip link del dev br1 } diff --git a/tools/testing/selftests/net/forwarding/pedit_l4port.sh b/tools/testing/selftests/net/forwarding/pedit_l4port.sh index 5f20d289ee43..10e594c55117 100755 --- a/tools/testing/selftests/net/forwarding/pedit_l4port.sh +++ b/tools/testing/selftests/net/forwarding/pedit_l4port.sh @@ -71,7 +71,9 @@ switch_destroy() tc qdisc del dev $swp2 clsact tc qdisc del dev $swp1 clsact

+ ip link set dev $swp2 down ip link set dev $swp2 nomaster + ip link set dev $swp1 down ip link set dev $swp1 nomaster ip link del dev br1 } diff --git a/tools/testing/selftests/net/forwarding/skbedit_priority.sh b/tools/testing/selftests/net/forwarding/skbedit_priority.sh index e3bd8a6bb8b4..bde11dc27873 100755 --- a/tools/testing/selftests/net/forwarding/skbedit_priority.sh +++ b/tools/testing/selftests/net/forwarding/skbedit_priority.sh @@ -72,7 +72,9 @@ switch_destroy() tc qdisc del dev $swp2 clsact tc qdisc del dev $swp1 clsact

+ ip link set dev $swp2 down ip link set dev $swp2 nomaster + ip link set dev $swp1 down ip link set dev $swp1 nomaster ip link del dev br1 }

From: Nirmoy Das nirmoy.das@amd.com

[ Upstream commit bc05716d4fdd065013633602c5960a2bf1511b9c ]

Fixes handling when page tables are in system memory.

v3: remove struct amdgpu_vm_parser. v2: remove unwanted variable. change amdgpu_amdkfd_validate instead of amdgpu_amdkfd_bo_validate.

Signed-off-by: Nirmoy Das nirmoy.das@amd.com Reviewed-by: Christian König christian.koenig@amd.com Reviewed-by: Felix Kuehling Felix.Kuehling@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 21 ++++--------------- 1 file changed, 4 insertions(+), 17 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c index ac0a432a9bf7..3c3f05d1f4da 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c @@ -49,12 +49,6 @@ static struct { spinlock_t mem_limit_lock; } kfd_mem_limit;

-/* Struct used for amdgpu_amdkfd_bo_validate */ -struct amdgpu_vm_parser { - uint32_t domain; - bool wait; -}; - static const char * const domain_bit_to_string[] = { "CPU", "GTT", @@ -337,11 +331,9 @@ validate_fail: return ret; }

-static int amdgpu_amdkfd_validate(void *param, struct amdgpu_bo *bo) +static int amdgpu_amdkfd_validate_vm_bo(void *_unused, struct amdgpu_bo *bo) { - struct amdgpu_vm_parser *p = param; - - return amdgpu_amdkfd_bo_validate(bo, p->domain, p->wait); + return amdgpu_amdkfd_bo_validate(bo, bo->allowed_domains, false); }

/* vm_validate_pt_pd_bos - Validate page table and directory BOs @@ -355,20 +347,15 @@ static int vm_validate_pt_pd_bos(struct amdgpu_vm *vm) { struct amdgpu_bo *pd = vm->root.base.bo; struct amdgpu_device *adev = amdgpu_ttm_adev(pd->tbo.bdev); - struct amdgpu_vm_parser param; int ret;

- param.domain = AMDGPU_GEM_DOMAIN_VRAM; - param.wait = false; - - ret = amdgpu_vm_validate_pt_bos(adev, vm, amdgpu_amdkfd_validate, - &param); + ret = amdgpu_vm_validate_pt_bos(adev, vm, amdgpu_amdkfd_validate_vm_bo, NULL); if (ret) { pr_err("failed to validate PT BOs\n"); return ret; }

- ret = amdgpu_amdkfd_validate(&param, pd); + ret = amdgpu_amdkfd_validate_vm_bo(NULL, pd); if (ret) { pr_err("failed to validate PD\n"); return ret;

From: Minchan Kim minchan@kernel.org

[ Upstream commit 648f2c6100cfa18e7dfe43bc0b9c3b73560d623c ]

In the field, we have seen lots of allocation failure from the call path below.

06-03 13:29:12.999 1010315 31557 31557 W Binder : 31542_2: page allocation failure: order:0, mode:0x800(GFP_NOWAIT), nodemask=(null),cpuset=background,mems_allowed=0 ... ... 06-03 13:29:12.999 1010315 31557 31557 W Call trace: 06-03 13:29:12.999 1010315 31557 31557 W : dump_backtrace.cfi_jt+0x0/0x8 06-03 13:29:12.999 1010315 31557 31557 W : dump_stack+0xc8/0x14c 06-03 13:29:12.999 1010315 31557 31557 W : warn_alloc+0x158/0x1c8 06-03 13:29:12.999 1010315 31557 31557 W : __alloc_pages_slowpath+0x9d8/0xb80 06-03 13:29:12.999 1010315 31557 31557 W : __alloc_pages_nodemask+0x1c4/0x430 06-03 13:29:12.999 1010315 31557 31557 W : allocate_slab+0xb4/0x390 06-03 13:29:12.999 1010315 31557 31557 W : ___slab_alloc+0x12c/0x3a4 06-03 13:29:12.999 1010315 31557 31557 W : kmem_cache_alloc+0x358/0x5e4 06-03 13:29:12.999 1010315 31557 31557 W : avc_alloc_node+0x30/0x184 06-03 13:29:12.999 1010315 31557 31557 W : avc_update_node+0x54/0x4f0 06-03 13:29:12.999 1010315 31557 31557 W : avc_has_extended_perms+0x1a4/0x460 06-03 13:29:12.999 1010315 31557 31557 W : selinux_file_ioctl+0x320/0x3d0 06-03 13:29:12.999 1010315 31557 31557 W : __arm64_sys_ioctl+0xec/0x1fc 06-03 13:29:12.999 1010315 31557 31557 W : el0_svc_common+0xc0/0x24c 06-03 13:29:12.999 1010315 31557 31557 W : el0_svc+0x28/0x88 06-03 13:29:12.999 1010315 31557 31557 W : el0_sync_handler+0x8c/0xf0 06-03 13:29:12.999 1010315 31557 31557 W : el0_sync+0x1a4/0x1c0 .. .. 06-03 13:29:12.999 1010315 31557 31557 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010315 31557 31557 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010315 31557 31557 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 10230 30892 30892 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 10230 30892 30892 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 10230 30892 30892 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 10230 30892 30892 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 10230 30892 30892 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0

Based on [1], selinux is tolerate for failure of memory allocation. Then, use __GFP_NOWARN together.

[1] 476accbe2f6e ("selinux: use GFP_NOWAIT in the AVC kmem_caches")

Signed-off-by: Minchan Kim minchan@kernel.org [PM: subj fix, line wraps, normalized commit refs] Signed-off-by: Paul Moore paul@paul-moore.com Signed-off-by: Sasha Levin sashal@kernel.org --- security/selinux/avc.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/security/selinux/avc.c b/security/selinux/avc.c index ad451cf9375e..a2dc83228daf 100644 --- a/security/selinux/avc.c +++ b/security/selinux/avc.c @@ -297,26 +297,27 @@ static struct avc_xperms_decision_node struct avc_xperms_decision_node *xpd_node; struct extended_perms_decision *xpd;

- xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, GFP_NOWAIT); + xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, + GFP_NOWAIT | __GFP_NOWARN); if (!xpd_node) return NULL;

xpd = &xpd_node->xpd; if (which & XPERMS_ALLOWED) { xpd->allowed = kmem_cache_zalloc(avc_xperms_data_cachep, - GFP_NOWAIT); + GFP_NOWAIT | __GFP_NOWARN); if (!xpd->allowed) goto error; } if (which & XPERMS_AUDITALLOW) { xpd->auditallow = kmem_cache_zalloc(avc_xperms_data_cachep, - GFP_NOWAIT); + GFP_NOWAIT | __GFP_NOWARN); if (!xpd->auditallow) goto error; } if (which & XPERMS_DONTAUDIT) { xpd->dontaudit = kmem_cache_zalloc(avc_xperms_data_cachep, - GFP_NOWAIT); + GFP_NOWAIT | __GFP_NOWARN); if (!xpd->dontaudit) goto error; } @@ -344,7 +345,7 @@ static struct avc_xperms_node *avc_xperms_alloc(void) { struct avc_xperms_node *xp_node;

- xp_node = kmem_cache_zalloc(avc_xperms_cachep, GFP_NOWAIT); + xp_node = kmem_cache_zalloc(avc_xperms_cachep, GFP_NOWAIT | __GFP_NOWARN); if (!xp_node) return xp_node; INIT_LIST_HEAD(&xp_node->xpd_head); @@ -500,7 +501,7 @@ static struct avc_node *avc_alloc_node(struct selinux_avc *avc) { struct avc_node *node;

- node = kmem_cache_zalloc(avc_node_cachep, GFP_NOWAIT); + node = kmem_cache_zalloc(avc_node_cachep, GFP_NOWAIT | __GFP_NOWARN); if (!node) goto out;

From: Mark Yacoub markyacoub@chromium.org

[ Upstream commit 03fc4cf45d30533d54f0f4ebc02aacfa12f52ce2 ]

For each CRTC state, check the size of Gamma and Degamma LUTs so unexpected and larger sizes wouldn't slip through.

TEST: IGT:kms_color::pipe-invalid-gamma-lut-sizes

v2: fix assignments in if clauses, Mark's email.

Reviewed-by: Harry Wentland harry.wentland@amd.com Signed-off-by: Mark Yacoub markyacoub@chromium.org Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 1 + .../amd/display/amdgpu_dm/amdgpu_dm_color.c | 41 ++++++++++++++++--- 3 files changed, 40 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 74e74971df74..817d701a9857 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -9499,6 +9499,10 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev, dm_old_crtc_state->dsc_force_changed == false) continue;

+ ret = amdgpu_dm_verify_lut_sizes(new_crtc_state); + if (ret) + goto fail; + if (!new_crtc_state->enable) continue;

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h index 52cc81705280..250adc92dfd0 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h @@ -529,6 +529,7 @@ void amdgpu_dm_trigger_timing_sync(struct drm_device *dev); #define MAX_COLOR_LEGACY_LUT_ENTRIES 256

void amdgpu_dm_init_color_mod(void); +int amdgpu_dm_verify_lut_sizes(const struct drm_crtc_state *crtc_state); int amdgpu_dm_update_crtc_color_mgmt(struct dm_crtc_state *crtc); int amdgpu_dm_update_plane_color_mgmt(struct dm_crtc_state *crtc, struct dc_plane_state *dc_plane_state); diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c index 157fe4efbb59..a022e5bb30a5 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c @@ -284,6 +284,37 @@ static int __set_input_tf(struct dc_transfer_func *func, return res ? 0 : -ENOMEM; }

+/** + * Verifies that the Degamma and Gamma LUTs attached to the |crtc_state| are of + * the expected size. + * Returns 0 on success. + */ +int amdgpu_dm_verify_lut_sizes(const struct drm_crtc_state *crtc_state) +{ + const struct drm_color_lut *lut = NULL; + uint32_t size = 0; + + lut = __extract_blob_lut(crtc_state->degamma_lut, &size); + if (lut && size != MAX_COLOR_LUT_ENTRIES) { + DRM_DEBUG_DRIVER( + "Invalid Degamma LUT size. Should be %u but got %u.\n", + MAX_COLOR_LUT_ENTRIES, size); + return -EINVAL; + } + + lut = __extract_blob_lut(crtc_state->gamma_lut, &size); + if (lut && size != MAX_COLOR_LUT_ENTRIES && + size != MAX_COLOR_LEGACY_LUT_ENTRIES) { + DRM_DEBUG_DRIVER( + "Invalid Gamma LUT size. Should be %u (or %u for legacy) but got %u.\n", + MAX_COLOR_LUT_ENTRIES, MAX_COLOR_LEGACY_LUT_ENTRIES, + size); + return -EINVAL; + } + + return 0; +} + /** * amdgpu_dm_update_crtc_color_mgmt: Maps DRM color management to DC stream. * @crtc: amdgpu_dm crtc state @@ -317,14 +348,12 @@ int amdgpu_dm_update_crtc_color_mgmt(struct dm_crtc_state *crtc) bool is_legacy; int r;

- degamma_lut = __extract_blob_lut(crtc->base.degamma_lut, &degamma_size); - if (degamma_lut && degamma_size != MAX_COLOR_LUT_ENTRIES) - return -EINVAL; + r = amdgpu_dm_verify_lut_sizes(&crtc->base); + if (r) + return r;

+ degamma_lut = __extract_blob_lut(crtc->base.degamma_lut, &degamma_size); regamma_lut = __extract_blob_lut(crtc->base.gamma_lut, &regamma_size); - if (regamma_lut && regamma_size != MAX_COLOR_LUT_ENTRIES && - regamma_size != MAX_COLOR_LEGACY_LUT_ENTRIES) - return -EINVAL;

has_degamma = degamma_lut && !__is_lut_linear(degamma_lut, degamma_size);

From: Steffen Klassert steffen.klassert@secunet.com

[ Upstream commit 6fd06963fa74197103cdbb4b494763127b3f2f34 ]

When memory allocation for XFRMA_ENCAP or XFRMA_COADDR fails, the error will not be reported because the -ENOMEM assignment to the err variable is overwritten before. Fix this by moving these two in front of the function so that memory allocation failures will be reported.

Reported-by: Tobias Brunner tobias@strongswan.org Signed-off-by: Steffen Klassert steffen.klassert@secunet.com Signed-off-by: Sasha Levin sashal@kernel.org --- net/xfrm/xfrm_user.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 5a0ef4361e43..817e714dedea 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -580,6 +580,20 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,

copy_from_user_state(x, p);

+ if (attrs[XFRMA_ENCAP]) { + x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]), + sizeof(*x->encap), GFP_KERNEL); + if (x->encap == NULL) + goto error; + } + + if (attrs[XFRMA_COADDR]) { + x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]), + sizeof(*x->coaddr), GFP_KERNEL); + if (x->coaddr == NULL) + goto error; + } + if (attrs[XFRMA_SA_EXTRA_FLAGS]) x->props.extra_flags = nla_get_u32(attrs[XFRMA_SA_EXTRA_FLAGS]);

@@ -600,23 +614,9 @@ static struct xfrm_state *xfrm_state_construct(struct net *net, attrs[XFRMA_ALG_COMP]))) goto error;

- if (attrs[XFRMA_ENCAP]) { - x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]), - sizeof(*x->encap), GFP_KERNEL); - if (x->encap == NULL) - goto error; - } - if (attrs[XFRMA_TFCPAD]) x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]);

- if (attrs[XFRMA_COADDR]) { - x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]), - sizeof(*x->coaddr), GFP_KERNEL); - if (x->coaddr == NULL) - goto error; - } - xfrm_mark_get(attrs, &x->mark);

xfrm_smark_init(attrs, &x->props.smark);

From: Tony Lindgren tony@atomide.com

[ Upstream commit 11ef6bc846dcdce838f0b00c5f6a562c57e5d43b ]

At least on wl12xx, reading the MAC after boot can fail with a warning at drivers/net/wireless/ti/wlcore/sdio.c:78 wl12xx_sdio_raw_read. The failed call comes from wl12xx_get_mac() that wlcore_nvs_cb() calls after request_firmware_work_func().

After the error, no wireless interface is created. Reloading the wl12xx module makes the interface work.

Turns out the wlan controller can be in a low-power ELP state after the boot from the bootloader or kexec, and needs to be woken up first.

Let's wake the hardware and add a sleep after that similar to wl12xx_pre_boot() is already doing.

Note that a similar issue could exist for wl18xx, but I have not seen it so far. And a search for wl18xx_get_mac and wl12xx_sdio_raw_read did not produce similar errors.

Cc: Carl Philipp Klemm philipp@uvos.xyz Signed-off-by: Tony Lindgren tony@atomide.com Signed-off-by: Kalle Valo kvalo@codeaurora.org Link: https://lore.kernel.org/r/20210603062814.19464-1-tony@atomide.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/ti/wl12xx/main.c | 7 +++++++ 1 file changed, 7 insertions(+)

diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c index 9d7dbfe7fe0c..c6da0cfb4afb 100644 --- a/drivers/net/wireless/ti/wl12xx/main.c +++ b/drivers/net/wireless/ti/wl12xx/main.c @@ -1503,6 +1503,13 @@ static int wl12xx_get_fuse_mac(struct wl1271 *wl) u32 mac1, mac2; int ret;

+ /* Device may be in ELP from the bootloader or kexec */ + ret = wlcore_write32(wl, WL12XX_WELP_ARM_COMMAND, WELP_ARM_COMMAND_VAL); + if (ret < 0) + goto out; + + usleep_range(500000, 700000); + ret = wlcore_set_partition(wl, &wl->ptable[PART_DRPW]); if (ret < 0) goto out;

From: Zou Wei zou_wei@huawei.com

[ Upstream commit dd778f89225cd258e8f0fed2b7256124982c8bb5 ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates correct modalias for automatic loading of this driver when it is built as an external module.

