1. 03 Sep, 2024 1 commit
    • Kalle Valo's avatar
      Merge tag 'ath-current-20240903' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath · e88b9ed3
      Kalle Valo authored
      ath.git patches for v6.11-rc7
      
      We have three patch which address two issues in the ath11k driver
      which should be addressed for 6.11-rc7:
      
      One patch fixes a NULL pointer dereference while parsing transmit
      power envelope (TPE) information, and the other two patches revert the
      hibernation support since it is interfering with suspend on some
      platforms. Note the cause of the suspend wakeups is still being
      investigated, and it is hoped this can be addressed and hibernation
      support can be restored in the near future.
      e88b9ed3
  2. 02 Sep, 2024 2 commits
  3. 27 Aug, 2024 2 commits
  4. 26 Aug, 2024 11 commits
  5. 22 Aug, 2024 1 commit
    • Baochen Qiang's avatar
      wifi: ath11k: fix NULL pointer dereference in ath11k_mac_get_eirp_power() · 9abf1999
      Baochen Qiang authored
      Commit 39dc8b8e ("wifi: mac80211: pass parsed TPE data to drivers") breaks
      ath11k, leading to kernel crash:
      
      BUG: kernel NULL pointer dereference, address: 0000000000000018
      RIP: 0010:ath11k_mac_get_eirp_power.isra.0+0x5b/0x80 [ath11k]
      Call Trace:
       <TASK>
       ath11k_mac_fill_reg_tpc_info+0x3d6/0x800 [ath11k]
       ath11k_mac_vdev_start_restart+0x412/0x4d0 [ath11k]
       ath11k_mac_op_sta_state+0x7bc/0xbb0 [ath11k]
       drv_sta_state+0xf1/0x5f0 [mac80211]
       sta_info_insert_rcu+0x28d/0x530 [mac80211]
       sta_info_insert+0xf/0x20 [mac80211]
       ieee80211_prep_connection+0x3b4/0x4c0 [mac80211]
       ieee80211_mgd_auth+0x363/0x600 [mac80211]
      
      The issue scenario is, AP advertises power spectral density (PSD) values in its
      transmit power envelope (TPE) IE and supports 160 MHz bandwidth in 6 GHz. When
      connecting to this AP, in ath11k_mac_parse_tx_pwr_env(), the local variable
      psd is true and then reg_tpc_info.num_pwr_levels is set to 8 due to 160 MHz
      bandwidth. Note here ath11k fails to set reg_tpc_info.is_psd_power as TRUE due
      to above commit. Then in ath11k_mac_fill_reg_tpc_info(), for each of the 8
      power levels, for a PSD channel, ath11k_mac_get_psd_channel() is expected to
      be called to get required information. However due to invalid
      reg_tpc_info.is_psd_power, it is ath11k_mac_get_eirp_power() that gets called
      and passed with pwr_lvl_idx as one of the arguments. Note this function
      implicitly requires pwr_lvl_idx to be no more than 3. So when pwr_lvl_idx is
      larger than that ath11k_mac_get_seg_freq() returns invalid center frequency,
      with which as the input ieee80211_get_channel() returns NULL, then kernel
      crashes due to NULL pointer dereference.
      
      Fix it by setting reg_tpc_info.is_psd_power properly.
      
      Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30
      
      Fixes: 39dc8b8e ("wifi: mac80211: pass parsed TPE data to drivers")
      Reported-by: default avatarMikko Tiihonen <mikko.tiihonen@iki.fi>
      Tested-by: default avatarMikko Tiihonen <mikko.tiihonen@iki.fi>
      Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219131Signed-off-by: default avatarBaochen Qiang <quic_bqiang@quicinc.com>
      Acked-by: default avatarJeff Johnson <quic_jjohnson@quicinc.com>
      Signed-off-by: default avatarKalle Valo <quic_kvalo@quicinc.com>
      Link: https://patch.msgid.link/20240813083808.9224-1-quic_bqiang@quicinc.com
      9abf1999
  6. 16 Aug, 2024 1 commit
  7. 13 Aug, 2024 3 commits
  8. 10 Aug, 2024 1 commit
  9. 07 Aug, 2024 1 commit
  10. 05 Aug, 2024 1 commit
    • Baochen Qiang's avatar
      wifi: ath12k: use 128 bytes aligned iova in transmit path for WCN7850 · 38055789
      Baochen Qiang authored
      In transmit path, it is likely that the iova is not aligned to PCIe TLP
      max payload size, which is 128 for WCN7850. Normally in such cases hardware
      is expected to split the packet into several parts in a manner such that
      they, other than the first one, have aligned iova. However due to hardware
      limitations, WCN7850 does not behave like that properly with some specific
      unaligned iova in transmit path. This easily results in target hang in a
      KPI transmit test: packet send/receive failure, WMI command send timeout
      etc. Also fatal error seen in PCIe level:
      
