5.17.14-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainerPATCH 268/772 drbd: fix duplicate array initializer
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 33cb0917bbe241dd17a2b87ead63514c1b7e5615 ]
There are two initializers for P_RETRY_WRITE:
drivers/block/drbd/drbd_main.c:3676:22: warning: initialized field overwritten [-Woverride-init]
Remove the first one since it was already ignored by the compiler and reorder the list to match the enum definition. As P_ZEROES had no entry, add that one instead.
--- drivers/block/drbd/drbd_main.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/block/drbd/drbd_main.c +6 -5
@@ -3609,9 +3609,8 @@ const char *cmdname(enum drbd_packet cmd)* when we want to support more than * one PRO_VERSION */ static const char *cmdnames[] = { + [P_DATA ] ="Data" , - [P_WSAME ] ="WriteSame" , - [P_TRIM ] ="Trim" , [P_DATA_REPLY ] ="DataReply" , [P_RS_DATA_REPLY ] ="RSDataReply" , [P_BARRIER ] ="Barrier" ,
@@ -3622,7 +3621,6 @@ const char *cmdname(enum drbd_packet cmd) [P_DATA_REQUEST] = "DataRequest", [P_RS_DATA_REQUEST] = "RSDataRequest", [P_SYNC_PARAM] = "SyncParam", - [P_SYNC_PARAM89] = "SyncParam89", [P_PROTOCOL] = "ReportProtocol", [P_UUIDS] = "ReportUUIDs", [P_SIZES] = "ReportSizes",
@@ -3630,6 +3628,7 @@ const char *cmdname(enum drbd_packet cmd) [P_SYNC_UUID] = "ReportSyncUUID", [P_AUTH_CHALLENGE] = "AuthChallenge", [P_AUTH_RESPONSE] = "AuthResponse", + [P_STATE_CHG_REQ] = "StateChgRequest", [P_PING] = "Ping", [P_PING_ACK] = "PingAck", [P_RECV_ACK] = "RecvAck",
@@ -3640,23 +3639,25 @@ const char *cmdname(enum drbd_packet cmd) [P_NEG_DREPLY] = "NegDReply", [P_NEG_RS_DREPLY] = "NegRSDReply", [P_BARRIER_ACK] = "BarrierAck", - [P_STATE_CHG_REQ] = "StateChgRequest", [P_STATE_CHG_REPLY] = "StateChgReply", [P_OV_REQUEST] = "OVRequest", [P_OV_REPLY] = "OVReply", [P_OV_RESULT] = "OVResult", [P_CSUM_RS_REQUEST] = "CsumRSRequest", [P_RS_IS_IN_SYNC] = "CsumRSIsInSync", + [P_SYNC_PARAM89] = "SyncParam89", [P_COMPRESSED_BITMAP] = "CBitmap", [P_DELAY_PROBE] = "DelayProbe", [P_OUT_OF_SYNC] = "OutOfSync", - [P_RETRY_WRITE] = "RetryWrite", [P_RS_CANCEL] = "RSCancel", [P_CONN_ST_CHG_REQ] = "conn_st_chg_req", [P_CONN_ST_CHG_REPLY] = "conn_st_chg_reply", [P_PROTOCOL_UPDATE] = "protocol_update", + [P_TRIM] = "Trim", [P_RS_THIN_REQ] = "rs_thin_req", [P_RS_DEALLOCATED] = "rs_deallocated", + [P_WSAME] = "WriteSame", + [P_ZEROES] = "Zeroes",/* enum drbd_packet, but not commands - obsoleted flags: * P_MAY_IGNORE
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 269/772 EDAC/dmc520: Dont print an error for each unconfigured interrupt line
In reply to Greg Kroah-HartmanFrom: Tyler Hicks <[email protected]>
[ Upstream commit ad2df24732e8956a45a00894d2163c4ee8fb0e1f ]
The dmc520 driver requires that at least one interrupt line, out of the ten possible, is configured. The driver prints an error and returns -EINVAL from its .probe function if there are no interrupt lines configured.
Don't print a KERN_ERR level message for each interrupt line that's unconfigured as that can confuse users into thinking that there is an error condition.
Before this change, the following KERN_ERR level messages would be reported if only dram_ecc_errc and dram_ecc_errd were configured in the device tree:
dmc520 68000000.dmc: IRQ ram_ecc_errc not found dmc520 68000000.dmc: IRQ ram_ecc_errd not found dmc520 68000000.dmc: IRQ failed_access not found dmc520 68000000.dmc: IRQ failed_prog not found dmc520 68000000.dmc: IRQ link_err not dmc520 68000000.dmc: IRQ temperature_event not found dmc520 68000000.dmc: IRQ arch_fsm not found dmc520 68000000.dmc: IRQ phy_request not found
--- drivers/edac/dmc520_edac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/edac/dmc520_edac.c +1 -1
@@ -489,7 +489,7 @@ static int dmc520_edac_probe(struct platform_device *pdev) dev = &pdev->dev;for (idx =0 ; idx <NUMBER_OF_IRQS ; idx++) { - irq =platform_get_irq_byname (pdev, dmc520_irq_configs[idx].name); + irq =platform_get_irq_byname_optional (pdev, dmc520_irq_configs[idx].name); irqs[idx] = irq; masks[idx] = dmc520_irq_configs[idx].mask;if (irq >=0 ) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 270/772 drm/bridge: anx7625: Use uint8 for lane-swing arrays
In reply to Greg Kroah-HartmanFrom: Nícolas F. R. A. Prado <[email protected]>
[ Upstream commit fb8da7f3111ab500606960bef1bb32450c664750 ]
As defined in the anx7625 dt-binding, the analogix,lane0-swing and analogix,lane1-swing properties are uint8 arrays. Yet, the driver was reading the array as if it were of uint32 and masking to 8-bit before writing to the registers. This means that a devicetree written in accordance to the dt-binding would have its values incorrectly parsed.
Fix the issue by reading the array as uint8 and storing them as uint8 internally, so that we can also drop the masking when writing the registers.
--- drivers/gpu/drm/bridge/analogix/anx7625.c | 12 ++++++------ drivers/gpu/drm/bridge/analogix/anx7625.h | 4 ++-- 2 files changed, 8 insertions(+), 8 deletions(-)
drivers/gpu/drm/bridge/analogix/anx7625.c +6 -6
@@ -1201,12 +1201,12 @@ static void anx7625_dp_adjust_swing(struct anx7625_data *ctx)for (i =0 ; i < ctx->pdata.dp_lane0_swing_reg_cnt; i++)anx7625_reg_write (ctx, ctx->i2c.tx_p1_client,DP_TX_LANE0_SWING_REG0 + i, - ctx->pdata.lane0_reg_data[i] &0xFF ); + ctx->pdata.lane0_reg_data[i]);for (i =0 ; i < ctx->pdata.dp_lane1_swing_reg_cnt; i++)anx7625_reg_write (ctx, ctx->i2c.tx_p1_client,DP_TX_LANE1_SWING_REG0 + i, - ctx->pdata.lane1_reg_data[i] &0xFF ); + ctx->pdata.lane1_reg_data[i]); }static void dp_hpd_change_handler (struct anx7625_data *ctx,bool on)
@@ -1313,8 +1313,8 @@ static int anx7625_get_swing_setting(struct device *dev, num_regs =DP_TX_SWING_REG_CNT ; pdata->dp_lane0_swing_reg_cnt = num_regs; -of_property_read_u32_array (dev->of_node,"analogix,lane0-swing" , - pdata->lane0_reg_data, num_regs); +of_property_read_u8_array (dev->of_node,"analogix,lane0-swing" , + pdata->lane0_reg_data, num_regs); } if (of_get_property(dev->of_node,
@@ -1323,8 +1323,8 @@ static int anx7625_get_swing_setting(struct device *dev, num_regs =DP_TX_SWING_REG_CNT ; pdata->dp_lane1_swing_reg_cnt = num_regs; -of_property_read_u32_array (dev->of_node,"analogix,lane1-swing" , - pdata->lane1_reg_data, num_regs); +of_property_read_u8_array (dev->of_node,"analogix,lane1-swing" , + pdata->lane1_reg_data, num_regs); }return 0 ;
drivers/gpu/drm/bridge/analogix/anx7625.h +2 -2
@@ -370,9 +370,9 @@ struct anx7625_platform_data {int mipi_lanes;int audio_en;int dp_lane0_swing_reg_cnt; -int lane0_reg_data[DP_TX_SWING_REG_CNT ]; +u8 lane0_reg_data[DP_TX_SWING_REG_CNT ];int dp_lane1_swing_reg_cnt; -int lane1_reg_data[DP_TX_SWING_REG_CNT ]; +u8 lane1_reg_data[DP_TX_SWING_REG_CNT ];u32 low_power_mode;struct device_node *mipi_host_node; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 271/772 mtd: rawnand: denali: Use managed device resources
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit 3a745b51cddafade99aaea1b93aad31e9614e230 ]
All of the resources used by this driver has managed interfaces, so use them. Otherwise we will get the following splat:
[ 4.472703] denali-nand-pci 0000:00:05.0: timeout while waiting for irq 0x1000 [ 4.474071] denali-nand-pci: probe of 0000:00:05.0 failed with error -5 [ 4.473538] nand: No NAND device found [ 4.474068] BUG: unable to handle page fault for address: ffffc90005000410 [ 4.475169] #PF: supervisor write access in kernel mode [ 4.475579] #PF: error_code(0x0002) - not-present page [ 4.478362] RIP: 0010:iowrite32+0x9/0x50 [ 4.486068] Call Trace: [ 4.486269] <IRQ> [ 4.486443] denali_isr+0x15b/0x300 [denali] [ 4.486788] ? denali_direct_write+0x50/0x50 [denali] [ 4.487189] __handle_irq_event_percpu+0x161/0x3b0 [ 4.487571] handle_irq_event+0x7d/0x1b0 [ 4.487884] handle_fasteoi_irq+0x2b0/0x770 [ 4.488219] __common_interrupt+0xc8/0x1b0 [ 4.488549] common_interrupt+0x9a/0xc0
--- drivers/mtd/nand/raw/denali_pci.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-)
drivers/mtd/nand/raw/denali_pci.c +4 -11
@@ -74,22 +74,21 @@ static int denali_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)return ret; } - denali->reg =ioremap (csr_base, csr_len); + denali->reg =devm_ioremap (denali->dev, csr_base, csr_len);if (!denali->reg) {dev_err (&dev->dev,"Spectra: Unable to remap memory region\n" );return -ENOMEM ; } - denali->host =ioremap (mem_base, mem_len); + denali->host =devm_ioremap (denali->dev, mem_base, mem_len);if (!denali->host) {dev_err (&dev->dev,"Spectra: ioremap failed!" ); - ret = -ENOMEM ; - goto out_unmap_reg; +return -ENOMEM ; } ret =denali_init (denali);if (ret) - goto out_unmap_host; +return ret; nsels = denali->nbanks;
@@ -117,10 +116,6 @@ static int denali_pci_probe(struct pci_dev *dev, const struct pci_device_id *id) out_remove_denali:denali_remove (denali); -out_unmap_host: -iounmap (denali->host); -out_unmap_reg: -iounmap (denali->reg);return ret; }
@@ -129,8 +124,6 @@ static void denali_pci_remove(struct pci_dev *dev)struct denali_controller *denali =pci_get_drvdata (dev);denali_remove (denali); -iounmap (denali->reg); -iounmap (denali->host); }static struct pci_driver denali_pci_driver = {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 272/772 HID: hid-led: fix maximum brightness for Dream Cheeky
In reply to Greg Kroah-HartmanFrom: Jonathan Teh <[email protected]>
[ Upstream commit 116c3f4a78ebe478d5ad5a038baf931e93e7d748 ]
Increase maximum brightness for Dream Cheeky to 63. Emperically determined based on testing in kernel 4.4 on this device:
Bus 003 Device 002: ID 1d34:0004 Dream Cheeky Webmail Notifier
--- drivers/hid/hid-led.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/hid-led.c +1 -1
@@ -366,7 +366,7 @@ static const struct hidled_config hidled_configs[] = { .type = DREAM_CHEEKY, .name = "Dream Cheeky Webmail Notifier", .short_name = "dream_cheeky", - .max_brightness = 31, + .max_brightness = 63, .num_leds = 1, .report_size = 9, .report_type = RAW_REQUEST,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 273/772 HID: elan: Fix potential double free in elan_input_configured
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 1af20714fedad238362571620be0bd690ded05b6 ]
'input' is a managed resource allocated with devm_input_allocate_device(), so there is no need to call input_free_device() explicitly or there will be a double free.
According to the doc of devm_input_allocate_device():
* Managed input devices do not need to be explicitly unregistered or
* freed as it will be done automatically when owner device unbinds from
* its driver (or binding fails).
--- drivers/hid/hid-elan.c | 2 -- 1 file changed, 2 deletions(-)
drivers/hid/hid-elan.c +0 -2
@@ -188,7 +188,6 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi) ret =input_mt_init_slots (input,ELAN_MAX_FINGERS ,INPUT_MT_POINTER );if (ret) {hid_err (hdev,"Failed to init elan MT slots: %d\n" , ret); -input_free_device (input);return ret; }
@@ -200,7 +199,6 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)hid_err (hdev,"Failed to register elan input device: %d\n" , ret);input_mt_destroy_slots (input); -input_free_device (input);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 274/772 drm/bridge: Fix error handling in analogix_dp_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 9f15930bb2ef9f031d62ffc49629cbae89137733 ]
In the error handling path, the clk_prepare_enable() function call should be balanced by a corresponding 'clk_disable_unprepare()' call, as already done in the remove function.
--- .../gpu/drm/bridge/analogix/analogix_dp_core.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
drivers/gpu/drm/bridge/analogix/analogix_dp_core.c +13 -5
@@ -1698,8 +1698,10 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data) res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); dp->reg_base =devm_ioremap_resource (&pdev->dev, res); -if (IS_ERR (dp->reg_base)) -return ERR_CAST (dp->reg_base); +if (IS_ERR (dp->reg_base)) { + ret =PTR_ERR (dp->reg_base); + goto err_disable_clk; + } dp->force_hpd =of_property_read_bool (dev->of_node,"force-hpd" );
@@ -1711,7 +1713,8 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data)if (IS_ERR (dp->hpd_gpiod)) {dev_err (dev,"error getting HDP GPIO: %ld\n" ,PTR_ERR (dp->hpd_gpiod)); -return ERR_CAST (dp->hpd_gpiod); + ret =PTR_ERR (dp->hpd_gpiod); + goto err_disable_clk; }if (dp->hpd_gpiod) {
@@ -1731,7 +1734,8 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data)if (dp->irq == -ENXIO ) {dev_err (&pdev->dev,"failed to get irq\n" ); -return ERR_PTR (-ENODEV ); + ret = -ENODEV ; + goto err_disable_clk; } ret = devm_request_threaded_irq(&pdev->dev, dp->irq,
@@ -1740,11 +1744,15 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data) irq_flags, "analogix-dp", dp);if (ret) {dev_err (&pdev->dev,"failed to request irq\n" ); -return ERR_PTR (ret); + goto err_disable_clk; }disable_irq (dp->irq);return dp; + +err_disable_clk: +clk_disable_unprepare (dp->clock); +return ERR_PTR (ret); }EXPORT_SYMBOL_GPL (analogix_dp_probe);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 275/772 regulator: da9121: Fix uninit-value in da9121_assign_chip_model()
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit bab76514aca36bc513224525d5598da676938218 ]
KASAN report slab-out-of-bounds in __regmap_init as follows:
BUG: KASAN: slab-out-of-bounds in __regmap_init drivers/base/regmap/regmap.c:841 Read of size 1 at addr ffff88803678cdf1 by task xrun/9137 CPU: 0 PID: 9137 Comm: xrun Tainted: G W 5.18.0-rc2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0xe8/0x15a lib/dump_stack.c:88 print_report.cold+0xcd/0x69b mm/kasan/report.c:313 kasan_report+0x8e/0xc0 mm/kasan/report.c:491 __regmap_init+0x4540/0x4ba0 drivers/base/regmap/regmap.c:841 __devm_regmap_init+0x7a/0x100 drivers/base/regmap/regmap.c:1266 __devm_regmap_init_i2c+0x65/0x80 drivers/base/regmap/regmap-i2c.c:394 da9121_i2c_probe+0x386/0x6d1 drivers/regulator/da9121-regulator.c:1039 i2c_device_probe+0x959/0xac0 drivers/i2c/i2c-core-base.c:563
This happend when da9121 device is probe by da9121_i2c_id, but with invalid dts. Thus, chip->subvariant_id is set to -EINVAL, and later da9121_assign_chip_model() will access 'regmap' without init it.