Reported-by: Hulk Robot hulkci@huawei.com Signed-off-by: Zou Wei zou_wei@huawei.com Signed-off-by: Kalle Valo kvalo@codeaurora.org Link: https://lore.kernel.org/r/1620788714-14300-1-git-send-email-zou_wei@huawei.c... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/st/cw1200/cw1200_sdio.c | 1 + 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/st/cw1200/cw1200_sdio.c b/drivers/net/wireless/st/cw1200/cw1200_sdio.c index b65ec14136c7..4c30b5772ce0 100644 --- a/drivers/net/wireless/st/cw1200/cw1200_sdio.c +++ b/drivers/net/wireless/st/cw1200/cw1200_sdio.c @@ -53,6 +53,7 @@ static const struct sdio_device_id cw1200_sdio_ids[] = { { SDIO_DEVICE(SDIO_VENDOR_ID_STE, SDIO_DEVICE_ID_STE_CW1200) }, { /* end: all zeroes */ }, }; +MODULE_DEVICE_TABLE(sdio, cw1200_sdio_ids);

/* hwbus_ops implemetation */

From: Amber Lin Amber.Lin@amd.com

[ Upstream commit a7b2451d31cfa2e8aeccf3b35612ce33f02371fc ]

Calling free_mqd inside of destroy_queue_nocpsch_locked can cause a circular lock. destroy_queue_nocpsch_locked is called under a DQM lock, which is taken in MMU notifiers, potentially in FS reclaim context. Taking another lock, which is BO reservation lock from free_mqd, while causing an FS reclaim inside the DQM lock creates a problematic circular lock dependency. Therefore move free_mqd out of destroy_queue_nocpsch_locked and call it after unlocking DQM.

Signed-off-by: Amber Lin Amber.Lin@amd.com Reviewed-by: Felix Kuehling Felix.Kuehling@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- .../drm/amd/amdkfd/kfd_device_queue_manager.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c index df05eca73275..3d66565a618f 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c @@ -486,9 +486,6 @@ static int destroy_queue_nocpsch_locked(struct device_queue_manager *dqm, if (retval == -ETIME) qpd->reset_wavefronts = true;

- - mqd_mgr->free_mqd(mqd_mgr, q->mqd, q->mqd_mem_obj); - list_del(&q->list); if (list_empty(&qpd->queues_list)) { if (qpd->reset_wavefronts) { @@ -523,6 +520,8 @@ static int destroy_queue_nocpsch(struct device_queue_manager *dqm, int retval; uint64_t sdma_val = 0; struct kfd_process_device *pdd = qpd_to_pdd(qpd); + struct mqd_manager *mqd_mgr = + dqm->mqd_mgrs[get_mqd_type_from_queue_type(q->properties.type)];

/* Get the SDMA queue stats */ if ((q->properties.type == KFD_QUEUE_TYPE_SDMA) || @@ -540,6 +539,8 @@ static int destroy_queue_nocpsch(struct device_queue_manager *dqm, pdd->sdma_past_activity_counter += sdma_val; dqm_unlock(dqm);

+ mqd_mgr->free_mqd(mqd_mgr, q->mqd, q->mqd_mem_obj); + return retval; }

@@ -1632,7 +1633,7 @@ static int set_trap_handler(struct device_queue_manager *dqm, static int process_termination_nocpsch(struct device_queue_manager *dqm, struct qcm_process_device *qpd) { - struct queue *q, *next; + struct queue *q; struct device_process_node *cur, *next_dpn; int retval = 0; bool found = false; @@ -1640,12 +1641,19 @@ static int process_termination_nocpsch(struct device_queue_manager *dqm, dqm_lock(dqm);

/* Clear all user mode queues */ - list_for_each_entry_safe(q, next, &qpd->queues_list, list) { + while (!list_empty(&qpd->queues_list)) { + struct mqd_manager *mqd_mgr; int ret;

+ q = list_first_entry(&qpd->queues_list, struct queue, list); + mqd_mgr = dqm->mqd_mgrs[get_mqd_type_from_queue_type( + q->properties.type)]; ret = destroy_queue_nocpsch_locked(dqm, qpd, q); if (ret) retval = ret; + dqm_unlock(dqm); + mqd_mgr->free_mqd(mqd_mgr, q->mqd, q->mqd_mem_obj); + dqm_lock(dqm); }

/* Unregister process */

From: Daniel Borkmann daniel@iogearbox.net

[ Upstream commit 28131e9d933339a92f78e7ab6429f4aaaa07061c ]

syzbot reported a shift-out-of-bounds that KUBSAN observed in the interpreter:

[...] UBSAN: shift-out-of-bounds in kernel/bpf/core.c:1420:2 shift exponent 255 is too large for 64-bit type 'long long unsigned int' CPU: 1 PID: 11097 Comm: syz-executor.4 Not tainted 5.12.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327 ___bpf_prog_run.cold+0x19/0x56c kernel/bpf/core.c:1420 __bpf_prog_run32+0x8f/0xd0 kernel/bpf/core.c:1735 bpf_dispatcher_nop_func include/linux/bpf.h:644 [inline] bpf_prog_run_pin_on_cpu include/linux/filter.h:624 [inline] bpf_prog_run_clear_cb include/linux/filter.h:755 [inline] run_filter+0x1a1/0x470 net/packet/af_packet.c:2031 packet_rcv+0x313/0x13e0 net/packet/af_packet.c:2104 dev_queue_xmit_nit+0x7c2/0xa90 net/core/dev.c:2387 xmit_one net/core/dev.c:3588 [inline] dev_hard_start_xmit+0xad/0x920 net/core/dev.c:3609 __dev_queue_xmit+0x2121/0x2e00 net/core/dev.c:4182 __bpf_tx_skb net/core/filter.c:2116 [inline] __bpf_redirect_no_mac net/core/filter.c:2141 [inline] __bpf_redirect+0x548/0xc80 net/core/filter.c:2164 ____bpf_clone_redirect net/core/filter.c:2448 [inline] bpf_clone_redirect+0x2ae/0x420 net/core/filter.c:2420 ___bpf_prog_run+0x34e1/0x77d0 kernel/bpf/core.c:1523 __bpf_prog_run512+0x99/0xe0 kernel/bpf/core.c:1737 bpf_dispatcher_nop_func include/linux/bpf.h:644 [inline] bpf_test_run+0x3ed/0xc50 net/bpf/test_run.c:50 bpf_prog_test_run_skb+0xabc/0x1c50 net/bpf/test_run.c:582 bpf_prog_test_run kernel/bpf/syscall.c:3127 [inline] __do_sys_bpf+0x1ea9/0x4f00 kernel/bpf/syscall.c:4406 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae [...]

Generally speaking, KUBSAN reports from the kernel should be fixed. However, in case of BPF, this particular report caused concerns since the large shift is not wrong from BPF point of view, just undefined. In the verifier, K-based shifts that are >= {64,32} (depending on the bitwidth of the instruction) are already rejected. The register-based cases were not given their content might not be known at verification time. Ideas such as verifier instruction rewrite with an additional AND instruction for the source register were brought up, but regularly rejected due to the additional runtime overhead they incur.

As Edward Cree rightly put it:

Shifts by more than insn bitness are legal in the BPF ISA; they are implementation-defined behaviour [of the underlying architecture], rather than UB, and have been made legal for performance reasons. Each of the JIT backends compiles the BPF shift operations to machine instructions which produce implementation-defined results in such a case; the resulting contents of the register may be arbitrary but program behaviour as a whole remains defined.

Guard checks in the fast path (i.e. affecting JITted code) will thus not be accepted.

The case of division by zero is not truly analogous here, as division instructions on many of the JIT-targeted architectures will raise a machine exception / fault on division by zero, whereas (to the best of my knowledge) none will do so on an out-of-bounds shift.

Given the KUBSAN report only affects the BPF interpreter, but not JITs, one solution is to add the ANDs with 63 or 31 into ___bpf_prog_run(). That would make the shifts defined, and thus shuts up KUBSAN, and the compiler would optimize out the AND on any CPU that interprets the shift amounts modulo the width anyway (e.g., confirmed from disassembly that on x86-64 and arm64 the generated interpreter code is the same before and after this fix).

The BPF interpreter is slow path, and most likely compiled out anyway as distros select BPF_JIT_ALWAYS_ON to avoid speculative execution of BPF instructions by the interpreter. Given the main argument was to avoid sacrificing performance, the fact that the AND is optimized away from compiler for mainstream archs helps as well as a solution moving forward. Also add a comment on LSH/RSH/ARSH translation for JIT authors to provide guidance when they see the ___bpf_prog_run() interpreter code and use it as a model for a new JIT backend.

Reported-by: syzbot+bed360704c521841c85d@syzkaller.appspotmail.com Reported-by: Kurt Manucredo fuzzybritches0@gmail.com Signed-off-by: Eric Biggers ebiggers@kernel.org Co-developed-by: Eric Biggers ebiggers@kernel.org Signed-off-by: Daniel Borkmann daniel@iogearbox.net Acked-by: Alexei Starovoitov ast@kernel.org Acked-by: Andrii Nakryiko andrii@kernel.org Tested-by: syzbot+bed360704c521841c85d@syzkaller.appspotmail.com Cc: Edward Cree ecree.xilinx@gmail.com Link: https://lore.kernel.org/bpf/0000000000008f912605bd30d5d7@google.com Link: https://lore.kernel.org/bpf/bac16d8d-c174-bdc4-91bd-bfa62b410190@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/bpf/core.c | 61 +++++++++++++++++++++++++++++++++-------------- 1 file changed, 43 insertions(+), 18 deletions(-)

diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 75244ecb2389..952d98beda63 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -1399,29 +1399,54 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, u64 *stack) select_insn: goto *jumptable[insn->code];

- /* ALU */ -#define ALU(OPCODE, OP) \ - ALU64_##OPCODE##_X: \ - DST = DST OP SRC; \ - CONT; \ - ALU_##OPCODE##_X: \ - DST = (u32) DST OP (u32) SRC; \ - CONT; \ - ALU64_##OPCODE##_K: \ - DST = DST OP IMM; \ - CONT; \ - ALU_##OPCODE##_K: \ - DST = (u32) DST OP (u32) IMM; \ + /* Explicitly mask the register-based shift amounts with 63 or 31 + * to avoid undefined behavior. Normally this won't affect the + * generated code, for example, in case of native 64 bit archs such + * as x86-64 or arm64, the compiler is optimizing the AND away for + * the interpreter. In case of JITs, each of the JIT backends compiles + * the BPF shift operations to machine instructions which produce + * implementation-defined results in such a case; the resulting + * contents of the register may be arbitrary, but program behaviour + * as a whole remains defined. In other words, in case of JIT backends, + * the AND must /not/ be added to the emitted LSH/RSH/ARSH translation. + */ + /* ALU (shifts) */ +#define SHT(OPCODE, OP) \ + ALU64_##OPCODE##_X: \ + DST = DST OP (SRC & 63); \ + CONT; \ + ALU_##OPCODE##_X: \ + DST = (u32) DST OP ((u32) SRC & 31); \ + CONT; \ + ALU64_##OPCODE##_K: \ + DST = DST OP IMM; \ + CONT; \ + ALU_##OPCODE##_K: \ + DST = (u32) DST OP (u32) IMM; \ + CONT; + /* ALU (rest) */ +#define ALU(OPCODE, OP) \ + ALU64_##OPCODE##_X: \ + DST = DST OP SRC; \ + CONT; \ + ALU_##OPCODE##_X: \ + DST = (u32) DST OP (u32) SRC; \ + CONT; \ + ALU64_##OPCODE##_K: \ + DST = DST OP IMM; \ + CONT; \ + ALU_##OPCODE##_K: \ + DST = (u32) DST OP (u32) IMM; \ CONT; - ALU(ADD, +) ALU(SUB, -) ALU(AND, &) ALU(OR, |) - ALU(LSH, <<) - ALU(RSH, >>) ALU(XOR, ^) ALU(MUL, *) + SHT(LSH, <<) + SHT(RSH, >>) +#undef SHT #undef ALU ALU_NEG: DST = (u32) -DST; @@ -1446,13 +1471,13 @@ select_insn: insn++; CONT; ALU_ARSH_X: - DST = (u64) (u32) (((s32) DST) >> SRC); + DST = (u64) (u32) (((s32) DST) >> (SRC & 31)); CONT; ALU_ARSH_K: DST = (u64) (u32) (((s32) DST) >> IMM); CONT; ALU64_ARSH_X: - (*(s64 *) &DST) >>= SRC; + (*(s64 *) &DST) >>= (SRC & 63); CONT; ALU64_ARSH_K: (*(s64 *) &DST) >>= IMM;

From: Jacob Keller jacob.e.keller@intel.com

[ Upstream commit 0c526d440f76676733cb470b454db9d5507a3a50 ]

The entry for PTYPE 2 in the ice_ptype_lkup table incorrectly states that this is an L2 packet with no payload. According to the datasheet, this PTYPE is actually unused and reserved.

Fix the lookup entry to indicate this is an unused entry that is reserved.

Signed-off-by: Jacob Keller jacob.e.keller@intel.com Tested-by: Tony Brelinski tonyx.brelinski@intel.com Signed-off-by: Tony Nguyen anthony.l.nguyen@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h b/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h index 98a7f27c532b..c0ee0541e53f 100644 --- a/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h +++ b/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h @@ -608,7 +608,7 @@ static const struct ice_rx_ptype_decoded ice_ptype_lkup[] = { /* L2 Packet types */ ICE_PTT_UNUSED_ENTRY(0), ICE_PTT(1, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY2), - ICE_PTT(2, L2, NONE, NOF, NONE, NONE, NOF, NONE, NONE), + ICE_PTT_UNUSED_ENTRY(2), ICE_PTT_UNUSED_ENTRY(3), ICE_PTT_UNUSED_ENTRY(4), ICE_PTT_UNUSED_ENTRY(5),

From: Felix Fietkau nbd@nbd.name

[ Upstream commit 94e4f5794627a80ce036c35b32a9900daeb31be3 ]

Fixes AQL issues on full queues, especially with 802.3 encap offload

Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/dma.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c index 426787f4b2ae..ee0acde53a60 100644 --- a/drivers/net/wireless/mediatek/mt76/dma.c +++ b/drivers/net/wireless/mediatek/mt76/dma.c @@ -349,6 +349,9 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q, struct sk_buff *skb, struct mt76_wcid *wcid, struct ieee80211_sta *sta) { + struct ieee80211_tx_status status = { + .sta = sta, + }; struct mt76_tx_info tx_info = { .skb = skb, }; @@ -360,11 +363,9 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q, u8 *txwi;

t = mt76_get_txwi(dev); - if (!t) { - hw = mt76_tx_status_get_hw(dev, skb); - ieee80211_free_txskb(hw, skb); - return -ENOMEM; - } + if (!t) + goto free_skb; + txwi = mt76_get_txwi_ptr(dev, t);

skb->prev = skb->next = NULL; @@ -427,8 +428,13 @@ free: } #endif

- dev_kfree_skb(tx_info.skb); mt76_put_txwi(dev, t); + +free_skb: + status.skb = tx_info.skb; + hw = mt76_tx_status_get_hw(dev, tx_info.skb); + ieee80211_tx_status_ext(hw, &status); + return ret; }

From: Yang Yingliang yangyingliang@huawei.com

[ Upstream commit b244163f2c45c12053cb0291c955f892e79ed8a9 ]

This node pointer is returned by of_parse_phandle() with refcount incremented in this function. of_node_put() on it before exiting this function.

Reported-by: Hulk Robot hulkci@huawei.com Signed-off-by: Yang Yingliang yangyingliang@huawei.com Acked-by: Alex Elder elder@linaro.org Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ipa/ipa_main.c | 1 + 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ipa/ipa_main.c b/drivers/net/ipa/ipa_main.c index 97c1b55405cb..ba27bcde901e 100644 --- a/drivers/net/ipa/ipa_main.c +++ b/drivers/net/ipa/ipa_main.c @@ -679,6 +679,7 @@ static int ipa_firmware_load(struct device *dev) }

ret = of_address_to_resource(node, 0, &res); + of_node_put(node); if (ret) { dev_err(dev, "error %d getting "memory-region" resource\n", ret);

From: Pavel Begunkov asml.silence@gmail.com

[ Upstream commit e6ab8991c5d0b0deae0961dc22c0edd1dee328f5 ]

WARNING: CPU: 1 PID: 11749 at fs/io-wq.c:244 io_wqe_wake_worker fs/io-wq.c:244 [inline] WARNING: CPU: 1 PID: 11749 at fs/io-wq.c:244 io_wqe_enqueue+0x7f6/0x910 fs/io-wq.c:751

A WARN_ON_ONCE() in io_wqe_wake_worker() can be triggered by a valid userspace setup. Replace it with pr_warn.

