5.15.46-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainerPATCH 285/667 x86/mm: Cleanup the control_va_addr_alignment() __setup handler
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 1ef64b1e89e6d4018da46e08ffc32779a31160c7 ]
Clean up control_va_addr_alignment():
a. Make '=' required instead of optional (as documented). b. Print a warning if an invalid option value is used.
c. Return 1 from the __setup handler when an invalid option value is
used. This prevents the kernel from polluting init's (limited) environment space with the entire string.
--- arch/x86/kernel/sys_x86_64.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
arch/x86/kernel/sys_x86_64.c +2 -5
@@ -68,9 +68,6 @@ static int __init control_va_addr_alignment(char *str)if (*str ==0 )return 1 ; -if (*str =='=' ) - str++; -if (!strcmp (str,"32" )) va_align.flags =ALIGN_VA_32 ;else if (!strcmp (str,"64" ))
@@ -80,11 +77,11 @@ static int __init control_va_addr_alignment(char *str)else if (!strcmp (str,"on" )) va_align.flags =ALIGN_VA_32 |ALIGN_VA_64 ;else -return 0 ; +pr_warn ("invalid option value: 'align_va_addr=%s'\n" , str);return 1 ; } -__setup ("align_va_addr" , control_va_addr_alignment); +__setup ("align_va_addr=" , control_va_addr_alignment); SYSCALL_DEFINE6(mmap, unsigned long, addr, unsigned long, len, unsigned long, prot, unsigned long, flags,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 286/667 arm64: fix types in copy_highpage()
In reply to Greg Kroah-HartmanFrom: Tong Tiangen <[email protected]>
[ Upstream commit 921d161f15d6b090599f6a8c23f131969edbd1fa ]
In copy_highpage() the kto and kfrom local variables are pointers to struct page, but these are used to hold arbitrary pointers to kernel memory . Each call to page_address() returns a void pointer to memory associated with the relevant page, and copy_page() expects void pointers to this memory.
This inconsistency was introduced in commit 2563776b41c3 ("arm64: mte:
Tags-aware copy_{user_,}highpage() implementations") and while this doesn't appear to be harmful in practice it is clearly wrong.
Correct this by making kto and kfrom void pointers.
--- arch/arm64/mm/copypage.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/mm/copypage.c +2 -2
@@ -16,8 +16,8 @@void copy_highpage (struct page *to,struct page *from) { -struct page *kto =page_address (to); -struct page *kfrom =page_address (from); +void *kto =page_address (to); +void *kfrom =page_address (from);copy_page (kto, kfrom);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 287/667 regulator: core: Fix enable_count imbalance with EXCLUSIVE_GET
In reply to Greg Kroah-HartmanFrom: Zev Weiss <[email protected]>
[ Upstream commit c3e3ca05dae37f8f74bb80358efd540911cbc2c8 ]
Since the introduction of regulator->enable_count, a driver that did an exclusive get on an already-enabled regulator would end up with enable_count initialized to 0 but rdev->use_count initialized to 1. With that starting point the regulator is effectively stuck enabled, because if the driver attempted to disable it it would fail the enable_count underflow check in _regulator_handle_consumer_disable().
The EXCLUSIVE_GET path in _regulator_get() now initializes enable_count along with rdev->use_count so that the regulator can be disabled without underflowing the former.
--- drivers/regulator/core.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/regulator/core.c +5 -2
@@ -2132,10 +2132,13 @@ struct regulator *_regulator_get(struct device *dev, const char *id, rdev->exclusive =1 ; ret =_regulator_is_enabled (rdev); -if (ret >0 ) +if (ret >0 ) { rdev->use_count =1 ; -else + regulator->enable_count =1 ; + }else { rdev->use_count =0 ; + regulator->enable_count =0 ; + } } link =device_link_add (dev, &rdev->dev,DL_FLAG_STATELESS );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 288/667 drm/msm/dsi: fix address for second DSI PHY on SDM660
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 9208c707650354dff5b164b586837454f7285124 ]
Correct a typo in the address of the second DSI PHY in the SDM660 device config.
Patchwork: https://patchwork.freedesktop.org/patch/484697/
--- drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c +1 -1
@@ -1064,6 +1064,6 @@ const struct msm_dsi_phy_cfg dsi_phy_14nm_660_cfgs = { }, .min_pll_rate = VCO_MIN_RATE, .max_pll_rate = VCO_MAX_RATE, - .io_start = { 0xc994400, 0xc996000 }, + .io_start = { 0xc994400, 0xc996400 }, .num_dsi_phy = 2, };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 289/667 drm/msm/dp: fix event thread stuck in wait_event after kthread_stop()
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
[ Upstream commit 2f9b5b3ae2eb625b75a898212a76f3b8c6d0d2b0 ]
Event thread supposed to exit from its while loop after kthread_stop(). However there may has possibility that event thread is pending in the middle of wait_event due to condition checking never become true. To make sure event thread exit its loop after kthread_stop(), this patch OR kthread_should_stop() into wait_event's condition checking so that event thread will exit its loop after kernal_stop().
Changes in v2:
-- correct spelling error at commit title
Changes in v3:
-- remove unnecessary parenthesis
-- while(1) to replace while (!kthread_should_stop())
Patchwork: https://patchwork.freedesktop.org/patch/484576/
--- drivers/gpu/drm/msm/dp/dp_display.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/gpu/drm/msm/dp/dp_display.c +9 -4
@@ -1069,15 +1069,20 @@ static int hpd_event_thread(void *data) dp_priv = (struct dp_display_private *)data; -while (!kthread_should_stop ()) { +while (1 ) {if (timeout_mode) {wait_event_timeout (dp_priv->event_q, - (dp_priv->event_pndx == dp_priv->event_gndx), -EVENT_TIMEOUT ); + (dp_priv->event_pndx == dp_priv->event_gndx) || +kthread_should_stop (),EVENT_TIMEOUT ); }else {wait_event_interruptible (dp_priv->event_q, - (dp_priv->event_pndx != dp_priv->event_gndx)); + (dp_priv->event_pndx != dp_priv->event_gndx) || +kthread_should_stop ()); } + +if (kthread_should_stop ()) +break ; +spin_lock_irqsave (&dp_priv->event_lock, flag); todo = &dp_priv->event_list[dp_priv->event_gndx];if (todo->delay) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 290/667 drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected
In reply to Greg Kroah-HartmanFrom: Jessica Zhang <[email protected]>
[ Upstream commit d59be579fa932c46b908f37509f319cbd4ca9a68 ]
mdp5_get_global_state runs the risk of hitting a -EDEADLK when acquiring the modeset lock, but currently mdp5_pipe_release doesn't check for if an error is returned. Because of this, there is a possibility of mdp5_pipe_release hitting a NULL dereference error.
To avoid this, let's have mdp5_pipe_release check if mdp5_get_global_state returns an error and propogate that error.
Changes since v1:
- Separated declaration and initialization of *new_state to avoid compiler warning
- Fixed some spelling mistakes in commit message
Changes since v2:
- Return 0 in case where hwpipe is NULL as this is considered normal behavior
- Added 2nd patch in series to fix a similar NULL dereference issue in mdp5_mixer_release
Patchwork: https://patchwork.freedesktop.org/patch/485179/
--- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 15 +++++++++++---- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 ++++++++++++++++---- 3 files changed, 28 insertions(+), 9 deletions(-)
drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c +11 -4
@@ -119,18 +119,23 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane,return 0 ; } -void mdp5_pipe_release (struct drm_atomic_state *s,struct mdp5_hw_pipe *hwpipe) +int mdp5_pipe_release (struct drm_atomic_state *s,struct mdp5_hw_pipe *hwpipe) {struct msm_drm_private *priv = s->dev->dev_private;struct mdp5_kms *mdp5_kms =to_mdp5_kms (to_mdp_kms (priv->kms));struct mdp5_global_state *state =mdp5_get_global_state (s); -struct mdp5_hw_pipe_state *new_state = &state->hwpipe; +struct mdp5_hw_pipe_state *new_state;if (!hwpipe) -return ; +return 0 ; + +if (IS_ERR (state)) +return PTR_ERR (state); + + new_state = &state->hwpipe;if (WARN_ON (!new_state->hwpipe_to_plane[hwpipe->idx])) -return ; +return -EINVAL ;DBG ("%s: release from plane %s" , hwpipe->name, new_state->hwpipe_to_plane[hwpipe->idx]->name);
@@ -141,6 +146,8 @@ void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) } new_state->hwpipe_to_plane[hwpipe->idx] =NULL ; + +return 0 ; }void mdp5_pipe_destroy (struct mdp5_hw_pipe *hwpipe)
drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h +1 -1
@@ -37,7 +37,7 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane, uint32_t caps, uint32_t blkcfg, struct mdp5_hw_pipe **hwpipe, struct mdp5_hw_pipe **r_hwpipe); -void mdp5_pipe_release (struct drm_atomic_state *s,struct mdp5_hw_pipe *hwpipe); +int mdp5_pipe_release (struct drm_atomic_state *s,struct mdp5_hw_pipe *hwpipe);struct mdp5_hw_pipe *mdp5_pipe_init (enum mdp5_pipe pipe,uint32_t reg_offset,uint32_t caps);
drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +16 -4
@@ -297,12 +297,24 @@ static int mdp5_plane_atomic_check_with_state(struct drm_crtc_state *crtc_state, mdp5_state->r_hwpipe =NULL ; -mdp5_pipe_release (state->state, old_hwpipe); -mdp5_pipe_release (state->state, old_right_hwpipe); + ret =mdp5_pipe_release (state->state, old_hwpipe); +if (ret) +return ret; + + ret =mdp5_pipe_release (state->state, old_right_hwpipe); +if (ret) +return ret; + } }else { -mdp5_pipe_release (state->state, mdp5_state->hwpipe); -mdp5_pipe_release (state->state, mdp5_state->r_hwpipe); + ret =mdp5_pipe_release (state->state, mdp5_state->hwpipe); +if (ret) +return ret; + + ret =mdp5_pipe_release (state->state, mdp5_state->r_hwpipe); +if (ret) +return ret; + mdp5_state->hwpipe = mdp5_state->r_hwpipe =NULL ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 291/667 drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected
In reply to Greg Kroah-HartmanFrom: Jessica Zhang <[email protected]>
[ Upstream commit ca75f6f7c6f89365e40f10f641b15981b1f07c31 ]
There is a possibility for mdp5_get_global_state to return -EDEADLK when acquiring the modeset lock, but currently global_state in mdp5_mixer_release doesn't check for if an error is returned.
To avoid a NULL dereference error, let's have mdp5_mixer_release check if an error is returned and propagate that error.
Patchwork: https://patchwork.freedesktop.org/patch/485181/
--- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 10 ++++++++-- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c | 15 +++++++++++---- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h | 4 ++-- 3 files changed, 21 insertions(+), 8 deletions(-)
drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +8 -2
@@ -612,9 +612,15 @@ static int mdp5_crtc_setup_pipeline(struct drm_crtc *crtc,if (ret)return ret; -mdp5_mixer_release (new_crtc_state->state, old_mixer); + ret =mdp5_mixer_release (new_crtc_state->state, old_mixer); +if (ret) +return ret; +if (old_r_mixer) { -mdp5_mixer_release (new_crtc_state->state, old_r_mixer); + ret =mdp5_mixer_release (new_crtc_state->state, old_r_mixer); +if (ret) +return ret; +if (!need_right_mixer) pipeline->r_mixer =NULL ; }
drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c +11 -4
@@ -116,21 +116,28 @@ int mdp5_mixer_assign(struct drm_atomic_state *s, struct drm_crtc *crtc,return 0 ; } -void mdp5_mixer_release (struct drm_atomic_state *s,struct mdp5_hw_mixer *mixer) +int mdp5_mixer_release (struct drm_atomic_state *s,struct mdp5_hw_mixer *mixer) {struct mdp5_global_state *global_state =mdp5_get_global_state (s); -struct mdp5_hw_mixer_state *new_state = &global_state->hwmixer; +struct mdp5_hw_mixer_state *new_state;if (!mixer) -return ; +return 0 ; + +if (IS_ERR (global_state)) +return PTR_ERR (global_state); + + new_state = &global_state->hwmixer;if (WARN_ON (!new_state->hwmixer_to_crtc[mixer->idx])) -return ; +return -EINVAL ;DBG ("%s: release from crtc %s" , mixer->name, new_state->hwmixer_to_crtc[mixer->idx]->name); new_state->hwmixer_to_crtc[mixer->idx] =NULL ; + +return 0 ; }void mdp5_mixer_destroy (struct mdp5_hw_mixer *mixer)
drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h +2 -2
@@ -30,7 +30,7 @@ void mdp5_mixer_destroy(struct mdp5_hw_mixer *lm);int mdp5_mixer_assign (struct drm_atomic_state *s,struct drm_crtc *crtc,uint32_t caps,struct mdp5_hw_mixer **mixer,struct mdp5_hw_mixer **r_mixer); -void mdp5_mixer_release (struct drm_atomic_state *s, -struct mdp5_hw_mixer *mixer); +int mdp5_mixer_release (struct drm_atomic_state *s, +struct mdp5_hw_mixer *mixer);#endif /* __MDP5_LM_H__ */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 292/667 drm/msm: return an error pointer in msm_gem_prime_get_sg_table()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit cf575e31611eb6dccf08fad02e57e35b2187704d ]
The msm_gem_prime_get_sg_table() needs to return error pointers on error. This is called from drm_gem_map_dma_buf() and returning a NULL will lead to a crash in that function.
Patchwork: https://patchwork.freedesktop.org/patch/485023/
--- drivers/gpu/drm/msm/msm_gem_prime.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/msm_gem_prime.c +1 -1
@@ -17,7 +17,7 @@ struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj)int npages = obj->size >>PAGE_SHIFT ;if (WARN_ON (!msm_obj->pages))/* should have already pinned! */ -return NULL ; +return ERR_PTR (-ENOMEM );return drm_prime_pages_to_sg (obj->dev, msm_obj->pages, npages); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 293/667 media: uvcvideo: Fix missing check to determine if element is found in list
In reply to Greg Kroah-HartmanFrom: Xiaomeng Tong <[email protected]>
[ Upstream commit 261f33388c29f6f3c12a724e6d89172b7f6d5996 ]
The list iterator will point to a bogus position containing HEAD if the list is empty or the element is not found in list. This case should be checked before any use of the iterator, otherwise it will lead to a invalid memory access. The missing check here is before "pin = iterm->id;", just add check here to fix the security bug.
In addition, the list iterator value will *always* be set and non-NULL by list_for_each_entry(), so it is incorrect to assume that the iterator value will be NULL if the element is not found in list, considering the (mis)use here: "if (iterm == NULL".
Use a new value 'it' as the list iterator, while use the old value 'iterm' as a dedicated pointer to point to the found element, which
1. can fix this bug, due to 'iterm' is NULL only if it's not found.
2. do not need to change all the uses of 'iterm' after the loop.
3. can also limit the scope of the list iterator 'it' *only inside* the traversal loop by simply declaring 'it' inside the loop in the future, as usage of the iterator outside of the list_for_each_entry is considered harmful. https://lkml.org/lkml/2022/2/17/1032
--- drivers/media/usb/uvc/uvc_v4l2.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
drivers/media/usb/uvc/uvc_v4l2.c +11 -9
@@ -864,29 +864,31 @@ static int uvc_ioctl_enum_input(struct file *file, void *fh,struct uvc_video_chain *chain = handle->chain;const struct uvc_entity *selector = chain->selector;struct uvc_entity *iterm =NULL ; +struct uvc_entity *it;u32 index = input->index; -int pin =0 ;if (selector ==NULL || (chain->dev->quirks &UVC_QUIRK_IGNORE_SELECTOR_UNIT )) {if (index !=0 )return -EINVAL ; -list_for_each_entry (iterm, &chain->entities, chain) { -if (UVC_ENTITY_IS_ITERM (iterm)) +list_for_each_entry (it, &chain->entities, chain) { +if (UVC_ENTITY_IS_ITERM (it)) { + iterm = it;break ; + } } - pin = iterm->id; }else if (index < selector->bNrInPins) { - pin = selector->baSourceID[index]; -list_for_each_entry (iterm, &chain->entities, chain) { -if (!UVC_ENTITY_IS_ITERM (iterm)) +list_for_each_entry (it, &chain->entities, chain) { +if (!UVC_ENTITY_IS_ITERM (it))continue ; -if (iterm->id == pin) +if (it->id == selector->baSourceID[index]) { + iterm = it;break ; + } } } -if (iterm ==NULL || iterm->id != pin) +if (iterm ==NULL )return -EINVAL ;memset (input,0 ,sizeof (*input));
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 294/667 arm64: stackleak: fix current_top_of_stack()
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
[ Upstream commit e85094c31ddb794ac41c299a5a7a68243148f829 ]
Due to some historical confusion, arm64's current_top_of_stack() isn't what the stackleak code expects. This could in theory result in a number of problems, and practically results in an unnecessary performance hit. We can avoid this by aligning the arm64 implementation with the x86 implementation.
The arm64 implementation of current_top_of_stack() was added specifically for stackleak in commit:
0b3e336601b82c6a ("arm64: Add support for STACKLEAK gcc plugin")
This was intended to be equivalent to the x86 implementation, but the implementation, semantics, and performance characteristics differ wildly:
* On x86, current_top_of_stack() returns the top of the current task's task stack, regardless of which stack is in active use.
The implementation accesses a percpu variable which the x86 entry code maintains, and returns the location immediately above the pt_regs on the task stack (above which x86 has some padding).
* On arm64 current_top_of_stack() returns the top of the stack in active use (i.e. the one which is currently being used).
The implementation checks the SP against a number of potentially-accessible stacks, and will BUG() if no stack is found.
The core stackleak_erase() code determines the upper bound of stack to erase with:
| if (on_thread_stack()) | boundary = current_stack_pointer; | else | boundary = current_top_of_stack();
On arm64 stackleak_erase() is always called on a task stack, and on_thread_stack() should always be true. On x86, stackleak_erase() is mostly called on a trampoline stack, and is sometimes called on a task stack.
Currently, this results in a lot of unnecessary code being generated for arm64 for the impossible !on_thread_stack() case. Some of this is inlined, bloating stackleak_erase(), while portions of this are left out-of-line and permitted to be instrumented (which would be a functional problem if that code were reachable).
As a first step towards improving this, this patch aligns arm64's implementation of current_top_of_stack() with x86's, always returning the top of the current task's stack. With GCC 11.1.0 this results in the bulk of the unnecessary code being removed, including all of the out-of-line instrumentable code.
While I don't believe there's a functional problem in practice I've marked this as a fix since the semantic was clearly wrong, the fix itself is simple, and other code might rely upon this in future.
--- arch/arm64/include/asm/processor.h | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
arch/arm64/include/asm/processor.h +4 -6
@@ -335,12 +335,10 @@ long get_tagged_addr_ctrl(struct task_struct *task);* of header definitions for the use of task_stack_page. */ -#define current_top_of_stack () \ -({ \ - struct stack_info _info; \ - BUG_ON(!on_accessible_stack(current, current_stack_pointer, 1, &_info)); \ - _info.high; \ -}) +/* +* The top of the current task's task stack +*/ +#define current_top_of_stack () ((unsigned long)current->stack + THREAD_SIZE)#define on_thread_stack () (on_task_stack(current, current_stack_pointer, 1, NULL))#endif /* __ASSEMBLY__ */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 295/667 iomap: iomap_write_failed fix
In reply to Greg Kroah-HartmanFrom: Andreas Gruenbacher <[email protected]>
[ Upstream commit b71450e2cc4b3c79f33c5bd276d152af9bd54f79 ]
The @lend parameter of truncate_pagecache_range() should be the offset of the last byte of the hole, not the first byte beyond it.
--- fs/iomap/buffered-io.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/iomap/buffered-io.c +2 -1
@@ -525,7 +525,8 @@ iomap_write_failed(struct inode *inode, loff_t pos, unsigned len)* write started inside the existing inode size. */ if (pos + len > i_size) -truncate_pagecache_range (inode,max (pos, i_size), pos + len); +truncate_pagecache_range (inode,max (pos, i_size), + pos + len -1 ); } static int
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 296/667 spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit a2b331ac11e1cac56f5b7d367e9f3c5796deaaed ]
It will cause null-ptr-deref if platform_get_resource_byname() returns NULL, we need check the return value.
--- drivers/spi/spi-fsl-qspi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/spi/spi-fsl-qspi.c +4 -0
@@ -876,6 +876,10 @@ static int fsl_qspi_probe(struct platform_device *pdev) res =platform_get_resource_byname (pdev,IORESOURCE_MEM ,"QuadSPI-memory" ); +if (!res) { + ret = -EINVAL ; + goto err_put_ctrl; + } q->memmap_phy = res->start;/* Since there are 4 cs, map size required is 4 times ahb_buf_size */ q->ahb_addr = devm_ioremap(dev, q->memmap_phy,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 297/667 Revert "cpufreq: Fix possible race in cpufreq online error path"
In reply to Greg Kroah-HartmanFrom: Viresh Kumar <[email protected]>
[ Upstream commit 85f0e42bd65d01b351d561efb38e584d4c596553 ]
This reverts commit f346e96267cd76175d6c201b40f770c0116a8a04.
The commit tried to fix a possible real bug but it made it even worse. The fix was simply buggy as now an error out to out_offline_policy or out_exit_policy will try to release a semaphore which was never taken in the first place. This works fine only if we failed late, i.e. via out_destroy_policy.
--- drivers/cpufreq/cpufreq.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/cpufreq/cpufreq.c +2 -3
@@ -1528,6 +1528,8 @@ static int cpufreq_online(unsigned int cpu)for_each_cpu (j, policy->real_cpus)remove_cpu_dev_symlink (policy,get_cpu_device (j)); +up_write (&policy->rwsem); + out_offline_policy:if (cpufreq_driver->offline) cpufreq_driver->offline (policy);
@@ -1536,9 +1538,6 @@ static int cpufreq_online(unsigned int cpu)if (cpufreq_driver->exit) cpufreq_driver->exit (policy); -cpumask_clear (policy->cpus); -up_write (&policy->rwsem); - out_free_policy:cpufreq_policy_free (policy);return ret;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 298/667 regulator: qcom_smd: Fix up PM8950 regulator configuration
In reply to Greg Kroah-HartmanFrom: Konrad Dybcio <[email protected]>
[ Upstream commit b11b3d21a94d66bc05d1142e0b210bfa316c62be ]
Following changes have been made:
- S5, L4, L18, L20 and L21 were removed (S5 is managed by SPMI, whereas the rest seems not to exist [or at least it's blocked by Sony Loire /MSM8956/ RPM firmware])
- Supply maps have were adjusted to reflect regulator changes.
--- drivers/regulator/qcom_smd-regulator.c | 35 +++++++++++++------------- 1 file changed, 17 insertions(+), 18 deletions(-)
drivers/regulator/qcom_smd-regulator.c +17 -18
@@ -926,32 +926,31 @@ static const struct rpm_regulator_data rpm_pm8950_regulators[] = { { "s2", QCOM_SMD_RPM_SMPA, 2, &pm8950_hfsmps, "vdd_s2" }, { "s3", QCOM_SMD_RPM_SMPA, 3, &pm8950_hfsmps, "vdd_s3" }, { "s4", QCOM_SMD_RPM_SMPA, 4, &pm8950_hfsmps, "vdd_s4" }, - { "s5", QCOM_SMD_RPM_SMPA, 5, &pm8950_ftsmps2p5, "vdd_s5" }, +/* S5 is managed via SPMI. */ { "s6", QCOM_SMD_RPM_SMPA, 6, &pm8950_hfsmps, "vdd_s6" }, { "l1", QCOM_SMD_RPM_LDOA, 1, &pm8950_ult_nldo, "vdd_l1_l19" }, { "l2", QCOM_SMD_RPM_LDOA, 2, &pm8950_ult_nldo, "vdd_l2_l23" }, { "l3", QCOM_SMD_RPM_LDOA, 3, &pm8950_ult_nldo, "vdd_l3" }, - { "l4", QCOM_SMD_RPM_LDOA, 4, &pm8950_ult_pldo, "vdd_l4_l5_l6_l7_l16" }, - { "l5", QCOM_SMD_RPM_LDOA, 5, &pm8950_pldo_lv, "vdd_l4_l5_l6_l7_l16" }, - { "l6", QCOM_SMD_RPM_LDOA, 6, &pm8950_pldo_lv, "vdd_l4_l5_l6_l7_l16" }, - { "l7", QCOM_SMD_RPM_LDOA, 7, &pm8950_pldo_lv, "vdd_l4_l5_l6_l7_l16" }, +/* L4 seems not to exist. */ + { "l5", QCOM_SMD_RPM_LDOA, 5, &pm8950_pldo_lv, "vdd_l5_l6_l7_l16" }, + { "l6", QCOM_SMD_RPM_LDOA, 6, &pm8950_pldo_lv, "vdd_l5_l6_l7_l16" }, + { "l7", QCOM_SMD_RPM_LDOA, 7, &pm8950_pldo_lv, "vdd_l5_l6_l7_l16" }, { "l8", QCOM_SMD_RPM_LDOA, 8, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22" }, { "l9", QCOM_SMD_RPM_LDOA, 9, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18" }, { "l10", QCOM_SMD_RPM_LDOA, 10, &pm8950_ult_nldo, "vdd_l9_l10_l13_l14_l15_l18"}, - { "l11", QCOM_SMD_RPM_LDOA, 11, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22"}, - { "l12", QCOM_SMD_RPM_LDOA, 12, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22"}, - { "l13", QCOM_SMD_RPM_LDOA, 13, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18"}, - { "l14", QCOM_SMD_RPM_LDOA, 14, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18"}, - { "l15", QCOM_SMD_RPM_LDOA, 15, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18"}, - { "l16", QCOM_SMD_RPM_LDOA, 16, &pm8950_ult_pldo, "vdd_l4_l5_l6_l7_l16"}, - { "l17", QCOM_SMD_RPM_LDOA, 17, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22"}, - { "l18", QCOM_SMD_RPM_LDOA, 18, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18"}, - { "l19", QCOM_SMD_RPM_LDOA, 18, &pm8950_pldo, "vdd_l1_l19"}, - { "l20", QCOM_SMD_RPM_LDOA, 18, &pm8950_pldo, "vdd_l20"}, - { "l21", QCOM_SMD_RPM_LDOA, 18, &pm8950_pldo, "vdd_l21"}, - { "l22", QCOM_SMD_RPM_LDOA, 18, &pm8950_pldo, "vdd_l8_l11_l12_l17_l22"}, - { "l23", QCOM_SMD_RPM_LDOA, 18, &pm8950_pldo, "vdd_l2_l23"}, + { "l11", QCOM_SMD_RPM_LDOA, 11, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22" }, + { "l12", QCOM_SMD_RPM_LDOA, 12, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22" }, + { "l13", QCOM_SMD_RPM_LDOA, 13, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18" }, + { "l14", QCOM_SMD_RPM_LDOA, 14, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18" }, + { "l15", QCOM_SMD_RPM_LDOA, 15, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18" }, + { "l16", QCOM_SMD_RPM_LDOA, 16, &pm8950_ult_pldo, "vdd_l5_l6_l7_l16" }, + { "l17", QCOM_SMD_RPM_LDOA, 17, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22" }, +/* L18 seems not to exist. */ + { "l19", QCOM_SMD_RPM_LDOA, 19, &pm8950_pldo, "vdd_l1_l19" }, +/* L20 & L21 seem not to exist. */ + { "l22", QCOM_SMD_RPM_LDOA, 22, &pm8950_pldo, "vdd_l8_l11_l12_l17_l22" }, + { "l23", QCOM_SMD_RPM_LDOA, 23, &pm8950_pldo, "vdd_l2_l23" }, {} };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 299/667 samples: bpf: Dont fail for a missing VMLINUX_BTF when VMLINUX_H is provided
In reply to Greg Kroah-HartmanFrom: Jerome Marchand <[email protected]>
[ Upstream commit ec24704492d8791a52a75a39e3ad762b6e017bc6 ]
samples/bpf build currently always fails if it can't generate vmlinux.h from vmlinux, even when vmlinux.h is directly provided by VMLINUX_H variable, which makes VMLINUX_H pointless. Only fails when neither method works.
--- samples/bpf/Makefile | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
samples/bpf/Makefile +4 -5
@@ -365,16 +365,15 @@ VMLINUX_BTF ?= $(abspath $(firstword $(wildcard $(VMLINUX_BTF_PATHS)))) $(obj)/vmlinux.h: $(VMLINUX_BTF) $(BPFTOOL) ifeq ($(VMLINUX_H),) +ifeq ($(VMLINUX_BTF),) + $(error Cannot find a vmlinux for VMLINUX_BTF at any of "$(VMLINUX_BTF_PATHS)",\ + build the kernel or set VMLINUX_BTF or VMLINUX_H variable) +endif $(Q)$(BPFTOOL) btf dump file $(VMLINUX_BTF) format c > $@ else $(Q)cp "$(VMLINUX_H)" $@ endif -ifeq ($(VMLINUX_BTF),) - $(error Cannot find a vmlinux for VMLINUX_BTF at any of "$(VMLINUX_BTF_PATHS)",\ - build the kernel or set VMLINUX_BTF variable) -endif - clean-files += vmlinux.h # Get Clang's default includes on this system, as opposed to those seen by
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 300/667 perf/amd/ibs: Use interrupt regs ip for stack unwinding
In reply to Greg Kroah-HartmanFrom: Ravi Bangoria <[email protected]>
[ Upstream commit 3d47083b9ff46863e8374ad3bb5edb5e464c75f8 ]
IbsOpRip is recorded when IBS interrupt is triggered. But there is a skid from the time IBS interrupt gets triggered to the time the interrupt is presented to the core. Meanwhile processor would have moved ahead and thus IbsOpRip will be inconsistent with rsp and rbp recorded as part of the interrupt regs. This causes issues while unwinding stack using the ORC unwinder as it needs consistent rip, rsp and rbp. Fix this by using rip from interrupt regs instead of IbsOpRip for stack unwinding.
--- arch/x86/events/amd/ibs.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
arch/x86/events/amd/ibs.c +18 -0
@@ -304,6 +304,16 @@ static int perf_ibs_init(struct perf_event *event) hwc->config_base = perf_ibs->msr; hwc->config = config; +/* +* rip recorded by IbsOpRip will not be consistent with rsp and rbp +* recorded as part of interrupt regs. Thus we need to use rip from +* interrupt regs while unwinding call stack. Setting _EARLY flag +* makes sure we unwind call-stack before perf sample rip is set to +* IbsOpRip. +*/ +if (event->attr.sample_type &PERF_SAMPLE_CALLCHAIN ) + event->attr.sample_type |= __PERF_SAMPLE_CALLCHAIN_EARLY; +return 0 ; }
@@ -687,6 +697,14 @@ static int perf_ibs_handle_irq(struct perf_ibs *perf_ibs, struct pt_regs *iregs) data.raw = &raw; } +/* +* rip recorded by IbsOpRip will not be consistent with rsp and rbp +* recorded as part of interrupt regs. Thus we need to use rip from +* interrupt regs while unwinding call stack. +*/ +if (event->attr.sample_type &PERF_SAMPLE_CALLCHAIN ) + data.callchain =perf_callchain (event, iregs); + throttle =perf_event_overflow (event, &data, ®s); out:if (throttle) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 301/667 ath11k: Dont check arvif->is_started before sending management frames
In reply to Greg Kroah-HartmanFrom: Baochen Qiang <[email protected]>
[ Upstream commit 355333a217541916576351446b5832fec7930566 ]
Commit 66307ca04057 ("ath11k: fix mgmt_tx_wmi cmd sent to FW for deleted vdev") wants both of below two conditions are true before sending management frames:
1: ar->allocated_vdev_map & (1LL << arvif->vdev_id) 2: arvif->is_started
Actually the second one is not necessary because with the first one we can make sure the vdev is present.
Also use ar->conf_mutex to synchronize vdev delete and mgmt. TX.
This issue is found in case of Passpoint scenario where ath11k needs to send action frames before vdev is started.
Fix it by removing the second condition.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
--- drivers/net/wireless/ath/ath11k/mac.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath11k/mac.c +3 -2
@@ -4266,8 +4266,8 @@ static void ath11k_mgmt_over_wmi_tx_work(struct work_struct *work) } arvif =ath11k_vif_to_arvif (skb_cb->vif); -if (ar->allocated_vdev_map & (1LL << arvif->vdev_id) && - arvif->is_started) { +mutex_lock (&ar->conf_mutex); +if (ar->allocated_vdev_map & (1LL << arvif->vdev_id)) { ret =ath11k_mac_mgmt_tx_wmi (ar, arvif, skb);if (ret) { ath11k_warn(ar->ab, "failed to tx mgmt frame, vdev_id %d :%d\n",
@@ -4283,6 +4283,7 @@ static void ath11k_mgmt_over_wmi_tx_work(struct work_struct *work) arvif->is_started);ieee80211_free_txskb (ar->hw, skb); } +mutex_unlock (&ar->conf_mutex); } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 302/667 wilc1000: fix crash observed in AP mode with cfg80211_register_netdevice()
In reply to Greg Kroah-HartmanFrom: Ajay Singh <[email protected]>
[ Upstream commit 868f0e28290c7a33e8cb79bfe97ebdcbb756e048 ]
Monitor(mon.) interface is used for handling the AP mode and 'ieee80211_ptr' reference is not getting set for it. Like earlier implementation, use register_netdevice() instead of cfg80211_register_netdevice() which expects valid 'ieee80211_ptr' reference to avoid the possible crash.
--- drivers/net/wireless/microchip/wilc1000/mon.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/microchip/wilc1000/mon.c +2 -2
@@ -233,7 +233,7 @@ struct net_device *wilc_wfi_init_mon_interface(struct wilc *wl, wl->monitor_dev->netdev_ops = &wilc_wfi_netdev_ops; wl->monitor_dev->needs_free_netdev = true; -if (cfg80211_register_netdevice (wl->monitor_dev)) { +if (register_netdevice (wl->monitor_dev)) {netdev_err (real_dev,"register_netdevice failed\n" );free_netdev (wl->monitor_dev);return NULL ;
@@ -251,7 +251,7 @@ void wilc_wfi_deinit_mon_interface(struct wilc *wl, bool rtnl_locked)return ;if (rtnl_locked) -cfg80211_unregister_netdevice (wl->monitor_dev); +unregister_netdevice (wl->monitor_dev);else unregister_netdev (wl->monitor_dev); wl->monitor_dev =NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 303/667 HID: amd_sfh: Modify the bus name
In reply to Greg Kroah-HartmanFrom: Basavaraj Natikar <[email protected]>
[ Upstream commit 206c3c2d85de8847fb732a5fb71443bacd287216 ]
Modifying the amd-sfh bus name to meaningful name.
--- drivers/hid/amd-sfh-hid/amd_sfh_hid.c | 2 +- drivers/hid/amd-sfh-hid/amd_sfh_hid.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/hid/amd-sfh-hid/amd_sfh_hid.c +1 -1
@@ -139,7 +139,7 @@ int amdtp_hid_probe(u32 cur_hid_dev, struct amdtp_cl_data *cli_data) hid->driver_data = hid_data; cli_data->hid_sensor_hubs[cur_hid_dev] = hid; - hid->bus =BUS_AMD_AMDTP ; + hid->bus =BUS_AMD_SFH ; hid->vendor =AMD_SFH_HID_VENDOR ; hid->product =AMD_SFH_HID_PRODUCT ; snprintf(hid->name, sizeof(hid->name), "%s %04X:%04X", "hid-amdtp",
drivers/hid/amd-sfh-hid/amd_sfh_hid.h +1 -1
@@ -10,7 +10,7 @@#define AMDSFH_HID_H #define MAX_HID_DEVICES 5 -#define BUS_AMD_AMDTP 0x20 +#define BUS_AMD_SFH 0x20#define AMD_SFH_HID_VENDOR 0x1022#define AMD_SFH_HID_PRODUCT 0x0001
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 304/667 HID: amd_sfh: Modify the hid name
In reply to Greg Kroah-HartmanFrom: Basavaraj Natikar <[email protected]>
[ Upstream commit 10f865cdcf37d26ae5e9595a7b4f9e06538e84e5 ]
Modifying the amd-sfh hid name to meaningful name.
--- drivers/hid/amd-sfh-hid/amd_sfh_hid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/amd-sfh-hid/amd_sfh_hid.c +1 -1
@@ -142,7 +142,7 @@ int amdtp_hid_probe(u32 cur_hid_dev, struct amdtp_cl_data *cli_data) hid->bus =BUS_AMD_SFH ; hid->vendor =AMD_SFH_HID_VENDOR ; hid->product =AMD_SFH_HID_PRODUCT ; -snprintf (hid->name,sizeof (hid->name),"%s %04X:%04X" ,"hid-amdtp" , +snprintf (hid->name,sizeof (hid->name),"%s %04X:%04X" ,"hid-amdsfh" , hid->vendor, hid->product); rc =hid_add_device (hid);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 305/667 ASoC: fsl: Use dev_err_probe() helper
In reply to Greg Kroah-HartmanFrom: Kuninori Morimoto <[email protected]>
[ Upstream commit 2e6f557ca35aa330dbf31c5e1cc8119eff1526fa ]
Use the dev_err_probe() helper, instead of open-coding the same operation.
