| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
Killing the interrupt-in urb when the line disciple requests throttling
may lead to data loss if an ongoing transfer is cancelled.
Instead set a flag to prevent the completion handler from resubmitting
the urb until the port is unthrottled.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
|
|
Forward from rc1 to rc3 to track upstream closer again.
Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
|
|
The driver data usb-serial pointer is unused since commit 66c32e483355
("USB: serial: keyspan_pda: drop redundant usb-serial pointer"), which
apparently failed to remove the pointer as intended.
Signed-off-by: Johan Hovold <johan@kernel.org>
|
|
Three functions are initialising their return value variables at
declaration only to later assign them unconditionally.
Signed-off-by: Johan Hovold <johan@kernel.org>
|
|
If the completion handler races with unthrottle() both functions may try
to resubmit the same interrupt-in urb, but at most one will succeed.
Fix the unthrottle logic using a throttle-requested flag so that only
one attempt to resubmit the urb is made to avoid logging an error.
Fixes: 43d186fe992d ("USB: serial: add metro-usb driver to the tree")
Signed-off-by: Johan Hovold <johan@kernel.org>
|
|
The unthrottle callback is allowed to sleep so pass the correct GFP flag
to usb_submit_urb() to avoid unnecessary atomic allocations.
Signed-off-by: Johan Hovold <johan@kernel.org>
|
|
The OOB port is not registered with driver core and does not have a
name.
Use the USB interface with dev_printk() that may involve the OOB port to
avoid log entries with no driver and a "null" device name.
Fixes: f9dfbebb8b39 ("USB: serial: digi_acceleport.c: remove dbg() usage")
Fixes: 194343d9364e ("USB: remove use of err() in drivers/usb/serial")
Signed-off-by: Johan Hovold <johan@kernel.org>
|
|
The latest EDK version was 14.7 released in 2013 that's why remove
description for it. Also remove generic description for Ethernet which
doesn't bring any value.
Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Michal Simek <michal.simek@amd.com>
|
|
"cache_strategy=" is meaningless and confusing on unencoded EROFS
filesystems; gate it on compressed images only since it's now possible
after commit 7cef3c834194 ("erofs: separate plain and compressed
filesystems formally").
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
|
|
The mlx4 CM paravirtualization layer rewrites a VF's local
communication ID to a PF-visible ID when CM MADs are sent from the VF.
For messages that start or advance a connection from the VF side, such
as REQ, REP, MRA and SIDR_REQ, mlx4_ib_multiplex_cm_handler() allocates
an id_map_entry when no existing mapping is found.
A REJ is different because it is a terminal response to an already known
exchange. It should either find an existing id_map_entry, rewrite the
local communication ID, and schedule that entry for deletion, or it
should pass through unchanged when no mapping exists.
Some REJ messages, such as rejects for an inbound REQ before an MRA or
REP was sent, do not have an id_map_entry because their local_comm_id is
zero. Timeout REJ messages are handled in the initial lookup branch, but
a lookup miss there must not fall through to id_map_alloc(); such a miss
means there is no existing mapping to translate or delete for the REJ.
Commit 227a0e142e37 ("IB/mlx4: Add support for REJ due to timeout")
added the timeout REJ case to the initial branch so an outgoing timeout
REJ could reuse the id_map_entry that was created when the VF's REQ was
multiplexed. Reusing that entry is the useful part: it rewrites the
timeout REJ local_comm_id to the same PF-visible ID that was sent in the
REQ. If the lookup misses, allocating a new id_map_entry does not help
because the peer has never seen that new PF-visible ID, and REJ is not
starting a new exchange.
Keep timeout REJ handling in the initial lookup branch, but return before
allocation if no mapping is found. Handle the other REJ cases with the
same lookup-only behavior. When a mapping is found, translate the local
communication ID and schedule delayed deletion, as is already done for
DREQ and for received REJ in the demux path. When no mapping is found,
keep the existing pass-through behavior.