Reported-by: syzbot+ea2f1484cffe5109dc10@syzkaller.appspotmail.com Signed-off-by: Pavel Begunkov asml.silence@gmail.com Link: https://lore.kernel.org/r/f7ede342c3342c4c26668f5168e2993e38bbd99c.162394969... Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- fs/io-wq.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/io-wq.c b/fs/io-wq.c index 4eba531bea5a..b836737f96f3 100644 --- a/fs/io-wq.c +++ b/fs/io-wq.c @@ -243,7 +243,8 @@ static void io_wqe_wake_worker(struct io_wqe *wqe, struct io_wqe_acct *acct) * Most likely an attempt to queue unbounded work on an io_wq that * wasn't setup with any unbounded workers. */ - WARN_ON_ONCE(!acct->max_workers); + if (unlikely(!acct->max_workers)) + pr_warn_once("io-wq is not configured for unbound workers");

rcu_read_lock(); ret = io_wqe_activate_free_worker(wqe); @@ -991,6 +992,8 @@ struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data)

if (WARN_ON_ONCE(!data->free_work || !data->do_work)) return ERR_PTR(-EINVAL); + if (WARN_ON_ONCE(!bounded)) + return ERR_PTR(-EINVAL);

wq = kzalloc(sizeof(*wq), GFP_KERNEL); if (!wq)

From: xinhui pan xinhui.pan@amd.com

[ Upstream commit 56f221b6389e7ab99c30bbf01c71998ae92fc584 ]

To avoid any list corruption.

Signed-off-by: xinhui pan xinhui.pan@amd.com Reviewed-by: Felix Kuehling Felix.Kuehling@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- .../drm/amd/amdkfd/kfd_device_queue_manager.c | 22 ++++++++++--------- 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c index 3d66565a618f..b2e55917c308 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c @@ -1712,7 +1712,7 @@ static int process_termination_cpsch(struct device_queue_manager *dqm, struct qcm_process_device *qpd) { int retval; - struct queue *q, *next; + struct queue *q; struct kernel_queue *kq, *kq_next; struct mqd_manager *mqd_mgr; struct device_process_node *cur, *next_dpn; @@ -1769,24 +1769,26 @@ static int process_termination_cpsch(struct device_queue_manager *dqm, qpd->reset_wavefronts = false; }

- dqm_unlock(dqm); - - /* Outside the DQM lock because under the DQM lock we can't do - * reclaim or take other locks that others hold while reclaiming. - */ - if (found) - kfd_dec_compute_active(dqm->dev); - /* Lastly, free mqd resources. * Do free_mqd() after dqm_unlock to avoid circular locking. */ - list_for_each_entry_safe(q, next, &qpd->queues_list, list) { + while (!list_empty(&qpd->queues_list)) { + q = list_first_entry(&qpd->queues_list, struct queue, list); mqd_mgr = dqm->mqd_mgrs[get_mqd_type_from_queue_type( q->properties.type)]; list_del(&q->list); qpd->queue_count--; + dqm_unlock(dqm); mqd_mgr->free_mqd(mqd_mgr, q->mqd, q->mqd_mem_obj); + dqm_lock(dqm); } + dqm_unlock(dqm); + + /* Outside the DQM lock because under the DQM lock we can't do + * reclaim or take other locks that others hold while reclaiming. + */ + if (found) + kfd_dec_compute_active(dqm->dev);

return retval; }

From: Ryder Lee ryder.lee@mediatek.com

[ Upstream commit 2707ff4dd7b1479dbd44ebb3c74788084cc95245 ]

The value of station mode is always 0.

Fixed: 00b2e16e0063 ("mt76: mt7915: add TxBF capabilities") Signed-off-by: Ryder Lee ryder.lee@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7915/init.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c index c7d4268d860a..5ab34606c021 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c @@ -452,6 +452,9 @@ mt7915_set_stream_he_txbf_caps(struct ieee80211_sta_he_cap *he_cap, if (nss < 2) return;

+ /* the maximum cap is 4 x 3, (Nr, Nc) = (3, 2) */ + elem->phy_cap_info[7] |= min_t(int, nss - 1, 2) << 3; + if (vif != NL80211_IFTYPE_AP) return;

@@ -465,9 +468,6 @@ mt7915_set_stream_he_txbf_caps(struct ieee80211_sta_he_cap *he_cap, c = IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMER_FB | IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMER_FB; elem->phy_cap_info[6] |= c; - - /* the maximum cap is 4 x 3, (Nr, Nc) = (3, 2) */ - elem->phy_cap_info[7] |= min_t(int, nss - 1, 2) << 3; }

static void

From: Pascal Terjan pterjan@google.com

[ Upstream commit c240b044edefa3c3af4014a4030e017dd95b59a1 ]

Based on 2001:3319 and 2357:0109 which I used to test the fix and 0bda:818b and 2357:0108 for which I found efuse dumps online.

== 2357:0109 == === Before === Vendor: Realtek Product: \x03802.11n NI Serial: === After === Vendor: Realtek Product: 802.11n NIC Serial not available.

== 2001:3319 == === Before === Vendor: Realtek Product: Wireless N Serial: no USB Adap === After === Vendor: Realtek Product: Wireless N Nano USB Adapter Serial not available.

Signed-off-by: Pascal Terjan pterjan@google.com Signed-off-by: Kalle Valo kvalo@codeaurora.org Link: https://lore.kernel.org/r/20210424172959.1559890-1-pterjan@google.com Signed-off-by: Sasha Levin sashal@kernel.org --- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 11 +--- .../realtek/rtl8xxxu/rtl8xxxu_8192e.c | 59 +++++++++++++++++-- 2 files changed, 56 insertions(+), 14 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h index d6d1be4169e5..acb6b0cd3667 100644 --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h @@ -853,15 +853,10 @@ struct rtl8192eu_efuse { u8 usb_optional_function; u8 res9[2]; u8 mac_addr[ETH_ALEN]; /* 0xd7 */ - u8 res10[2]; - u8 vendor_name[7]; - u8 res11[2]; - u8 device_name[0x0b]; /* 0xe8 */ - u8 res12[2]; - u8 serial[0x0b]; /* 0xf5 */ - u8 res13[0x30]; + u8 device_info[80]; + u8 res11[3]; u8 unknown[0x0d]; /* 0x130 */ - u8 res14[0xc3]; + u8 res12[0xc3]; };

struct rtl8xxxu_reg8val { diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c index cfe2dfdae928..b06508d0cdf8 100644 --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c @@ -554,9 +554,43 @@ rtl8192e_set_tx_power(struct rtl8xxxu_priv *priv, int channel, bool ht40) } }

+static void rtl8192eu_log_next_device_info(struct rtl8xxxu_priv *priv, + char *record_name, + char *device_info, + unsigned int *record_offset) +{ + char *record = device_info + *record_offset; + + /* A record is [ total length | 0x03 | value ] */ + unsigned char l = record[0]; + + /* + * The whole device info section seems to be 80 characters, make sure + * we don't read further. + */ + if (*record_offset + l > 80) { + dev_warn(&priv->udev->dev, + "invalid record length %d while parsing "%s" at offset %u.\n", + l, record_name, *record_offset); + return; + } + + if (l >= 2) { + char value[80]; + + memcpy(value, &record[2], l - 2); + value[l - 2] = '\0'; + dev_info(&priv->udev->dev, "%s: %s\n", record_name, value); + *record_offset = *record_offset + l; + } else { + dev_info(&priv->udev->dev, "%s not available.\n", record_name); + } +} + static int rtl8192eu_parse_efuse(struct rtl8xxxu_priv *priv) { struct rtl8192eu_efuse *efuse = &priv->efuse_wifi.efuse8192eu; + unsigned int record_offset; int i;

if (efuse->rtl_id != cpu_to_le16(0x8129)) @@ -604,12 +638,25 @@ static int rtl8192eu_parse_efuse(struct rtl8xxxu_priv *priv) priv->has_xtalk = 1; priv->xtalk = priv->efuse_wifi.efuse8192eu.xtal_k & 0x3f;

- dev_info(&priv->udev->dev, "Vendor: %.7s\n", efuse->vendor_name); - dev_info(&priv->udev->dev, "Product: %.11s\n", efuse->device_name); - if (memchr_inv(efuse->serial, 0xff, 11)) - dev_info(&priv->udev->dev, "Serial: %.11s\n", efuse->serial); - else - dev_info(&priv->udev->dev, "Serial not available.\n"); + /* + * device_info section seems to be laid out as records + * [ total length | 0x03 | value ] so: + * - vendor length + 2 + * - 0x03 + * - vendor string (not null terminated) + * - product length + 2 + * - 0x03 + * - product string (not null terminated) + * Then there is one or 2 0x00 on all the 4 devices I own or found + * dumped online. + * As previous version of the code handled an optional serial + * string, I now assume there may be a third record if the + * length is not 0. + */ + record_offset = 0; + rtl8192eu_log_next_device_info(priv, "Vendor", efuse->device_info, &record_offset); + rtl8192eu_log_next_device_info(priv, "Product", efuse->device_info, &record_offset); + rtl8192eu_log_next_device_info(priv, "Serial", efuse->device_info, &record_offset);

if (rtl8xxxu_debug & RTL8XXXU_DEBUG_EFUSE) { unsigned char *raw = priv->efuse_wifi.raw;

From: Joakim Zhang qiangqing.zhang@nxp.com

[ Upstream commit 471ff4455d61c9929ae912328859921708e1eafc ]

Frieder Schrempf reported a TX throuthput issue [1], it happens quite often that the measured bandwidth in TX direction drops from its expected/nominal value to something like ~50% (for 100M) or ~67% (for 1G) connections.

[1] https://lore.kernel.org/linux-arm-kernel/421cc86c-b66f-b372-32f7-21e59f9a98b...

The issue becomes clear after digging into it, Net core would select queues when transmitting packets. Since FEC have not impletemented ndo_select_queue callback yet, so it will call netdev_pick_tx to select queues randomly.

For i.MX6SX ENET IP with AVB support, driver default enables this feature. According to the setting of QOS/RCMRn/DMAnCFG registers, AVB configured to Credit-based scheme, 50% bandwidth of each queue 1&2.

With below tests let me think more: 1) With FEC_QUIRK_HAS_AVB quirk, can reproduce TX bandwidth fluctuations issue. 2) Without FEC_QUIRK_HAS_AVB quirk, can't reproduce TX bandwidth fluctuations issue.

The related difference with or w/o FEC_QUIRK_HAS_AVB quirk is that, whether we program FTYPE field of TxBD or not. As I describe above, AVB feature is enabled by default. With FEC_QUIRK_HAS_AVB quirk, frames in queue 0 marked as non-AVB, and frames in queue 1&2 marked as AVB Class A&B. It's unreasonable if frames in queue 1&2 are not required to be time-sensitive. So when Net core select tx queues ramdomly, Credit-based scheme would work and lead to TX bandwidth fluctuated. On the other hand, w/o FEC_QUIRK_HAS_AVB quirk, frames in queue 1&2 are all marked as non-AVB, so Credit-based scheme would not work.

Till now, how can we fix this TX throughput issue? Yes, please remove FEC_QUIRK_HAS_AVB quirk if you suffer it from time-nonsensitive networking. However, this quirk is used to indicate i.MX6SX, other setting depends on it. So this patch adds a new quirk FEC_QUIRK_HAS_MULTI_QUEUES to represent i.MX6SX, it is safe for us remove FEC_QUIRK_HAS_AVB quirk now.

FEC_QUIRK_HAS_AVB quirk is set by default in the driver, and users may not know much about driver details, they would waste effort to find the root cause, that is not we want. The following patch is a implementation to fix it and users don't need to modify the driver.

Tested-by: Frieder Schrempf frieder.schrempf@kontron.de Reported-by: Frieder Schrempf frieder.schrempf@kontron.de Signed-off-by: Joakim Zhang qiangqing.zhang@nxp.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/freescale/fec.h | 5 +++++ drivers/net/ethernet/freescale/fec_main.c | 11 ++++++----- 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h index 0602d5d5d2ee..2e002e4b4b4a 100644 --- a/drivers/net/ethernet/freescale/fec.h +++ b/drivers/net/ethernet/freescale/fec.h @@ -467,6 +467,11 @@ struct bufdesc_ex { */ #define FEC_QUIRK_NO_HARD_RESET (1 << 18)

+/* i.MX6SX ENET IP supports multiple queues (3 queues), use this quirk to + * represents this ENET IP. + */ +#define FEC_QUIRK_HAS_MULTI_QUEUES (1 << 19) + struct bufdesc_prop { int qid; /* Address of Rx and Tx buffers */ diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c index 89393fbc726f..15c9cffa8735 100644 --- a/drivers/net/ethernet/freescale/fec_main.c +++ b/drivers/net/ethernet/freescale/fec_main.c @@ -121,7 +121,7 @@ static const struct fec_devinfo fec_imx6x_info = { FEC_QUIRK_HAS_VLAN | FEC_QUIRK_HAS_AVB | FEC_QUIRK_ERR007885 | FEC_QUIRK_BUG_CAPTURE | FEC_QUIRK_HAS_RACC | FEC_QUIRK_HAS_COALESCE | - FEC_QUIRK_CLEAR_SETUP_MII, + FEC_QUIRK_CLEAR_SETUP_MII | FEC_QUIRK_HAS_MULTI_QUEUES, };

static const struct fec_devinfo fec_imx6ul_info = { @@ -420,6 +420,7 @@ fec_enet_txq_submit_frag_skb(struct fec_enet_priv_tx_q *txq, estatus |= FEC_TX_BD_FTYPE(txq->bd.qid); if (skb->ip_summed == CHECKSUM_PARTIAL) estatus |= BD_ENET_TX_PINS | BD_ENET_TX_IINS; + ebdp->cbd_bdu = 0; ebdp->cbd_esc = cpu_to_fec32(estatus); } @@ -953,7 +954,7 @@ fec_restart(struct net_device *ndev) * For i.MX6SX SOC, enet use AXI bus, we use disable MAC * instead of reset MAC itself. */ - if (fep->quirks & FEC_QUIRK_HAS_AVB || + if (fep->quirks & FEC_QUIRK_HAS_MULTI_QUEUES || ((fep->quirks & FEC_QUIRK_NO_HARD_RESET) && fep->link)) { writel(0, fep->hwp + FEC_ECNTRL); } else { @@ -1164,7 +1165,7 @@ fec_stop(struct net_device *ndev) * instead of reset MAC itself. */ if (!(fep->wol_flag & FEC_WOL_FLAG_SLEEP_ON)) { - if (fep->quirks & FEC_QUIRK_HAS_AVB) { + if (fep->quirks & FEC_QUIRK_HAS_MULTI_QUEUES) { writel(0, fep->hwp + FEC_ECNTRL); } else { writel(1, fep->hwp + FEC_ECNTRL); @@ -2559,7 +2560,7 @@ static void fec_enet_itr_coal_set(struct net_device *ndev)

writel(tx_itr, fep->hwp + FEC_TXIC0); writel(rx_itr, fep->hwp + FEC_RXIC0); - if (fep->quirks & FEC_QUIRK_HAS_AVB) { + if (fep->quirks & FEC_QUIRK_HAS_MULTI_QUEUES) { writel(tx_itr, fep->hwp + FEC_TXIC1); writel(rx_itr, fep->hwp + FEC_RXIC1); writel(tx_itr, fep->hwp + FEC_TXIC2); @@ -3356,7 +3357,7 @@ static int fec_enet_init(struct net_device *ndev) fep->csum_flags |= FLAG_RX_CSUM_ENABLED; }

- if (fep->quirks & FEC_QUIRK_HAS_AVB) { + if (fep->quirks & FEC_QUIRK_HAS_MULTI_QUEUES) { fep->tx_align = 0; fep->rx_align = 0x3f; }

From: Zheyu Ma zheyuma97@gmail.com

[ Upstream commit 6a1e5a4af17e440dd82a58a2c5f40ff17a82b722 ]

When 'nicstar_init_one' fails, 'ns_init_card_error' will be executed for error handling, but the correct memory free function should be used, otherwise it will cause an error. Since 'card->rsq.org' and 'card->tsq.org' are allocated using 'dma_alloc_coherent' function, they should be freed using 'dma_free_coherent'.