--- sound/soc/fsl/fsl-asoc-card.c | 3 +-- sound/soc/fsl/imx-card.c | 17 ++++++----------- sound/soc/fsl/imx-sgtl5000.c | 4 +--- sound/soc/fsl/imx-spdif.c | 4 ++-- 4 files changed, 10 insertions(+), 18 deletions(-)
sound/soc/fsl/fsl-asoc-card.c +1 -2
@@ -842,8 +842,7 @@ static int fsl_asoc_card_probe(struct platform_device *pdev) ret =devm_snd_soc_register_card (&pdev->dev, &priv->card);if (ret) { -if (ret != -EPROBE_DEFER ) -dev_err (&pdev->dev,"snd_soc_register_card failed (%d)\n" , ret); +dev_err_probe (&pdev->dev, ret,"snd_soc_register_card failed\n" ); goto asrc_fail; }
sound/soc/fsl/imx-card.c +6 -11
@@ -579,9 +579,8 @@ static int imx_card_parse_of(struct imx_card_data *data) ret =snd_soc_of_get_dai_name (cpu, &link->cpus->dai_name);if (ret) { -if (ret != -EPROBE_DEFER ) -dev_err (card->dev,"%s: error getting cpu dai name: %d\n" , - link->name, ret); +dev_err_probe (card->dev, ret, +"%s: error getting cpu dai name\n" , link->name); goto err; }
@@ -589,9 +588,8 @@ static int imx_card_parse_of(struct imx_card_data *data)if (codec) { ret =snd_soc_of_get_dai_link_codecs (dev, codec, link);if (ret <0 ) { -if (ret != -EPROBE_DEFER ) -dev_err (dev,"%s: codec dai not found: %d\n" , - link->name, ret); +dev_err_probe (dev, ret,"%s: codec dai not found\n" , + link->name); goto err; }
@@ -830,11 +828,8 @@ static int imx_card_probe(struct platform_device *pdev) } ret =devm_snd_soc_register_card (&pdev->dev, &data->card); -if (ret) { -if (ret != -EPROBE_DEFER ) -dev_err (&pdev->dev,"snd_soc_register_card failed (%d)\n" , ret); -return ret; - } +if (ret) +return dev_err_probe (&pdev->dev, ret,"snd_soc_register_card failed\n" );return 0 ; }
sound/soc/fsl/imx-sgtl5000.c +1 -3
@@ -173,9 +173,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) ret =devm_snd_soc_register_card (&pdev->dev, &data->card);if (ret) { -if (ret != -EPROBE_DEFER ) -dev_err (&pdev->dev,"snd_soc_register_card failed (%d)\n" , - ret); +dev_err_probe (&pdev->dev, ret,"snd_soc_register_card failed\n" ); goto fail; }
sound/soc/fsl/imx-spdif.c +2 -2
@@ -70,8 +70,8 @@ static int imx_spdif_audio_probe(struct platform_device *pdev) goto end; ret =devm_snd_soc_register_card (&pdev->dev, &data->card); -if (ret && ret != -EPROBE_DEFER ) -dev_err (&pdev->dev,"snd_soc_register_card failed: %d\n" , ret); +if (ret) +dev_err_probe (&pdev->dev, ret,"snd_soc_register_card failed\n" ); end:of_node_put (spdif_np);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 306/667 ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 41cd312dfe980af869c3503b4d38e62ed20dd3b7 ]
of_find_i2c_device_by_node() takes a reference, In error paths, we should call put_device() to drop the reference to aviod refount leak.
--- sound/soc/fsl/imx-sgtl5000.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
sound/soc/fsl/imx-sgtl5000.c +8 -6
@@ -120,19 +120,19 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) data =devm_kzalloc (&pdev->dev,sizeof (*data),GFP_KERNEL );if (!data) { ret = -ENOMEM ; - goto fail; + goto put_device; } comp =devm_kzalloc (&pdev->dev,3 *sizeof (*comp),GFP_KERNEL );if (!comp) { ret = -ENOMEM ; - goto fail; + goto put_device; } data->codec_clk =clk_get (&codec_dev->dev,NULL );if (IS_ERR (data->codec_clk)) { ret =PTR_ERR (data->codec_clk); - goto fail; + goto put_device; } data->clk_frequency =clk_get_rate (data->codec_clk);
@@ -158,10 +158,10 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) data->card.dev = &pdev->dev; ret =snd_soc_of_parse_card_name (&data->card,"model" );if (ret) - goto fail; + goto put_device; ret =snd_soc_of_parse_audio_routing (&data->card,"audio-routing" );if (ret) - goto fail; + goto put_device; data->card.num_links =1 ; data->card.owner =THIS_MODULE ; data->card.dai_link = &data->dai;
@@ -174,7 +174,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) ret =devm_snd_soc_register_card (&pdev->dev, &data->card);if (ret) {dev_err_probe (&pdev->dev, ret,"snd_soc_register_card failed\n" ); - goto fail; + goto put_device; }of_node_put (ssi_np);
@@ -182,6 +182,8 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)return 0 ; +put_device: +put_device (&codec_dev->dev); fail:if (data && !IS_ERR (data->codec_clk))clk_put (data->codec_clk);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 307/667 ASoC: imx-hdmi: Fix refcount leak in imx_hdmi_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit ed46731d8e86c8d65f5fc717671e1f1f6c3146d2 ]
of_find_device_by_node() takes reference, we should use put_device() to release it. when devm_kzalloc() fails, it doesn't have a put_device(), it will cause refcount leak.
Add missing put_device() to fix this.
--- sound/soc/fsl/imx-hdmi.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/fsl/imx-hdmi.c +1 -0
@@ -126,6 +126,7 @@ static int imx_hdmi_probe(struct platform_device *pdev) data =devm_kzalloc (&pdev->dev,sizeof (*data),GFP_KERNEL );if (!data) { ret = -ENOMEM ; +put_device (&cpu_pdev->dev); goto fail; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 308/667 ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 2be84f73785fa9ed6443e3c5b158730266f1c2ee ]
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when done.
--- sound/soc/mxs/mxs-saif.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/mxs/mxs-saif.c +1 -0
@@ -754,6 +754,7 @@ static int mxs_saif_probe(struct platform_device *pdev) saif->master_id = saif->id; }else { ret =of_alias_get_id (master,"saif" ); +of_node_put (master);if (ret <0 )return ret;else
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 309/667 regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit afaa7b933ef00a2d3262f4d1252087613fb5c06d ]
of_node_get() returns a node with refcount incremented. Calling of_node_put() to drop the reference when not needed anymore.
--- drivers/regulator/pfuze100-regulator.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/regulator/pfuze100-regulator.c +2 -0
@@ -521,6 +521,7 @@ static int pfuze_parse_regulators_dt(struct pfuze_chip *chip) parent =of_get_child_by_name (np,"regulators" );if (!parent) {dev_err (dev,"regulators node not found\n" ); +of_node_put (np);return -EINVAL ; }
@@ -550,6 +551,7 @@ static int pfuze_parse_regulators_dt(struct pfuze_chip *chip) }of_node_put (parent); +of_node_put (np);if (ret <0 ) {dev_err (dev,"Error parsing regulator init data: %d\n" , ret);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 310/667 dma-direct: factor out a helper for DMA_ATTR_NO_KERNEL_MAPPING allocations
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit d541ae55d538265861ef729a64d2d816d34ef1e2 ]
Split the code for DMA_ATTR_NO_KERNEL_MAPPING allocations into a separate helper to make dma_direct_alloc a little more readable.
--- kernel/dma/direct.c | 31 ++++++++++++++++++++----------- 1 file changed, 20 insertions(+), 11 deletions(-)
kernel/dma/direct.c +20 -11
@@ -149,6 +149,24 @@ static void *dma_direct_alloc_from_pool(struct device *dev, size_t size,return ret; } +static void *dma_direct_alloc_no_mapping (struct device *dev,size_t size, +dma_addr_t *dma_handle,gfp_t gfp) +{ +struct page *page; + + page =__dma_direct_alloc_pages (dev, size, gfp & ~__GFP_ZERO); +if (!page) +return NULL ; + +/* remove any dirty cache lines on the kernel alias */ +if (!PageHighMem (page)) +arch_dma_prep_coherent (page, size); + +/* return the page pointer as the opaque cookie */ + *dma_handle =phys_to_dma_direct (dev,page_to_phys (page)); +return page; +} +void *dma_direct_alloc (struct device *dev,size_t size,dma_addr_t *dma_handle,gfp_t gfp,unsigned long attrs) {
@@ -161,17 +179,8 @@ void *dma_direct_alloc(struct device *dev, size_t size, gfp |= __GFP_NOWARN;if ((attrs &DMA_ATTR_NO_KERNEL_MAPPING ) && - !force_dma_unencrypted (dev) && !is_swiotlb_for_alloc (dev)) { - page =__dma_direct_alloc_pages (dev, size, gfp & ~__GFP_ZERO); -if (!page) -return NULL ; -/* remove any dirty cache lines on the kernel alias */ -if (!PageHighMem (page)) -arch_dma_prep_coherent (page, size); - *dma_handle =phys_to_dma_direct (dev,page_to_phys (page)); -/* return the page pointer as the opaque cookie */ -return page; - } + !force_dma_unencrypted (dev) && !is_swiotlb_for_alloc (dev)) +return dma_direct_alloc_no_mapping (dev, size, dma_handle, gfp); if (!IS_ENABLED(CONFIG_ARCH_HAS_DMA_SET_UNCACHED) && !IS_ENABLED(CONFIG_DMA_DIRECT_REMAP) &&
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 311/667 dma-direct: dont fail on highmem CMA pages in dma_direct_alloc_pages
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 92826e967535db2eb117db227b1191aaf98e4bb3 ]
When dma_direct_alloc_pages encounters a highmem page it just gives up currently. But what we really should do is to try memory using the page allocator instead - without this platforms with a global highmem CMA pool will fail all dma_alloc_pages allocations.
--- kernel/dma/direct.c | 27 ++++++++++----------------- 1 file changed, 10 insertions(+), 17 deletions(-)
kernel/dma/direct.c +10 -17
@@ -85,7 +85,7 @@ static void __dma_direct_free_pages(struct device *dev, struct page *page, }static struct page *__dma_direct_alloc_pages (struct device *dev,size_t size, -gfp_t gfp) +gfp_t gfp,bool allow_highmem) {int node =dev_to_node (dev);struct page *page =NULL ;
@@ -106,9 +106,12 @@ static struct page *__dma_direct_alloc_pages(struct device *dev, size_t size, } page =dma_alloc_contiguous (dev, size, gfp); -if (page && !dma_coherent_ok (dev,page_to_phys (page), size)) { -dma_free_contiguous (dev, page, size); - page =NULL ; +if (page) { +if (!dma_coherent_ok (dev,page_to_phys (page), size) || + (!allow_highmem &&PageHighMem (page))) { +dma_free_contiguous (dev, page, size); + page =NULL ; + } } again:if (!page)
@@ -154,7 +157,7 @@ static void *dma_direct_alloc_no_mapping(struct device *dev, size_t size, {struct page *page; - page =__dma_direct_alloc_pages (dev, size, gfp & ~__GFP_ZERO); + page =__dma_direct_alloc_pages (dev, size, gfp & ~__GFP_ZERO, true);if (!page)return NULL ;
@@ -209,7 +212,7 @@ void *dma_direct_alloc(struct device *dev, size_t size,return dma_direct_alloc_from_pool (dev, size, dma_handle, gfp);/* we always manually zero the memory once we are done */ - page =__dma_direct_alloc_pages (dev, size, gfp & ~__GFP_ZERO); + page =__dma_direct_alloc_pages (dev, size, gfp & ~__GFP_ZERO, true);if (!page)return NULL ;
@@ -335,19 +338,9 @@ struct page *dma_direct_alloc_pages(struct device *dev, size_t size, !is_swiotlb_for_alloc(dev))return dma_direct_alloc_from_pool (dev, size, dma_handle, gfp); - page =__dma_direct_alloc_pages (dev, size, gfp); + page =__dma_direct_alloc_pages (dev, size, gfp, false);if (!page)return NULL ; -if (PageHighMem (page)) { -/* -* Depending on the cma= arguments and per-arch setup -* dma_alloc_contiguous could return highmem pages. -* Without remapping there is no way to return them here, -* so log an error and fail. -*/ -dev_info (dev,"Rejecting highmem page from CMA.\n" ); - goto out_free_pages; - } ret =page_address (page);if (force_dma_unencrypted (dev)) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 312/667 ASoC: samsung: Use dev_err_probe() helper
In reply to Greg Kroah-HartmanFrom: Kuninori Morimoto <[email protected]>
[ Upstream commit 27c6eaebcf75e4fac145d17c7fa76bc64b60d24c ]
Use the dev_err_probe() helper, instead of open-coding the same operation.
--- sound/soc/samsung/aries_wm8994.c | 17 +++++++---------- sound/soc/samsung/arndale.c | 5 ++--- sound/soc/samsung/littlemill.c | 5 ++--- sound/soc/samsung/lowland.c | 5 ++--- sound/soc/samsung/odroid.c | 4 +--- sound/soc/samsung/smdk_wm8994.c | 4 ++-- sound/soc/samsung/smdk_wm8994pcm.c | 4 ++-- sound/soc/samsung/snow.c | 9 +++------ sound/soc/samsung/speyside.c | 5 ++--- sound/soc/samsung/tm2_wm5110.c | 3 +-- sound/soc/samsung/tobermory.c | 5 ++--- 11 files changed, 26 insertions(+), 40 deletions(-)
sound/soc/samsung/aries_wm8994.c +7 -10
@@ -585,19 +585,16 @@ static int aries_audio_probe(struct platform_device *pdev) extcon_np =of_parse_phandle (np,"extcon" ,0 ); priv->usb_extcon =extcon_find_edev_by_node (extcon_np); -if (IS_ERR (priv->usb_extcon)) { -if (PTR_ERR (priv->usb_extcon) != -EPROBE_DEFER ) -dev_err (dev,"Failed to get extcon device" ); -return PTR_ERR (priv->usb_extcon); - } +if (IS_ERR (priv->usb_extcon)) +return dev_err_probe (dev,PTR_ERR (priv->usb_extcon), +"Failed to get extcon device" );of_node_put (extcon_np); priv->adc =devm_iio_channel_get (dev,"headset-detect" ); -if (IS_ERR (priv->adc)) { -if (PTR_ERR (priv->adc) != -EPROBE_DEFER ) -dev_err (dev,"Failed to get ADC channel" ); -return PTR_ERR (priv->adc); - } +if (IS_ERR (priv->adc)) +return dev_err_probe (dev,PTR_ERR (priv->adc), +"Failed to get ADC channel" ); +if (priv->adc->channel->type !=IIO_VOLTAGE )return -EINVAL ;
sound/soc/samsung/arndale.c +2 -3
@@ -174,9 +174,8 @@ static int arndale_audio_probe(struct platform_device *pdev) ret =devm_snd_soc_register_card (card->dev, card);if (ret) { -if (ret != -EPROBE_DEFER ) -dev_err (&pdev->dev, -"snd_soc_register_card() failed: %d\n" , ret); +dev_err_probe (&pdev->dev, ret, +"snd_soc_register_card() failed\n" ); goto err_put_of_nodes; }return 0 ;
sound/soc/samsung/littlemill.c +2 -3
@@ -325,9 +325,8 @@ static int littlemill_probe(struct platform_device *pdev) card->dev = &pdev->dev; ret =devm_snd_soc_register_card (&pdev->dev, card); -if (ret && ret != -EPROBE_DEFER ) -dev_err (&pdev->dev,"snd_soc_register_card() failed: %d\n" , - ret); +if (ret) +dev_err_probe (&pdev->dev, ret,"snd_soc_register_card() failed\n" );return ret; }
sound/soc/samsung/lowland.c +2 -3
@@ -183,9 +183,8 @@ static int lowland_probe(struct platform_device *pdev) card->dev = &pdev->dev; ret =devm_snd_soc_register_card (&pdev->dev, card); -if (ret && ret != -EPROBE_DEFER ) -dev_err (&pdev->dev,"snd_soc_register_card() failed: %d\n" , - ret); +if (ret) +dev_err_probe (&pdev->dev, ret,"snd_soc_register_card() failed\n" );return ret; }
sound/soc/samsung/odroid.c +1 -3
@@ -311,9 +311,7 @@ static int odroid_audio_probe(struct platform_device *pdev) ret =devm_snd_soc_register_card (dev, card);if (ret <0 ) { -if (ret != -EPROBE_DEFER ) -dev_err (dev,"snd_soc_register_card() failed: %d\n" , - ret); +dev_err_probe (dev, ret,"snd_soc_register_card() failed\n" ); goto err_put_clk_i2s; }
sound/soc/samsung/smdk_wm8994.c +2 -2
@@ -179,8 +179,8 @@ static int smdk_audio_probe(struct platform_device *pdev) ret =devm_snd_soc_register_card (&pdev->dev, card); -if (ret && ret != -EPROBE_DEFER ) -dev_err (&pdev->dev,"snd_soc_register_card() failed:%d\n" , ret); +if (ret) +dev_err_probe (&pdev->dev, ret,"snd_soc_register_card() failed\n" );return ret; }
sound/soc/samsung/smdk_wm8994pcm.c +2 -2
@@ -118,8 +118,8 @@ static int snd_smdk_probe(struct platform_device *pdev) smdk_pcm.dev = &pdev->dev; ret =devm_snd_soc_register_card (&pdev->dev, &smdk_pcm); -if (ret && ret != -EPROBE_DEFER ) -dev_err (&pdev->dev,"snd_soc_register_card failed %d\n" , ret); +if (ret) +dev_err_probe (&pdev->dev, ret,"snd_soc_register_card failed\n" );return ret; }
sound/soc/samsung/snow.c +3 -6
@@ -212,12 +212,9 @@ static int snow_probe(struct platform_device *pdev)snd_soc_card_set_drvdata (card, priv); ret =devm_snd_soc_register_card (dev, card); -if (ret) { -if (ret != -EPROBE_DEFER ) -dev_err (&pdev->dev, -"snd_soc_register_card failed (%d)\n" , ret); -return ret; - } +if (ret) +return dev_err_probe (&pdev->dev, ret, +"snd_soc_register_card failed\n" );return ret; }
sound/soc/samsung/speyside.c +2 -3
@@ -330,9 +330,8 @@ static int speyside_probe(struct platform_device *pdev) card->dev = &pdev->dev; ret =devm_snd_soc_register_card (&pdev->dev, card); -if (ret && ret != -EPROBE_DEFER ) -dev_err (&pdev->dev,"snd_soc_register_card() failed: %d\n" , - ret); +if (ret) +dev_err_probe (&pdev->dev, ret,"snd_soc_register_card() failed\n" );return ret; }
sound/soc/samsung/tm2_wm5110.c +1 -2
@@ -612,8 +612,7 @@ static int tm2_probe(struct platform_device *pdev) ret =devm_snd_soc_register_card (dev, card);if (ret <0 ) { -if (ret != -EPROBE_DEFER ) -dev_err (dev,"Failed to register card: %d\n" , ret); +dev_err_probe (dev, ret,"Failed to register card\n" ); goto dai_node_put; }
sound/soc/samsung/tobermory.c +2 -3
@@ -229,9 +229,8 @@ static int tobermory_probe(struct platform_device *pdev) card->dev = &pdev->dev; ret =devm_snd_soc_register_card (&pdev->dev, card); -if (ret && ret != -EPROBE_DEFER ) -dev_err (&pdev->dev,"snd_soc_register_card() failed: %d\n" , - ret); +if (ret) +dev_err_probe (&pdev->dev, ret,"snd_soc_register_card() failed\n" );return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 313/667 ASoC: samsung: Fix refcount leak in aries_audio_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit bf4a9b2467b775717d0e9034ad916888e19713a3 ]
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. If extcon_find_edev_by_node() fails, it doesn't call of_node_put() Calling of_node_put() after extcon_find_edev_by_node() to fix this.
--- sound/soc/samsung/aries_wm8994.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/samsung/aries_wm8994.c +1 -1
@@ -585,10 +585,10 @@ static int aries_audio_probe(struct platform_device *pdev) extcon_np =of_parse_phandle (np,"extcon" ,0 ); priv->usb_extcon =extcon_find_edev_by_node (extcon_np); +of_node_put (extcon_np);if (IS_ERR (priv->usb_extcon))return dev_err_probe (dev,PTR_ERR (priv->usb_extcon),"Failed to get extcon device" ); -of_node_put (extcon_np); priv->adc =devm_iio_channel_get (dev,"headset-detect" );if (IS_ERR (priv->adc))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 314/667 block: Fix the bio.bi_opf comment
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit 5d2ae14276e698c76fa0c8ce870103f343b38263 ]
Commit ef295ecf090d modified the Linux kernel such that the bottom bits of the bi_opf member contain the operation instead of the topmost bits. That commit did not update the comment next to bi_opf. Hence this patch.
Quoted 1 line
From commit
ef295ecf090d:
-#define bio_op(bio) ((bio)->bi_opf >> BIO_OP_SHIFT)
+#define bio_op(bio) ((bio)->bi_opf & REQ_OP_MASK)
--- include/linux/blk_types.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
include/linux/blk_types.h +2 -3
@@ -215,9 +215,8 @@ static inline void bio_issue_init(struct bio_issue *issue,struct bio {struct bio *bi_next;/* request queue link */ struct block_device *bi_bdev; -unsigned int bi_opf;/* bottom bits req flags, -* top bits REQ_OP. Use -* accessors. +unsigned int bi_opf;/* bottom bits REQ_OP, top bits +* req_flags. */ unsigned short bi_flags;/* BIO_* below */ unsigned short bi_ioprio;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 315/667 kselftest/cgroup: fix test_stress.sh to use OUTPUT dir
In reply to Greg Kroah-HartmanFrom: Phil Auld <[email protected]>
[ Upstream commit 54de76c0123915e7533ce352de30a1f2d80fe81f ]
Running cgroup kselftest with O= fails to run the with_stress test due to hardcoded ./test_core. Find test_core binary using the OUTPUT directory.
--- tools/testing/selftests/cgroup/test_stress.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/cgroup/test_stress.sh +1 -1
@@ -1,4 +1,4 @@ #!/bin/bash # SPDX-License-Identifier: GPL-2.0 -./with_stress.sh -s subsys -s fork ./test_core +./with_stress.sh -s subsys -s fork ${OUTPUT}/test_core
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 316/667 scripts/faddr2line: Fix overlapping text section failures
In reply to Greg Kroah-HartmanFrom: Josh Poimboeuf <[email protected]>
[ Upstream commit 1d1a0e7c5100d332583e20b40aa8c0a8ed3d7849 ]
There have been some recent reports of faddr2line failures:
$ scripts/faddr2line sound/soundcore.ko sound_devnode+0x5/0x35 bad symbol size: base: 0x0000000000000000 end: 0x0000000000000000
$ ./scripts/faddr2line vmlinux.o enter_from_user_mode+0x24 bad symbol size: base: 0x0000000000005fe0 end: 0x0000000000005fe0
The problem is that faddr2line is based on 'nm', which has a major
limitation: it doesn't know how to distinguish between different text sections. So if an offset exists in multiple text sections in the object, it may fail.
Rewrite faddr2line to be section-aware, by basing it on readelf.
--- scripts/faddr2line | 150 +++++++++++++++++++++++++++++---------------- 1 file changed, 97 insertions(+), 53 deletions(-)
scripts/faddr2line +97 -53
@@ -44,17 +44,6 @@ set -o errexit set -o nounset -READELF="${CROSS_COMPILE:-}readelf" -ADDR2LINE="${CROSS_COMPILE:-}addr2line" -SIZE="${CROSS_COMPILE:-}size" -NM="${CROSS_COMPILE:-}nm" - -command -v awk >/dev/null 2>&1 || die "awk isn't installed" -command -v ${READELF} >/dev/null 2>&1 || die "readelf isn't installed" -command -v ${ADDR2LINE} >/dev/null 2>&1 || die "addr2line isn't installed" -command -v ${SIZE} >/dev/null 2>&1 || die "size isn't installed" -command -v ${NM} >/dev/null 2>&1 || die "nm isn't installed" - usage() { echo "usage: faddr2line [--list] <object file> <func+offset> <func+offset>..." >&2 exit 1
@@ -69,6 +58,14 @@ die() { exit 1 } +READELF="${CROSS_COMPILE:-}readelf" +ADDR2LINE="${CROSS_COMPILE:-}addr2line" +AWK="awk" + +command -v ${AWK} >/dev/null 2>&1 || die "${AWK} isn't installed" +command -v ${READELF} >/dev/null 2>&1 || die "${READELF} isn't installed" +command -v ${ADDR2LINE} >/dev/null 2>&1 || die "${ADDR2LINE} isn't installed" + # Try to figure out the source directory prefix so we can remove it from the # addr2line output. HACK ALERT: This assumes that start_kernel() is in # init/main.c! This only works for vmlinux. Otherwise it falls back to
@@ -76,7 +73,7 @@ die() { find_dir_prefix() { local objfile=$1 - local start_kernel_addr=$(${READELF} -sW $objfile | awk '$8 == "start_kernel" {printf "0x%s", $2}') + local start_kernel_addr=$(${READELF} --symbols --wide $objfile | ${AWK} '$8 == "start_kernel" {printf "0x%s", $2}') [[ -z $start_kernel_addr ]] && return local file_line=$(${ADDR2LINE} -e $objfile $start_kernel_addr)
@@ -97,86 +94,133 @@ __faddr2line() { local dir_prefix=$3 local print_warnings=$4 - local func=${func_addr%+*} + local sym_name=${func_addr%+*} local offset=${func_addr#*+} offset=${offset%/*} - local size= - [[ $func_addr =~ "/" ]] && size=${func_addr#*/} + local user_size= + [[ $func_addr =~ "/" ]] && user_size=${func_addr#*/} - if [[ -z $func ]] || [[ -z $offset ]] || [[ $func = $func_addr ]]; then + if [[ -z $sym_name ]] || [[ -z $offset ]] || [[ $sym_name = $func_addr ]]; then warn "bad func+offset $func_addr" DONE=1 return fi # Go through each of the object's symbols which match the func name. - # In rare cases there might be duplicates. - file_end=$(${SIZE} -Ax $objfile | awk '$1 == ".text" {print $2}') - while read symbol; do - local fields=($symbol) - local sym_base=0x${fields[0]} - local sym_type=${fields[1]} - local sym_end=${fields[3]} - - # calculate the size - local sym_size=$(($sym_end - $sym_base)) + # In rare cases there might be duplicates, in which case we print all + # matches. + while read line; do + local fields=($line) + local sym_addr=0x${fields[1]} + local sym_elf_size=${fields[2]} + local sym_sec=${fields[6]} + + # Get the section size: + local sec_size=$(${READELF} --section-headers --wide $objfile | + sed 's/\[ /\[/' | + ${AWK} -v sec=$sym_sec '$1 == "[" sec "]" { print "0x" $6; exit }') + + if [[ -z $sec_size ]]; then + warn "bad section size: section: $sym_sec" + DONE=1 + return + fi + + # Calculate the symbol size. + # + # Unfortunately we can't use the ELF size, because kallsyms + # also includes the padding bytes in its size calculation. For + # kallsyms, the size calculation is the distance between the + # symbol and the next symbol in a sorted list. + local sym_size + local cur_sym_addr + local found=0 + while read line; do + local fields=($line) + cur_sym_addr=0x${fields[1]} + local cur_sym_elf_size=${fields[2]} + local cur_sym_name=${fields[7]:-} + + if [[ $cur_sym_addr = $sym_addr ]] && + [[ $cur_sym_elf_size = $sym_elf_size ]] && + [[ $cur_sym_name = $sym_name ]]; then + found=1 + continue + fi + + if [[ $found = 1 ]]; then + sym_size=$(($cur_sym_addr - $sym_addr)) + [[ $sym_size -lt $sym_elf_size ]] && continue; + found=2 + break + fi + done < <(${READELF} --symbols --wide $objfile | ${AWK} -v sec=$sym_sec '$7 == sec' | sort --key=2) + + if [[ $found = 0 ]]; then + warn "can't find symbol: sym_name: $sym_name sym_sec: $sym_sec sym_addr: $sym_addr sym_elf_size: $sym_elf_size" + DONE=1 + return + fi + + # If nothing was found after the symbol, assume it's the last + # symbol in the section. + [[ $found = 1 ]] && sym_size=$(($sec_size - $sym_addr)) + if [[ -z $sym_size ]] || [[ $sym_size -le 0 ]]; then - warn "bad symbol size: base: $sym_base end: $sym_end" + warn "bad symbol size: sym_addr: $sym_addr cur_sym_addr: $cur_sym_addr" DONE=1 return fi + sym_size=0x$(printf %x $sym_size) - # calculate the address - local addr=$(($sym_base + $offset)) + # Calculate the section address from user-supplied offset: + local addr=$(($sym_addr + $offset)) if [[ -z $addr ]] || [[ $addr = 0 ]]; then - warn "bad address: $sym_base + $offset" + warn "bad address: $sym_addr + $offset" DONE=1 return fi addr=0x$(printf %x $addr) - # weed out non-function symbols - if [[ $sym_type != t ]] && [[ $sym_type != T ]]; then - [[ $print_warnings = 1 ]] && - echo "skipping $func address at $addr due to non-function symbol of type '$sym_type'" - continue - fi - - # if the user provided a size, make sure it matches the symbol's size - if [[ -n $size ]] && [[ $size -ne $sym_size ]]; then + # If the user provided a size, make sure it matches the symbol's size: + if [[ -n $user_size ]] && [[ $user_size -ne $sym_size ]]; then [[ $print_warnings = 1 ]] && - echo "skipping $func address at $addr due to size mismatch ($size != $sym_size)" + echo "skipping $sym_name address at $addr due to size mismatch ($user_size != $sym_size)" continue; fi - # make sure the provided offset is within the symbol's range + # Make sure the provided offset is within the symbol's range: if [[ $offset -gt $sym_size ]]; then [[ $print_warnings = 1 ]] && - echo "skipping $func address at $addr due to size mismatch ($offset > $sym_size)" + echo "skipping $sym_name address at $addr due to size mismatch ($offset > $sym_size)" continue fi - # separate multiple entries with a blank line + # In case of duplicates or multiple addresses specified on the + # cmdline, separate multiple entries with a blank line: [[ $FIRST = 0 ]] && echo FIRST=0 - # pass real address to addr2line - echo "$func+$offset/$sym_size:" - local file_lines=$(${ADDR2LINE} -fpie $objfile $addr | sed "s; $dir_prefix\(\./\)*; ;") - [[ -z $file_lines ]] && return + echo "$sym_name+$offset/$sym_size:" + # Pass section address to addr2line and strip absolute paths + # from the output: + local output=$(${ADDR2LINE} -fpie $objfile $addr | sed "s; $dir_prefix\(\./\)*; ;") + [[ -z $output ]] && continue + + # Default output (non --list): if [[ $LIST = 0 ]]; then - echo "$file_lines" | while read -r line + echo "$output" | while read -r line do echo $line done DONE=1; - return + continue fi - # show each line with context - echo "$file_lines" | while read -r line + # For --list, show each line with its corresponding source code: + echo "$output" | while read -r line do echo echo $line
@@ -184,12 +228,12 @@ __faddr2line() { n1=$[$n-5] n2=$[$n+5] f=$(echo $line | sed 's/.*at \(.\+\):.*/\1/g') - awk 'NR>=strtonum("'$n1'") && NR<=strtonum("'$n2'") { if (NR=='$n') printf(">%d<", NR); else printf(" %d ", NR); printf("\t%s\n", $0)}' $f + ${AWK} 'NR>=strtonum("'$n1'") && NR<=strtonum("'$n2'") { if (NR=='$n') printf(">%d<", NR); else printf(" %d ", NR); printf("\t%s\n", $0)}' $f done DONE=1 - done < <(${NM} -n $objfile | awk -v fn=$func -v end=$file_end '$3 == fn { found=1; line=$0; start=$1; next } found == 1 { found=0; print line, "0x"$1 } END {if (found == 1) print line, end; }') + done < <(${READELF} --symbols --wide $objfile | ${AWK} -v fn=$sym_name '$4 == "FUNC" && $8 == fn') } [[ $# -lt 2 ]] && usage
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 317/667 media: aspeed: Fix an error handling path in aspeed_video_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 310fda622bbd38be17fb444f7f049b137af3bc0d ]
A dma_free_coherent() call is missing in the error handling path of the probe, as already done in the remove function.
In fact, this call is included in aspeed_video_free_buf(). So use the latter both in the error handling path of the probe and in the remove function.
It is easier to see the relation with aspeed_video_alloc_buf() this way.
--- drivers/media/platform/aspeed-video.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/platform/aspeed-video.c +2 -2
@@ -1723,6 +1723,7 @@ static int aspeed_video_probe(struct platform_device *pdev) rc =aspeed_video_setup_video (video);if (rc) { +aspeed_video_free_buf (video, &video->jpeg);clk_unprepare (video->vclk);clk_unprepare (video->eclk);return rc;
@@ -1748,8 +1749,7 @@ static int aspeed_video_remove(struct platform_device *pdev)v4l2_device_unregister (v4l2_dev); -dma_free_coherent (video->dev,VE_JPEG_HEADER_SIZE , video->jpeg.virt, - video->jpeg.dma); +aspeed_video_free_buf (video, &video->jpeg);of_reserved_mem_device_release (dev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 318/667 media: exynos4-is: Fix PM disable depth imbalance in fimc_is_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 5c0db68ce0faeb000c3540d095eb272d671a6e03 ]
If probe fails then we need to call pm_runtime_disable() to balance out the previous pm_runtime_enable() call.
--- drivers/media/platform/exynos4-is/fimc-is.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/platform/exynos4-is/fimc-is.c +3 -1
@@ -830,7 +830,7 @@ static int fimc_is_probe(struct platform_device *pdev) ret =pm_runtime_resume_and_get (dev);if (ret <0 ) - goto err_irq; + goto err_pm_disable;vb2_dma_contig_set_max_seg_size (dev,DMA_BIT_MASK (32 ));
@@ -864,6 +864,8 @@ static int fimc_is_probe(struct platform_device *pdev)pm_runtime_put_noidle (dev);if (!pm_runtime_enabled (dev))fimc_is_runtime_suspend (dev); +err_pm_disable: +pm_runtime_disable (dev); err_irq:free_irq (is->irq, is); err_clk:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 319/667 mt76: mt7921: Fix the error handling path of mt7921_pci_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 4e90db5e21eb3bb272fe47386dc3506755e209e9 ]
In case of error, some resources must be freed, as already done above and below the devm_kmemdup() and __mt7921e_mcu_drv_pmctrl() calls added in the commit in Fixes:.
--- drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7921/pci.c +5 -3
@@ -254,8 +254,10 @@ static int mt7921_pci_probe(struct pci_dev *pdev, dev->bus_ops = dev->mt76.bus; bus_ops =devm_kmemdup (dev->mt76.dev, dev->bus_ops,sizeof (*bus_ops),GFP_KERNEL ); -if (!bus_ops) -return -ENOMEM ; +if (!bus_ops) { + ret = -ENOMEM ; + goto err_free_dev; + } bus_ops->rr = mt7921_rr; bus_ops->wr = mt7921_wr;
@@ -264,7 +266,7 @@ static int mt7921_pci_probe(struct pci_dev *pdev, ret =__mt7921_mcu_drv_pmctrl (dev);if (ret) -return ret; + goto err_free_dev; mdev->rev = (mt7921_l1_rr (dev,MT_HW_CHIPID ) <<16 ) | (mt7921_l1_rr (dev,MT_HW_REV ) &0xff );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 320/667 mt76: do not attempt to reorder received 802.3 packets without agg session
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
[ Upstream commit 3968a66475b40691c37b5e6c76975f699671e10e ]
Fixes potential latency / packet drop issues in cases where a BA session has not (yet) been established.
--- drivers/net/wireless/mediatek/mt76/agg-rx.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/agg-rx.c +3 -2
@@ -162,8 +162,9 @@ void mt76_rx_aggr_reorder(struct sk_buff *skb, struct sk_buff_head *frames)if (!sta)return ; -if (!status->aggr && !(status->flag &RX_FLAG_8023 )) { -mt76_rx_aggr_check_ctl (skb, frames); +if (!status->aggr) { +if (!(status->flag &RX_FLAG_8023 )) +mt76_rx_aggr_check_ctl (skb, frames);return ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 321/667 media: st-delta: Fix PM disable depth imbalance in delta_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 94e3dba710fe0afc772172305444250023fc2d30 ]
The pm_runtime_enable will decrease power disable depth. If the probe fails, we should use pm_runtime_disable() to balance pm_runtime_enable().
--- drivers/media/platform/sti/delta/delta-v4l2.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/media/platform/sti/delta/delta-v4l2.c +4 -2
@@ -1859,7 +1859,7 @@ static int delta_probe(struct platform_device *pdev)if (ret) {dev_err (delta->dev,"%s failed to initialize firmware ipc channel\n" ,DELTA_PREFIX ); - goto err; + goto err_pm_disable; }/* register all available decoders */
@@ -1873,7 +1873,7 @@ static int delta_probe(struct platform_device *pdev)if (ret) {dev_err (delta->dev,"%s failed to register V4L2 device\n" ,DELTA_PREFIX ); - goto err; + goto err_pm_disable; } delta->work_queue =create_workqueue (DELTA_NAME );
@@ -1898,6 +1898,8 @@ static int delta_probe(struct platform_device *pdev)destroy_workqueue (delta->work_queue); err_v4l2:v4l2_device_unregister (&delta->v4l2_dev); +err_pm_disable: +pm_runtime_disable (dev); err:return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 322/667 media: atmel: atmel-isc: Fix PM disable depth imbalance in atmel_isc_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 395829c61a196a0821a703a49c4db3ac51daff73 ]
The pm_runtime_enable will decrease power disable depth. If the probe fails, we should use pm_runtime_disable() to balance pm_runtime_enable().