Fix it by return -EINVAL from da9121_assign_chip_model() if 'chip->subvariant_id' is invalid.
--- drivers/regulator/da9121-regulator.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/regulator/da9121-regulator.c +2 -0
@@ -1030,6 +1030,8 @@ static int da9121_assign_chip_model(struct i2c_client *i2c, chip->variant_id =DA9121_TYPE_DA9142 ; regmap = &da9121_2ch_regmap_config;break ; +default : +return -EINVAL ; }/* Set these up for of_regulator_match call which may want .of_map_modes */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 276/772 drm/mediatek: dpi: Use mt8183 output formats for mt8192
In reply to Greg Kroah-HartmanFrom: Nícolas F. R. A. Prado <[email protected]>
[ Upstream commit 7112e0b0a58be8575547eba6596c42710922674f ]
The configuration for mt8192 was incorrectly using the output formats from mt8173. Since the output formats for mt8192 are instead the same ones as for mt8183, which require two bus samples per pixel, the pixelclock and DDR edge setting were misconfigured. This made external displays unable to show the image.
Fix the issue by correcting the output format for mt8192 to be the same as for mt8183, fixing the usage of external displays for mt8192.
--- drivers/gpu/drm/mediatek/mtk_dpi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/mediatek/mtk_dpi.c +2 -2
@@ -819,8 +819,8 @@ static const struct mtk_dpi_conf mt8192_conf = { .cal_factor = mt8183_calculate_factor, .reg_h_fre_con = 0xe0, .max_clock_khz = 150000, - .output_fmts = mt8173_output_fmts, - .num_output_fmts = ARRAY_SIZE(mt8173_output_fmts), + .output_fmts = mt8183_output_fmts, + .num_output_fmts = ARRAY_SIZE(mt8183_output_fmts), };static int mtk_dpi_probe (struct platform_device *pdev)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 277/772 signal: Deliver SIGTRAP on perf event asynchronously if blocked
In reply to Greg Kroah-HartmanFrom: Marco Elver <[email protected]>
[ Upstream commit 78ed93d72ded679e3caf0758357209887bda885f ]
With SIGTRAP on perf events, we have encountered termination of processes due to user space attempting to block delivery of SIGTRAP. Consider this case:
<set up SIGTRAP on a perf event>
...
sigset_t s;
sigemptyset(&s);
sigaddset(&s, SIGTRAP | <and others>);
sigprocmask(SIG_BLOCK, &s, ...);
...
<perf event triggers>When the perf event triggers, while SIGTRAP is blocked, force_sig_perf() will force the signal, but revert back to the default handler, thus terminating the task.
This makes sense for error conditions, but not so much for explicitly requested monitoring. However, the expectation is still that signals generated by perf events are synchronous, which will no longer be the case if the signal is blocked and delivered later.
To give user space the ability to clearly distinguish synchronous from asynchronous signals, introduce siginfo_t::si_perf_flags and TRAP_PERF_FLAG_ASYNC (opted for flags in case more binary information is required in future).
The resolution to the problem is then to (a) no longer force the signal (avoiding the terminations), but (b) tell user space via si_perf_flags if the signal was synchronous or not, so that such signals can be handled differently (e.g. let user space decide to ignore or consider the data imprecise).
The alternative of making the kernel ignore SIGTRAP on perf events if the signal is blocked may work for some usecases, but likely causes issues in others that then have to revert back to interception of sigprocmask() (which we want to avoid). [ A concrete example: when using breakpoint perf events to track data-flow, in a region of code where signals are blocked, data-flow can no longer be tracked accurately. When a relevant asynchronous signal is received after unblocking the signal, the data-flow tracking logic needs to know its state is imprecise. ]
--- arch/arm/kernel/signal.c | 1 + arch/arm64/kernel/signal.c | 1 + arch/arm64/kernel/signal32.c | 1 + arch/m68k/kernel/signal.c | 1 + arch/sparc/kernel/signal32.c | 1 + arch/sparc/kernel/signal_64.c | 1 + arch/x86/kernel/signal_compat.c | 2 ++ include/linux/compat.h | 1 + include/linux/sched/signal.h | 2 +- include/uapi/asm-generic/siginfo.h | 7 +++++++ kernel/events/core.c | 4 ++-- kernel/signal.c | 18 ++++++++++++++++-- 12 files changed, 35 insertions(+), 5 deletions(-)
arch/arm/kernel/signal.c +1 -0
@@ -708,6 +708,7 @@ static_assert(offsetof(siginfo_t, si_upper) == 0x18);static_assert (offsetof(siginfo_t , si_pkey) ==0x14 );static_assert (offsetof(siginfo_t , si_perf_data) ==0x10 );static_assert (offsetof(siginfo_t , si_perf_type) ==0x14 ); +static_assert (offsetof(siginfo_t , si_perf_flags) ==0x18 );static_assert (offsetof(siginfo_t , si_band) ==0x0c );static_assert (offsetof(siginfo_t , si_fd) ==0x10 );static_assert (offsetof(siginfo_t , si_call_addr) ==0x0c );
arch/arm64/kernel/signal.c +1 -0
@@ -1012,6 +1012,7 @@ static_assert(offsetof(siginfo_t, si_upper) == 0x28);static_assert (offsetof(siginfo_t , si_pkey) ==0x20 );static_assert (offsetof(siginfo_t , si_perf_data) ==0x18 );static_assert (offsetof(siginfo_t , si_perf_type) ==0x20 ); +static_assert (offsetof(siginfo_t , si_perf_flags) ==0x24 );static_assert (offsetof(siginfo_t , si_band) ==0x10 );static_assert (offsetof(siginfo_t , si_fd) ==0x18 );static_assert (offsetof(siginfo_t , si_call_addr) ==0x10 );
arch/arm64/kernel/signal32.c +1 -0
@@ -487,6 +487,7 @@ static_assert(offsetof(compat_siginfo_t, si_upper) == 0x18);static_assert (offsetof(compat_siginfo_t , si_pkey) ==0x14 );static_assert (offsetof(compat_siginfo_t , si_perf_data) ==0x10 );static_assert (offsetof(compat_siginfo_t , si_perf_type) ==0x14 ); +static_assert (offsetof(compat_siginfo_t , si_perf_flags) ==0x18 );static_assert (offsetof(compat_siginfo_t , si_band) ==0x0c );static_assert (offsetof(compat_siginfo_t , si_fd) ==0x10 );static_assert (offsetof(compat_siginfo_t , si_call_addr) ==0x0c );
arch/m68k/kernel/signal.c +1 -0
@@ -625,6 +625,7 @@ static inline void siginfo_build_tests(void)/* _sigfault._perf */ BUILD_BUG_ON (offsetof(siginfo_t , si_perf_data) !=0x10 );BUILD_BUG_ON (offsetof(siginfo_t , si_perf_type) !=0x14 ); +BUILD_BUG_ON (offsetof(siginfo_t , si_perf_flags) !=0x18 );/* _sigpoll */ BUILD_BUG_ON (offsetof(siginfo_t , si_band) !=0x0c );
arch/sparc/kernel/signal32.c +1 -0
@@ -780,5 +780,6 @@ static_assert(offsetof(compat_siginfo_t, si_upper) == 0x18);static_assert (offsetof(compat_siginfo_t , si_pkey) ==0x14 );static_assert (offsetof(compat_siginfo_t , si_perf_data) ==0x10 );static_assert (offsetof(compat_siginfo_t , si_perf_type) ==0x14 ); +static_assert (offsetof(compat_siginfo_t , si_perf_flags) ==0x18 );static_assert (offsetof(compat_siginfo_t , si_band) ==0x0c );static_assert (offsetof(compat_siginfo_t , si_fd) ==0x10 );
arch/sparc/kernel/signal_64.c +1 -0
@@ -590,5 +590,6 @@ static_assert(offsetof(siginfo_t, si_upper) == 0x28);static_assert (offsetof(siginfo_t , si_pkey) ==0x20 );static_assert (offsetof(siginfo_t , si_perf_data) ==0x18 );static_assert (offsetof(siginfo_t , si_perf_type) ==0x20 ); +static_assert (offsetof(siginfo_t , si_perf_flags) ==0x24 );static_assert (offsetof(siginfo_t , si_band) ==0x10 );static_assert (offsetof(siginfo_t , si_fd) ==0x14 );
arch/x86/kernel/signal_compat.c +2 -0
@@ -149,8 +149,10 @@ static inline void signal_compat_build_tests(void)BUILD_BUG_ON (offsetof(siginfo_t , si_perf_data) !=0x18 );BUILD_BUG_ON (offsetof(siginfo_t , si_perf_type) !=0x20 ); +BUILD_BUG_ON (offsetof(siginfo_t , si_perf_flags) !=0x24 );BUILD_BUG_ON (offsetof(compat_siginfo_t , si_perf_data) !=0x10 );BUILD_BUG_ON (offsetof(compat_siginfo_t , si_perf_type) !=0x14 ); +BUILD_BUG_ON (offsetof(compat_siginfo_t , si_perf_flags) !=0x18 );CHECK_CSI_OFFSET (_sigpoll);CHECK_CSI_SIZE (_sigpoll,2 *sizeof (int ));
include/linux/compat.h +1 -0
@@ -235,6 +235,7 @@ typedef struct compat_siginfo {struct {compat_ulong_t _data;u32 _type; +u32 _flags; } _perf; }; } _sigfault;
include/linux/sched/signal.h +1 -1
@@ -320,7 +320,7 @@ int send_sig_mceerr(int code, void __user *, short, struct task_struct *);int force_sig_bnderr (void __user *addr,void __user *lower,void __user *upper);int force_sig_pkuerr (void __user *addr,u32 pkey); -int force_sig_perf (void __user *addr,u32 type,u64 sig_data); +int send_sig_perf (void __user *addr,u32 type,u64 sig_data);int force_sig_ptrace_errno_trap (int errno,void __user *addr);int force_sig_fault_trapno (int sig,int code,void __user *addr,int trapno);
include/uapi/asm-generic/siginfo.h +7 -0
@@ -99,6 +99,7 @@ union __sifields {struct {unsigned long _data;__u32 _type; +__u32 _flags; } _perf; }; } _sigfault;
@@ -164,6 +165,7 @@ typedef struct siginfo {#define si_pkey _sifields._sigfault._addr_pkey._pkey#define si_perf_data _sifields._sigfault._perf._data#define si_perf_type _sifields._sigfault._perf._type +#define si_perf_flags _sifields._sigfault._perf._flags#define si_band _sifields._sigpoll._band#define si_fd _sifields._sigpoll._fd#define si_call_addr _sifields._sigsys._call_addr
@@ -270,6 +272,11 @@ typedef struct siginfo {* that are of the form: ((PTRACE_EVENT_XXX << 8) | SIGTRAP) */ +/* +* Flags for si_perf_flags if SIGTRAP si_code is TRAP_PERF. +*/ +#define TRAP_PERF_FLAG_ASYNC (1u << 0) +/* * SIGCHLD si_codes */
kernel/events/core.c +2 -2
@@ -6533,8 +6533,8 @@ static void perf_sigtrap(struct perf_event *event)if (current->flags &PF_EXITING )return ; -force_sig_perf ((void __user *)event->pending_addr, - event->attr.type, event->attr.sig_data); +send_sig_perf ((void __user *)event->pending_addr, + event->attr.type, event->attr.sig_data); }static void perf_pending_event_disable (struct perf_event *event)
kernel/signal.c +16 -2
@@ -1805,7 +1805,7 @@ int force_sig_pkuerr(void __user *addr, u32 pkey) }#endif -int force_sig_perf (void __user *addr,u32 type,u64 sig_data) +int send_sig_perf (void __user *addr,u32 type,u64 sig_data) {struct kernel_siginfo info;
@@ -1817,7 +1817,18 @@ int force_sig_perf(void __user *addr, u32 type, u64 sig_data) info.si_perf_data = sig_data; info.si_perf_type = type; -return force_sig_info (&info); +/* +* Signals generated by perf events should not terminate the whole +* process if SIGTRAP is blocked, however, delivering the signal +* asynchronously is better than not delivering at all. But tell user +* space if the signal was asynchronous, so it can clearly be +* distinguished from normal synchronous ones. +*/ + info.si_perf_flags =sigismember (¤t->blocked, info.si_signo) ? +TRAP_PERF_FLAG_ASYNC : +0 ; + +return send_sig_info (info.si_signo, &info, current); }/**
@@ -3430,6 +3441,7 @@ void copy_siginfo_to_external32(struct compat_siginfo *to, to->si_addr =ptr_to_compat (from->si_addr); to->si_perf_data = from->si_perf_data; to->si_perf_type = from->si_perf_type; + to->si_perf_flags = from->si_perf_flags;break ;case SIL_CHLD : to->si_pid = from->si_pid;
@@ -3507,6 +3519,7 @@ static int post_copy_siginfo_from_user32(kernel_siginfo_t *to, to->si_addr =compat_ptr (from->si_addr); to->si_perf_data = from->si_perf_data; to->si_perf_type = from->si_perf_type; + to->si_perf_flags = from->si_perf_flags;break ;case SIL_CHLD : to->si_pid = from->si_pid;
@@ -4720,6 +4733,7 @@ static inline void siginfo_buildtime_checks(void)CHECK_OFFSET (si_pkey);CHECK_OFFSET (si_perf_data);CHECK_OFFSET (si_perf_type); +CHECK_OFFSET (si_perf_flags);/* sigpoll */ CHECK_OFFSET (si_band);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 278/772 sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq
In reply to Greg Kroah-HartmanFrom: Chengming Zhou <[email protected]>
[ Upstream commit 64eaf50731ac0a8c76ce2fedd50ef6652aabc5ff ]
Since commit 23127296889f ("sched/fair: Update scale invariance of PELT") change to use rq_clock_pelt() instead of rq_clock_task(), we should also use rq_clock_pelt() for throttled_clock_task_time and throttled_clock_task accounting to get correct cfs_rq_clock_pelt() of throttled cfs_rq. And rename throttled_clock_task(_time) to be clock_pelt rather than clock_task.
--- kernel/sched/fair.c | 8 ++++---- kernel/sched/pelt.h | 4 ++-- kernel/sched/sched.h | 4 ++-- 3 files changed, 8 insertions(+), 8 deletions(-)
kernel/sched/fair.c +4 -4
@@ -4793,8 +4793,8 @@ static int tg_unthrottle_up(struct task_group *tg, void *data) cfs_rq->throttle_count--;if (!cfs_rq->throttle_count) { - cfs_rq->throttled_clock_task_time +=rq_clock_task (rq) - - cfs_rq->throttled_clock_task; + cfs_rq->throttled_clock_pelt_time +=rq_clock_pelt (rq) - + cfs_rq->throttled_clock_pelt;/* Add cfs_rq with load or one or more already running entities to the list */ if (!cfs_rq_is_decayed (cfs_rq) || cfs_rq->nr_running)
@@ -4811,7 +4811,7 @@ static int tg_throttle_down(struct task_group *tg, void *data)/* group is entering throttled state, stop time */ if (!cfs_rq->throttle_count) { - cfs_rq->throttled_clock_task =rq_clock_task (rq); + cfs_rq->throttled_clock_pelt =rq_clock_pelt (rq);list_del_leaf_cfs_rq (cfs_rq); } cfs_rq->throttle_count++;
@@ -5255,7 +5255,7 @@ static void sync_throttle(struct task_group *tg, int cpu) pcfs_rq = tg->parent->cfs_rq[cpu]; cfs_rq->throttle_count = pcfs_rq->throttle_count; - cfs_rq->throttled_clock_task =rq_clock_task (cpu_rq (cpu)); + cfs_rq->throttled_clock_pelt =rq_clock_pelt (cpu_rq (cpu)); }/* conditionally throttle active cfs_rq's from put_prev_entity() */
kernel/sched/pelt.h +2 -2
@@ -145,9 +145,9 @@ static inline u64 rq_clock_pelt(struct rq *rq)static inline u64 cfs_rq_clock_pelt (struct cfs_rq *cfs_rq) {if (unlikely (cfs_rq->throttle_count)) -return cfs_rq->throttled_clock_task - cfs_rq->throttled_clock_task_time; +return cfs_rq->throttled_clock_pelt - cfs_rq->throttled_clock_pelt_time; -return rq_clock_pelt (rq_of (cfs_rq)) - cfs_rq->throttled_clock_task_time; +return rq_clock_pelt (rq_of (cfs_rq)) - cfs_rq->throttled_clock_pelt_time; }#else static inline u64 cfs_rq_clock_pelt (struct cfs_rq *cfs_rq)
kernel/sched/sched.h +2 -2
@@ -618,8 +618,8 @@ struct cfs_rq {s64 runtime_remaining;u64 throttled_clock; -u64 throttled_clock_task; -u64 throttled_clock_task_time; +u64 throttled_clock_pelt; +u64 throttled_clock_pelt_time;int throttled;int throttle_count;struct list_head throttled_list;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 279/772 sched/psi: report zeroes for CPU full at the system level
In reply to Greg Kroah-HartmanFrom: Chengming Zhou <[email protected]>
[ Upstream commit 890d550d7dbac7a31ecaa78732aa22be282bb6b8 ]
Martin find it confusing when look at the /proc/pressure/cpu output, and found no hint about that CPU "full" line in psi Documentation.