Fix this by using 'dma_free_coherent' instead of 'kfree'

This log reveals it:

[ 3.440294] kernel BUG at mm/slub.c:4206! [ 3.441059] invalid opcode: 0000 [#1] PREEMPT SMP PTI [ 3.441430] CPU: 2 PID: 1 Comm: swapper/0 Not tainted 5.12.4-g70e7f0549188-dirty #141 [ 3.441986] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 3.442780] RIP: 0010:kfree+0x26a/0x300 [ 3.443065] Code: e8 3a c3 b9 ff e9 d6 fd ff ff 49 8b 45 00 31 db a9 00 00 01 00 75 4d 49 8b 45 00 a9 00 00 01 00 75 0a 49 8b 45 08 a8 01 75 02 <0f> 0b 89 d9 b8 00 10 00 00 be 06 00 00 00 48 d3 e0 f7 d8 48 63 d0 [ 3.443396] RSP: 0000:ffffc90000017b70 EFLAGS: 00010246 [ 3.443396] RAX: dead000000000100 RBX: 0000000000000000 RCX: 0000000000000000 [ 3.443396] RDX: 0000000000000000 RSI: ffffffff85d3df94 RDI: ffffffff85df38e6 [ 3.443396] RBP: ffffc90000017b90 R08: 0000000000000001 R09: 0000000000000001 [ 3.443396] R10: 0000000000000000 R11: 0000000000000001 R12: ffff888107dc0000 [ 3.443396] R13: ffffea00001f0100 R14: ffff888101a8bf00 R15: ffff888107dc0160 [ 3.443396] FS: 0000000000000000(0000) GS:ffff88817bc80000(0000) knlGS:0000000000000000 [ 3.443396] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3.443396] CR2: 0000000000000000 CR3: 000000000642e000 CR4: 00000000000006e0 [ 3.443396] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 3.443396] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 3.443396] Call Trace: [ 3.443396] ns_init_card_error+0x12c/0x220 [ 3.443396] nicstar_init_one+0x10d2/0x1130 [ 3.443396] local_pci_probe+0x4a/0xb0 [ 3.443396] pci_device_probe+0x126/0x1d0 [ 3.443396] ? pci_device_remove+0x100/0x100 [ 3.443396] really_probe+0x27e/0x650 [ 3.443396] driver_probe_device+0x84/0x1d0 [ 3.443396] ? mutex_lock_nested+0x16/0x20 [ 3.443396] device_driver_attach+0x63/0x70 [ 3.443396] __driver_attach+0x117/0x1a0 [ 3.443396] ? device_driver_attach+0x70/0x70 [ 3.443396] bus_for_each_dev+0xb6/0x110 [ 3.443396] ? rdinit_setup+0x40/0x40 [ 3.443396] driver_attach+0x22/0x30 [ 3.443396] bus_add_driver+0x1e6/0x2a0 [ 3.443396] driver_register+0xa4/0x180 [ 3.443396] __pci_register_driver+0x77/0x80 [ 3.443396] ? uPD98402_module_init+0xd/0xd [ 3.443396] nicstar_init+0x1f/0x75 [ 3.443396] do_one_initcall+0x7a/0x3d0 [ 3.443396] ? rdinit_setup+0x40/0x40 [ 3.443396] ? rcu_read_lock_sched_held+0x4a/0x70 [ 3.443396] kernel_init_freeable+0x2a7/0x2f9 [ 3.443396] ? rest_init+0x2c0/0x2c0 [ 3.443396] kernel_init+0x13/0x180 [ 3.443396] ? rest_init+0x2c0/0x2c0 [ 3.443396] ? rest_init+0x2c0/0x2c0 [ 3.443396] ret_from_fork+0x1f/0x30 [ 3.443396] Modules linked in: [ 3.443396] Dumping ftrace buffer: [ 3.443396] (ftrace buffer empty) [ 3.458593] ---[ end trace 3c6f8f0d8ef59bcd ]--- [ 3.458922] RIP: 0010:kfree+0x26a/0x300 [ 3.459198] Code: e8 3a c3 b9 ff e9 d6 fd ff ff 49 8b 45 00 31 db a9 00 00 01 00 75 4d 49 8b 45 00 a9 00 00 01 00 75 0a 49 8b 45 08 a8 01 75 02 <0f> 0b 89 d9 b8 00 10 00 00 be 06 00 00 00 48 d3 e0 f7 d8 48 63 d0 [ 3.460499] RSP: 0000:ffffc90000017b70 EFLAGS: 00010246 [ 3.460870] RAX: dead000000000100 RBX: 0000000000000000 RCX: 0000000000000000 [ 3.461371] RDX: 0000000000000000 RSI: ffffffff85d3df94 RDI: ffffffff85df38e6 [ 3.461873] RBP: ffffc90000017b90 R08: 0000000000000001 R09: 0000000000000001 [ 3.462372] R10: 0000000000000000 R11: 0000000000000001 R12: ffff888107dc0000 [ 3.462871] R13: ffffea00001f0100 R14: ffff888101a8bf00 R15: ffff888107dc0160 [ 3.463368] FS: 0000000000000000(0000) GS:ffff88817bc80000(0000) knlGS:0000000000000000 [ 3.463949] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3.464356] CR2: 0000000000000000 CR3: 000000000642e000 CR4: 00000000000006e0 [ 3.464856] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 3.465356] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 3.465860] Kernel panic - not syncing: Fatal exception [ 3.466370] Dumping ftrace buffer: [ 3.466616] (ftrace buffer empty) [ 3.466871] Kernel Offset: disabled [ 3.467122] Rebooting in 1 seconds..

Signed-off-by: Zheyu Ma zheyuma97@gmail.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/atm/nicstar.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c index b015c3e14336..3a38720acd0e 100644 --- a/drivers/atm/nicstar.c +++ b/drivers/atm/nicstar.c @@ -839,10 +839,12 @@ static void ns_init_card_error(ns_dev *card, int error) dev_kfree_skb_any(hb); } if (error >= 12) { - kfree(card->rsq.org); + dma_free_coherent(&card->pcidev->dev, NS_RSQSIZE + NS_RSQ_ALIGNMENT, + card->rsq.org, card->rsq.dma); } if (error >= 11) { - kfree(card->tsq.org); + dma_free_coherent(&card->pcidev->dev, NS_TSQSIZE + NS_TSQ_ALIGNMENT, + card->tsq.org, card->tsq.dma); } if (error >= 10) { free_irq(card->pcidev->irq, card);

From: Longpeng(Mike) longpeng2@huawei.com

[ Upstream commit c7ff9cff70601ea19245d997bb977344663434c7 ]

The client's sk_state will be set to TCP_ESTABLISHED if the server replay the client's connect request.

However, if the client has pending signal, its sk_state will be set to TCP_CLOSE without notify the server, so the server will hold the corrupt connection.

client server

1. sk_state=TCP_SYN_SENT | 2. call ->connect() | 3. wait reply | | 4. sk_state=TCP_ESTABLISHED | 5. insert to connected list | 6. reply to the client 7. sk_state=TCP_ESTABLISHED | 8. insert to connected list | 9. *signal pending* <--------------------- the user kill client 10. sk_state=TCP_CLOSE | client is exiting... | 11. call ->release() | virtio_transport_close if (!(sk->sk_state == TCP_ESTABLISHED || sk->sk_state == TCP_CLOSING)) return true; *return at here, the server cannot notice the connection is corrupt*

So the client should notify the peer in this case.

Cc: David S. Miller davem@davemloft.net Cc: Jakub Kicinski kuba@kernel.org Cc: Jorgen Hansen jhansen@vmware.com Cc: Norbert Slusarek nslusarek@gmx.net Cc: Andra Paraschiv andraprs@amazon.com Cc: Colin Ian King colin.king@canonical.com Cc: David Brazdil dbrazdil@google.com Cc: Alexander Popov alex.popov@linux.com Suggested-by: Stefano Garzarella sgarzare@redhat.com Link: https://lkml.org/lkml/2021/5/17/418 Signed-off-by: lixianming lixianming5@huawei.com Signed-off-by: Longpeng(Mike) longpeng2@huawei.com Reviewed-by: Stefano Garzarella sgarzare@redhat.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- net/vmw_vsock/af_vsock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index bc7fb9bf3351..2a82fbf32ccc 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -1369,7 +1369,7 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,

if (signal_pending(current)) { err = sock_intr_errno(timeout); - sk->sk_state = TCP_CLOSE; + sk->sk_state = sk->sk_state == TCP_ESTABLISHED ? TCP_CLOSING : TCP_CLOSE; sock->state = SS_UNCONNECTED; vsock_transport_cancel_pkt(vsk); goto out_wait;

From: Xiao Yang yangx.jy@fujitsu.com

[ Upstream commit 20ec0a6d6016aa28b9b3299be18baef1a0f91cd2 ]

rxe_mr_init_user() always returns the fixed -EINVAL when ib_umem_get() fails so it's hard for user to know which actual error happens in ib_umem_get(). For example, ib_umem_get() will return -EOPNOTSUPP when trying to pin pages on a DAX file.

Return actual error as mlx4/mlx5 does.

Link: https://lore.kernel.org/r/20210621071456.4259-1-ice_yangxiao@163.com Signed-off-by: Xiao Yang yangx.jy@fujitsu.com Signed-off-by: Jason Gunthorpe jgg@nvidia.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/sw/rxe/rxe_mr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c index 9f63947bab12..fe2b7d223183 100644 --- a/drivers/infiniband/sw/rxe/rxe_mr.c +++ b/drivers/infiniband/sw/rxe/rxe_mr.c @@ -135,7 +135,7 @@ int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova, if (IS_ERR(umem)) { pr_warn("err %d from rxe_umem_get\n", (int)PTR_ERR(umem)); - err = -EINVAL; + err = PTR_ERR(umem); goto err1; }

From: Johannes Berg johannes.berg@intel.com

[ Upstream commit a171399fd687a7d2fa56a10c9a2d7084a647677d ]

SMPS requests may differ per interfaces due to e.g. Bluetooth only interfering on 2.4 GHz, so if that's the case we should, in the case of multiple PHY contexts, still allow RX diversity on PHY context that have no interfaces with SMPS requests.

Fix the code to pass through the PHY context in question and skip interfaces with non-matching PHY context while iterating.

Signed-off-by: Johannes Berg johannes.berg@intel.com Signed-off-by: Luca Coelho luciano.coelho@intel.com Link: https://lore.kernel.org/r/iwlwifi.20210617100544.123c6b05809d.I992e3d1c6a298... Signed-off-by: Luca Coelho luciano.coelho@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 3 +- .../net/wireless/intel/iwlwifi/mvm/phy-ctxt.c | 15 ++++++---- .../net/wireless/intel/iwlwifi/mvm/utils.c | 28 ++++++++++++++----- 3 files changed, 32 insertions(+), 14 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h index 0a963d01b825..f17dfdf2bfaf 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h @@ -1828,7 +1828,8 @@ int iwl_mvm_disable_beacon_filter(struct iwl_mvm *mvm, void iwl_mvm_update_smps(struct iwl_mvm *mvm, struct ieee80211_vif *vif, enum iwl_mvm_smps_type_request req_type, enum ieee80211_smps_mode smps_request); -bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm); +bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm, + struct iwl_mvm_phy_ctxt *ctxt);

/* Low latency */ int iwl_mvm_update_low_latency(struct iwl_mvm *mvm, struct ieee80211_vif *vif, diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c index 0fd51f6aa206..4ed2338027d1 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause /* - * Copyright (C) 2012-2014, 2018-2020 Intel Corporation + * Copyright (C) 2012-2014, 2018-2021 Intel Corporation * Copyright (C) 2013-2014 Intel Mobile Communications GmbH * Copyright (C) 2017 Intel Deutschland GmbH */ @@ -76,6 +76,7 @@ static void iwl_mvm_phy_ctxt_cmd_hdr(struct iwl_mvm_phy_ctxt *ctxt, }

static void iwl_mvm_phy_ctxt_set_rxchain(struct iwl_mvm *mvm, + struct iwl_mvm_phy_ctxt *ctxt, __le32 *rxchain_info, u8 chains_static, u8 chains_dynamic) @@ -93,7 +94,7 @@ static void iwl_mvm_phy_ctxt_set_rxchain(struct iwl_mvm *mvm, * between the two antennas is sufficiently different to impact * performance. */ - if (active_cnt == 1 && iwl_mvm_rx_diversity_allowed(mvm)) { + if (active_cnt == 1 && iwl_mvm_rx_diversity_allowed(mvm, ctxt)) { idle_cnt = 2; active_cnt = 2; } @@ -113,6 +114,7 @@ static void iwl_mvm_phy_ctxt_set_rxchain(struct iwl_mvm *mvm, * Add the phy configuration to the PHY context command */ static void iwl_mvm_phy_ctxt_cmd_data_v1(struct iwl_mvm *mvm, + struct iwl_mvm_phy_ctxt *ctxt, struct iwl_phy_context_cmd_v1 *cmd, struct cfg80211_chan_def *chandef, u8 chains_static, u8 chains_dynamic) @@ -123,7 +125,7 @@ static void iwl_mvm_phy_ctxt_cmd_data_v1(struct iwl_mvm *mvm, /* Set the channel info data */ iwl_mvm_set_chan_info_chandef(mvm, &cmd->ci, chandef);

- iwl_mvm_phy_ctxt_set_rxchain(mvm, &tail->rxchain_info, + iwl_mvm_phy_ctxt_set_rxchain(mvm, ctxt, &tail->rxchain_info, chains_static, chains_dynamic);

tail->txchain_info = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm)); @@ -133,6 +135,7 @@ static void iwl_mvm_phy_ctxt_cmd_data_v1(struct iwl_mvm *mvm, * Add the phy configuration to the PHY context command */ static void iwl_mvm_phy_ctxt_cmd_data(struct iwl_mvm *mvm, + struct iwl_mvm_phy_ctxt *ctxt, struct iwl_phy_context_cmd *cmd, struct cfg80211_chan_def *chandef, u8 chains_static, u8 chains_dynamic) @@ -143,7 +146,7 @@ static void iwl_mvm_phy_ctxt_cmd_data(struct iwl_mvm *mvm, /* Set the channel info data */ iwl_mvm_set_chan_info_chandef(mvm, &cmd->ci, chandef);

- iwl_mvm_phy_ctxt_set_rxchain(mvm, &cmd->rxchain_info, + iwl_mvm_phy_ctxt_set_rxchain(mvm, ctxt, &cmd->rxchain_info, chains_static, chains_dynamic); }

@@ -170,7 +173,7 @@ static int iwl_mvm_phy_ctxt_apply(struct iwl_mvm *mvm, iwl_mvm_phy_ctxt_cmd_hdr(ctxt, &cmd, action);

/* Set the command data */ - iwl_mvm_phy_ctxt_cmd_data(mvm, &cmd, chandef, + iwl_mvm_phy_ctxt_cmd_data(mvm, ctxt, &cmd, chandef, chains_static, chains_dynamic);

@@ -186,7 +189,7 @@ static int iwl_mvm_phy_ctxt_apply(struct iwl_mvm *mvm, action);

/* Set the command data */ - iwl_mvm_phy_ctxt_cmd_data_v1(mvm, &cmd, chandef, + iwl_mvm_phy_ctxt_cmd_data_v1(mvm, ctxt, &cmd, chandef, chains_static, chains_dynamic); ret = iwl_mvm_send_cmd_pdu(mvm, PHY_CONTEXT_CMD, diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c index b6b481ff1518..fc4d8840eca4 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c @@ -683,23 +683,37 @@ void iwl_mvm_accu_radio_stats(struct iwl_mvm *mvm) mvm->accu_radio_stats.on_time_scan += mvm->radio_stats.on_time_scan; }

+struct iwl_mvm_diversity_iter_data { + struct iwl_mvm_phy_ctxt *ctxt; + bool result; +}; + static void iwl_mvm_diversity_iter(void *_data, u8 *mac, struct ieee80211_vif *vif) { struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif); - bool *result = _data; + struct iwl_mvm_diversity_iter_data *data = _data; int i;

+ if (mvmvif->phy_ctxt != data->ctxt) + return; + for (i = 0; i < NUM_IWL_MVM_SMPS_REQ; i++) { if (mvmvif->smps_requests[i] == IEEE80211_SMPS_STATIC || - mvmvif->smps_requests[i] == IEEE80211_SMPS_DYNAMIC) - *result = false; + mvmvif->smps_requests[i] == IEEE80211_SMPS_DYNAMIC) { + data->result = false; + break; + } } }

-bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm) +bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm, + struct iwl_mvm_phy_ctxt *ctxt) { - bool result = true; + struct iwl_mvm_diversity_iter_data data = { + .ctxt = ctxt, + .result = true, + };

lockdep_assert_held(&mvm->mutex);

@@ -711,9 +725,9 @@ bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm)

ieee80211_iterate_active_interfaces_atomic( mvm->hw, IEEE80211_IFACE_ITER_NORMAL, - iwl_mvm_diversity_iter, &result); + iwl_mvm_diversity_iter, &data);

- return result; + return data.result; }

void iwl_mvm_send_low_latency_cmd(struct iwl_mvm *mvm,

From: Johannes Berg johannes.berg@intel.com

[ Upstream commit 310f60f53a86eba680d9bc20a371e13b06a5f903 ]

In the case of gen3 devices with image loader (IML) support, we were leaking the IML DMA allocation and never freeing it. Fix that.