--- drivers/media/platform/atmel/atmel-sama5d2-isc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/media/platform/atmel/atmel-sama5d2-isc.c +4 -1
@@ -537,7 +537,7 @@ static int atmel_isc_probe(struct platform_device *pdev) ret =clk_prepare_enable (isc->ispck);if (ret) {dev_err (dev,"failed to enable ispck: %d\n" , ret); - goto cleanup_subdev; + goto disable_pm; }/* ispck should be greater or equal to hclock */
@@ -555,6 +555,9 @@ static int atmel_isc_probe(struct platform_device *pdev) unprepare_clk:clk_disable_unprepare (isc->ispck); +disable_pm: +pm_runtime_disable (dev); + cleanup_subdev:isc_subdev_cleanup (isc);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 323/667 media: i2c: rdacm2x: properly set subdev entity function
In reply to Greg Kroah-HartmanFrom: Laurentiu Palcu <[email protected]>
[ Upstream commit d2facee67b4883bb3e7461a0a93fd70d0c7b7261 ]
The subdevice entity function was left unset, which produces a warning when probing the device:
mxc-md bus@58000000:camera: Entity type for entity rdacm20 19-0051 was not initialized!
This patch will set entity function to MEDIA_ENT_F_CAM_SENSOR and leave flags unset.
--- drivers/media/i2c/rdacm20.c | 2 +- drivers/media/i2c/rdacm21.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/media/i2c/rdacm20.c +1 -1
@@ -611,7 +611,7 @@ static int rdacm20_probe(struct i2c_client *client) goto error_free_ctrls; dev->pad.flags =MEDIA_PAD_FL_SOURCE ; - dev->sd.entity.flags |=MEDIA_ENT_F_CAM_SENSOR ; + dev->sd.entity.function =MEDIA_ENT_F_CAM_SENSOR ; ret =media_entity_pads_init (&dev->sd.entity,1 , &dev->pad);if (ret <0 ) goto error_free_ctrls;
drivers/media/i2c/rdacm21.c +1 -1
@@ -583,7 +583,7 @@ static int rdacm21_probe(struct i2c_client *client) goto error_free_ctrls; dev->pad.flags =MEDIA_PAD_FL_SOURCE ; - dev->sd.entity.flags |=MEDIA_ENT_F_CAM_SENSOR ; + dev->sd.entity.function =MEDIA_ENT_F_CAM_SENSOR ; ret =media_entity_pads_init (&dev->sd.entity,1 , &dev->pad);if (ret <0 ) goto error_free_ctrls;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 324/667 media: exynos4-is: Change clk_disable to clk_disable_unprepare
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 9fadab72a6916c7507d7fedcd644859eef995078 ]
The corresponding API for clk_prepare_enable is clk_disable_unprepare, other than clk_disable.
Fix this by changing clk_disable to clk_disable_unprepare.
--- drivers/media/platform/exynos4-is/fimc-is.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/exynos4-is/fimc-is.c +1 -1
@@ -140,7 +140,7 @@ static int fimc_is_enable_clocks(struct fimc_is *is)dev_err (&is->pdev->dev,"clock %s enable failed\n" , fimc_is_clocks[i]);for (--i; i >=0 ; i--) -clk_disable (is->clocks[i]); +clk_disable_unprepare (is->clocks[i]);return ret; }pr_debug ("enabled clock: %s\n" , fimc_is_clocks[i]);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 325/667 media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit 471bec68457aaf981add77b4f590d65dd7da1059 ]
Syzbot reported that -1 is used as array index. The problem was in missing validation check.
hdw->unit_number is initialized with -1 and then if init table walk fails this value remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the easiest fix for that.
hdw->workpoll initialization moved upper to prevent warning in __flush_work.
--- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/media/usb/pvrusb2/pvrusb2-hdw.c +5 -2
@@ -2569,6 +2569,11 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf, }while (0 );mutex_unlock (&pvr2_unit_mtx); +INIT_WORK (&hdw->workpoll, pvr2_hdw_worker_poll); + +if (hdw->unit_number ==-1 ) + goto fail; + cnt1 =0 ; cnt2 =scnprintf (hdw->name+cnt1,sizeof (hdw->name)-cnt1,"pvrusb2" ); cnt1 += cnt2;
@@ -2580,8 +2585,6 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,if (cnt1 >=sizeof (hdw->name)) cnt1 =sizeof (hdw->name)-1 ; hdw->name[cnt1] =0 ; -INIT_WORK (&hdw->workpoll,pvr2_hdw_worker_poll); -pvr2_trace (PVR2_TRACE_INIT ,"Driver unit number is %d, name is %s" , hdw->unit_number,hdw->name);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 326/667 media: vsp1: Fix offset calculation for plane cropping
In reply to Greg Kroah-HartmanFrom: Michael Rodin <[email protected]>
[ Upstream commit 5f25abec8f21b7527c1223a354d23c270befddb3 ]
The vertical subsampling factor is currently not considered in the offset calculation for plane cropping done in rpf_configure_partition. This causes a distortion (shift of the color plane) when formats with the vsub factor larger than 1 are used (e.g. NV12, see vsp1_video_formats in vsp1_pipe.c). This commit considers vsub factor for all planes except plane 0 (luminance).
Drop generalization of the offset calculation to reduce the binary size.
--- drivers/media/platform/vsp1/vsp1_rpf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/media/platform/vsp1/vsp1_rpf.c +3 -3
@@ -291,11 +291,11 @@ static void rpf_configure_partition(struct vsp1_entity *entity, + crop.left * fmtinfo->bpp[0 ] /8 ;if (format->num_planes >1 ) { +unsigned int bpl = format->plane_fmt[1 ].bytesperline;unsigned int offset; - offset = crop.top * format->plane_fmt[1 ].bytesperline - + crop.left / fmtinfo->hsub - * fmtinfo->bpp[1 ] /8 ; + offset = crop.top / fmtinfo->vsub * bpl + + crop.left / fmtinfo->hsub * fmtinfo->bpp[1 ] /8 ; mem.addr[1 ] += offset; mem.addr[2 ] += offset; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 327/667 media: atmel: atmel-sama5d2-isc: fix wrong mask in YUYV format check
In reply to Greg Kroah-HartmanFrom: Eugen Hristev <[email protected]>
[ Upstream commit 91f49b80983f7bffdea9498209b2b896231ac776 ]
While this does not happen in production, this check should be done versus the mask, as checking with the YCYC value may not include some bits that may be set.
It is correct and safe to check the whole mask.
--- drivers/media/platform/atmel/atmel-sama5d2-isc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/atmel/atmel-sama5d2-isc.c +1 -1
@@ -267,7 +267,7 @@ static void isc_sama5d2_config_rlp(struct isc_device *isc)* Thus, if the YCYC mode is selected, replace it with the * sama5d2-compliant mode which is YYCC . */ -if ((rlp_mode &ISC_RLP_CFG_MODE_YCYC ) ==ISC_RLP_CFG_MODE_YCYC ) { +if ((rlp_mode &ISC_RLP_CFG_MODE_MASK ) ==ISC_RLP_CFG_MODE_YCYC ) { rlp_mode &= ~ISC_RLP_CFG_MODE_MASK ; rlp_mode |=ISC_RLP_CFG_MODE_YYCC ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 328/667 media: hantro: HEVC: Fix tile info buffer value computation
In reply to Greg Kroah-HartmanFrom: Benjamin Gaignard <[email protected]>
[ Upstream commit d7f4149df818463c1d7094b35db6ebd79f46c7bd ]
Use pps->column_width_minus1[j] + 1 as value for the tile info buffer instead of pps->column_width_minus1[j + 1].
The patch fixes DBLK_E_VIXS_2, DBLK_F_VIXS_2, DBLK_G_VIXS_2, SAO_B_MediaTek_5, TILES_A_Cisco_2 and TILES_B_Cisco_1 tests in fluster.
--- drivers/staging/media/hantro/hantro_g2_hevc_dec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/media/hantro/hantro_g2_hevc_dec.c +1 -1
@@ -74,7 +74,7 @@ static void prepare_tile_info_buffer(struct hantro_ctx *ctx) no_chroma =1 ;for (j =0 , tmp_w =0 ; j < num_tile_cols -1 ; j++) { tmp_w += pps->column_width_minus1[j] +1 ; - *p++ = pps->column_width_minus1[j +1 ]; + *p++ = pps->column_width_minus1[j] +1 ; *p++ = h;if (i ==0 && h ==1 && ctb_size ==16 ) no_chroma =1 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 329/667 Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
In reply to Greg Kroah-HartmanFrom: Ying Hsu <[email protected]>
[ Upstream commit 7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2 ]
Connecting the same socket twice consecutively in sco_sock_connect() could lead to a race condition where two sco_conn objects are created but only one is associated with the socket. If the socket is closed before the SCO connection is established, the timer associated with the dangling sco_conn object won't be canceled. As the sock object is being freed, the use-after-free problem happens when the timer callback function sco_sock_timeout() accesses the socket. Here's the call trace:
dump_stack+0x107/0x163 ? refcount_inc+0x1c/ print_address_description.constprop.0+0x1c/0x47e ? refcount_inc+0x1c/0x7b kasan_report+0x13a/0x173 ? refcount_inc+0x1c/0x7b check_memory_region+0x132/0x139 refcount_inc+0x1c/0x7b sco_sock_timeout+0xb2/0x1ba process_one_work+0x739/0xbd1 ? cancel_delayed_work+0x13f/0x13f ? __raw_spin_lock_init+0xf0/0xf0 ? to_kthread+0x59/0x85 worker_thread+0x593/0x70e kthread+0x346/0x35a ? drain_workqueue+0x31a/0x31a ? kthread_bind+0x4b/0x4b ret_from_fork+0x1f/0x30
--- net/bluetooth/sco.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-)
net/bluetooth/sco.c +13 -8
@@ -575,19 +575,24 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen addr->sa_family != AF_BLUETOOTH)return -EINVAL ; -if (sk->sk_state !=BT_OPEN && sk->sk_state !=BT_BOUND ) -return -EBADFD ; +lock_sock (sk); +if (sk->sk_state !=BT_OPEN && sk->sk_state !=BT_BOUND ) { + err = -EBADFD ; + goto done; + } -if (sk->sk_type !=SOCK_SEQPACKET ) -return -EINVAL ; +if (sk->sk_type !=SOCK_SEQPACKET ) { + err = -EINVAL ; + goto done; + } hdev =hci_get_route (&sa->sco_bdaddr, &sco_pi (sk)->src,BDADDR_BREDR ); -if (!hdev) -return -EHOSTUNREACH ; +if (!hdev) { + err = -EHOSTUNREACH ; + goto done; + }hci_dev_lock (hdev); -lock_sock (sk); -/* Set destination address and psm */ bacpy (&sco_pi (sk)->dst, &sa->sco_bdaddr);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 330/667 Bluetooth: use hdev lock in activate_scan for hci_is_adv_monitoring
In reply to Greg Kroah-HartmanFrom: Niels Dossche <[email protected]>
[ Upstream commit 50a3633ae5e98cf1b80ef5b73c9e341aee9ad896 ]
hci_is_adv_monitoring's function documentation states that it must be called under the hdev lock. Paths that leads to an unlocked call are:discov_update => start_discovery => interleaved_discov => active_scan
and: discov_update => start_discovery => active_scan
The solution is to take the lock in active_scan during the duration of the call to hci_is_adv_monitoring.
--- net/bluetooth/hci_request.c | 2 ++ 1 file changed, 2 insertions(+)
net/bluetooth/hci_request.c +2 -0
@@ -3174,6 +3174,7 @@ static int active_scan(struct hci_request *req, unsigned long opt)if (err <0 ) own_addr_type =ADDR_LE_DEV_PUBLIC ; +hci_dev_lock (hdev);if (hci_is_adv_monitoring (hdev)) {/* Duplicate filter should be disabled when some advertisement * monitor is activated, otherwise AdvMon can only receive one
@@ -3190,6 +3191,7 @@ static int active_scan(struct hci_request *req, unsigned long opt)*/ filter_dup =LE_SCAN_FILTER_DUP_DISABLE ; } +hci_dev_unlock (hdev); hci_req_start_scan(req, LE_SCAN_ACTIVE, interval, hdev->le_scan_window_discovery, own_addr_type,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 331/667 Bluetooth: use hdev lock for accept_list and reject_list in conn req
In reply to Greg Kroah-HartmanFrom: Niels Dossche <[email protected]>
[ Upstream commit fb048cae51bacdfbbda2954af3c213fdb1d484f4 ]
All accesses (both reads and modifications) to hdev->{accept,reject}_list are protected by hdev lock, except the ones in hci_conn_request_evt. This can cause a race condition in the form of a list corruption.
The solution is to protect these lists in hci_conn_request_evt as well.
I was unable to find the exact commit that introduced the issue for the reject list, I was only able to find it for the accept list.
--- net/bluetooth/hci_event.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
net/bluetooth/hci_event.c +9 -6
@@ -2790,10 +2790,12 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)return ; } +hci_dev_lock (hdev); +if (hci_bdaddr_list_lookup (&hdev->reject_list, &ev->bdaddr,BDADDR_BREDR )) {hci_reject_conn (hdev, &ev->bdaddr); -return ; + goto unlock; }/* Require HCI_CONNECTABLE or an accept list entry to accept the
@@ -2805,13 +2807,11 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb) !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr, BDADDR_BREDR)) {hci_reject_conn (hdev, &ev->bdaddr); -return ; + goto unlock; }/* Connection accepted */ -hci_dev_lock (hdev); - ie =hci_inquiry_cache_lookup (hdev, &ev->bdaddr);if (ie)memcpy (ie->data.dev_class, ev->dev_class,3 );
@@ -2823,8 +2823,7 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb) HCI_ROLE_SLAVE);if (!conn) {bt_dev_err (hdev,"no memory for new connection" ); -hci_dev_unlock (hdev); -return ; + goto unlock; } }
@@ -2864,6 +2863,10 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb) conn->state =BT_CONNECT2 ;hci_connect_cfm (conn,0 ); } + +return ; +unlock: +hci_dev_unlock (hdev); }static u8 hci_to_mgmt_reason (u8 err)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 332/667 nvme: set dma alignment to dword
In reply to Greg Kroah-HartmanFrom: Keith Busch <[email protected]>
[ Upstream commit 52fde2c07da606f3f120af4f734eadcfb52b04be ]
The nvme specification only requires qword alignment for segment descriptors, and the driver already guarantees that. The spec has always allowed user data to be dword aligned, which is what the queue's attribute is for, so relax the alignment requirement to that value.
While we could allow byte alignment for some controllers when using SGLs, we still need to support PRP, and that only allows dword.
--- drivers/nvme/host/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/core.c +1 -1
@@ -1777,7 +1777,7 @@ static void nvme_set_queue_limits(struct nvme_ctrl *ctrl,blk_queue_max_segments (q,min_t (u32, max_segments,USHRT_MAX )); }blk_queue_virt_boundary (q,NVME_CTRL_PAGE_SIZE -1 ); -blk_queue_dma_alignment (q,7 ); +blk_queue_dma_alignment (q,3 );blk_queue_write_cache (q, vwc, vwc); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 333/667 m68k: math-emu: Fix dependencies of math emulation support
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit ed6bc6bf0a7d75e80eb1df883c09975ebb74e590 ]
If CONFIG_M54xx=y, CONFIG_MMU=y, and CONFIG_M68KFPU_EMU=y:
{standard input}:272: Error: invalid instruction for this architecture; needs 68000 or higher (68000 [68ec000, 68hc000, 68hc001, 68008, 68302, 68306, 68307, 68322, 68356], 68010, 68020 [68k, 68ec020], 68030 [68ec030], 68040 [68ec040], 68060 [68ec060], cpu32 [68330, 68331, 68332, 68333, 68334, 68336, 68340, 68341, 68349, 68360], fidoa [fido]) -- statement `sub.b %d1,%d3' ignored
{standard input}:609: Error: invalid instruction for this architecture; needs 68020 or higher (68020 [68k, 68ec020], 68030 [68ec030], 68040 [68ec040], 68060 [68ec060]) -- statement `bfextu 4(%a1){%d0,#8},%d0' ignored
{standard input}:752: Error: operands mismatch -- statement `mulu.l 4(%a0),%d3:%d0' ignored
{standard input}:1155: Error: operands mismatch -- statement `divu.l %d0,%d3:%d7' ignoredThe math emulation support code is intended for 68020 and higher, and uses several instructions or instruction modes not available on coldfire or 68000.
Originally, the dependency of M68KFPU_EMU on MMU was fine, as MMU support was only available on 68020 or higher. But this assumption was broken by the introduction of MMU support for M547x and M548x.
Drop the dependency on MMU, as the code should work fine on 68020 and up without MMU (which are not yet supported by Linux, though). Add dependencies on M68KCLASSIC (to rule out Coldfire) and FPU (kernel has some type of floating-point support --- be it hardware or software emulated, to rule out anything below 68020).
--- arch/m68k/Kconfig.cpu | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/m68k/Kconfig.cpu +1 -1
@@ -338,7 +338,7 @@ comment "Processor Specific Options" config M68KFPU_EMU bool "Math emulation support" - depends on MMU + depends on M68KCLASSIC && FPU help At some point in the future, this will cause floating-point math instructions to be emulated by the kernel on machines that lack a
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 334/667 sctp: read sk->sk_bound_dev_if once in sctp_rcv()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit a20ea298071f46effa3aaf965bf9bb34c901db3f ]
sctp_rcv() reads sk->sk_bound_dev_if twice while the socket is not locked. Another cpu could change this field under us.
--- net/sctp/input.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/sctp/input.c +3 -1
@@ -92,6 +92,7 @@ int sctp_rcv(struct sk_buff *skb)struct sctp_chunk *chunk;union sctp_addr src;union sctp_addr dest; +int bound_dev_if;int family;struct sctp_af *af;struct net *net =dev_net (skb->dev);
@@ -169,7 +170,8 @@ int sctp_rcv(struct sk_buff *skb)* If a frame arrives on an interface and the receiving socket is * bound to another interface, via SO_BINDTODEVICE, treat it as OOTB */ -if (sk->sk_bound_dev_if && (sk->sk_bound_dev_if != af->skb_iif (skb))) { + bound_dev_if =READ_ONCE (sk->sk_bound_dev_if); +if (bound_dev_if && (bound_dev_if != af->skb_iif (skb))) {if (transport) {sctp_transport_put (transport); asoc =NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 335/667 net: hinic: add missing destroy_workqueue in hinic_pf_to_mgmt_init
In reply to Greg Kroah-HartmanFrom: Zheng Bin <[email protected]>
[ Upstream commit 382d917bfc1e92339dae3c8a636b2730e8bb5132 ]
hinic_pf_to_mgmt_init misses destroy_workqueue in error path, this patch fixes that.
--- drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c +2 -0
@@ -643,6 +643,7 @@ int hinic_pf_to_mgmt_init(struct hinic_pf_to_mgmt *pf_to_mgmt, err =alloc_msg_buf (pf_to_mgmt);if (err) {dev_err (&pdev->dev,"Failed to allocate msg buffers\n" ); +destroy_workqueue (pf_to_mgmt->workq);hinic_health_reporters_destroy (hwdev->devlink_dev);return err; }
@@ -650,6 +651,7 @@ int hinic_pf_to_mgmt_init(struct hinic_pf_to_mgmt *pf_to_mgmt, err =hinic_api_cmd_init (pf_to_mgmt->cmd_chain, hwif);if (err) {dev_err (&pdev->dev,"Failed to initialize cmd chains\n" ); +destroy_workqueue (pf_to_mgmt->workq);hinic_health_reporters_destroy (hwdev->devlink_dev);return err; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 336/667 ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_*
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit a34840c4eb3278a7c29c9c57a65ce7541c66f9f2 ]
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
--- sound/soc/ti/j721e-evm.c | 44 ++++++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 11 deletions(-)
sound/soc/ti/j721e-evm.c +33 -11
@@ -634,17 +634,18 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, codec_node =of_parse_phandle (node,"ti,cpb-codec" ,0 );if (!codec_node) {dev_err (priv->dev,"CPB codec node is not provided\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto put_dai_node; } domain = &priv->audio_domains[J721E_AUDIO_DOMAIN_CPB ]; ret =j721e_get_clocks (priv->dev, &domain->codec,"cpb-codec-scki" );if (ret) -return ret; + goto put_codec_node; ret =j721e_get_clocks (priv->dev, &domain->mcasp,"cpb-mcasp-auxclk" );if (ret) -return ret; + goto put_codec_node;/* * Common Processor Board, two links
@@ -654,8 +655,10 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, comp_count =6 ; compnent =devm_kzalloc (priv->dev, comp_count *sizeof (*compnent),GFP_KERNEL ); -if (!compnent) -return -ENOMEM ; +if (!compnent) { + ret = -ENOMEM ; + goto put_codec_node; + } comp_idx =0 ; priv->dai_links[*link_idx].cpus = &compnent[comp_idx++];
@@ -706,6 +709,12 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, (*conf_idx)++;return 0 ; + +put_codec_node: +of_node_put (codec_node); +put_dai_node: +of_node_put (dai_node); +return ret; } static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx,
@@ -730,23 +739,25 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, codeca_node =of_parse_phandle (node,"ti,ivi-codec-a" ,0 );if (!codeca_node) {dev_err (priv->dev,"IVI codec-a node is not provided\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto put_dai_node; } codecb_node =of_parse_phandle (node,"ti,ivi-codec-b" ,0 );if (!codecb_node) {dev_warn (priv->dev,"IVI codec-b node is not provided\n" ); -return 0 ; + ret =0 ; + goto put_codeca_node; } domain = &priv->audio_domains[J721E_AUDIO_DOMAIN_IVI ]; ret =j721e_get_clocks (priv->dev, &domain->codec,"ivi-codec-scki" );if (ret) -return ret; + goto put_codecb_node; ret =j721e_get_clocks (priv->dev, &domain->mcasp,"ivi-mcasp-auxclk" );if (ret) -return ret; + goto put_codecb_node;/* * IVI extension, two links
@@ -758,8 +769,10 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, comp_count =8 ; compnent =devm_kzalloc (priv->dev, comp_count *sizeof (*compnent),GFP_KERNEL ); -if (!compnent) -return -ENOMEM ; +if (!compnent) { + ret = -ENOMEM ; + goto put_codecb_node; + } comp_idx =0 ; priv->dai_links[*link_idx].cpus = &compnent[comp_idx++];
@@ -820,6 +833,15 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, (*conf_idx)++;return 0 ; + + +put_codecb_node: +of_node_put (codecb_node); +put_codeca_node: +of_node_put (codeca_node); +put_dai_node: +of_node_put (dai_node); +return ret; }static int j721e_soc_probe (struct platform_device *pdev)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 337/667 kselftest/arm64: bti: force static linking
In reply to Greg Kroah-HartmanFrom: Andre Przywara <[email protected]>
[ Upstream commit d7a49291d786b4400996afe3afcc3ef5eeb6f0ef ]
The "bti" selftests are built with -nostdlib, which apparently automatically creates a statically linked binary, which is what we want and need for BTI (to avoid interactions with the dynamic linker).
However this is not true when building a PIE binary, which some toolchains (Ubuntu) configure as the default.
When compiling btitest with such a toolchain, it will create a dynamically linked binary, which will probably fail some tests, as the dynamic linker might not support BTI:
===================
TAP version 13
1..18
not ok 1 nohint_func/call_using_br_x0
not ok 2 nohint_func/call_using_br_x16
not ok 3 nohint_func/call_using_blr
....
===================
To make sure we create static binaries, add an explicit -static on the linker command line. This forces static linking even if the toolchain defaults to PIE builds, and fixes btitest runs on BTI enabled machines.
--- tools/testing/selftests/arm64/bti/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/arm64/bti/Makefile +2 -2
@@ -39,7 +39,7 @@ BTI_OBJS = \ teststubs-bti.o \ trampoline-bti.o gen/btitest: $(BTI_OBJS) - $(CC) $(CFLAGS_BTI) $(CFLAGS_COMMON) -nostdlib -o $@ $^ + $(CC) $(CFLAGS_BTI) $(CFLAGS_COMMON) -nostdlib -static -o $@ $^ NOBTI_OBJS = \ test-nobti.o \
@@ -50,7 +50,7 @@ NOBTI_OBJS = \ teststubs-nobti.o \ trampoline-nobti.o gen/nobtitest: $(NOBTI_OBJS) - $(CC) $(CFLAGS_BTI) $(CFLAGS_COMMON) -nostdlib -o $@ $^ + $(CC) $(CFLAGS_BTI) $(CFLAGS_COMMON) -nostdlib -static -o $@ $^ # Including KSFT lib.mk here will also mangle the TEST_GEN_PROGS list # to account for any OUTPUT target-dirs optionally provided by
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 338/667 media: ov7670: remove ov7670_power_off from ov7670_remove
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
[ Upstream commit 5bf19572e31375368f19edd2dbb2e0789518bb99 ]
In ov7670_probe, it always invokes ov7670_power_off() no matter the execution is successful or failed. So we cannot invoke it agiain in ov7670_remove().
Fix this by removing ov7670_power_off from ov7670_remove.
--- drivers/media/i2c/ov7670.c | 1 - 1 file changed, 1 deletion(-)
drivers/media/i2c/ov7670.c +0 -1
@@ -2017,7 +2017,6 @@ static int ov7670_remove(struct i2c_client *client)v4l2_async_unregister_subdev (sd);v4l2_ctrl_handler_free (&info->hdl);media_entity_cleanup (&info->sd.entity); -ov7670_power_off (sd);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 339/667 media: i2c: ov5648: fix wrong pointer passed to IS_ERR() and PTR_ERR()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit a6dd5265c21c28d0a782befe41a97c347e78f22f ]
IS_ERR() and PTR_ERR() use wrong pointer, it should be sensor->dovdd, fix it.
--- drivers/media/i2c/ov5648.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/i2c/ov5648.c +2 -2
@@ -2498,9 +2498,9 @@ static int ov5648_probe(struct i2c_client *client)/* DOVDD: digital I/O */ sensor->dovdd =devm_regulator_get (dev,"dovdd" ); -if (IS_ERR (sensor->dvdd)) { +if (IS_ERR (sensor->dovdd)) {dev_err (dev,"cannot get DOVDD (digital I/O) regulator\n" ); - ret =PTR_ERR (sensor->dvdd); + ret =PTR_ERR (sensor->dovdd); goto error_endpoint; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 340/667 media: staging: media: rkvdec: Make use of the helper function devm_platform_ioremap_resource()
In reply to Greg Kroah-HartmanFrom: Cai Huoqing <[email protected]>
[ Upstream commit 5a3683d60e56f4faa9552d3efafd87ef106dd393 ]
Use the devm_platform_ioremap_resource() helper instead of calling platform_get_resource() and devm_ioremap_resource() separately
--- drivers/staging/media/rkvdec/rkvdec.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/staging/media/rkvdec/rkvdec.c +1 -3
@@ -967,7 +967,6 @@ static const char * const rkvdec_clk_names[] = {static int rkvdec_probe (struct platform_device *pdev) {struct rkvdec_dev *rkvdec; -struct resource *res;unsigned int i;int ret, irq;
@@ -999,8 +998,7 @@ static int rkvdec_probe(struct platform_device *pdev)*/ clk_set_rate (rkvdec->clocks[0 ].clk,500 *1000 *1000 ); - res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); - rkvdec->regs =devm_ioremap_resource (&pdev->dev, res); + rkvdec->regs =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (rkvdec->regs))return PTR_ERR (rkvdec->regs);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 341/667 media: rkvdec: Stop overclocking the decoder
In reply to Greg Kroah-HartmanFrom: Nicolas Dufresne <[email protected]>
[ Upstream commit 9998943f6dfc5d5472bfab2e38527fb6ba5e9da7 ]
While this overclock hack seems to work on some implementations (some ChromeBooks, RockPi4) it also causes instability on other implementations (notably LibreComputer Renegade, but there were more reports in the LibreELEC project, where this has been removed). While performance is indeed affected (tested with GStreamer), 4K playback still works as long as you don't operate in lock step and keep at least 1 frame ahead of time in the decode queue.
After discussion with ChromeOS members, it would seem that their implementation indeed used to synchronously decode each frame, so this hack was simply compensating for their code being less efficient. In my opinion, this hack should not have been included upstream.
--- drivers/staging/media/rkvdec/rkvdec.c | 6 ------ 1 file changed, 6 deletions(-)
drivers/staging/media/rkvdec/rkvdec.c +0 -6
@@ -992,12 +992,6 @@ static int rkvdec_probe(struct platform_device *pdev)if (ret)return ret; -/* -* Bump ACLK to max. possible freq. (500 MHz) to improve performance -* When 4k video playback. -*/ -clk_set_rate (rkvdec->clocks[0 ].clk,500 *1000 *1000 ); - rkvdec->regs =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (rkvdec->regs))return PTR_ERR (rkvdec->regs);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 342/667 media: rkvdec: h264: Fix dpb_valid implementation
In reply to Greg Kroah-HartmanFrom: Nicolas Dufresne <[email protected]>
[ Upstream commit 7ab889f09dfa70e8097ec1b9186fd228124112cb ]
The ref builder only provided references that are marked as valid in the dpb. Thus the current implementation of dpb_valid would always set the flag to 1. This is not representing missing frames (this is called 'non-existing' pictures in the spec). In some context, these non-existing pictures still need to occupy a slot in the reference list according to the spec.
--- drivers/staging/media/rkvdec/rkvdec-h264.c | 33 ++++++++++++++++------ 1 file changed, 24 insertions(+), 9 deletions(-)
drivers/staging/media/rkvdec/rkvdec-h264.c +24 -9
@@ -112,6 +112,7 @@ struct rkvdec_h264_run {const struct v4l2_ctrl_h264_sps *sps;const struct v4l2_ctrl_h264_pps *pps;const struct v4l2_ctrl_h264_scaling_matrix *scaling_matrix; +int ref_buf_idx[V4L2_H264_NUM_DPB_ENTRIES ]; };struct rkvdec_h264_ctx {
@@ -725,6 +726,26 @@ static void assemble_hw_pps(struct rkvdec_ctx *ctx, } } +static void lookup_ref_buf_idx (struct rkvdec_ctx *ctx, +struct rkvdec_h264_run *run) +{ +const struct v4l2_ctrl_h264_decode_params *dec_params = run->decode_params; +u32 i; + +for (i =0 ; i <ARRAY_SIZE (dec_params->dpb); i++) { +struct v4l2_m2m_ctx *m2m_ctx = ctx->fh.m2m_ctx; +const struct v4l2_h264_dpb_entry *dpb = run->decode_params->dpb; +struct vb2_queue *cap_q = &m2m_ctx->cap_q_ctx.q; +int buf_idx =-1 ; + +if (dpb[i].flags &V4L2_H264_DPB_ENTRY_FLAG_ACTIVE ) + buf_idx =vb2_find_timestamp (cap_q, + dpb[i].reference_ts,0 ); + + run->ref_buf_idx[i] = buf_idx; + } +} +static void assemble_hw_rps (struct rkvdec_ctx *ctx,struct rkvdec_h264_run *run) {
@@ -762,7 +783,7 @@ static void assemble_hw_rps(struct rkvdec_ctx *ctx,for (j =0 ; j <RKVDEC_NUM_REFLIST ; j++) {for (i =0 ; i < h264_ctx->reflists.num_valid; i++) { -u8 dpb_valid =0 ; +bool dpb_valid = run->ref_buf_idx[i] >=0 ;u8 idx =0 ;switch (j) {
@@ -779,8 +800,6 @@ static void assemble_hw_rps(struct rkvdec_ctx *ctx,if (idx >=ARRAY_SIZE (dec_params->dpb))continue ; - dpb_valid = !!(dpb[idx].flags & -V4L2_H264_DPB_ENTRY_FLAG_ACTIVE );set_ps_field (hw_rps,DPB_INFO (i, j), idx | dpb_valid <<4 );
@@ -859,13 +878,8 @@ get_ref_buf(struct rkvdec_ctx *ctx, struct rkvdec_h264_run *run, unsigned int dpb_idx) {struct v4l2_m2m_ctx *m2m_ctx = ctx->fh.m2m_ctx; -const struct v4l2_h264_dpb_entry *dpb = run->decode_params->dpb;struct vb2_queue *cap_q = &m2m_ctx->cap_q_ctx.q; -int buf_idx =-1 ; - -if (dpb[dpb_idx].flags &V4L2_H264_DPB_ENTRY_FLAG_ACTIVE ) - buf_idx =vb2_find_timestamp (cap_q, - dpb[dpb_idx].reference_ts,0 ); +int buf_idx = run->ref_buf_idx[dpb_idx];/* * If a DPB entry is unused or invalid, address of current destination
@@ -1102,6 +1116,7 @@ static int rkvdec_h264_run(struct rkvdec_ctx *ctx)assemble_hw_scaling_list (ctx, &run);assemble_hw_pps (ctx, &run); +lookup_ref_buf_idx (ctx, &run);assemble_hw_rps (ctx, &run);config_registers (ctx, &run);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 343/667 media: rkvdec: h264: Fix bit depth wrap in pps packet
In reply to Greg Kroah-HartmanFrom: Jonas Karlman <[email protected]>
[ Upstream commit a074aa4760d1dad0bd565c0f66e7250f5f219ab0 ]
The luma and chroma bit depth fields in the pps packet are 3 bits wide. 8 is wrongly added to the bit depth values written to these 3 bit fields. Because only the 3 LSB are written, the hardware was configured correctly.
Correct this by not adding 8 to the luma and chroma bit depth value.
--- drivers/staging/media/rkvdec/rkvdec-h264.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/staging/media/rkvdec/rkvdec-h264.c +2 -2
@@ -662,8 +662,8 @@ static void assemble_hw_pps(struct rkvdec_ctx *ctx,WRITE_PPS (0xff ,PROFILE_IDC );WRITE_PPS (1 ,CONSTRAINT_SET3_FLAG );WRITE_PPS (sps->chroma_format_idc,CHROMA_FORMAT_IDC ); -WRITE_PPS (sps->bit_depth_luma_minus8 +8 ,BIT_DEPTH_LUMA ); -WRITE_PPS (sps->bit_depth_chroma_minus8 +8 ,BIT_DEPTH_CHROMA ); +WRITE_PPS (sps->bit_depth_luma_minus8,BIT_DEPTH_LUMA ); +WRITE_PPS (sps->bit_depth_chroma_minus8,BIT_DEPTH_CHROMA );WRITE_PPS (0 ,QPPRIME_Y_ZERO_TRANSFORM_BYPASS_FLAG );WRITE_PPS (sps->log2_max_frame_num_minus4,LOG2_MAX_FRAME_NUM_MINUS4 );WRITE_PPS (sps->max_num_ref_frames,MAX_NUM_REF_FRAMES );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 344/667 regulator: scmi: Fix refcount leak in scmi_regulator_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 68d6c8476fd4f448e70e0ab31ff972838ac41dae ]
of_find_node_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak.
--- drivers/regulator/scmi-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/scmi-regulator.c +1 -1
@@ -352,7 +352,7 @@ static int scmi_regulator_probe(struct scmi_device *sdev)return ret; } } - +of_node_put (np);/* * Register a regulator for each valid regulator-DT-entry that we * can successfully reach via SCMI and has a valid associated voltage
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 345/667 ext4: reject the commit option on ext2 filesystems
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
[ Upstream commit cb8435dc8ba33bcafa41cf2aa253794320a3b8df ]
The 'commit' option is only applicable for ext3 and ext4 filesystems, and has never been accepted by the ext2 filesystem driver, so the ext4 driver shouldn't allow it on ext2 filesystems.
This fixes a failure in xfstest ext4/053.
--- fs/ext4/super.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/super.c +1 -0
@@ -1934,6 +1934,7 @@ static const struct mount_opts { MOPT_EXT4_ONLY | MOPT_CLEAR}, {Opt_warn_on_error, EXT4_MOUNT_WARN_ON_ERROR, MOPT_SET}, {Opt_nowarn_on_error, EXT4_MOUNT_WARN_ON_ERROR, MOPT_CLEAR}, + {Opt_commit, 0, MOPT_NO_EXT2}, {Opt_nojournal_checksum, EXT4_MOUNT_JOURNAL_CHECKSUM, MOPT_EXT4_ONLY | MOPT_CLEAR}, {Opt_journal_checksum, EXT4_MOUNT_JOURNAL_CHECKSUM,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 346/667 drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit c56de483093d7ad0782327f95dda7da97bc4c315 ]
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore.
a6xx_gmu_init() passes the node to of_find_device_by_node() and of_dma_configure(), of_find_device_by_node() will takes its reference, of_dma_configure() doesn't need the node after usage.
Add missing of_node_put() to avoid refcount leak.
--- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/msm/adreno/a6xx_gpu.c +1 -0
@@ -1872,6 +1872,7 @@ struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)BUG_ON (!node); ret =a6xx_gmu_init (a6xx_gpu, node); +of_node_put (node);if (ret) {a6xx_destroy (&(a6xx_gpu->base.base));return ERR_PTR (ret);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 347/667 drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
In reply to Greg Kroah-HartmanFrom: Hangyu Hua <[email protected]>
[ Upstream commit 947a844bb3ebff0f4736d244d792ce129f6700d7 ]
drm_gem_object_lookup will call drm_gem_object_get inside. So cursor_bo needs to be put when msm_gem_get_and_pin_iova fails.
--- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +3 -1
@@ -989,8 +989,10 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc, ret =msm_gem_get_and_pin_iova (cursor_bo, kms->aspace, &mdp5_crtc->cursor.iova); -if (ret) +if (ret) { +drm_gem_object_put (cursor_bo);return -EINVAL ; + }pm_runtime_get_sync (&pdev->dev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 348/667 x86/sev: Annotate stack change in the #VC handler
In reply to Greg Kroah-HartmanFrom: Lai Jiangshan <[email protected]>
[ Upstream commit c42b145181aafd59ed31ccd879493389e3ea5a08 ]
In idtentry_vc(), vc_switch_off_ist() determines a safe stack to switch to, off of the IST stack. Annotate the new stack switch with ENCODE_FRAME_POINTER in case UNWINDER_FRAME_POINTER is used.
A stack walk before looks like this:
CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0-rc7+ #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl dump_stack kernel_exc_vmm_communication asm_exc_vmm_communication ? native_read_msr ? __x2apic_disable.part.0 ? x2apic_setup ? cpu_init ? trap_init ? start_kernel ? x86_64_start_reservations ? x86_64_start_kernel ? secondary_startup_64_no_verify </TASK>
and with the fix, the stack dump is exact:
CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0-rc7+ #3 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl dump_stack kernel_exc_vmm_communication asm_exc_vmm_communication RIP: 0010:native_read_msr Code: ... < snipped regs > ? __x2apic_disable.part.0 x2apic_setup cpu_init trap_init start_kernel x86_64_start_reservations x86_64_start_kernel secondary_startup_64_no_verify </TASK>
[ bp: Test in a SEV-ES guest and rewrite the commit message to
explain what exactly this does. ]
--- arch/x86/entry/entry_64.S | 1 + 1 file changed, 1 insertion(+)
arch/x86/entry/entry_64.S +1 -0
@@ -499,6 +499,7 @@ SYM_CODE_START(\asmsym) call vc_switch_off_ist movq %rax, %rsp /* Switch to new stack */ + ENCODE_FRAME_POINTER UNWIND_HINT_REGS /* Update pt_regs */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 349/667 drm/msm: dont free the IRQ if it was not requested
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 577e2a9dfc8fba7938aaf75db63fae7e328cc3cb ]
As msm_drm_uninit() is called from the msm_drm_init() error path, additional care should be necessary as not to call the free_irq() for the IRQ that was not requested before (because an error occured earlier than the request_irq() call).
This fixed the issue reported with the following backtrace:
[ 8.571329] Trying to free already-free IRQ 187 [ 8.571339] WARNING: CPU: 0 PID: 76 at kernel/irq/manage.c:1895 free_irq+0x1e0/0x35c [ 8.588746] Modules linked in: pmic_glink pdr_interface fastrpc qrtr_smd snd_soc_hdmi_codec msm fsa4480 gpu_sched drm_dp_aux_bus qrtr i2c_qcom_geni crct10dif_ce qcom_stats qcom_q6v5_pas drm_display_helper gpi qcom_pil_info drm_kms_helper qcom_q6v5 qcom_sysmon qcom_common qcom_glink_smem qcom_rng mdt_loader qmi_helpers phy_qcom_qmp ufs_qcom typec qnoc_sm8350 socinfo rmtfs_mem fuse drm ipv6 [ 8.624154] CPU: 0 PID: 76 Comm: kworker/u16:2 Not tainted 5.18.0-rc5-next-20220506-00033-g6cee8cab6089-dirty #419 [ 8.624161] Hardware name: Qualcomm Technologies, Inc. SM8350 HDK (DT) [ 8.641496] Workqueue: events_unbound deferred_probe_work_func [ 8.647510] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 8.654681] pc : free_irq+0x1e0/0x35c [ 8.658454] lr : free_irq+0x1e0/0x35c [ 8.662228] sp : ffff800008ab3950 [ 8.665642] x29: ffff800008ab3950 x28: 0000000000000000 x27: ffff16350f56a700 [ 8.672994] x26: ffff1635025df080 x25: ffff16350251badc x24: ffff16350251bb90 [ 8.680343] x23: 0000000000000000 x22: 00000000000000bb x21: ffff16350e8f9800 [ 8.687690] x20: ffff16350251ba00 x19: ffff16350cbd5880 x18: ffffffffffffffff [ 8.695039] x17: 0000000000000000 x16: ffffa2dd12179434 x15: ffffa2dd1431d02d [ 8.702391] x14: 0000000000000000 x13: ffffa2dd1431d028 x12: 662d79646165726c [ 8.709740] x11: ffffa2dd13fd2438 x10: 000000000000000a x9 : 00000000000000bb [ 8.717111] x8 : ffffa2dd13fd23f0 x7 : ffff800008ab3750 x6 : 00000000fffff202 [ 8.724487] x5 : ffff16377e870a18 x4 : 00000000fffff202 x3 : ffff735a6ae1b000 [ 8.731851] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff1635015f8000 [ 8.739217] Call trace: [ 8.741755] free_irq+0x1e0/0x35c [ 8.745198] msm_drm_uninit.isra.0+0x14c/0x294 [msm] [ 8.750548] msm_drm_bind+0x28c/0x5d0 [msm] [ 8.755081] try_to_bring_up_aggregate_device+0x164/0x1d0 [ 8.760657] __component_add+0xa0/0x170 [ 8.764626] component_add+0x14/0x20 [ 8.768337] dp_display_probe+0x2a4/0x464 [msm] [ 8.773242] platform_probe+0x68/0xe0 [ 8.777043] really_probe.part.0+0x9c/0x28c [ 8.781368] __driver_probe_device+0x98/0x144 [ 8.785871] driver_probe_device+0x40/0x140 [ 8.790191] __device_attach_driver+0xb4/0x120 [ 8.794788] bus_for_each_drv+0x78/0xd0 [ 8.798751] __device_attach+0xdc/0x184 [ 8.802713] device_initial_probe+0x14/0x20 [ 8.807031] bus_probe_device+0x9c/0xa4 [ 8.810991] deferred_probe_work_func+0x88/0xc0 [ 8.815667] process_one_work+0x1d0/0x320 [ 8.819809] worker_thread+0x14c/0x444 [ 8.823688] kthread+0x10c/0x110 [ 8.827036] ret_from_fork+0x10/0x20
Patchwork: https://patchwork.freedesktop.org/patch/485422/
--- drivers/gpu/drm/msm/msm_drv.c | 7 ++++++- drivers/gpu/drm/msm/msm_kms.h | 1 + 2 files changed, 7 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/msm_drv.c +6 -1
@@ -237,6 +237,8 @@ static int msm_irq_postinstall(struct drm_device *dev)static int msm_irq_install (struct drm_device *dev,unsigned int irq) { +struct msm_drm_private *priv = dev->dev_private; +struct msm_kms *kms = priv->kms;int ret;if (irq ==IRQ_NOTCONNECTED )
@@ -248,6 +250,8 @@ static int msm_irq_install(struct drm_device *dev, unsigned int irq)if (ret)return ret; + kms->irq_requested = true; + ret =msm_irq_postinstall (dev);if (ret) {free_irq (irq, dev);
@@ -263,7 +267,8 @@ static void msm_irq_uninstall(struct drm_device *dev)struct msm_kms *kms = priv->kms; kms->funcs->irq_uninstall (kms); -free_irq (kms->irq, dev); +if (kms->irq_requested) +free_irq (kms->irq, dev); }struct msm_vblank_work {
drivers/gpu/drm/msm/msm_kms.h +1 -0
@@ -149,6 +149,7 @@ struct msm_kms {/* irq number to be passed on to msm_irq_install */ int irq; +bool irq_requested;/* mapper-id used to request GEM buffer mapped for scanout: */ struct msm_gem_address_space *aspace;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 350/667 selftests/bpf: Add missed ima_setup.sh in Makefile
In reply to Greg Kroah-HartmanFrom: Hangbin Liu <[email protected]>
[ Upstream commit 70a1b25326dd77e145157ccf1a31c1948032eec4 ]
When build bpf test and install it to another folder, e.g.
make -j10 install -C tools/testing/selftests/ TARGETS="bpf" \
SKIP_TARGETS="" INSTALL_PATH=/tmp/kselftests
The ima_setup.sh is missed in target folder, which makes test_ima failed.
Fix it by adding ima_setup.sh to TEST_PROGS_EXTENDED.
--- tools/testing/selftests/bpf/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/Makefile +1 -1
@@ -78,7 +78,7 @@ TEST_PROGS := test_kmod.sh \ test_xsk.sh TEST_PROGS_EXTENDED := with_addr.sh \ - with_tunnels.sh \ + with_tunnels.sh ima_setup.sh \ test_xdp_vlan.sh test_bpftool.py # Compile but not part of 'make run_tests'
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 351/667 drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path
In reply to Greg Kroah-HartmanFrom: Abhinav Kumar <[email protected]>
[ Upstream commit 64b22a0da12adb571c01edd671ee43634ebd7e41 ]
If there are errors while trying to enable the pm in the bind path, it will lead to unclocked access of hw revision register thereby crashing the device.
This will not address why the pm_runtime_get_sync() fails but at the very least we should be able to prevent the crash by handling the error and bailing out earlier.
changes in v2:
- use pm_runtime_resume_and_get() instead of pm_runtime_get_sync()
Patchwork: https://patchwork.freedesktop.org/patch/486721/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +3 -1
@@ -1001,7 +1001,9 @@ static int dpu_kms_hw_init(struct msm_kms *kms)dpu_kms_parse_data_bus_icc_path (dpu_kms); -pm_runtime_get_sync (&dpu_kms->pdev->dev); + rc =pm_runtime_resume_and_get (&dpu_kms->pdev->dev); +if (rc <0 ) + goto error; dpu_kms->core_rev =readl_relaxed (dpu_kms->mmio +0x0 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 352/667 drm/i915: Fix CFI violation with show_dynamic_id()
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit 58606220a2f1407a7516c547f09a1ba7b4350a73 ]
When an attribute group is created with sysfs_create_group(), the ->sysfs_ops() callback is set to kobj_sysfs_ops, which sets the ->show() callback to kobj_attr_show(). kobj_attr_show() uses container_of() to get the ->show() callback from the attribute it was passed, meaning the ->show() callback needs to be the same type as the ->show() callback in 'struct kobj_attribute'.
However, show_dynamic_id() has the type of the ->show() callback in 'struct device_attribute', which causes a CFI violation when opening the 'id' sysfs node under drm/card0/metrics. This happens to work because the layout of 'struct kobj_attribute' and 'struct device_attribute' are the same, so the container_of() cast happens to allow the ->show() callback to still work.
Change the type of show_dynamic_id() to match the ->show() callback in 'struct kobj_attributes' and update the type of sysfs_metric_id to match, which resolves the CFI violation.
--- drivers/gpu/drm/i915/i915_perf.c | 4 ++-- drivers/gpu/drm/i915/i915_perf_types.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/i915_perf.c +2 -2
@@ -4008,8 +4008,8 @@ static struct i915_oa_reg *alloc_oa_regs(struct i915_perf *perf,return ERR_PTR (err); } -static ssize_t show_dynamic_id (struct device *dev, -struct device_attribute *attr, +static ssize_t show_dynamic_id (struct kobject *kobj, +struct kobj_attribute *attr,char *buf) { struct i915_oa_config *oa_config =
drivers/gpu/drm/i915/i915_perf_types.h +1 -1
@@ -55,7 +55,7 @@ struct i915_oa_config {struct attribute_group sysfs_metric;struct attribute *attrs[2 ]; -struct device_attribute sysfs_metric_id; +struct kobj_attribute sysfs_metric_id;struct kref ref;struct rcu_head rcu;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 353/667 thermal/drivers/bcm2711: Dont clamp temperature at zero
In reply to Greg Kroah-HartmanFrom: Stefan Wahren <[email protected]>
[ Upstream commit 106e0121e243de4da7d634338089a68a8da2abe9 ]
The thermal sensor on BCM2711 is capable of negative temperatures, so don't clamp the measurements at zero. Since this was the only use for variable t, drop it.
This change based on a patch by Dom Cobley, who also tested the fix.
--- drivers/thermal/broadcom/bcm2711_thermal.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/thermal/broadcom/bcm2711_thermal.c +1 -4
@@ -38,7 +38,6 @@ static int bcm2711_get_temp(void *data, int *temp)int offset =thermal_zone_get_offset (priv->thermal);u32 val;int ret; -long t; ret =regmap_read (priv->regmap,AVS_RO_TEMP_STATUS , &val);if (ret)
@@ -50,9 +49,7 @@ static int bcm2711_get_temp(void *data, int *temp) val &=AVS_RO_TEMP_STATUS_DATA_MSK ;/* Convert a HW code to a temperature reading (millidegree celsius) */ - t = slope * val + offset; - - *temp = t <0 ?0 : t; + *temp = slope * val + offset;return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 354/667 thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe
In reply to Greg Kroah-HartmanFrom: Zheng Yongjun <[email protected]>
[ Upstream commit e20d136ec7d6f309989c447638365840d3424c8e ]
platform_get_resource() may return NULL, add proper check to avoid potential NULL dereferencing.
--- drivers/thermal/broadcom/sr-thermal.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/thermal/broadcom/sr-thermal.c +3 -0
@@ -60,6 +60,9 @@ static int sr_thermal_probe(struct platform_device *pdev)return -ENOMEM ; res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); +if (!res) +return -ENOENT ; + sr_thermal->regs = (void __iomem *)devm_memremap (&pdev->dev, res->start,resource_size (res),MEMREMAP_WB );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 355/667 thermal/core: Fix memory leak in __thermal_cooling_device_register()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 98a160e898c0f4a979af9de3ab48b4b1d42d1dbb ]
I got memory leak as follows when doing fault injection test:
unreferenced object 0xffff888010080000 (size 264312):
comm "182", pid 102533, jiffies 4296434960 (age 10.100s) hex dump (first 32 bytes):
00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
ff ff ff ff ff ff ff ff 40 7f 1f b9 ff ff ff ff ........@.......
backtrace:
[<0000000038b2f4fc>] kmalloc_order_trace+0x1d/0x110 mm/slab_common.c:969
[<00000000ebcb8da5>] __kmalloc+0x373/0x420 include/linux/slab.h:510
[<0000000084137f13>] thermal_cooling_device_setup_sysfs+0x15d/0x2d0 include/linux/slab.h:586
[<00000000352b8755>] __thermal_cooling_device_register+0x332/0xa60 drivers/thermal/thermal_core.c:927
[<00000000fb9f331b>] devm_thermal_of_cooling_device_register+0x6b/0xf0 drivers/thermal/thermal_core.c:1041
[<000000009b8012d2>] max6650_probe.cold+0x557/0x6aa drivers/hwmon/max6650.c:211
[<00000000da0b7e04>] i2c_device_probe+0x472/0xac0 drivers/i2c/i2c-core-base.c:561If device_register() fails, thermal_cooling_device_destroy_sysfs() need be called to free the memory allocated in thermal_cooling_device_setup_sysfs().
--- drivers/thermal/thermal_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/thermal/thermal_core.c +1 -0
@@ -945,6 +945,7 @@ __thermal_cooling_device_register(struct device_node *np,return cdev; out_kfree_type: +thermal_cooling_device_destroy_sysfs (cdev);kfree (cdev->type);put_device (&cdev->device); cdev =NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 356/667 thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 09700c504d8e63faffd2a2235074e8c5d130cb8f ]
of_find_node_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak.
--- drivers/thermal/imx_sc_thermal.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/thermal/imx_sc_thermal.c +4 -2
@@ -94,8 +94,8 @@ static int imx_sc_thermal_probe(struct platform_device *pdev) sensor =devm_kzalloc (&pdev->dev,sizeof (*sensor),GFP_KERNEL );if (!sensor) {of_node_put (child); -of_node_put (sensor_np); -return -ENOMEM ; + ret = -ENOMEM ; + goto put_node; } ret = thermal_zone_of_get_sensor_id(child,
@@ -124,7 +124,9 @@ static int imx_sc_thermal_probe(struct platform_device *pdev)dev_warn (&pdev->dev,"failed to add hwmon sysfs attributes\n" ); } +put_node:of_node_put (sensor_np); +of_node_put (np);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 357/667 bfq: Relax waker detection for shared queues
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit f950667356ce90a41b446b726d4595a10cb65415 ]
Currently we look for waker only if current queue has no requests. This makes sense for bfq queues with a single process however for shared queues when there is a larger number of processes the condition that queue has no requests is difficult to meet because often at least one process has some request in flight although all the others are waiting for the waker to do the work and this harms throughput. Relax the "no queued request for bfq queue" condition to "the current task has no queued requests yet". For this, we also need to start tracking number of requests in flight for each task.
This patch (together with the following one) restores the performance for dbench with 128 clients that regressed with commit c65e6fd460b4 ("bfq: Do not let waker requests skip proper accounting") because this commit makes requests of wakers properly enter BFQ queues and thus these queues become ineligible for the old waker detection logic. Dbench results:
Vanilla 5.18-rc3 5.18-rc3 + revert 5.18-rc3 patched Mean 1237.36 ( 0.00%) 950.16 * 23.21%* 988.35 * 20.12%*
Numbers are time to complete workload so lower is better.
--- block/bfq-iosched.c | 5 +++-- block/bfq-iosched.h | 1 + 2 files changed, 4 insertions(+), 2 deletions(-)
block/bfq-iosched.c +3 -2
@@ -2022,7 +2022,6 @@ static void bfq_check_waker(struct bfq_data *bfqd, struct bfq_queue *bfqq,if (!bfqd->last_completed_rq_bfqq || bfqd->last_completed_rq_bfqq == bfqq ||bfq_bfqq_has_short_ttime (bfqq) || - bfqq->dispatched >0 || now_ns - bfqd->last_completion >=4 *NSEC_PER_MSEC || bfqd->last_completed_rq_bfqq == bfqq->waker_bfqq)return ;
@@ -2084,7 +2083,7 @@ static void bfq_add_request(struct request *rq) bfqq->queued[rq_is_sync (rq)]++; bfqd->queued++; -if (RB_EMPTY_ROOT (&bfqq->sort_list) &&bfq_bfqq_sync (bfqq)) { +if (bfq_bfqq_sync (bfqq) &&RQ_BIC (rq)->requests <=1 ) {bfq_check_waker (bfqd, bfqq, now_ns);/*
@@ -6422,6 +6421,7 @@ static void bfq_finish_requeue_request(struct request *rq)bfq_completed_request (bfqq, bfqd); }bfq_finish_requeue_request_body (bfqq); +RQ_BIC (rq)->requests--;spin_unlock_irqrestore (&bfqd->lock, flags);/*
@@ -6643,6 +6643,7 @@ static struct bfq_queue *bfq_init_rq(struct request *rq) bfqq->allocated++; bfqq->ref++; + bic->requests++;bfq_log_bfqq (bfqd, bfqq,"get_request %p: bfqq %p, %d" , rq, bfqq, bfqq->ref);
block/bfq-iosched.h +1 -0
@@ -466,6 +466,7 @@ struct bfq_io_cq {struct bfq_queue *stable_merge_bfqq;bool stably_merged;/* non splittable if true */ +unsigned int requests;/* Number of requests this process has in flight */ };/**
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 358/667 bfq: Allow current waker to defend against a tentative one
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit c5ac56bb6110e42e79d3106866658376b2e48ab9 ]
The code in bfq_check_waker() ignores wake up events from the current waker. This makes it more likely we select a new tentative waker although the current one is generating more wake up events. Treat current waker the same way as any other process and allow it to reset the waker detection logic.
--- block/bfq-iosched.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
block/bfq-iosched.c +1 -2
@@ -2022,8 +2022,7 @@ static void bfq_check_waker(struct bfq_data *bfqd, struct bfq_queue *bfqq,if (!bfqd->last_completed_rq_bfqq || bfqd->last_completed_rq_bfqq == bfqq ||bfq_bfqq_has_short_ttime (bfqq) || - now_ns - bfqd->last_completion >=4 *NSEC_PER_MSEC || - bfqd->last_completed_rq_bfqq == bfqq->waker_bfqq) + now_ns - bfqd->last_completion >=4 *NSEC_PER_MSEC )return ; if (bfqd->last_completed_rq_bfqq !=
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 359/667 ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit be2af740e2a9c7134f2d8ab4f104006e110b13de ]
Fix the missing clk_disable_unprepare() before return from wm2000_anc_transition() in the error handling case.
--- sound/soc/codecs/wm2000.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/soc/codecs/wm2000.c +3 -3
@@ -536,7 +536,7 @@ static int wm2000_anc_transition(struct wm2000_priv *wm2000, {struct i2c_client *i2c = wm2000->i2c;int i, j; -int ret; +int ret =0 ;if (wm2000->anc_mode == mode)return 0 ;
@@ -566,13 +566,13 @@ static int wm2000_anc_transition(struct wm2000_priv *wm2000, ret = anc_transitions[i].step[j](i2c, anc_transitions[i].analogue);if (ret !=0 ) -return ret; +break ; }if (anc_transitions[i].dest ==ANC_OFF )clk_disable_unprepare (wm2000->mclk); -return 0 ; +return ret; }static int wm2000_anc_set_mode (struct wm2000_priv *wm2000)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 360/667 PM: domains: Fix initialization of genpds next_wakeup
In reply to Greg Kroah-HartmanFrom: Ulf Hansson <[email protected]>
[ Upstream commit 622d9b5577f19a6472db21df042fea8f5fefe244 ]
In the genpd governor we walk the list of child-domains to take into account their next_wakeup. If the child-domain itself, doesn't have a governor assigned to it, we can end up using the next_wakeup value before it has been properly initialized. To prevent a possible incorrect behaviour in the governor, let's initialize next_wakeup to KTIME_MAX.
--- drivers/base/power/domain.c | 1 + 1 file changed, 1 insertion(+)
drivers/base/power/domain.c +1 -0
@@ -1978,6 +1978,7 @@ int pm_genpd_init(struct generic_pm_domain *genpd, genpd->device_count =0 ; genpd->max_off_time_ns =-1 ; genpd->max_off_time_changed = true; + genpd->next_wakeup =KTIME_MAX ; genpd->provider =NULL ; genpd->has_provider = false; genpd->accounting_time =ktime_get ();
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 361/667 net: macb: Fix PTP one step sync support
In reply to Greg Kroah-HartmanFrom: Harini Katakam <[email protected]>
[ Upstream commit 5cebb40bc9554aafcc492431181f43c6231b0459 ]
PTP one step sync packets cannot have CSUM padding and insertion in SW since time stamp is inserted on the fly by HW.
In addition, ptp4l version 3.0 and above report an error when skb timestamps are reported for packets that not processed for TX TS after transmission.
Add a helper to identify PTP one step sync and fix the above two errors. Add a common mask for PTP header flag field "twoStepflag". Also reset ptp OSS bit when one step is not selected.
--- drivers/net/ethernet/cadence/macb_main.c | 40 +++++++++++++++++++++--- drivers/net/ethernet/cadence/macb_ptp.c | 4 ++- include/linux/ptp_classify.h | 3 ++ 3 files changed, 42 insertions(+), 5 deletions(-)
drivers/net/ethernet/cadence/macb_main.c +36 -4
@@ -35,6 +35,7 @@#include <linux/tcp.h> #include <linux/iopoll.h> #include <linux/pm_runtime.h> +#include <linux/ptp_classify.h> #include "macb.h" /* This structure is only used for MACB on SiFive FU540 devices */
@@ -1155,6 +1156,36 @@ static void macb_tx_error_task(struct work_struct *work)spin_unlock_irqrestore (&bp->lock, flags); } +static bool ptp_one_step_sync (struct sk_buff *skb) +{ +struct ptp_header *hdr; +unsigned int ptp_class; +u8 msgtype; + +/* No need to parse packet if PTP TS is not involved */ +if (likely (!(skb_shinfo (skb)->tx_flags &SKBTX_HW_TSTAMP ))) + goto not_oss; + +/* Identify and return whether PTP one step sync is being processed */ + ptp_class =ptp_classify_raw (skb); +if (ptp_class ==PTP_CLASS_NONE ) + goto not_oss; + + hdr =ptp_parse_header (skb, ptp_class); +if (!hdr) + goto not_oss; + +if (hdr->flag_field[0 ] &PTP_FLAG_TWOSTEP ) + goto not_oss; + + msgtype =ptp_get_msgtype (hdr, ptp_class); +if (msgtype ==PTP_MSGTYPE_SYNC ) +return true; + +not_oss: +return false; +} +static void macb_tx_interrupt (struct macb_queue *queue) {unsigned int tail;
@@ -1199,8 +1230,8 @@ static void macb_tx_interrupt(struct macb_queue *queue)/* First, update TX stats if needed */ if (skb) { -if (unlikely (skb_shinfo (skb)->tx_flags & -SKBTX_HW_TSTAMP ) && +if (unlikely (skb_shinfo (skb)->tx_flags &SKBTX_HW_TSTAMP ) && + !ptp_one_step_sync (skb) &&gem_ptp_do_txstamp (queue, skb, desc) ==0 ) {/* skb now belongs to timestamp buffer * and will be removed later
@@ -2030,7 +2061,8 @@ static unsigned int macb_tx_map(struct macb *bp, ctrl |=MACB_BF (TX_LSO , lso_ctrl); ctrl |=MACB_BF (TX_TCP_SEQ_SRC , seq_ctrl);if ((bp->dev->features &NETIF_F_HW_CSUM ) && - skb->ip_summed !=CHECKSUM_PARTIAL && !lso_ctrl) + skb->ip_summed !=CHECKSUM_PARTIAL && !lso_ctrl && + !ptp_one_step_sync (skb)) ctrl |=MACB_BIT (TX_NOCRC ); }else /* Only set MSS/MFS on payload descriptors
@@ -2128,7 +2160,7 @@ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev)if (!(ndev->features &NETIF_F_HW_CSUM ) || !((*skb)->ip_summed !=CHECKSUM_PARTIAL ) || -skb_shinfo (*skb)->gso_size)/* Not available for GSO */ +skb_shinfo (*skb)->gso_size ||ptp_one_step_sync (*skb))return 0 ;if (padlen <=0 ) {
drivers/net/ethernet/cadence/macb_ptp.c +3 -1
@@ -469,8 +469,10 @@ int gem_set_hwtst(struct net_device *dev, struct ifreq *ifr, int cmd)case HWTSTAMP_TX_ONESTEP_SYNC :if (gem_ptp_set_one_step_sync (bp,1 ) !=0 )return -ERANGE ; - fallthrough; + tx_bd_control =TSTAMP_ALL_FRAMES ; +break ;case HWTSTAMP_TX_ON : +gem_ptp_set_one_step_sync (bp,0 ); tx_bd_control =TSTAMP_ALL_FRAMES ;break ;default :
include/linux/ptp_classify.h +3 -0
@@ -42,6 +42,9 @@#define OFF_PTP_SOURCE_UUID 22/* PTPv1 only */ #define OFF_PTP_SEQUENCE_ID 30 +/* PTP header flag fields */ +#define PTP_FLAG_TWOSTEP BIT(1) +/* Below defines should actually be removed at some point in time. */ #define IP6_HLEN 40#define UDP_HLEN 8
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 362/667 NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx
In reply to Greg Kroah-HartmanFrom: Duoming Zhou <[email protected]>
[ Upstream commit b413b0cb008646e9f24ce5253cb3cf7ee217aff6 ]
There are sleep in atomic context bugs when the request to secure element of st21nfca is timeout. The root cause is that kzalloc and alloc_skb with GFP_KERNEL parameter and mutex_lock are called in st21nfca_se_wt_timeout which is a timer handler. The call tree shows the execution paths that could lead to bugs:
(Interrupt context)st21nfca_se_wt_timeout
nfc_hci_send_event
nfc_hci_hcp_message_tx
kzalloc(..., GFP_KERNEL) //may sleep
alloc_skb(..., GFP_KERNEL) //may sleep
mutex_lock() //may sleep
This patch moves the operations that may sleep into a work item. The work item will run in another kernel thread which is in process context to execute the bottom half of the interrupt. So it could prevent atomic context from sleeping.
--- drivers/nfc/st21nfca/se.c | 17 ++++++++++++++--- drivers/nfc/st21nfca/st21nfca.h | 1 + 2 files changed, 15 insertions(+), 3 deletions(-)
drivers/nfc/st21nfca/se.c +14 -3
@@ -241,7 +241,7 @@ int st21nfca_hci_se_io(struct nfc_hci_dev *hdev, u32 se_idx, }EXPORT_SYMBOL (st21nfca_hci_se_io); -static void st21nfca_se_wt_timeout (struct timer_list *t) +static void st21nfca_se_wt_work (struct work_struct *work) {/* * No answer from the secure element
@@ -254,8 +254,9 @@ static void st21nfca_se_wt_timeout(struct timer_list *t)*/ /* hardware reset managed through VCC_UICC_OUT power supply */ u8 param =0x01 ; -struct st21nfca_hci_info *info =from_timer (info, t, - se_info.bwi_timer); +struct st21nfca_hci_info *info =container_of (work, + struct st21nfca_hci_info, + se_info.timeout_work);pr_debug ("\n" );
@@ -273,6 +274,13 @@ static void st21nfca_se_wt_timeout(struct timer_list *t) info->se_info.cb (info->se_info.cb_context,NULL ,0 , -ETIME ); } +static void st21nfca_se_wt_timeout (struct timer_list *t) +{ +struct st21nfca_hci_info *info =from_timer (info, t, se_info.bwi_timer); + +schedule_work (&info->se_info.timeout_work); +} +static void st21nfca_se_activation_timeout (struct timer_list *t) { struct st21nfca_hci_info *info = from_timer(info, t,
@@ -364,6 +372,7 @@ int st21nfca_apdu_reader_event_received(struct nfc_hci_dev *hdev,switch (event) {case ST21NFCA_EVT_TRANSMIT_DATA :del_timer_sync (&info->se_info.bwi_timer); +cancel_work_sync (&info->se_info.timeout_work); info->se_info.bwi_active = false; r =nfc_hci_send_event (hdev,ST21NFCA_DEVICE_MGNT_GATE ,ST21NFCA_EVT_SE_END_OF_APDU_TRANSFER ,NULL ,0 );
@@ -393,6 +402,7 @@ void st21nfca_se_init(struct nfc_hci_dev *hdev)struct st21nfca_hci_info *info =nfc_hci_get_clientdata (hdev);init_completion (&info->se_info.req_completion); +INIT_WORK (&info->se_info.timeout_work, st21nfca_se_wt_work);/* initialize timers */ timer_setup (&info->se_info.bwi_timer, st21nfca_se_wt_timeout,0 ); info->se_info.bwi_active = false;
@@ -420,6 +430,7 @@ void st21nfca_se_deinit(struct nfc_hci_dev *hdev)if (info->se_info.se_active)del_timer_sync (&info->se_info.se_active_timer); +cancel_work_sync (&info->se_info.timeout_work); info->se_info.bwi_active = false; info->se_info.se_active = false; }
drivers/nfc/st21nfca/st21nfca.h +1 -0
@@ -141,6 +141,7 @@ struct st21nfca_se_info {se_io_cb_t cb;void *cb_context; +struct work_struct timeout_work; };struct st21nfca_hci_info {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 363/667 ASoC: max98090: Move check for invalid values before casting in max98090_put_enab_tlv()
In reply to Greg Kroah-HartmanFrom: Alexey Khoroshilov <[email protected]>
[ Upstream commit f7a344468105ef8c54086dfdc800e6f5a8417d3e ]
Validation of signed input should be done before casting to unsigned int.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- sound/soc/codecs/max98090.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/soc/codecs/max98090.c +4 -2
@@ -393,7 +393,8 @@ static int max98090_put_enab_tlv(struct snd_kcontrol *kcontrol,struct soc_mixer_control *mc = (struct soc_mixer_control *)kcontrol->private_value;unsigned int mask = (1 <<fls (mc->max)) -1 ; -unsigned int sel = ucontrol->value.integer.value[0 ]; +int sel_unchecked = ucontrol->value.integer.value[0 ]; +unsigned int sel;unsigned int val =snd_soc_component_read (component, mc->reg);unsigned int *select;
@@ -413,8 +414,9 @@ static int max98090_put_enab_tlv(struct snd_kcontrol *kcontrol, val = (val >> mc->shift) & mask; -if (sel <0 || sel > mc->max) +if (sel_unchecked <0 || sel_unchecked > mc->max)return -EINVAL ; + sel = sel_unchecked; *select = sel;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 364/667 net: stmmac: selftests: Use kcalloc() instead of kzalloc()
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
[ Upstream commit 36371876e000012ae4440fcf3097c2f0ed0f83e7 ]
Use 2-factor multiplication argument form kcalloc() instead of kzalloc().
--- drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c +2 -2
@@ -1104,13 +1104,13 @@ static int stmmac_test_rxp(struct stmmac_priv *priv) goto cleanup_sel; } - actions =kzalloc (nk *sizeof (*actions),GFP_KERNEL ); + actions =kcalloc (nk,sizeof (*actions),GFP_KERNEL );if (!actions) { ret = -ENOMEM ; goto cleanup_exts; } - act =kzalloc (nk *sizeof (*act),GFP_KERNEL ); + act =kcalloc (nk,sizeof (*act),GFP_KERNEL );if (!act) { ret = -ENOMEM ; goto cleanup_actions;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 365/667 net: stmmac: fix out-of-bounds access in a selftest
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit fe5c5fc145edcf98a759b895f52b646730eeb7be ]
GCC 12 points out that struct tc_action is smaller than struct tcf_action:
drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c: In function ‘stmmac_test_rxp’:drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c:1132:21: warning: array subscript ‘struct tcf_gact[0]’ is partly outside array bounds of ‘unsigned char[272]’ [-Warray-bounds]
1132 | gact->tcf_action = TC_ACT_SHOT;
| ^~
--- .../net/ethernet/stmicro/stmmac/stmmac_selftests.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c +6 -7
@@ -1084,8 +1084,9 @@ static int stmmac_test_rxp(struct stmmac_priv *priv)unsigned char addr[ETH_ALEN ] = {0xde ,0xad ,0xbe ,0xef ,0x00 ,0x00 };struct tc_cls_u32_offload cls_u32 = { };struct stmmac_packet_attrs attr = { }; -struct tc_action **actions, *act; +struct tc_action **actions;struct tc_u32_sel *sel; +struct tcf_gact *gact;struct tcf_exts *exts;int ret, i, nk =1 ;
@@ -1110,8 +1111,8 @@ static int stmmac_test_rxp(struct stmmac_priv *priv) goto cleanup_exts; } - act =kcalloc (nk,sizeof (*act),GFP_KERNEL ); -if (!act) { + gact =kcalloc (nk,sizeof (*gact),GFP_KERNEL ); +if (!gact) { ret = -ENOMEM ; goto cleanup_actions; }
@@ -1126,9 +1127,7 @@ static int stmmac_test_rxp(struct stmmac_priv *priv) exts->nr_actions = nk; exts->actions = actions;for (i =0 ; i < nk; i++) { -struct tcf_gact *gact =to_gact (&act[i]); - - actions[i] = &act[i]; + actions[i] = (struct tc_action *)&gact[i]; gact->tcf_action =TC_ACT_SHOT ; }
@@ -1152,7 +1151,7 @@ static int stmmac_test_rxp(struct stmmac_priv *priv)stmmac_tc_setup_cls_u32 (priv, priv, &cls_u32); cleanup_act: -kfree (act); +kfree (gact); cleanup_actions:kfree (actions); cleanup_exts:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 366/667 hv_netvsc: Fix potential dereference of NULL pointer
In reply to Greg Kroah-HartmanFrom: Yongzhi Liu <[email protected]>
[ Upstream commit eb4c0788964730d12e8dd520bd8f5217ca48321c ]
The return value of netvsc_devinfo_get()
needs to be checked to avoid use of NULL
pointer in case of an allocation failure.
--- drivers/net/hyperv/netvsc_drv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/hyperv/netvsc_drv.c +4 -1
@@ -2665,7 +2665,10 @@ static int netvsc_suspend(struct hv_device *dev)/* Save the current config info */ ndev_ctx->saved_netvsc_dev_info =netvsc_devinfo_get (nvdev); - +if (!ndev_ctx->saved_netvsc_dev_info) { + ret = -ENOMEM ; + goto out; + } ret =netvsc_detach (net, nvdev); out:rtnl_unlock ();
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 367/667 hwmon: (pmbus) Check PEC support before reading other registers
In reply to Greg Kroah-HartmanFrom: Adam Wujek <[email protected]>
[ Upstream commit d1baf7a3a3177d46a7149858beddb88a9eca7a54 ]
Make sure that the support of PEC is determined before the read of other registers. Otherwise the validation of PEC can trigger an error on the read of STATUS_BYTE or STATUS_WORD registers.
The problematic scenario is the following. A device with enabled PEC support is up and running and a kernel driver is loaded. Then the driver is unloaded (or device unbound), the HW device is reconfigured externally (e.g. by i2cset) to advertise itself as not supporting PEC. Without the move of the code, at the second load of the driver (or bind) the STATUS_BYTE or STATUS_WORD register is always read with PEC enabled, which is likely to cause a read error resulting with fail of a driver load (or bind).
