update master #1

frank-w · 2017-12-12T16:31:27Z

Merge actual kernel-repo

Remove circular dependency deadlock in a scenario where hotplug of CPU is being done while there is updation in cgroup and cpuset triggered from userspace. Process A => kthreadd => Process B => Process C => Process A Process A cpu_subsys_offline(); cpu_down(); _cpu_down(); percpu_down_write(&cpu_hotplug_lock); //held cpuhp_invoke_callback(); workqueue_offline_cpu(); queue_work_on(); // unbind_work on system_highpri_wq __queue_work(); insert_work(); wake_up_worker(); flush_work(); wait_for_completion(); worker_thread(); manage_workers(); create_worker(); kthread_create_on_node(); wake_up_process(kthreadd_task); kthreadd kthreadd(); kernel_thread(); do_fork(); copy_process(); percpu_down_read(&cgroup_threadgroup_rwsem); __rwsem_down_read_failed_common(); //waiting Process B kernfs_fop_write(); cgroup_file_write(); cgroup_procs_write(); percpu_down_write(&cgroup_threadgroup_rwsem); //held cgroup_attach_task(); cgroup_migrate(); cgroup_migrate_execute(); cpuset_can_attach(); mutex_lock(&cpuset_mutex); //waiting Process C kernfs_fop_write(); cgroup_file_write(); cpuset_write_resmask(); mutex_lock(&cpuset_mutex); //held update_cpumask(); update_cpumasks_hier(); rebuild_sched_domains_locked(); get_online_cpus(); percpu_down_read(&cpu_hotplug_lock); //waiting Eliminating deadlock by reversing the locking order for cpuset_mutex and cpu_hotplug_lock. Signed-off-by: Prateek Sood <[email protected]> Signed-off-by: Tejun Heo <[email protected]>

Convert cpuset_hotplug_workfn() into synchronous call for cpu hotplug path. For memory hotplug path it still gets queued as a work item. Since cpuset_hotplug_workfn() can be made synchronous for cpu hotplug path, it is not required to wait for cpuset hotplug while thawing processes. Signed-off-by: Prateek Sood <[email protected]> Signed-off-by: Tejun Heo <[email protected]>

…rly() This is needed in order to allow the unbound workqueue to take housekeeping cpus into accounty Signed-off-by: Tal Shorer <[email protected]> Signed-off-by: Tejun Heo <[email protected]>

Initialize wq_unbound_cpumask to exclude cpus that were isolated by the cmdline's isolcpus parameter. Signed-off-by: Tal Shorer <[email protected]> Signed-off-by: Tejun Heo <[email protected]>

Signed-off-by: Albert Pool <[email protected]> Signed-off-by: Tejun Heo <[email protected]>

This macro `task_css_set` verifies that the caller is inside proper critical section if the kernel set CONFIG_PROVE_RCU=y. Signed-off-by: Wang Long <[email protected]> Signed-off-by: Tejun Heo <[email protected]>

Here, The function pdc_hardware_init always return zero. So it is not necessary to check its return value. Signed-off-by: Arvind Yadav <[email protected]> Signed-off-by: Tejun Heo <[email protected]>

Make these pdc2027x_*_timing structures const as it is never modified. Signed-off-by: Arvind Yadav <[email protected]> Signed-off-by: Tejun Heo <[email protected]>

Commit 438a506 ("percpu: don't forget to free the temporary struct pcpu_alloc_info") uncovered a problem on the CRIS architecture where the bootmem allocator is initialized with virtual addresses. Given it has: #define __va(x) ((void *)((unsigned long)(x) | 0x80000000)) then things just work out because the end result is the same whether you give this a physical or a virtual address. Untill you call memblock_free_early(__pa(address)) that is, because values from __pa() don't match with the virtual addresses stuffed in the bootmem allocator anymore. Avoid freeing the temporary pcpu_alloc_info memory on that architecture until they fix things up to let the kernel boot like it did before. Signed-off-by: Nicolas Pitre <[email protected]> Signed-off-by: Tejun Heo <[email protected]> Fixes: 438a506 ("percpu: don't forget to free the temporary struct pcpu_alloc_info")

Lockdep complains that the stats update is trying to register a non-static key. This is because u64_stats are using a seqlock on 32bit arches, which needs to be initialized before usage. Fixes: 041cd64 (cgroup: Implement cgroup2 basic CPU usage accounting) Signed-off-by: Lucas Stach <[email protected]> Signed-off-by: Tejun Heo <[email protected]>