Signed-off-by: Praveen Kumar Kannoju <praveen.kannoju@oracle.com>
Link: https://patch.msgid.link/20260615171759.557425-1-praveen.kannoju@oracle.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
|
|
diagnose_failure_lnl() read VPU_HW_BTRS_MTL_INTERRUPT_STAT instead of
VPU_HW_BTRS_LNL_INTERRUPT_STAT, which on LNL and newer parts is a
different register with a different bit layout, so failure diagnostics
decoded the wrong register and reported a bogus error cause.
Read the LNL interrupt status register instead.
Fixes: 8a27ad81f7d3 ("accel/ivpu: Split IP and buttress code")
Reviewed-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://patch.msgid.link/20260710101331.1899505-1-karol.wachowski@linux.intel.com
|
|
IntoGEMObject::from_raw() receives a pointer to struct drm_gem_object,
not a pointer to Self. The previous documentation used Self even though
the function argument is the embedded GEM object pointer.
However, the pointer must not be any arbitrary valid drm_gem_object. The
implementations recover Self with container_of(), so the GEM object must
be embedded in a valid Self instance. This patch documents that requirement
explicitly.
Assisted-by: Codex:GPT-5
Signed-off-by: Yilin Chen <1479826151@qq.com>
Link: https://patch.msgid.link/tencent_4426892E62B77DEA2AE898E899A871940005@qq.com
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
|
|
Clean up the inb command handling a bit by removing an unnecessary line
break and moving the assignment operator before breaking another long
expression.
Signed-off-by: Johan Hovold <johan@kernel.org>
|
|
Clean up the write completion handler by adding a temporary variable for
the transfer buffer and using the pre-existing urb pointer while
dropping some redundant casts.
Signed-off-by: Johan Hovold <johan@kernel.org>
|
|
Add the missing space around operators in transfer-buffer length
expressions to make the code more readable.
Signed-off-by: Johan Hovold <johan@kernel.org>
|
|
Drop the in-buf size define which has not been used since the port
buffers were removed by commit 5fea2a4dabdf ("USB: digi_acceleport
further buffer clean up").
Signed-off-by: Johan Hovold <johan@kernel.org>
|
|
The driver submits the OOB read urb on first open of a port and does not
stop it until the device is disconnected.
Add an open counter and submit the urb on first open and stop it on last
close to avoid wasting resources (e.g. power) when the device is not in
use.
Signed-off-by: Johan Hovold <johan@kernel.org>
|
|
The urb context pointer does not change while an urb is in flight so
there is never a need to check for NULL on completion.
The port driver data is not freed until the port is unbound at which
point all I/O for that port has been stopped (and I/O is no longer
started for a port that has not yet been probed).
The device driver data is not freed until after the driver has been
unbound and at which point all I/O has also ceased.
Drop the redundant, overly defensive (and still incomplete) sanity
checks from the completion callbacks.
Signed-off-by: Johan Hovold <johan@kernel.org>
|
|
Clean up the driver by moving some declarations to approximate reverse
xmas style and removing some stray newlines (and adding a few for
readability).
While at it, also replace two spaces before tabs in the driver structs.
Signed-off-by: Johan Hovold <johan@kernel.org>
|
|
Add a helper function for retrieving the OOB port to replace two
convoluted expressions.
Signed-off-by: Johan Hovold <johan@kernel.org>
|
|
Explicitly stop the write urb on close() also if the device is being
unbound instead of relying on core to do it after returning.
Note that the dp_write_urb_in_use flag is cleared by the completion
handler.
Signed-off-by: Johan Hovold <johan@kernel.org>
|
|
Drop the close wait queue which has not been used since commit
335f8514f200 ("tty: Bring the usb tty port structure into more use").
Signed-off-by: Johan Hovold <johan@kernel.org>
|
|
The driver submits the read urbs for all ports when the first port is
opened, which could happen before the other ports have been probed and
their private data set up.
