summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2022-03-29parisc: Move CPU startup-related functions into .text sectionHelge Deller
If CONFIG_HOTPLUG_CPU is enabled, those functions will be run again after bootup. So they need to reside in the .text section. Signed-off-by: Helge Deller <deller@gmx.de>
2022-03-29parisc: Move store_cpu_topology() into text sectionHelge Deller
Signed-off-by: Helge Deller <deller@gmx.de>
2022-03-29parisc: Switch from GENERIC_CPU_DEVICES to GENERIC_ARCH_TOPOLOGYHelge Deller
Switch away from the own cpu topology code to common code which is used by ARM64 and RISCV. That will allow us to enable CPU hotplug later on. Signed-off-by: Helge Deller <deller@gmx.de>
2022-03-29parisc: Ensure set_firmware_width() is called only onceHelge Deller
Call set_firmware_width() only once at runtime. This prevents that hotplugged CPUs will get stuck in spinlocks later on. Signed-off-by: Helge Deller <deller@gmx.de>
2022-03-29parisc: Add constants for control registers and clean up mfctl()Helge Deller
Clean up the code for the mfctl() and mtctl() functions and add often used constants. Signed-off-by: Helge Deller <deller@gmx.de>
2022-03-29parisc: Detect hppa-suse-linux-gcc compiler for cross-buildingHelge Deller
Allow the system to find the SUSE hppa compiler and linker to set CROSS32_COMPILE and CROSS_COMPILE. Suggested-by: Jiri Slaby <jirislaby@kernel.org> Signed-off-by: Helge Deller <deller@gmx.de>
2022-03-29parisc: Clean up cpu_check_affinity() and drop cpu_set_affinity_irq()Helge Deller
The cpu_set_affinity_irq() isn't needed. Not the CPU irqs need to change, but the slave irq chips simply need to be reprogrammed to a new CPU irq with the txn_* functions. Signed-off-by: Helge Deller <deller@gmx.de>
2022-03-29parisc: Fix CPU affinity for Lasi, WAX and Dino chipsHelge Deller
Add the missing logic to allow Lasi, WAX and Dino to set the CPU affinity. This fixes IRQ migration to other CPUs when a CPU is shutdown which currently holds the IRQs for one of those chips. Signed-off-by: Helge Deller <deller@gmx.de>
2022-03-29Merge tag 'devprop-5.18-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull device properties code update from Rafael Wysocki: "This is based on new i2c material for 5.18-rc1 and simply reorganizes the code on top of it so as to group similar functions together (Andy Shevchenko)" * tag 'devprop-5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: device property: Don't split fwnode_get_irq*() APIs in the code
2022-03-29Merge tag 'pm-5.18-rc1-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power management updates from Rafael Wysocki: "These update ARM cpufreq drivers, the OPP (Operating Performance Points) library and the power management documentation. Specifics: - Add per core DVFS support for QCom SoC (Bjorn Andersson), convert to yaml binding (Manivannan Sadhasivam) and various other fixes to the QCom drivers (Luca Weiss). - Add OPP table for imx7s SoC (Denys Drozdov) and minor fixes (Stefan Agner). - Fix CPPC driver's freq/performance conversions (Pierre Gondois). - Minor generic cleanups (Yury Norov). - Introduce opp-microwatt property to the OPP core, bindings, etc (Lukasz Luba). - Convert DT bindings to schema format and various related fixes (Yassine Oudjana). - Expose OPP's OF node in debugfs (Viresh Kumar). - Add Intel uncore frequency scaling documentation file to its MAINTAINERS entry (Srinivas Pandruvada). - Clean up the AMD P-state driver documentation (Jan Engelhardt)" * tag 'pm-5.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (24 commits) Documentation: amd-pstate: grammar and sentence structure updates dt-bindings: cpufreq: cpufreq-qcom-hw: Convert to YAML bindings dt-bindings: dvfs: Use MediaTek CPUFREQ HW as an example Documentation: EM: Describe new registration method using DT OPP: Add support of "opp-microwatt" for EM registration PM: EM: add macro to set .active_power() callback conditionally OPP: Add "opp-microwatt" supporting code dt-bindings: opp: Add "opp-microwatt" entry in the OPP MAINTAINERS: Add additional file to uncore frequency control cpufreq: blocklist Qualcomm sc8280xp and sa8540p in cpufreq-dt-platdev cpufreq: qcom-hw: Add support for per-core-dcvs dt-bindings: power: avs: qcom,cpr: Convert to DT schema arm64: dts: qcom: qcs404: Rename CPU and CPR OPP tables arm64: dts: qcom: msm8996: Rename cluster OPP tables dt-bindings: opp: Convert qcom-nvmem-cpufreq to DT schema dt-bindings: opp: qcom-opp: Convert to DT schema arm64: dts: qcom: msm8996-mtp: Add msm8996 compatible dt-bindings: arm: qcom: Add msm8996 and apq8096 compatibles opp: Expose of-node's name in debugfs cpufreq: CPPC: Fix performance/frequency conversion ...