      	...
      	Capabilities: ...
      		...
      		DevSta: ... FatalErr+ ...
      		...
      	...
      
      Work around this by manually moving/reallocating payload buffer such that
      we can map it to a 128 bytes aligned iova. The moving requires sufficient
      head room or tail room in skb: for the former we can do ourselves a favor
      by asking some extra bytes when registering with mac80211, while for the
      latter we can do nothing.
      
      Moving/reallocating buffer consumes additional CPU cycles, but the good news
      is that an aligned iova increases PCIe efficiency. In my tests on some X86
      platforms the KPI results are almost consistent.
      
      Since this is seen only with WCN7850, add a new hardware parameter to
      differentiate from others.
      
      Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
      Signed-off-by: default avatarBaochen Qiang <quic_bqiang@quicinc.com>
      Cc: <stable@vger.kernel.org>
      Tested-by: default avatarMark Pearson <mpearson-lenovo@squebb.ca>
      Signed-off-by: default avatarKalle Valo <quic_kvalo@quicinc.com>
      Link: https://patch.msgid.link/20240715023814.20242-1-quic_bqiang@quicinc.com
      38055789
  11. 04 Aug, 2024 11 commits
    • Linus Torvalds's avatar
      Linux 6.11-rc2 · de9c2c66
      Linus Torvalds authored
      de9c2c66
    • Tetsuo Handa's avatar
      profiling: remove profile=sleep support · b88f5538
      Tetsuo Handa authored
      The kernel sleep profile is no longer working due to a recursive locking
      bug introduced by commit 42a20f86 ("sched: Add wrapper for get_wchan()
      to keep task blocked")
      
      Booting with the 'profile=sleep' kernel command line option added or
      executing
      
        # echo -n sleep > /sys/kernel/profiling
      
      after boot causes the system to lock up.
      
      Lockdep reports
      
        kthreadd/3 is trying to acquire lock:
        ffff93ac82e08d58 (&p->pi_lock){....}-{2:2}, at: get_wchan+0x32/0x70
      
        but task is already holding lock:
        ffff93ac82e08d58 (&p->pi_lock){....}-{2:2}, at: try_to_wake_up+0x53/0x370
      
      with the call trace being
      
         lock_acquire+0xc8/0x2f0
         get_wchan+0x32/0x70
         __update_stats_enqueue_sleeper+0x151/0x430
         enqueue_entity+0x4b0/0x520
         enqueue_task_fair+0x92/0x6b0
         ttwu_do_activate+0x73/0x140
         try_to_wake_up+0x213/0x370
         swake_up_locked+0x20/0x50
         complete+0x2f/0x40
         kthread+0xfb/0x180
      
      However, since nobody noticed this regression for more than two years,
      let's remove 'profile=sleep' support based on the assumption that nobody
      needs this functionality.
      
      Fixes: 42a20f86 ("sched: Add wrapper for get_wchan() to keep task blocked")
      Cc: stable@vger.kernel.org # v5.16+
      Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b88f5538
    • Linus Torvalds's avatar
      Merge tag 'x86-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · a5dbd76a
      Linus Torvalds authored
      Pull x86 fixes from Thomas Gleixner:
      
       - Prevent a deadlock on cpu_hotplug_lock in the aperf/mperf driver.
      
         A recent change in the ACPI code which consolidated code pathes moved
         the invocation of init_freq_invariance_cppc() to be moved to a CPU
         hotplug handler. The first invocation on AMD CPUs ends up enabling a
         static branch which dead locks because the static branch enable tries
         to acquire cpu_hotplug_lock but that lock is already held write by
         the hotplug machinery.
      
         Use static_branch_enable_cpuslocked() instead and take the hotplug
         lock read for the Intel code path which is invoked from the
         architecture code outside of the CPU hotplug operations.
      