In rsa_get_n(), if the buffer contained all 0's and "FIPS mode" is enabled, we would read one byte past the end of the buffer while scanning the leading zeroes. Fix it by checking 'n_sz' before '!*ptr'. This bug was reachable by adding a specially crafted key of type "asymmetric" (requires CONFIG_RSA and CONFIG_X509_CERTIFICATE_PARSER). KASAN report: BUG: KASAN: slab-out-of-bounds in rsa_get_n+0x19e/0x1d0 crypto/rsa_helper.c:33 Read of size 1 at addr ffff88003501a708 by task keyctl/196 CPU: 1 PID: 196 Comm: keyctl Not tainted 4.14.0-09238-g1d3b78bbc6e9 #26 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014 Call Trace: rsa_get_n+0x19e/0x1d0 crypto/rsa_helper.c:33 asn1_ber_decoder+0x82a/0x1fd0 lib/asn1_decoder.c:328 rsa_set_pub_key+0xd3/0x320 crypto/rsa.c:278 crypto_akcipher_set_pub_key ./include/crypto/akcipher.h:364 [inline] pkcs1pad_set_pub_key+0xae/0x200 crypto/rsa-pkcs1pad.c:117 crypto_akcipher_set_pub_key ./include/crypto/akcipher.h:364 [inline] public_key_verify_signature+0x270/0x9d0 crypto/asymmetric_keys/public_key.c:106 x509_check_for_self_signed+0x2ea/0x480 crypto/asymmetric_keys/x509_public_key.c:141 x509_cert_parse+0x46a/0x620 crypto/asymmetric_keys/x509_cert_parser.c:129 x509_key_preparse+0x61/0x750 crypto/asymmetric_keys/x509_public_key.c:174 asymmetric_key_preparse+0xa4/0x150 crypto/asymmetric_keys/asymmetric_type.c:388 key_create_or_update+0x4d4/0x10a0 security/keys/key.c:850 SYSC_add_key security/keys/keyctl.c:122 [inline] SyS_add_key+0xe8/0x290 security/keys/keyctl.c:62 entry_SYSCALL_64_fastpath+0x1f/0x96 Allocated by task 196: __do_kmalloc mm/slab.c:3711 [inline] __kmalloc_track_caller+0x118/0x2e0 mm/slab.c:3726 kmemdup+0x17/0x40 mm/util.c:118 kmemdup ./include/linux/string.h:414 [inline] x509_cert_parse+0x2cb/0x620 crypto/asymmetric_keys/x509_cert_parser.c:106 x509_key_preparse+0x61/0x750 crypto/asymmetric_keys/x509_public_key.c:174 asymmetric_key_preparse+0xa4/0x150 crypto/asymmetric_keys/asymmetric_type.c:388 key_create_or_update+0x4d4/0x10a0 security/keys/key.c:850 SYSC_add_key security/keys/keyctl.c:122 [inline] SyS_add_key+0xe8/0x290 security/keys/keyctl.c:62 entry_SYSCALL_64_fastpath+0x1f/0x96 Fixes: 5a7de97 ("crypto: rsa - return raw integers for the ASN.1 parser") Cc: <[email protected]> # v4.8+ Cc: Tudor Ambarus <[email protected]> Signed-off-by: Eric Biggers <[email protected]> Reviewed-by: James Morris <[email protected]> Reviewed-by: David Howells <[email protected]> Signed-off-by: Herbert Xu <[email protected]>

In the AEAD interface for AF_ALG, the reference to the "null skcipher" held by each tfm was being dropped in the wrong place -- when each af_alg_ctx was freed instead of when the aead_tfm was freed. As discovered by syzkaller, a specially crafted program could use this to cause the null skcipher to be freed while it is still in use. Fix it by dropping the reference in the right place. Fixes: 72548b0 ("crypto: algif_aead - copy AAD from src to dst") Reported-by: syzbot <[email protected]> Cc: <[email protected]> # v4.14+ Signed-off-by: Eric Biggers <[email protected]> Reviewed-by: Stephan Mueller <[email protected]> Signed-off-by: Herbert Xu <[email protected]>

af_alg_free_areq_sgls() If allocating the ->tsgl member of 'struct af_alg_async_req' failed, during cleanup we dereferenced the NULL ->tsgl pointer in af_alg_free_areq_sgls(), because ->tsgl_entries was nonzero. Fix it by only freeing the ->tsgl list if it is non-NULL. This affected both algif_skcipher and algif_aead. Fixes: e870456 ("crypto: algif_skcipher - overhaul memory management") Fixes: d887c52 ("crypto: algif_aead - overhaul memory management") Reported-by: syzbot <[email protected]> Cc: <[email protected]> # v4.14+ Signed-off-by: Eric Biggers <[email protected]> Reviewed-by: Stephan Mueller <[email protected]> Signed-off-by: Herbert Xu <[email protected]>