2022-03-29Merge branches 'clk-sifive' and 'clk-visconti' into clk-nextStephen Boyd
* clk-sifive: clk: sifive: Move all stuff into SoCs header files from C files clk: sifive: Add SoCs prefix in each SoCs-dependent data riscv: dts: Change the macro name of prci in each device node dt-bindings: change the macro name of prci in header files and example clk: sifive: duplicate the macro definitions for the time being * clk-visconti: clk: visconti: prevent array overflow in visconti_clk_register_gates()
2022-03-29Merge branches 'clk-range', 'clk-uniphier', 'clk-apple' and 'clk-qcom' into ↵Stephen Boyd
clk-next - Make clk_set_rate_range() re-evaluate the limits each time - Introduce various clk_set_rate_range() tests - Add clk_drop_range() to drop a previously set range - Support for NCO blocks on Apple SoCs * clk-range: clk: Drop the rate range on clk_put() clk: test: Test clk_set_rate_range on orphan mux clk: Initialize orphan req_rate clk: bcm: rpi: Run some clocks at the minimum rate allowed clk: bcm: rpi: Set a default minimum rate clk: bcm: rpi: Add variant structure clk: Add clk_drop_range clk: Always set the rate on clk_set_range_rate clk: Use clamp instead of open-coding our own clk: Always clamp the rounded rate clk: Enforce that disjoints limits are invalid clk: Introduce Kunit Tests for the framework clk: Fix clk_hw_get_clk() when dev is NULL * clk-uniphier: clk: uniphier: Fix fixed-rate initialization * clk-apple: clk: clk-apple-nco: Allow and fix module building MAINTAINERS: Add clk-apple-nco under ARM/APPLE MACHINE clk: clk-apple-nco: Add driver for Apple NCO dt-bindings: clock: Add Apple NCO * clk-qcom: (61 commits) clk: qcom: gcc-msm8994: Fix gpll4 width dt-bindings: clock: fix dt_binding_check error for qcom,gcc-other.yaml clk: qcom: Add display clock controller driver for SM6125 dt-bindings: clock: add QCOM SM6125 display clock bindings clk: qcom: Fix sorting of SDX_GCC_65 in Makefile and Kconfig clk: qcom: gcc: Add emac GDSC support for SM8150 clk: qcom: gcc: sm8150: Fix some identation issues clk: qcom: gcc: Add UFS_CARD and UFS_PHY GDSCs for SM8150 clk: qcom: gcc: Add PCIe0 and PCIe1 GDSC for SM8150 clk: qcom: clk-rcg2: Update the frac table for pixel clock clk: qcom: clk-rcg2: Update logic to calculate D value for RCG clk: qcom: smd: Add missing MSM8998 RPM clocks clk: qcom: smd: Add missing RPM clocks for msm8992/4 dt-bindings: clock: qcom: rpmcc: Add RPM Modem SubSystem (MSS) clocks clk: qcom: gcc-ipq806x: add CryptoEngine resets dt-bindings: reset: add ipq8064 ce5 resets clk: qcom: gcc-ipq806x: add CryptoEngine clocks dt-bindings: clock: add ipq8064 ce5 clk define clk: qcom: gcc-ipq806x: add additional freq for sdc table clk: qcom: clk-rcg: add clk_rcg_floor_ops ops ...
2022-03-29Merge branches 'clk-starfive', 'clk-ti', 'clk-terminate' and 'clk-cleanup' ↵Stephen Boyd
into clk-next - Audio clks on StarFive JH7100 RISC-V SoC - Terminate arrays with sentinels and make that clearer - Cleanup SPDX tags - Fix typos in comments * clk-starfive: clk: starfive: Add JH7100 audio clock driver clk: starfive: jh7100: Support more clock types clk: starfive: jh7100: Make hw clock implementation reusable dt-bindings: clock: Add starfive,jh7100-audclk bindings dt-bindings: clock: Add JH7100 audio clock definitions clk: starfive: jh7100: Handle audio_div clock properly clk: starfive: jh7100: Don't round divisor up twice * clk-ti: clk: ti: Drop legacy compatibility clocks for dra7 clk: ti: Drop legacy compatibility clocks for am4 clk: ti: Drop legacy compatibility clocks for am3 clk: ti: Update component clocks to use ti_dt_clk_name() clk: ti: Update pll and clockdomain clocks to use ti_dt_clk_name() clk: ti: Add ti_dt_clk_name() helper to use clock-output-names clk: ti: Use clock-output-names for clkctrl clk: ti: Add ti_find_clock_provider() to use clock-output-names clk: ti: Optionally parse IO address from parent clock node clk: ti: Preserve node in ti_dt_clocks_register() clk: ti: Constify clkctrl_name * clk-terminate: clk: actions: Make sentinel elements more obvious clk: clps711x: Terminate clk_div_table with sentinel element clk: hisilicon: Terminate clk_div_table with sentinel element clk: loongson1: Terminate clk_div_table with sentinel element clk: actions: Terminate clk_div_table with sentinel element * clk-cleanup: clk: zynq: Update the parameters to zynq_clk_register_periph_clk clk: zynq: trivial warning fix clk: qcom: sm6125-gcc: fix typos in comments clk: ti: clkctrl: fix typos in comments clk: COMMON_CLK_LAN966X should depend on SOC_LAN966 clk: Use of_device_get_match_data() clk: bcm2835: Remove unused variable clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver clk: cleanup comments clk: socfpga: cleanup spdx tags
2022-03-29Merge branches 'clk-mvebu', 'clk-const', 'clk-imx' and 'clk-rockchip' into ↵Stephen Boyd