% cat /proc/pressure/cpu
some avg10=0.92 avg60=0.91 avg300=0.73 total=933490489 full avg10=0.22 avg60=0.23 avg300=0.16 total=358783277
The PSI_CPU_FULL state is introduced by commit e7fcd7622823 ("psi: Add PSI_CPU_FULL state"), which mainly for cgroup level, but also counted at the system level as a side effect.
Naturally, the FULL state doesn't exist for the CPU resource at the system level. These "full" numbers can come from CPU idle schedule latency. For example, t1 is the time when task wakeup on an idle CPU, t2 is the time when CPU pick and switch to it. The delta of (t2 - t1) will be in CPU_FULL state.
Another case all processes can be stalled is when all cgroups have been throttled at the same time, which unlikely to happen.
Anyway, CPU_FULL metric is meaningless and confusing at the system level. So this patch will report zeroes for CPU full at the system level, and update psi Documentation accordingly.
--- Documentation/accounting/psi.rst | 9 ++++----- kernel/sched/psi.c | 15 +++++++++------ 2 files changed, 13 insertions(+), 11 deletions(-)
Documentation/accounting/psi.rst +4 -5
@@ -37,11 +37,7 @@ Pressure interface Pressure information for each resource is exported through the respective file in /proc/pressure/ -- cpu, memory, and io. -The format for CPU is as such:: - - some avg10=0.00 avg60=0.00 avg300=0.00 total=0 - -and for memory and IO:: +The format is as such:: some avg10=0.00 avg60=0.00 avg300=0.00 total=0 full avg10=0.00 avg60=0.00 avg300=0.00 total=0
@@ -58,6 +54,9 @@ situation from a state where some tasks are stalled but the CPU is still doing productive work. As such, time spent in this subset of the stall state is tracked separately and exported in the "full" averages. +CPU full is undefined at the system level, but has been reported +since 5.13, so it is set to zero for backward compatibility. + The ratios (in %) are tracked as recent trends over ten, sixty, and three hundred second windows, which gives insight into short term events as well as medium and long term trends. The total absolute stall time
kernel/sched/psi.c +9 -6
@@ -1062,14 +1062,17 @@ int psi_show(struct seq_file *m, struct psi_group *group, enum psi_res res)mutex_unlock (&group->avgs_lock);for (full =0 ; full <2 ; full++) { -unsigned long avg[3 ]; -u64 total; +unsigned long avg[3 ] = {0 , }; +u64 total =0 ;int w; -for (w =0 ; w <3 ; w++) - avg[w] = group->avg[res *2 + full][w]; - total =div_u64 (group->total[PSI_AVGS ][res *2 + full], -NSEC_PER_USEC ); +/* CPU FULL is undefined at the system level */ +if (!(group == &psi_system && res ==PSI_CPU && full)) { +for (w =0 ; w <3 ; w++) + avg[w] = group->avg[res *2 + full][w]; + total =div_u64 (group->total[PSI_AVGS ][res *2 + full], +NSEC_PER_USEC ); + } seq_printf(m, "%s avg10=%lu.%02lu avg60=%lu.%02lu avg300=%lu.%02lu total=%llu\n", full ? "full" : "some",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 280/772 spi: img-spfi: Fix pm_runtime_get_sync() error checking
In reply to Greg Kroah-HartmanFrom: Zheng Yongjun <[email protected]>
[ Upstream commit cc470d55343056d6b2a5c32e10e0aad06f324078 ]
If the device is already in a runtime PM enabled state pm_runtime_get_sync() will return 1, so a test for negative value should be used to check for errors.
--- drivers/spi/spi-img-spfi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-img-spfi.c +1 -1
@@ -731,7 +731,7 @@ static int img_spfi_resume(struct device *dev)int ret; ret =pm_runtime_get_sync (dev); -if (ret) { +if (ret <0 ) {pm_runtime_put_noidle (dev);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 281/772 cpufreq: Fix possible race in cpufreq online error path
In reply to Greg Kroah-HartmanFrom: Schspa Shi <[email protected]>
[ Upstream commit f346e96267cd76175d6c201b40f770c0116a8a04 ]
When cpufreq online fails, the policy->cpus mask is not cleared and policy->rwsem is released too early, so the driver can be invoked via the cpuinfo_cur_freq sysfs attribute while its ->offline() or ->exit() callbacks are being run.
Take policy->clk as an example:
static int cpufreq_online(unsigned int cpu)
{
...
// policy->cpus != 0 at this time
down_write(&policy->rwsem);
ret = cpufreq_add_dev_interface(policy);
up_write(&policy->rwsem);
return 0;
out_destroy_policy:
for_each_cpu(j, policy->real_cpus)
remove_cpu_dev_symlink(policy, get_cpu_device(j));
up_write(&policy->rwsem);
...
out_exit_policy:
if (cpufreq_driver->exit)
cpufreq_driver->exit(policy);
clk_put(policy->clk);
// policy->clk is a wild pointer
...
^
|
Another process access
__cpufreq_get
cpufreq_verify_current_freq
cpufreq_generic_get
// acces wild pointer of policy->clk;
|
|
out_offline_policy: |
cpufreq_policy_free(policy); |
// deleted here, and will wait for no body reference
cpufreq_policy_put_kobj(policy);
}Address this by modifying cpufreq_online() to release policy->rwsem in the error path after the driver callbacks have run and to clear policy->cpus before releasing the semaphore.
--- drivers/cpufreq/cpufreq.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/cpufreq/cpufreq.c +3 -2
@@ -1534,8 +1534,6 @@ static int cpufreq_online(unsigned int cpu)for_each_cpu (j, policy->real_cpus)remove_cpu_dev_symlink (policy,get_cpu_device (j)); -up_write (&policy->rwsem); - out_offline_policy:if (cpufreq_driver->offline) cpufreq_driver->offline (policy);
@@ -1544,6 +1542,9 @@ static int cpufreq_online(unsigned int cpu)if (cpufreq_driver->exit) cpufreq_driver->exit (policy); +cpumask_clear (policy->cpus); +up_write (&policy->rwsem); + out_free_policy:cpufreq_policy_free (policy);return ret;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 282/772 printk: use atomic updates for klogd work
In reply to Greg Kroah-HartmanFrom: John Ogness <[email protected]>
[ Upstream commit 2ba3673d70178bf07fb75ff25c54bc478add4021 ]
The per-cpu @printk_pending variable can be updated from sleepable contexts, such as:
get_random_bytes()
warn_unseeded_randomness()
printk_deferred()
defer_console_output()
and can be updated from interrupt contexts, such as:
handle_irq_event_percpu()
__irq_wake_thread()
wake_up_process()
try_to_wake_up()
select_task_rq()
select_fallback_rq()
printk_deferred()
defer_console_output()and can be updated from NMI contexts, such as:
vprintk()
if (in_nmi()) defer_console_output()
Therefore the atomic variant of the updating functions must be used.
Replace __this_cpu_xchg() with this_cpu_xchg().
Replace __this_cpu_or() with this_cpu_or().
--- kernel/printk/printk.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/printk/printk.c +2 -2
@@ -3230,7 +3230,7 @@ static DEFINE_PER_CPU(int, printk_pending);static void wake_up_klogd_work_func (struct irq_work *irq_work) { -int pending =__this_cpu_xchg (printk_pending,0 ); +int pending =this_cpu_xchg (printk_pending,0 );if (pending &PRINTK_PENDING_OUTPUT ) {/* If trylock fails, someone else is doing the printing */
@@ -3264,7 +3264,7 @@ void defer_console_output(void)return ;preempt_disable (); -__this_cpu_or (printk_pending,PRINTK_PENDING_OUTPUT ); +this_cpu_or (printk_pending,PRINTK_PENDING_OUTPUT );irq_work_queue (this_cpu_ptr (&wake_up_klogd_work));preempt_enable (); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 283/772 printk: add missing memory barrier to wake_up_klogd()
In reply to Greg Kroah-HartmanFrom: John Ogness <[email protected]>
[ Upstream commit 1f5d783094cf28b4905f51cad846eb5d1db6673e ]
It is important that any new records are visible to preparing waiters before the waker checks if the wait queue is empty. Otherwise it is possible that:
- there are new records available
- the waker sees an empty wait queue and does not wake
- the preparing waiter sees no new records and begins to wait
This is exactly the problem that the function description of waitqueue_active() warns about.
Use wq_has_sleeper() instead of waitqueue_active() because it includes the necessary full memory barrier.
--- kernel/printk/printk.c | 39 ++++++++++++++++++++++++++++++++++++--- 1 file changed, 36 insertions(+), 3 deletions(-)
kernel/printk/printk.c +36 -3
@@ -735,8 +735,19 @@ static ssize_t devkmsg_read(struct file *file, char __user *buf, goto out; } +/* +* Guarantee this task is visible on the waitqueue before +* checking the wake condition. +* +* The full memory barrier within set_current_state() of +* prepare_to_wait_event() pairs with the full memory barrier +* within wq_has_sleeper(). +* +* This pairs with wake_up_klogd:A. +*/ ret =wait_event_interruptible (log_wait, -prb_read_valid (prb,atomic64_read (&user->seq), r)); +prb_read_valid (prb, +atomic64_read (&user->seq), r));/* LMM(devkmsg_read:A) */ if (ret) goto out; }
@@ -1502,7 +1513,18 @@ static int syslog_print(char __user *buf, int size) seq = syslog_seq;mutex_unlock (&syslog_lock); - len =wait_event_interruptible (log_wait,prb_read_valid (prb, seq,NULL )); +/* +* Guarantee this task is visible on the waitqueue before +* checking the wake condition. +* +* The full memory barrier within set_current_state() of +* prepare_to_wait_event() pairs with the full memory barrier +* within wq_has_sleeper(). +* +* This pairs with wake_up_klogd:A. +*/ + len =wait_event_interruptible (log_wait, +prb_read_valid (prb, seq,NULL ));/* LMM(syslog_print:A) */ mutex_lock (&syslog_lock);if (len)
@@ -3251,7 +3273,18 @@ void wake_up_klogd(void)return ;preempt_disable (); -if (waitqueue_active (&log_wait)) { +/* +* Guarantee any new records can be seen by tasks preparing to wait +* before this context checks if the wait queue is empty. +* +* The full memory barrier within wq_has_sleeper() pairs with the full +* memory barrier within set_current_state() of +* prepare_to_wait_event(), which is called after ___wait_event() adds +* the waiter but before it has checked the wait condition. +* +* This pairs with devkmsg_read:A and syslog_print:A. +*/ +if (wq_has_sleeper (&log_wait)) {/* LMM(wake_up_klogd:A) */ this_cpu_or (printk_pending,PRINTK_PENDING_WAKEUP );irq_work_queue (this_cpu_ptr (&wake_up_klogd_work)); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 284/772 printk: wake waiters for safe and NMI contexts
In reply to Greg Kroah-HartmanFrom: John Ogness <[email protected]>
[ Upstream commit 5341b93dea8c39d7612f7a227015d4b1d5cf30db ]
When printk() is called from safe or NMI contexts, it will directly store the record (vprintk_store()) and then defer the console output. However, defer_console_output() only causes console printing and does not wake any waiters of new records.
Wake waiters from defer_console_output() so that they also are aware of the new records from safe and NMI contexts.
--- kernel/printk/printk.c | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-)
kernel/printk/printk.c +16 -12
@@ -743,7 +743,7 @@ static ssize_t devkmsg_read(struct file *file, char __user *buf,* prepare_to_wait_event() pairs with the full memory barrier * within wq_has_sleeper(). * -* This pairs with wake_up_klogd:A. +* This pairs with __wake_up_klogd:A. */ ret = wait_event_interruptible(log_wait, prb_read_valid(prb,
@@ -1521,7 +1521,7 @@ static int syslog_print(char __user *buf, int size)* prepare_to_wait_event() pairs with the full memory barrier * within wq_has_sleeper(). * -* This pairs with wake_up_klogd:A. +* This pairs with __wake_up_klogd:A. */ len =wait_event_interruptible (log_wait,prb_read_valid (prb, seq,NULL ));/* LMM(syslog_print:A) */
@@ -3267,7 +3267,7 @@ static void wake_up_klogd_work_func(struct irq_work *irq_work) static DEFINE_PER_CPU(struct irq_work, wake_up_klogd_work) =IRQ_WORK_INIT_LAZY (wake_up_klogd_work_func); -void wake_up_klogd (void ) +static void __wake_up_klogd (int val) {if (!printk_percpu_data_ready ())return ;
@@ -3284,22 +3284,26 @@ void wake_up_klogd(void)* * This pairs with devkmsg_read:A and syslog_print:A. */ -if (wq_has_sleeper (&log_wait)) {/* LMM(wake_up_klogd:A) */ -this_cpu_or (printk_pending,PRINTK_PENDING_WAKEUP ); +if (wq_has_sleeper (&log_wait) ||/* LMM(__wake_up_klogd:A) */ + (val &PRINTK_PENDING_OUTPUT )) { +this_cpu_or (printk_pending, val);irq_work_queue (this_cpu_ptr (&wake_up_klogd_work)); }preempt_enable (); } -void defer_console_output (void ) +void wake_up_klogd (void ) { -if (!printk_percpu_data_ready ()) -return ; +__wake_up_klogd (PRINTK_PENDING_WAKEUP ); +} -preempt_disable (); -this_cpu_or (printk_pending,PRINTK_PENDING_OUTPUT ); -irq_work_queue (this_cpu_ptr (&wake_up_klogd_work)); -preempt_enable (); +void defer_console_output (void ) +{ +/* +* New messages may have been added directly to the ringbuffer +* using vprintk_store(), so wake any waiters as well. +*/ +__wake_up_klogd (PRINTK_PENDING_WAKEUP |PRINTK_PENDING_OUTPUT ); }void printk_trigger_flush (void )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 285/772 ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 2dc509305cf956381532792cb8dceef2b1504765 ]
The "rxstatus->rs_keyix" eventually gets passed to test_bit() so we need to ensure that it is within the bitmap.
drivers/net/wireless/ath/ath9k/common.c:46 ath9k_cmn_rx_accept()
error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()'
--- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +8 -0
@@ -1016,6 +1016,14 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, goto rx_next; } +if (rxstatus->rs_keyix >=ATH_KEYMAX && + rxstatus->rs_keyix !=ATH9K_RXKEYIX_INVALID ) { +ath_dbg (common,ANY , +"Invalid keyix, dropping (keyix: %d)\n" , + rxstatus->rs_keyix); + goto rx_next; + } +/* Get the RX status information */ memset (rx_status,0 ,sizeof (struct ieee80211_rx_status ));
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 286/772 media: i2c: max9286: Use "maxim,gpio-poc" property
In reply to Greg Kroah-HartmanFrom: Jacopo Mondi <[email protected]>
[ Upstream commit c9352df7139bc5be6642ebc8a78b40477ab32acd ]
The 'maxim,gpio-poc' property is used when the remote camera power-over-coax is controlled by one of the MAX9286 gpio lines, to instruct the driver about which line to use and what the line polarity is.
Add to the max9286 driver support for parsing the newly introduced property and use it if available in place of the usual supply, as it is not possible to establish one as consumer of the max9286 gpio controller.
If the new property is present, no gpio controller is registered and 'poc-supply' is ignored.
In order to maximize code re-use, break out the max9286 gpio handling function so that they can be used by the gpio controller through the gpio-consumer API, or directly by the driver code.
Wrap the power up and power down routines to their own function to be able to use either the gpio line directly or the supply. This will make it easier to control the remote camera power at run time.