Because the HMAC template didn't check that its underlying hash algorithm is unkeyed, trying to use "hmac(hmac(sha3-512-generic))" through AF_ALG or through KEYCTL_DH_COMPUTE resulted in the inner HMAC being used without having been keyed, resulting in sha3_update() being called without sha3_init(), causing a stack buffer overflow. This is a very old bug, but it seems to have only started causing real problems when SHA-3 support was added (requires CONFIG_CRYPTO_SHA3) because the innermost hash's state is ->import()ed from a zeroed buffer, and it just so happens that other hash algorithms are fine with that, but SHA-3 is not. However, there could be arch or hardware-dependent hash algorithms also affected; I couldn't test everything. Fix the bug by introducing a function crypto_shash_alg_has_setkey() which tests whether a shash algorithm is keyed. Then update the HMAC template to require that its underlying hash algorithm is unkeyed. Here is a reproducer: #include <linux/if_alg.h> #include <sys/socket.h> int main() { int algfd; struct sockaddr_alg addr = { .salg_type = "hash", .salg_name = "hmac(hmac(sha3-512-generic))", }; char key[4096] = { 0 }; algfd = socket(AF_ALG, SOCK_SEQPACKET, 0); bind(algfd, (const struct sockaddr *)&addr, sizeof(addr)); setsockopt(algfd, SOL_ALG, ALG_SET_KEY, key, sizeof(key)); } Here was the KASAN report from syzbot: BUG: KASAN: stack-out-of-bounds in memcpy include/linux/string.h:341 [inline] BUG: KASAN: stack-out-of-bounds in sha3_update+0xdf/0x2e0 crypto/sha3_generic.c:161 Write of size 4096 at addr ffff8801cca07c40 by task syzkaller076574/3044 CPU: 1 PID: 3044 Comm: syzkaller076574 Not tainted 4.14.0-mm1+ #25 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 print_address_description+0x73/0x250 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report+0x25b/0x340 mm/kasan/report.c:409 check_memory_region_inline mm/kasan/kasan.c:260 [inline] check_memory_region+0x137/0x190 mm/kasan/kasan.c:267 memcpy+0x37/0x50 mm/kasan/kasan.c:303 memcpy include/linux/string.h:341 [inline] sha3_update+0xdf/0x2e0 crypto/sha3_generic.c:161 crypto_shash_update+0xcb/0x220 crypto/shash.c:109 shash_finup_unaligned+0x2a/0x60 crypto/shash.c:151 crypto_shash_finup+0xc4/0x120 crypto/shash.c:165 hmac_finup+0x182/0x330 crypto/hmac.c:152 crypto_shash_finup+0xc4/0x120 crypto/shash.c:165 shash_digest_unaligned+0x9e/0xd0 crypto/shash.c:172 crypto_shash_digest+0xc4/0x120 crypto/shash.c:186 hmac_setkey+0x36a/0x690 crypto/hmac.c:66 crypto_shash_setkey+0xad/0x190 crypto/shash.c:64 shash_async_setkey+0x47/0x60 crypto/shash.c:207 crypto_ahash_setkey+0xaf/0x180 crypto/ahash.c:200 hash_setkey+0x40/0x90 crypto/algif_hash.c:446 alg_setkey crypto/af_alg.c:221 [inline] alg_setsockopt+0x2a1/0x350 crypto/af_alg.c:254 SYSC_setsockopt net/socket.c:1851 [inline] SyS_setsockopt+0x189/0x360 net/socket.c:1830 entry_SYSCALL_64_fastpath+0x1f/0x96 Reported-by: syzbot <[email protected]> Cc: <[email protected]> Signed-off-by: Eric Biggers <[email protected]> Signed-off-by: Herbert Xu <[email protected]>

When asked to encrypt or decrypt 0 bytes, both the generic and x86 implementations of Salsa20 crash in blkcipher_walk_done(), either when doing 'kfree(walk->buffer)' or 'free_page((unsigned long)walk->page)', because walk->buffer and walk->page have not been initialized. The bug is that Salsa20 is calling blkcipher_walk_done() even when nothing is in 'walk.nbytes'. But blkcipher_walk_done() is only meant to be called when a nonzero number of bytes have been provided. The broken code is part of an optimization that tries to make only one call to salsa20_encrypt_bytes() to process inputs that are not evenly divisible by 64 bytes. To fix the bug, just remove this "optimization" and use the blkcipher_walk API the same way all the other users do. Reproducer: #include <linux/if_alg.h> #include <sys/socket.h> #include <unistd.h> int main() { int algfd, reqfd; struct sockaddr_alg addr = { .salg_type = "skcipher", .salg_name = "salsa20", }; char key[16] = { 0 }; algfd = socket(AF_ALG, SOCK_SEQPACKET, 0); bind(algfd, (void *)&addr, sizeof(addr)); reqfd = accept(algfd, 0, 0); setsockopt(algfd, SOL_ALG, ALG_SET_KEY, key, sizeof(key)); read(reqfd, key, sizeof(key)); } Reported-by: syzbot <[email protected]> Fixes: eb6f13e ("[CRYPTO] salsa20_generic: Fix multi-page processing") Cc: <[email protected]> # v2.6.25+ Signed-off-by: Eric Biggers <[email protected]> Signed-off-by: Herbert Xu <[email protected]>