clk-next - Mark mux table as const in clk-mux - Make the all_lists array const * clk-mvebu: clk: mvebu: use time_is_before_eq_jiffies() instead of open coding it * clk-const: clk: Mark clk_core_evict_parent_cache_subtree() 'target' const clk: Mark 'all_lists' as const clk: pistachio: Declare mux table as const u32[] clk: qcom: Declare mux table as const u32[] clk: mmp: Declare mux tables as const u32[] clk: hisilicon: Remove unnecessary cast of mux table to u32 * clk: mux: Declare u32 *table parameter as const clk: nxp: Declare mux table parameter as const u32 * clk: nxp: Remove unused variable * clk-imx: (28 commits) dt-bindings: clock: drop useless consumer example clk: imx: Select MXC_CLK for i.MX93 clock driver clk: imx: remove redundant re-assignment of pll->base MAINTAINERS: clk: imx: add git tree and dt-bindings files clk: imx: pll14xx: Support dynamic rates clk: imx: pll14xx: Add pr_fmt clk: imx: pll14xx: explicitly return lowest rate clk: imx: pll14xx: name variables after usage clk: imx: pll14xx: consolidate rate calculation clk: imx: pll14xx: Use FIELD_GET/FIELD_PREP clk: imx: pll14xx: Drop wrong shifting clk: imx: pll14xx: Use register defines consistently clk: imx8mp: remove SYS PLL 1/2 clock gates clk: imx8mn: remove SYS PLL 1/2 clock gates clk: imx8mm: remove SYS PLL 1/2 clock gates clk: imx: add i.MX93 clk clk: imx: support fracn gppll clk: imx: add i.MX93 composite clk dt-bindings: clock: add i.MX93 clock definition dt-bindings: clock: Add imx93 clock support ... * clk-rockchip: clk: rockchip: re-add rational best approximation algorithm to the fractional divider clk/rockchip: Use of_device_get_match_data() clk: rockchip: Add CLK_SET_RATE_PARENT to the HDMI reference clock on rk3568 clk: rockchip: drop CLK_SET_RATE_PARENT from dclk_vop* on rk3568 clk: rockchip: Add more PLL rates for rk3568
2022-03-29Merge branches 'clk-xilinx', 'clk-kunit', 'clk-cs2000' and 'clk-renesas' ↵Stephen Boyd
into clk-next - Kunit tests for clk-gate implementation - Convert Cirrus Logic CS2000P driver to regmap, yamlify DT binding and add support for dynamic mode * clk-xilinx: clk: zynqmp: replace warn_once with pr_debug for failed clock ops * clk-kunit: clk: gate: Add some kunit test suites * clk-cs2000: clk: cs2000-cp: convert driver to regmap clk: cs2000-cp: freeze config during register fiddling clk: cs2000-cp: make clock skip setting configurable clk: cs2000-cp: add support for dynamic mode clk: cs2000-cp: Make aux output function controllable dt-bindings: clock: cs2000-cp: document cirrus,dynamic-mode dt-bindings: clock: cs2000-cp: document cirrus,clock-skip flag dt-bindings: clock: cs2000-cp: document aux-output-source dt-bindings: clock: convert cs2000-cp bindings to yaml * clk-renesas: dt-bindings: clock: renesas: Make example 'clocks' parsable clk: rs9: Add Renesas 9-series PCIe clock generator driver clk: fixed-factor: Introduce devm_clk_hw_register_fixed_factor_index() dt-bindings: clk: rs9: Add Renesas 9-series I2C PCIe clock generator clk: renesas: r8a779f0: Add PFC clock clk: renesas: r8a779f0: Add I2C clocks clk: renesas: r8a779f0: Add WDT clock clk: renesas: r8a779f0: Fix RSW2 clock divider clk: renesas: rzg2l-cpg: Add support for RZ/V2L SoC dt-bindings: clock: renesas: Document RZ/V2L SoC dt-bindings: clock: Add R9A07G054 CPG Clock and Reset Definitions clk: renesas: r8a779a0: Add CANFD module clock clk: renesas: r9a07g044: Update multiplier and divider values for PLL2/3 clk: renesas: r8a7799[05]: Add MLP clocks clk: renesas: r8a779f0: Add SYS-DMAC clocks
2022-03-29Merge branches 'clk-microchip', 'clk-si', 'clk-mtk', 'clk-at91' and 'clk-st' ↵Stephen Boyd
into clk-next - Clock configuration on Microchip PolarFire SoCs - Free allocations on probe error in Mediatek clk driver - Modernize Mediatek clk driver by consolidating code * clk-microchip: clk: microchip: Add driver for Microchip PolarFire SoC dt-bindings: clk: microchip: Add Microchip PolarFire host binding * clk-si: clk-si5341: replace snprintf in show functions with sysfs_emit clk: si5341: fix reported clk_rate when output divider is 2 * clk-mtk: (32 commits) clk: mediatek: Warn if clk IDs are duplicated clk: mediatek: mt8195: Implement remove functions clk: mediatek: mt8195: Implement error handling in probe functions clk: mediatek: mt8195: Hook up mtk_clk_simple_remove() clk: mediatek: Unregister clks in mtk_clk_simple_probe() error path clk: mediatek: mtk: Implement error handling in register APIs clk: mediatek: pll: Implement error handling in register API clk: mediatek: mux: Implement error handling in register API clk: mediatek: mux: Reverse check for existing clk to reduce nesting level clk: mediatek: gate: Implement error handling in register API clk: mediatek: cpumux: Implement error handling in register API clk: mediatek: mtk: Clean up included headers clk: mediatek: Add mtk_clk_simple_remove() clk: mediatek: Implement mtk_clk_unregister_composites() API clk: mediatek: Implement mtk_clk_unregister_divider_clks() API clk: mediatek: Implement mtk_clk_unregister_factors() API clk: mediatek: Implement mtk_clk_unregister_fixed_clks() API clk: mediatek: pll: Clean up included headers clk: mediatek: pll: Implement unregister API clk: mediatek: pll: Split definitions into separate header file ... * clk-at91: clk: at91: clk-master: remove dead code clk: at91: sama7g5: fix parents of PDMCs' GCLK clk: at91: sama7g5: Allow MCK1 to be exported and referenced in DT clk: at91: allow setting PMC_AUDIOPINCK clock parents via DT * clk-st: clk: stm32mp1: Add parent_data to ETHRX clock clk: stm32mp1: Split ETHCK_K into separate MUX and GATE clock