       - Fix the number of reserved bits in the sev_config structure bit field
         so that the bitfield does not exceed 64 bit.
      
       - Add missing Zen5 model numbers
      
       - Fix the alignment assumptions of pti_clone_pgtable() and
         clone_entry_text() on 32-bit:
      
         The code assumes PMD aligned code sections, but on 32-bit the kernel
         entry text is not PMD aligned. So depending on the code size and
         location, which is configuration and compiler dependent, entry text
         can cross a PMD boundary. As the start is not PMD aligned adding PMD
         size to the start address is larger than the end address which
         results in partially mapped entry code for user space. That causes
         endless recursion on the first entry from userspace (usually #PF).
      
         Cure this by aligning the start address in the addition so it ends up
         at the next PMD start address.
      
         clone_entry_text() enforces PMD mapping, but on 32-bit the tail might
         eventually be PTE mapped, which causes a map fail because the PMD for
         the tail is not a large page mapping. Use PTI_LEVEL_KERNEL_IMAGE for
         the clone() invocation which resolves to PTE on 32-bit and PMD on
         64-bit.
      
       - Zero the 8-byte case for get_user() on range check failure on 32-bit
      
         The recend consolidation of the 8-byte get_user() case broke the
         zeroing in the failure case again. Establish it by clearing ECX
         before the range check and not afterwards as that obvioulsy can't be
         reached when the range check fails
      
      * tag 'x86-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit
        x86/mm: Fix pti_clone_entry_text() for i386
        x86/mm: Fix pti_clone_pgtable() alignment assumption
        x86/setup: Parse the builtin command line before merging
        x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range
        x86/sev: Fix __reserved field in sev_config
        x86/aperfmperf: Fix deadlock on cpu_hotplug_lock
      a5dbd76a
    • Linus Torvalds's avatar
      Merge tag 'timers-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 61ca6c78
      Linus Torvalds authored
      Pull timer fixes from Thomas Gleixner:
       "Two fixes for the timer/clocksource code:
      
         - The recent fix to make the take over of the broadcast timer more
           reliable retrieves a per CPU pointer in preemptible context.
      
           This went unnoticed in testing as some compilers hoist the access
           into the non-preemotible section where the pointer is actually
           used, but obviously compilers can rightfully invoke it where the
           code put it.
      
           Move it into the non-preemptible section right to the actual usage
           side to cure it.
      
         - The clocksource watchdog is supposed to emit a warning when the
           retry count is greater than one and the number of retries reaches
           the limit.
      
           The condition is backwards and warns always when the count is
           greater than one. Fixup the condition to prevent spamming dmesg"
      
      * tag 'timers-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        clocksource: Fix brown-bag boolean thinko in cs_watchdog_read()
        tick/broadcast: Move per CPU pointer access into the atomic section
      61ca6c78
    • Linus Torvalds's avatar
      Merge tag 'sched-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 6cc82dc2
      Linus Torvalds authored
      Pull scheduler fixes from Thomas Gleixner:
      
       - When stime is larger than rtime due to accounting imprecision, then
         utime = rtime - stime becomes negative. As this is unsigned math, the
         result becomes a huge positive number.
      
         Cure it by resetting stime to rtime in that case, so utime becomes 0.
      
       - Restore consistent state when sched_cpu_deactivate() fails.
      
         When offlining a CPU fails in sched_cpu_deactivate() after the SMT
         present counter has been decremented, then the function aborts but
         fails to increment the SMT present counter and leaves it imbalanced.
         Consecutive operations cause it to underflow. Add the missing fixup
         for the error path.
      
         For SMT accounting the runqueue needs to marked online again in the
         error exit path to restore consistent state.
      