If such an urb completes before the port has been probed, the completion
handler will not resubmit it, thus preventing any further reads.
Fix the ordering issue by not submitting the port read urbs until the
port is opened.
This also avoids wasting resources (e.g. power) when ports are not in
use.
Note that the port write urbs are already stopped on close (unless
unbinding, but they are also stopped by core on disconnect).
Fixes: fb44ff854e14 ("USB: digi_acceleport: fix port-data memory leak")
Signed-off-by: Johan Hovold <johan@kernel.org>
|
|
Stopping an urb is not an error and should not be logged as such.
Demote the dev_err() in the read bulk completion handler to dev_dbg()
when an urb is being unlinked on disconnect.
Note that this will become more of an issue when the urbs are stopped
every time a port is closed.
This issue was flagged by Sashiko when reviewing the upcoming change.
Link: https://sashiko.dev/#/patchset/20260623150826.314727-1-johan%40kernel.org?part=2
Signed-off-by: Johan Hovold <johan@kernel.org>
|
|
kvm_sbi_fwft_set() applies the caller's flags to conf->flags before
invoking the set() callback. If the callback returns an error, the LOCK
bit persists and the feature becomes permanently locked without its value
ever being changed.
Move the flags assignment after the callback so LOCK takes effect only
on success.
Fixes: 6b72fd170592 ("RISC-V: KVM: add support for FWFT SBI extension")
Signed-off-by: SeungJu Cheon <suunj1331@gmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260624130238.524706-1-suunj1331@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
|
|
We have been moving remote objects to an on-stack array and flushing it
when full. Instead, we can swap them towards the beginning of the
supplied array and bulk-free it just once.
Also add a comment to explain the rationale of freeing remote objects
last, because now it would appear to be simpler to free them first.
Reviewed-by: Pedro Falcato <pfalcato@suse.de>
Reviewed-by: Shengming Hu <hu.shengming@zte.com.cn>
Reviewed-by: Harry Yoo (Oracle) <harry@kernel.org>
Reviewed-by: Hao Li <hao.li@linux.dev>
Link: https://patch.msgid.link/20260713-bulk_free_remote-v2-1-24ee24771c2f@kernel.org
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
|
|
kvm_riscv_mmu_ioremap() currently tops up its on-stack page-table
cache via kvm_mmu_topup_memory_cache(), which allocates up to
KVM_ARCH_NR_OBJS_PER_MEMORY_CACHE (32) objects per topup.
ioremap only consumes non-leaf page-table pages, at most
pgd_levels - 1 (1 to 4) per call, and for contiguous mappings
within the same huge page the non-leaf pages are allocated once
and reused by subsequent pages. Topping up to 32 objects therefore
triggers many unnecessary GFP_KERNEL_ACCOUNT allocations on every
call, all of which are freed when the function returns. In hot
paths (such as vCPU migration), this creates avoidable allocator
churn and wastes CPU cycles.
Use __kvm_mmu_topup_memory_cache() with a capacity of pgd_levels so
the on-stack cache is sized to the maximum demand of a single
mapping. This removes the redundant allocations and reduces per-call
overhead without changing behavior.
Reviewed-by: Anup Patel <anup@brainfault.org>
Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
Link: https://lore.kernel.org/r/20260610093922.51617-1-fangyu.yu@linux.alibaba.com
Signed-off-by: Anup Patel <anup@brainfault.org>
|
|
dma_iova_destroy() frees the IOVA space through __iommu_dma_iova_unlink()
using a "free_iova" boolean, which duplicates the IOVA free logic in
dma_iova_free(). And it frees using the unmapped @mapped_len, which for a
partially linked reservation is smaller than the reserved size. This
results in a benign waste as pointed out by Robin, not a leak. So this is
a cleanup, not a fix.
Drop the duplicated free path. Fold __iommu_dma_iova_unlink into
dma_iova_unlink and remove the free_iova parameter so it only unmaps.
dma_iova_destroy then unlinks the mapped range if mapped_len is set and
unconditionally calls dma_iova_free, which frees the whole reservation
via dma_iova_size. The freed size now always matches the reserved size,
and destroy reads as unlink then free.