2022-03-29clk: zynq: Update the parameters to zynq_clk_register_periph_clkShubhrajyoti Datta
In case there are only one gate or the two_gate is 0 the clk1 clock passed is not used. We are passing 0 which is arm_pll. Pass a invalid clock instead. Signed-off-by: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com> Link: https://lore.kernel.org/r/20220222130903.17235-3-shubhrajyoti.datta@xilinx.com Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2022-03-29clk: zynq: trivial warning fixShubhrajyoti Datta
Fix the below warning WARNING: Missing a blank line after declarations + int enable = !!(fclk_enable & BIT(i - fclk0)); + zynq_clk_register_fclk(i, clk_output_name[i], Signed-off-by: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com> Link: https://lore.kernel.org/r/20220222130903.17235-2-shubhrajyoti.datta@xilinx.com Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2022-03-29Merge branch 'pm-docs'Rafael J. Wysocki
Merge additional power management documentation udates for 5.18-rc1: - Add Intel uncore frequency scaling documentation file to its MAINTAINERS entry (Srinivas Pandruvada). - Clean up the AMD P-state driver documentation (Jan Engelhardt). * pm-docs: Documentation: amd-pstate: grammar and sentence structure updates MAINTAINERS: Add additional file to uncore frequency control
2022-03-29Merge branch 'pm-opp'Rafael J. Wysocki
Merge OPP (Operating Performance Points) changes for 5.18-rc1. * pm-opp: Documentation: EM: Describe new registration method using DT OPP: Add support of "opp-microwatt" for EM registration PM: EM: add macro to set .active_power() callback conditionally OPP: Add "opp-microwatt" supporting code dt-bindings: opp: Add "opp-microwatt" entry in the OPP dt-bindings: power: avs: qcom,cpr: Convert to DT schema arm64: dts: qcom: qcs404: Rename CPU and CPR OPP tables arm64: dts: qcom: msm8996: Rename cluster OPP tables dt-bindings: opp: Convert qcom-nvmem-cpufreq to DT schema dt-bindings: opp: qcom-opp: Convert to DT schema arm64: dts: qcom: msm8996-mtp: Add msm8996 compatible dt-bindings: arm: qcom: Add msm8996 and apq8096 compatibles opp: Expose of-node's name in debugfs
2022-03-29Merge tag 'devicetree-fixes-for-5.18-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Clean-up missing '/schemas' in $ref paths - Fix MediaTek Vcodec decoder example 'dma-ranges' errors - Expand available values of PBL for snps,dwmac to fix warnings in mediatek-dwmac.yaml example - Fix warnings in MediaTek display bindings * tag 'devicetree-fixes-for-5.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: Fix missing '/schemas' in $ref paths dt-bindings: media: mediatek,vcodec: Fix addressing cell sizes dt-bindings: net: snps,dwmac: modify available values of PBL dt-bindings: display: mediatek: Fix examples on new bindings dt-bindings: display: mediatek, ovl: Fix 'iommu' required property typo dt-bindings: display: mediatek, mutex: Fix mediatek, gce-events type Revert "dt-bindings: display: mediatek: add ethdr definition for mt8195"
2022-03-29Merge tag 'dma-mapping-5.18' of git://git.infradead.org/users/hch/dma-mappingLinus Torvalds
Pull dma-mapping updates from Christoph Hellwig: - do not zero buffer in set_memory_decrypted (Kirill A. Shutemov) - fix return value of dma-debug __setup handlers (Randy Dunlap) - swiotlb cleanups (Robin Murphy) - remove most remaining users of the pci-dma-compat.h API (Christophe JAILLET) - share the ABI header for the DMA map_benchmark with userspace (Tian Tao) - update the maintainer for DMA MAPPING BENCHMARK (Xiang Chen) - remove CONFIG_DMA_REMAP (me) * tag 'dma-mapping-5.18' of git://git.infradead.org/users/hch/dma-mapping: dma-mapping: benchmark: extract a common header file for map_benchmark definition dma-debug: fix return value of __setup handlers dma-mapping: remove CONFIG_DMA_REMAP media: v4l2-pci-skeleton: Remove usage of the deprecated "pci-dma-compat.h" API rapidio/tsi721: Remove usage of the deprecated "pci-dma-compat.h" API sparc: Remove usage of the deprecated "pci-dma-compat.h" API agp/intel: Remove usage of the deprecated "pci-dma-compat.h" API alpha: Remove usage of the deprecated "pci-dma-compat.h" API MAINTAINERS: update maintainer list of DMA MAPPING BENCHMARK swiotlb: simplify array allocation swiotlb: tidy up includes swiotlb: simplify debugfs setup swiotlb: do not zero buffer in set_memory_decrypted()
2022-03-29phy: PHY_FSL_LYNX_28G should depend on ARCH_LAYERSCAPEGeert Uytterhoeven
Freescale Layerscape Lynx 28G SerDes PHYs are only present on Freescale/NXP Layerscape SoCs. Move PHY_FSL_LYNX_28G outside the block for ARCH_MXC, as the latter is meant for i.MX8 SoCs, which is a different family than Layerscape. Add a dependency on ARCH_LAYERSCAPE, to prevent asking the user about this driver when configuring a kernel without Layerscape SoC support. Fixes: 02e2af20f4f9f2aa ("Merge tag 'char-misc-5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc") Fixes: 8f73b37cf3fbda67 ("phy: add support for the Layerscape SerDes 28G") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2022-03-29Revert "parisc: Fix invalidate/flush vmap routines"Helge Deller
This reverts commit 53d862fac4a09b9c56cca0433fa9de5732fd05a1. It turned out that flush_kernel_vmap_range() is being called with interrupts disabled. There's no way to flush entire cache with interrupts disabled. Signed-off-by: Helge Deller <deller@gmx.de>