      * tag 'sched-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched/core: Fix unbalance set_rq_online/offline() in sched_cpu_deactivate()
        sched/core: Introduce sched_set_rq_on/offline() helper
        sched/smt: Fix unbalance sched_smt_present dec/inc
        sched/smt: Introduce sched_smt_present_inc/dec() helper
        sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
      6cc82dc2
    • Linus Torvalds's avatar
      Merge tag 'perf-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 1ddeb0ef
      Linus Torvalds authored
      Pull x86 perf fixes from Thomas Gleixner:
      
       - Move the smp_processor_id() invocation back into the non-preemtible
         region, so that the result is valid to use
      
       - Add the missing package C2 residency counters for Sierra Forest CPUs
         to make the newly added support actually useful
      
      * tag 'perf-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf/x86: Fix smp_processor_id()-in-preemptible warnings
        perf/x86/intel/cstate: Add pkg C2 residency counter for Sierra Forest
      1ddeb0ef
    • Linus Torvalds's avatar
      Merge tag 'irq-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 953f7764
      Linus Torvalds authored
      Pull irq fixes from Thomas Gleixner:
       "A couple of fixes for interrupt chip drivers:
      
         - Make sure to skip the clear register space in the MBIGEN driver
           when calculating the node register index. Otherwise the clear
           register is clobbered and the wrong node registers are accessed.
      
         - Fix a signed/unsigned confusion in the loongarch CPU driver which
           converts an error code to a huge "valid" interrupt number.
      
         - Convert the mesion GPIO interrupt controller lock to a raw spinlock
           so it works on RT.
      
         - Add a missing static to a internal function in the pic32 EVIC
           driver"
      
      * tag 'irq-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        irqchip/mbigen: Fix mbigen node address layout
        irqchip/meson-gpio: Convert meson_gpio_irq_controller::lock to 'raw_spinlock_t'
        irqchip/irq-pic32-evic: Add missing 'static' to internal function
        irqchip/loongarch-cpu: Fix return value of lpic_gsi_to_irq()
      953f7764
    • Linus Torvalds's avatar
      Merge tag 'locking-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 3bc70ad1
      Linus Torvalds authored
      Pull locking fixes from Thomas Gleixner:
       "Two fixes for locking and jump labels:
      
         - Ensure that the atomic_cmpxchg() conditions are correct and
           evaluating to true on any non-zero value except 1. The missing
           check of the return value leads to inconsisted state of the jump
           label counter.
      
         - Add a missing type conversion in the paravirt spinlock code which
           makes loongson build again"
      
      * tag 'locking-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        jump_label: Fix the fix, brown paper bags galore
        locking/pvqspinlock: Correct the type of "old" variable in pv_kick_node()
      3bc70ad1
    • Rob Herring (Arm)'s avatar
      arm: dts: arm: versatile-ab: Fix duplicate clock node name · ff588380
      Rob Herring (Arm) authored
      Commit 04f08ef2 ("arm/arm64: dts: arm: Use generic clock and
      regulator nodenames") renamed nodes and created 2 "clock-24000000" nodes
      (at different paths).
      
      The kernel can't handle these duplicate names even though they are at
      different paths.  Fix this by renaming one of the nodes to "clock-pclk".
      
      This name is aligned with other Arm boards (those didn't have a known
      frequency to use in the node name).
      
      Fixes: 04f08ef2 ("arm/arm64: dts: arm: Use generic clock and regulator nodenames")
      Reported-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Signed-off-by: default avatarRob Herring (Arm) <robh@kernel.org>
      Tested-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Reviewed-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Tested-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ff588380
    • Linus Torvalds's avatar
      Merge tag '6.11-rc1-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 · 3f3f6d61
      Linus Torvalds authored
      Pull smb client fixes from Steve French:
      
       - two reparse point fixes
      
       - minor cleanup
      
       - additional trace point (to help debug a recent problem)
      
      * tag '6.11-rc1-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: update internal version number
        smb: client: fix FSCTL_GET_REPARSE_POINT against NetApp
        smb3: add dynamic tracepoints for shutdown ioctl
        cifs: Remove cifs_aio_ctx
        smb: client: handle lack of FSCTL_GET_REPARSE_POINT support
      3f3f6d61
    • Linus Torvalds's avatar
      Merge tag 'media/v6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media · 3c41df42
      Linus Torvalds authored
      Pull media fixes from Mauro Carvalho Chehab:
      
       - two Kconfig fixes
      
       - one fix for the UVC driver addressing probing time detection of a UVC
         custom controls
      
       - one fix related to PDF generation
      
      * tag 'media/v6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
        media: v4l: Fix missing tabular column hint for Y14P format
        media: intel/ipu6: select AUXILIARY_BUS in Kconfig
        media: ipu-bridge: fix ipu6 Kconfig dependencies
        media: uvcvideo: Fix custom control mapping probing
      3c41df42
  12. 03 Aug, 2024 5 commits