These PP2C and PP3C registers control the configuration of the PHY control OOB timing for the COMINIT/COMWAKE parameters respectively for sata port. Overwrite default values with calculated ones to get better OOB timing. Signed-off-by: Tang Yuantian <[email protected]> Signed-off-by: Tejun Heo <[email protected]>

The driver name "ahci" is already used by the ahci platform driver. This leads to the following error: Error: Driver 'ahci' is already registered, aborting... Change the name to ahci-mtk to fix this. Signed-off-by: Matthias Brugger <[email protected]> Signed-off-by: Tejun Heo <[email protected]>

…sstatus speed During hotplug, it is possible for 6Gbps link speed to be limited all the way down to 1.5 Gbps which may lead to a slower link speed when drive is re-connected. This behavior has been seen on a Intel Lewisburg SATA controller (8086:a1d2) with HGST HUH728080ALE600 drive where SATA link speed was limited to 1.5 Gbps and when re-connected the link came up 3.0 Gbps. This patch was retested on above configuration and showed the hotplugged link to come back online at max speed (6Gbps). I did not see the downgrade when testing on Intel C600/X79, but retested patched linux-4.14-rc5 kernel and didn't see any side effects from this change. Also, successfully retested hotplug on port multiplier 3Gbps link. tj: Minor comment updates. Signed-off-by: David Milburn <[email protected]> Signed-off-by: Tejun Heo <[email protected]>

This reverts commit 1599a18. This and the previous commit led to another circular locking scenario and the scenario which is fixed by this commit no longer exists after e8b3f8d ("workqueue/hotplug: simplify workqueue_offline_cpu()") which removes work item flushing from hotplug path. Revert it for now. Signed-off-by: Tejun Heo <[email protected]>

Since the recent cpu/hotplug refactoring, workqueue_offline_cpu() is guaranteed to run on the local cpu which is going offline. This also fixes the following deadlock by removing work item scheduling and flushing from CPU hotplug path. http://lkml.kernel.org/r/[email protected] tj: Description update. Signed-off-by: Lai Jiangshan <[email protected]> Signed-off-by: Tejun Heo <[email protected]>

Since the cpu/hotplug refactoring, DOWN_FAILED is never called without preceding DOWN_PREPARE making the workaround unnecessary. Remove it. Signed-off-by: Lai Jiangshan <[email protected]> Signed-off-by: Tejun Heo <[email protected]>

This reverts commit aa24163. This and the following commit led to another circular locking scenario and the scenario which is fixed by this commit no longer exists after e8b3f8d ("workqueue/hotplug: simplify workqueue_offline_cpu()") which removes work item flushing from hotplug path. Revert it for now. Signed-off-by: Tejun Heo <[email protected]>

We haven't yet figured out what to do with RT threads on cgroup2. Document the limitation. v2: Included the warning about system management software behavior as suggested by Michael. Signed-off-by: Tejun Heo <[email protected]> Reported-by: "Michael Kerrisk (man-pages)" <[email protected]>

System may crash after unloading ipmi_si.ko module because a timer may remain and fire after the module cleaned up resources. cleanup_one_si() contains the following processing. /* * Make sure that interrupts, the timer and the thread are * stopped and will not run again. */ if (to_clean->irq_cleanup) to_clean->irq_cleanup(to_clean); wait_for_timer_and_thread(to_clean); /* * Timeouts are stopped, now make sure the interrupts are off * in the BMC. Note that timers and CPU interrupts are off, * so no need for locks. */ while (to_clean->curr_msg || (to_clean->si_state != SI_NORMAL)) { poll(to_clean); schedule_timeout_uninterruptible(1); } si_state changes as following in the while loop calling poll(to_clean). SI_GETTING_MESSAGES => SI_CHECKING_ENABLES => SI_SETTING_ENABLES => SI_GETTING_EVENTS => SI_NORMAL As written in the code comments above, timers are expected to stop before the polling loop and not to run again. But the timer is set again in the following process when si_state becomes SI_SETTING_ENABLES. => poll => smi_event_handler => handle_transaction_done // smi_info->si_state == SI_SETTING_ENABLES => start_getting_events => start_new_msg => smi_mod_timer => mod_timer As a result, before the timer set in start_new_msg() expires, the polling loop may see si_state becoming SI_NORMAL and the module clean-up finishes. For example, hard LOCKUP and panic occurred as following. smi_timeout was called after smi_event_handler, kcs_event and hangs at port_inb() trying to access I/O port after release. [exception RIP: port_inb+19] RIP: ffffffffc0473053 RSP: ffff88069fdc3d80 RFLAGS: 00000006 RAX: ffff8806800f8e00 RBX: ffff880682bd9400 RCX: 0000000000000000 RDX: 0000000000000ca3 RSI: 0000000000000ca3 RDI: ffff8806800f8e40 RBP: ffff88069fdc3d80 R8: ffffffff81d86dfc R9: ffffffff81e36426 R10: 00000000000509f0 R11: 0000000000100000 R12: 0000000000]:000000 R13: 0000000000000000 R14: 0000000000000246 R15: ffff8806800f8e00 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0000 --- <NMI exception stack> --- To fix the problem I defined a flag, timer_can_start, as member of struct smi_info. The flag is enabled immediately after initializing the timer and disabled immediately before waiting for timer deletion. Fixes: 0cfec91 ("ipmi: Start the timer and thread on internal msgs") Signed-off-by: Yamazaki Masamitsu <[email protected]> [Adjusted for recent changes in the driver.] Signed-off-by: Corey Minyard <[email protected]>