--- drivers/hwmon/pmbus/pmbus_core.c | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-)
drivers/hwmon/pmbus/pmbus_core.c +15 -13
@@ -2308,6 +2308,21 @@ static int pmbus_init_common(struct i2c_client *client, struct pmbus_data *data,struct device *dev = &client->dev;int page, ret; +/* +* Figure out if PEC is enabled before accessing any other register. +* Make sure PEC is disabled, will be enabled later if needed. +*/ + client->flags &= ~I2C_CLIENT_PEC ; + +/* Enable PEC if the controller and bus supports it */ +if (!(data->flags &PMBUS_NO_CAPABILITY )) { + ret =i2c_smbus_read_byte_data (client,PMBUS_CAPABILITY ); +if (ret >=0 && (ret &PB_CAPABILITY_ERROR_CHECK )) { +if (i2c_check_functionality (client->adapter,I2C_FUNC_SMBUS_PEC )) + client->flags |=I2C_CLIENT_PEC ; + } + } +/* * Some PMBus chips don't support PMBUS_STATUS_WORD, so try * to use PMBUS_STATUS_BYTE instead if that is the case.
@@ -2326,19 +2341,6 @@ static int pmbus_init_common(struct i2c_client *client, struct pmbus_data *data, data->has_status_word = true; } -/* Make sure PEC is disabled, will be enabled later if needed */ - client->flags &= ~I2C_CLIENT_PEC ; - -/* Enable PEC if the controller and bus supports it */ -if (!(data->flags &PMBUS_NO_CAPABILITY )) { - ret =i2c_smbus_read_byte_data (client,PMBUS_CAPABILITY ); -if (ret >=0 && (ret &PB_CAPABILITY_ERROR_CHECK )) { -if (i2c_check_functionality (client->adapter,I2C_FUNC_SMBUS_PEC )) { - client->flags |=I2C_CLIENT_PEC ; - } - } - } -/* * Check if the chip is write protected. If it is, we can not clear * faults, and we should not try it. Also, in that case, writes into
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 368/667 rxrpc: Fix listen() setting the bar too high for the prealloc rings
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 88e22159750b0d55793302eeed8ee603f5c1a95c ]
AF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump up the sysctl), but whilst the preallocation circular buffers have 32 slots in them, one of them has to be a dead slot because we're using CIRC_CNT().
This means that listen(rxrpc_sock, 32) will cause an oops when the socket is closed because rxrpc_service_prealloc_one() allocated one too many calls and rxrpc_discard_prealloc() won't then be able to get rid of them because it'll think the ring is empty. rxrpc_release_calls_on_socket() then tries to abort them, but oopses because call->peer isn't yet set.
Fix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match the ring capacity.
BUG: kernel NULL pointer dereference, address: 0000000000000086 ... RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc] Call Trace: <TASK> ? __wake_up_common_lock+0x7a/0x90 ? rxrpc_notify_socket+0x8e/0x140 [rxrpc] ? rxrpc_abort_call+0x4c/0x60 [rxrpc] rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc] rxrpc_release+0xc9/0x1c0 [rxrpc] __sock_release+0x37/0xa0 sock_close+0x11/0x20 __fput+0x89/0x240 task_work_run+0x59/0x90 do_exit+0x319/0xaa0
--- net/rxrpc/sysctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/rxrpc/sysctl.c +2 -2
@@ -12,7 +12,7 @@static struct ctl_table_header *rxrpc_sysctl_reg_table;static const unsigned int four =4 ; -static const unsigned int thirtytwo =32 ; +static const unsigned int max_backlog =RXRPC_BACKLOG_MAX -1 ;static const unsigned int n_65535 =65535 ;static const unsigned int n_max_acks =RXRPC_RXTX_BUFF_SIZE -1 ;static const unsigned long one_jiffy =1 ;
@@ -89,7 +89,7 @@ static struct ctl_table rxrpc_sysctl_table[] = { .mode = 0644, .proc_handler = proc_dointvec_minmax, .extra1 = (void *)&four, - .extra2 = (void *)&thirtytwo, + .extra2 = (void *)&max_backlog, }, { .procname = "rx_window_size",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 369/667 rxrpc: Dont try to resend the request if were receiving the reply
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 114af61f88fbe34d641b13922d098ffec4c1be1b ]
rxrpc has a timer to trigger resending of unacked data packets in a call. This is not cancelled when a client call switches to the receive phase on the basis that most calls don't last long enough for it to ever expire. However, if it *does* expire after we've started to receive the reply, we shouldn't then go into trying to retransmit or pinging the server to find out if an ack got lost.
Fix this by skipping the resend code if we're into receiving the reply to a client call.
--- net/rxrpc/call_event.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/rxrpc/call_event.c +2 -1
@@ -406,7 +406,8 @@ void rxrpc_process_call(struct work_struct *work) goto recheck_state; } -if (test_and_clear_bit (RXRPC_CALL_EV_RESEND , &call->events)) { +if (test_and_clear_bit (RXRPC_CALL_EV_RESEND , &call->events) && + call->state !=RXRPC_CALL_CLIENT_RECV_REPLY ) {rxrpc_resend (call, now); goto recheck_state; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 370/667 rxrpc: Fix overlapping ACK accounting
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 8940ba3cfe4841928777fd45eaa92051522c7f0c ]
Fix accidental overlapping of Rx-phase ACK accounting with Tx-phase ACK accounting through variables shared between the two. call->acks_* members refer to ACKs received in the Tx phase and call->ackr_* members to ACKs sent/to be sent during the Rx phase.
--- net/rxrpc/ar-internal.h | 7 ++++--- net/rxrpc/input.c | 16 ++++++++-------- 2 files changed, 12 insertions(+), 11 deletions(-)
net/rxrpc/ar-internal.h +4 -3
@@ -676,10 +676,9 @@ struct rxrpc_call {spinlock_t input_lock;/* Lock for packet input to this call */ -/* receive-phase ACK management */ +/* Receive-phase ACK management (ACKs we send). */ u8 ackr_reason;/* reason to ACK */ rxrpc_serial_t ackr_serial;/* serial of packet being ACK'd */ -rxrpc_serial_t ackr_first_seq;/* first sequence number received */ rxrpc_seq_t ackr_prev_seq;/* previous sequence number received */ rxrpc_seq_t ackr_consumed;/* Highest packet shown consumed */ rxrpc_seq_t ackr_seen;/* Highest packet shown seen */
@@ -692,8 +691,10 @@ struct rxrpc_call {#define RXRPC_CALL_RTT_AVAIL_MASK 0xf#define RXRPC_CALL_RTT_PEND_SHIFT 8 -/* transmission-phase ACK management */ +/* Transmission-phase ACK management (ACKs we've received). */ ktime_t acks_latest_ts;/* Timestamp of latest ACK received */ +rxrpc_seq_t acks_first_seq;/* first sequence number received */ +rxrpc_seq_t acks_prev_seq;/* previous sequence number received */ rxrpc_seq_t acks_lowest_nak;/* Lowest NACK in the buffer (or ==tx_hard_ack) */ rxrpc_seq_t acks_lost_top;/* tx_top at the time lost-ack ping sent */ rxrpc_serial_t acks_lost_ping;/* Serial number of probe ACK */
net/rxrpc/input.c +8 -8
@@ -812,7 +812,7 @@ static void rxrpc_input_soft_acks(struct rxrpc_call *call, u8 *acks,static bool rxrpc_is_ack_valid (struct rxrpc_call *call,rxrpc_seq_t first_pkt,rxrpc_seq_t prev_pkt) { -rxrpc_seq_t base =READ_ONCE (call->ackr_first_seq); +rxrpc_seq_t base =READ_ONCE (call->acks_first_seq);if (after (first_pkt, base))return true;/* The window advanced */
@@ -820,7 +820,7 @@ static bool rxrpc_is_ack_valid(struct rxrpc_call *call,if (before (first_pkt, base))return false;/* firstPacket regressed */ -if (after_eq (prev_pkt, call->ackr_prev_seq)) +if (after_eq (prev_pkt, call->acks_prev_seq))return true;/* previousPacket hasn't regressed. */ /* Some rx implementations put a serial number in previousPacket. */
@@ -933,8 +933,8 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb)/* Discard any out-of-order or duplicate ACKs (outside lock). */ if (!rxrpc_is_ack_valid (call, first_soft_ack, prev_pkt)) {trace_rxrpc_rx_discard_ack (call->debug_id, ack_serial, - first_soft_ack, call->ackr_first_seq, - prev_pkt, call->ackr_prev_seq); + first_soft_ack, call->acks_first_seq, + prev_pkt, call->acks_prev_seq);return ; }
@@ -949,14 +949,14 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb)/* Discard any out-of-order or duplicate ACKs (inside lock). */ if (!rxrpc_is_ack_valid (call, first_soft_ack, prev_pkt)) {trace_rxrpc_rx_discard_ack (call->debug_id, ack_serial, - first_soft_ack, call->ackr_first_seq, - prev_pkt, call->ackr_prev_seq); + first_soft_ack, call->acks_first_seq, + prev_pkt, call->acks_prev_seq); goto out; } call->acks_latest_ts = skb->tstamp; - call->ackr_first_seq = first_soft_ack; - call->ackr_prev_seq = prev_pkt; + call->acks_first_seq = first_soft_ack; + call->acks_prev_seq = prev_pkt;/* Parse rwind and mtu sizes if provided. */ if (buf.info.rxMTU)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 371/667 rxrpc: Dont let ack.previousPacket regress
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 81524b6312535897707f2942695da1d359a5e56b ]
The previousPacket field in the rx ACK packet should never go backwards - it's now the highest DATA sequence number received, not the last on received (it used to be used for out of sequence detection).
--- net/rxrpc/ar-internal.h | 4 ++-- net/rxrpc/input.c | 4 +++- net/rxrpc/output.c | 2 +- 3 files changed, 6 insertions(+), 4 deletions(-)
net/rxrpc/ar-internal.h +2 -2
@@ -679,7 +679,7 @@ struct rxrpc_call {/* Receive-phase ACK management (ACKs we send). */ u8 ackr_reason;/* reason to ACK */ rxrpc_serial_t ackr_serial;/* serial of packet being ACK'd */ -rxrpc_seq_t ackr_prev_seq;/* previous sequence number received */ +rxrpc_seq_t ackr_highest_seq;/* Higest sequence number received */ rxrpc_seq_t ackr_consumed;/* Highest packet shown consumed */ rxrpc_seq_t ackr_seen;/* Highest packet shown seen */
@@ -694,7 +694,7 @@ struct rxrpc_call {/* Transmission-phase ACK management (ACKs we've received). */ ktime_t acks_latest_ts;/* Timestamp of latest ACK received */ rxrpc_seq_t acks_first_seq;/* first sequence number received */ -rxrpc_seq_t acks_prev_seq;/* previous sequence number received */ +rxrpc_seq_t acks_prev_seq;/* Highest previousPacket received */ rxrpc_seq_t acks_lowest_nak;/* Lowest NACK in the buffer (or ==tx_hard_ack) */ rxrpc_seq_t acks_lost_top;/* tx_top at the time lost-ack ping sent */ rxrpc_serial_t acks_lost_ping;/* Serial number of probe ACK */
net/rxrpc/input.c +3 -1
@@ -453,7 +453,6 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb) !rxrpc_receiving_reply(call)) goto unlock; - call->ackr_prev_seq = seq0; hard_ack =READ_ONCE (call->rx_hard_ack); nr_subpackets = sp->nr_subpackets;
@@ -534,6 +533,9 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb) ack_serial = serial; } +if (after (seq0, call->ackr_highest_seq)) + call->ackr_highest_seq = seq0; +/* Queue the packet. We use a couple of memory barriers here as need * to make sure that rx_top is perceived to be set after the buffer * pointer and that the buffer pointer is set after the annotation and
net/rxrpc/output.c +1 -1
@@ -89,7 +89,7 @@ static size_t rxrpc_fill_out_ack(struct rxrpc_connection *conn, pkt->ack.bufferSpace =htons (8 ); pkt->ack.maxSkew =htons (0 ); pkt->ack.firstPacket =htonl (hard_ack +1 ); - pkt->ack.previousPacket =htonl (call->ackr_prev_seq); + pkt->ack.previousPacket =htonl (call->ackr_highest_seq); pkt->ack.serial =htonl (serial); pkt->ack.reason = reason; pkt->ack.nAcks = top - hard_ack;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 372/667 rxrpc: Fix decision on when to generate an IDLE ACK
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 9a3dedcf18096e8f7f22b8777d78c4acfdea1651 ]
Fix the decision on when to generate an IDLE ACK by keeping a count of the number of packets we've received, but not yet soft-ACK'd, and the number of packets we've processed, but not yet hard-ACK'd, rather than trying to keep track of which DATA sequence numbers correspond to those points.
We then generate an ACK when either counter exceeds 2. The counters are both cleared when we transcribe the information into any sort of ACK packet for transmission. IDLE and DELAY ACKs are skipped if both counters are 0 (ie. no change).
--- include/trace/events/rxrpc.h | 2 +- net/rxrpc/ar-internal.h | 4 ++-- net/rxrpc/input.c | 11 +++++++++-- net/rxrpc/output.c | 18 +++++++++++------- net/rxrpc/recvmsg.c | 8 +++----- 5 files changed, 26 insertions(+), 17 deletions(-)
include/trace/events/rxrpc.h +1 -1
@@ -1509,7 +1509,7 @@ TRACE_EVENT(rxrpc_call_reset, __entry->call_serial = call->rx_serial; __entry->conn_serial = call->conn->hi_serial; __entry->tx_seq = call->tx_hard_ack; - __entry->rx_seq = call->ackr_seen; + __entry->rx_seq = call->rx_hard_ack; ), TP_printk("c=%08x %08x:%08x r=%08x/%08x tx=%08x rx=%08x",
net/rxrpc/ar-internal.h +2 -2
@@ -680,8 +680,8 @@ struct rxrpc_call {u8 ackr_reason;/* reason to ACK */ rxrpc_serial_t ackr_serial;/* serial of packet being ACK'd */ rxrpc_seq_t ackr_highest_seq;/* Higest sequence number received */ -rxrpc_seq_t ackr_consumed;/* Highest packet shown consumed */ -rxrpc_seq_t ackr_seen;/* Highest packet shown seen */ +atomic_t ackr_nr_unacked;/* Number of unacked packets */ +atomic_t ackr_nr_consumed;/* Number of packets needing hard ACK */ /* RTT management */ rxrpc_serial_t rtt_serial[4 ];/* Serial number of DATA or PING sent */
net/rxrpc/input.c +9 -2
@@ -412,8 +412,8 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb) {struct rxrpc_skb_priv *sp =rxrpc_skb (skb);enum rxrpc_call_state state; -unsigned int j, nr_subpackets; -rxrpc_serial_t serial = sp->hdr.serial, ack_serial =0 ; +unsigned int j, nr_subpackets, nr_unacked =0 ; +rxrpc_serial_t serial = sp->hdr.serial, ack_serial = serial;rxrpc_seq_t seq0 = sp->hdr.seq, hard_ack;bool immediate_ack = false, jumbo_bad = false;u8 ack =0 ;
@@ -569,6 +569,8 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb) sp =NULL ; } + nr_unacked++; +if (last) {set_bit (RXRPC_CALL_RX_LAST , &call->flags);if (!ack) {
@@ -588,9 +590,14 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb) } call->rx_expect_next = seq +1 ; } +if (!ack) + ack_serial = serial; } ack: +if (atomic_add_return (nr_unacked, &call->ackr_nr_unacked) >2 && !ack) + ack =RXRPC_ACK_IDLE ; +if (ack) rxrpc_propose_ACK(call, ack, ack_serial, immediate_ack, true,
net/rxrpc/output.c +11 -7
@@ -74,11 +74,18 @@ static size_t rxrpc_fill_out_ack(struct rxrpc_connection *conn, u8 reason) {rxrpc_serial_t serial; +unsigned int tmp;rxrpc_seq_t hard_ack, top, seq;int ix;u32 mtu, jmax;u8 *ackp = pkt->acks; + tmp =atomic_xchg (&call->ackr_nr_unacked,0 ); + tmp |=atomic_xchg (&call->ackr_nr_consumed,0 ); +if (!tmp && (reason ==RXRPC_ACK_DELAY || + reason ==RXRPC_ACK_IDLE )) +return 0 ; +/* Barrier against rxrpc_input_data(). */ serial = call->ackr_serial; hard_ack =READ_ONCE (call->rx_hard_ack);
@@ -223,6 +230,10 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping, n =rxrpc_fill_out_ack (conn, call, pkt, &hard_ack, &top, reason);spin_unlock_bh (&call->lock); +if (n ==0 ) { +kfree (pkt); +return 0 ; + } iov[0 ].iov_base = pkt; iov[0 ].iov_len =sizeof (pkt->whdr) +sizeof (pkt->ack) + n;
@@ -259,13 +270,6 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping,ntohl (pkt->ack.serial), false, true, rxrpc_propose_ack_retry_tx); - }else { -spin_lock_bh (&call->lock); -if (after (hard_ack, call->ackr_consumed)) - call->ackr_consumed = hard_ack; -if (after (top, call->ackr_seen)) - call->ackr_seen = top; -spin_unlock_bh (&call->lock); }rxrpc_set_keepalive (call);
net/rxrpc/recvmsg.c +3 -5
@@ -260,11 +260,9 @@ static void rxrpc_rotate_rx_window(struct rxrpc_call *call)rxrpc_end_rx_phase (call, serial); }else {/* Check to see if there's an ACK that needs sending. */ -if (after_eq (hard_ack, call->ackr_consumed +2 ) || -after_eq (top, call->ackr_seen +2 ) || - (hard_ack == top &&after (hard_ack, call->ackr_consumed))) -rxrpc_propose_ACK (call,RXRPC_ACK_DELAY , serial, - true, true, +if (atomic_inc_return (&call->ackr_nr_consumed) >2 ) +rxrpc_propose_ACK (call,RXRPC_ACK_IDLE , serial, + true, false, rxrpc_propose_ack_rotate_rx);if (call->ackr_reason && call->ackr_reason !=RXRPC_ACK_DELAY )rxrpc_send_ack_packet (call, false,NULL );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 373/667 net: huawei: hinic: Use devm_kcalloc() instead of devm_kzalloc()
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
[ Upstream commit 9d922f5df53844228b9f7c62f2593f4f06c0b69b ]
Use 2-factor multiplication argument form devm_kcalloc() instead of devm_kzalloc().
--- .../ethernet/huawei/hinic/hinic_hw_api_cmd.c | 5 ++-- .../net/ethernet/huawei/hinic/hinic_hw_cmdq.c | 10 ++++---- .../net/ethernet/huawei/hinic/hinic_hw_dev.c | 5 ++-- .../net/ethernet/huawei/hinic/hinic_hw_eqs.c | 9 ++++---- .../net/ethernet/huawei/hinic/hinic_hw_wq.c | 23 +++++++++---------- .../net/ethernet/huawei/hinic/hinic_main.c | 10 ++++---- drivers/net/ethernet/huawei/hinic/hinic_tx.c | 9 ++++---- 7 files changed, 31 insertions(+), 40 deletions(-)
drivers/net/ethernet/huawei/hinic/hinic_hw_api_cmd.c +2 -3
@@ -814,7 +814,6 @@ static int api_chain_init(struct hinic_api_cmd_chain *chain, {struct hinic_hwif *hwif = attr->hwif;struct pci_dev *pdev = hwif->pdev; -size_t cell_ctxt_size; chain->hwif = hwif; chain->chain_type = attr->chain_type;
@@ -826,8 +825,8 @@ static int api_chain_init(struct hinic_api_cmd_chain *chain,sema_init (&chain->sem,1 ); - cell_ctxt_size = chain->num_cells *sizeof (*chain->cell_ctxt); - chain->cell_ctxt =devm_kzalloc (&pdev->dev, cell_ctxt_size,GFP_KERNEL ); + chain->cell_ctxt =devm_kcalloc (&pdev->dev, chain->num_cells, +sizeof (*chain->cell_ctxt),GFP_KERNEL );if (!chain->cell_ctxt)return -ENOMEM ;
drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c +4 -6
@@ -796,11 +796,10 @@ static int init_cmdqs_ctxt(struct hinic_hwdev *hwdev,struct hinic_cmdq_ctxt *cmdq_ctxts;struct pci_dev *pdev = hwif->pdev;struct hinic_pfhwdev *pfhwdev; -size_t cmdq_ctxts_size;int err; - cmdq_ctxts_size =HINIC_MAX_CMDQ_TYPES *sizeof (*cmdq_ctxts); - cmdq_ctxts =devm_kzalloc (&pdev->dev, cmdq_ctxts_size,GFP_KERNEL ); + cmdq_ctxts =devm_kcalloc (&pdev->dev,HINIC_MAX_CMDQ_TYPES , +sizeof (*cmdq_ctxts),GFP_KERNEL );if (!cmdq_ctxts)return -ENOMEM ;
@@ -884,7 +883,6 @@ int hinic_init_cmdqs(struct hinic_cmdqs *cmdqs, struct hinic_hwif *hwif,struct hinic_func_to_io *func_to_io =cmdqs_to_func_to_io (cmdqs);struct pci_dev *pdev = hwif->pdev;struct hinic_hwdev *hwdev; -size_t saved_wqs_size;u16 max_wqe_size;int err;
@@ -895,8 +893,8 @@ int hinic_init_cmdqs(struct hinic_cmdqs *cmdqs, struct hinic_hwif *hwif,if (!cmdqs->cmdq_buf_pool)return -ENOMEM ; - saved_wqs_size =HINIC_MAX_CMDQ_TYPES *sizeof (struct hinic_wq ); - cmdqs->saved_wqs =devm_kzalloc (&pdev->dev, saved_wqs_size,GFP_KERNEL ); + cmdqs->saved_wqs =devm_kcalloc (&pdev->dev,HINIC_MAX_CMDQ_TYPES , +sizeof (*cmdqs->saved_wqs),GFP_KERNEL );if (!cmdqs->saved_wqs) { err = -ENOMEM ; goto err_saved_wqs;
drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c +2 -3
@@ -162,7 +162,6 @@ static int init_msix(struct hinic_hwdev *hwdev)struct hinic_hwif *hwif = hwdev->hwif;struct pci_dev *pdev = hwif->pdev;int nr_irqs, num_aeqs, num_ceqs; -size_t msix_entries_size;int i, err; num_aeqs =HINIC_HWIF_NUM_AEQS (hwif);
@@ -171,8 +170,8 @@ static int init_msix(struct hinic_hwdev *hwdev)if (nr_irqs >HINIC_HWIF_NUM_IRQS (hwif)) nr_irqs =HINIC_HWIF_NUM_IRQS (hwif); - msix_entries_size = nr_irqs *sizeof (*hwdev->msix_entries); - hwdev->msix_entries =devm_kzalloc (&pdev->dev, msix_entries_size, + hwdev->msix_entries =devm_kcalloc (&pdev->dev, nr_irqs, +sizeof (*hwdev->msix_entries),GFP_KERNEL );if (!hwdev->msix_entries)return -ENOMEM ;
drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.c +4 -5
@@ -631,16 +631,15 @@ static int alloc_eq_pages(struct hinic_eq *eq)struct hinic_hwif *hwif = eq->hwif;struct pci_dev *pdev = hwif->pdev;u32 init_val, addr, val; -size_t addr_size;int err, pg; - addr_size = eq->num_pages *sizeof (*eq->dma_addr); - eq->dma_addr =devm_kzalloc (&pdev->dev, addr_size,GFP_KERNEL ); + eq->dma_addr =devm_kcalloc (&pdev->dev, eq->num_pages, +sizeof (*eq->dma_addr),GFP_KERNEL );if (!eq->dma_addr)return -ENOMEM ; - addr_size = eq->num_pages *sizeof (*eq->virt_addr); - eq->virt_addr =devm_kzalloc (&pdev->dev, addr_size,GFP_KERNEL ); + eq->virt_addr =devm_kcalloc (&pdev->dev, eq->num_pages, +sizeof (*eq->virt_addr),GFP_KERNEL );if (!eq->virt_addr) { err = -ENOMEM ; goto err_virt_addr_alloc;
drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c +11 -12
@@ -193,20 +193,20 @@ static int alloc_page_arrays(struct hinic_wqs *wqs) {struct hinic_hwif *hwif = wqs->hwif;struct pci_dev *pdev = hwif->pdev; -size_t size; - size = wqs->num_pages *sizeof (*wqs->page_paddr); - wqs->page_paddr =devm_kzalloc (&pdev->dev, size,GFP_KERNEL ); + wqs->page_paddr =devm_kcalloc (&pdev->dev, wqs->num_pages, +sizeof (*wqs->page_paddr),GFP_KERNEL );if (!wqs->page_paddr)return -ENOMEM ; - size = wqs->num_pages *sizeof (*wqs->page_vaddr); - wqs->page_vaddr =devm_kzalloc (&pdev->dev, size,GFP_KERNEL ); + wqs->page_vaddr =devm_kcalloc (&pdev->dev, wqs->num_pages, +sizeof (*wqs->page_vaddr),GFP_KERNEL );if (!wqs->page_vaddr) goto err_page_vaddr; - size = wqs->num_pages *sizeof (*wqs->shadow_page_vaddr); - wqs->shadow_page_vaddr =devm_kzalloc (&pdev->dev, size,GFP_KERNEL ); + wqs->shadow_page_vaddr =devm_kcalloc (&pdev->dev, wqs->num_pages, +sizeof (*wqs->shadow_page_vaddr), +GFP_KERNEL );if (!wqs->shadow_page_vaddr) goto err_page_shadow_vaddr;
@@ -379,15 +379,14 @@ static int alloc_wqes_shadow(struct hinic_wq *wq) {struct hinic_hwif *hwif = wq->hwif;struct pci_dev *pdev = hwif->pdev; -size_t size; - size = wq->num_q_pages * wq->max_wqe_size; - wq->shadow_wqe =devm_kzalloc (&pdev->dev, size,GFP_KERNEL ); + wq->shadow_wqe =devm_kcalloc (&pdev->dev, wq->num_q_pages, + wq->max_wqe_size,GFP_KERNEL );if (!wq->shadow_wqe)return -ENOMEM ; - size = wq->num_q_pages *sizeof (wq->prod_idx); - wq->shadow_idx =devm_kzalloc (&pdev->dev, size,GFP_KERNEL ); + wq->shadow_idx =devm_kcalloc (&pdev->dev, wq->num_q_pages, +sizeof (wq->prod_idx),GFP_KERNEL );if (!wq->shadow_idx) goto err_shadow_idx;
drivers/net/ethernet/huawei/hinic/hinic_main.c +4 -6
@@ -144,13 +144,12 @@ static int create_txqs(struct hinic_dev *nic_dev) {int err, i, j, num_txqs =hinic_hwdev_num_qps (nic_dev->hwdev);struct net_device *netdev = nic_dev->netdev; -size_t txq_size;if (nic_dev->txqs)return -EINVAL ; - txq_size = num_txqs *sizeof (*nic_dev->txqs); - nic_dev->txqs =devm_kzalloc (&netdev->dev, txq_size,GFP_KERNEL ); + nic_dev->txqs =devm_kcalloc (&netdev->dev, num_txqs, +sizeof (*nic_dev->txqs),GFP_KERNEL );if (!nic_dev->txqs)return -ENOMEM ;
@@ -241,13 +240,12 @@ static int create_rxqs(struct hinic_dev *nic_dev) {int err, i, j, num_rxqs =hinic_hwdev_num_qps (nic_dev->hwdev);struct net_device *netdev = nic_dev->netdev; -size_t rxq_size;if (nic_dev->rxqs)return -EINVAL ; - rxq_size = num_rxqs *sizeof (*nic_dev->rxqs); - nic_dev->rxqs =devm_kzalloc (&netdev->dev, rxq_size,GFP_KERNEL ); + nic_dev->rxqs =devm_kcalloc (&netdev->dev, num_rxqs, +sizeof (*nic_dev->rxqs),GFP_KERNEL );if (!nic_dev->rxqs)return -ENOMEM ;
drivers/net/ethernet/huawei/hinic/hinic_tx.c +4 -5
@@ -862,7 +862,6 @@ int hinic_init_txq(struct hinic_txq *txq, struct hinic_sq *sq,struct hinic_dev *nic_dev =netdev_priv (netdev);struct hinic_hwdev *hwdev = nic_dev->hwdev;int err, irqname_len; -size_t sges_size; txq->netdev = netdev; txq->sq = sq;
@@ -871,13 +870,13 @@ int hinic_init_txq(struct hinic_txq *txq, struct hinic_sq *sq, txq->max_sges =HINIC_MAX_SQ_BUFDESCS ; - sges_size = txq->max_sges *sizeof (*txq->sges); - txq->sges =devm_kzalloc (&netdev->dev, sges_size,GFP_KERNEL ); + txq->sges =devm_kcalloc (&netdev->dev, txq->max_sges, +sizeof (*txq->sges),GFP_KERNEL );if (!txq->sges)return -ENOMEM ; - sges_size = txq->max_sges *sizeof (*txq->free_sges); - txq->free_sges =devm_kzalloc (&netdev->dev, sges_size,GFP_KERNEL ); + txq->free_sges =devm_kcalloc (&netdev->dev, txq->max_sges, +sizeof (*txq->free_sges),GFP_KERNEL );if (!txq->free_sges) { err = -ENOMEM ; goto err_alloc_free_sges;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 374/667 hinic: Avoid some over memory allocation
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 15d221d0c345b76947911a3ac91897ffe2f1cc4e ]
'prod_idx' (atomic_t) is larger than 'shadow_idx' (u16), so some memory is over-allocated.
--- drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c +1 -1
@@ -386,7 +386,7 @@ static int alloc_wqes_shadow(struct hinic_wq *wq)return -ENOMEM ; wq->shadow_idx =devm_kcalloc (&pdev->dev, wq->num_q_pages, -sizeof (wq->prod_idx),GFP_KERNEL ); +sizeof (*wq->shadow_idx),GFP_KERNEL );if (!wq->shadow_idx) goto err_shadow_idx;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 375/667 net: dsa: restrict SMSC_LAN9303_I2C kconfig
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 0a3ad7d323686fbaae8688326cc5ea0d185c6fca ]
Since kconfig 'select' does not follow dependency chains, if symbol KSA selects KSB, then KSA should also depend on the same symbols that KSB depends on, in order to prevent Kconfig warnings and possible build errors.
Change NET_DSA_SMSC_LAN9303_I2C and NET_DSA_SMSC_LAN9303_MDIO so that they are limited to VLAN_8021Q if the latter is enabled. This prevents the Kconfig warning:
WARNING: unmet direct dependencies detected for NET_DSA_SMSC_LAN9303
Depends on [m]: NETDEVICES [=y] && NET_DSA [=y] && (VLAN_8021Q [=m] || VLAN_8021Q [=m]=n) Selected by [y]:
- NET_DSA_SMSC_LAN9303_I2C [=y] && NETDEVICES [=y] && NET_DSA [=y] && I2C [=y]
--- drivers/net/dsa/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/dsa/Kconfig +2 -1
@@ -81,7 +81,6 @@ config NET_DSA_REALTEK_SMI config NET_DSA_SMSC_LAN9303 tristate - depends on VLAN_8021Q || VLAN_8021Q=n select NET_DSA_TAG_LAN9303 select REGMAP help
@@ -91,6 +90,7 @@ config NET_DSA_SMSC_LAN9303 config NET_DSA_SMSC_LAN9303_I2C tristate "SMSC/Microchip LAN9303 3-ports 10/100 ethernet switch in I2C managed mode" depends on I2C + depends on VLAN_8021Q || VLAN_8021Q=n select NET_DSA_SMSC_LAN9303 select REGMAP_I2C help
@@ -100,6 +100,7 @@ config NET_DSA_SMSC_LAN9303_I2C config NET_DSA_SMSC_LAN9303_MDIO tristate "SMSC/Microchip LAN9303 3-ports 10/100 ethernet switch in MDIO managed mode" select NET_DSA_SMSC_LAN9303 + depends on VLAN_8021Q || VLAN_8021Q=n help Enable access functions if the SMSC/Microchip LAN9303 is configured for MDIO managed mode.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 376/667 net/smc: postpone sk_refcnt increment in connect()
In reply to Greg Kroah-HartmanFrom: liuyacan <[email protected]>
[ Upstream commit 75c1edf23b95a9c66923d9269d8e86e4dbde151f ]
Same trigger condition as commit 86434744. When setsockopt runs in parallel to a connect(), and switch the socket into fallback mode. Then the sk_refcnt is incremented in smc_connect(), but its state stay in SMC_INIT (NOT SMC_ACTIVE). This cause the corresponding sk_refcnt decrement in __smc_release() will not be performed.
--- net/smc/af_smc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/smc/af_smc.c +1 -1
@@ -1283,9 +1283,9 @@ static int smc_connect(struct socket *sock, struct sockaddr *addr,if (rc && rc != -EINPROGRESS ) goto out; -sock_hold (&smc->sk);/* sock put in passive closing */ if (smc->use_fallback) goto out; +sock_hold (&smc->sk);/* sock put in passive closing */ if (flags &O_NONBLOCK ) {if (queue_work (smc_hs_wq, &smc->connect_work)) smc->connect_nonblock =1 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 377/667 dma-direct: factor out dma_set_{de,en}crypted helpers
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 4d0564785bb03841e4b5c5b31aa4ecd1eb0d01bb ]
Factor out helpers the make dealing with memory encryption a little less cumbersome.
--- kernel/dma/direct.c | 56 ++++++++++++++++++++------------------------- 1 file changed, 25 insertions(+), 31 deletions(-)
kernel/dma/direct.c +25 -31
@@ -75,6 +75,20 @@ static bool dma_coherent_ok(struct device *dev, phys_addr_t phys, size_t size)min_not_zero (dev->coherent_dma_mask, dev->bus_dma_limit); } +static int dma_set_decrypted (struct device *dev,void *vaddr,size_t size) +{ +if (!force_dma_unencrypted (dev)) +return 0 ; +return set_memory_decrypted ((unsigned long )vaddr,1 <<get_order (size)); +} + +static int dma_set_encrypted (struct device *dev,void *vaddr,size_t size) +{ +if (!force_dma_unencrypted (dev)) +return 0 ; +return set_memory_encrypted ((unsigned long )vaddr,1 <<get_order (size)); +} +static void __dma_direct_free_pages (struct device *dev,struct page *page,size_t size) {
@@ -175,7 +189,6 @@ void *dma_direct_alloc(struct device *dev, size_t size, {struct page *page;void *ret; -int err; size =PAGE_ALIGN (size);if (attrs &DMA_ATTR_NO_WARN )
@@ -228,12 +241,8 @@ void *dma_direct_alloc(struct device *dev, size_t size, __builtin_return_address(0));if (!ret) goto out_free_pages; -if (force_dma_unencrypted (dev)) { - err =set_memory_decrypted ((unsigned long )ret, -1 <<get_order (size)); -if (err) - goto out_free_pages; - } +if (dma_set_decrypted (dev, ret, size)) + goto out_free_pages;memset (ret,0 , size); goto done; }
@@ -250,13 +259,8 @@ void *dma_direct_alloc(struct device *dev, size_t size, } ret =page_address (page); -if (force_dma_unencrypted (dev)) { - err =set_memory_decrypted ((unsigned long )ret, -1 <<get_order (size)); -if (err) - goto out_free_pages; - } - +if (dma_set_decrypted (dev, ret, size)) + goto out_free_pages;memset (ret,0 , size); if (IS_ENABLED(CONFIG_ARCH_HAS_DMA_SET_UNCACHED) &&
@@ -271,13 +275,9 @@ void *dma_direct_alloc(struct device *dev, size_t size,return ret; out_encrypt_pages: -if (force_dma_unencrypted (dev)) { - err =set_memory_encrypted ((unsigned long )page_address (page), -1 <<get_order (size)); -/* If memory cannot be re-encrypted, it must be leaked */ -if (err) -return NULL ; - } +/* If memory cannot be re-encrypted, it must be leaked */ +if (dma_set_encrypted (dev,page_address (page), size)) +return NULL ; out_free_pages:__dma_direct_free_pages (dev, page, size);return NULL ;
@@ -316,8 +316,7 @@ void dma_direct_free(struct device *dev, size_t size, dma_free_from_pool(dev, cpu_addr, PAGE_ALIGN(size))) return; -if (force_dma_unencrypted (dev)) -set_memory_encrypted ((unsigned long )cpu_addr,1 << page_order); +dma_set_encrypted (dev, cpu_addr,1 << page_order);if (IS_ENABLED (CONFIG_DMA_REMAP ) &&is_vmalloc_addr (cpu_addr))vunmap (cpu_addr);
@@ -343,11 +342,8 @@ struct page *dma_direct_alloc_pages(struct device *dev, size_t size,return NULL ; ret =page_address (page); -if (force_dma_unencrypted (dev)) { -if (set_memory_decrypted ((unsigned long )ret, -1 <<get_order (size))) - goto out_free_pages; - } +if (dma_set_decrypted (dev, ret, size)) + goto out_free_pages;memset (ret,0 , size); *dma_handle =phys_to_dma_direct (dev,page_to_phys (page));return page;
@@ -368,9 +364,7 @@ void dma_direct_free_pages(struct device *dev, size_t size, dma_free_from_pool(dev, vaddr, size))return ; -if (force_dma_unencrypted (dev)) -set_memory_encrypted ((unsigned long )vaddr,1 << page_order); - +dma_set_encrypted (dev, vaddr,1 << page_order);__dma_direct_free_pages (dev, page, size); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 378/667 dma-direct: dont call dma_set_decrypted for remapped allocations
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 5570449b6876f215d49ac4db9ccce6ff7aa1e20a ]
Remapped allocations handle the encrypted bit through the pgprot passed to vmap, so there is no call dma_set_decrypted. Note that this case is currently entirely theoretical as no valid kernel configuration supports remapped allocations and memory encryption currently.