Note that dma_iova_destroy() no longer routes the free through the flush
queue; teardown now unmaps synchronously and frees directly, matching
dma_iova_free().
No functional change intended for callers.
Suggested-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Honglei Huang <honghuan@amd.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20260703033729.455358-1-honghuan@amd.com
|
|
Update DMA reserved memory pool allocation log messages to display
sizes in KiB instead of MiB. Using MiB caused allocations less than
1 MiB to be logged as 0 MiB due to integer truncation. KiB provides
better precision for smaller memory regions specified in the Device Tree.
Signed-off-by: Vova Sharaienko <sharaienko@google.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20260629223759.2637162-1-sharaienko@google.com
|
|
Fixed spacing around * coding style issue
Signed-off-by: Vova Sharaienko <sharaienko@google.com>
[mszyprow: changed patch prefix]
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20260623000821.2269955-1-sharaienko@google.com
|
|
esp_ssg_unref() releases the page references held on the source
scatterlist after the AEAD operation completes. It calls
skb_page_unref() on every frag page for an out-of-place transform
(req->src != req->dst), and in the error path of esp_output_tail()
(already_unref == true) on the request's own scatterlist.
This is wrong when the skb carries managed frags
(SKBFL_MANAGED_FRAG_REFS). Managed frags are owned by a zerocopy ubuf
and the skb does not hold a per-frag page reference; io_uring SEND_ZC
with a registered buffer attaches the bvec pages this way via
io_sg_from_iter(). The rest of the stack honours this invariant:
skb_release_data() skips the per-frag unref when SKBFL_MANAGED_FRAG_REFS
is set, and skb_zcopy_managed() is the guard used at the other unref
sites.
esp_ssg_unref() is missing that guard, so for a managed-frag skb it
drops a page reference the skb never acquired. This can underflow the
page reference count and free a page that is still in use.
Guard the function with skb_zcopy_managed() so both unref paths are
skipped for managed-frag skbs, matching skb_release_data().
Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Signed-off-by: Maher Azzouzi <maherazz04@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
|
|
The depth check in xfrm6_input_addr() is off by one:
if (1 + sp->len == XFRM_MAX_DEPTH)
goto drop;
...
sp->xvec[sp->len++] = x;
xfrm_input() can leave sp->len == XFRM_MAX_DEPTH, and the transport-mode
receive path re-enters IPv6 input via xfrm_trans_reinject() with that
secpath preserved. If the inner packet carries a destination-options HAO
option or a type-2 routing header, xfrm6_input_addr() is called with
sp->len == XFRM_MAX_DEPTH; the check (1 + 6 == 6) is false, so
sp->xvec[sp->len++] writes one slot past the 6-element xvec[]. The write
stays within the sec_path allocation (invisible to KASAN); UBSAN_BOUNDS
flags it and panics under panic_on_warn.
Use "sp->len >= XFRM_MAX_DEPTH", matching xfrm_input(). This also
restores one chain level the old check rejected at sp->len == 5.
UBSAN: array-index-out-of-bounds in net/ipv6/xfrm6_input.c:309:10
index 6 is out of range for type 'xfrm_state *[6]'
Fixes: 9473e1f631de ("[XFRM] MIPv6: Fix to input RO state correctly.")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
|
|
Add maintainers entry for the Samsung Exynos8855 SoC based platforms
Signed-off-by: Alim Akhtar <alim.akhtar@samsung.com>
Reviewed-by: Peter Griffin <peter.griffin@linaro.org>
Link: https://patch.msgid.link/20260627171228.2687857-7-alim.akhtar@samsung.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
|
|
Add initial devicetree support for Samsung smdk board using
Exynos8855 SoC.
This SoC has Octa-core CPU with tri cluster architecture, a custom GPU
and a NPU supporting up to 14.7 TOPS apart from other supporting peripheral
and IPs.