--- drivers/media/i2c/max9286.c | 120 +++++++++++++++++++++++++++--------- 1 file changed, 90 insertions(+), 30 deletions(-)
drivers/media/i2c/max9286.c +90 -30
@@ -15,6 +15,7 @@#include <linux/fwnode.h> #include <linux/gpio/consumer.h> #include <linux/gpio/driver.h> +#include <linux/gpio/machine.h> #include <linux/i2c.h> #include <linux/i2c-mux.h> #include <linux/module.h>
@@ -168,6 +169,8 @@ struct max9286_priv {u32 init_rev_chan_mv;u32 rev_chan_mv; +u32 gpio_poc[2 ]; +struct v4l2_ctrl_handler ctrls;struct v4l2_ctrl *pixelrate;
@@ -1025,20 +1028,27 @@ static int max9286_setup(struct max9286_priv *priv)return 0 ; } -static void max9286_gpio_set (struct gpio_chip *chip, -unsigned int offset,int value) +static int max9286_gpio_set (struct max9286_priv *priv,unsigned int offset, +int value) { -struct max9286_priv *priv =gpiochip_get_data (chip); -if (value) priv->gpio_state |=BIT (offset);else priv->gpio_state &= ~BIT (offset); -max9286_write (priv,0x0f ,MAX9286_0X0F_RESERVED | priv->gpio_state); +return max9286_write (priv,0x0f , +MAX9286_0X0F_RESERVED | priv->gpio_state); } -static int max9286_gpio_get (struct gpio_chip *chip,unsigned int offset) +static void max9286_gpiochip_set (struct gpio_chip *chip, +unsigned int offset,int value) +{ +struct max9286_priv *priv =gpiochip_get_data (chip); + +max9286_gpio_set (priv, offset, value); +} + +static int max9286_gpiochip_get (struct gpio_chip *chip,unsigned int offset) {struct max9286_priv *priv =gpiochip_get_data (chip);
@@ -1057,13 +1067,10 @@ static int max9286_register_gpio(struct max9286_priv *priv) gpio->owner =THIS_MODULE ; gpio->ngpio =2 ; gpio->base =-1 ; - gpio->set = max9286_gpio_set; - gpio->get = max9286_gpio_get; + gpio->set = max9286_gpiochip_set; + gpio->get = max9286_gpiochip_get; gpio->can_sleep = true; -/* GPIO values default to high */ - priv->gpio_state =BIT (0 ) |BIT (1 ); - ret =devm_gpiochip_add_data (dev, gpio, priv);if (ret)dev_err (dev,"Unable to create gpio_chip\n" );
@@ -1071,6 +1078,70 @@ static int max9286_register_gpio(struct max9286_priv *priv)return ret; } +static int max9286_parse_gpios (struct max9286_priv *priv) +{ +struct device *dev = &priv->client->dev; +int ret; + +/* GPIO values default to high */ + priv->gpio_state =BIT (0 ) |BIT (1 ); + +/* +* Parse the "gpio-poc" vendor property. If the property is not +* specified the camera power is controlled by a regulator. +*/ + ret =of_property_read_u32_array (dev->of_node,"maxim,gpio-poc" , + priv->gpio_poc,2 ); +if (ret == -EINVAL ) { +/* +* If gpio lines are not used for the camera power, register +* a gpio controller for consumers. +*/ + ret =max9286_register_gpio (priv); +if (ret) +return ret; + + priv->regulator =devm_regulator_get (dev,"poc" ); +if (IS_ERR (priv->regulator)) { +return dev_err_probe (dev,PTR_ERR (priv->regulator), +"Unable to get PoC regulator (%ld)\n" , +PTR_ERR (priv->regulator)); + } + +return 0 ; + } + +/* If the property is specified make sure it is well formed. */ +if (ret || priv->gpio_poc[0 ] >1 || + (priv->gpio_poc[1 ] !=GPIO_ACTIVE_HIGH && + priv->gpio_poc[1 ] !=GPIO_ACTIVE_LOW )) { +dev_err (dev,"Invalid 'gpio-poc' property\n" ); +return -EINVAL ; + } + +return 0 ; +} + +static int max9286_poc_enable (struct max9286_priv *priv,bool enable) +{ +int ret; + +/* If the regulator is not available, use gpio to control power. */ +if (!priv->regulator) + ret =max9286_gpio_set (priv, priv->gpio_poc[0 ], + enable ^ priv->gpio_poc[1 ]); +else if (enable) + ret =regulator_enable (priv->regulator); +else + ret =regulator_disable (priv->regulator); + +if (ret <0 ) +dev_err (&priv->client->dev,"Unable to turn power %s\n" , + enable ?"on" :"off" ); + +return ret; +} +static int max9286_init (struct device *dev) {struct max9286_priv *priv;
@@ -1080,17 +1151,14 @@ static int max9286_init(struct device *dev) client =to_i2c_client (dev); priv =i2c_get_clientdata (client); -/* Enable the bus power. */ - ret =regulator_enable (priv->regulator); -if (ret <0 ) { -dev_err (&client->dev,"Unable to turn PoC on\n" ); + ret =max9286_poc_enable (priv, true); +if (ret)return ret; - } ret =max9286_setup (priv);if (ret) {dev_err (dev,"Unable to setup max9286\n" ); - goto err_regulator; + goto err_poc_disable; }/*
@@ -1100,7 +1168,7 @@ static int max9286_init(struct device *dev) ret =max9286_v4l2_register (priv);if (ret) {dev_err (dev,"Failed to register with V4L2\n" ); - goto err_regulator; + goto err_poc_disable; } ret =max9286_i2c_mux_init (priv);
@@ -1116,8 +1184,8 @@ static int max9286_init(struct device *dev) err_v4l2_register:max9286_v4l2_unregister (priv); -err_regulator: -regulator_disable (priv->regulator); +err_poc_disable: +max9286_poc_enable (priv, false);return ret; }
@@ -1288,18 +1356,10 @@ static int max9286_probe(struct i2c_client *client)*/ max9286_configure_i2c (priv, false); - ret =max9286_register_gpio (priv); + ret =max9286_parse_gpios (priv);if (ret) goto err_powerdown; - priv->regulator =devm_regulator_get (&client->dev,"poc" ); -if (IS_ERR (priv->regulator)) { - ret =PTR_ERR (priv->regulator); -dev_err_probe (&client->dev, ret, -"Unable to get PoC regulator\n" ); - goto err_powerdown; - } - ret =max9286_parse_dt (priv);if (ret) goto err_powerdown;
@@ -1326,7 +1386,7 @@ static int max9286_remove(struct i2c_client *client)max9286_v4l2_unregister (priv); -regulator_disable (priv->regulator); +max9286_poc_enable (priv, false);gpiod_set_value_cansleep (priv->gpiod_pwdn,0 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 287/772 media: i2c: max9286: fix kernel oops when removing module
In reply to Greg Kroah-HartmanFrom: Laurentiu Palcu <[email protected]>
[ Upstream commit 365ab7ebc24eebb42b9e020aeb440d51af8960cd ]
When removing the max9286 module we get a kernel oops:
Unable to handle kernel paging request at virtual address 000000aa00000094
Mem abort info:
ESR = 0x96000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004
CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=0000000880d85000 [000000aa00000094] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: fsl_jr_uio caam_jr rng_core libdes caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine max9271 authenc crct10dif_ce mxc_jpeg_encdec CPU: 2 PID: 713 Comm: rmmod Tainted: G C 5.15.5-00057-gaebcd29c8ed7-dirty #5 Hardware name: Freescale i.MX8QXP MEK (DT) pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : i2c_mux_del_adapters+0x24/0xf0 lr : max9286_remove+0x28/0xd0 [max9286]
sp : ffff800013a9bbf0
x29: ffff800013a9bbf0 x28: ffff00080b6da940 x27: 0000000000000000
x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
x23: ffff000801a5b970 x22: ffff0008048b0890 x21: ffff800009297000
x20: ffff0008048b0f70 x19: 000000aa00000064 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000014 x13: 0000000000000000 x12: ffff000802da49e8
x11: ffff000802051918 x10: ffff000802da4920 x9 : ffff000800030098 x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff6364626d x5 : 8080808000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffffffffffffffff x1 : ffff00080b6da940 x0 : 0000000000000000
Call trace: i2c_mux_del_adapters+0x24/0xf0 max9286_remove+0x28/0xd0 [max9286] i2c_device_remove+0x40/0x110 __device_release_driver+0x188/0x234 driver_detach+0xc4/0x150 bus_remove_driver+0x60/0xe0 driver_unregister+0x34/0x64 i2c_del_driver+0x58/0xa0 max9286_i2c_driver_exit+0x1c/0x490 [max9286] __arm64_sys_delete_module+0x194/0x260 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0xd4/0xfc do_el0_svc+0x2c/0x94 el0_svc+0x28/0x80 el0t_64_sync_handler+0xa8/0x130 el0t_64_sync+0x1a0/0x1a4
The Oops happens because the I2C client data does not point to max9286_priv anymore but to v4l2_subdev. The change happened in max9286_init() which calls v4l2_i2c_subdev_init() later on...
Besides fixing the max9286_remove() function, remove the call to i2c_set_clientdata() in max9286_probe(), to avoid confusion, and make the necessary changes to max9286_init() so that it doesn't have to use i2c_get_clientdata() in order to fetch the pointer to priv.
--- drivers/media/i2c/max9286.c | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-)
drivers/media/i2c/max9286.c +7 -12
@@ -1142,22 +1142,18 @@ static int max9286_poc_enable(struct max9286_priv *priv, bool enable)return ret; } -static int max9286_init (struct device *dev) +static int max9286_init (struct max9286_priv *priv) { -struct max9286_priv *priv; -struct i2c_client *client; +struct i2c_client *client = priv->client;int ret; - client =to_i2c_client (dev); - priv =i2c_get_clientdata (client); - ret =max9286_poc_enable (priv, true);if (ret)return ret; ret =max9286_setup (priv);if (ret) { -dev_err (dev,"Unable to setup max9286\n" ); +dev_err (&client->dev,"Unable to setup max9286\n" ); goto err_poc_disable; }
@@ -1167,13 +1163,13 @@ static int max9286_init(struct device *dev)*/ ret =max9286_v4l2_register (priv);if (ret) { -dev_err (dev,"Failed to register with V4L2\n" ); +dev_err (&client->dev,"Failed to register with V4L2\n" ); goto err_poc_disable; } ret =max9286_i2c_mux_init (priv);if (ret) { -dev_err (dev,"Unable to initialize I2C multiplexer\n" ); +dev_err (&client->dev,"Unable to initialize I2C multiplexer\n" ); goto err_v4l2_register; }
@@ -1328,7 +1324,6 @@ static int max9286_probe(struct i2c_client *client)mutex_init (&priv->mutex); priv->client = client; -i2c_set_clientdata (client, priv); priv->gpiod_pwdn =devm_gpiod_get_optional (&client->dev,"enable" ,GPIOD_OUT_HIGH );
@@ -1364,7 +1359,7 @@ static int max9286_probe(struct i2c_client *client)if (ret) goto err_powerdown; - ret =max9286_init (&client->dev); + ret =max9286_init (priv);if (ret <0 ) goto err_cleanup_dt;
@@ -1380,7 +1375,7 @@ static int max9286_probe(struct i2c_client *client)static int max9286_remove (struct i2c_client *client) { -struct max9286_priv *priv =i2c_get_clientdata (client); +struct max9286_priv *priv =sd_to_max9286 (i2c_get_clientdata (client));i2c_mux_del_adapters (priv->mux);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 288/772 media: hantro: Empty encoder capture buffers by default
In reply to Greg Kroah-HartmanFrom: Chen-Yu Tsai <[email protected]>
[ Upstream commit 309373a3571ef7175bd9da0c9b13476a718e8478 ]
The payload size for encoder capture buffers is set by the driver upon finishing encoding each frame, based on the encoded length returned from hardware, and whatever header and padding length used. Setting a non-zero default serves no real purpose, and also causes issues if the capture buffer is returned to userspace unused, confusing the application.
Instead, always set the payload size to 0 for encoder capture buffers when preparing them.
--- drivers/staging/media/hantro/hantro_v4l2.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/staging/media/hantro/hantro_v4l2.c +6 -2
@@ -656,8 +656,12 @@ static int hantro_buf_prepare(struct vb2_buffer *vb)* (for OUTPUT buffers, if userspace passes 0 bytesused, v4l2-core sets * it to buffer length). */ -if (V4L2_TYPE_IS_CAPTURE (vq->type)) -vb2_set_plane_payload (vb,0 , pix_fmt->plane_fmt[0 ].sizeimage); +if (V4L2_TYPE_IS_CAPTURE (vq->type)) { +if (ctx->is_encoder) +vb2_set_plane_payload (vb,0 ,0 ); +else +vb2_set_plane_payload (vb,0 , pix_fmt->plane_fmt[0 ].sizeimage); + }return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 289/772 drm/panel: simple: Add missing bus flags for Innolux G070Y2-L01
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit 0f73a559f916b618c0c05186bd644c90cc9e9695 ]
The DE signal is active high on this display, fill in the missing bus_flags. This aligns panel_desc with its display_timing .
--- drivers/gpu/drm/panel/panel-simple.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/panel/panel-simple.c +1 -0
@@ -2029,6 +2029,7 @@ static const struct panel_desc innolux_g070y2_l01 = { .unprepare = 800, }, .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, + .bus_flags = DRM_BUS_FLAG_DE_HIGH, .connector_type = DRM_MODE_CONNECTOR_LVDS, };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 290/772 ALSA: pcm: Check for null pointer of pointer substream before dereferencing it
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 011b559be832194f992f73d6c0d5485f5925a10b ]
Pointer substream is being dereferenced on the assignment of pointer card before substream is being null checked with the macro PCM_RUNTIME_CHECK. Although PCM_RUNTIME_CHECK calls BUG_ON, it still is useful to perform the the pointer check before card is assigned.
--- sound/core/pcm_memory.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/core/pcm_memory.c +2 -1
@@ -453,7 +453,6 @@ EXPORT_SYMBOL(snd_pcm_lib_malloc_pages);*/ int snd_pcm_lib_free_pages (struct snd_pcm_substream *substream) { -struct snd_card *card = substream->pcm->card;struct snd_pcm_runtime *runtime;if (PCM_RUNTIME_CHECK (substream))
@@ -462,6 +461,8 @@ int snd_pcm_lib_free_pages(struct snd_pcm_substream *substream)if (runtime->dma_area ==NULL )return 0 ;if (runtime->dma_buffer_p != &substream->dma_buffer) { +struct snd_card *card = substream->pcm->card; +/* it's a newly allocated buffer. release it now. */ do_free_pages (card, runtime->dma_buffer_p);kfree (runtime->dma_buffer_p);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 291/772 mtdblock: warn if opened on NAND
In reply to Greg Kroah-HartmanFrom: Bjørn Mork <[email protected]>
[ Upstream commit 96a3295c351da82d7af99b2fc004a3cf9f4716a9 ]
Warning on every translated mtd partition results in excessive log noise if this driver is loaded:
nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xf1
nand: Macronix MX30LF1G18AC
nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 mt7621-nand 1e003000.nand: ECC strength adjusted to 4 bits
read_bbt: found bbt at block 1023
10 fixed-partitions partitions found on MTD device mt7621-nand
Creating 10 MTD partitions on "mt7621-nand":
0x000000000000-0x000000080000 : "Bootloader"
mtdblock: MTD device 'Bootloader' is NAND, please consider using UBI block devices instead. 0x000000080000-0x000000100000 : "Config"
mtdblock: MTD device 'Config' is NAND, please consider using UBI block devices instead. 0x000000100000-0x000000140000 : "Factory"
mtdblock: MTD device 'Factory' is NAND, please consider using UBI block devices instead. 0x000000140000-0x000002000000 : "Kernel"
mtdblock: MTD device 'Kernel' is NAND, please consider using UBI block devices instead. 0x000000540000-0x000002000000 : "ubi"
mtdblock: MTD device 'ubi' is NAND, please consider using UBI block devices instead. 0x000002140000-0x000004000000 : "Kernel2"
mtdblock: MTD device 'Kernel2' is NAND, please consider using UBI block devices instead. 0x000004000000-0x000004100000 : "wwan"
mtdblock: MTD device 'wwan' is NAND, please consider using UBI block devices instead. 0x000004100000-0x000005100000 : "data"
mtdblock: MTD device 'data' is NAND, please consider using UBI block devices instead. 0x000005100000-0x000005200000 : "rom-d"
mtdblock: MTD device 'rom-d' is NAND, please consider using UBI block devices instead. 0x000005200000-0x000005280000 : "reserve"
mtdblock: MTD device 'reserve' is NAND, please consider using UBI block devices instead. mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 21
This is more likely to annoy than to help users of embedded distros where this driver is enabled by default. Making the blockdevs available does not imply that they are in use, and warning about bootloader partitions or other devices which obviously never will be mounted is more confusing than helpful.