--- kernel/dma/direct.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
kernel/dma/direct.c +6 -7
@@ -241,8 +241,6 @@ void *dma_direct_alloc(struct device *dev, size_t size, __builtin_return_address(0));if (!ret) goto out_free_pages; -if (dma_set_decrypted (dev, ret, size)) - goto out_free_pages;memset (ret,0 , size); goto done; }
@@ -316,12 +314,13 @@ void dma_direct_free(struct device *dev, size_t size, dma_free_from_pool(dev, cpu_addr, PAGE_ALIGN(size))) return; -dma_set_encrypted (dev, cpu_addr,1 << page_order); - -if (IS_ENABLED (CONFIG_DMA_REMAP ) &&is_vmalloc_addr (cpu_addr)) +if (IS_ENABLED (CONFIG_DMA_REMAP ) &&is_vmalloc_addr (cpu_addr)) {vunmap (cpu_addr); -else if (IS_ENABLED (CONFIG_ARCH_HAS_DMA_CLEAR_UNCACHED )) -arch_dma_clear_uncached (cpu_addr, size); + }else { +if (IS_ENABLED (CONFIG_ARCH_HAS_DMA_CLEAR_UNCACHED )) +arch_dma_clear_uncached (cpu_addr, size); +dma_set_encrypted (dev, cpu_addr,1 << page_order); + }__dma_direct_free_pages (dev,dma_direct_to_page (dev, dma_addr), size); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 379/667 dma-direct: always leak memory that cant be re-encrypted
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit a90cf30437489343b8386ae87b4827b6d6c3ed50 ]
We must never let unencrypted memory go back into the general page pool. So if we fail to set it back to encrypted when freeing DMA memory, leak the memory instead and warn the user.
--- kernel/dma/direct.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
kernel/dma/direct.c +10 -4
@@ -84,9 +84,14 @@ static int dma_set_decrypted(struct device *dev, void *vaddr, size_t size)static int dma_set_encrypted (struct device *dev,void *vaddr,size_t size) { +int ret; +if (!force_dma_unencrypted (dev))return 0 ; -return set_memory_encrypted ((unsigned long )vaddr,1 <<get_order (size)); + ret =set_memory_encrypted ((unsigned long )vaddr,1 <<get_order (size)); +if (ret) +pr_warn_ratelimited ("leaking DMA memory that can't be re-encrypted\n" ); +return ret; } static void __dma_direct_free_pages(struct device *dev, struct page *page,
@@ -273,7 +278,6 @@ void *dma_direct_alloc(struct device *dev, size_t size,return ret; out_encrypt_pages: -/* If memory cannot be re-encrypted, it must be leaked */ if (dma_set_encrypted (dev,page_address (page), size))return NULL ; out_free_pages:
@@ -319,7 +323,8 @@ void dma_direct_free(struct device *dev, size_t size, }else {if (IS_ENABLED (CONFIG_ARCH_HAS_DMA_CLEAR_UNCACHED ))arch_dma_clear_uncached (cpu_addr, size); -dma_set_encrypted (dev, cpu_addr,1 << page_order); +if (dma_set_encrypted (dev, cpu_addr,1 << page_order)) +return ; }__dma_direct_free_pages (dev,dma_direct_to_page (dev, dma_addr), size);
@@ -363,7 +368,8 @@ void dma_direct_free_pages(struct device *dev, size_t size, dma_free_from_pool(dev, vaddr, size))return ; -dma_set_encrypted (dev, vaddr,1 << page_order); +if (dma_set_encrypted (dev, vaddr,1 << page_order)) +return ;__dma_direct_free_pages (dev, page, size); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 380/667 dma-direct: dont over-decrypt memory
In reply to Greg Kroah-HartmanFrom: Robin Murphy <[email protected]>
[ Upstream commit 4a37f3dd9a83186cb88d44808ab35b78375082c9 ]
The original x86 sev_alloc() only called set_memory_decrypted() on memory returned by alloc_pages_node(), so the page order calculation fell out of that logic. However, the common dma-direct code has several potential allocators, not all of which are guaranteed to round up the underlying allocation to a power-of-two size, so carrying over that calculation for the encryption/decryption size was a mistake. Fix it by rounding to a *number* of pages, rather than an order.
Until recently there was an even worse interaction with DMA_DIRECT_REMAP where we could have ended up decrypting part of the next adjacent vmalloc area, only averted by no architecture actually supporting both configs at once. Don't ask how I found that one out...
--- kernel/dma/direct.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/dma/direct.c +2 -2
@@ -79,7 +79,7 @@ static int dma_set_decrypted(struct device *dev, void *vaddr, size_t size) {if (!force_dma_unencrypted (dev))return 0 ; -return set_memory_decrypted ((unsigned long )vaddr,1 <<get_order (size)); +return set_memory_decrypted ((unsigned long )vaddr,PFN_UP (size)); }static int dma_set_encrypted (struct device *dev,void *vaddr,size_t size)
@@ -88,7 +88,7 @@ static int dma_set_encrypted(struct device *dev, void *vaddr, size_t size)if (!force_dma_unencrypted (dev))return 0 ; - ret =set_memory_encrypted ((unsigned long )vaddr,1 <<get_order (size)); + ret =set_memory_encrypted ((unsigned long )vaddr,PFN_UP (size));if (ret)pr_warn_ratelimited ("leaking DMA memory that can't be re-encrypted\n" );return ret;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 381/667 arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399
In reply to Greg Kroah-HartmanFrom: Shawn Lin <[email protected]>
[ Upstream commit 4246d0bab2a8685e3d4aec2cb0ef8c526689ce96 ]
drive-impedance-ohm is introduced for emmc phy instead of pcie phy.
--- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3399.dtsi +1 -1
@@ -1477,6 +1477,7 @@ reg = <0xf780 0x24>; clocks = <&sdhci>; clock-names = "emmcclk"; + drive-impedance-ohm = <50>; #phy-cells = <0>; status = "disabled"; };
@@ -1487,7 +1488,6 @@ clock-names = "refclk"; #phy-cells = <1>; resets = <&cru SRST_PCIEPHY>; - drive-impedance-ohm = <50>; reset-names = "phy"; status = "disabled"; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 382/667 arm64: dts: mt8192: Fix nor_flash status disable typo
In reply to Greg Kroah-HartmanFrom: Allen-KH Cheng <[email protected]>
[ Upstream commit 27f0eb16b0d417c155e96b5d3b89074699944e09 ]
Correct nor_flash status disable typo of mt8192 SoC.
--- arch/arm64/boot/dts/mediatek/mt8192.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt8192.dtsi +1 -1
@@ -433,7 +433,7 @@ clock-names = "spi", "sf", "axi"; #address-cells = <1>; #size-cells = <0>; - status = "disable"; + status = "disabled"; }; i2c3: i2c3@11cb0000 {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 383/667 PCI/ACPI: Allow D3 only if Root Port can signal and wake from D3
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
[ Upstream commit dff6139015dc68e93be3822a7bd406a1d138628b ]
acpi_pci_bridge_d3(dev) returns "true" if "dev" is a hotplug bridge that can handle hotplug events while in D3. Previously this meant either:
- "dev" has a _PS0 or _PR0 method (acpi_pci_power_manageable()), or
- The Root Port above "dev" has a _DSD with a "HotPlugSupportInD3" property with value 1.
This did not consider _PRW, which tells us about wakeup GPEs (ACPI v6.4, sec 7.3.13). Without a wakeup GPE, from an ACPI perspective the Root Port has no way of generating wakeup signals, so hotplug events will be lost if we use D3.
Similarly, it did not consider _S0W, which tells us the deepest D-state from which a device can wake itself (sec 7.3.20). If _S0W tells us the device cannot wake from D3, hotplug events will again be lost if we use D3.
Some platforms, e.g., AMD Yellow Carp, supply "HotPlugSupportInD3" without _PRW or with an _S0W that says the Root Port cannot wake from D3. On those platforms, we previously put bridges in D3hot, hotplug events were lost, and hotplugged devices would not be recognized without manually rescanning.
Allow bridges to be put in D3 only if the Root Port can generate wakeup GPEs (wakeup.flags.valid), it can wake from D3 (_S0W), AND it has the "HotPlugSupportInD3" property.
Neither Windows 10 nor Windows 11 puts the bridge in D3 when the firmware is configured this way, and this change aligns the handling of the situation to be the same.
--- drivers/pci/pci-acpi.c | 41 ++++++++++++++++++++++++++++++----------- 1 file changed, 30 insertions(+), 11 deletions(-)
drivers/pci/pci-acpi.c +30 -11
@@ -976,9 +976,11 @@ static bool acpi_pci_power_manageable(struct pci_dev *dev)static bool acpi_pci_bridge_d3 (struct pci_dev *dev) { -const union acpi_object *obj; -struct acpi_device *adev;struct pci_dev *rpdev; +struct acpi_device *adev; +acpi_status status; +unsigned long long state; +const union acpi_object *obj;if (!dev->is_hotplug_bridge)return false;
@@ -987,12 +989,6 @@ static bool acpi_pci_bridge_d3(struct pci_dev *dev)if (acpi_pci_power_manageable (dev))return true; -/* -* The ACPI firmware will provide the device-specific properties through -* _DSD configuration object. Look for the 'HotPlugSupportInD3' property -* for the root port and if it is set we know the hierarchy behind it -* supports D3 just fine. -*/ rpdev =pcie_find_root_port (dev);if (!rpdev)return false;
@@ -1001,11 +997,34 @@ static bool acpi_pci_bridge_d3(struct pci_dev *dev)if (!adev)return false; -if (acpi_dev_get_property (adev,"HotPlugSupportInD3" , -ACPI_TYPE_INTEGER , &obj) <0 ) +/* +* If the Root Port cannot signal wakeup signals at all, i.e., it +* doesn't supply a wakeup GPE via _PRW, it cannot signal hotplug +* events from low-power states including D3hot and D3cold. +*/ +if (!adev->wakeup.flags.valid)return false; -return obj->integer.value ==1 ; +/* +* If the Root Port cannot wake itself from D3hot or D3cold, we +* can't use D3. +*/ + status =acpi_evaluate_integer (adev->handle,"_S0W" ,NULL , &state); +if (ACPI_SUCCESS (status) && state <ACPI_STATE_D3_HOT ) +return false; + +/* +* The "HotPlugSupportInD3" property in a Root Port _DSD indicates +* the Port can signal hotplug events while in D3. We assume any +* bridges *below* that Root Port can also signal hotplug events +* while in D3. +*/ +if (!acpi_dev_get_property (adev,"HotPlugSupportInD3" , +ACPI_TYPE_INTEGER , &obj) && + obj->integer.value ==1 ) +return true; + +return false; }static int acpi_pci_set_power_state (struct pci_dev *dev,pci_power_t state)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 384/667 memory: samsung: exynos5422-dmc: Avoid some over memory allocation
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 56653827f0d7bc7c2d8bac0e119fd1521fa9990a ]
'dmc->counter' is a 'struct devfreq_event_dev **', so there is some over memory allocation. 'counters_size' should be computed with 'sizeof(struct devfreq_event_dev *)'.
Use 'sizeof(*dmc->counter)' instead to fix it.
While at it, use devm_kcalloc() instead of devm_kzalloc()+open coded multiplication.
--- drivers/memory/samsung/exynos5422-dmc.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/memory/samsung/exynos5422-dmc.c +2 -3
@@ -1322,7 +1322,6 @@ static int exynos5_dmc_init_clks(struct exynos5_dmc *dmc)*/ static int exynos5_performance_counters_init (struct exynos5_dmc *dmc) { -int counters_size;int ret, i; dmc->num_counters = devfreq_event_get_edev_count(dmc->dev,
@@ -1332,8 +1331,8 @@ static int exynos5_performance_counters_init(struct exynos5_dmc *dmc)return dmc->num_counters; } - counters_size =sizeof (struct devfreq_event_dev ) * dmc->num_counters; - dmc->counter =devm_kzalloc (dmc->dev, counters_size,GFP_KERNEL ); + dmc->counter =devm_kcalloc (dmc->dev, dmc->num_counters, +sizeof (*dmc->counter),GFP_KERNEL );if (!dmc->counter)return -ENOMEM ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 385/667 ARM: dts: BCM5301X: update CRU block description
In reply to Greg Kroah-HartmanFrom: Rafał Miłecki <[email protected]>
[ Upstream commit 31fd9b79dc580301c53a001482755ba7e88c2809 ]
This describes CRU in a way matching documentation and fixes:
arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dt.yaml: cru@100: $nodename:0: 'cru@100' does not match '^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$'
From schema: /lib/python3.6/site-packages/dtschema/schemas/simple-bus.yaml
--- arch/arm/boot/dts/bcm5301x.dtsi | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
arch/arm/boot/dts/bcm5301x.dtsi +9 -4
@@ -423,14 +423,14 @@ #address-cells = <1>; #size-cells = <1>; - cru@100 { - compatible = "simple-bus"; + cru-bus@100 { + compatible = "brcm,ns-cru", "simple-mfd"; reg = <0x100 0x1a4>; ranges; #address-cells = <1>; #size-cells = <1>; - lcpll0: lcpll0@100 { + lcpll0: clock-controller@100 { #clock-cells = <1>; compatible = "brcm,nsp-lcpll0"; reg = <0x100 0x14>;
@@ -439,7 +439,7 @@ "sdio", "ddr_phy"; }; - genpll: genpll@140 { + genpll: clock-controller@140 { #clock-cells = <1>; compatible = "brcm,nsp-genpll"; reg = <0x140 0x24>;
@@ -450,6 +450,11 @@ "sata1", "sata2"; }; + syscon@180 { + compatible = "brcm,cru-clkset", "syscon"; + reg = <0x180 0x4>; + }; + pinctrl: pin-controller@1c0 { compatible = "brcm,bcm4708-pinmux"; reg = <0x1c0 0x24>;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 386/667 ARM: dts: BCM5301X: Update pin controller node name
In reply to Greg Kroah-HartmanFrom: Rafał Miłecki <[email protected]>
[ Upstream commit 130b5e32ba9d2d2313e39cf3f6d0729bff02b76a ]
This fixes:arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dtb: cru-bus@100: 'pin-controller@1c0' does not match any of the regexes: '^clock-controller@[a-f0-9]+$', '^phy@[a-f0-9]+$', '^pinctrl@[a-f0-9]+$', '^syscon@[a-f0-9]+$', '^thermal@[a-f0-9]+$'
From schema: Documentation/devicetree/bindings/mfd/brcm,cru.yamlarch/arm/boot/dts/bcm4708-asus-rt-ac56u.dtb: pin-controller@1c0: $nodename:0: 'pin-controller@1c0' does not match '^(pinctrl|pinmux)(@[0-9a-f]+)?$'
From schema: Documentation/devicetree/bindings/pinctrl/brcm,ns-pinmux.yaml
Ref: e7391b021e3f ("dt-bindings: mfd: brcm,cru: Rename pinctrl node")
--- arch/arm/boot/dts/bcm5301x.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/bcm5301x.dtsi +1 -1
@@ -455,7 +455,7 @@ reg = <0x180 0x4>; }; - pinctrl: pin-controller@1c0 { + pinctrl: pinctrl@1c0 { compatible = "brcm,bcm4708-pinmux"; reg = <0x1c0 0x24>; reg-names = "cru_gpio_control";
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 387/667 ARM: dts: suniv: F1C100: fix watchdog compatible
In reply to Greg Kroah-HartmanFrom: Andre Przywara <[email protected]>
[ Upstream commit 01a850ee61cbf0ab77dcbf26bb133fec2dd640d6 ]
The F1C100 series of SoCs actually have their watchdog IP being compatible with the newer Allwinner generation, not the older one.
The currently described sun4i-a10-wdt actually does not work, neither the watchdog functionality (just never fires), nor the reset part (reboot hangs).
Replace the compatible string with the one used by the newer generation. Verified to work with both the watchdog and reboot functionality on a LicheePi Nano.
Also add the missing interrupt line and clock source, to make it binding compliant.
--- arch/arm/boot/dts/suniv-f1c100s.dtsi | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/arm/boot/dts/suniv-f1c100s.dtsi +3 -1
@@ -104,8 +104,10 @@ wdt: watchdog@1c20ca0 { compatible = "allwinner,suniv-f1c100s-wdt", - "allwinner,sun4i-a10-wdt"; + "allwinner,sun6i-a31-wdt"; reg = <0x01c20ca0 0x20>; + interrupts = <16>; + clocks = <&osc32k>; }; uart0: serial@1c25000 {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 388/667 soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 8fd3f18ea31a398ecce4a6d3804433658678b0a3 ]
The device_node pointer is returned by of_parse_phandle() with refcount incremented. We should use of_node_put() on it when done.
--- drivers/soc/qcom/smp2p.c | 1 + 1 file changed, 1 insertion(+)
drivers/soc/qcom/smp2p.c +1 -0
@@ -421,6 +421,7 @@ static int smp2p_parse_ipc(struct qcom_smp2p *smp2p) } smp2p->ipc_regmap =syscon_node_to_regmap (syscon); +of_node_put (syscon);if (IS_ERR (smp2p->ipc_regmap))return PTR_ERR (smp2p->ipc_regmap);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 389/667 soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit aad66a3c78da668f4506356c2fdb70b7a19ecc76 ]
The device_node pointer is returned by of_parse_phandle() with refcount incremented. We should use of_node_put() on it when done.
--- drivers/soc/qcom/smsm.c | 1 + 1 file changed, 1 insertion(+)
drivers/soc/qcom/smsm.c +1 -0
@@ -374,6 +374,7 @@ static int smsm_parse_ipc(struct qcom_smsm *smsm, unsigned host_id)return 0 ; host->ipc_regmap =syscon_node_to_regmap (syscon); +of_node_put (syscon);if (IS_ERR (host->ipc_regmap))return PTR_ERR (host->ipc_regmap);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 390/667 PCI: cadence: Fix find_first_zero_bit() limit
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 0aa3a0937feeb91a0e4e438c3c063b749b194192 ]
The ep->ob_region_map bitmap is a long and it has BITS_PER_LONG bits.
--- drivers/pci/controller/cadence/pcie-cadence-ep.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/pci/controller/cadence/pcie-cadence-ep.c +1 -2
@@ -187,8 +187,7 @@ static int cdns_pcie_ep_map_addr(struct pci_epc *epc, u8 fn, u8 vfn,struct cdns_pcie *pcie = &ep->pcie;u32 r; - r =find_first_zero_bit (&ep->ob_region_map, -sizeof (ep->ob_region_map) *BITS_PER_LONG ); + r =find_first_zero_bit (&ep->ob_region_map,BITS_PER_LONG );if (r >= ep->max_regions -1 ) {dev_err (&epc->dev,"no free outbound region\n" );return -EINVAL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 391/667 PCI: rockchip: Fix find_first_zero_bit() limit
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 096950e230b8d83645c7cf408b9f399f58c08b96 ]
The ep->ob_region_map bitmap is a long and it has BITS_PER_LONG bits.
--- drivers/pci/controller/pcie-rockchip-ep.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/pci/controller/pcie-rockchip-ep.c +1 -2
@@ -264,8 +264,7 @@ static int rockchip_pcie_ep_map_addr(struct pci_epc *epc, u8 fn, u8 vfn,struct rockchip_pcie *pcie = &ep->rockchip;u32 r; - r =find_first_zero_bit (&ep->ob_region_map, -sizeof (ep->ob_region_map) *BITS_PER_LONG ); + r =find_first_zero_bit (&ep->ob_region_map,BITS_PER_LONG );/* * Region 0 is reserved for configuration space and shouldn't * be used elsewhere per TRM, so leave it out.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 392/667 PCI: mediatek: Fix refcount leak in mtk_pcie_subsys_powerup()
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 214e0d8fe4a813ae6ffd62bc2dfe7544c20914f4 ]
The of_find_compatible_node() function returns a node pointer with refcount incremented, We should use of_node_put() on it when done Add the missing of_node_put() to release the refcount.
--- drivers/pci/controller/pcie-mediatek.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/controller/pcie-mediatek.c +1 -0
@@ -1008,6 +1008,7 @@ static int mtk_pcie_subsys_powerup(struct mtk_pcie *pcie) "mediatek,generic-pciecfg");if (cfg_node) { pcie->cfg =syscon_node_to_regmap (cfg_node); +of_node_put (cfg_node);if (IS_ERR (pcie->cfg))return PTR_ERR (pcie->cfg); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 393/667 PCI: dwc: Fix setting error return on MSI DMA mapping failure
In reply to Greg Kroah-HartmanFrom: Jiantao Zhang <[email protected]>
[ Upstream commit 88557685cd72cf0db686a4ebff3fad4365cb6071 ]
When dma_mapping_error() returns error because of no enough memory, but dw_pcie_host_init() returns success, which will mislead the callers.
--- drivers/pci/controller/dwc/pcie-designware-host.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pci/controller/dwc/pcie-designware-host.c +2 -1
@@ -380,7 +380,8 @@ int dw_pcie_host_init(struct pcie_port *pp)sizeof (pp->msi_msg),DMA_FROM_DEVICE , DMA_ATTR_SKIP_CPU_SYNC); -if (dma_mapping_error (pci->dev, pp->msi_data)) { + ret =dma_mapping_error (pci->dev, pp->msi_data); +if (ret) {dev_err (pci->dev,"Failed to map MSI data\n" ); pp->msi_data =0 ; goto err_free_msi;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 394/667 ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec clocks
In reply to Greg Kroah-HartmanFrom: Thorsten Scherer <[email protected]>
[ Upstream commit 3d397a1277853498e8b7b305f2610881357c033f ]
Commit f3e7dae323ab ("ARM: dts: imx6qdl: add enet_out clk support") added another item to the list of clocks for the fec device. As imx6dl-eckelmann-ci4x10.dts only overwrites clocks, but not clock-names this resulted in an inconsistency with clocks having one item more than clock-names.
Also overwrite clock-names with the same value as in imx6qdl.dtsi. This is a no-op today, but prevents similar inconsistencies if the soc file will be changed in a similar way in the future.
--- arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts +5 -1
@@ -297,7 +297,11 @@ phy-mode = "rmii"; phy-reset-gpios = <&gpio1 18 GPIO_ACTIVE_LOW>; phy-handle = <&phy>; - clocks = <&clks IMX6QDL_CLK_ENET>, <&clks IMX6QDL_CLK_ENET>, <&rmii_clk>; + clocks = <&clks IMX6QDL_CLK_ENET>, + <&clks IMX6QDL_CLK_ENET>, + <&rmii_clk>, + <&clks IMX6QDL_CLK_ENET_REF>; + clock-names = "ipg", "ahb", "ptp", "enet_out"; status = "okay"; mdio {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 395/667 soc: qcom: llcc: Add MODULE_DEVICE_TABLE()
In reply to Greg Kroah-HartmanFrom: Bjorn Andersson <[email protected]>
[ Upstream commit 5334a3b12a7233b31788de60d61bfd890059d783 ]
The llcc-qcom driver can be compiled as a module, but lacks MODULE_DEVICE_TABLE() and will therefore not be loaded automatically. Fix this.
--- drivers/soc/qcom/llcc-qcom.c | 1 + 1 file changed, 1 insertion(+)
drivers/soc/qcom/llcc-qcom.c +1 -0
@@ -630,6 +630,7 @@ static const struct of_device_id qcom_llcc_of_match[] = { { .compatible = "qcom,sm8250-llcc", .data = &sm8250_cfg }, { } }; +MODULE_DEVICE_TABLE (of, qcom_llcc_of_match);static struct platform_driver qcom_llcc_driver = { .driver = {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 396/667 KVM: nVMX: Leave most VM-Exit info fields unmodified on failed VM-Entry
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit c3634d25fbee88e2368a8e0903ae0d0670eb9e71 ]
Don't modify vmcs12 exit fields except EXIT_REASON and EXIT_QUALIFICATION when performing a nested VM-Exit due to failed VM-Entry. Per the SDM, only the two aformentioned fields are filled and "All other VM-exit information fields are unmodified".
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/nested.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
arch/x86/kvm/vmx/nested.c +10 -5
@@ -4185,12 +4185,12 @@ static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,if (to_vmx (vcpu)->exit_reason.enclave_mode) vmcs12->vm_exit_reason |=VMX_EXIT_REASONS_SGX_ENCLAVE_MODE ; vmcs12->exit_qualification = exit_qualification; - vmcs12->vm_exit_intr_info = exit_intr_info; - - vmcs12->idt_vectoring_info_field =0 ; - vmcs12->vm_exit_instruction_len =vmcs_read32 (VM_EXIT_INSTRUCTION_LEN ); - vmcs12->vmx_instruction_info =vmcs_read32 (VMX_INSTRUCTION_INFO ); +/* +* On VM-Exit due to a failed VM-Entry, the VMCS isn't marked launched +* and only EXIT_REASON and EXIT_QUALIFICATION are updated, all other +* exit info fields are unmodified. +*/ if (!(vmcs12->vm_exit_reason &VMX_EXIT_REASONS_FAILED_VMENTRY )) { vmcs12->launch_state =1 ;
@@ -4202,8 +4202,13 @@ static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,* Transfer the event that L0 or L1 may wanted to inject into * L2 to IDT_VECTORING_INFO_FIELD. */ + vmcs12->idt_vectoring_info_field =0 ;vmcs12_save_pending_event (vcpu, vmcs12); + vmcs12->vm_exit_intr_info = exit_intr_info; + vmcs12->vm_exit_instruction_len =vmcs_read32 (VM_EXIT_INSTRUCTION_LEN ); + vmcs12->vmx_instruction_info =vmcs_read32 (VMX_INSTRUCTION_INFO ); +/* * According to spec, there's no need to store the guest's * MSRs if the exit is due to a VM-entry failure that occurs
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 397/667 KVM: nVMX: Clear IDT vectoring on nested VM-Exit for double/triple fault
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit 9bd1f0efa859b61950d109b32ff8d529cc33a3ad ]
Clear the IDT vectoring field in vmcs12 on next VM-Exit due to a double or triple fault. Per the SDM, a VM-Exit isn't considered to occur during event delivery if the exit is due to an intercepted double fault or a triple fault. Opportunistically move the default clearing (no event "pending") into the helper so that it's more obvious that KVM does indeed handle this case.
Note, the double fault case is worded rather wierdly in the SDM:
The original event results in a double-fault exception that causes the VM exit directly.
Temporarily ignoring injected events, double faults can _only_ occur if an exception occurs while attempting to deliver a different exception, i.e. there's _always_ an original event. And for injected double fault, while there's no original event, injected events are never subject to interception.
Presumably the SDM is calling out that a the vectoring info will be valid if a different exit occurs after a double fault, e.g. if a #PF occurs and is intercepted while vectoring #DF, then the vectoring info will show the double fault. In other words, the clause can simply be read as:
The VM exit is caused by a double-fault exception.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/nested.c | 32 ++++++++++++++++++++++++++++---- arch/x86/kvm/vmx/vmcs.h | 5 +++++ 2 files changed, 33 insertions(+), 4 deletions(-)
arch/x86/kvm/vmx/nested.c +28 -4
@@ -3678,12 +3678,34 @@ vmcs12_guest_cr4(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12) }static void vmcs12_save_pending_event (struct kvm_vcpu *vcpu, -struct vmcs12 *vmcs12) +struct vmcs12 *vmcs12, +u32 vm_exit_reason,u32 exit_intr_info) {u32 idt_vectoring;unsigned int nr; -if (vcpu->arch.exception.injected) { +/* +* Per the SDM, VM-Exits due to double and triple faults are never +* considered to occur during event delivery, even if the double/triple +* fault is the result of an escalating vectoring issue. +* +* Note, the SDM qualifies the double fault behavior with "The original +* event results in a double-fault exception". It's unclear why the +* qualification exists since exits due to double fault can occur only +* while vectoring a different exception (injected events are never +* subject to interception), i.e. there's _always_ an original event. +* +* The SDM also uses NMI as a confusing example for the "original event +* causes the VM exit directly" clause. NMI isn't special in any way, +* the same rule applies to all events that cause an exit directly. +* NMI is an odd choice for the example because NMIs can only occur on +* instruction boundaries, i.e. they _can't_ occur during vectoring. +*/ +if ((u16 )vm_exit_reason ==EXIT_REASON_TRIPLE_FAULT || + ((u16 )vm_exit_reason ==EXIT_REASON_EXCEPTION_NMI && +is_double_fault (exit_intr_info))) { + vmcs12->idt_vectoring_info_field =0 ; + }else if (vcpu->arch.exception.injected) { nr = vcpu->arch.exception.nr; idt_vectoring = nr |VECTORING_INFO_VALID_MASK ;
@@ -3716,6 +3738,8 @@ static void vmcs12_save_pending_event(struct kvm_vcpu *vcpu, idt_vectoring |=INTR_TYPE_EXT_INTR ; vmcs12->idt_vectoring_info_field = idt_vectoring; + }else { + vmcs12->idt_vectoring_info_field =0 ; } }
@@ -4202,8 +4226,8 @@ static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,* Transfer the event that L0 or L1 may wanted to inject into * L2 to IDT_VECTORING_INFO_FIELD. */ - vmcs12->idt_vectoring_info_field =0 ; -vmcs12_save_pending_event (vcpu, vmcs12); +vmcs12_save_pending_event (vcpu, vmcs12, + vm_exit_reason, exit_intr_info); vmcs12->vm_exit_intr_info = exit_intr_info; vmcs12->vm_exit_instruction_len =vmcs_read32 (VM_EXIT_INSTRUCTION_LEN );
arch/x86/kvm/vmx/vmcs.h +5 -0
@@ -104,6 +104,11 @@ static inline bool is_breakpoint(u32 intr_info)return is_exception_n (intr_info,BP_VECTOR ); } +static inline bool is_double_fault (u32 intr_info) +{ +return is_exception_n (intr_info,DF_VECTOR ); +} +static inline bool is_page_fault (u32 intr_info) {return is_exception_n (intr_info,PF_VECTOR );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 398/667 crypto: qat - set CIPHER capability for QAT GEN2
In reply to Greg Kroah-HartmanFrom: Giovanni Cabiddu <[email protected]>
[ Upstream commit 547bde7bd4ecd78f36f98744e6c9a0999e52da5a ]
Set the CIPHER capability for QAT GEN2 devices if the hardware supports it. This is done if both the CIPHER and the AUTHENTICATION engines are available on the device.
--- drivers/crypto/qat/qat_common/adf_gen2_hw_data.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/crypto/qat/qat_common/adf_gen2_hw_data.c +9 -3
@@ -161,17 +161,23 @@ u32 adf_gen2_get_accel_cap(struct adf_accel_dev *accel_dev)u32 legfuses;u32 capabilities =ICP_ACCEL_CAPABILITIES_CRYPTO_SYMMETRIC |ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC | -ICP_ACCEL_CAPABILITIES_AUTHENTICATION ; +ICP_ACCEL_CAPABILITIES_AUTHENTICATION | +ICP_ACCEL_CAPABILITIES_CIPHER ;/* Read accelerator capabilities mask */ pci_read_config_dword (pdev,ADF_DEVICE_LEGFUSE_OFFSET , &legfuses); -if (legfuses &ICP_ACCEL_MASK_CIPHER_SLICE ) +/* A set bit in legfuses means the feature is OFF in this SKU */ +if (legfuses &ICP_ACCEL_MASK_CIPHER_SLICE ) { capabilities &= ~ICP_ACCEL_CAPABILITIES_CRYPTO_SYMMETRIC ; + capabilities &= ~ICP_ACCEL_CAPABILITIES_CIPHER ; + }if (legfuses &ICP_ACCEL_MASK_PKE_SLICE ) capabilities &= ~ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC ; -if (legfuses &ICP_ACCEL_MASK_AUTH_SLICE ) +if (legfuses &ICP_ACCEL_MASK_AUTH_SLICE ) { capabilities &= ~ICP_ACCEL_CAPABILITIES_AUTHENTICATION ; + capabilities &= ~ICP_ACCEL_CAPABILITIES_CIPHER ; + }if ((straps | fuses) &ADF_POWERGATE_PKE ) capabilities &= ~ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 399/667 crypto: qat - set COMPRESSION capability for QAT GEN2
In reply to Greg Kroah-HartmanFrom: Giovanni Cabiddu <[email protected]>
[ Upstream commit cfe4894eccdc7fa5cd35bf34e918614d06ecce38 ]
Enhance the device capability detection for QAT GEN2 devices to detect if a device supports the compression service.
This is done by checking both the fuse and the strap registers for c62x and c3xxx and only the fuse register for dh895xcc.
--- drivers/crypto/qat/qat_common/adf_gen2_hw_data.c | 8 +++++++- drivers/crypto/qat/qat_common/adf_gen2_hw_data.h | 1 + drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c | 2 ++ 3 files changed, 10 insertions(+), 1 deletion(-)
drivers/crypto/qat/qat_common/adf_gen2_hw_data.c +7 -1
@@ -162,7 +162,8 @@ u32 adf_gen2_get_accel_cap(struct adf_accel_dev *accel_dev)u32 capabilities =ICP_ACCEL_CAPABILITIES_CRYPTO_SYMMETRIC |ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC |ICP_ACCEL_CAPABILITIES_AUTHENTICATION | -ICP_ACCEL_CAPABILITIES_CIPHER ; +ICP_ACCEL_CAPABILITIES_CIPHER | +ICP_ACCEL_CAPABILITIES_COMPRESSION ;/* Read accelerator capabilities mask */ pci_read_config_dword (pdev,ADF_DEVICE_LEGFUSE_OFFSET , &legfuses);
@@ -178,10 +179,15 @@ u32 adf_gen2_get_accel_cap(struct adf_accel_dev *accel_dev) capabilities &= ~ICP_ACCEL_CAPABILITIES_AUTHENTICATION ; capabilities &= ~ICP_ACCEL_CAPABILITIES_CIPHER ; } +if (legfuses &ICP_ACCEL_MASK_COMPRESS_SLICE ) + capabilities &= ~ICP_ACCEL_CAPABILITIES_COMPRESSION ;if ((straps | fuses) &ADF_POWERGATE_PKE ) capabilities &= ~ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC ; +if ((straps | fuses) &ADF_POWERGATE_DC ) + capabilities &= ~ICP_ACCEL_CAPABILITIES_COMPRESSION ; +return capabilities; }EXPORT_SYMBOL_GPL (adf_gen2_get_accel_cap);
drivers/crypto/qat/qat_common/adf_gen2_hw_data.h +1 -0
@@ -111,6 +111,7 @@ do { \ (ADF_ARB_REG_SLOT * (index)), value)/* Power gating */ +#define ADF_POWERGATE_DC BIT(23)#define ADF_POWERGATE_PKE BIT(24)/* WDT timers
drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c +2 -0
@@ -97,6 +97,8 @@ static u32 get_accel_cap(struct adf_accel_dev *accel_dev) capabilities &= ~ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC ;if (legfuses &ICP_ACCEL_MASK_AUTH_SLICE ) capabilities &= ~ICP_ACCEL_CAPABILITIES_AUTHENTICATION ; +if (legfuses &ICP_ACCEL_MASK_COMPRESS_SLICE ) + capabilities &= ~ICP_ACCEL_CAPABILITIES_COMPRESSION ;return capabilities; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 400/667 crypto: qat - set CIPHER capability for DH895XCC
In reply to Greg Kroah-HartmanFrom: Giovanni Cabiddu <[email protected]>
[ Upstream commit 6a23804cb8bcb85c6998bf193d94d4036db26f51 ]
Set the CIPHER capability for QAT DH895XCC devices if the hardware supports it. This is done if both the CIPHER and the AUTHENTICATION engines are available on the device.
--- .../crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c +9 -3
@@ -86,17 +86,23 @@ static u32 get_accel_cap(struct adf_accel_dev *accel_dev) capabilities =ICP_ACCEL_CAPABILITIES_CRYPTO_SYMMETRIC |ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC | -ICP_ACCEL_CAPABILITIES_AUTHENTICATION ; +ICP_ACCEL_CAPABILITIES_AUTHENTICATION | +ICP_ACCEL_CAPABILITIES_CIPHER ;/* Read accelerator capabilities mask */ pci_read_config_dword (pdev,ADF_DEVICE_LEGFUSE_OFFSET , &legfuses); -if (legfuses &ICP_ACCEL_MASK_CIPHER_SLICE ) +/* A set bit in legfuses means the feature is OFF in this SKU */ +if (legfuses &ICP_ACCEL_MASK_CIPHER_SLICE ) { capabilities &= ~ICP_ACCEL_CAPABILITIES_CRYPTO_SYMMETRIC ; + capabilities &= ~ICP_ACCEL_CAPABILITIES_CIPHER ; + }if (legfuses &ICP_ACCEL_MASK_PKE_SLICE ) capabilities &= ~ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC ; -if (legfuses &ICP_ACCEL_MASK_AUTH_SLICE ) +if (legfuses &ICP_ACCEL_MASK_AUTH_SLICE ) { capabilities &= ~ICP_ACCEL_CAPABILITIES_AUTHENTICATION ; + capabilities &= ~ICP_ACCEL_CAPABILITIES_CIPHER ; + }if (legfuses &ICP_ACCEL_MASK_COMPRESS_SLICE ) capabilities &= ~ICP_ACCEL_CAPABILITIES_COMPRESSION ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 401/667 crypto: qat - set COMPRESSION capability for DH895XCC
In reply to Greg Kroah-HartmanFrom: Giovanni Cabiddu <[email protected]>
[ Upstream commit 0eaa51543273fd0f4ba9bea83638f7033436e5eb ]
The capability detection logic clears bits for the features that are disabled in a certain SKU. For example, if the bit associate to compression is not present in the LEGFUSE register, the correspondent bit is cleared in the capability mask.