2022-03-29net: lan966x: fix kernel oops on ioctl when I/F is downMichael Walle
ioctls handled by phy_mii_ioctl() will cause a kernel oops when the interface is down. Fix it by making sure there is a PHY attached. Fixes: 735fec995b21 ("net: lan966x: Implement SIOCSHWTSTAMP and SIOCGHWTSTAMP") Signed-off-by: Michael Walle <michael@walle.cc> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://lore.kernel.org/r/20220328220350.3118969-1-michael@walle.cc Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2022-03-29Merge branch 'fix-uaf-bugs-caused-by-ax25_release'Paolo Abeni
Duoming Zhou says: ==================== Fix UAF bugs caused by ax25_release() The first patch fixes UAF bugs in ax25_send_control, and the second patch fixes UAF bugs in ax25 timers. ==================== Link: https://lore.kernel.org/r/cover.1648472006.git.duoming@zju.edu.cn Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2022-03-29ax25: Fix UAF bugs in ax25 timersDuoming Zhou
There are race conditions that may lead to UAF bugs in ax25_heartbeat_expiry(), ax25_t1timer_expiry(), ax25_t2timer_expiry(), ax25_t3timer_expiry() and ax25_idletimer_expiry(), when we call ax25_release() to deallocate ax25_dev. One of the UAF bugs caused by ax25_release() is shown below: (Thread 1) | (Thread 2) ax25_dev_device_up() //(1) | ... | ax25_kill_by_device() ax25_bind() //(2) | ax25_connect() | ... ax25_std_establish_data_link() | ax25_start_t1timer() | ax25_dev_device_down() //(3) mod_timer(&ax25->t1timer,..) | | ax25_release() (wait a time) | ... | ax25_dev_put(ax25_dev) //(4)FREE ax25_t1timer_expiry() | ax25->ax25_dev->values[..] //USE| ... ... | We increase the refcount of ax25_dev in position (1) and (2), and decrease the refcount of ax25_dev in position (3) and (4). The ax25_dev will be freed in position (4) and be used in ax25_t1timer_expiry(). The fail log is shown below: ============================================================== [ 106.116942] BUG: KASAN: use-after-free in ax25_t1timer_expiry+0x1c/0x60 [ 106.116942] Read of size 8 at addr ffff88800bda9028 by task swapper/0/0 [ 106.116942] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.17.0-06123-g0905eec574 [ 106.116942] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-14 [ 106.116942] Call Trace: ... [ 106.116942] ax25_t1timer_expiry+0x1c/0x60 [ 106.116942] call_timer_fn+0x122/0x3d0 [ 106.116942] __run_timers.part.0+0x3f6/0x520 [ 106.116942] run_timer_softirq+0x4f/0xb0 [ 106.116942] __do_softirq+0x1c2/0x651 ... This patch adds del_timer_sync() in ax25_release(), which could ensure that all timers stop before we deallocate ax25_dev. Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2022-03-29ax25: fix UAF bug in ax25_send_control()Duoming Zhou
There are UAF bugs in ax25_send_control(), when we call ax25_release() to deallocate ax25_dev. The possible race condition is shown below: (Thread 1) | (Thread 2) ax25_dev_device_up() //(1) | | ax25_kill_by_device() ax25_bind() //(2) | ax25_connect() | ... ax25->state = AX25_STATE_1 | ... | ax25_dev_device_down() //(3) (Thread 3) ax25_release() | ax25_dev_put() //(4) FREE | case AX25_STATE_1: | ax25_send_control() | alloc_skb() //USE | The refcount of ax25_dev increases in position (1) and (2), and decreases in position (3) and (4). The ax25_dev will be freed before dereference sites in ax25_send_control(). The following is part of the report: [ 102.297448] BUG: KASAN: use-after-free in ax25_send_control+0x33/0x210 [ 102.297448] Read of size 8 at addr ffff888009e6e408 by task ax25_close/602 [ 102.297448] Call Trace: [ 102.303751] ax25_send_control+0x33/0x210 [ 102.303751] ax25_release+0x356/0x450 [ 102.305431] __sock_release+0x6d/0x120 [ 102.305431] sock_close+0xf/0x20 [ 102.305431] __fput+0x11f/0x420 [ 102.305431] task_work_run+0x86/0xd0 [ 102.307130] get_signal+0x1075/0x1220 [ 102.308253] arch_do_signal_or_restart+0x1df/0xc00 [ 102.308253] exit_to_user_mode_prepare+0x150/0x1e0 [ 102.308253] syscall_exit_to_user_mode+0x19/0x50 [ 102.308253] do_syscall_64+0x48/0x90 [ 102.308253] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 102.308253] RIP: 0033:0x405ae7 This patch defers the free operation of ax25_dev and net_device after all corresponding dereference sites in ax25_release() to avoid UAF. Fixes: 9fd75b66b8f6 ("ax25: Fix refcount leaks caused by ax25_cb_del()") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2022-03-29openvswitch: Fixed nd target mask field in the flow dump.Martin Varghese
IPv6 nd target mask was not getting populated in flow dump. In the function __ovs_nla_put_key the icmp code mask field was checked instead of icmp code key field to classify the flow as neighbour discovery. ufid:bdfbe3e5-60c2-43b0-a5ff-dfcac1c37328, recirc_id(0),dp_hash(0/0), skb_priority(0/0),in_port(ovs-nm1),skb_mark(0/0),ct_state(0/0), ct_zone(0/0),ct_mark(0/0),ct_label(0/0), eth(src=00:00:00:00:00:00/00:00:00:00:00:00, dst=00:00:00:00:00:00/00:00:00:00:00:00), eth_type(0x86dd), ipv6(src=::/::,dst=::/::,label=0/0,proto=58,tclass=0/0,hlimit=0/0,frag=no), icmpv6(type=135,code=0), nd(target=2001::2/::, sll=00:00:00:00:00:00/00:00:00:00:00:00, tll=00:00:00:00:00:00/00:00:00:00:00:00), packets:10, bytes:860, used:0.504s, dp:ovs, actions:ovs-nm2 Fixes: e64457191a25 (openvswitch: Restructure datapath.c and flow.c) Signed-off-by: Martin Varghese <martin.varghese@nokia.com> Link: https://lore.kernel.org/r/20220328054148.3057-1-martinvarghesenokia@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2022-03-28selftests/bpf: Fix clang compilation errorsYonghong Song