Move the warning to open(), where it will be of more use - actually warning anyone who mounts a file system on NAND using mtdblock.
--- drivers/mtd/mtdblock.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/mtd/mtdblock.c +4 -4
@@ -257,6 +257,10 @@ static int mtdblock_open(struct mtd_blktrans_dev *mbd)return 0 ; } +if (mtd_type_is_nand (mbd->mtd)) +pr_warn ("%s: MTD device '%s' is NAND, please consider using UBI block devices instead.\n" , + mbd->tr->name, mbd->mtd->name); +/* OK, it's not open. Create cache info for it */ mtdblk->count =1 ;mutex_init (&mtdblk->cache_mutex);
@@ -322,10 +326,6 @@ static void mtdblock_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd)if (!(mtd->flags &MTD_WRITEABLE )) dev->mbd.readonly =1 ; -if (mtd_type_is_nand (mtd)) -pr_warn ("%s: MTD device '%s' is NAND, please consider using UBI block devices instead.\n" , - tr->name, mtd->name); -if (add_mtd_blktrans_dev (&dev->mbd))kfree (dev); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 292/772 inotify: show inotify mask flags in proc fdinfo
In reply to Greg Kroah-HartmanFrom: Amir Goldstein <[email protected]>
[ Upstream commit a32e697cda27679a0327ae2cafdad8c7170f548f ]
The inotify mask flags IN_ONESHOT and IN_EXCL_UNLINK are not "internal to kernel" and should be exposed in procfs fdinfo so CRIU can restore them.
--- fs/notify/fdinfo.c | 11 ++--------- fs/notify/inotify/inotify.h | 12 ++++++++++++ fs/notify/inotify/inotify_user.c | 2 +- 3 files changed, 15 insertions(+), 10 deletions(-)
fs/notify/fdinfo.c +2 -9
@@ -83,16 +83,9 @@ static void inotify_fdinfo(struct seq_file *m, struct fsnotify_mark *mark) inode_mark = container_of(mark, struct inotify_inode_mark, fsn_mark); inode =igrab (fsnotify_conn_inode (mark->connector));if (inode) { -/* -* IN_ALL_EVENTS represents all of the mask bits -* that we expose to userspace. There is at -* least one bit (FS_EVENT_ON_CHILD) which is -* used only internally to the kernel. -*/ -u32 mask = mark->mask &IN_ALL_EVENTS ; -seq_printf (m,"inotify wd:%x ino:%lx sdev:%x mask:%x ignored_mask:%x " , +seq_printf (m,"inotify wd:%x ino:%lx sdev:%x mask:%x ignored_mask:0 " , inode_mark->wd, inode->i_ino, inode->i_sb->s_dev, - mask, mark->ignored_mask); +inotify_mark_user_mask (mark));show_mark_fhandle (m, inode);seq_putc (m,'\n' );iput (inode);
fs/notify/inotify/inotify.h +12 -0
@@ -22,6 +22,18 @@ static inline struct inotify_event_info *INOTIFY_E(struct fsnotify_event *fse) return container_of(fse, struct inotify_event_info, fse); } +/* +* INOTIFY_USER_FLAGS represents all of the mask bits that we expose to +* userspace. There is at least one bit (FS_EVENT_ON_CHILD) which is +* used only internally to the kernel. +*/ +#define INOTIFY_USER_MASK (IN_ALL_EVENTS | IN_ONESHOT | IN_EXCL_UNLINK) + +static inline __u32 inotify_mark_user_mask (struct fsnotify_mark *fsn_mark) +{ +return fsn_mark->mask &INOTIFY_USER_MASK ; +} +extern void inotify_ignored_and_remove_idr (struct fsnotify_mark *fsn_mark,struct fsnotify_group *group); extern int inotify_handle_inode_event(struct fsnotify_mark *inode_mark,
fs/notify/inotify/inotify_user.c +1 -1
@@ -110,7 +110,7 @@ static inline __u32 inotify_arg_to_mask(struct inode *inode, u32 arg) mask |=FS_EVENT_ON_CHILD ;/* mask off the flags used to open the fd */ - mask |= (arg & (IN_ALL_EVENTS |IN_ONESHOT |IN_EXCL_UNLINK )); + mask |= (arg &INOTIFY_USER_MASK );return mask; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 293/772 fsnotify: fix wrong lockdep annotations
In reply to Greg Kroah-HartmanFrom: Amir Goldstein <[email protected]>
[ Upstream commit 623af4f538b5df9b416e1b82f720af7371b4c771 ]
Commit 6960b0d909cd ("fsnotify: change locking order") changed some of the mark_mutex locks in direct reclaim path to use:
mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING);
This change is explained:
"...It uses nested locking to avoid deadlock in case we do the final
iput() on an inode which still holds marks and thus would take the mutex again when calling fsnotify_inode_delete() in destroy_inode()."
The problem is that the mutex_lock_nested() is not a nested lock at all. In fact, it has the opposite effect of preventing lockdep from warning about a very possible deadlock.
Due to these wrong annotations, a deadlock that was introduced with nfsd filecache in kernel v5.4 went unnoticed in v5.4.y for over two years until it was reported recently by Khazhismel Kumykov, only to find out that the deadlock was already fixed in kernel v5.5.
Fix the wrong lockdep annotations.
--- fs/notify/mark.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/notify/mark.c +3 -3
@@ -452,7 +452,7 @@ void fsnotify_free_mark(struct fsnotify_mark *mark)void fsnotify_destroy_mark (struct fsnotify_mark *mark,struct fsnotify_group *group) { -mutex_lock_nested (&group->mark_mutex,SINGLE_DEPTH_NESTING ); +mutex_lock (&group->mark_mutex);fsnotify_detach_mark (mark);mutex_unlock (&group->mark_mutex);fsnotify_free_mark (mark);
@@ -770,7 +770,7 @@ void fsnotify_clear_marks_by_group(struct fsnotify_group *group,* move marks to free to to_free list in one go and then free marks in * to_free list one by one. */ -mutex_lock_nested (&group->mark_mutex,SINGLE_DEPTH_NESTING ); +mutex_lock (&group->mark_mutex);list_for_each_entry_safe (mark, lmark, &group->marks_list, g_list) {if (mark->connector->type == obj_type)list_move (&mark->g_list, &to_free);
@@ -779,7 +779,7 @@ void fsnotify_clear_marks_by_group(struct fsnotify_group *group, clear:while (1 ) { -mutex_lock_nested (&group->mark_mutex,SINGLE_DEPTH_NESTING ); +mutex_lock (&group->mark_mutex);if (list_empty (head)) {mutex_unlock (&group->mark_mutex);break ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 294/772 spi: rockchip: Stop spi slave dma receiver when cs inactive
In reply to Greg Kroah-HartmanFrom: Jon Lin <[email protected]>
[ Upstream commit 869f2c94db92f0f1d6acd0dff1c1ebb8160f5e29 ]
The spi which's version is higher than ver 2 will automatically enable this feature.
If the length of master transmission is uncertain, the RK spi slave is better to automatically stop after cs inactive instead of waiting for xfer_completion forever.
--- drivers/spi/spi-rockchip.c | 81 ++++++++++++++++++++++++++++++++++---- 1 file changed, 73 insertions(+), 8 deletions(-)
drivers/spi/spi-rockchip.c +73 -8
@@ -133,7 +133,8 @@#define INT_TF_OVERFLOW (1 << 1)#define INT_RF_UNDERFLOW (1 << 2)#define INT_RF_OVERFLOW (1 << 3) -#define INT_RF_FULL (1 << 4) +#define INT_RF_FULL (1 << 4) +#define INT_CS_INACTIVE (1 << 6)/* Bit fields in ICR, 4bit */ #define ICR_MASK 0x0f
@@ -194,6 +195,8 @@ struct rockchip_spi {bool cs_asserted[ROCKCHIP_SPI_MAX_CS_NUM ];bool slave_abort; +bool cs_inactive;/* spi slave tansmition stop when cs inactive */ +struct spi_transfer *xfer;/* Store xfer temporarily */ };static inline void spi_enable_chip (struct rockchip_spi *rs,bool enable)
@@ -343,6 +346,15 @@ static irqreturn_t rockchip_spi_isr(int irq, void *dev_id)struct spi_controller *ctlr = dev_id;struct rockchip_spi *rs =spi_controller_get_devdata (ctlr); +/* When int_cs_inactive comes, spi slave abort */ +if (rs->cs_inactive &&readl_relaxed (rs->regs +ROCKCHIP_SPI_IMR ) &INT_CS_INACTIVE ) { + ctlr->slave_abort (ctlr); +writel_relaxed (0 , rs->regs +ROCKCHIP_SPI_IMR ); +writel_relaxed (0xffffffff , rs->regs +ROCKCHIP_SPI_ICR ); + +return IRQ_HANDLED ; + } +if (rs->tx_left)rockchip_spi_pio_writer (rs);
@@ -350,6 +362,7 @@ static irqreturn_t rockchip_spi_isr(int irq, void *dev_id)if (!rs->rx_left) {spi_enable_chip (rs, false);writel_relaxed (0 , rs->regs +ROCKCHIP_SPI_IMR ); +writel_relaxed (0xffffffff , rs->regs +ROCKCHIP_SPI_ICR );spi_finalize_current_transfer (ctlr); }
@@ -357,14 +370,18 @@ static irqreturn_t rockchip_spi_isr(int irq, void *dev_id) }static int rockchip_spi_prepare_irq (struct rockchip_spi *rs, -struct spi_transfer *xfer) +struct spi_controller *ctlr, +struct spi_transfer *xfer) { rs->tx = xfer->tx_buf; rs->rx = xfer->rx_buf; rs->tx_left = rs->tx ? xfer->len / rs->n_bytes :0 ; rs->rx_left = xfer->len / rs->n_bytes; -writel_relaxed (INT_RF_FULL , rs->regs +ROCKCHIP_SPI_IMR ); +if (rs->cs_inactive) +writel_relaxed (INT_RF_FULL |INT_CS_INACTIVE , rs->regs +ROCKCHIP_SPI_IMR ); +else +writel_relaxed (INT_RF_FULL , rs->regs +ROCKCHIP_SPI_IMR );spi_enable_chip (rs, true);if (rs->tx_left)
@@ -383,6 +400,9 @@ static void rockchip_spi_dma_rxcb(void *data)if (state &TXDMA && !rs->slave_abort)return ; +if (rs->cs_inactive) +writel_relaxed (0 , rs->regs +ROCKCHIP_SPI_IMR ); +spi_enable_chip (rs, false);spi_finalize_current_transfer (ctlr); }
@@ -423,14 +443,16 @@ static int rockchip_spi_prepare_dma(struct rockchip_spi *rs,atomic_set (&rs->state,0 ); + rs->tx = xfer->tx_buf; + rs->rx = xfer->rx_buf; + rxdesc =NULL ;if (xfer->rx_buf) {struct dma_slave_config rxconf = { .direction =DMA_DEV_TO_MEM , .src_addr = rs->dma_addr_rx, .src_addr_width = rs->n_bytes, - .src_maxburst =rockchip_spi_calc_burst_size (xfer->len / - rs->n_bytes), + .src_maxburst =rockchip_spi_calc_burst_size (xfer->len / rs->n_bytes), };dmaengine_slave_config (ctlr->dma_rx, &rxconf);
@@ -474,10 +496,13 @@ static int rockchip_spi_prepare_dma(struct rockchip_spi *rs,/* rx must be started before tx due to spi instinct */ if (rxdesc) {atomic_or (RXDMA , &rs->state); -dmaengine_submit (rxdesc); + ctlr->dma_rx->cookie =dmaengine_submit (rxdesc);dma_async_issue_pending (ctlr->dma_rx); } +if (rs->cs_inactive) +writel_relaxed (INT_CS_INACTIVE , rs->regs +ROCKCHIP_SPI_IMR ); +spi_enable_chip (rs, true);if (txdesc) {
@@ -584,7 +609,42 @@ static size_t rockchip_spi_max_transfer_size(struct spi_device *spi)static int rockchip_spi_slave_abort (struct spi_controller *ctlr) {struct rockchip_spi *rs =spi_controller_get_devdata (ctlr); +u32 rx_fifo_left; +struct dma_tx_state state; +enum dma_status status; + +/* Get current dma rx point */ +if (atomic_read (&rs->state) &RXDMA ) { +dmaengine_pause (ctlr->dma_rx); + status =dmaengine_tx_status (ctlr->dma_rx, ctlr->dma_rx->cookie, &state); +if (status ==DMA_ERROR ) { + rs->rx = rs->xfer->rx_buf; + rs->xfer->len =0 ; + rx_fifo_left =readl_relaxed (rs->regs +ROCKCHIP_SPI_RXFLR ); +for (; rx_fifo_left; rx_fifo_left--) +readl_relaxed (rs->regs +ROCKCHIP_SPI_RXDR ); + goto out; + }else { + rs->rx += rs->xfer->len - rs->n_bytes * state.residue; + } + } +/* Get the valid data left in rx fifo and set rs->xfer->len real rx size */ +if (rs->rx) { + rx_fifo_left =readl_relaxed (rs->regs +ROCKCHIP_SPI_RXFLR ); +for (; rx_fifo_left; rx_fifo_left--) { +u32 rxw =readl_relaxed (rs->regs +ROCKCHIP_SPI_RXDR ); + +if (rs->n_bytes ==1 ) + *(u8 *)rs->rx = (u8 )rxw; +else + *(u16 *)rs->rx = (u16 )rxw; + rs->rx += rs->n_bytes; + } + rs->xfer->len = (unsigned int )(rs->rx - rs->xfer->rx_buf); + } + +out:if (atomic_read (&rs->state) &RXDMA )dmaengine_terminate_sync (ctlr->dma_rx);if (atomic_read (&rs->state) &TXDMA )
@@ -626,7 +686,7 @@ static int rockchip_spi_transfer_one( } rs->n_bytes = xfer->bits_per_word <=8 ?1 :2 ; - + rs->xfer = xfer; use_dma = ctlr->can_dma ? ctlr->can_dma (ctlr, spi, xfer) : false; ret =rockchip_spi_config (rs, spi, xfer, use_dma, ctlr->slave);
@@ -636,7 +696,7 @@ static int rockchip_spi_transfer_one(if (use_dma)return rockchip_spi_prepare_dma (rs, ctlr, xfer); -return rockchip_spi_prepare_irq (rs, xfer); +return rockchip_spi_prepare_irq (rs, ctlr, xfer); } static bool rockchip_spi_can_dma(struct spi_controller *ctlr,
@@ -815,8 +875,13 @@ static int rockchip_spi_probe(struct platform_device *pdev)switch (readl_relaxed (rs->regs +ROCKCHIP_SPI_VERSION )) {case ROCKCHIP_SPI_VER2_TYPE2 : ctlr->mode_bits |=SPI_CS_HIGH ; +if (ctlr->can_dma && slave_mode) + rs->cs_inactive = true; +else + rs->cs_inactive = false;break ;default : + rs->cs_inactive = false;break ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 295/772 spi: rockchip: Preset cs-high and clk polarity in setup progress
In reply to Greg Kroah-HartmanFrom: Jon Lin <[email protected]>
[ Upstream commit 3a4bf922d42efa4e9a3dc803d1fd786d43e8a501 ]
After power up, the cs and clock is in default status, and the cs-high and clock polarity dts property configuration will take no effect until the calling of rockchip_spi_config in the first transmission. So preset them to make sure a correct voltage before the first transmission coming.