This change adds the compression capability to the mask as this was missing in the commit that enhanced the capability detection logic.
--- drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c +2 -1
@@ -87,7 +87,8 @@ static u32 get_accel_cap(struct adf_accel_dev *accel_dev) capabilities =ICP_ACCEL_CAPABILITIES_CRYPTO_SYMMETRIC |ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC |ICP_ACCEL_CAPABILITIES_AUTHENTICATION | -ICP_ACCEL_CAPABILITIES_CIPHER ; +ICP_ACCEL_CAPABILITIES_CIPHER | +ICP_ACCEL_CAPABILITIES_COMPRESSION ;/* Read accelerator capabilities mask */ pci_read_config_dword (pdev,ADF_DEVICE_LEGFUSE_OFFSET , &legfuses);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 402/667 platform/chrome: cros_ec: fix error handling in cros_ec_register()
In reply to Greg Kroah-HartmanFrom: Tzung-Bi Shih <[email protected]>
[ Upstream commit 2cd01bd6b117df07b1bc2852f08694fdd29e40ed ]
Fix cros_ec_register() to unregister platform devices if blocking_notifier_chain_register() fails.
Also use the single exit path to handle the platform device unregistration.
--- drivers/platform/chrome/cros_ec.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/platform/chrome/cros_ec.c +10 -6
@@ -189,6 +189,8 @@ int cros_ec_register(struct cros_ec_device *ec_dev) ec_dev->max_request =sizeof (struct ec_params_hello ); ec_dev->max_response =sizeof (struct ec_response_get_protocol_info ); ec_dev->max_passthru =0 ; + ec_dev->ec =NULL ; + ec_dev->pd =NULL ; ec_dev->din =devm_kzalloc (dev, ec_dev->din_size,GFP_KERNEL );if (!ec_dev->din)
@@ -245,18 +247,16 @@ int cros_ec_register(struct cros_ec_device *ec_dev)if (IS_ERR (ec_dev->pd)) {dev_err (ec_dev->dev,"Failed to create CrOS PD platform device\n" ); -platform_device_unregister (ec_dev->ec); -return PTR_ERR (ec_dev->pd); + err =PTR_ERR (ec_dev->pd); + goto exit; } }if (IS_ENABLED (CONFIG_OF ) && dev->of_node) { err =devm_of_platform_populate (dev);if (err) { -platform_device_unregister (ec_dev->pd); -platform_device_unregister (ec_dev->ec);dev_err (dev,"Failed to register sub-devices\n" ); -return err; + goto exit; } }
@@ -278,7 +278,7 @@ int cros_ec_register(struct cros_ec_device *ec_dev) err =blocking_notifier_chain_register (&ec_dev->event_notifier, &ec_dev->notifier_ready);if (err) -return err; + goto exit; }dev_info (dev,"Chrome EC device registered\n" );
@@ -291,6 +291,10 @@ int cros_ec_register(struct cros_ec_device *ec_dev)cros_ec_irq_thread (0 , ec_dev);return 0 ; +exit: +platform_device_unregister (ec_dev->ec); +platform_device_unregister (ec_dev->pd); +return err; }EXPORT_SYMBOL (cros_ec_register);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 403/667 ARM: dts: imx6dl-colibri: Fix I2C pinmuxing
In reply to Greg Kroah-HartmanFrom: Max Krummenacher <[email protected]>
[ Upstream commit 5f5c579a34a87117c20b411df583ae816c1ec84f ]
Fix names of extra pingroup node and property for gpio bus recovery. Without the change i2c2 is not functional.
--- arch/arm/boot/dts/imx6qdl-colibri.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm/boot/dts/imx6qdl-colibri.dtsi +3 -3
@@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0+ OR MIT /* - * Copyright 2014-2020 Toradex + * Copyright 2014-2022 Toradex * Copyright 2012 Freescale Semiconductor, Inc. * Copyright 2011 Linaro Ltd. */
@@ -132,7 +132,7 @@ clock-frequency = <100000>; pinctrl-names = "default", "gpio"; pinctrl-0 = <&pinctrl_i2c2>; - pinctrl-0 = <&pinctrl_i2c2_gpio>; + pinctrl-1 = <&pinctrl_i2c2_gpio>; scl-gpios = <&gpio2 30 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; sda-gpios = <&gpio3 16 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; status = "okay";
@@ -488,7 +488,7 @@ >; }; - pinctrl_i2c2_gpio: i2c2grp { + pinctrl_i2c2_gpio: i2c2gpiogrp { fsl,pins = < MX6QDL_PAD_EIM_EB2__GPIO2_IO30 0x4001b8b1 MX6QDL_PAD_EIM_D16__GPIO3_IO16 0x4001b8b1
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 404/667 platform/chrome: Re-introduce cros_ec_cmd_xfer and use it for ioctls
In reply to Greg Kroah-HartmanFrom: Guenter Roeck <[email protected]>
[ Upstream commit 57b888ca2541785de2fcb90575b378921919b6c0 ]
Commit 413dda8f2c6f ("platform/chrome: cros_ec_chardev: Use cros_ec_cmd_xfer_status helper") inadvertendly changed the userspace ABI. Previously, cros_ec ioctls would only report errors if the EC communication failed, and otherwise return success and the result of the EC communication. An EC command execution failure was reported in the EC response field. The above mentioned commit changed this behavior, and the ioctl itself would fail. This breaks userspace commands trying to analyze the EC command execution error since the actual EC command response is no longer reported to userspace.
Fix the problem by re-introducing the cros_ec_cmd_xfer() helper, and use it to handle ioctl messages.
--- drivers/platform/chrome/cros_ec_chardev.c | 2 +- drivers/platform/chrome/cros_ec_proto.c | 50 +++++++++++++++++---- include/linux/platform_data/cros_ec_proto.h | 3 ++ 3 files changed, 45 insertions(+), 10 deletions(-)
drivers/platform/chrome/cros_ec_chardev.c +1 -1
@@ -301,7 +301,7 @@ static long cros_ec_chardev_ioctl_xcmd(struct cros_ec_dev *ec, void __user *arg) } s_cmd->command += ec->cmd_offset; - ret =cros_ec_cmd_xfer_status (ec->ec_dev, s_cmd); + ret =cros_ec_cmd_xfer (ec->ec_dev, s_cmd);/* Only copy data to userland if data was received. */ if (ret <0 ) goto exit;
drivers/platform/chrome/cros_ec_proto.c +41 -9
69 lines not on this page · raw message
include/linux/platform_data/cros_ec_proto.h +3 -0
@@ -216,6 +216,9 @@ int cros_ec_prepare_tx(struct cros_ec_device *ec_dev,int cros_ec_check_result (struct cros_ec_device *ec_dev,struct cros_ec_command *msg); +int cros_ec_cmd_xfer (struct cros_ec_device *ec_dev, +struct cros_ec_command *msg); +int cros_ec_cmd_xfer_status (struct cros_ec_device *ec_dev,struct cros_ec_command *msg);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 405/667 can: xilinx_can: mark bit timing constants as const
In reply to Greg Kroah-HartmanFrom: Marc Kleine-Budde <[email protected]>
[ Upstream commit ae38fda02996d43d9fb09f16e81e0008704dd524 ]
This patch marks the bit timing constants as const.
--- drivers/net/can/xilinx_can.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/can/xilinx_can.c +2 -2
@@ -239,7 +239,7 @@ static const struct can_bittiming_const xcan_bittiming_const_canfd = { };/* AXI CANFD Data Bittiming constants as per AXI CANFD 1.0 specs */ -static struct can_bittiming_const xcan_data_bittiming_const_canfd = { +static const struct can_bittiming_const xcan_data_bittiming_const_canfd = { .name =DRIVER_NAME , .tseg1_min =1 , .tseg1_max =16 ,
@@ -265,7 +265,7 @@ static const struct can_bittiming_const xcan_bittiming_const_canfd2 = { };/* AXI CANFD 2.0 Data Bittiming constants as per AXI CANFD 2.0 spec */ -static struct can_bittiming_const xcan_data_bittiming_const_canfd2 = { +static const struct can_bittiming_const xcan_data_bittiming_const_canfd2 = { .name =DRIVER_NAME , .tseg1_min =1 , .tseg1_max =32 ,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 406/667 ARM: dts: stm32: Fix PHY post-reset delay on Avenger96
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit ef2d90708883f4025a801feb0ba8411a7a4387e1 ]
Per KSZ9031RNX PHY datasheet FIGURE 7-5: POWER-UP/POWER-DOWN/RESET TIMING Note 2: After the de-assertion of reset, wait a minimum of 100 μs before starting programming on the MIIM (MDC/MDIO) interface.
Add 1ms post-reset delay to guarantee this figure.
--- arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +1 -0
@@ -141,6 +141,7 @@ compatible = "snps,dwmac-mdio"; reset-gpios = <&gpioz 2 GPIO_ACTIVE_LOW>; reset-delay-us = <1000>; + reset-post-delay-us = <1000>; phy0: ethernet-phy@7 { reg = <7>;
Signature · 9 lines
2.35.1 _______________________________________________ linux-arm-kernel mailing list [email protected] http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
Greg Kroah-Hartman
maintainerPATCH 407/667 ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT
In reply to Greg Kroah-HartmanFrom: Phil Elwell <[email protected]>
[ Upstream commit 2c663e5e5bbf2a5b85e0f76ccb69663f583c3e33 ]
The GPIOs 30 to 39 are connected to the Cypress CYW43438 (Wifi/BT). So fix the GPIO line names accordingly.
--- arch/arm/boot/dts/bcm2835-rpi-zero-w.dts | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
arch/arm/boot/dts/bcm2835-rpi-zero-w.dts +12 -10
@@ -74,16 +74,18 @@ "GPIO27", "SDA0", "SCL0", - "NC", /* GPIO30 */ - "NC", /* GPIO31 */ - "NC", /* GPIO32 */ - "NC", /* GPIO33 */ - "NC", /* GPIO34 */ - "NC", /* GPIO35 */ - "NC", /* GPIO36 */ - "NC", /* GPIO37 */ - "NC", /* GPIO38 */ - "NC", /* GPIO39 */ + /* Used by BT module */ + "CTS0", + "RTS0", + "TXD0", + "RXD0", + /* Used by Wifi */ + "SD1_CLK", + "SD1_CMD", + "SD1_DATA0", + "SD1_DATA1", + "SD1_DATA2", + "SD1_DATA3", "CAM_GPIO1", /* GPIO40 */ "WL_ON", /* GPIO41 */ "NC", /* GPIO42 */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 408/667 ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C
In reply to Greg Kroah-HartmanFrom: Phil Elwell <[email protected]>
[ Upstream commit 9fd26fd02749ec964eb0d588a3bab9e09bf77927 ]
The GPIOs 46 & 47 are already used for a I2C interface to a SMPS. So fix the GPIO line names accordingly.
--- arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts +2 -2
@@ -63,8 +63,8 @@ "GPIO43", "GPIO44", "GPIO45", - "GPIO46", - "GPIO47", + "SMPS_SCL", + "SMPS_SDA", /* Used by eMMC */ "SD_CLK_R", "SD_CMD_R",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 409/667 ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED
In reply to Greg Kroah-HartmanFrom: Phil Elwell <[email protected]>
[ Upstream commit 57f718aa4b93392fb1a8c0a874ab882b9e18136a ]
The red LED on the Raspberry Pi 3 B Plus is the power LED. So fix the GPIO line name accordingly.
--- arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts +1 -1
@@ -45,7 +45,7 @@ #gpio-cells = <2>; gpio-line-names = "BT_ON", "WL_ON", - "STATUS_LED_R", + "PWR_LED_R", "LAN_RUN", "", "CAM_GPIO0",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 410/667 ARM: dts: bcm2835-rpi-b: Fix GPIO line names
In reply to Greg Kroah-HartmanFrom: Stefan Wahren <[email protected]>
[ Upstream commit 97bd8659c1c46c23e4daea7e040befca30939950 ]
Recently this has been fixed in the vendor tree, so upstream this.
--- arch/arm/boot/dts/bcm2835-rpi-b.dts | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
arch/arm/boot/dts/bcm2835-rpi-b.dts +6 -7
@@ -53,18 +53,17 @@ "GPIO18", "NC", /* GPIO19 */ "NC", /* GPIO20 */ - "GPIO21", + "CAM_GPIO0", "GPIO22", "GPIO23", "GPIO24", "GPIO25", "NC", /* GPIO26 */ - "CAM_GPIO0", - /* Binary number representing build/revision */ - "CONFIG0", - "CONFIG1", - "CONFIG2", - "CONFIG3", + "GPIO27", + "GPIO28", + "GPIO29", + "GPIO30", + "GPIO31", "NC", /* GPIO32 */ "NC", /* GPIO33 */ "NC", /* GPIO34 */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 411/667 misc: ocxl: fix possible double free in ocxl_file_register_afu
In reply to Greg Kroah-HartmanFrom: Hangyu Hua <[email protected]>
[ Upstream commit 950cf957fe34d40d63dfa3bf3968210430b6491e ]
info_release() will be called in device_unregister() when info->dev's reference count is 0. So there is no need to call ocxl_afu_put() and kfree() again.
Fix this by adding free_minor() and return to err_unregister error path.
--- drivers/misc/ocxl/file.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/misc/ocxl/file.c +2 -0
@@ -558,7 +558,9 @@ int ocxl_file_register_afu(struct ocxl_afu *afu) err_unregister:ocxl_sysfs_unregister_afu (info);// safe to call even if register failed +free_minor (info);device_unregister (&info->dev); +return rc; err_put:ocxl_afu_put (afu);free_minor (info);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 412/667 crypto: marvell/cesa - ECB does not IV
In reply to Greg Kroah-HartmanFrom: Corentin Labbe <[email protected]>
[ Upstream commit 4ffa1763622ae5752961499588f3f8874315f974 ]
The DES3 ECB has an IV size set but ECB does not need one.
--- drivers/crypto/marvell/cesa/cipher.c | 1 - 1 file changed, 1 deletion(-)
drivers/crypto/marvell/cesa/cipher.c +0 -1
@@ -624,7 +624,6 @@ struct skcipher_alg mv_cesa_ecb_des3_ede_alg = { .decrypt = mv_cesa_ecb_des3_ede_decrypt, .min_keysize = DES3_EDE_KEY_SIZE, .max_keysize = DES3_EDE_KEY_SIZE, - .ivsize = DES3_EDE_BLOCK_SIZE, .base = { .cra_name = "ecb(des3_ede)", .cra_driver_name = "mv-ecb-des3-ede",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 413/667 gpiolib: of: Introduce hook for missing gpio-ranges
In reply to Greg Kroah-HartmanFrom: Stefan Wahren <[email protected]>
[ Upstream commit 3550bba25d5587a701e6edf20e20984d2ee72c78 ]
Since commit 2ab73c6d8323 ("gpio: Support GPIO controllers without pin-ranges") the device tree nodes of GPIO controller need the gpio-ranges property to handle gpio-hogs. Unfortunately it's impossible to guarantee that every new kernel is shipped with an updated device tree binary.
In order to provide backward compatibility with those older DTB, we need a callback within of_gpiochip_add_pin_range() so the relevant platform driver can handle this case.
--- drivers/gpio/gpiolib-of.c | 5 +++++ include/linux/gpio/driver.h | 12 ++++++++++++ 2 files changed, 17 insertions(+)
drivers/gpio/gpiolib-of.c +5 -0
@@ -933,6 +933,11 @@ static int of_gpiochip_add_pin_range(struct gpio_chip *chip)if (!np)return 0 ; +if (!of_property_read_bool (np,"gpio-ranges" ) && + chip->of_gpio_ranges_fallback) { +return chip->of_gpio_ranges_fallback (chip, np); + } + group_names =of_find_property (np, group_names_propname,NULL );for (;; index++) {
include/linux/gpio/driver.h +12 -0
@@ -481,6 +481,18 @@ struct gpio_chip {*/ int (*of_xlate)(struct gpio_chip *gc,const struct of_phandle_args *gpiospec,u32 *flags); + +/** +* @of_gpio_ranges_fallback: +* +* Optional hook for the case that no gpio-ranges property is defined +* within the device tree node "np" (usually DT before introduction +* of gpio-ranges). So this callback is helpful to provide the +* necessary backward compatibility for the pin ranges. +*/ +int (*of_gpio_ranges_fallback)(struct gpio_chip *gc, +struct device_node *np); +#endif /* CONFIG_OF_GPIO */ };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 414/667 pinctrl: bcm2835: implement hook for missing gpio-ranges
In reply to Greg Kroah-HartmanFrom: Stefan Wahren <[email protected]>
[ Upstream commit d2b67744fd99b06555b7e4d67302ede6c7c6a638 ]
The commit c8013355ead6 ("ARM: dts: gpio-ranges property is now required") fixed the GPIO probing issues caused by "pinctrl: bcm2835: Change init order for gpio hogs". This changed only the kernel DTS files. Unfortunately it isn't guaranteed that these files are shipped to all users.
So implement the necessary backward compatibility for BCM2835 and BCM2711 platform.
--- drivers/pinctrl/bcm/pinctrl-bcm2835.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/pinctrl/bcm/pinctrl-bcm2835.c +18 -0
@@ -351,6 +351,22 @@ static int bcm2835_gpio_direction_output(struct gpio_chip *chip,return pinctrl_gpio_direction_output (chip->base + offset); } +static int bcm2835_of_gpio_ranges_fallback (struct gpio_chip *gc, +struct device_node *np) +{ +struct pinctrl_dev *pctldev =of_pinctrl_get (np); + +of_node_put (np); + +if (!pctldev) +return 0 ; + +gpiochip_add_pin_range (gc,pinctrl_dev_get_devname (pctldev),0 ,0 , + gc->ngpio); + +return 0 ; +} +static const struct gpio_chip bcm2835_gpio_chip = { .label =MODULE_NAME , .owner =THIS_MODULE ,
@@ -365,6 +381,7 @@ static const struct gpio_chip bcm2835_gpio_chip = { .base = -1, .ngpio = BCM2835_NUM_GPIOS, .can_sleep = false, + .of_gpio_ranges_fallback = bcm2835_of_gpio_ranges_fallback, };static const struct gpio_chip bcm2711_gpio_chip = {
@@ -381,6 +398,7 @@ static const struct gpio_chip bcm2711_gpio_chip = { .base = -1, .ngpio = BCM2711_NUM_GPIOS, .can_sleep = false, + .of_gpio_ranges_fallback = bcm2835_of_gpio_ranges_fallback, }; static void bcm2835_gpio_irq_handle_bank(struct bcm2835_pinctrl *pc,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 415/667 arm: mediatek: select arch timer for mt7629
In reply to Greg Kroah-HartmanFrom: Chuanhong Guo <[email protected]>
[ Upstream commit d66aea197d534e23d4989eb72fca9c0c114b97c9 ]
This chip has an armv7 arch timer according to the dts. Select it in Kconfig to enforce the support for it.
Otherwise the system time is just completely wrong if user forget to enable ARM_ARCH_TIMER in kernel config.
--- arch/arm/mach-mediatek/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-mediatek/Kconfig +1 -0
@@ -30,6 +30,7 @@ config MACH_MT7623 config MACH_MT7629 bool "MediaTek MT7629 SoCs support" default ARCH_MEDIATEK + select HAVE_ARM_ARCH_TIMER config MACH_MT8127 bool "MediaTek MT8127 SoCs support"
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 416/667 pinctrl/rockchip: support deferring other gpio params
In reply to Greg Kroah-HartmanFrom: Caleb Connolly <[email protected]>
[ Upstream commit 8ce5ef64546850294b021497046588a7abcebe96 ]
Add support for deferring other params like PIN_CONFIG_INPUT_ENABLE. This will be used to add support for PIN_CONFIG_INPUT_ENABLE to the driver.
--- drivers/gpio/gpio-rockchip.c | 24 ++++++++----- drivers/pinctrl/pinctrl-rockchip.c | 54 ++++++++++++++++-------------- drivers/pinctrl/pinctrl-rockchip.h | 7 ++-- 3 files changed, 50 insertions(+), 35 deletions(-)
drivers/gpio/gpio-rockchip.c +16 -8
@@ -19,6 +19,7 @@#include <linux/of_address.h> #include <linux/of_device.h> #include <linux/of_irq.h> +#include <linux/pinctrl/pinconf-generic.h> #include <linux/regmap.h> #include "../pinctrl/core.h"
@@ -691,7 +692,7 @@ static int rockchip_gpio_probe(struct platform_device *pdev)struct device_node *pctlnp =of_get_parent (np);struct pinctrl_dev *pctldev =NULL ;struct rockchip_pin_bank *bank =NULL ; -struct rockchip_pin_output_deferred *cfg; +struct rockchip_pin_deferred *cfg;static int gpio;int id, ret;
@@ -732,15 +733,22 @@ static int rockchip_gpio_probe(struct platform_device *pdev)return ret; } -while (!list_empty (&bank->deferred_output)) { - cfg =list_first_entry (&bank->deferred_output, - struct rockchip_pin_output_deferred, head); +while (!list_empty (&bank->deferred_pins)) { + cfg =list_first_entry (&bank->deferred_pins, + struct rockchip_pin_deferred, head);list_del (&cfg->head); - ret =rockchip_gpio_direction_output (&bank->gpio_chip, cfg->pin, cfg->arg); -if (ret) -dev_warn (dev,"setting output pin %u to %u failed\n" , cfg->pin, cfg->arg); - +switch (cfg->param) { +case PIN_CONFIG_OUTPUT : + ret =rockchip_gpio_direction_output (&bank->gpio_chip, cfg->pin, cfg->arg); +if (ret) +dev_warn (dev,"setting output pin %u to %u failed\n" , cfg->pin, + cfg->arg); +break ; +default : +dev_warn (dev,"unknown deferred config param %d\n" , cfg->param); +break ; + }kfree (cfg); }
drivers/pinctrl/pinctrl-rockchip.c +29 -25
99 lines not on this page · raw message
drivers/pinctrl/pinctrl-rockchip.h +5 -2
@@ -171,7 +171,7 @@ struct rockchip_pin_bank {u32 toggle_edge_mode;u32 recalced_mask;u32 route_mask; -struct list_head deferred_output; +struct list_head deferred_pins;struct mutex deferred_lock; };
@@ -247,9 +247,12 @@ struct rockchip_pin_config {unsigned int nconfigs; }; -struct rockchip_pin_output_deferred { +enum pin_config_param ; + +struct rockchip_pin_deferred {struct list_head head;unsigned int pin; +enum pin_config_param param;u32 arg; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 417/667 pinctrl: mediatek: mt8195: enable driver on mtk platforms
In reply to Greg Kroah-HartmanFrom: Fabien Parent <[email protected]>
[ Upstream commit 931d7fa89e640dea146e00b77c1d73459e66ab6e ]
Set the pinctrl driver as built-in by default if
ARM64 and ARCH_MEDIATEK are enabled.
--- drivers/pinctrl/mediatek/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/mediatek/Kconfig +1 -0
@@ -152,6 +152,7 @@ config PINCTRL_MT8195 bool "Mediatek MT8195 pin control" depends on OF depends on ARM64 || COMPILE_TEST + default ARM64 && ARCH_MEDIATEK select PINCTRL_MTK_PARIS config PINCTRL_MT8365
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 418/667 arm64: dts: qcom: qrb5165-rb5: Fix can-clock node name
In reply to Greg Kroah-HartmanFrom: Vinod Koul <[email protected]>
[ Upstream commit 1eae95fb1d696968ca72be3ac8e0d62bb4d8da42 ]
Per DT spec node names should not have underscores (_) in them, so change can_clock to can-clock.
--- arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/qrb5165-rb5.dts +1 -1
@@ -27,7 +27,7 @@ }; /* Fixed crystal oscillator dedicated to MCP2518FD */ - clk40M: can_clock { + clk40M: can-clock { compatible = "fixed-clock"; #clock-cells = <0>; clock-frequency = <40000000>;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 419/667 Drivers: hv: vmbus: Fix handling of messages with transaction ID of zero
In reply to Greg Kroah-HartmanFrom: Andrea Parri (Microsoft) <[email protected]>
[ Upstream commit 82cd4bacff88a11e36f143e2cb950174b09c86c3 ]
vmbus_request_addr() returns 0 (zero) if the transaction ID passed to as argument is 0. This is unfortunate for two reasons: first, netvsc_send_completion() does not check for a NULL cmd_rqst (before dereferencing the corresponding NVSP message); second, 0 is a *valid* value of cmd_rqst in netvsc_send_tx_complete(), cf. the call of vmbus_sendpacket() in netvsc_send_pkt().
vmbus_request_addr() has included the code in question since its introduction with commit e8b7db38449ac ("Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus hardening"); such code was motivated by the early use of vmbus_requestor by hv_storvsc. Since hv_storvsc moved to a tag-based mechanism to generate and retrieve transaction IDs with commit bf5fd8cae3c8f ("scsi: storvsc: Use blk_mq_unique_tag() to generate requestIDs"), vmbus_request_addr() can be modified to return VMBUS_RQST_ERROR if the ID is 0. This change solves the issues in hv_netvsc (and makes the handling of messages with transaction ID of 0 consistent with the semantics "the ID is not contained in the requestor/invalid ID").
vmbus_next_request_id(), vmbus_request_addr() should still reserve the ID of 0 for Hyper-V, because Hyper-V will "ignore" (not respond to) VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED packets/requests with transaction ID of 0 from the guest.
--- drivers/hv/channel.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/hv/channel.c +4 -2
@@ -1221,7 +1221,9 @@ u64 vmbus_next_request_id(struct vmbus_channel *channel, u64 rqst_addr)/* * Cannot return an ID of 0, which is reserved for an unsolicited -* message from Hyper-V. +* message from Hyper-V; Hyper-V does not acknowledge (respond to) +* VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED requests with ID of +* 0 sent by the guest. */ return current_id +1 ; }
@@ -1246,7 +1248,7 @@ u64 vmbus_request_addr(struct vmbus_channel *channel, u64 trans_id)/* Hyper-V can send an unsolicited message with ID of 0 */ if (!trans_id) -return trans_id; +return VMBUS_RQST_ERROR ;spin_lock_irqsave (&rqstor->req_lock, flags);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 420/667 powerpc/fadump: fix PT_LOAD segment for boot memory area
In reply to Greg Kroah-HartmanFrom: Hari Bathini <[email protected]>
[ Upstream commit 15eb77f873255cf9f4d703b63cfbd23c46579654 ]
Boot memory area is setup as separate PT_LOAD segment in the vmcore as it is moved by f/w, on crash, to a destination address provided by the kernel. Having separate PT_LOAD segment helps in handling the different physical address and offset for boot memory area in the vmcore.
Commit ced1bf52f477 ("powerpc/fadump: merge adjacent memory ranges to reduce PT_LOAD segements") inadvertly broke this pre-condition for cases where some of the first kernel memory is available adjacent to boot memory area. This scenario is rare but possible when memory for fadump could not be reserved adjacent to boot memory area owing to memory hole or such. Reading memory from a vmcore exported in such scenario provides incorrect data. Fix it by ensuring no other region is folded into boot memory area.
--- arch/powerpc/kernel/fadump.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
arch/powerpc/kernel/fadump.c +6 -2
@@ -861,7 +861,6 @@ static int fadump_alloc_mem_ranges(struct fadump_mrange_info *mrange_info) sizeof(struct fadump_memory_range));return 0 ; } -static inline int fadump_add_mem_range (struct fadump_mrange_info *mrange_info,u64 base,u64 end) {
@@ -880,7 +879,12 @@ static inline int fadump_add_mem_range(struct fadump_mrange_info *mrange_info, start = mem_ranges[mrange_info->mem_range_cnt -1 ].base; size = mem_ranges[mrange_info->mem_range_cnt -1 ].size; -if ((start + size) == base) +/* +* Boot memory area needs separate PT_LOAD segment(s) as it +* is moved to a different location at the time of crash. +* So, fold only if the region is not boot memory area. +*/ +if ((start + size) == base && start >= fw_dump.boot_mem_top) is_adjacent = true; }if (!is_adjacent) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 421/667 mfd: ipaq-micro: Fix error check return value of platform_get_irq()
In reply to Greg Kroah-HartmanFrom: Lv Ruyi <[email protected]>
[ Upstream commit 3b49ae380ce1a3054e0c505dd9a356b82a5b48e8 ]
platform_get_irq() return negative value on failure, so null check of irq is incorrect. Fix it by comparing whether it is less than zero.
--- drivers/mfd/ipaq-micro.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mfd/ipaq-micro.c +1 -1
@@ -403,7 +403,7 @@ static int __init micro_probe(struct platform_device *pdev)micro_reset_comm (micro); irq =platform_get_irq (pdev,0 ); -if (!irq) +if (irq <0 )return -EINVAL ; ret = devm_request_irq(&pdev->dev, irq, micro_serial_isr, IRQF_SHARED, "ipaq-micro",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 422/667 scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac()
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
[ Upstream commit 54db804d5d7d36709d1ce70bde3b9a6c61b290b6 ]
Fix the following Wstringop-overflow warnings when building with GCC-11:
drivers/scsi/fcoe/fcoe.c: In function ‘fcoe_netdev_config’:drivers/scsi/fcoe/fcoe.c:744:32: warning: ‘fcoe_wwn_from_mac’ accessing 32 bytes in a region of size 6 [-Wstringop-overflow=]
744 | wwnn = fcoe_wwn_from_mac(ctlr->ctl_src_addr, 1, 0);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/scsi/fcoe/fcoe.c:744:32: note: referencing argument 1 of type ‘unsigned char *’
In file included from drivers/scsi/fcoe/fcoe.c:36:
./include/scsi/libfcoe.h:252:5: note: in a call to function ‘fcoe_wwn_from_mac’
252 | u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN], unsigned int, unsigned int);
| ^~~~~~~~~~~~~~~~~
drivers/scsi/fcoe/fcoe.c:747:32: warning: ‘fcoe_wwn_from_mac’ accessing 32 bytes in a region of size 6 [-Wstringop-overflow=]
747 | wwpn = fcoe_wwn_from_mac(ctlr->ctl_src_addr,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
748 | 2, 0);
| ~~~~~
drivers/scsi/fcoe/fcoe.c:747:32: note: referencing argument 1 of type ‘unsigned char *’
In file included from drivers/scsi/fcoe/fcoe.c:36:
./include/scsi/libfcoe.h:252:5: note: in a call to function ‘fcoe_wwn_from_mac’
252 | u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN], unsigned int, unsigned int);
| ^~~~~~~~~~~~~~~~~ CC drivers/scsi/bnx2fc/bnx2fc_io.o
In function ‘bnx2fc_net_config’,
inlined from ‘bnx2fc_if_create’ at drivers/scsi/bnx2fc/bnx2fc_fcoe.c:1543:7:drivers/scsi/bnx2fc/bnx2fc_fcoe.c:833:32: warning: ‘fcoe_wwn_from_mac’ accessing 32 bytes in a region of size 6 [-Wstringop-overflow=]
833 | wwnn = fcoe_wwn_from_mac(ctlr->ctl_src_addr,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
834 | 1, 0);
| ~~~~~
drivers/scsi/bnx2fc/bnx2fc_fcoe.c: In function ‘bnx2fc_if_create’:
drivers/scsi/bnx2fc/bnx2fc_fcoe.c:833:32: note: referencing argument 1 of type ‘unsigned char *’
In file included from drivers/scsi/bnx2fc/bnx2fc.h:53,
from drivers/scsi/bnx2fc/bnx2fc_fcoe.c:17:
./include/scsi/libfcoe.h:252:5: note: in a call to function ‘fcoe_wwn_from_mac’
252 | u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN], unsigned int, unsigned int);
| ^~~~~~~~~~~~~~~~~
In function ‘bnx2fc_net_config’,
inlined from ‘bnx2fc_if_create’ at drivers/scsi/bnx2fc/bnx2fc_fcoe.c:1543:7:
drivers/scsi/bnx2fc/bnx2fc_fcoe.c:839:32: warning: ‘fcoe_wwn_from_mac’ accessing 32 bytes in a region of size 6 [-Wstringop-overflow=]
839 | wwpn = fcoe_wwn_from_mac(ctlr->ctl_src_addr,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
840 | 2, 0);
| ~~~~~
drivers/scsi/bnx2fc/bnx2fc_fcoe.c: In function ‘bnx2fc_if_create’:
drivers/scsi/bnx2fc/bnx2fc_fcoe.c:839:32: note: referencing argument 1 of type ‘unsigned char *’
In file included from drivers/scsi/bnx2fc/bnx2fc.h:53,
from drivers/scsi/bnx2fc/bnx2fc_fcoe.c:17:
./include/scsi/libfcoe.h:252:5: note: in a call to function ‘fcoe_wwn_from_mac’
252 | u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN], unsigned int, unsigned int);
| ^~~~~~~~~~~~~~~~~
drivers/scsi/qedf/qedf_main.c: In function ‘__qedf_probe’:
drivers/scsi/qedf/qedf_main.c:3520:30: warning: ‘fcoe_wwn_from_mac’ accessing 32 bytes in a region of size 6 [-Wstringop-overflow=]
3520 | qedf->wwnn = fcoe_wwn_from_mac(qedf->mac, 1, 0);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~drivers/scsi/qedf/qedf_main.c:3520:30: note: referencing argument 1 of type ‘unsigned char *’ In file included from drivers/scsi/qedf/qedf.h:9,
from drivers/scsi/qedf/qedf_main.c:23:./include/scsi/libfcoe.h:252:5: note: in a call to function ‘fcoe_wwn_from_mac’
252 | u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN], unsigned int, unsigned int);
| ^~~~~~~~~~~~~~~~~
drivers/scsi/qedf/qedf_main.c:3521:30: warning: ‘fcoe_wwn_from_mac’ accessing 32 bytes in a region of size 6 [-Wstringop-overflow=]
3521 | qedf->wwpn = fcoe_wwn_from_mac(qedf->mac, 2, 0);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~drivers/scsi/qedf/qedf_main.c:3521:30: note: referencing argument 1 of type ‘unsigned char *’ In file included from drivers/scsi/qedf/qedf.h:9,
from drivers/scsi/qedf/qedf_main.c:23:./include/scsi/libfcoe.h:252:5: note: in a call to function ‘fcoe_wwn_from_mac’
252 | u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN], unsigned int, unsigned int);
| ^~~~~~~~~~~~~~~~~by changing the array size to the correct value of ETH_ALEN in the argument declaration.
Also, fix a couple of checkpatch warnings:
WARNING: function definition argument 'unsigned int' should also have an identifier name
This helps with the ongoing efforts to globally enable -Wstringop-overflow.
--- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- include/scsi/libfcoe.h | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-)
drivers/scsi/fcoe/fcoe_ctlr.c +1 -1
@@ -1969,7 +1969,7 @@ EXPORT_SYMBOL(fcoe_ctlr_recv_flogi);* * Returns: u64 fc world wide name */ -u64 fcoe_wwn_from_mac (unsigned char mac[MAX_ADDR_LEN ], +u64 fcoe_wwn_from_mac (unsigned char mac[ETH_ALEN ],unsigned int scheme,unsigned int port) {u64 wwn;
include/scsi/libfcoe.h +2 -1
@@ -249,7 +249,8 @@ int fcoe_ctlr_recv_flogi(struct fcoe_ctlr *, struct fc_lport *, struct fc_frame *);/* libfcoe funcs */ -u64 fcoe_wwn_from_mac (unsigned char mac[MAX_ADDR_LEN ],unsigned int ,unsigned int ); +u64 fcoe_wwn_from_mac (unsigned char mac[ETH_ALEN ],unsigned int scheme, +unsigned int port);int fcoe_libfc_config (struct fc_lport *,struct fcoe_ctlr *,const struct libfc_function_template *,int init_fcp);u32 fcoe_fc_crc (struct fc_frame *fp);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 423/667 soc: bcm: Check for NULL return of devm_kzalloc()
In reply to Greg Kroah-HartmanFrom: QintaoShen <[email protected]>
[ Upstream commit b4bd2aafacce48db26b0a213d849818d940556dd ]
As the potential failure of allocation, devm_kzalloc() may return NULL. Then the 'pd->pmb' and the follow lines of code may bring null pointer dereference.
Therefore, it is better to check the return value of devm_kzalloc() to avoid this confusion.
--- drivers/soc/bcm/bcm63xx/bcm-pmb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/soc/bcm/bcm63xx/bcm-pmb.c +3 -0
@@ -314,6 +314,9 @@ static int bcm_pmb_probe(struct platform_device *pdev)for (e = table; e->name; e++) {struct bcm_pmb_pm_domain *pd =devm_kzalloc (dev,sizeof (*pd),GFP_KERNEL ); +if (!pd) +return -ENOMEM ; + pd->pmb = pmb; pd->data = e; pd->genpd.name = e->name;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 424/667 arm64: dts: ti: k3-am64-mcu: remove incorrect UART base clock rates
In reply to Greg Kroah-HartmanFrom: Matthias Schiffer <[email protected]>
[ Upstream commit 439677d416b17dd39964d5f7d64b742a2e51da5b ]
We found that (at least some versions of) the sci-fw set the base clock rate for UARTs in the MCU domain to 96 MHz instead of the expected 48 MHz, leading to incorrect baud rates when used from Linux.