When the IPMI PCI code was split out, some code was consolidated for setting the io_setup field in the io structure. The PCI code needed this set before registration to probe register spacing, though, so restore the old code for that function. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=197999 Signed-off-by: Corey Minyard <[email protected]> Tested-by: Meelis Roos <[email protected]>

This patch fixes ipmi crash on parisc introduced in the kernel 4.15-rc. The pointer io.io_setup is not initialized and thus it causes crash in try_smi_init when attempting to call new_smi->io.io_setup. Signed-off-by: Mikulas Patocka <[email protected]> Signed-off-by: Corey Minyard <[email protected]>

The filw was converted from print_symbol() to %pf some time ago (044c782 "workqueue: fix checkpatch issues"). kallsyms does not seem to be needed anymore. Signed-off-by: Sergey Senozhatsky <[email protected]> Cc: Tejun Heo <[email protected]> Cc: Lai Jiangshan <[email protected]> Signed-off-by: Tejun Heo <[email protected]>

…/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "This push fixes the following issues: - buffer overread in RSA - potential use after free in algif_aead. - error path null pointer dereference in af_alg - forbid combinations such as hmac(hmac(sha3)) which may crash - crash in salsa20 due to incorrect API usage" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: salsa20 - fix blkcipher_walk API usage crypto: hmac - require that the underlying hash algorithm is unkeyed crypto: af_alg - fix NULL pointer dereference in crypto: algif_aead - fix reference counting of null skcipher crypto: rsa - fix buffer overread when stripping leading zeroes

Pull IPMI fixes from Corey Minyard. * tag 'for-linus-4.15-2' of git://github.com/cminyard/linux-ipmi: ipmi_si: fix crash on parisc ipmi_si: Fix oops with PCI devices ipmi: Stop timers before cleaning up the module

…ernel/git/tj/libata Pull libata fixes from Tejun Heo: "Nothing too interesting. David Milburn improved a corner case misbehavior during hotplug. Other than that, minor driver-specific fixes" * 'for-4.15-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata: libata: sata_down_spd_limit should return if driver has not recorded sstatus speed ahci: mtk: Change driver name to ahci-mtk ahci: qoriq: refine port register configuration pata_pdc2027x : make pdc2027x_*_timing structures const pata_pdc2027x: Remove unnecessary error check ata: mediatek: Fix typo in module description