Signed-off-by: Johannes Berg johannes.berg@intel.com Signed-off-by: Luca Coelho luciano.coelho@intel.com Link: https://lore.kernel.org/r/iwlwifi.20210618105614.07e117dbedb7.I7bb9ebbe06176... Signed-off-by: Luca Coelho luciano.coelho@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- .../wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c | 15 ++++++++++----- .../net/wireless/intel/iwlwifi/pcie/internal.h | 3 +++ 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c index cecc32e7dbe8..2dbc51daa2f8 100644 --- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c +++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c @@ -79,7 +79,6 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans, struct iwl_prph_scratch *prph_scratch; struct iwl_prph_scratch_ctrl_cfg *prph_sc_ctrl; struct iwl_prph_info *prph_info; - void *iml_img; u32 control_flags = 0; int ret; int cmdq_size = max_t(u32, IWL_CMD_QUEUE_SIZE, @@ -187,14 +186,15 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans, trans_pcie->prph_scratch = prph_scratch;

/* Allocate IML */ - iml_img = dma_alloc_coherent(trans->dev, trans->iml_len, - &trans_pcie->iml_dma_addr, GFP_KERNEL); - if (!iml_img) { + trans_pcie->iml = dma_alloc_coherent(trans->dev, trans->iml_len, + &trans_pcie->iml_dma_addr, + GFP_KERNEL); + if (!trans_pcie->iml) { ret = -ENOMEM; goto err_free_ctxt_info; }

- memcpy(iml_img, trans->iml, trans->iml_len); + memcpy(trans_pcie->iml, trans->iml, trans->iml_len);

iwl_enable_fw_load_int_ctx_info(trans);

@@ -243,6 +243,11 @@ void iwl_pcie_ctxt_info_gen3_free(struct iwl_trans *trans) trans_pcie->ctxt_info_dma_addr = 0; trans_pcie->ctxt_info_gen3 = NULL;

+ dma_free_coherent(trans->dev, trans->iml_len, trans_pcie->iml, + trans_pcie->iml_dma_addr); + trans_pcie->iml_dma_addr = 0; + trans_pcie->iml = NULL; + iwl_pcie_ctxt_info_free_fw_img(trans);

dma_free_coherent(trans->dev, sizeof(*trans_pcie->prph_scratch), diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h index d9688c7bed07..53af3f29eab8 100644 --- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h +++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h @@ -279,6 +279,8 @@ struct cont_rec { * Context information addresses will be taken from here. * This is driver's local copy for keeping track of size and * count for allocating and freeing the memory. + * @iml: image loader image virtual address + * @iml_dma_addr: image loader image DMA address * @trans: pointer to the generic transport area * @scd_base_addr: scheduler sram base address in SRAM * @kw: keep warm address @@ -329,6 +331,7 @@ struct iwl_trans_pcie { }; struct iwl_prph_info *prph_info; struct iwl_prph_scratch *prph_scratch; + void *iml; dma_addr_t ctxt_info_dma_addr; dma_addr_t prph_info_dma_addr; dma_addr_t prph_scratch_dma_addr;

From: Po-Hao Huang phhuang@realtek.com

[ Upstream commit 7a1baaaee6c866455c9c77bf9b0405941a3678c7 ]

Update RTL8822C devices' RF tables to v62. This fixes higher than expected spur in 2400 MHz under CCK mask.

Signed-off-by: Po-Hao Huang phhuang@realtek.com Signed-off-by: Ping-Ke Shih pkshih@realtek.com Signed-off-by: Kalle Valo kvalo@codeaurora.org Link: https://lore.kernel.org/r/20210506083643.18317-1-pkshih@realtek.com Signed-off-by: Sasha Levin sashal@kernel.org --- .../wireless/realtek/rtw88/rtw8822c_table.c | 1008 ++++++++--------- 1 file changed, 504 insertions(+), 504 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822c_table.c b/drivers/net/wireless/realtek/rtw88/rtw8822c_table.c index ad5715c65de3..03f97acbf80f 100644 --- a/drivers/net/wireless/realtek/rtw88/rtw8822c_table.c +++ b/drivers/net/wireless/realtek/rtw88/rtw8822c_table.c @@ -16812,53 +16812,53 @@ static const u32 rtw8822c_rf_a[] = { 0x92000002, 0x00000000, 0x40000000, 0x00000000, 0x03F, 0x00010E46, 0x93000001, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x93000002, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x93000003, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x93000004, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x93000005, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x93000006, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x93000015, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x93000016, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x94000001, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x94000002, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x94000003, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x94000004, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x94000005, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x94000006, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x94000015, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x94000016, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x95000001, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x95000002, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x95000003, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x95000004, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x95000005, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x95000006, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x95000015, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0x95000016, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00030246, + 0x03F, 0x0003D646, 0xA0000000, 0x00000000, 0x03F, 0x00002A46, 0xB0000000, 0x00000000, @@ -18762,53 +18762,53 @@ static const u32 rtw8822c_rf_a[] = { 0x92000002, 0x00000000, 0x40000000, 0x00000000, 0x03F, 0x0000EA46, 0x93000001, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000002, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000003, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000004, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000005, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000006, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000015, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000016, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000001, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000002, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000003, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000004, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000005, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000006, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000015, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000016, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000001, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000002, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000003, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000004, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000005, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000006, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000015, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000016, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0xA0000000, 0x00000000, 0x03F, 0x00002A46, 0xB0000000, 0x00000000, @@ -18957,53 +18957,53 @@ static const u32 rtw8822c_rf_a[] = { 0x92000002, 0x00000000, 0x40000000, 0x00000000, 0x03F, 0x0000EA46, 0x93000001, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000002, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000003, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000004, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000005, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000006, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000015, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000016, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000001, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000002, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000003, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000004, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000005, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000006, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000015, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000016, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000001, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000002, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000003, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000004, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000005, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000006, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000015, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000016, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0xA0000000, 0x00000000, 0x03F, 0x00002A46, 0xB0000000, 0x00000000, @@ -19152,53 +19152,53 @@ static const u32 rtw8822c_rf_a[] = { 0x92000002, 0x00000000, 0x40000000, 0x00000000, 0x03F, 0x0000EA46, 0x93000001, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000002, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000003, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000004, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000005, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000006, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000015, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000016, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000001, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000002, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000003, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000004, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000005, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000006, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000015, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000016, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000001, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000002, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000003, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000004, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000005, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000006, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000015, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000016, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0xA0000000, 0x00000000, 0x03F, 0x00002A46, 0xB0000000, 0x00000000, @@ -19347,53 +19347,53 @@ static const u32 rtw8822c_rf_a[] = { 0x92000002, 0x00000000, 0x40000000, 0x00000000, 0x03F, 0x0000EA46, 0x93000001, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000002, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000003, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000004, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000005, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000006, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000015, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x93000016, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000001, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000002, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000003, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000004, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000005, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000006, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000015, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x94000016, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000001, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000002, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000003, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000004, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000005, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000006, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000015, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0x95000016, 0x00000000, 0x40000000, 0x00000000, - 0x03F, 0x00031E46, + 0x03F, 0x0003D646, 0xA0000000, 0x00000000, 0x03F, 0x00002A46, 0xB0000000, 0x00000000, @@ -19610,21 +19610,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x93000002, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -19633,21 +19633,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x93000003, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -19656,21 +19656,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x93000004, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -19679,21 +19679,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x93000005, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -19702,21 +19702,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x93000006, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -19725,21 +19725,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x93000015, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -19748,21 +19748,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x93000016, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -19771,21 +19771,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x94000001, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -19794,21 +19794,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x94000002, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -19817,21 +19817,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x94000003, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -19840,21 +19840,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x94000004, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -19863,21 +19863,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x94000005, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -19886,21 +19886,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x94000006, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -19909,21 +19909,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x94000015, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -19932,21 +19932,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x94000016, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -19955,21 +19955,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x95000001, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -19978,21 +19978,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x95000002, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -20001,21 +20001,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x95000003, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -20024,21 +20024,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x95000004, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -20047,21 +20047,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x95000005, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -20070,21 +20070,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x95000006, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -20093,21 +20093,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x95000015, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -20116,21 +20116,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x95000016, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -20139,21 +20139,21 @@ static const u32 rtw8822c_rf_a[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x000008C8, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x000008CB, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x000008CE, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x000008D1, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x000008D4, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000DD1, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0xA0000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000487, @@ -38484,21 +38484,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x93000002, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38507,21 +38507,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x93000003, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38530,21 +38530,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x93000004, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38553,21 +38553,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x93000005, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38576,21 +38576,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x93000006, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38599,21 +38599,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x93000015, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38622,21 +38622,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x93000016, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38645,21 +38645,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x94000001, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38668,21 +38668,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x94000002, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38691,21 +38691,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x94000003, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38714,21 +38714,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x94000004, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38737,21 +38737,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x94000005, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38760,21 +38760,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x94000006, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38783,21 +38783,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x94000015, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38806,21 +38806,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x94000016, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38829,21 +38829,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x95000001, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38852,21 +38852,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x95000002, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38875,21 +38875,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x95000003, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38898,21 +38898,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x95000004, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38921,21 +38921,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x95000005, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38944,21 +38944,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x95000006, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38967,21 +38967,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x95000015, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -38990,21 +38990,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0x95000016, 0x00000000, 0x40000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000467, @@ -39013,21 +39013,21 @@ static const u32 rtw8822c_rf_b[] = { 0x033, 0x00000062, 0x03F, 0x00000908, 0x033, 0x00000063, - 0x03F, 0x00000D09, + 0x03F, 0x00000CC6, 0x033, 0x00000064, - 0x03F, 0x00000D49, + 0x03F, 0x00000CC9, 0x033, 0x00000065, - 0x03F, 0x00000D8A, + 0x03F, 0x00000CCC, 0x033, 0x00000066, - 0x03F, 0x00000DEB, + 0x03F, 0x00000CCF, 0x033, 0x00000067, - 0x03F, 0x00000DEE, + 0x03F, 0x00000CD2, 0x033, 0x00000068, - 0x03F, 0x00000DF1, + 0x03F, 0x00000CD5, 0x033, 0x00000069, - 0x03F, 0x00000DF4, + 0x03F, 0x00000DD4, 0x033, 0x0000006A, - 0x03F, 0x00000DF7, + 0x03F, 0x00000DD7, 0xA0000000, 0x00000000, 0x033, 0x00000060, 0x03F, 0x00000487,

From: Íñigo Huguet ihuguet@redhat.com

[ Upstream commit 45423cff1db66cf0993e8a9bd0ac93e740149e49 ]

If pci_remove was called for a PF with VFs, the removal of the VFs was called twice from efx_ef10_sriov_fini: one directly with pci_driver->remove and another implicit by calling pci_disable_sriov, which also perform the VFs remove. This was leading to crashing the kernel on the second attempt.

Given that pci_disable_sriov already calls to pci remove function, get rid of the direct call to pci_driver->remove from the driver.

2 different ways to trigger the bug: - Create one or more VFs, then attach the PF to a virtual machine (at least with qemu/KVM) - Create one or more VFs, then remove the PF with: echo 1 > /sys/bus/pci/devices/PF_PCI_ID/remove

Removing sfc module does not trigger the error, at least for me, because it removes the VF first, and then the PF.

Example of a log with the error: list_del corruption, ffff967fd20a8ad0->next is LIST_POISON1 (dead000000000100) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:47! [...trimmed...] RIP: 0010:__list_del_entry_valid.cold.1+0x12/0x4c [...trimmed...] Call Trace: efx_dissociate+0x1f/0x140 [sfc] efx_pci_remove+0x27/0x150 [sfc] pci_device_remove+0x3b/0xc0 device_release_driver_internal+0x103/0x1f0 pci_stop_bus_device+0x69/0x90 pci_stop_and_remove_bus_device+0xe/0x20 pci_iov_remove_virtfn+0xba/0x120 sriov_disable+0x2f/0xe0 efx_ef10_pci_sriov_disable+0x52/0x80 [sfc] ? pcie_aer_is_native+0x12/0x40 efx_ef10_sriov_fini+0x72/0x110 [sfc] efx_pci_remove+0x62/0x150 [sfc] pci_device_remove+0x3b/0xc0 device_release_driver_internal+0x103/0x1f0 unbind_store+0xf6/0x130 kernfs_fop_write+0x116/0x190 vfs_write+0xa5/0x1a0 ksys_write+0x4f/0xb0 do_syscall_64+0x5b/0x1a0 entry_SYSCALL_64_after_hwframe+0x65/0xca

Signed-off-by: Íñigo Huguet ihuguet@redhat.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/sfc/ef10_sriov.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/drivers/net/ethernet/sfc/ef10_sriov.c b/drivers/net/ethernet/sfc/ef10_sriov.c index 21fa6c0e8873..a5d28b0f75ba 100644 --- a/drivers/net/ethernet/sfc/ef10_sriov.c +++ b/drivers/net/ethernet/sfc/ef10_sriov.c @@ -439,7 +439,6 @@ int efx_ef10_sriov_init(struct efx_nic *efx) void efx_ef10_sriov_fini(struct efx_nic *efx) { struct efx_ef10_nic_data *nic_data = efx->nic_data; - unsigned int i; int rc;

if (!nic_data->vf) { @@ -449,14 +448,7 @@ void efx_ef10_sriov_fini(struct efx_nic *efx) return; }

- /* Remove any VFs in the host */ - for (i = 0; i < efx->vf_count; ++i) { - struct efx_nic *vf_efx = nic_data->vf[i].efx; - - if (vf_efx) - vf_efx->pci_dev->driver->remove(vf_efx->pci_dev); - } - + /* Disable SRIOV and remove any VFs in the host */ rc = efx_ef10_pci_sriov_disable(efx, true); if (rc) netif_dbg(efx, drv, efx->net_dev,

From: Gustavo A. R. Silva gustavoars@kernel.org

[ Upstream commit e93bdd78406da9ed01554c51e38b2a02c8ef8025 ]

Fix the following out-of-bounds warning:

net/wireless/wext-spy.c:178:2: warning: 'memcpy' offset [25, 28] from the object at 'threshold' is out of the bounds of referenced subobject 'low' with type 'struct iw_quality' at offset 20 [-Warray-bounds]

The problem is that the original code is trying to copy data into a couple of struct members adjacent to each other in a single call to memcpy(). This causes a legitimate compiler warning because memcpy() overruns the length of &threshold.low and &spydata->spy_thr_low. As these are just a couple of struct members, fix this by using direct assignments, instead of memcpy().

This helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy().

Link: https://github.com/KSPP/linux/issues/109 Reported-by: kernel test robot lkp@intel.com Signed-off-by: Gustavo A. R. Silva gustavoars@kernel.org Reviewed-by: Kees Cook keescook@chromium.org Link: https://lore.kernel.org/r/20210422200032.GA168995@embeddedor Signed-off-by: Johannes Berg johannes.berg@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- net/wireless/wext-spy.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/net/wireless/wext-spy.c b/net/wireless/wext-spy.c index 33bef22e44e9..b379a0371653 100644 --- a/net/wireless/wext-spy.c +++ b/net/wireless/wext-spy.c @@ -120,8 +120,8 @@ int iw_handler_set_thrspy(struct net_device * dev, return -EOPNOTSUPP;

/* Just do it */ - memcpy(&(spydata->spy_thr_low), &(threshold->low), - 2 * sizeof(struct iw_quality)); + spydata->spy_thr_low = threshold->low; + spydata->spy_thr_high = threshold->high;

/* Clear flag */ memset(spydata->spy_thr_under, '\0', sizeof(spydata->spy_thr_under)); @@ -147,8 +147,8 @@ int iw_handler_get_thrspy(struct net_device * dev, return -EOPNOTSUPP;

/* Just do it */ - memcpy(&(threshold->low), &(spydata->spy_thr_low), - 2 * sizeof(struct iw_quality)); + threshold->low = spydata->spy_thr_low; + threshold->high = spydata->spy_thr_high;

return 0; } @@ -173,10 +173,10 @@ static void iw_send_thrspy_event(struct net_device * dev, memcpy(threshold.addr.sa_data, address, ETH_ALEN); threshold.addr.sa_family = ARPHRD_ETHER; /* Copy stats */ - memcpy(&(threshold.qual), wstats, sizeof(struct iw_quality)); + threshold.qual = *wstats; /* Copy also thresholds */ - memcpy(&(threshold.low), &(spydata->spy_thr_low), - 2 * sizeof(struct iw_quality)); + threshold.low = spydata->spy_thr_low; + threshold.high = spydata->spy_thr_high;

/* Send event to user space */ wireless_send_event(dev, SIOCGIWTHRSPY, &wrqu, (char *) &threshold);

From: Johannes Berg johannes.berg@intel.com

[ Upstream commit d656a4c6ead6c3f252b2f2532bc9735598f7e317 ]

If we have been keeping per-CPU statistics, consider them regardless of USES_RSS, because we may not actually fill those, for example in non-fast-RX cases when the connection is not compatible with fast-RX. If we didn't fill them, the additional data will be zero and not affect anything, and if we did fill them then it's more correct to consider them.

This fixes an issue in mesh mode where some statistics are not updated due to USES_RSS being set, but fast-RX isn't used.