As the 8250_omap driver will query the actual clock rate from the clk driver when clock-frequency is unset, removing the incorrect property is sufficient to fix the baud rate.
--- arch/arm64/boot/dts/ti/k3-am64-mcu.dtsi | 2 -- 1 file changed, 2 deletions(-)
arch/arm64/boot/dts/ti/k3-am64-mcu.dtsi +0 -2
@@ -10,7 +10,6 @@ compatible = "ti,am64-uart", "ti,am654-uart"; reg = <0x00 0x04a00000 0x00 0x100>; interrupts = <GIC_SPI 185 IRQ_TYPE_LEVEL_HIGH>; - clock-frequency = <48000000>; current-speed = <115200>; power-domains = <&k3_pds 149 TI_SCI_PD_EXCLUSIVE>; clocks = <&k3_clks 149 0>;
@@ -21,7 +20,6 @@ compatible = "ti,am64-uart", "ti,am654-uart"; reg = <0x00 0x04a10000 0x00 0x100>; interrupts = <GIC_SPI 186 IRQ_TYPE_LEVEL_HIGH>; - clock-frequency = <48000000>; current-speed = <115200>; power-domains = <&k3_pds 160 TI_SCI_PD_EXCLUSIVE>; clocks = <&k3_clks 160 0>;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 425/667 ASoC: sh: rz-ssi: Check return value of pm_runtime_resume_and_get()
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
[ Upstream commit f04b4fb47d83b110a5b007fb2eddea862cfeb151 ]
The return value of pm_runtime_resume_and_get() needs to be checked to avoid a usage count imbalance in the error case. This fix is basically the same as 92c959bae2e5 ("reset: renesas: Fix Runtime PM usage"), and the last step before pm_runtime_resume_and_get() can be annotated as __must_check.
--- sound/soc/sh/rz-ssi.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
sound/soc/sh/rz-ssi.c +6 -1
@@ -1025,7 +1025,12 @@ static int rz_ssi_probe(struct platform_device *pdev)reset_control_deassert (ssi->rstc);pm_runtime_enable (&pdev->dev); -pm_runtime_resume_and_get (&pdev->dev); + ret =pm_runtime_resume_and_get (&pdev->dev); +if (ret <0 ) { +pm_runtime_disable (ssi->dev); +reset_control_assert (ssi->rstc); +return dev_err_probe (ssi->dev, ret,"pm_runtime_resume_and_get failed\n" ); + } ret = devm_snd_soc_register_component(&pdev->dev, &rz_ssi_soc_component, rz_ssi_soc_dai,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 426/667 ASoC: sh: rz-ssi: Propagate error codes returned from platform_get_irq_byname()
In reply to Greg Kroah-HartmanFrom: Lad Prabhakar <[email protected]>
[ Upstream commit 91686a3984f34df0ab844cdbaa7e4d9621129f5d ]
Propagate error codes returned from platform_get_irq_byname() instead of returning -ENODEV. platform_get_irq_byname() may return -EPROBE_DEFER, to handle such cases propagate the error codes.
While at it drop the dev_err_probe() messages as platform_get_irq_byname() already does this for us in case of error.
--- sound/soc/sh/rz-ssi.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
sound/soc/sh/rz-ssi.c +3 -6
@@ -983,8 +983,7 @@ static int rz_ssi_probe(struct platform_device *pdev)/* Error Interrupt */ ssi->irq_int =platform_get_irq_byname (pdev,"int_req" );if (ssi->irq_int <0 ) -return dev_err_probe (&pdev->dev, -ENODEV , -"Unable to get SSI int_req IRQ\n" ); +return ssi->irq_int; ret =devm_request_irq (&pdev->dev, ssi->irq_int, &rz_ssi_interrupt,0 ,dev_name (&pdev->dev), ssi);
@@ -996,8 +995,7 @@ static int rz_ssi_probe(struct platform_device *pdev)/* Tx and Rx interrupts (pio only) */ ssi->irq_tx =platform_get_irq_byname (pdev,"dma_tx" );if (ssi->irq_tx <0 ) -return dev_err_probe (&pdev->dev, -ENODEV , -"Unable to get SSI dma_tx IRQ\n" ); +return ssi->irq_tx; ret = devm_request_irq(&pdev->dev, ssi->irq_tx, &rz_ssi_interrupt, 0,
@@ -1008,8 +1006,7 @@ static int rz_ssi_probe(struct platform_device *pdev) ssi->irq_rx =platform_get_irq_byname (pdev,"dma_rx" );if (ssi->irq_rx <0 ) -return dev_err_probe (&pdev->dev, -ENODEV , -"Unable to get SSI dma_rx IRQ\n" ); +return ssi->irq_rx; ret = devm_request_irq(&pdev->dev, ssi->irq_rx, &rz_ssi_interrupt, 0,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 427/667 ASoC: sh: rz-ssi: Release the DMA channels in rz_ssi_probe() error path
In reply to Greg Kroah-HartmanFrom: Lad Prabhakar <[email protected]>
[ Upstream commit 767e6f26204d3f5406630e86b720d01818b8616d ]
DMA channels requested by rz_ssi_dma_request() in rz_ssi_probe() were never released in the error path apart from one place. This patch fixes this issue by calling rz_ssi_release_dma_channels() in the error path.
--- sound/soc/sh/rz-ssi.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
sound/soc/sh/rz-ssi.c +10 -3
@@ -982,14 +982,18 @@ static int rz_ssi_probe(struct platform_device *pdev)/* Error Interrupt */ ssi->irq_int =platform_get_irq_byname (pdev,"int_req" ); -if (ssi->irq_int <0 ) +if (ssi->irq_int <0 ) { +rz_ssi_release_dma_channels (ssi);return ssi->irq_int; + } ret =devm_request_irq (&pdev->dev, ssi->irq_int, &rz_ssi_interrupt,0 ,dev_name (&pdev->dev), ssi); -if (ret <0 ) +if (ret <0 ) { +rz_ssi_release_dma_channels (ssi);return dev_err_probe (&pdev->dev, ret,"irq request error (int_req)\n" ); + }if (!rz_ssi_is_dma_enabled (ssi)) {/* Tx and Rx interrupts (pio only) */
@@ -1017,13 +1021,16 @@ static int rz_ssi_probe(struct platform_device *pdev) } ssi->rstc =devm_reset_control_get_exclusive (&pdev->dev,NULL ); -if (IS_ERR (ssi->rstc)) +if (IS_ERR (ssi->rstc)) { +rz_ssi_release_dma_channels (ssi);return PTR_ERR (ssi->rstc); + }reset_control_deassert (ssi->rstc);pm_runtime_enable (&pdev->dev); ret =pm_runtime_resume_and_get (&pdev->dev);if (ret <0 ) { +rz_ssi_release_dma_channels (ssi);pm_runtime_disable (ssi->dev);reset_control_assert (ssi->rstc);return dev_err_probe (ssi->dev, ret,"pm_runtime_resume_and_get failed\n" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 428/667 firmware: arm_scmi: Fix list protocols enumeration in the base protocol
In reply to Greg Kroah-HartmanFrom: Cristian Marussi <[email protected]>
[ Upstream commit 8009120e0354a67068e920eb10dce532391361d0 ]
While enumerating protocols implemented by the SCMI platform using BASE_DISCOVER_LIST_PROTOCOLS, the number of returned protocols is currently validated in an improper way since the check employs a sum between unsigned integers that could overflow and cause the check itself to be silently bypassed if the returned value 'loop_num_ret' is big enough.
Fix the validation avoiding the addition.
--- drivers/firmware/arm_scmi/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/arm_scmi/base.c +1 -1
@@ -197,7 +197,7 @@ scmi_base_implementation_list_get(const struct scmi_protocol_handle *ph,break ; loop_num_ret =le32_to_cpu (*num_ret); -if (tot_num_ret + loop_num_ret >MAX_PROTOCOLS_IMP ) { +if (loop_num_ret >MAX_PROTOCOLS_IMP - tot_num_ret) {dev_err (dev,"No. of Protocol > MAX_PROTOCOLS_IMP" );break ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 429/667 nvdimm: Fix firmware activation deadlock scenarios
In reply to Greg Kroah-HartmanFrom: Dan Williams <[email protected]>
[ Upstream commit e6829d1bd3c4b58296ee9e412f7ed4d6cb390192 ]
Lockdep reports the following deadlock scenarios for CXL root device power-management, device_prepare(), operations, and device_shutdown() operations for 'nd_region' devices:
Chain exists of: &nvdimm_region_key --> &nvdimm_bus->reconfig_mutex --> system_transition_mutex Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(system_transition_mutex);
lock(&nvdimm_bus->reconfig_mutex);
lock(system_transition_mutex); lock(&nvdimm_region_key);
Chain exists of: &cxl_nvdimm_bridge_key --> acpi_scan_lock --> &cxl_root_key Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&cxl_root_key);
lock(acpi_scan_lock);
lock(&cxl_root_key); lock(&cxl_nvdimm_bridge_key);
These stem from holding nvdimm_bus_lock() over hibernate_quiet_exec() which walks the entire system device topology taking device_lock() along the way. The nvdimm_bus_lock() is protecting against unregistration, multiple simultaneous ops callers, and preventing activate_show() from racing activate_store(). For the first 2, the lock is redundant. Unregistration already flushes all ops users, and sysfs already prevents multiple threads to be active in an ops handler at the same time. For the last userspace should already be waiting for its last activate_store() to complete, and does not need activate_show() to flush the write side, so this lock usage can be deleted in these attributes.
--- drivers/nvdimm/core.c | 9 --------- 1 file changed, 9 deletions(-)
drivers/nvdimm/core.c +0 -9
@@ -399,9 +399,7 @@ static ssize_t capability_show(struct device *dev,if (!nd_desc->fw_ops)return -EOPNOTSUPP ; -nvdimm_bus_lock (dev); cap = nd_desc->fw_ops->capability (nd_desc); -nvdimm_bus_unlock (dev);switch (cap) {case NVDIMM_FWA_CAP_QUIESCE :
@@ -426,10 +424,8 @@ static ssize_t activate_show(struct device *dev,if (!nd_desc->fw_ops)return -EOPNOTSUPP ; -nvdimm_bus_lock (dev); cap = nd_desc->fw_ops->capability (nd_desc); state = nd_desc->fw_ops->activate_state (nd_desc); -nvdimm_bus_unlock (dev);if (cap <NVDIMM_FWA_CAP_QUIESCE )return -EOPNOTSUPP ;
@@ -474,7 +470,6 @@ static ssize_t activate_store(struct device *dev,else return -EINVAL ; -nvdimm_bus_lock (dev); state = nd_desc->fw_ops->activate_state (nd_desc);switch (state) {
@@ -492,7 +487,6 @@ static ssize_t activate_store(struct device *dev,default : rc = -ENXIO ; } -nvdimm_bus_unlock (dev);if (rc ==0 ) rc = len;
@@ -515,10 +509,7 @@ static umode_t nvdimm_bus_firmware_visible(struct kobject *kobj, struct attributif (!nd_desc->fw_ops)return 0 ; -nvdimm_bus_lock (dev); cap = nd_desc->fw_ops->capability (nd_desc); -nvdimm_bus_unlock (dev); -if (cap <NVDIMM_FWA_CAP_QUIESCE )return 0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 430/667 nvdimm: Allow overwrite in the presence of disabled dimms
In reply to Greg Kroah-HartmanFrom: Dan Williams <[email protected]>
[ Upstream commit bb7bf697fed58eae9d3445944e457ab0de4da54f ]
It is not clear why the original implementation of overwrite support required the dimm driver to be active before overwrite could proceed. In fact that can lead to cases where the kernel retains an invalid cached copy of the labels from before the overwrite. Unfortunately the kernel has not only allowed that case, but enforced it.
Going forward, allow for overwrite to happen while the label area is offline, and follow-on with updates to 'ndctl sanitize-dimm --overwrite' to trigger the label area invalidation by default.
--- drivers/nvdimm/security.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/nvdimm/security.c +0 -5
@@ -379,11 +379,6 @@ static int security_overwrite(struct nvdimm *nvdimm, unsigned int keyid) || !nvdimm->sec.flags)return -EOPNOTSUPP ; -if (dev->driver ==NULL ) { -dev_dbg (dev,"Unable to overwrite while DIMM active.\n" ); -return -EINVAL ; - } - rc =check_security_state (nvdimm);if (rc)return rc;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 431/667 pinctrl: mvebu: Fix irq_of_parse_and_map() return value
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 71bc7cf3be65bab441e03667cf215c557712976c ]
The irq_of_parse_and_map() returns 0 on failure, not a negative ERRNO.
--- drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +1 -1
@@ -781,7 +781,7 @@ static int armada_37xx_irqchip_register(struct platform_device *pdev,for (i =0 ; i < nr_irq_parent; i++) {int irq =irq_of_parse_and_map (np, i); -if (irq <0 ) +if (!irq)continue ; girq->parents[i] = irq; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 432/667 drivers/base/node.c: fix compaction sysfs file leak
In reply to Greg Kroah-HartmanFrom: Miaohe Lin <[email protected]>
[ Upstream commit da63dc84befaa9e6079a0bc363ff0eaa975f9073 ]
Compaction sysfs file is created via compaction_register_node in register_node. But we forgot to remove it in unregister_node. Thus compaction sysfs file is leaked. Using compaction_unregister_node to fix this issue.
--- drivers/base/node.c | 1 + 1 file changed, 1 insertion(+)
drivers/base/node.c +1 -0
@@ -679,6 +679,7 @@ static int register_node(struct node *node, int num)*/ void unregister_node (struct node *node) { +compaction_unregister_node (node);hugetlb_unregister_node (node);/* no-op, if memoryless node */ node_remove_accesses (node);node_remove_caches (node);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 433/667 dax: fix cache flush on PMD-mapped pages
In reply to Greg Kroah-HartmanFrom: Muchun Song <[email protected]>
[ Upstream commit e583b5c472bd23d450e06f148dc1f37be74f7666 ]
The flush_cache_page() only remove a PAGE_SIZE sized range from the cache. However, it does not cover the full pages in a THP except a head page. Replace it with flush_cache_range() to fix this issue. This is just a documentation issue with the respect to properly documenting the expected usage of cache flushing before modifying the pmd. However, in practice this is not a problem due to the fact that DAX is not available on architectures with virtually indexed caches per:
commit d92576f1167c ("dax: does not work correctly with virtual aliasing caches")
--- fs/dax.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/dax.c +2 -1
@@ -846,7 +846,8 @@ static void dax_entry_mkclean(struct address_space *mapping, pgoff_t index,if (!pmd_dirty (*pmdp) && !pmd_write (*pmdp)) goto unlock_pmd; -flush_cache_page (vma, address, pfn); +flush_cache_range (vma, address, + address +HPAGE_PMD_SIZE ); pmd =pmdp_invalidate (vma, address, pmdp); pmd =pmd_wrprotect (pmd); pmd =pmd_mkclean (pmd);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 434/667 drivers/base/memory: fix an unlikely reference counting issue in __add_memory_block()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit f47f758cff59c68015d6b9b9c077110df7c2c828 ]
__add_memory_block() calls both put_device() and device_unregister() when storing the memory block into the xarray. This is incorrect because xarray doesn't take an additional reference and device_unregister() already calls put_device().
Triggering the issue looks really unlikely and its only effect should be to log a spurious warning about a ref counted issue.
--- drivers/base/memory.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/base/memory.c +2 -3
@@ -634,10 +634,9 @@ int register_memory(struct memory_block *memory) } ret =xa_err (xa_store (&memory_blocks, memory->dev.id, memory,GFP_KERNEL )); -if (ret) { -put_device (&memory->dev); +if (ret)device_unregister (&memory->dev); - } +return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 435/667 firmware: arm_ffa: Fix uuid parameter to ffa_partition_probe
In reply to Greg Kroah-HartmanFrom: Sudeep Holla <[email protected]>
[ Upstream commit f3c45c045e25ed52461829d2ce07954f72b6ad15 ]
While we pass uuid_null intentionally to ffa_partition_probe in ffa_setup_partitions to get the count of the partitions, it must not be uuid_null in ffa_partition_info_get which is used by the ffa_drivers to fetch the specific partition info passing the UUID of the partition.
Fix ffa_partition_info_get by passing the received uuid down to ffa_partition_probe so that the correct partition information is fetched.
--- drivers/firmware/arm_ffa/driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/arm_ffa/driver.c +1 -1
@@ -556,7 +556,7 @@ static int ffa_partition_info_get(const char *uuid_str,return -ENODEV ; } - count =ffa_partition_probe (&uuid_null, &pbuf); + count =ffa_partition_probe (&uuid, &pbuf);if (count <=0 )return -ENOENT ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 436/667 firmware: arm_ffa: Remove incorrect assignment of driver_data
In reply to Greg Kroah-HartmanFrom: Sudeep Holla <[email protected]>
[ Upstream commit 00512d2930b338fdd42bd90bbd1793fe212c2d31 ]
The ffa core driver currently assigns its own driver information to individual ffa device driver_data which is wrong. Firstly, it leaks this core driver information to individual ffa_device and hence to ffa_driver. Secondly the ffa_device driver_data is for use by individual ffa_driver and not for this core driver managing all those devices.
--- drivers/firmware/arm_ffa/driver.c | 2 -- 1 file changed, 2 deletions(-)
drivers/firmware/arm_ffa/driver.c +0 -2
@@ -645,8 +645,6 @@ static void ffa_setup_partitions(void) __func__, tpbuf->id);continue ; } - -ffa_dev_set_drvdata (ffa_dev, drv_info); }kfree (pbuf); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 437/667 list: introduce list_is_head() helper and re-use it in list.h
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 0425473037db40d9e322631f2d4dc6ef51f97e88 ]
Introduce list_is_head() in the similar (*) way as it's done for list_entry_is_head(). Make use of it in the list.h.
*) it's done as inliner and not a macro to be aligned with other
list_is_*() APIs; while at it, make all three to have the same style.
--- include/linux/list.h | 36 ++++++++++++++++++++++-------------- 1 file changed, 22 insertions(+), 14 deletions(-)
include/linux/list.h +22 -14
@@ -256,8 +256,7 @@ static inline void list_bulk_move_tail(struct list_head *head,* @list: the entry to test * @head: the head of the list */ -static inline int list_is_first (const struct list_head *list, -const struct list_head *head) +static inline int list_is_first (const struct list_head *list,const struct list_head *head) {return list->prev == head; }
@@ -267,12 +266,21 @@ static inline int list_is_first(const struct list_head *list,* @list: the entry to test * @head: the head of the list */ -static inline int list_is_last (const struct list_head *list, -const struct list_head *head) +static inline int list_is_last (const struct list_head *list,const struct list_head *head) {return list->next == head; } +/** +* list_is_head - tests whether @list is the list @head +* @list: the entry to test +* @head: the head of the list +*/ +static inline int list_is_head (const struct list_head *list,const struct list_head *head) +{ +return list == head; +} +/** * list_empty - tests whether a list is empty * @head: the list to test.
@@ -316,7 +324,7 @@ static inline void list_del_init_careful(struct list_head *entry)static inline int list_empty_careful (const struct list_head *head) {struct list_head *next =smp_load_acquire (&head->next); -return (next == head) && (next == head->prev); +return list_is_head (next, head) && (next == head->prev); }/**
@@ -391,10 +399,9 @@ static inline void list_cut_position(struct list_head *list, {if (list_empty (head))return ; -if (list_is_singular (head) && - (head->next != entry && head != entry)) +if (list_is_singular (head) && !list_is_head (entry, head) && (entry != head->next))return ; -if (entry == head) +if (list_is_head (entry, head))INIT_LIST_HEAD (list);else __list_cut_position (list, head, entry);
@@ -568,7 +575,7 @@ static inline void list_splice_tail_init(struct list_head *list,* @head: the head for your list. */ #define list_for_each (pos, head) \ - for (pos = (head)->next; pos != (head); pos = pos->next) + for (pos = (head)->next; !list_is_head(pos, (head)); pos = pos->next)/** * list_for_each_continue - continue iteration over a list
@@ -578,7 +585,7 @@ static inline void list_splice_tail_init(struct list_head *list,* Continue to iterate over a list, continuing after the current position. */ #define list_for_each_continue (pos, head) \ - for (pos = pos->next; pos != (head); pos = pos->next) + for (pos = pos->next; !list_is_head(pos, (head)); pos = pos->next)/** * list_for_each_prev - iterate over a list backwards
@@ -586,7 +593,7 @@ static inline void list_splice_tail_init(struct list_head *list,* @head: the head for your list. */ #define list_for_each_prev (pos, head) \ - for (pos = (head)->prev; pos != (head); pos = pos->prev) + for (pos = (head)->prev; !list_is_head(pos, (head)); pos = pos->prev)/** * list_for_each_safe - iterate over a list safe against removal of list entry
@@ -595,8 +602,9 @@ static inline void list_splice_tail_init(struct list_head *list,* @head: the head for your list. */ #define list_for_each_safe (pos, n, head) \ - for (pos = (head)->next, n = pos->next; pos != (head); \ - pos = n, n = pos->next) + for (pos = (head)->next, n = pos->next; \ + !list_is_head(pos, (head)); \ + pos = n, n = pos->next)/** * list_for_each_prev_safe - iterate over a list backwards safe against removal of list entry
@@ -606,7 +614,7 @@ static inline void list_splice_tail_init(struct list_head *list,*/ #define list_for_each_prev_safe (pos, n, head) \ for (pos = (head)->prev, n = pos->prev; \ - pos != (head); \ + !list_is_head(pos, (head)); \ pos = n, n = pos->prev)/**
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 438/667 list: fix a data-race around ep->rdllist
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
[ Upstream commit d679ae94fdd5d3ab00c35078f5af5f37e068b03d ]
ep_poll() first calls ep_events_available() with no lock held and checks if ep->rdllist is empty by list_empty_careful(), which reads rdllist->prev. Thus all accesses to it need some protection to avoid store/load-tearing.
Note INIT_LIST_HEAD_RCU() already has the annotation for both prev and next.
Commit bf3b9f6372c4 ("epoll: Add busy poll support to epoll with socket fds.") added the first lockless ep_events_available(), and commit c5a282e9635e ("fs/epoll: reduce the scope of wq lock in epoll_wait()") made some ep_events_available() calls lockless and added single call under a lock, finally commit e59d3c64cba6 ("epoll: eliminate unnecessary lock for zero timeout") made the last ep_events_available() lockless.
BUG: KCSAN: data-race in do_epoll_wait / do_epoll_wait
write to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0:
INIT_LIST_HEAD include/linux/list.h:38 [inline] list_splice_init include/linux/list.h:492 [inline] ep_start_scan fs/eventpoll.c:622 [inline] ep_send_events fs/eventpoll.c:1656 [inline] ep_poll fs/eventpoll.c:1806 [inline] do_epoll_wait+0x4eb/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae
read to 0xffff88810480c7d8 of 8 bytes by task 1799 on cpu 1:
list_empty_careful include/linux/list.h:329 [inline] ep_events_available fs/eventpoll.c:381 [inline] ep_poll fs/eventpoll.c:1797 [inline] do_epoll_wait+0x279/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae
value changed: 0xffff88810480c7d0 -> 0xffff888103c15098
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 1799 Comm: syz-fuzzer Tainted: G W 5.17.0-rc7-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
--- include/linux/list.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
include/linux/list.h +3 -3
@@ -33,7 +33,7 @@static inline void INIT_LIST_HEAD (struct list_head *list) {WRITE_ONCE (list->next, list); - list->prev = list; +WRITE_ONCE (list->prev, list); }#ifdef CONFIG_DEBUG_LIST
@@ -304,7 +304,7 @@ static inline int list_empty(const struct list_head *head)static inline void list_del_init_careful (struct list_head *entry) {__list_del_entry (entry); - entry->prev = entry; +WRITE_ONCE (entry->prev, entry);smp_store_release (&entry->next, entry); }
@@ -324,7 +324,7 @@ static inline void list_del_init_careful(struct list_head *entry)static inline int list_empty_careful (const struct list_head *head) {struct list_head *next =smp_load_acquire (&head->next); -return list_is_head (next, head) && (next == head->prev); +return list_is_head (next, head) && (next ==READ_ONCE (head->prev)); }/**
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 439/667 drm/msm/dpu: fix error check return value of irq_of_parse_and_map()
In reply to Greg Kroah-HartmanFrom: Lv Ruyi <[email protected]>
[ Upstream commit 95093595914c17f32e1d6228b4db06fab8cebd35 ]
The irq_of_parse_and_map() function returns 0 on failure, and does not return a negative value anyhow, so never enter this conditional branch.
Patchwork: https://patchwork.freedesktop.org/patch/483291/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +1 -1
@@ -1188,7 +1188,7 @@ static int dpu_bind(struct device *dev, struct device *master, void *data) priv->kms = &dpu_kms->base; -return ret; +return 0 ; }static void dpu_unbind (struct device *dev,struct device *master,void *data)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 440/667 powerpc/8xx: export cpm_setbrg for modules
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 22f8e625ebabd7ed3185b82b44b4f12fc0402113 ]
Fix missing export for a loadable module build:
ERROR: modpost: "cpm_setbrg" [drivers/tty/serial/cpm_uart/cpm_uart.ko] undefined!
--- arch/powerpc/platforms/8xx/cpm1.c | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/platforms/8xx/cpm1.c +1 -0
@@ -280,6 +280,7 @@ cpm_setbrg(uint brg, uint rate)out_be32 (bp, (((BRG_UART_CLK_DIV16 / rate) -1 ) <<1 ) |CPM_BRG_EN |CPM_BRG_DIV16 ); } +EXPORT_SYMBOL (cpm_setbrg);struct cpm_ioport16 {__be16 dir, par, odr_sor, dat, intr;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 441/667 pinctrl: renesas: r8a779a0: Fix GPIO function on I2C-capable pins
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 4288caed9a6319b766dc0adf605c7b401180db34 ]
Unlike on R-Car Gen3 SoCs, setting a bit to zero in a GPIO / Peripheral Function Select Register (GPSRn) on R-Car V3U is not always sufficient to configure a pin for GPIO. For I2C-capable pins, the I2C function must also be explicitly disabled in the corresponding Module Select Register (MODSELn).
Add the missing FN_SEL_I2Ci_0 function enums to the pinmux_data[] array by temporarily overriding the GP_2_j_FN function enum to expand to two
enums: the original GP_2_j_FN enum to configure the GSPR register bits, and the missing FN_SEL_I2Ci_0 enum to configure the MODSEL register bits.
--- drivers/pinctrl/renesas/pfc-r8a779a0.c | 29 ++++++++++++++++++++++++++ 1 file changed, 29 insertions(+)
drivers/pinctrl/renesas/pfc-r8a779a0.c +29 -0
@@ -629,7 +629,36 @@ enum { };static const u16 pinmux_data[] = { +/* Using GP_2_[2-15] requires disabling I2C in MOD_SEL2 */ +#define GP_2_2_FN GP_2_2_FN, FN_SEL_I2C0_0 +#define GP_2_3_FN GP_2_3_FN, FN_SEL_I2C0_0 +#define GP_2_4_FN GP_2_4_FN, FN_SEL_I2C1_0 +#define GP_2_5_FN GP_2_5_FN, FN_SEL_I2C1_0 +#define GP_2_6_FN GP_2_6_FN, FN_SEL_I2C2_0 +#define GP_2_7_FN GP_2_7_FN, FN_SEL_I2C2_0 +#define GP_2_8_FN GP_2_8_FN, FN_SEL_I2C3_0 +#define GP_2_9_FN GP_2_9_FN, FN_SEL_I2C3_0 +#define GP_2_10_FN GP_2_10_FN, FN_SEL_I2C4_0 +#define GP_2_11_FN GP_2_11_FN, FN_SEL_I2C4_0 +#define GP_2_12_FN GP_2_12_FN, FN_SEL_I2C5_0 +#define GP_2_13_FN GP_2_13_FN, FN_SEL_I2C5_0 +#define GP_2_14_FN GP_2_14_FN, FN_SEL_I2C6_0 +#define GP_2_15_FN GP_2_15_FN, FN_SEL_I2C6_0PINMUX_DATA_GP_ALL (), +#undef GP_2_2_FN +#undef GP_2_3_FN +#undef GP_2_4_FN +#undef GP_2_5_FN +#undef GP_2_6_FN +#undef GP_2_7_FN +#undef GP_2_8_FN +#undef GP_2_9_FN +#undef GP_2_10_FN +#undef GP_2_11_FN +#undef GP_2_12_FN +#undef GP_2_13_FN +#undef GP_2_14_FN +#undef GP_2_15_FNPINMUX_SINGLE (MMC_D7 ),PINMUX_SINGLE (MMC_D6 ),
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 442/667 pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 5376e3d904532e657fd7ca1a9b1ff3d351527b90 ]
It will cause null-ptr-deref when using 'res', if platform_get_resource() returns NULL, so move using 'res' after devm_ioremap_resource() that will check it to avoid null-ptr-deref.
And use devm_platform_get_and_ioremap_resource() to simplify code.
--- drivers/pinctrl/renesas/core.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/pinctrl/renesas/core.c +3 -4
@@ -71,12 +71,11 @@ static int sh_pfc_map_resources(struct sh_pfc *pfc,/* Fill them. */ for (i =0 ; i < num_windows; i++) { - res =platform_get_resource (pdev,IORESOURCE_MEM , i); - windows->phys = res->start; - windows->size =resource_size (res); - windows->virt =devm_ioremap_resource (pfc->dev, res); + windows->virt =devm_platform_get_and_ioremap_resource (pdev, i, &res);if (IS_ERR (windows->virt))return -ENOMEM ; + windows->phys = res->start; + windows->size =resource_size (res); windows++; }for (i =0 ; i < num_irqs; i++)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 443/667 powerpc/idle: Fix return value of __setup() handler
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit b793a01000122d2bd133ba451a76cc135b5e162c ]
__setup() handlers should return 1 to obsolete_checksetup() in init/main.c to indicate that the boot option has been handled.
A return of 0 causes the boot option/value to be listed as an Unknown kernel parameter and added to init's (limited) argument or environment strings.
Also, error return codes don't mean anything to obsolete_checksetup() -- only non-zero (usually 1) or zero. So return 1 from powersave_off().
--- arch/powerpc/kernel/idle.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/idle.c +1 -1
@@ -37,7 +37,7 @@ static int __init powersave_off(char *arg) { ppc_md.power_save =NULL ; cpuidle_disable =IDLE_POWERSAVE_OFF ; -return 0 ; +return 1 ; }__setup ("powersave=off" , powersave_off);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 444/667 powerpc/4xx/cpm: Fix return value of __setup() handler
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 5bb99fd4090fe1acfdb90a97993fcda7f8f5a3d6 ]
__setup() handlers should return 1 to obsolete_checksetup() in init/main.c to indicate that the boot option has been handled.
A return of 0 causes the boot option/value to be listed as an Unknown kernel parameter and added to init's (limited) argument or environment strings.
Also, error return codes don't mean anything to obsolete_checksetup() -- only non-zero (usually 1) or zero. So return 1 from cpm_powersave_off().
--- arch/powerpc/platforms/4xx/cpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/4xx/cpm.c +1 -1
@@ -327,6 +327,6 @@ late_initcall(cpm_init);static int __init cpm_powersave_off (char *arg) { cpm.powersave_off =1 ; -return 0 ; +return 1 ; }__setup ("powersave=off" , cpm_powersave_off);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 445/667 RDMA/hns: Add the detection for CMDQ status in the device initialization process
In reply to Greg Kroah-HartmanFrom: Yangyang Li <[email protected]>
[ Upstream commit e8ea058edc2b225a68b307057a65599625daaebf ]
CMDQ may fail during HNS ROCEE initialization. The following is the log when the execution fails:
hns3 0000:bd:00.2: In reset process RoCE client reinit. hns3 0000:bd:00.2: CMDQ move tail from 840 to 839 hns3 0000:bd:00.2 hns_2: failed to set gid, ret = -11! hns3 0000:bd:00.2: CMDQ move tail from 840 to 839 <...>
hns3 0000:bd:00.2: CMDQ move tail from 840 to 839 hns3 0000:bd:00.2: CMDQ move tail from 840 to 0 hns3 0000:bd:00.2: [cmd]token 14e mailbox 20 timeout. hns3 0000:bd:00.2 hns_2: set HEM step 0 failed! hns3 0000:bd:00.2 hns_2: set HEM address to HW failed! hns3 0000:bd:00.2 hns_2: failed to alloc mtpt, ret = -16. infiniband hns_2: Couldn't create ib_mad PD infiniband hns_2: Couldn't open port 1
hns3 0000:bd:00.2: Reset done, RoCE client reinit finished.
However, even if ib_mad client registration failed, ib_register_device() still returns success to the driver.
In the device initialization process, CMDQ execution fails because HW/FW is abnormal. Therefore, if CMDQ fails, the initialization function should set CMDQ to a fatal error state and return a failure to the caller.
--- drivers/infiniband/hw/hns/hns_roce_device.h | 6 ++++++ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 21 +++++++++++++++++++++ 2 files changed, 27 insertions(+)
drivers/infiniband/hw/hns/hns_roce_device.h +6 -0
@@ -559,6 +559,11 @@ struct hns_roce_cmd_context {u16 busy; }; +enum hns_roce_cmdq_state { +HNS_ROCE_CMDQ_STATE_NORMAL , +HNS_ROCE_CMDQ_STATE_FATAL_ERR , +}; +struct hns_roce_cmdq {struct dma_pool *pool;struct semaphore poll_sem;
@@ -578,6 +583,7 @@ struct hns_roce_cmdq {* close device, switch into poll mode(non event mode) */ u8 use_events; +enum hns_roce_cmdq_state state; };struct hns_roce_cmd_mailbox {
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +21 -0
@@ -1273,6 +1273,16 @@ static int hns_roce_cmq_csq_done(struct hns_roce_dev *hr_dev)return tail == priv->cmq.csq.head; } +static void update_cmdq_status (struct hns_roce_dev *hr_dev) +{ +struct hns_roce_v2_priv *priv = hr_dev->priv; +struct hnae3_handle *handle = priv->handle; + +if (handle->rinfo.reset_state ==HNS_ROCE_STATE_RST_INIT || + handle->rinfo.instance_state ==HNS_ROCE_STATE_INIT ) + hr_dev->cmd.state =HNS_ROCE_CMDQ_STATE_FATAL_ERR ; +} +static int __hns_roce_cmq_send (struct hns_roce_dev *hr_dev,struct hns_roce_cmq_desc *desc,int num) {
@@ -1326,6 +1336,8 @@ static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, csq->head, tail); csq->head = tail; +update_cmdq_status (hr_dev); + ret = -EAGAIN ; }
@@ -1340,6 +1352,9 @@ static int hns_roce_cmq_send(struct hns_roce_dev *hr_dev,bool busy;int ret; +if (hr_dev->cmd.state ==HNS_ROCE_CMDQ_STATE_FATAL_ERR ) +return -EIO ; +if (!v2_chk_mbox_is_avail (hr_dev, &busy))return busy ? -EBUSY :0 ;
@@ -1536,6 +1551,9 @@ static void hns_roce_function_clear(struct hns_roce_dev *hr_dev) {int i; +if (hr_dev->cmd.state ==HNS_ROCE_CMDQ_STATE_FATAL_ERR ) +return ; +for (i = hr_dev->func_num -1 ; i >=0 ; i--) {__hns_roce_function_clear (hr_dev, i);if (i !=0 )
@@ -2818,6 +2836,9 @@ static int v2_wait_mbox_complete(struct hns_roce_dev *hr_dev, u32 timeout, mb_st = (struct hns_roce_mbox_status *)desc.data; end =msecs_to_jiffies (timeout) + jiffies;while (v2_chk_mbox_is_avail (hr_dev, &busy)) { +if (hr_dev->cmd.state ==HNS_ROCE_CMDQ_STATE_FATAL_ERR ) +return -EIO ; + status =0 ;hns_roce_cmq_setup_basic_desc (&desc,HNS_ROCE_OPC_QUERY_MB_ST , true);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 446/667 arm64: dts: marvell: espressobin-ultra: fix SPI-NOR config
In reply to Greg Kroah-HartmanFrom: Robert Marko <[email protected]>
[ Upstream commit 5202f4c3816b42e989f9cad49a73c7e88fba89f4 ]
SPI config for the SPI-NOR is incorrect and completely breaking reading/writing to the onboard SPI-NOR.
SPI-NOR is connected in the single(x1) IO mode and not in the quad (x4) mode.
Also, there is no need to override the max frequency from the DTSI as the mx25u3235f that is used supports 104Mhz.
--- arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts | 4 ---- 1 file changed, 4 deletions(-)
arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts +0 -4
@@ -71,10 +71,6 @@ &spi0 { flash@0 { - spi-max-frequency = <108000000>; - spi-rx-bus-width = <4>; - spi-tx-bus-width = <4>; - partitions { compatible = "fixed-partitions"; #address-cells = <1>;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 447/667 arm64: dts: marvell: espressobin-ultra: enable front USB3 port
In reply to Greg Kroah-HartmanFrom: Robert Marko <[email protected]>
[ Upstream commit eacec7ebc16cf5d2f6a6c7cf5d57156da2c3e98f ]
Espressobin Ultra has a front panel USB3.0 Type-A port which works just fine so enable it.
I dont see a reason why it was disabled in the first place anyway.
--- arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts | 1 - 1 file changed, 1 deletion(-)
arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts +0 -1
@@ -108,7 +108,6 @@ &usb3 { usb-phy = <&usb3_phy>; - status = "disabled"; }; &mdio {
Signature · 1 line
2.35.1