as i only have older firmware yet atm, i reduced the mdio speed to default and changed the phy modes to usxgmii. $ uname -a Linux bpi-r4-pro 6.18.0-rc1-bpi-r4 #1 SMP Wed Oct 15 19:20:01 CEST 2025 aarch64 GNU/Linux root@bpi-r4-pro:~ $ dmesg | grep -i aeon [ 3.375859] Aeonsemi AS21xxx mdio-bus:18: DEBUG as21xxx_probe:787 [ 4.975260] Aeonsemi AS21xxx mdio-bus:18: Firmware Version: 1.8.2 [ 5.545842] Aeonsemi AS21xxx mdio-bus:1c: DEBUG as21xxx_probe:787 [ 7.140091] Aeonsemi AS21xxx mdio-bus:1c: Firmware Version: 1.8.2 root@bpi-r4-pro:~ $ ./regs m 0x1001F300 0x0 12 3 Value at 0x1001F300 (0x7f83e39300): 0x11100000 Modify 0x0[14:12]; Readback 0x11100000 root@bpi-r4-pro:~ $ ./regs m 0x1001F000 0x1 3 1 Value at 0x1001F000 (0x7f953db000): 0x28 Modify 0x1[3:3]; Readback 0x28 root@bpi-r4-pro:~ $ ./regs m 0x1001F100 0x0 3 1 Value at 0x1001F100 (0x7f9a2ec100): 0x20 Modify 0x0[3:3]; Readback 0x20 root@bpi-r4-pro:~ $ ip link set eth1 up [ 78.825998] Aeonsemi AS21xxx mdio-bus:1c: aeon_ipc_send_cmd fail to polling status failed: -110 [ 78.834776] Aeonsemi AS21xxx mdio-bus:1c: Firmware Version: [ 78.855684] mtk_soc_eth 15100000.ethernet eth1: PHY [mdio-bus:1c] driver [Aeonsemi AS21xxx] (irq=POLL) [ 78.872839] mtk_soc_eth 15100000.ethernet eth1: configuring for phy/usxgmii link mode [ 78.880688] mtk_soc_eth 15100000.ethernet eth1: firmware wants phy mode, but PCS requires inband [ 133.365631] rcu: INFO: rcu_sched self-detected stall on CPU [ 133.371211] rcu: 0-....: (5999 ticks this GP) idle=5494/1/0x4000000000000000 softirq=1546/1546 fqs=3000 [ 133.380680] rcu: (t=6000 jiffies g=1189 q=19 ncpus=4) [ 133.385810] CPU: 0 UID: 0 PID: 3415 Comm: ip Not tainted 6.18.0-rc1-bpi-r4 #1 NONE [ 133.385817] Hardware name: Bananapi BPI-R4 (DT) [ 133.385819] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 133.385824] pc : phylink_start+0xac/0x248 [ 133.385836] lr : phylink_start+0x8c/0x248 [ 133.385840] sp : ffffffc0885f34b0 [ 133.385842] x29: ffffffc0885f34b0 x28: ffffff80c00e1080 x27: ffffffc080fb7268 [ 133.385849] x26: ffffff80c24f2000 x25: ffffffc080fb62b8 x24: 0000000000000001 [ 133.385854] x23: 0000000000001002 x22: ffffff80c24f2a00 x21: ffffff80c24f2000 [ 133.385860] x20: 0000000000000000 x19: ffffff80c109b800 x18: 00000000000030b0 [ 133.385865] x17: 0000000000003040 x16: 0000000000005078 x15: 0000000000003048 [ 133.385869] x14: ffffff80c19241c0 x13: 0000000001e3ac80 x12: 0000000000000000 [ 133.385874] x11: 00000000000000c0 x10: 0000000000000980 x9 : ffffffc0885f3110 [ 133.385879] x8 : ffffff80c1924ae0 x7 : ffffff80ff754d00 x6 : 00000001308de816 [ 133.385884] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 [ 133.385889] x2 : ffffff80c23236b8 x1 : ffffff80c2323698 x0 : ffffff80c109b8a0 [ 133.385894] Call trace: [ 133.385896] phylink_start+0xac/0x248 (P) [ 133.385903] mtk_open+0x45c/0xb24 [ 133.385908] __dev_open+0x110/0x228 [ 133.385915] __dev_change_flags+0x1e8/0x240 [ 133.385919] netif_change_flags+0x24/0x6c [ 133.385924] do_setlink.isra.0+0xb50/0xe4c [ 133.385930] rtnl_newlink+0x684/0x968 [ 133.385934] rtnetlink_rcv_msg+0x1ec/0x378 [ 133.385939] netlink_rcv_skb+0x60/0x130 [ 133.385944] rtnetlink_rcv+0x18/0x24 [ 133.385949] netlink_unicast+0x300/0x374 [ 133.385952] netlink_sendmsg+0x180/0x3b8 [ 133.385956] ____sys_sendmsg+0x110/0x2c4 [ 133.385961] ___sys_sendmsg+0x84/0xe4 [ 133.385967] __sys_sendmsg+0x84/0xf4 [ 133.385971] __arm64_sys_sendmsg+0x24/0x30 [ 133.385975] invoke_syscall+0x48/0x10c [ 133.385981] el0_svc_common.constprop.0+0x40/0xe0 [ 133.385984] do_el0_svc+0x1c/0x28 [ 133.385988] el0_svc+0x34/0xec [ 133.385992] el0t_64_sync_handler+0xa0/0xe4 [ 133.385996] el0t_64_sync+0x19c/0x1a0