Reported-by: Thiraviyam Mariyappan tmariyap@codeaurora.org Link: https://lore.kernel.org/r/20210610220814.13b35f5797c5.I511e9b33c5694e0d6cef4... Signed-off-by: Johannes Berg johannes.berg@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- net/mac80211/sta_info.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c index 13250cadb420..e18c3855f616 100644 --- a/net/mac80211/sta_info.c +++ b/net/mac80211/sta_info.c @@ -2088,10 +2088,9 @@ static struct ieee80211_sta_rx_stats * sta_get_last_rx_stats(struct sta_info *sta) { struct ieee80211_sta_rx_stats *stats = &sta->rx_stats; - struct ieee80211_local *local = sta->local; int cpu;

- if (!ieee80211_hw_check(&local->hw, USES_RSS)) + if (!sta->pcpu_rx_stats) return stats;

for_each_possible_cpu(cpu) { @@ -2191,9 +2190,7 @@ static void sta_set_tidstats(struct sta_info *sta, int cpu;

if (!(tidstats->filled & BIT(NL80211_TID_STATS_RX_MSDU))) { - if (!ieee80211_hw_check(&local->hw, USES_RSS)) - tidstats->rx_msdu += - sta_get_tidstats_msdu(&sta->rx_stats, tid); + tidstats->rx_msdu += sta_get_tidstats_msdu(&sta->rx_stats, tid);

if (sta->pcpu_rx_stats) { for_each_possible_cpu(cpu) { @@ -2272,7 +2269,6 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo, sinfo->rx_beacon = sdata->u.mgd.count_beacon_signal;

drv_sta_statistics(local, sdata, &sta->sta, sinfo); - sinfo->filled |= BIT_ULL(NL80211_STA_INFO_INACTIVE_TIME) | BIT_ULL(NL80211_STA_INFO_STA_FLAGS) | BIT_ULL(NL80211_STA_INFO_BSS_PARAM) | @@ -2307,8 +2303,7 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo,

if (!(sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES64) | BIT_ULL(NL80211_STA_INFO_RX_BYTES)))) { - if (!ieee80211_hw_check(&local->hw, USES_RSS)) - sinfo->rx_bytes += sta_get_stats_bytes(&sta->rx_stats); + sinfo->rx_bytes += sta_get_stats_bytes(&sta->rx_stats);

if (sta->pcpu_rx_stats) { for_each_possible_cpu(cpu) {

From: Ilan Peer ilan.peer@intel.com

[ Upstream commit 45daaa1318410794de956fb8e9d06aed2dbb23d0 ]

The following race was possible:

1. The device driver requests HW restart. 2. A scan is requested from user space and is propagated to the driver. During this flow HW_SCANNING flag is set. 3. The thread that handles the HW restart is scheduled, and before starting the actual reconfiguration it checks that HW_SCANNING is not set. The flow does so without acquiring any lock, and thus the WARN fires.

Fix this by checking that HW_SCANNING is on only after RTNL is acquired, i.e., user space scan request handling is no longer in transit.

Signed-off-by: Ilan Peer ilan.peer@intel.com Signed-off-by: Luca Coelho luciano.coelho@intel.com Link: https://lore.kernel.org/r/iwlwifi.20210618133832.8238ab3e19ab.I2693c581c7025... Signed-off-by: Johannes Berg johannes.berg@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- net/mac80211/main.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/net/mac80211/main.c b/net/mac80211/main.c index 9dd741b68f26..937a024a13e2 100644 --- a/net/mac80211/main.c +++ b/net/mac80211/main.c @@ -257,14 +257,13 @@ static void ieee80211_restart_work(struct work_struct *work) /* wait for scan work complete */ flush_workqueue(local->workqueue); flush_work(&local->sched_scan_stopped_work); + flush_work(&local->radar_detected_work); + + rtnl_lock();

WARN(test_bit(SCAN_HW_SCANNING, &local->scanning), "%s called with hardware scan in progress\n", __func__);

- flush_work(&local->radar_detected_work); - /* we might do interface manipulations, so need both */ - rtnl_lock(); - wiphy_lock(local->hw.wiphy); list_for_each_entry(sdata, &local->interfaces, list) { /* * XXX: there may be more work for other vif types and even

From: Sean Young sean@mess.org

[ Upstream commit 647d446d66e493d23ca1047fa8492b0269674530 ]

The syscall bpf(BPF_PROG_QUERY, &attr) should use the prog_cnt field to see how many entries user space provided and return ENOSPC if there are more programs than that. Before this patch, this is not checked and ENOSPC is never returned.

Note that one lirc device is limited to 64 bpf programs, and user space I'm aware of -- ir-keytable -- always gives enough space for 64 entries already. However, we should not copy program ids than are requested.

Signed-off-by: Sean Young sean@mess.org Signed-off-by: Daniel Borkmann daniel@iogearbox.net Link: https://lore.kernel.org/bpf/20210623213754.632-1-sean@mess.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/rc/bpf-lirc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/rc/bpf-lirc.c b/drivers/media/rc/bpf-lirc.c index 3fe3edd80876..afae0afe3f81 100644 --- a/drivers/media/rc/bpf-lirc.c +++ b/drivers/media/rc/bpf-lirc.c @@ -326,7 +326,8 @@ int lirc_prog_query(const union bpf_attr *attr, union bpf_attr __user *uattr) }

if (attr->query.prog_cnt != 0 && prog_ids && cnt) - ret = bpf_prog_array_copy_to_user(progs, prog_ids, cnt); + ret = bpf_prog_array_copy_to_user(progs, prog_ids, + attr->query.prog_cnt);

unlock: mutex_unlock(&ir_raw_handler_lock);

From: Jakub Kicinski kuba@kernel.org

[ Upstream commit 6d123b81ac615072a8525c13c6c41b695270a15d ]

Dave observed number of machines hitting OOM on the UDP send path. The workload seems to be sending large UDP packets over loopback. Since loopback has MTU of 64k kernel will try to allocate an skb with up to 64k of head space. This has a good chance of failing under memory pressure. What's worse if the message length is <32k the allocation may trigger an OOM killer.

This is entirely avoidable, we can use an skb with page frags.

af_unix solves a similar problem by limiting the head length to SKB_MAX_ALLOC. This seems like a good and simple approach. It means that UDP messages > 16kB will now use fragments if underlying device supports SG, if extra allocator pressure causes regressions in real workloads we can switch to trying the large allocation first and falling back.

v4: pre-calculate all the additions to alloclen so we can be sure it won't go over order-2

Reported-by: Dave Jones dsj@fb.com Signed-off-by: Jakub Kicinski kuba@kernel.org Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- net/ipv4/ip_output.c | 32 ++++++++++++++++++-------------- net/ipv6/ip6_output.c | 32 +++++++++++++++++--------------- 2 files changed, 35 insertions(+), 29 deletions(-)

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 3aab53beb4ea..3ec3b67c184f 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -1054,7 +1054,7 @@ static int __ip_append_data(struct sock *sk, unsigned int datalen; unsigned int fraglen; unsigned int fraggap; - unsigned int alloclen; + unsigned int alloclen, alloc_extra; unsigned int pagedlen; struct sk_buff *skb_prev; alloc_new_skb: @@ -1074,35 +1074,39 @@ alloc_new_skb: fraglen = datalen + fragheaderlen; pagedlen = 0;

+ alloc_extra = hh_len + 15; + alloc_extra += exthdrlen; + + /* The last fragment gets additional space at tail. + * Note, with MSG_MORE we overallocate on fragments, + * because we have no idea what fragment will be + * the last. + */ + if (datalen == length + fraggap) + alloc_extra += rt->dst.trailer_len; + if ((flags & MSG_MORE) && !(rt->dst.dev->features&NETIF_F_SG)) alloclen = mtu; - else if (!paged) + else if (!paged && + (fraglen + alloc_extra < SKB_MAX_ALLOC || + !(rt->dst.dev->features & NETIF_F_SG))) alloclen = fraglen; else { alloclen = min_t(int, fraglen, MAX_HEADER); pagedlen = fraglen - alloclen; }

- alloclen += exthdrlen; - - /* The last fragment gets additional space at tail. - * Note, with MSG_MORE we overallocate on fragments, - * because we have no idea what fragment will be - * the last. - */ - if (datalen == length + fraggap) - alloclen += rt->dst.trailer_len; + alloclen += alloc_extra;

if (transhdrlen) { - skb = sock_alloc_send_skb(sk, - alloclen + hh_len + 15, + skb = sock_alloc_send_skb(sk, alloclen, (flags & MSG_DONTWAIT), &err); } else { skb = NULL; if (refcount_read(&sk->sk_wmem_alloc) + wmem_alloc_delta <= 2 * sk->sk_sndbuf) - skb = alloc_skb(alloclen + hh_len + 15, + skb = alloc_skb(alloclen, sk->sk_allocation); if (unlikely(!skb)) err = -ENOBUFS; diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index ff4f9ebcf7f6..497974b4372a 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1555,7 +1555,7 @@ emsgsize: unsigned int datalen; unsigned int fraglen; unsigned int fraggap; - unsigned int alloclen; + unsigned int alloclen, alloc_extra; unsigned int pagedlen; alloc_new_skb: /* There's no room in the current skb */ @@ -1582,17 +1582,28 @@ alloc_new_skb: fraglen = datalen + fragheaderlen; pagedlen = 0;

+ alloc_extra = hh_len; + alloc_extra += dst_exthdrlen; + alloc_extra += rt->dst.trailer_len; + + /* We just reserve space for fragment header. + * Note: this may be overallocation if the message + * (without MSG_MORE) fits into the MTU. + */ + alloc_extra += sizeof(struct frag_hdr); + if ((flags & MSG_MORE) && !(rt->dst.dev->features&NETIF_F_SG)) alloclen = mtu; - else if (!paged) + else if (!paged && + (fraglen + alloc_extra < SKB_MAX_ALLOC || + !(rt->dst.dev->features & NETIF_F_SG))) alloclen = fraglen; else { alloclen = min_t(int, fraglen, MAX_HEADER); pagedlen = fraglen - alloclen; } - - alloclen += dst_exthdrlen; + alloclen += alloc_extra;

if (datalen != length + fraggap) { /* @@ -1602,30 +1613,21 @@ alloc_new_skb: datalen += rt->dst.trailer_len; }

- alloclen += rt->dst.trailer_len; fraglen = datalen + fragheaderlen;

- /* - * We just reserve space for fragment header. - * Note: this may be overallocation if the message - * (without MSG_MORE) fits into the MTU. - */ - alloclen += sizeof(struct frag_hdr); - copy = datalen - transhdrlen - fraggap - pagedlen; if (copy < 0) { err = -EINVAL; goto error; } if (transhdrlen) { - skb = sock_alloc_send_skb(sk, - alloclen + hh_len, + skb = sock_alloc_send_skb(sk, alloclen, (flags & MSG_DONTWAIT), &err); } else { skb = NULL; if (refcount_read(&sk->sk_wmem_alloc) + wmem_alloc_delta <= 2 * sk->sk_sndbuf) - skb = alloc_skb(alloclen + hh_len, + skb = alloc_skb(alloclen, sk->sk_allocation); if (unlikely(!skb)) err = -ENOBUFS;

From: mark-yw.chen mark-yw.chen@mediatek.com

[ Upstream commit 8454ed9ff9647e31e061fb5eb2e39ce79bc5e960 ]

This patch reduce in-token during download patch procedure. Don't submit urb for polling event before sending hci command.

Signed-off-by: mark-yw.chen mark-yw.chen@mediatek.com Signed-off-by: Marcel Holtmann marcel@holtmann.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/bluetooth/btusb.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index ddc7b86725cd..b3ba5a9dc5fc 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -3377,11 +3377,6 @@ static int btusb_mtk_hci_wmt_sync(struct hci_dev *hdev, struct btmtk_wmt_hdr *hdr; int err;

- /* Submit control IN URB on demand to process the WMT event */ - err = btusb_mtk_submit_wmt_recv_urb(hdev); - if (err < 0) - return err; - /* Send the WMT command and wait until the WMT event returns */ hlen = sizeof(*hdr) + wmt_params->dlen; if (hlen > 255) @@ -3407,6 +3402,11 @@ static int btusb_mtk_hci_wmt_sync(struct hci_dev *hdev, goto err_free_wc; }

+ /* Submit control IN URB on demand to process the WMT event */ + err = btusb_mtk_submit_wmt_recv_urb(hdev); + if (err < 0) + return err; + /* The vendor specific WMT commands are all answered by a vendor * specific event and will have the Command Status or Command * Complete as with usual HCI command flow control.

From: Kiran K kiran.k@intel.com

[ Upstream commit 06d213d8a89a6f55b708422c3dda2b22add10748 ]

For incoming SCO connection with transparent coding format, alt setting of CVSD is getting applied instead of Transparent.

Before fix: < HCI Command: Accept Synchron.. (0x01|0x0029) plen 21 #2196 [hci0] 321.342548 Address: 1C:CC:D6:E2:EA:80 (Xiaomi Communications Co Ltd) Transmit bandwidth: 8000 Receive bandwidth: 8000 Max latency: 13 Setting: 0x0003 Input Coding: Linear Input Data Format: 1's complement Input Sample Size: 8-bit # of bits padding at MSB: 0 Air Coding Format: Transparent Data Retransmission effort: Optimize for link quality (0x02) Packet type: 0x003f HV1 may be used HV2 may be used HV3 may be used EV3 may be used EV4 may be used EV5 may be used

HCI Event: Command Status (0x0f) plen 4 #2197 [hci0] 321.343585

Accept Synchronous Connection Request (0x01|0x0029) ncmd 1 Status: Success (0x00)

HCI Event: Synchronous Connect Comp.. (0x2c) plen 17 #2198 [hci0] 321.351666

Status: Success (0x00) Handle: 257 Address: 1C:CC:D6:E2:EA:80 (Xiaomi Communications Co Ltd) Link type: eSCO (0x02) Transmission interval: 0x0c Retransmission window: 0x04 RX packet length: 60 TX packet length: 60 Air mode: Transparent (0x03) ........

SCO Data RX: Handle 257 flags 0x00 dlen 48 #2336 [hci0] 321.383655

< SCO Data TX: Handle 257 flags 0x00 dlen 60 #2337 [hci0] 321.389558

SCO Data RX: Handle 257 flags 0x00 dlen 48 #2338 [hci0] 321.393615 SCO Data RX: Handle 257 flags 0x00 dlen 48 #2339 [hci0] 321.393618 SCO Data RX: Handle 257 flags 0x00 dlen 48 #2340 [hci0] 321.393618

< SCO Data TX: Handle 257 flags 0x00 dlen 60 #2341 [hci0] 321.397070

SCO Data RX: Handle 257 flags 0x00 dlen 48 #2342 [hci0] 321.403622 SCO Data RX: Handle 257 flags 0x00 dlen 48 #2343 [hci0] 321.403625 SCO Data RX: Handle 257 flags 0x00 dlen 48 #2344 [hci0] 321.403625 SCO Data RX: Handle 257 flags 0x00 dlen 48 #2345 [hci0] 321.403625

< SCO Data TX: Handle 257 flags 0x00 dlen 60 #2346 [hci0] 321.404569 < SCO Data TX: Handle 257 flags 0x00 dlen 60 #2347 [hci0] 321.412091

SCO Data RX: Handle 257 flags 0x00 dlen 48 #2348 [hci0] 321.413626 SCO Data RX: Handle 257 flags 0x00 dlen 48 #2349 [hci0] 321.413630 SCO Data RX: Handle 257 flags 0x00 dlen 48 #2350 [hci0] 321.413630

< SCO Data TX: Handle 257 flags 0x00 dlen 60 #2351 [hci0] 321.419674

After fix:

< HCI Command: Accept Synchronou.. (0x01|0x0029) plen 21 #309 [hci0] 49.439693 Address: 1C:CC:D6:E2:EA:80 (Xiaomi Communications Co Ltd) Transmit bandwidth: 8000 Receive bandwidth: 8000 Max latency: 13 Setting: 0x0003 Input Coding: Linear Input Data Format: 1's complement Input Sample Size: 8-bit # of bits padding at MSB: 0 Air Coding Format: Transparent Data Retransmission effort: Optimize for link quality (0x02) Packet type: 0x003f HV1 may be used HV2 may be used HV3 may be used EV3 may be used EV4 may be used EV5 may be used

HCI Event: Command Status (0x0f) plen 4 #310 [hci0] 49.440308

Accept Synchronous Connection Request (0x01|0x0029) ncmd 1 Status: Success (0x00)

HCI Event: Synchronous Connect Complete (0x2c) plen 17 #311 [hci0] 49.449308

Status: Success (0x00) Handle: 257 Address: 1C:CC:D6:E2:EA:80 (Xiaomi Communications Co Ltd) Link type: eSCO (0x02) Transmission interval: 0x0c Retransmission window: 0x04 RX packet length: 60 TX packet length: 60 Air mode: Transparent (0x03) < SCO Data TX: Handle 257 flags 0x00 dlen 60 #312 [hci0] 49.450421 < SCO Data TX: Handle 257 flags 0x00 dlen 60 #313 [hci0] 49.457927

HCI Event: Max Slots Change (0x1b) plen 3 #314 [hci0] 49.460345

Handle: 256 Max slots: 5 < SCO Data TX: Handle 257 flags 0x00 dlen 60 #315 [hci0] 49.465453

SCO Data RX: Handle 257 flags 0x00 dlen 60 #316 [hci0] 49.470502 SCO Data RX: Handle 257 flags 0x00 dlen 60 #317 [hci0] 49.470519

< SCO Data TX: Handle 257 flags 0x00 dlen 60 #318 [hci0] 49.472996

SCO Data RX: Handle 257 flags 0x00 dlen 60 #319 [hci0] 49.480412

< SCO Data TX: Handle 257 flags 0x00 dlen 60 #320 [hci0] 49.480492 < SCO Data TX: Handle 257 flags 0x00 dlen 60 #321 [hci0] 49.487989

SCO Data RX: Handle 257 flags 0x00 dlen 60 #322 [hci0] 49.490303

< SCO Data TX: Handle 257 flags 0x00 dlen 60 #323 [hci0] 49.495496

SCO Data RX: Handle 257 flags 0x00 dlen 60 #324 [hci0] 49.500304 SCO Data RX: Handle 257 flags 0x00 dlen 60 #325 [hci0] 49.500311

Signed-off-by: Kiran K kiran.k@intel.com Signed-off-by: Lokendra Singh lokendra.singh@intel.com Signed-off-by: Marcel Holtmann marcel@holtmann.org Signed-off-by: Sasha Levin sashal@kernel.org --- net/bluetooth/hci_event.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index c6f400b108d9..99c89f02a974 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -4379,12 +4379,12 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev,

bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);

- switch (conn->setting & SCO_AIRMODE_MASK) { - case SCO_AIRMODE_CVSD: + switch (ev->air_mode) { + case 0x02: if (hdev->notify) hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD); break; - case SCO_AIRMODE_TRANSP: + case 0x03: if (hdev->notify) hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP); break;

From: Daniel Lenski dlenski@gmail.com

[ Upstream commit 0324d19cb99804d99e42c990b8b1e191575a091b ]

This patch adds the 0cf3:e500 Bluetooth device (from a QCA9377 board) as a QCA_ROME device. It appears to be functionally identical to another device ID, also from a QCA9377 board, which was previously marked as QCA_ROME in 0a03f98b98c201191e3ba15a0e33f46d8660e1fd ("Bluetooth: Add a new 04ca:3015 QCA_ROME device").