--- drivers/spi/spi-rockchip.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
drivers/spi/spi-rockchip.c +24 -0
@@ -713,6 +713,29 @@ static bool rockchip_spi_can_dma(struct spi_controller *ctlr,return xfer->len / bytes_per_word >= rs->fifo_len; } +static int rockchip_spi_setup (struct spi_device *spi) +{ +struct rockchip_spi *rs =spi_controller_get_devdata (spi->controller); +u32 cr0; + +pm_runtime_get_sync (rs->dev); + + cr0 =readl_relaxed (rs->regs +ROCKCHIP_SPI_CTRLR0 ); + + cr0 &= ~(0x3 <<CR0_SCPH_OFFSET ); + cr0 |= ((spi->mode &0x3 ) <<CR0_SCPH_OFFSET ); +if (spi->mode &SPI_CS_HIGH && spi->chip_select <=1 ) + cr0 |=BIT (spi->chip_select) <<CR0_SOI_OFFSET ; +else if (spi->chip_select <=1 ) + cr0 &= ~(BIT (spi->chip_select) <<CR0_SOI_OFFSET ); + +writel_relaxed (cr0, rs->regs +ROCKCHIP_SPI_CTRLR0 ); + +pm_runtime_put (rs->dev); + +return 0 ; +} +static int rockchip_spi_probe (struct platform_device *pdev) {int ret;
@@ -840,6 +863,7 @@ static int rockchip_spi_probe(struct platform_device *pdev) ctlr->min_speed_hz = rs->freq /BAUDR_SCKDV_MAX ; ctlr->max_speed_hz =min (rs->freq /BAUDR_SCKDV_MIN ,MAX_SCLK_OUT ); + ctlr->setup = rockchip_spi_setup; ctlr->set_cs = rockchip_spi_set_cs; ctlr->transfer_one = rockchip_spi_transfer_one; ctlr->max_transfer_size = rockchip_spi_max_transfer_size;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 296/772 spi: rockchip: fix missing error on unsupported SPI_CS_HIGH
In reply to Greg Kroah-HartmanFrom: Luca Ceresoli <[email protected]>
[ Upstream commit d5d933f09ac326aebad85bfb787cc786ad477711 ]
The hardware (except for the ROCKCHIP_SPI_VER2_TYPE2 version) does not support active-high native chip selects. However if such a CS is configured the core does not error as it normally should, because the 'ctlr->use_gpio_descriptors = true' line in rockchip_spi_probe() makes the core set SPI_CS_HIGH in ctlr->mode_bits.
In such a case the spi-rockchip driver operates normally but produces an active-low chip select signal without notice.
There is no provision in the current core code to handle this situation. Fix by adding a check in the ctlr->setup function (similarly to what spi-atmel.c does).
This cannot be done reading the SPI_CS_HIGH but in ctlr->mode_bits because that bit gets always set by the core for master mode (see above).
--- drivers/spi/spi-rockchip.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/spi/spi-rockchip.c +8 -0
@@ -196,6 +196,8 @@ struct rockchip_spi {bool slave_abort;bool cs_inactive;/* spi slave tansmition stop when cs inactive */ +bool cs_high_supported;/* native CS supports active-high polarity */ +struct spi_transfer *xfer;/* Store xfer temporarily */ };
@@ -718,6 +720,11 @@ static int rockchip_spi_setup(struct spi_device *spi)struct rockchip_spi *rs =spi_controller_get_devdata (spi->controller);u32 cr0; +if (!spi->cs_gpiod && (spi->mode &SPI_CS_HIGH ) && !rs->cs_high_supported) { +dev_warn (&spi->dev,"setup: non GPIO CS can't be active-high\n" ); +return -EINVAL ; + } +pm_runtime_get_sync (rs->dev); cr0 =readl_relaxed (rs->regs +ROCKCHIP_SPI_CTRLR0 );
@@ -898,6 +905,7 @@ static int rockchip_spi_probe(struct platform_device *pdev)switch (readl_relaxed (rs->regs +ROCKCHIP_SPI_VERSION )) {case ROCKCHIP_SPI_VER2_TYPE2 : + rs->cs_high_supported = true; ctlr->mode_bits |=SPI_CS_HIGH ;if (ctlr->can_dma && slave_mode) rs->cs_inactive = true;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 297/772 of: overlay: do not break notify on NOTIFY_{OK|STOP}
In reply to Greg Kroah-HartmanFrom: Nuno Sá <[email protected]>
[ Upstream commit 5f756a2eaa4436d7d3dc1e040147f5e992ae34b5 ]
We should not break overlay notifications on NOTIFY_{OK|STOP} otherwise we might break on the first fragment. We should only stop notifications if a *real* errno is returned by one of the listeners.
--- drivers/of/overlay.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/of/overlay.c +1 -3
@@ -170,9 +170,7 @@ static int overlay_notify(struct overlay_changeset *ovcs, ret =blocking_notifier_call_chain (&overlay_notify_chain, action, &nd); -if (ret ==NOTIFY_OK || ret ==NOTIFY_STOP ) -return 0 ; -if (ret) { +if (notifier_to_errno (ret)) { ret =notifier_to_errno (ret);pr_err ("overlay changeset %s notifier error %d, target: %pOF\n" , of_overlay_action_name[action], ret, nd.target);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 298/772 selftests/damon: add damon to selftests root Makefile
In reply to Greg Kroah-HartmanFrom: Yuanchu Xie <[email protected]>
[ Upstream commit 678f0cdc572c5fda940cb038d70eebb8d818adc8 ]
Currently the damon selftests are not built with the rest of the selftests. We add damon to the list of targets.
--- tools/testing/selftests/Makefile | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/Makefile +1 -0
@@ -9,6 +9,7 @@ TARGETS += clone3 TARGETS += core TARGETS += cpufreq TARGETS += cpu-hotplug +TARGETS += damon TARGETS += drivers/dma-buf TARGETS += efivarfs TARGETS += exec
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 299/772 drm/msm: properly add and remove internal bridges
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit d28ea556267c4f2ec7264ab49f1b1296834321ec ]
Add calls to drm_bridge_add()/drm_bridge_remove() DRM bridges created by the driver. This fixes the following warning.
WARNING: CPU: 0 PID: 1 at kernel/locking/mutex.c:579 __mutex_lock+0x840/0x9f4 DEBUG_LOCKS_WARN_ON(lock->magic != lock) Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.18.0-rc1-00002-g3054695a0d27-dirty #55 Hardware name: Generic DT based system unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x58/0x70 dump_stack_lvl from __warn+0xc8/0x1e8 __warn from warn_slowpath_fmt+0x78/0xa8 warn_slowpath_fmt from __mutex_lock+0x840/0x9f4 __mutex_lock from mutex_lock_nested+0x1c/0x24 mutex_lock_nested from drm_bridge_hpd_enable+0x2c/0x84 drm_bridge_hpd_enable from msm_hdmi_modeset_init+0xc0/0x21c msm_hdmi_modeset_init from mdp4_kms_init+0x53c/0x90c mdp4_kms_init from msm_drm_bind+0x514/0x698 msm_drm_bind from try_to_bring_up_aggregate_device+0x160/0x1bc try_to_bring_up_aggregate_device from component_master_add_with_match+0xc4/0xf8 component_master_add_with_match from msm_pdev_probe+0x274/0x350 msm_pdev_probe from platform_probe+0x5c/0xbc platform_probe from really_probe.part.0+0x9c/0x290 really_probe.part.0 from __driver_probe_device+0xa8/0x13c __driver_probe_device from driver_probe_device+0x34/0x10c driver_probe_device from __driver_attach+0xbc/0x178 __driver_attach from bus_for_each_dev+0x74/0xc0 bus_for_each_dev from bus_add_driver+0x160/0x1e4 bus_add_driver from driver_register+0x88/0x118 driver_register from do_one_initcall+0x6c/0x334 do_one_initcall from kernel_init_freeable+0x1bc/0x220 kernel_init_freeable from kernel_init+0x18/0x12c kernel_init from ret_from_fork+0x14/0x2c
Patchwork: https://patchwork.freedesktop.org/patch/481778/
--- drivers/gpu/drm/msm/dp/dp_drm.c | 4 ++++ drivers/gpu/drm/msm/dsi/dsi_manager.c | 3 +++ drivers/gpu/drm/msm/hdmi/hdmi_bridge.c | 3 +++ drivers/gpu/drm/msm/msm_drv.c | 3 +++ 4 files changed, 13 insertions(+)
drivers/gpu/drm/msm/dp/dp_drm.c +4 -0
@@ -230,9 +230,13 @@ struct drm_bridge *msm_dp_bridge_init(struct msm_dp *dp_display, struct drm_devi bridge->funcs = &dp_bridge_ops; bridge->encoder = encoder; +drm_bridge_add (bridge); + rc =drm_bridge_attach (encoder, bridge,NULL ,DRM_BRIDGE_ATTACH_NO_CONNECTOR );if (rc) {DRM_ERROR ("failed to attach bridge, rc=%d\n" , rc); +drm_bridge_remove (bridge); +return ERR_PTR (rc); }
drivers/gpu/drm/msm/dsi/dsi_manager.c +3 -0
@@ -668,6 +668,8 @@ struct drm_bridge *msm_dsi_manager_bridge_init(u8 id) bridge = &dsi_bridge->base; bridge->funcs = &dsi_mgr_bridge_funcs; +drm_bridge_add (bridge); + ret =drm_bridge_attach (encoder, bridge,NULL ,0 );if (ret) goto fail;
@@ -738,6 +740,7 @@ struct drm_connector *msm_dsi_manager_ext_bridge_init(u8 id)void msm_dsi_manager_bridge_destroy (struct drm_bridge *bridge) { +drm_bridge_remove (bridge); }int msm_dsi_manager_cmd_xfer (int id,const struct mipi_dsi_msg *msg)
drivers/gpu/drm/msm/hdmi/hdmi_bridge.c +3 -0
@@ -15,6 +15,7 @@ void msm_hdmi_bridge_destroy(struct drm_bridge *bridge)struct hdmi_bridge *hdmi_bridge =to_hdmi_bridge (bridge);msm_hdmi_hpd_disable (hdmi_bridge); +drm_bridge_remove (bridge); }static void msm_hdmi_power_on (struct drm_bridge *bridge)
@@ -346,6 +347,8 @@ struct drm_bridge *msm_hdmi_bridge_init(struct hdmi *hdmi)DRM_BRIDGE_OP_DETECT |DRM_BRIDGE_OP_EDID ; +drm_bridge_add (bridge); + ret =drm_bridge_attach (hdmi->encoder, bridge,NULL ,DRM_BRIDGE_ATTACH_NO_CONNECTOR );if (ret) goto fail;
drivers/gpu/drm/msm/msm_drv.c +3 -0
@@ -385,6 +385,9 @@ static int msm_drm_uninit(struct device *dev)drm_mode_config_cleanup (ddev); +for (i =0 ; i < priv->num_bridges; i++) +drm_bridge_remove (priv->bridges[i]); +pm_runtime_get_sync (dev);msm_irq_uninstall (ddev);pm_runtime_put_sync (dev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 300/772 drm/msm/dpu: adjust display_v_end for eDP and DP
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
[ Upstream commit e18aeea7f5efb9508722c8c7fd4d32e6f8cdfe50 ]
The “DP timing” requires the active region to be defined in the bottom-right corner of the frame dimensions which is different with DSI. Therefore both display_h_end and display_v_end need to be adjusted accordingly. However current implementation has only display_h_end adjusted.
Patchwork: https://patchwork.freedesktop.org/patch/476277/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c +1 -0
@@ -148,6 +148,7 @@ static void dpu_hw_intf_setup_timing_engine(struct dpu_hw_intf *ctx, active_v_end = active_v_start + (p->yres * hsync_period) -1 ; display_v_start += p->hsync_pulse_width + p->h_back_porch; + display_v_end -= p->h_front_porch; active_hctl = (active_h_end <<16 ) | active_h_start; display_hctl = active_hctl;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 301/772 scsi: iscsi: Fix harmless double shift bug
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 565138ac5f8a5330669a20e5f94759764e9165ec ]
These flags are supposed to be bit numbers. Right now they cause a double shift bug where we use BIT(BIT(2)) instead of BIT(2). Fortunately, the bit numbers are small and it's done consistently so it does not cause an issue at run time.
--- include/scsi/libiscsi.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
include/scsi/libiscsi.h +3 -3
@@ -53,9 +53,9 @@ enum {#define ISID_SIZE 6/* Connection flags */ -#define ISCSI_CONN_FLAG_SUSPEND_TX BIT(0) -#define ISCSI_CONN_FLAG_SUSPEND_RX BIT(1) -#define ISCSI_CONN_FLAG_BOUND BIT(2) +#define ISCSI_CONN_FLAG_SUSPEND_TX 0 +#define ISCSI_CONN_FLAG_SUSPEND_RX 1 +#define ISCSI_CONN_FLAG_BOUND 2#define ISCSI_ITT_MASK 0x1fff#define ISCSI_TOTAL_CMDS_MAX 4096
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 302/772 scsi: ufs: qcom: Fix ufs_qcom_resume()
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit bee40dc167da159ea5b939c074e1da258610a3d6 ]
Clearing hba->is_sys_suspended if ufs_qcom_resume() succeeds is wrong. That variable must only be cleared if all actions involved in a resume succeed. Hence remove the statement that clears hba->is_sys_suspended from ufs_qcom_resume().
--- drivers/scsi/ufs/ufs-qcom.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/scsi/ufs/ufs-qcom.c +1 -6
@@ -641,12 +641,7 @@ static int ufs_qcom_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op)return err; } - err =ufs_qcom_ice_resume (host); -if (err) -return err; - - hba->is_sys_suspended = false; -return 0 ; +return ufs_qcom_ice_resume (host); }static void ufs_qcom_dev_ref_clk_ctrl (struct ufs_qcom_host *host,bool enable)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 303/772 scsi: ufs: core: Exclude UECxx from SFR dump list
In reply to Greg Kroah-HartmanFrom: Kiwoong Kim <[email protected]>
[ Upstream commit ef60031022eb6d972aac86ca26c98c33e1289436 ]
Some devices may return invalid or zeroed data during an UIC error condition. In addition, reading these SFRs will clear them. This means the subsequent error handling will not be able to see them and therefore no error handling will be scheduled.
Skip reading these SFRs in ufshcd_dump_regs().
--- drivers/scsi/ufs/ufshcd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/scsi/ufs/ufshcd.c +6 -1
@@ -115,8 +115,13 @@ int ufshcd_dump_regs(struct ufs_hba *hba, size_t offset, size_t len,if (!regs)return -ENOMEM ; -for (pos =0 ; pos < len; pos +=4 ) +for (pos =0 ; pos < len; pos +=4 ) { +if (offset ==0 && + pos >=REG_UIC_ERROR_CODE_PHY_ADAPTER_LAYER && + pos <=REG_UIC_ERROR_CODE_DME ) +continue ; regs[pos /4 ] =ufshcd_readl (hba, offset + pos); + }ufshcd_hex_dump (prefix, regs, len);kfree (regs);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 304/772 drm/v3d: Fix null pointer dereference of pointer perfmon
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit ce7a1ecf3f9f1fccaf67295307614511d8e11b13 ]
In the unlikely event that pointer perfmon is null the WARN_ON return path occurs after the pointer has already been deferenced. Fix this by only dereferencing perfmon after it has been null checked.
--- drivers/gpu/drm/v3d/v3d_perfmon.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/v3d/v3d_perfmon.c +2 -1
@@ -25,11 +25,12 @@ void v3d_perfmon_start(struct v3d_dev *v3d, struct v3d_perfmon *perfmon) {unsigned int i;u32 mask; -u8 ncounters = perfmon->ncounters; +u8 ncounters;if (WARN_ON_ONCE (!perfmon || v3d->active_perfmon))return ; + ncounters = perfmon->ncounters; mask =GENMASK (ncounters -1 ,0 );for (i =0 ; i < ncounters; i++) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 305/772 selftests/resctrl: Fix null pointer dereference on open failed
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit c7b607fa9325ccc94982774c505176677117689c ]
Currently if opening /dev/null fails to open then file pointer fp is null and further access to fp via fprintf will cause a null pointer dereference. Fix this by returning a negative error value when a null fp is detected.
Detected using cppcheck static analysis:tools/testing/selftests/resctrl/fill_buf.c:124:6: note: Assuming that condition '!fp' is not redundant
if (!fp)
^
tools/testing/selftests/resctrl/fill_buf.c:126:10: note: Null pointer dereference
fprintf(fp, "Sum: %d ", ret);
--- tools/testing/selftests/resctrl/fill_buf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/testing/selftests/resctrl/fill_buf.c +3 -1
@@ -121,8 +121,10 @@ static int fill_cache_read(unsigned char *start_ptr, unsigned char *end_ptr,/* Consume read result so that reading memory is not optimized out. */ fp =fopen ("/dev/null" ,"w" ); -if (!fp) +if (!fp) {perror ("Unable to write to /dev/null" ); +return -1 ; + }fprintf (fp,"Sum: %d " , ret);fclose (fp);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 306/772 libbpf: Fix logic for finding matching program for CO-RE relocation
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 966a7509325395c51c5f6d89e7352b0585e4804b ]
Fix the bug in bpf_object__relocate_core() which can lead to finding invalid matching BPF program when processing CO-RE relocation. IF matching program is not found, last encountered program will be assumed to be correct program and thus error detection won't detect the problem.