also the pcs error, but no rcu stall :) root@bpi-r4-pro:~ $ uname -a Linux bpi-r4-pro 6.18.0-rc1-bpi-r4 #1 SMP Thu Oct 16 07:26:21 CEST 2025 aarch64 GNU/Linux root@bpi-r4-pro:~ $ dmesg | grep -i aeon [ 5.257960] Aeonsemi AS21xxx mdio-bus:1c: Firmware Version: 1.8.5 root@bpi-r4-pro:~ $ ./regs m 0x1001F300 0x0 12 3 Value at 0x1001F300 (0x7f9708e300): 0x11101000 Modify 0x0[14:12]; Readback 0x11100000 root@bpi-r4-pro:~ $ ./regs m 0x1001F000 0x1 3 1 Value at 0x1001F000 (0x7fb56b7000): 0x20 Modify 0x1[3:3]; Readback 0x28 root@bpi-r4-pro:~ $ ./regs m 0x1001F100 0x0 3 1 Value at 0x1001F100 (0x7fa9635100): 0x20 Modify 0x0[3:3]; Readback 0x20 root@bpi-r4-pro:~ $ ip a a 192.168.0.19/24 dev eth1 root@bpi-r4-pro:~ $ ip l s eth1 up [ 91.444062] Aeonsemi AS21xxx mdio-bus:1c: Firmware Version: 1.8.5 [ 91.465333] mtk_soc_eth 15100000.ethernet eth1: PHY [mdio-bus:1c] driver [Aeonsemi AS21xxx] (irq=POLL) [ 91.482555] mtk_soc_eth 15100000.ethernet eth1: configuring for phy/usxgmii link mode [ 91.490439] mtk_soc_eth 15100000.ethernet eth1: firmware wants phy mode, but PCS requires inband