Without this patch, the WiFi side of the QCA9377 board is slow or unusable when the Bluetooth side is in use.

See https://askubuntu.com/a/1137852 for another report of QCA_ROME fixing this issue for this device ID.

/sys/kernel/debug/usb/devices:

T: Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 D: Ver= 2.01 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0cf3 ProdID=e500 Rev= 0.01 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms

Signed-off-by: Daniel Lenski dlenski@gmail.com Signed-off-by: Marcel Holtmann marcel@holtmann.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/bluetooth/btusb.c | 2 ++ 1 file changed, 2 insertions(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index b3ba5a9dc5fc..12f05093c46d 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -270,6 +270,8 @@ static const struct usb_device_id blacklist_table[] = { BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME | BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0cf3, 0xe500), .driver_info = BTUSB_QCA_ROME | + BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME | BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x0489, 0xe09f), .driver_info = BTUSB_QCA_ROME |

From: Luiz Augusto von Dentz luiz.von.dentz@intel.com

[ Upstream commit de895b43932cb47e69480540be7eca289af24f23 ]

The use of l2cap_chan_del is not safe under a loop using list_for_each_entry.

Signed-off-by: Luiz Augusto von Dentz luiz.von.dentz@intel.com Signed-off-by: Marcel Holtmann marcel@holtmann.org Signed-off-by: Sasha Levin sashal@kernel.org --- net/bluetooth/l2cap_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 015f9ecadd0a..b1f4d5505bba 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -6062,7 +6062,7 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, struct l2cap_ecred_conn_rsp *rsp = (void *) data; struct hci_conn *hcon = conn->hcon; u16 mtu, mps, credits, result; - struct l2cap_chan *chan; + struct l2cap_chan *chan, *tmp; int err = 0, sec_level; int i = 0;

@@ -6081,7 +6081,7 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,

cmd_len -= sizeof(*rsp);

- list_for_each_entry(chan, &conn->chan_l, list) { + list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { u16 dcid;

if (chan->ident != cmd->ident ||

From: Tedd Ho-Jeong An tedd.an@intel.com

[ Upstream commit 02ce2c2c24024aade65a8d91d6a596651eaf2d0a ]

When the Get Device Flags command fails, it returns the error status with the parameters filled with the garbage values. Although the parameters are not used, it is better to fill with zero than the random values.

Signed-off-by: Tedd Ho-Jeong An tedd.an@intel.com Signed-off-by: Marcel Holtmann marcel@holtmann.org Signed-off-by: Sasha Levin sashal@kernel.org --- net/bluetooth/mgmt.c | 2 ++ 1 file changed, 2 insertions(+)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index 06e24b5e164d..b4f6773b1a5b 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -4056,6 +4056,8 @@ static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,

hci_dev_lock(hdev);

+ memset(&rp, 0, sizeof(rp)); + if (cp->addr.type == BDADDR_BREDR) { br_params = hci_bdaddr_list_lookup_with_flags(&hdev->whitelist, &cp->addr.bdaddr,

From: Tim Jiang tjiang@codeaurora.org

[ Upstream commit 4f00bfb372674d586c4a261bfc595cbce101fbb6 ]

This is btsoc timing issue, after host start to downloading bt firmware, ep2 need time to switch from function acl to function dfu, so host add 20ms delay as workaround.

Signed-off-by: Tim Jiang tjiang@codeaurora.org Signed-off-by: Marcel Holtmann marcel@holtmann.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/bluetooth/btusb.c | 5 +++++ 1 file changed, 5 insertions(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 64b0e68c68eb..a97e5c476adf 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -4136,6 +4136,11 @@ static int btusb_setup_qca_download_fw(struct hci_dev *hdev, sent += size; count -= size;

+ /* ep2 need time to switch from function acl to function dfu, + * so we add 20ms delay here. + */ + msleep(20); + while (count) { size = min_t(size_t, count, QCA_DFU_PACKET_LEN);

From: Rustam Kovhaev rkovhaev@gmail.com

[ Upstream commit ccff81e1d028bbbf8573d3364a87542386c707bf ]

kmemleak scans struct page, but it does not scan the page content. If we allocate some memory with kmalloc(), then allocate page with alloc_page(), and if we put kmalloc pointer somewhere inside that page, kmemleak will report kmalloc pointer as a false positive.

We can instruct kmemleak to scan the memory area by calling kmemleak_alloc() and kmemleak_free(), but part of struct bpf_ringbuf is mmaped to user space, and if struct bpf_ringbuf changes we would have to revisit and review size argument in kmemleak_alloc(), because we do not want kmemleak to scan the user space memory. Let's simplify things and use kmemleak_not_leak() here.

For posterity, also adding additional prior analysis from Andrii:

I think either kmemleak or syzbot are misreporting this. I've added a bunch of printks around all allocations performed by BPF ringbuf. [...] On repro side I get these two warnings:

[vmuser@archvm bpf]$ sudo ./repro BUG: memory leak unreferenced object 0xffff88810d538c00 (size 64): comm "repro", pid 2140, jiffies 4294692933 (age 14.540s) hex dump (first 32 bytes): 00 af 19 04 00 ea ff ff c0 ae 19 04 00 ea ff ff ................ 80 ae 19 04 00 ea ff ff c0 29 2e 04 00 ea ff ff .........)...... backtrace: [<0000000077bfbfbd>] __bpf_map_area_alloc+0x31/0xc0 [<00000000587fa522>] ringbuf_map_alloc.cold.4+0x48/0x218 [<0000000044d49e96>] __do_sys_bpf+0x359/0x1d90 [<00000000f601d565>] do_syscall_64+0x2d/0x40 [<0000000043d3112a>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak unreferenced object 0xffff88810d538c80 (size 64): comm "repro", pid 2143, jiffies 4294699025 (age 8.448s) hex dump (first 32 bytes): 80 aa 19 04 00 ea ff ff 00 ab 19 04 00 ea ff ff ................ c0 ab 19 04 00 ea ff ff 80 44 28 04 00 ea ff ff .........D(..... backtrace: [<0000000077bfbfbd>] __bpf_map_area_alloc+0x31/0xc0 [<00000000587fa522>] ringbuf_map_alloc.cold.4+0x48/0x218 [<0000000044d49e96>] __do_sys_bpf+0x359/0x1d90 [<00000000f601d565>] do_syscall_64+0x2d/0x40 [<0000000043d3112a>] entry_SYSCALL_64_after_hwframe+0x44/0xae

Note that both reported leaks (ffff88810d538c80 and ffff88810d538c00) correspond to pages array bpf_ringbuf is allocating and tracking properly internally. Note also that syzbot repro doesn't close FD of created BPF ringbufs, and even when ./repro itself exits with error, there are still two forked processes hanging around in my system. So clearly ringbuf maps are alive at that point. So reporting any memory leak looks weird at that point, because that memory is being used by active referenced BPF ringbuf.

It's also a question why repro doesn't clean up its forks. But if I do a `pkill repro`, I do see that all the allocated memory is /properly/ cleaned up [and the] "leaks" are deallocated properly.

BTW, if I add close() right after bpf() syscall in syzbot repro, I see that everything is immediately deallocated, like designed. And no memory leak is reported. So I don't think the problem is anywhere in bpf_ringbuf code, rather in the leak detection and/or repro itself.

Reported-by: syzbot+5d895828587f49e7fe9b@syzkaller.appspotmail.com Signed-off-by: Rustam Kovhaev rkovhaev@gmail.com [ Daniel: also included analysis from Andrii to the commit log ] Signed-off-by: Daniel Borkmann daniel@iogearbox.net Tested-by: syzbot+5d895828587f49e7fe9b@syzkaller.appspotmail.com Cc: Dmitry Vyukov dvyukov@google.com Cc: Andrii Nakryiko andrii@kernel.org Link: https://lore.kernel.org/bpf/CAEf4BzYk+dqs+jwu6VKXP-RttcTEGFe+ySTGWT9CRNkagDi... Link: https://lore.kernel.org/lkml/YNTAqiE7CWJhOK2M@nuc10 Link: https://lore.kernel.org/lkml/20210615101515.GC26027@arm.com Link: https://syzkaller.appspot.com/bug?extid=5d895828587f49e7fe9b Link: https://lore.kernel.org/bpf/20210626181156.1873604-1-rkovhaev@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/bpf/ringbuf.c | 2 ++ 1 file changed, 2 insertions(+)

diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c index 84b3b35fc0d0..9e0c10c6892a 100644 --- a/kernel/bpf/ringbuf.c +++ b/kernel/bpf/ringbuf.c @@ -8,6 +8,7 @@ #include <linux/vmalloc.h> #include <linux/wait.h> #include <linux/poll.h> +#include <linux/kmemleak.h> #include <uapi/linux/btf.h>

#define RINGBUF_CREATE_FLAG_MASK (BPF_F_NUMA_NODE) @@ -105,6 +106,7 @@ static struct bpf_ringbuf *bpf_ringbuf_area_alloc(size_t data_sz, int numa_node) rb = vmap(pages, nr_meta_pages + 2 * nr_data_pages, VM_ALLOC | VM_USERMAP, PAGE_KERNEL); if (rb) { + kmemleak_not_leak(pages); rb->pages = pages; rb->nr_pages = nr_pages; return rb;

From: Marcelo Ricardo Leitner marcelo.leitner@gmail.com

[ Upstream commit 0c5dc070ff3d6246d22ddd931f23a6266249e3db ]

Ilja reported that, simply putting it, nothing was validating that from_addr_param functions were operating on initialized memory. That is, the parameter itself was being validated by sctp_walk_params, but it doesn't check for types and their specific sizes and it could be a 0-length one, causing from_addr_param to potentially work over the next parameter or even uninitialized memory.

The fix here is to, in all calls to from_addr_param, check if enough space is there for the wanted IP address type.

Reported-by: Ilja Van Sprundel ivansprundel@ioactive.com Signed-off-by: Marcelo Ricardo Leitner marcelo.leitner@gmail.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- include/net/sctp/structs.h | 2 +- net/sctp/bind_addr.c | 19 +++++++++++-------- net/sctp/input.c | 6 ++++-- net/sctp/ipv6.c | 7 ++++++- net/sctp/protocol.c | 7 ++++++- net/sctp/sm_make_chunk.c | 29 ++++++++++++++++------------- 6 files changed, 44 insertions(+), 26 deletions(-)

diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h index 1aa585216f34..d49593c72a55 100644 --- a/include/net/sctp/structs.h +++ b/include/net/sctp/structs.h @@ -461,7 +461,7 @@ struct sctp_af { int saddr); void (*from_sk) (union sctp_addr *, struct sock *sk); - void (*from_addr_param) (union sctp_addr *, + bool (*from_addr_param) (union sctp_addr *, union sctp_addr_param *, __be16 port, int iif); int (*to_addr_param) (const union sctp_addr *, diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c index 53e5ed79f63f..59e653b528b1 100644 --- a/net/sctp/bind_addr.c +++ b/net/sctp/bind_addr.c @@ -270,22 +270,19 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list, rawaddr = (union sctp_addr_param *)raw_addr_list;

af = sctp_get_af_specific(param_type2af(param->type)); - if (unlikely(!af)) { + if (unlikely(!af) || + !af->from_addr_param(&addr, rawaddr, htons(port), 0)) { retval = -EINVAL; - sctp_bind_addr_clean(bp); - break; + goto out_err; }

- af->from_addr_param(&addr, rawaddr, htons(port), 0); if (sctp_bind_addr_state(bp, &addr) != -1) goto next; retval = sctp_add_bind_addr(bp, &addr, sizeof(addr), SCTP_ADDR_SRC, gfp); - if (retval) { + if (retval) /* Can't finish building the list, clean up. */ - sctp_bind_addr_clean(bp); - break; - } + goto out_err;

next: len = ntohs(param->length); @@ -294,6 +291,12 @@ next: }

return retval; + +out_err: + if (retval) + sctp_bind_addr_clean(bp); + + return retval; }

/******************************************************************** diff --git a/net/sctp/input.c b/net/sctp/input.c index d508f6f3dd08..8924e2e142c8 100644 --- a/net/sctp/input.c +++ b/net/sctp/input.c @@ -1131,7 +1131,8 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct net *net, if (!af) continue;

- af->from_addr_param(paddr, params.addr, sh->source, 0); + if (!af->from_addr_param(paddr, params.addr, sh->source, 0)) + continue;

asoc = __sctp_lookup_association(net, laddr, paddr, transportp); if (asoc) @@ -1174,7 +1175,8 @@ static struct sctp_association *__sctp_rcv_asconf_lookup( if (unlikely(!af)) return NULL;

- af->from_addr_param(&paddr, param, peer_port, 0); + if (af->from_addr_param(&paddr, param, peer_port, 0)) + return NULL;

return __sctp_lookup_association(net, laddr, &paddr, transportp); } diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c index bd08807c9e44..5c6f5ced9cfa 100644 --- a/net/sctp/ipv6.c +++ b/net/sctp/ipv6.c @@ -551,15 +551,20 @@ static void sctp_v6_to_sk_daddr(union sctp_addr *addr, struct sock *sk) }

/* Initialize a sctp_addr from an address parameter. */ -static void sctp_v6_from_addr_param(union sctp_addr *addr, +static bool sctp_v6_from_addr_param(union sctp_addr *addr, union sctp_addr_param *param, __be16 port, int iif) { + if (ntohs(param->v6.param_hdr.length) < sizeof(struct sctp_ipv6addr_param)) + return false; + addr->v6.sin6_family = AF_INET6; addr->v6.sin6_port = port; addr->v6.sin6_flowinfo = 0; /* BUG */ addr->v6.sin6_addr = param->v6.addr; addr->v6.sin6_scope_id = iif; + + return true; }

/* Initialize an address parameter from a sctp_addr and return the length diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c index 6f2bbfeec3a4..25192b378e2e 100644 --- a/net/sctp/protocol.c +++ b/net/sctp/protocol.c @@ -254,14 +254,19 @@ static void sctp_v4_to_sk_daddr(union sctp_addr *addr, struct sock *sk) }

/* Initialize a sctp_addr from an address parameter. */ -static void sctp_v4_from_addr_param(union sctp_addr *addr, +static bool sctp_v4_from_addr_param(union sctp_addr *addr, union sctp_addr_param *param, __be16 port, int iif) { + if (ntohs(param->v4.param_hdr.length) < sizeof(struct sctp_ipv4addr_param)) + return false; + addr->v4.sin_family = AF_INET; addr->v4.sin_port = port; addr->v4.sin_addr.s_addr = param->v4.addr.s_addr; memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); + + return true; }

/* Initialize an address parameter from a sctp_addr and return the length diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c index da4ce0947c3a..1fdbde6f07b8 100644 --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -2350,11 +2350,13 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,