--- tools/lib/bpf/libbpf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
tools/lib/bpf/libbpf.c +3 -2
@@ -5639,9 +5639,10 @@ bpf_object__relocate_core(struct bpf_object *obj, const char *targ_btf_path)*/ prog =NULL ;for (i =0 ; i < obj->nr_programs; i++) { - prog = &obj->programs[i]; -if (strcmp (prog->sec_name, sec_name) ==0 ) +if (strcmp (obj->programs[i].sec_name, sec_name) ==0 ) { + prog = &obj->programs[i];break ; + } }if (!prog) {pr_warn ("sec '%s': failed to find a BPF program\n" , sec_name);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 307/772 mtd: spi-nor: core: Check written SR value in spi_nor_write_16bit_sr_and_check()
In reply to Greg Kroah-HartmanFrom: Chen-Tsung Hsieh <[email protected]>
[ Upstream commit 70dd83d737d8900b2d98db6dc6b928c596334d37 ]
Read back Status Register 1 to ensure that the written byte match the received value and return -EIO if read back test failed.
Without this patch, spi_nor_write_16bit_sr_and_check() only check the second half of the 16bit. It causes errors like spi_nor_sr_unlock() return success incorrectly when spi_nor_write_16bit_sr_and_check() doesn't write SR successfully.
--- drivers/mtd/spi-nor/core.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/mtd/spi-nor/core.c +9 -0
@@ -1007,6 +1007,15 @@ static int spi_nor_write_16bit_sr_and_check(struct spi_nor *nor, u8 sr1)if (ret)return ret; + ret =spi_nor_read_sr (nor, sr_cr); +if (ret) +return ret; + +if (sr1 != sr_cr[0 ]) { +dev_dbg (nor->dev,"SR: Read back test failed\n" ); +return -EIO ; + } +if (nor->flags &SNOR_F_NO_READ_CR )return 0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 308/772 x86/pm: Fix false positive kmemleak report in msr_build_context()
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
[ Upstream commit b0b592cf08367719e1d1ef07c9f136e8c17f7ec3 ]
Since
e2a1256b17b1 ("x86/speculation: Restore speculation related MSRs during S3 resume")
kmemleak reports this issue:
unreferenced object 0xffff888009cedc00 (size 256):
comm "swapper/0", pid 1, jiffies 4294693823 (age 73.764s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 ........H.......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
msr_build_context (include/linux/slab.h:621)
pm_check_save_msr (arch/x86/power/cpu.c:520)
do_one_initcall (init/main.c:1298)
kernel_init_freeable (init/main.c:1370)
kernel_init (init/main.c:1504)
ret_from_fork (arch/x86/entry/entry_64.S:304)Reproducer:
- boot the VM with a debug kernel config (see
https://github.com/multipath-tcp/mptcp_net-next/issues/268)
- wait ~1 minute
- start a kmemleak scan
The root cause here is alignment within the packed struct saved_context (from suspend_64.h). Kmemleak only searches for pointers that are aligned (see how pointers are scanned in kmemleak.c), but pahole shows that the saved_msrs struct member and all members after it in the structure are unaligned:
struct saved_context {
struct pt_regs regs; /* 0 168 */
/* --- cacheline 2 boundary (128 bytes) was 40 bytes ago --- */
u16 ds; /* 168 2 */...
u64 misc_enable; /* 232 8 */
bool misc_enable_saved; /* 240 1 */
/* Note below odd offset values for the remainder of this struct */
struct saved_msrs saved_msrs; /* 241 16 */
/* --- cacheline 4 boundary (256 bytes) was 1 bytes ago --- */
long unsigned int efer; /* 257 8 */
u16 gdt_pad; /* 265 2 */
struct desc_ptr gdt_desc; /* 267 10 */
u16 idt_pad; /* 277 2 */
struct desc_ptr idt; /* 279 10 */
u16 ldt; /* 289 2 */
u16 tss; /* 291 2 */
long unsigned int tr; /* 293 8 */
long unsigned int safety; /* 301 8 */
long unsigned int return_address; /* 309 8 */
/* size: 317, cachelines: 5, members: 25 */
/* last cacheline: 61 bytes */
} __attribute__((__packed__));
Move misc_enable_saved to the end of the struct declaration so that saved_msrs fits in before the cacheline 4 boundary.
The comment above the saved_context declaration says to fix wakeup_64.S file and __save/__restore_processor_state() if the struct is modified:
it looks like all the accesses in wakeup_64.S are done through offsets which are computed at build-time. Update that comment accordingly.
At the end, the false positive kmemleak report is due to a limitation from kmemleak but it is always good to avoid unaligned members for optimisation purposes.
Please note that it looks like this issue is not new, e.g.
https://lore.kernel.org/all/[email protected]/
https://lore.kernel.org/all/[email protected]/
[ bp: Massage + cleanup commit message. ]
--- arch/x86/include/asm/suspend_32.h | 2 +- arch/x86/include/asm/suspend_64.h | 12 ++++++++---- 2 files changed, 9 insertions(+), 5 deletions(-)
arch/x86/include/asm/suspend_32.h +1 -1
@@ -19,7 +19,6 @@ struct saved_context {u16 gs;unsigned long cr0, cr2, cr3, cr4;u64 misc_enable; -bool misc_enable_saved;struct saved_msrs saved_msrs;struct desc_ptr gdt_desc;struct desc_ptr idt;
@@ -28,6 +27,7 @@ struct saved_context {unsigned long tr;unsigned long safety;unsigned long return_address; +bool misc_enable_saved; } __attribute__((packed));/* routines for saving/restoring kernel state */
arch/x86/include/asm/suspend_64.h +8 -4
@@ -14,9 +14,13 @@* Image of the saved processor state, used by the low level ACPI suspend to * RAM code and by the low level hibernation code. * -* If you modify it, fix arch/x86/kernel/acpi/wakeup_64.S and make sure that -* __save/__restore_processor_state(), defined in arch/x86/kernel/suspend_64.c, -* still work as required. +* If you modify it, check how it is used in arch/x86/kernel/acpi/wakeup_64.S +* and make sure that __save/__restore_processor_state(), defined in +* arch/x86/power/cpu.c, still work as required. +* +* Because the structure is packed, make sure to avoid unaligned members. For +* optimisation purposes but also because tools like kmemleak only search for +* pointers that are aligned. */ struct saved_context {struct pt_regs regs;
@@ -36,7 +40,6 @@ struct saved_context {unsigned long cr0, cr2, cr3, cr4;u64 misc_enable; -bool misc_enable_saved;struct saved_msrs saved_msrs;unsigned long efer;u16 gdt_pad;/* Unused */
@@ -48,6 +51,7 @@ struct saved_context {unsigned long tr;unsigned long safety;unsigned long return_address; +bool misc_enable_saved; } __attribute__((packed));#define loaddebug (thread,register) \
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 309/772 mtd: rawnand: cadence: fix possible null-ptr-deref in cadence_nand_dt_probe()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit a28ed09dafee20da51eb26452950839633afd824 ]
It will cause null-ptr-deref when using 'res', if platform_get_resource() returns NULL, so move using 'res' after devm_ioremap_resource() that will check it to avoid null-ptr-deref.
And use devm_platform_get_and_ioremap_resource() to simplify code.
--- drivers/mtd/nand/raw/cadence-nand-controller.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/mtd/nand/raw/cadence-nand-controller.c +2 -3
@@ -2983,11 +2983,10 @@ static int cadence_nand_dt_probe(struct platform_device *ofdev)if (IS_ERR (cdns_ctrl->reg))return PTR_ERR (cdns_ctrl->reg); - res =platform_get_resource (ofdev,IORESOURCE_MEM ,1 ); - cdns_ctrl->io.dma = res->start; - cdns_ctrl->io.virt =devm_ioremap_resource (&ofdev->dev, res); + cdns_ctrl->io.virt =devm_platform_get_and_ioremap_resource (ofdev,1 , &res);if (IS_ERR (cdns_ctrl->io.virt))return PTR_ERR (cdns_ctrl->io.virt); + cdns_ctrl->io.dma = res->start; dt->clk =devm_clk_get (cdns_ctrl->dev,"nf_clk" );if (IS_ERR (dt->clk))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 310/772 mtd: rawnand: intel: fix possible null-ptr-deref in ebu_nand_probe()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit ddf66aefd685fd46500b9917333e1b1e118276dc ]
It will cause null-ptr-deref when using 'res', if platform_get_resource() returns NULL, so move using 'res' after devm_ioremap_resource() that will check it to avoid null-ptr-deref.
--- drivers/mtd/nand/raw/intel-nand-controller.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/raw/intel-nand-controller.c +1 -1
@@ -619,9 +619,9 @@ static int ebu_nand_probe(struct platform_device *pdev) resname =devm_kasprintf (dev,GFP_KERNEL ,"nand_cs%d" , cs); res =platform_get_resource_byname (pdev,IORESOURCE_MEM , resname); ebu_host->cs[cs].chipaddr =devm_ioremap_resource (dev, res); - ebu_host->cs[cs].nand_pa = res->start;if (IS_ERR (ebu_host->cs[cs].chipaddr))return PTR_ERR (ebu_host->cs[cs].chipaddr); + ebu_host->cs[cs].nand_pa = res->start; ebu_host->clk =devm_clk_get (dev,NULL );if (IS_ERR (ebu_host->clk))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 311/772 x86/speculation: Add missing prototype for unpriv_ebpf_notify()
In reply to Greg Kroah-HartmanFrom: Josh Poimboeuf <[email protected]>
[ Upstream commit 2147c438fde135d6c145a96e373d9348e7076f7f ]
Fix the following warnings seen with "make W=1":
kernel/sysctl.c:183:13: warning: no previous prototype for ‘unpriv_ebpf_notify’ [-Wmissing-prototypes]
183 | void __weak unpriv_ebpf_notify(int new_state)
| ^~~~~~~~~~~~~~~~~~
arch/x86/kernel/cpu/bugs.c:659:6: warning: no previous prototype for ‘unpriv_ebpf_notify’ [-Wmissing-prototypes]
659 | void unpriv_ebpf_notify(int new_state)
| ^~~~~~~~~~~~~~~~~~
--- include/linux/bpf.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/bpf.h +2 -0
@@ -2064,6 +2064,8 @@ void bpf_offload_dev_netdev_unregister(struct bpf_offload_dev *offdev, struct net_device *netdev);bool bpf_offload_dev_match (struct bpf_prog *prog,struct net_device *netdev); +void unpriv_ebpf_notify (int new_state); +#if defined(CONFIG_NET ) && defined(CONFIG_BPF_SYSCALL )int bpf_prog_offload_init (struct bpf_prog *prog,union bpf_attr *attr);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 312/772 ASoC: rk3328: fix disabling mclk on pclk probe failure
In reply to Greg Kroah-HartmanFrom: Nicolas Frattaroli <[email protected]>
[ Upstream commit dd508e324cdde1c06ace08a8143fa50333a90703 ]
If preparing/enabling the pclk fails, the probe function should unprepare and disable the previously prepared and enabled mclk, which it doesn't do. This commit rectifies this.
--- sound/soc/codecs/rk3328_codec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/rk3328_codec.c +1 -1
@@ -481,7 +481,7 @@ static int rk3328_platform_probe(struct platform_device *pdev) ret =clk_prepare_enable (rk3328->pclk);if (ret <0 ) {dev_err (&pdev->dev,"failed to enable acodec pclk\n" ); -return ret; + goto err_unprepare_mclk; } base =devm_platform_ioremap_resource (pdev,0 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 313/772 perf tools: Add missing headers needed by util/data.h
In reply to Greg Kroah-HartmanFrom: Yang Jihong <[email protected]>
[ Upstream commit 4d27cf1d9de5becfa4d1efb2ea54dba1b9fc962a ]
'struct perf_data' in util/data.h uses the "u64" data type, which is defined in "linux/types.h".
If we only include util/data.h, the following compilation error occurs:
util/data.h:38:3: error: unknown type name ‘u64’
u64 version;
^~~Solution: include "linux/types.h." to add the needed type definitions.
--- tools/perf/util/data.h | 1 + 1 file changed, 1 insertion(+)
tools/perf/util/data.h +1 -0
@@ -4,6 +4,7 @@#include <stdio.h> #include <stdbool.h> +#include <linux/types.h> enum perf_data_mode {PERF_DATA_MODE_WRITE ,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 314/772 drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume
In reply to Greg Kroah-HartmanFrom: Vinod Polimera <[email protected]>
[ Upstream commit fa5186b279ecf44b14fb435540d2065be91cb1ed ]
BUG: Unable to handle kernel paging request at virtual address 006b6b6b6b6b6be3 Call trace: dpu_vbif_init_memtypes+0x40/0xb8 dpu_runtime_resume+0xcc/0x1c0 pm_generic_runtime_resume+0x30/0x44 __genpd_runtime_resume+0x68/0x7c genpd_runtime_resume+0x134/0x258 __rpm_callback+0x98/0x138 rpm_callback+0x30/0x88 rpm_resume+0x36c/0x49c __pm_runtime_resume+0x80/0xb0 dpu_core_irq_uninstall+0x30/0xb0 dpu_irq_uninstall+0x18/0x24 msm_drm_uninit+0xd8/0x16c
Patchwork: https://patchwork.freedesktop.org/patch/483255/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +3 -1
@@ -795,8 +795,10 @@ static void _dpu_kms_hw_destroy(struct dpu_kms *dpu_kms)for (i =0 ; i < dpu_kms->catalog->vbif_count; i++) {u32 vbif_idx = dpu_kms->catalog->vbif[i].id; -if ((vbif_idx <VBIF_MAX ) && dpu_kms->hw_vbif[vbif_idx]) +if ((vbif_idx <VBIF_MAX ) && dpu_kms->hw_vbif[vbif_idx]) {dpu_hw_vbif_destroy (dpu_kms->hw_vbif[vbif_idx]); + dpu_kms->hw_vbif[vbif_idx] =NULL ; + } } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 315/772 drm/msm/dp: stop event kernel thread when DP unbind
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
[ Upstream commit 570d3e5d28db7a94557fa179167a9fb8642fb8a1 ]
Current DP driver implementation, event thread is kept running after DP display is unbind. This patch fix this problem by disabling DP irq and stop event thread to exit gracefully at dp_display_unbind().
Changes in v2:
-- start event thread at dp_display_bind()
Changes in v3:
-- disable all HDP interrupts at unbind
-- replace dp_hpd_event_setup() with dp_hpd_event_thread_start() -- replace dp_hpd_event_stop() with dp_hpd_event_thread_stop() -- move init_waitqueue_head(&dp->event_q) to probe() -- move spin_lock_init(&dp->event_lock) to probe()
Changes in v4:
-- relocate both dp_display_bind() and dp_display_unbind() to bottom of file
Changes in v5:
-- cancel relocation of both dp_display_bind() and dp_display_unbind()
Changes in v6:
-- move empty event q to dp_event_thread_start()
Changes in v7:
-- call ktheread_stop() directly instead of dp_hpd_event_thread_stop() function
Changes in v8:
-- return error immediately if audio registration failed.
Changes in v9:
-- return error immediately if event thread create failed.