llvm upstream patch ([1]) added to issue warning for code like void test() { int j = 0; for (int i = 0; i < 1000; i++) j++; return; } This triggered several errors in selftests/bpf build since compilation flag -Werror is used. ... test_lpm_map.c:212:15: error: variable 'n_matches' set but not used [-Werror,-Wunused-but-set-variable] size_t i, j, n_matches, n_matches_after_delete, n_nodes, n_lookups; ^ test_lpm_map.c:212:26: error: variable 'n_matches_after_delete' set but not used [-Werror,-Wunused-but-set-variable] size_t i, j, n_matches, n_matches_after_delete, n_nodes, n_lookups; ^ ... prog_tests/get_stack_raw_tp.c:32:15: error: variable 'cnt' set but not used [-Werror,-Wunused-but-set-variable] static __u64 cnt; ^ ... For test_lpm_map.c, 'n_matches'/'n_matches_after_delete' are changed to be volatile in order to silent the warning. I didn't remove these two declarations since they are referenced in a commented code which might be used by people in certain cases. For get_stack_raw_tp.c, the variable 'cnt' is removed. [1] https://reviews.llvm.org/D122271 Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20220325200304.2915588-1-yhs@fb.com
2022-03-28Merge branch 'xsk: another round of fixes'Alexei Starovoitov
Maciej Fijalkowski says: ==================== Hello, yet another fixes for XSK from Magnus and me. Magnus addresses the fact that xp_alloc() can return NULL, so this needs to be handled to avoid clearing entries in the SW ring on driver side. Then he addresses the off-by-one problem in Tx desc cleaning routine for ice ZC driver. From my side, I am adding protection to ZC Rx processing loop so that cleaning of descriptors wouldn't go over already processed entries. Then I also fix an issue with assigning XSK pool to Tx queues. This is directed to bpf tree. Thanks! Maciej Fijalkowski (2): ice: xsk: stop Rx processing when ntc catches ntu ice: xsk: fix indexing in ice_tx_xsk_pool() ==================== Acked-by: Alexander Lobakin <alexandr.lobakin@intel.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2022-03-28ice: xsk: Fix indexing in ice_tx_xsk_pool()Maciej Fijalkowski
Ice driver tries to always create XDP rings array to be num_possible_cpus() sized, regardless of user's queue count setting that can be changed via ethtool -L for example. Currently, ice_tx_xsk_pool() calculates the qid by decrementing the ring->q_index by the count of XDP queues, but ring->q_index is set to 'i + vsi->alloc_txq'. When user did ethtool -L $IFACE combined 1, alloc_txq is 1, but vsi->num_xdp_txq is still num_possible_cpus(). Then, ice_tx_xsk_pool() will do OOB access and in the final result ring would not get xsk_pool pointer assigned. Then, each ice_xsk_wakeup() call will fail with error and it will not be possible to get into NAPI and do the processing from driver side. Fix this by decrementing vsi->alloc_txq instead of vsi->num_xdp_txq from ring-q_index in ice_tx_xsk_pool() so the calculation is reflected to the setting of ring->q_index. Fixes: 22bf877e528f ("ice: introduce XDP_TX fallback path") Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20220328142123.170157-5-maciej.fijalkowski@intel.com
2022-03-28ice: xsk: Stop Rx processing when ntc catches ntuMaciej Fijalkowski
This can happen with big budget values and some breakage of re-filling descriptors as we do not clear the entry that ntu is pointing at the end of ice_alloc_rx_bufs_zc. So if ntc is at ntu then it might be the case that status_error0 has an old, uncleared value and ntc would go over with processing which would result in false results. Break Rx loop when ntc == ntu to avoid broken behavior. Fixes: 3876ff525de7 ("ice: xsk: Handle SW XDP ring wrap and bump tail more often") Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20220328142123.170157-4-maciej.fijalkowski@intel.com
2022-03-28ice: xsk: Eliminate unnecessary loop iterationMagnus Karlsson
The NIC Tx ring completion routine cleans entries from the ring in batches. However, it processes one more batch than it is supposed to. Note that this does not matter from a functionality point of view since it will not find a set DD bit for the next batch and just exit the loop. But from a performance perspective, it is faster to terminate the loop before and not issue an expensive read over PCIe to get the DD bit. Fixes: 126cdfe1007a ("ice: xsk: Improve AF_XDP ZC Tx and use batching API") Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20220328142123.170157-3-maciej.fijalkowski@intel.com
2022-03-28xsk: Do not write NULL in SW ring at allocation failureMagnus Karlsson