Commercially this SoC is also known as Exynos1580 [1]
[1] https://semiconductor.samsung.com/processor/mobile-processor/exynos-1580/
Signed-off-by: Alim Akhtar <alim.akhtar@samsung.com>
Link: https://semiconductor.samsung.com/processor/mobile-processor/exynos-1580/
Link: https://patch.msgid.link/20260627171228.2687857-6-alim.akhtar@samsung.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
|
|
Wrap the dequeue_xmitframes_to_sleeping_queue() function declaration to
fix line exceeding 100 characters.
This fixes the following checkpatch.pl check:
- CHECK: line length of 126 exceeds 100 columns.
Signed-off-by: Pablo Vallespín Aranguren <pablopva014@gmail.com>
Link: https://patch.msgid.link/alPVQEAdoUFjHiJo@ThinkPad-P15
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Add Samsung Exynos8855 smdk board to documentation
Signed-off-by: Alim Akhtar <alim.akhtar@samsung.com>
Reviewed-by: Peter Griffin <peter.griffin@linaro.org>
Link: https://patch.msgid.link/20260627171228.2687857-2-alim.akhtar@samsung.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
|
|
Add pinctrl configuration for Exynos8855. The bank type
macros are reused from EXYNOS850 and GS101 SoC.
Signed-off-by: Alim Akhtar <alim.akhtar@samsung.com>
Reviewed-by: Peter Griffin <peter.griffin@linaro.org>
Link: https://patch.msgid.link/20260627171228.2687857-4-alim.akhtar@samsung.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
|
|
Add a dedicated compatible for the exynos8855-wakeup-eint node, which
is compatible with Exynos7 implementation.
Signed-off-by: Alim Akhtar <alim.akhtar@samsung.com>
Reviewed-by: Peter Griffin <peter.griffin@linaro.org>
Link: https://patch.msgid.link/20260627171228.2687857-5-alim.akhtar@samsung.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
|
|
Document pin controller support on Exynos8855 SoC.
Signed-off-by: Alim Akhtar <alim.akhtar@samsung.com>
Reviewed-by: Peter Griffin <peter.griffin@linaro.org>
Link: https://patch.msgid.link/20260627171228.2687857-3-alim.akhtar@samsung.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
|
|
Correct eight PERIS gate clock parents to match the hardware clock
tree and reorder the GIC mux parents so mout_peris_bus_user is the
default source.
Signed-off-by: Denzeel Oliva <wachiturroxd150@gmail.com>
Reviewed-by: Peter Griffin <peter.griffin@linaro.org>
Link: https://patch.msgid.link/20260613-exynos990-peris-fix-v3-v3-3-2b230db78ae4@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
|
|
Add the missing CLK_GOUT_PERIS_TMU_SUB_PCLK gate clock for the Thermal
Management Unit sub-block and update CLKS_NR_PERIS accordingly.
Signed-off-by: Denzeel Oliva <wachiturroxd150@gmail.com>
Reviewed-by: Peter Griffin <peter.griffin@linaro.org>
Link: https://patch.msgid.link/20260613-exynos990-peris-fix-v3-v3-2-2b230db78ae4@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
|
|
Add the missing TMU_SUB_PCLK clock ID for the Exynos990 PERIS CMU.
Signed-off-by: Denzeel Oliva <wachiturroxd150@gmail.com>
Reviewed-by: Peter Griffin <peter.griffin@linaro.org>
Link: https://patch.msgid.link/20260613-exynos990-peris-fix-v3-v3-1-2b230db78ae4@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
|
|
restore_dm_crypt_keys_to_thread_keyring() gets a reference to the user
keyring before restoring the saved dm-crypt keys.
The same keyring reference is then passed to add_key_to_keyring() for each
saved key, but add_key_to_keyring() drops that reference on every call.
This is only balanced when exactly one key is restored. With multiple
keys, the keyring reference is dropped too many times and may trigger a
refcount underflow or use-after-free.