/* Process the initialization parameters. */ sctp_walk_params(param, peer_init, init_hdr.params) { - if (!src_match && (param.p->type == SCTP_PARAM_IPV4_ADDRESS || - param.p->type == SCTP_PARAM_IPV6_ADDRESS)) { + if (!src_match && + (param.p->type == SCTP_PARAM_IPV4_ADDRESS || + param.p->type == SCTP_PARAM_IPV6_ADDRESS)) { af = sctp_get_af_specific(param_type2af(param.p->type)); - af->from_addr_param(&addr, param.addr, - chunk->sctp_hdr->source, 0); + if (!af->from_addr_param(&addr, param.addr, + chunk->sctp_hdr->source, 0)) + continue; if (sctp_cmp_addr_exact(sctp_source(chunk), &addr)) src_match = 1; } @@ -2535,7 +2537,8 @@ static int sctp_process_param(struct sctp_association *asoc, break; do_addr_param: af = sctp_get_af_specific(param_type2af(param.p->type)); - af->from_addr_param(&addr, param.addr, htons(asoc->peer.port), 0); + if (!af->from_addr_param(&addr, param.addr, htons(asoc->peer.port), 0)) + break; scope = sctp_scope(peer_addr); if (sctp_in_scope(net, &addr, scope)) if (!sctp_assoc_add_peer(asoc, &addr, gfp, SCTP_UNCONFIRMED)) @@ -2636,15 +2639,13 @@ do_addr_param: addr_param = param.v + sizeof(struct sctp_addip_param);

af = sctp_get_af_specific(param_type2af(addr_param->p.type)); - if (af == NULL) + if (!af) break;

- af->from_addr_param(&addr, addr_param, - htons(asoc->peer.port), 0); + if (!af->from_addr_param(&addr, addr_param, + htons(asoc->peer.port), 0)) + break;

- /* if the address is invalid, we can't process it. - * XXX: see spec for what to do. - */ if (!af->addr_valid(&addr, NULL, NULL)) break;

@@ -3058,7 +3059,8 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc, if (unlikely(!af)) return SCTP_ERROR_DNS_FAILED;

- af->from_addr_param(&addr, addr_param, htons(asoc->peer.port), 0); + if (!af->from_addr_param(&addr, addr_param, htons(asoc->peer.port), 0)) + return SCTP_ERROR_DNS_FAILED;

/* ADDIP 4.2.1 This parameter MUST NOT contain a broadcast * or multicast address. @@ -3335,7 +3337,8 @@ static void sctp_asconf_param_success(struct sctp_association *asoc,

/* We have checked the packet before, so we do not check again. */ af = sctp_get_af_specific(param_type2af(addr_param->p.type)); - af->from_addr_param(&addr, addr_param, htons(bp->port), 0); + if (!af->from_addr_param(&addr, addr_param, htons(bp->port), 0)) + return;

switch (asconf_param->param_hdr.type) { case SCTP_PARAM_ADD_IP:

From: zhanglianjie zhanglianjie@uniontech.com

[ Upstream commit 6817c944430d00f71ccaa9c99ff5b0096aeb7873 ]

The cause of the problem is as follows: 1. when cat /sys/devices/system/memory/memory0/valid_zones, test_pages_in_a_zone() will be called. 2. test_pages_in_a_zone() finds the zone according to stat_pfn = 0. The smallest pfn of the numa node in the mips architecture is 128, and the page corresponding to the previous 0~127 pfn is not initialized (page->flags is 0xFFFFFFFF) 3. The nid and zonenum obtained using page_zone(pfn_to_page(0)) are out of bounds in the corresponding array, &NODE_DATA(page_to_nid(page))->node_zones[page_zonenum(page)], access to the out-of-bounds zone member variables appear abnormal, resulting in Oops. Therefore, it is necessary to keep the page between 0 and the minimum pfn to prevent Oops from appearing.

Signed-off-by: zhanglianjie zhanglianjie@uniontech.com Signed-off-by: Thomas Bogendoerfer tsbogend@alpha.franken.de Signed-off-by: Sasha Levin sashal@kernel.org --- arch/mips/loongson64/numa.c | 3 +++ 1 file changed, 3 insertions(+)

diff --git a/arch/mips/loongson64/numa.c b/arch/mips/loongson64/numa.c index a8f57bf01285..a791863ed352 100644 --- a/arch/mips/loongson64/numa.c +++ b/arch/mips/loongson64/numa.c @@ -118,6 +118,9 @@ static void __init node_mem_init(unsigned int node) if (node_end_pfn(0) >= (0xffffffff >> PAGE_SHIFT)) memblock_reserve((node_addrspace_offset | 0xfe000000), 32 << 20); + + /* Reserve pfn range 0~node[0]->node_start_pfn */ + memblock_reserve(0, PAGE_SIZE * start_pfn); } }

From: 周琰杰 (Zhou Yanjie) zhouyanjie@wanyeetech.com

[ Upstream commit 23c64447b3538a6f34cb38aae3bc19dc1ec53436 ]

The original clock (3 MHz) is too fast for the clocksource, there will be a chance that the system may get stuck.

Reported-by: Nikolaus Schaller hns@goldelico.com Tested-by: Nikolaus Schaller hns@goldelico.com # on CI20 Signed-off-by: 周琰杰 (Zhou Yanjie) zhouyanjie@wanyeetech.com Acked-by: Paul Cercueil paul@crapouillou.net Signed-off-by: Thomas Bogendoerfer tsbogend@alpha.franken.de Signed-off-by: Sasha Levin sashal@kernel.org --- arch/mips/boot/dts/ingenic/ci20.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/mips/boot/dts/ingenic/ci20.dts b/arch/mips/boot/dts/ingenic/ci20.dts index 8877c62609de..3a4eaf1f3f48 100644 --- a/arch/mips/boot/dts/ingenic/ci20.dts +++ b/arch/mips/boot/dts/ingenic/ci20.dts @@ -525,10 +525,10 @@

&tcu { /* - * 750 kHz for the system timer and 3 MHz for the clocksource, + * 750 kHz for the system timer and clocksource, * use channel #0 for the system timer, #1 for the clocksource. */ assigned-clocks = <&tcu TCU_CLK_TIMER0>, <&tcu TCU_CLK_TIMER1>, <&tcu TCU_CLK_OST>; - assigned-clock-rates = <750000>, <3000000>, <3000000>; + assigned-clock-rates = <750000>, <750000>, <3000000>; };

From: Xiaochen Shen xiaochen.shen@intel.com

commit 1421ec684a43379b2aa3cfda20b03d38282dc990 upstream.

Resctrl test suite accepts command line argument "-t" to specify the unit tests to run in the test list (e.g., -t mbm,mba,cmt,cat) as documented in the help.

When calling strtok() to parse the option, the incorrect delimiters argument ":\t" is used. As a result, passing "-t mbm,mba,cmt,cat" throws an invalid option error.

Fix this by using delimiters argument "," instead of ":\t" for parsing of unit tests list. At the same time, remove the unnecessary "spaces" between the unit tests in help documentation to prevent confusion.

Fixes: 790bf585b0ee ("selftests/resctrl: Add Cache Allocation Technology (CAT) selftest") Fixes: 78941183d1b1 ("selftests/resctrl: Add Cache QoS Monitoring (CQM) selftest") Fixes: ecdbb911f22d ("selftests/resctrl: Add MBM test") Fixes: 034c7678dd2c ("selftests/resctrl: Add README for resctrl tests") Cc: stable@vger.kernel.org Signed-off-by: Xiaochen Shen xiaochen.shen@intel.com Reviewed-by: Tony Luck tony.luck@intel.com Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org

--- tools/testing/selftests/resctrl/README | 2 +- tools/testing/selftests/resctrl/resctrl_tests.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)

--- a/tools/testing/selftests/resctrl/README +++ b/tools/testing/selftests/resctrl/README @@ -47,7 +47,7 @@ Parameter '-h' shows usage information.

usage: resctrl_tests [-h] [-b "benchmark_cmd [options]"] [-t test list] [-n no_of_bits] -b benchmark_cmd [options]: run specified benchmark for MBM, MBA and CQM default benchmark is builtin fill_buf - -t test list: run tests specified in the test list, e.g. -t mbm, mba, cqm, cat + -t test list: run tests specified in the test list, e.g. -t mbm,mba,cqm,cat -n no_of_bits: run cache tests using specified no of bits in cache bit mask -p cpu_no: specify CPU number to run the test. 1 is default -h: help --- a/tools/testing/selftests/resctrl/resctrl_tests.c +++ b/tools/testing/selftests/resctrl/resctrl_tests.c @@ -40,7 +40,7 @@ static void cmd_help(void) printf("\t-b benchmark_cmd [options]: run specified benchmark for MBM, MBA and CQM"); printf("\t default benchmark is builtin fill_buf\n"); printf("\t-t test list: run tests specified in the test list, "); - printf("e.g. -t mbm, mba, cqm, cat\n"); + printf("e.g. -t mbm,mba,cqm,cat\n"); printf("\t-n no_of_bits: run cache tests using specified no of bits in cache bit mask\n"); printf("\t-p cpu_no: specify CPU number to run the test. 1 is default\n"); printf("\t-h: help\n"); @@ -98,7 +98,7 @@ int main(int argc, char **argv)

return -1; } - token = strtok(NULL, ":\t"); + token = strtok(NULL, ","); } break; case 'p':

From: Aneesh Kumar K.V aneesh.kumar@linux.ibm.com

commit 97113eb39fa7972722ff490b947d8af023e1f6a2 upstream.

To avoid a race between rmap walk and mremap, mremap does take_rmap_locks(). The lock was taken to ensure that rmap walk don't miss a page table entry due to PTE moves via move_pagetables(). The kernel does further optimization of this lock such that if we are going to find the newly added vma after the old vma, the rmap lock is not taken. This is because rmap walk would find the vmas in the same order and if we don't find the page table attached to older vma we would find it with the new vma which we would iterate later.

As explained in commit eb66ae030829 ("mremap: properly flush TLB before releasing the page") mremap is special in that it doesn't take ownership of the page. The optimized version for PUD/PMD aligned mremap also doesn't hold the ptl lock. This can result in stale TLB entries as show below.

This patch updates the rmap locking requirement in mremap to handle the race condition explained below with optimized mremap::

Optmized PMD move

CPU 1 CPU 2 CPU 3

mremap(old_addr, new_addr) page_shrinker/try_to_unmap_one

mmap_write_lock_killable()

addr = old_addr lock(pte_ptl) lock(pmd_ptl) pmd = *old_pmd pmd_clear(old_pmd) flush_tlb_range(old_addr)

*new_pmd = pmd *new_addr = 10; and fills TLB with new addr and old pfn

unlock(pmd_ptl) ptep_clear_flush() old pfn is free. Stale TLB entry

Optimized PUD move also suffers from a similar race. Both the above race condition can be fixed if we force mremap path to take rmap lock.

Link: https://lkml.kernel.org/r/20210616045239.370802-7-aneesh.kumar@linux.ibm.com Fixes: 2c91bd4a4e2e ("mm: speed up mremap by 20x on large regions") Fixes: c49dd3401802 ("mm: speedup mremap on 1GB or larger regions") Link: https://lore.kernel.org/linux-mm/CAHk-=wgXVR04eBNtxQfevontWnP6FDm+oj5vauQXP3... Signed-off-by: Aneesh Kumar K.V aneesh.kumar@linux.ibm.com Acked-by: Hugh Dickins hughd@google.com Acked-by: Kirill A. Shutemov kirill.shutemov@linux.intel.com Cc: Christophe Leroy christophe.leroy@csgroup.eu Cc: Joel Fernandes joel@joelfernandes.org Cc: Kalesh Singh kaleshsingh@google.com Cc: Kirill A. Shutemov kirill@shutemov.name Cc: Michael Ellerman mpe@ellerman.id.au Cc: Nicholas Piggin npiggin@gmail.com Cc: Stephen Rothwell sfr@canb.auug.org.au Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Linus Torvalds torvalds@linux-foundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org

--- mm/mremap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/mm/mremap.c +++ b/mm/mremap.c @@ -439,7 +439,7 @@ unsigned long move_page_tables(struct vm if (!new_pud) break; if (move_pgt_entry(NORMAL_PUD, vma, old_addr, new_addr, - old_pud, new_pud, need_rmap_locks)) + old_pud, new_pud, true)) continue; }

@@ -466,7 +466,7 @@ unsigned long move_page_tables(struct vm * moving at the PMD level if possible. */ if (move_pgt_entry(NORMAL_PMD, vma, old_addr, new_addr, - old_pmd, new_pmd, need_rmap_locks)) + old_pmd, new_pmd, true)) continue; }

From: Nathan Chancellor nathan@kernel.org

commit 015d98149b326e0f1f02e44413112ca8b4330543 upstream.

A change in clang 13 results in the __lwsync macro being defined as __builtin_ppc_lwsync, which emits 'lwsync' or 'msync' depending on what the target supports. This breaks the build because of -Werror in arch/powerpc, along with thousands of warnings:

In file included from arch/powerpc/kernel/pmc.c:12: In file included from include/linux/bug.h:5: In file included from arch/powerpc/include/asm/bug.h:109: In file included from include/asm-generic/bug.h:20: In file included from include/linux/kernel.h:12: In file included from include/linux/bitops.h:32: In file included from arch/powerpc/include/asm/bitops.h:62: arch/powerpc/include/asm/barrier.h:49:9: error: '__lwsync' macro redefined [-Werror,-Wmacro-redefined] #define __lwsync() __asm__ __volatile__ (stringify_in_c(LWSYNC) : : :"memory") ^ <built-in>:308:9: note: previous definition is here #define __lwsync __builtin_ppc_lwsync ^ 1 error generated.

Undefine this macro so that the runtime patching introduced by commit 2d1b2027626d ("powerpc: Fixup lwsync at runtime") continues to work properly with clang and the build no longer breaks.

Cc: stable@vger.kernel.org Signed-off-by: Nathan Chancellor nathan@kernel.org Reviewed-by: Nick Desaulniers ndesaulniers@google.com Signed-off-by: Michael Ellerman mpe@ellerman.id.au Link: https://github.com/ClangBuiltLinux/linux/issues/1386 Link: https://github.com/llvm/llvm-project/commit/62b5df7fe2b3fda1772befeda15598fb... Link: https://lore.kernel.org/r/20210528182752.1852002-1-nathan@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org

--- arch/powerpc/include/asm/barrier.h | 2 ++ 1 file changed, 2 insertions(+)

--- a/arch/powerpc/include/asm/barrier.h +++ b/arch/powerpc/include/asm/barrier.h @@ -46,6 +46,8 @@ # define SMPWMB eieio #endif

+/* clang defines this macro for a builtin, which will not work with runtime patching */ +#undef __lwsync #define __lwsync() __asm__ __volatile__ (stringify_in_c(LWSYNC) : : :"memory") #define dma_rmb() __lwsync() #define dma_wmb() __asm__ __volatile__ (stringify_in_c(SMPWMB) : : :"memory")

From: Alex Deucher alexander.deucher@amd.com

commit 06ac9b6c736ac9da600b1782d7ac6d6e746286c4 upstream.

Add new PCI device id.

Reviewed-by: Guchun Chen guchun.chen@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org

--- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 + 1 file changed, 1 insertion(+)

--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c @@ -1123,6 +1123,7 @@ static const struct pci_device_id pciidl {0x1002, 0x73E0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_DIMGREY_CAVEFISH}, {0x1002, 0x73E1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_DIMGREY_CAVEFISH}, {0x1002, 0x73E2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_DIMGREY_CAVEFISH}, + {0x1002, 0x73E3, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_DIMGREY_CAVEFISH}, {0x1002, 0x73FF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_DIMGREY_CAVEFISH},

{0, 0, 0}

From: Aaron Liu aaron.liu@amd.com

commit e2329e74a615cc58b25c42b7aa1477a5e3f6a435 upstream.

Without driver loaded, SDMA0_UTCL1_PAGE.TMZ_ENABLE is set to 1 by default for all asic. On Raven/Renoir, the sdma goldsetting changes SDMA0_UTCL1_PAGE.TMZ_ENABLE to 0. This patch restores SDMA0_UTCL1_PAGE.TMZ_ENABLE to 1.

Signed-off-by: Aaron Liu aaron.liu@amd.com Acked-by: Luben Tuikov luben.tuikov@amd.com Acked-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org

--- drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c @@ -142,7 +142,7 @@ static const struct soc15_reg_golden gol SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC0_RB_WPTR_POLL_CNTL, 0xfffffff7, 0x00403000), SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC1_IB_CNTL, 0x800f0111, 0x00000100), SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC1_RB_WPTR_POLL_CNTL, 0xfffffff7, 0x00403000), - SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_PAGE, 0x000003ff, 0x000003c0), + SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_PAGE, 0x000003ff, 0x000003e0), SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_WATERMK, 0xfc000000, 0x00000000) };

@@ -268,7 +268,7 @@ static const struct soc15_reg_golden gol SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_POWER_CNTL, 0x003fff07, 0x40000051), SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC0_RB_WPTR_POLL_CNTL, 0xfffffff7, 0x00403000), SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC1_RB_WPTR_POLL_CNTL, 0xfffffff7, 0x00403000), - SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_PAGE, 0x000003ff, 0x000003c0), + SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_PAGE, 0x000003ff, 0x000003e0), SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_WATERMK, 0xfc000000, 0x03fbe1fe) };