For the case when xp_alloc_batch() is used but the batched allocation cannot be used, there is a slow path that uses the non-batched xp_alloc(). When it fails to allocate an entry, it returns NULL. The current code wrote this NULL into the entry of the provided results array (pointer to the driver SW ring usually) and returned. This might not be what the driver expects and to make things simpler, just write successfully allocated xdp_buffs into the SW ring,. The driver might have information in there that is still important after an allocation failure. Note that at this point in time, there are no drivers using xp_alloc_batch() that could trigger this slow path. But one might get added. Fixes: 47e4075df300 ("xsk: Batched buffer allocation for the pool") Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20220328142123.170157-2-maciej.fijalkowski@intel.com
2022-03-28Merge branch 'kprobes: rethook: x86: Replace kretprobe trampoline with rethook'Alexei Starovoitov
Masami Hiramatsu says: ==================== Here are the 3rd version for generic kretprobe and kretprobe on x86 for replacing the kretprobe trampoline with rethook. The previous version is here[1] [1] https://lore.kernel.org/all/164821817332.2373735.12048266953420821089.stgit@devnote2/T/#u This version fixed typo and build issues for bpf-next and CONFIG_RETHOOK=y error. I also add temporary mitigation lines for ANNOTATE_NOENDBR macro issue for bpf-next tree [2/4]. This will be removed after merging kernel IBT series. Background: This rethook came from Jiri's request of multiple kprobe for bpf[2]. He tried to solve an issue that starting bpf with multiple kprobe will take a long time because bpf-kprobe will wait for RCU grace period for sync rcu events. Jiri wanted to attach a single bpf handler to multiple kprobes and he tried to introduce multiple-probe interface to kprobe. So I asked him to use ftrace and kretprobe-like hook if it is only for the function entry and exit, instead of adding ad-hoc interface to kprobes. For this purpose, I introduced the fprobe (kprobe like interface for ftrace) with the rethook (this is a generic return hook feature for fprobe exit handler)[3]. [2] https://lore.kernel.org/all/20220104080943.113249-1-jolsa@kernel.org/T/#u [3] https://lore.kernel.org/all/164191321766.806991.7930388561276940676.stgit@devnote2/T/#u The rethook is basically same as the kretprobe trampoline. I just made it decoupled from kprobes. Eventually, the all arch dependent kretprobe trampolines will be replaced with the rethook trampoline instead of cloning and set HAVE_RETHOOK=y. When I port the rethook for all arch which supports kretprobe, the legacy kretprobe specific code (which is for CONFIG_KRETPROBE_ON_RETHOOK=n) will be removed eventually. ==================== Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2022-03-28x86,kprobes: Fix optprobe trampoline to generate complete pt_regsMasami Hiramatsu
Currently the optprobe trampoline template code ganerate an almost complete pt_regs on-stack, everything except regs->ss. The 'regs->ss' points to the top of stack, which is not a valid segment decriptor. As same as the rethook does, complete the job by also pushing ss. Suggested-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/164826166027.2455864.14759128090648961900.stgit@devnote2
2022-03-28x86,rethook: Fix arch_rethook_trampoline() to generate a complete pt_regsPeter Zijlstra
Currently arch_rethook_trampoline() generates an almost complete pt_regs on-stack, everything except regs->ss that is, that currently points to the fake return address, which is not a valid segment descriptor. Since interpretation of regs->[sb]p should be done in the context of regs->ss, and we have code actually doing that (see arch/x86/lib/insn-eval.c for instance), complete the job by also pushing ss. This ensures that anybody who does do look at regs->ss doesn't mysteriously malfunction, avoiding much future pain. Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org> Link: https://lore.kernel.org/bpf/164826164851.2455864.17272661073069737350.stgit@devnote2
2022-03-28x86,rethook,kprobes: Replace kretprobe with rethook on x86Masami Hiramatsu
Replaces the kretprobe code with rethook on x86. With this patch, kretprobe on x86 uses the rethook instead of kretprobe specific trampoline code. Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Tested-by: Jiri Olsa <jolsa@kernel.org> Link: https://lore.kernel.org/bpf/164826163692.2455864.13745421016848209527.stgit@devnote2
2022-03-28kprobes: Use rethook for kretprobe if possibleMasami Hiramatsu
Use rethook for kretprobe function return hooking if the arch sets CONFIG_HAVE_RETHOOK=y. In this case, CONFIG_KRETPROBE_ON_RETHOOK is set to 'y' automatically, and the kretprobe internal data fields switches to use rethook. If not, it continues to use kretprobe specific function return hooks. Suggested-by: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/164826162556.2455864.12255833167233452047.stgit@devnote2
2022-03-28bpftool: Fix generated code in codegen_assertsJiri Olsa
Arnaldo reported perf compilation fail with: $ make -k BUILD_BPF_SKEL=1 CORESIGHT=1 PYTHON=python3 ... In file included from util/bpf_counter.c:28: /tmp/build/perf//util/bpf_skel/bperf_leader.skel.h: In function ‘bperf_leader_bpf__assert’: /tmp/build/perf//util/bpf_skel/bperf_leader.skel.h:351:51: error: unused parameter ‘s’ [-Werror=unused-parameter] 351 | bperf_leader_bpf__assert(struct bperf_leader_bpf *s) | ~~~~~~~~~~~~~~~~~~~~~~~~~^ cc1: all warnings being treated as errors If there's nothing to generate in the new assert function, we will get unused 's' warn/error, adding 'unused' attribute to it. Fixes: 08d4dba6ae77 ("bpftool: Bpf skeletons assert type sizes") Reported-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> Link: https://lore.kernel.org/bpf/20220328083703.2880079-1-jolsa@kernel.org