When more than five keys are restored, a refcount underflow/use-after-free
warning can be triggered.
The early error paths after lookup_user_key() also return without dropping
the keyring reference.
Keep ownership of the keyring reference in
restore_dm_crypt_keys_to_thread_keyring(), drop it once on all exit paths,
and make add_key_to_keyring() only use the reference without consuming it.
Fixes: 62f17d9df692 ("crash_dump: retrieve dm crypt keys in kdump kernel")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-and-tested-by: Coiby Xu <Coiby.Xu@gmail.com>
Acked-by: Baoquan He <baoquan.he@linux.dev>
Reviewed-by: Bradley Morgan <include@grrlz.net>
Link: https://patch.msgid.link/20260704112509.3717884-1-lgs201920130244@gmail.com
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
|
|
The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().
Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.
This is a source-level fix. It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
|
|
The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().
Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.
This is a source-level fix. It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
|
|
Document Inline Crypto Engine (ICE) on Qualcomm Nord SoC.
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Harshal Dev <harshal.dev@oss.qualcomm.com>
Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
|
|
The hand-rolled bit-scanning loop in the NCQ completion path has an
infinite loop bug. When tag_mask has only high bits set (e.g.
0x80000000), the inner while loop left-shifts tag_mask until it
overflows to 0. At that point !(0 & 1) is always true and 0 <<= 1
stays 0, causing an infinite loop in hardirq context with a spinlock
held.
Replace the open-coded bit-scanning with __ffs() which correctly
finds the least significant set bit and is bounded by the width of
the argument.
Fixes: 62936009f35a ("[libata] Add 460EX on-chip SATA driver, sata_dwc_460ex")
Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
|
|
clear_interrupt_bit() ignores the bit argument and performs a
read-write-back of the entire INTPR register. If INTPR uses standard
Write-1-to-Clear semantics, this clears every pending interrupt bit,
not just the intended one. Coalesced interrupts (e.g. DMAT + NEWFP)
would be cleared together, silently losing the second event.
Write only the specific bit to clear so that other pending interrupts
are preserved.
Fixes: 62936009f35a ("[libata] Add 460EX on-chip SATA driver, sata_dwc_460ex")
Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
|
|
Replace irq_of_parse_and_map() with platform_get_irq() in both
sata_dwc_dma_init_old() and sata_dwc_probe(). This is the preferred
way to obtain IRQs for platform devices and provides better error
reporting. Remove the now-unnecessary #include <linux/of_irq.h>.
irq_of_parse_and_map() requires irq_dispose_mapping(), which is missing.
Also fix unused variable when CONFIG_SATA_DWC_OLD_DMA is disabled.
Fixes: 62936009f35a ("[libata] Add 460EX on-chip SATA driver, sata_dwc_460ex")
Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
|
|
sata_dwc_enable_interrupts() is called before platform_get_irq() and
ata_host_activate(), leaving the SATA controller's interrupt mask
enabled without a registered handler. If a later step fails (irq
request, phy init, etc.) or if the controller asserts an interrupt
during probe, the irq line may fire with no handler, causing a
spurious interrupt storm.
Move sata_dwc_enable_interrupts() after ata_host_activate() so that
interrupts are only unmasked once the handler is registered and the
core is fully initialized.
Fixes: 62936009f35a ("[libata] Add 460EX on-chip SATA driver, sata_dwc_460ex")
Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
|
Johan Hovold
Maarten Lankhorst
Michal Simek
Gao Xiang
Praveen Kumar Kannoju
Karol Wachowski
Yilin Chen
SeungJu Cheon
Vlastimil Babka (SUSE)
Fangyu Yu
Honglei Huang
Vova Sharaienko
Maher Azzouzi
Xiang Mei
Alim Akhtar
Pablo Vallespín Aranguren
Denzeel Oliva
Guangshuo Li
Pengpeng Hou
Shawn Guo
Rosen Penev