[ 5.277262] mtk-msdc 11230000.mmc: msdc_runtime_suspend:3308 before gate_clock [ 5.284492] mtk-msdc 11230000.mmc: msdc_gate_clock:925 before bulk_disable_unprepare [ 5.292255] Unable to handle kernel paging request at virtual address ffffffc0813d2388 [ 5.300166] Mem abort info: [ 5.302948] ESR = 0x0000000096000007 [ 5.306684] EC = 0x25: DABT (current EL), IL = 32 bits [ 5.311983] SET = 0, FnV = 0 [ 5.315025] EA = 0, S1PTW = 0 [ 5.318154] FSC = 0x07: level 3 translation fault [ 5.323020] Data abort info: [ 5.325888] ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 [ 5.331359] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 5.336397] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 5.341695] swapper pgtable: 4k pages, 39-bit VAs, pgdp=00000000452fd000 [ 5.348382] [ffffffc0813d2388] pgd=1000000045ae1003, p4d=1000000045ae1003, pud=1000000045ae1003, pmd=1000000045ae4003, pte=0000000000000000 [ 5.360895] Internal error: Oops: 0000000096000007 [#1] SMP [ 5.366543] Modules linked in: [ 5.369590] CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.18.0-rc1-bpi-r4-mt7987-clk #34 NONE [ 5.378882] Hardware name: Bananapi BPI-R4-LITE (DT) [ 5.383834] Workqueue: pm pm_runtime_work [ 5.387843] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 5.394792] pc : mtk_cg_disable+0x18/0x38 [ 5.398795] lr : clk_core_disable+0x7c/0x150 [ 5.403057] sp : ffffffc081bb3bc0 [ 5.406360] x29: ffffffc081bb3bc0 x28: ffffff8000113540 x27: 0000000000000000 [ 5.413485] x26: ffffff8000113580 x25: 00000000000f4240 x24: ffffff80001a1ac0 [ 5.420610] x23: 0000000000000008 x22: 0000000000000004 x21: ffffff8001112738 [ 5.427734] x20: ffffff8000ff8800 x19: ffffff8000ff8800 x18: 00000000ffffffff [ 5.434858] x17: 755f656c62617369 x16: 645f6b6c75622065 x15: 726f666562203532 [ 5.441983] x14: 00000000ffffffea x13: ffffffc081bb3918 x12: ffffffc081869cf0 [ 5.449107] x11: 0000000000000001 x10: 0000000000000001 x9 : 0000000000017fe8 [ 5.456232] x8 : c0000000ffffefff x7 : ffffffc081811c70 x6 : 0000000000057fa8 [ 5.463356] x5 : ffffffc081869c98 x4 : ffffffc081ace6a8 x3 : 0000000000000001 [ 5.470480] x2 : 0000000000000001 x1 : ffffffc0813d2370 x0 : ffffff8001036400 [ 5.477605] Call trace: [ 5.480041] mtk_cg_disable+0x18/0x38 (P) [ 5.484043] clk_core_disable+0x7c/0x150 [ 5.487956] clk_disable+0x30/0x4c [ 5.491350] clk_bulk_disable+0x3c/0x58 [ 5.495177] msdc_gate_clock+0x48/0x15c [ 5.499005] msdc_runtime_suspend+0x2a0/0x2e4 [ 5.503352] pm_generic_runtime_suspend+0x2c/0x44 [ 5.508047] __rpm_callback+0x40/0x228 [ 5.511788] rpm_callback+0x38/0x80 [ 5.515268] rpm_suspend+0xd8/0x630 [ 5.518748] pm_runtime_work+0x114/0x118 [ 5.522662] process_one_work+0x164/0x3ac [ 5.526665] worker_thread+0x284/0x46c [ 5.530404] kthread+0x114/0x1c8 [ 5.533623] ret_from_fork+0x10/0x20 [ 5.537193] Code: d2800023 910003fd f9401401 f9400c00 (f9400c24) [ 5.543272] ---[ end trace 0000000000000000 ]--- [ 5.277262] mtk-msdc 11230000.mmc: msdc_runtime_suspend:3308 before gate_clock [ 5.284492] mtk-msdc 11230000.mmc: msdc_gate_clock:925 before bulk_disable_unprepare [ 5.292255] Unable to handle kernel paging request at virtual address ffffffc0813d2388 [ 5.300166] Mem abort info: [ 5.302948] ESR = 0x0000000096000007 [ 5.306684] EC = 0x25: DABT (current EL), IL = 32 bits [ 5.311983] SET = 0, FnV = 0 [ 5.315025] EA = 0, S1PTW = 0 [ 5.318154] FSC = 0x07: level 3 translation fault [ 5.323020] Data abort info: [ 5.325888] ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 [ 5.331359] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 5.336397] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 5.341695] swapper pgtable: 4k pages, 39-bit VAs, pgdp=00000000452fd000 [ 5.348382] [ffffffc0813d2388] pgd=1000000045ae1003, p4d=1000000045ae1003, pud=1000000045ae1003, pmd=1000000045ae4003, pte=0000000000000000 [ 5.360895] Internal error: Oops: 0000000096000007 [#1] SMP [ 5.366543] Modules linked in: [ 5.369590] CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.18.0-rc1-bpi-r4-mt7987-clk #34 NONE [ 5.378882] Hardware name: Bananapi BPI-R4-LITE (DT) [ 5.383834] Workqueue: pm pm_runtime_work [ 5.387843] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 5.394792] pc : mtk_cg_disable+0x18/0x38 [ 5.398795] lr : clk_core_disable+0x7c/0x150 [ 5.403057] sp : ffffffc081bb3bc0 [ 5.406360] x29: ffffffc081bb3bc0 x28: ffffff8000113540 x27: 0000000000000000 [ 5.413485] x26: ffffff8000113580 x25: 00000000000f4240 x24: ffffff80001a1ac0 [ 5.420610] x23: 0000000000000008 x22: 0000000000000004 x21: ffffff8001112738 [ 5.427734] x20: ffffff8000ff8800 x19: ffffff8000ff8800 x18: 00000000ffffffff [ 5.434858] x17: 755f656c62617369 x16: 645f6b6c75622065 x15: 726f666562203532 [ 5.441983] x14: 00000000ffffffea x13: ffffffc081bb3918 x12: ffffffc081869cf0 [ 5.449107] x11: 0000000000000001 x10: 0000000000000001 x9 : 0000000000017fe8 [ 5.456232] x8 : c0000000ffffefff x7 : ffffffc081811c70 x6 : 0000000000057fa8 [ 5.463356] x5 : ffffffc081869c98 x4 : ffffffc081ace6a8 x3 : 0000000000000001 [ 5.470480] x2 : 0000000000000001 x1 : ffffffc0813d2370 x0 : ffffff8001036400 [ 5.477605] Call trace: [ 5.480041] mtk_cg_disable+0x18/0x38 (P) [ 5.484043] clk_core_disable+0x7c/0x150 [ 5.487956] clk_disable+0x30/0x4c [ 5.491350] clk_bulk_disable+0x3c/0x58 [ 5.495177] msdc_gate_clock+0x48/0x15c [ 5.499005] msdc_runtime_suspend+0x2a0/0x2e4 [ 5.503352] pm_generic_runtime_suspend+0x2c/0x44 [ 5.508047] __rpm_callback+0x40/0x228 [ 5.511788] rpm_callback+0x38/0x80 [ 5.515268] rpm_suspend+0xd8/0x630 [ 5.518748] pm_runtime_work+0x114/0x118 [ 5.522662] process_one_work+0x164/0x3ac [ 5.526665] worker_thread+0x284/0x46c [ 5.530404] kthread+0x114/0x1c8 [ 5.533623] ret_from_fork+0x10/0x20 [ 5.537193] Code: d2800023 910003fd f9401401 f9400c00 (f9400c24) [ 5.543272] ---[ end trace 0000000000000000 ]--- Fixes: ("clk: mediatek: clk-gate: Refactor mtk_clk_register_gate to use mtk_gate struct") Fixes: ("clk: mediatek: add clock driver for mt7987 from sdk")