2022-03-28selftests/bpf: fix selftest after random: Urandom_read tracepoint removalAndrii Nakryiko
14c174633f34 ("random: remove unused tracepoints") removed all the tracepoints from drivers/char/random.c, one of which, random:urandom_read, was used by stacktrace_build_id selftest to trigger stack trace capture. Fix breakage by switching to kprobing urandom_read() function. Suggested-by: Yonghong Song <yhs@fb.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Yonghong Song <yhs@fb.com> Link: https://lore.kernel.org/bpf/20220325225643.2606-1-andrii@kernel.org
2022-03-28bpf: Fix maximum permitted number of arguments checkYuntao Wang
Since the m->arg_size array can hold up to MAX_BPF_FUNC_ARGS argument sizes, it's ok that nargs is equal to MAX_BPF_FUNC_ARGS. Signed-off-by: Yuntao Wang <ytcoode@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/20220324164238.1274915-1-ytcoode@gmail.com
2022-03-28bpf: Sync comments for bpf_get_stackGeliang Tang
Commit ee2a098851bf missed updating the comments for helper bpf_get_stack in tools/include/uapi/linux/bpf.h. Sync it. Fixes: ee2a098851bf ("bpf: Adjust BPF stack helper functions to accommodate skip > 0") Signed-off-by: Geliang Tang <geliang.tang@suse.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/ce54617746b7ed5e9ba3b844e55e74cb8a60e0b5.1648110794.git.geliang.tang@suse.com
2022-03-28Merge branch 'fprobe: Fixes for Sparse and Smatch warnings'Alexei Starovoitov
Masami Hiramatsu says: ==================== Hi, These fprobe patches are for fixing the warnings by Smatch and sparse. This is arch independent part of the fixes. Thank you, --- ==================== Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2022-03-28fprobe: Fix sparse warning for acccessing __rcu ftrace_hashMasami Hiramatsu
Since ftrace_ops::local_hash::filter_hash field is an __rcu pointer, we have to use rcu_access_pointer() to access it. Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/164802093635.1732982.4938094876018890866.stgit@devnote2
2022-03-28fprobe: Fix smatch type mismatch warningMasami Hiramatsu
Fix the type mismatching warning of 'rethook_node vs fprobe_rethook_node' found by Smatch. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/164802092611.1732982.12268174743437084619.stgit@devnote2
2022-03-28bpf/bpftool: Add unprivileged_bpf_disabled check against value of 2Milan Landaverde
In [1], we added a kconfig knob that can set /proc/sys/kernel/unprivileged_bpf_disabled to 2 We now check against this value in bpftool feature probe [1] https://lore.kernel.org/bpf/74ec548079189e4e4dffaeb42b8987bb3c852eee.1620765074.git.daniel@iogearbox.net Signed-off-by: Milan Landaverde <milan@mdaverde.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Quentin Monnet <quentin@isovalent.com> Acked-by: KP Singh <kpsingh@kernel.org> Link: https://lore.kernel.org/bpf/20220322145012.1315376-1-milan@mdaverde.com
2022-03-28dt-bindings: Fix missing '/schemas' in $ref pathsRob Herring
Absolute paths in $ref should always begin with '/schemas'. The tools mostly work with it omitted, but for correctness the path should be everything except the hostname as that is taken from the schema's $id value. This scheme is defined in the json-schema spec. Cc: Hector Martin <marcan@marcan.st> Cc: Sven Peter <sven@svenpeter.dev> Cc: Andrew Lunn <andrew@lunn.ch> Cc: Vivien Didelot <vivien.didelot@gmail.com> Cc: Florian Fainelli <f.fainelli@gmail.com> Cc: Vladimir Oltean <olteanv@gmail.com> Cc: "David S. Miller" <davem@davemloft.net> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: Mark Brown <broonie@kernel.org> Cc: Chunfeng Yun <chunfeng.yun@mediatek.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Mukesh Savaliya <msavaliy@codeaurora.org> Cc: Akash Asthana <akashast@codeaurora.org> Cc: Bayi Cheng <bayi.cheng@mediatek.com> Cc: Chuanhong Guo <gch981213@gmail.com> Cc: Min Guo <min.guo@mediatek.com> Cc: netdev@vger.kernel.org Cc: linux-spi@vger.kernel.org Cc: linux-usb@vger.kernel.org Signed-off-by: Rob Herring <robh@kernel.org> Acked-by: Jakub Kicinski <kuba@kernel.org> Acked-by: Mark Brown <broonie@debian.org> Link: https://lore.kernel.org/r/20220325215652.525383-1-robh@kernel.org
2022-03-28dt-bindings: media: mediatek,vcodec: Fix addressing cell sizesRob Herring
'dma-ranges' in the example is written for cell sizes of 2 cells, but the schema and example specify sizes of 1 cell. As the h/w has a bus address of >32-bits, cell sizes of 2 is correct. Update the schema's '#address-cells' and '#size-cells' to be 2 and adjust the example throughout. There's no error currently because dtc only checks 'dma-ranges' is a correct multiple number of cells (3) and the schema checking is based on bracketing of entries. Signed-off-by: Rob Herring <robh@kernel.org> Link: https://lore.kernel.org/r/20220301233501.2110047-1-robh@kernel.org
generated by cgit (git 2.34.1) at 2025-07-15 20:13:53 +0000