Changes in v10:
-- delete extra DRM_ERROR("failed to create DP event thread\n");
Patchwork: https://patchwork.freedesktop.org/patch/482399/
--- drivers/gpu/drm/msm/dp/dp_display.c | 39 +++++++++++++++++++++++------ 1 file changed, 31 insertions(+), 8 deletions(-)
drivers/gpu/drm/msm/dp/dp_display.c +31 -8
@@ -113,6 +113,7 @@ struct dp_display_private {u32 hpd_state;u32 event_pndx;u32 event_gndx; +struct task_struct *ev_tsk;struct dp_event event_list[DP_EVENT_Q_MAX ];spinlock_t event_lock;
@@ -230,6 +231,8 @@ void dp_display_signal_audio_complete(struct msm_dp *dp_display)complete_all (&dp->audio_comp); } +static int dp_hpd_event_thread_start (struct dp_display_private *dp_priv); +static int dp_display_bind (struct device *dev,struct device *master,void *data) {
@@ -263,9 +266,18 @@ static int dp_display_bind(struct device *dev, struct device *master, } rc =dp_register_audio_driver (dev, dp->audio); -if (rc) +if (rc) {DRM_ERROR ("Audio registration Dp failed\n" ); + goto end; + } + rc =dp_hpd_event_thread_start (dp); +if (rc) { +DRM_ERROR ("Event thread create failed\n" ); + goto end; + } + +return 0 ; end:return rc; }
@@ -276,6 +288,11 @@ static void dp_display_unbind(struct device *dev, struct device *master,struct dp_display_private *dp =dev_get_dp_display_private (dev);struct msm_drm_private *priv =dev_get_drvdata (master); +/* disable all HPD interrupts */ +dp_catalog_hpd_config_intr (dp->catalog,DP_DP_HPD_INT_MASK , false); + +kthread_stop (dp->ev_tsk); +dp_power_client_deinit (dp->power);dp_aux_unregister (dp->aux); priv->dp[dp->id] =NULL ;
@@ -1048,7 +1065,7 @@ static int hpd_event_thread(void *data) dp_priv = (struct dp_display_private *)data; -while (1 ) { +while (!kthread_should_stop ()) {if (timeout_mode) { wait_event_timeout(dp_priv->event_q, (dp_priv->event_pndx == dp_priv->event_gndx),
@@ -1126,12 +1143,17 @@ static int hpd_event_thread(void *data)return 0 ; } -static void dp_hpd_event_setup (struct dp_display_private *dp_priv) +static int dp_hpd_event_thread_start (struct dp_display_private *dp_priv) { -init_waitqueue_head (&dp_priv->event_q); -spin_lock_init (&dp_priv->event_lock); +/* set event q to empty */ + dp_priv->event_gndx =0 ; + dp_priv->event_pndx =0 ; -kthread_run (hpd_event_thread, dp_priv,"dp_hpd_handler" ); + dp_priv->ev_tsk =kthread_run (hpd_event_thread, dp_priv,"dp_hpd_handler" ); +if (IS_ERR (dp_priv->ev_tsk)) +return PTR_ERR (dp_priv->ev_tsk); + +return 0 ; }static irqreturn_t dp_display_irq_handler (int irq,void *dev_id)
@@ -1260,7 +1282,10 @@ static int dp_display_probe(struct platform_device *pdev)return -EPROBE_DEFER ; } +/* setup event q */ mutex_init (&dp->event_mutex); +init_waitqueue_head (&dp->event_q); +spin_lock_init (&dp->event_lock);/* Store DP audio handle inside DP display */ dp->dp_display.dp_audio = dp->audio;
@@ -1435,8 +1460,6 @@ void msm_dp_irq_postinstall(struct msm_dp *dp_display) dp = container_of(dp_display, struct dp_display_private, dp_display); -dp_hpd_event_setup (dp); -dp_add_event (dp,EV_HPD_INIT_SETUP ,0 ,100 ); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 316/772 drm/msm/dp: fix error check return value of irq_of_parse_and_map()
In reply to Greg Kroah-HartmanFrom: Lv Ruyi <[email protected]>
[ Upstream commit e92d0d93f86699b7b25c7906613fdc374d66c8ca ]
The irq_of_parse_and_map() function returns 0 on failure, and does not return an negative value.
Patchwork: https://patchwork.freedesktop.org/patch/483176/
--- drivers/gpu/drm/msm/dp/dp_display.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/gpu/drm/msm/dp/dp_display.c +3 -4
@@ -1212,10 +1212,9 @@ int dp_display_request_irq(struct msm_dp *dp_display) dp = container_of(dp_display, struct dp_display_private, dp_display); dp->irq =irq_of_parse_and_map (dp->pdev->dev.of_node,0 ); -if (dp->irq <0 ) { - rc = dp->irq; -DRM_ERROR ("failed to get irq: %d\n" , rc); -return rc; +if (!dp->irq) { +DRM_ERROR ("failed to get irq\n" ); +return -EINVAL ; } rc = devm_request_irq(&dp->pdev->dev, dp->irq,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 317/772 drm/msm/dp: reset DP controller before transmit phy test pattern
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
[ Upstream commit 581d69981159b00f0443d171a4b900089f34ccfe ]
DP controller state can not switch from video ready state to transmit phy pattern state at run time. DP mainlink has to be teared down followed by reset controller to default state to have DP controller switch to transmit phy test pattern state and start generate specified phy test pattern to sinker once main link setup again.
Changes in v2:
-- correct Fixes's commit id
Patchwork: https://patchwork.freedesktop.org/patch/483563/
--- drivers/gpu/drm/msm/dp/dp_ctrl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/dp/dp_ctrl.c +1 -1
@@ -1519,7 +1519,7 @@ static int dp_ctrl_process_phy_test_request(struct dp_ctrl_private *ctrl)* running. Add the global reset just before disabling the * link clocks and core clocks. */ - ret =dp_ctrl_off_link_stream (&ctrl->dp_ctrl); + ret =dp_ctrl_off (&ctrl->dp_ctrl);if (ret) {DRM_ERROR ("failed to disable DP controller\n" );return ret;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 318/772 drm/msm/dp: do not stop transmitting phy test pattern during DP phy compliance test
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
[ Upstream commit 2788b4efa60c1e03ac10a156f3fdbd3be0f9198c ]
At normal operation, transmit phy test pattern has to be terminated before DP controller switch to video ready state. However during phy compliance testing, transmit phy test pattern should not be terminated until end of compliance test which usually indicated by unplugged interrupt.
Only stop sending the train pattern in dp_ctrl_on_stream() if we're not doing compliance testing. We also no longer reset 'p_level' and 'v_level' within dp_ctrl_on_link() due to both 'p_level' and 'v_level' are acquired from link status at previous dpcd read and we like to use those level to start link training.
Changes in v2:
-- add more details commit text
-- correct Fixes
Changes in v3:
-- drop unnecessary braces
Patchwork: https://patchwork.freedesktop.org/patch/483564/
--- drivers/gpu/drm/msm/dp/dp_ctrl.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
drivers/gpu/drm/msm/dp/dp_ctrl.c +6 -8
@@ -1686,8 +1686,6 @@ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl) ctrl->link->link_params.rate, ctrl->link->link_params.num_lanes, ctrl->dp_ctrl.pixel_rate); - ctrl->link->phy_params.p_level =0 ; - ctrl->link->phy_params.v_level =0 ; rc =dp_ctrl_enable_mainlink_clocks (ctrl);if (rc)
@@ -1809,12 +1807,6 @@ int dp_ctrl_on_stream(struct dp_ctrl *dp_ctrl) } } -if (!dp_ctrl_channel_eq_ok (ctrl)) -dp_ctrl_link_retrain (ctrl); - -/* stop txing train pattern to end link training */ -dp_ctrl_clear_training_pattern (ctrl); - ret =dp_ctrl_enable_stream_clocks (ctrl);if (ret) {DRM_ERROR ("Failed to start pixel clocks. ret=%d\n" , ret);
@@ -1826,6 +1818,12 @@ int dp_ctrl_on_stream(struct dp_ctrl *dp_ctrl)return 0 ; } +if (!dp_ctrl_channel_eq_ok (ctrl)) +dp_ctrl_link_retrain (ctrl); + +/* stop txing train pattern to end link training */ +dp_ctrl_clear_training_pattern (ctrl); +/* * Set up transfer unit values and set controller state to send * video.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 319/772 drm/msm/dsi: fix error checks and return values for DSI xmit functions
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit f0e7e9ed379c012c4d6b09a09b868accc426223c ]
As noticed by Dan ([1] an the followup thread) there are multiple issues with the return values for MSM DSI command transmission callback. In the error case it can easily return a positive value when it should have returned a proper error code.
This commits attempts to fix these issues both in TX and in RX paths.
[1]: https://lore.kernel.org/linux-arm-msm/20211001123617.GH2283@kili/
Patchwork: https://patchwork.freedesktop.org/patch/480501/
--- drivers/gpu/drm/msm/dsi/dsi_host.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
drivers/gpu/drm/msm/dsi/dsi_host.c +14 -7
@@ -1337,10 +1337,10 @@ static int dsi_cmds2buf_tx(struct msm_dsi_host *msm_host,dsi_get_bpp (msm_host->format) /8 ; len =dsi_cmd_dma_add (msm_host, msg); -if (!len) { +if (len <0 ) {pr_err ("%s: failed to add cmd type = 0x%x\n" , __func__, msg->type); -return -EINVAL ; +return len; }/* for video mode, do not send cmds more than
@@ -1359,10 +1359,14 @@ static int dsi_cmds2buf_tx(struct msm_dsi_host *msm_host, } ret =dsi_cmd_dma_tx (msm_host, len); -if (ret < len) { -pr_err ("%s: cmd dma tx failed, type=0x%x, data0=0x%x, len=%d\n" , - __func__, msg->type, (*(u8 *)(msg->tx_buf)), len); -return -ECOMM ; +if (ret <0 ) { +pr_err ("%s: cmd dma tx failed, type=0x%x, data0=0x%x, len=%d, ret=%d\n" , + __func__, msg->type, (*(u8 *)(msg->tx_buf)), len, ret); +return ret; + }else if (ret < len) { +pr_err ("%s: cmd dma tx failed, type=0x%x, data0=0x%x, ret=%d len=%d\n" , + __func__, msg->type, (*(u8 *)(msg->tx_buf)), ret, len); +return -EIO ; }return len;
@@ -2088,9 +2092,12 @@ int msm_dsi_host_cmd_rx(struct mipi_dsi_host *host, } ret =dsi_cmds2buf_tx (msm_host, msg); -if (ret < msg->tx_len) { +if (ret <0 ) {pr_err ("%s: Read cmd Tx failed, %d\n" , __func__, ret);return ret; + }else if (ret < msg->tx_len) { +pr_err ("%s: Read cmd Tx failed, too short: %d\n" , __func__, ret); +return -ECOMM ; }/*
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 320/772 drm/msm/hdmi: check return value after calling platform_get_resource_byname()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit a36e506711548df923ceb7ec9f6001375be799a5 ]
It will cause null-ptr-deref if platform_get_resource_byname() returns NULL, we need check the return value.
Patchwork: https://patchwork.freedesktop.org/patch/482992/
--- drivers/gpu/drm/msm/hdmi/hdmi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/msm/hdmi/hdmi.c +4 -0
@@ -142,6 +142,10 @@ static struct hdmi *msm_hdmi_init(struct platform_device *pdev)/* HDCP needs physical address of hdmi register */ res =platform_get_resource_byname (pdev,IORESOURCE_MEM , config->mmio_name); +if (!res) { + ret = -EINVAL ; + goto fail; + } hdmi->mmio_phy_addr = res->start; hdmi->qfprom_mmio = msm_ioremap(pdev,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 321/772 drm/msm/hdmi: fix error check return value of irq_of_parse_and_map()
In reply to Greg Kroah-HartmanFrom: Lv Ruyi <[email protected]>
[ Upstream commit 03371e4fbdeb7f596cbceacb59e474248b6d95ac ]
The irq_of_parse_and_map() function returns 0 on failure, and does not return a negative value anyhow, so never enter this conditional branch.
Patchwork: https://patchwork.freedesktop.org/patch/483294/
--- drivers/gpu/drm/msm/hdmi/hdmi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/msm/hdmi/hdmi.c +3 -3
@@ -303,9 +303,9 @@ int msm_hdmi_modeset_init(struct hdmi *hdmi,drm_connector_attach_encoder (hdmi->connector, hdmi->encoder); hdmi->irq =irq_of_parse_and_map (pdev->dev.of_node,0 ); -if (hdmi->irq <0 ) { - ret = hdmi->irq; -DRM_DEV_ERROR (dev->dev,"failed to get irq: %d\n" , ret); +if (!hdmi->irq) { + ret = -EINVAL ; +DRM_DEV_ERROR (dev->dev,"failed to get irq\n" ); goto fail; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 322/772 drm/msm: add missing include to msm_drv.c
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 8123fe83c3a3448bbfa5b5b1cacfdfe7d076fca6 ]
Add explicit include of drm_bridge.h to the msm_drv.c to fix the following warning:
drivers/gpu/drm/msm/msm_drv.c:236:17: error: implicit declaration of function 'drm_bridge_remove'; did you mean 'drm_bridge_detach'? [-Werror=implicit-function-declaration]
Patchwork: https://patchwork.freedesktop.org/patch/484310/
--- drivers/gpu/drm/msm/msm_drv.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/msm/msm_drv.c +1 -0
@@ -11,6 +11,7 @@#include <linux/uaccess.h> #include <uapi/linux/sched/types.h> +#include <drm/drm_bridge.h> #include <drm/drm_drv.h> #include <drm/drm_file.h> #include <drm/drm_ioctl.h>
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 323/772 drm/panel: panel-simple: Fix proper bpc for AM-1280800N3TZQW-T00H
In reply to Greg Kroah-HartmanFrom: Jagan Teki <[email protected]>
[ Upstream commit 7eafbecd2288c542ea15ea20cf1a7e64a25c21bc ]
AM-1280800N3TZQW-T00H panel support 8 bpc not 6 bpc as per recent testing in i.MX8MM platform.
Fix it.
--- drivers/gpu/drm/panel/panel-simple.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/panel/panel-simple.c +1 -1
@@ -720,7 +720,7 @@ static const struct drm_display_mode ampire_am_1280800n3tzqw_t00h_mode = {static const struct panel_desc ampire_am_1280800n3tzqw_t00h = { .modes = &ire_am_1280800n3tzqw_t00h_mode, .num_modes =1 , - .bpc =6 , + .bpc =8 , .size = { .width =217 , .height =136 ,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 324/772 kunit: fix debugfs code to use enum kunit_status, not bool
In reply to Greg Kroah-HartmanFrom: Daniel Latypov <[email protected]>
[ Upstream commit 38289a26e1b8a37755f3e07056ca416c1ee2a2e8 ]
Commit 6d2426b2f258 ("kunit: Support skipped tests") switched to using enum kunit_status to track the result of running a test/suite since we now have more than just pass/fail.
This callsite wasn't updated, silently converting to enum to a bool and then back.
--- lib/kunit/debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/kunit/debugfs.c +1 -1
@@ -52,7 +52,7 @@ static void debugfs_print_result(struct seq_file *seq,static int debugfs_print_results (struct seq_file *seq,void *v) {struct kunit_suite *suite = (struct kunit_suite *)seq->private; -bool success =kunit_suite_has_succeeded (suite); +enum kunit_status success =kunit_suite_has_succeeded (suite);struct kunit_case *test_case;if (!suite || !suite->log)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 325/772 drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit f8c242908ad15bbd604d3bcb54961b7d454c43f8 ]
It will cause null-ptr-deref in resource_size(), if platform_get_resource() returns NULL, move calling resource_size() after devm_ioremap_resource() that will check 'res' to avoid null-ptr-deref.
--- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/rockchip/rockchip_drm_vop.c +1 -1
@@ -2118,10 +2118,10 @@ static int vop_bind(struct device *dev, struct device *master, void *data)vop_win_init (vop); res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); - vop->len =resource_size (res); vop->regs =devm_ioremap_resource (dev, res);if (IS_ERR (vop->regs))return PTR_ERR (vop->regs); + vop->len =resource_size (res); res =platform_get_resource (pdev,IORESOURCE_MEM ,1 );if (res) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 326/772 spi: cadence-quadspi: fix Direct Access Mode disable for SoCFPGA
In reply to Greg Kroah-HartmanFrom: Ian Abbott <[email protected]>
[ Upstream commit f724c296f2f2cc3f9342b0fc26239635cbed856e ]
The Cadence QSPI compatible string required for the SoCFPGA platform changed from the default "cdns,qspi-nor" to "intel,socfpga-qspi" with the introduction of an additional quirk in
commit 98d948eb8331 ("spi: cadence-quadspi: fix write completion support"). However, that change did not preserve the previously used
quirk for this platform. Reinstate the CQSPI_DISABLE_DAC_MODE quirk for the SoCFPGA platform.
--- drivers/spi/spi-cadence-quadspi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-cadence-quadspi.c +1 -1
@@ -1863,7 +1863,7 @@ static const struct cqspi_driver_platdata intel_lgm_qspi = { };static const struct cqspi_driver_platdata socfpga_qspi = { - .quirks =CQSPI_NO_SUPPORT_WR_COMPLETION , + .quirks =CQSPI_DISABLE_DAC_MODE |CQSPI_NO_SUPPORT_WR_COMPLETION , };static const struct cqspi_driver_platdata versal_ospi = {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 327/772 perf tools: Use Python devtools for version autodetection rather than runtime
In reply to Greg Kroah-HartmanFrom: James Clark <[email protected]>
[ Upstream commit 630af16eee495f583db5202c3613d1b191f10694 ]
This fixes the issue where the build will fail if only the Python2 runtime is installed but the Python3 devtools are installed. Currently the workaround is 'make PYTHON=python3'.
Fix it by autodetecting Python based on whether python[x]-config exists rather than just python[x] because both are needed for the build. Then -config is stripped to find the Python runtime.
Testing
=======
* Auto detect links with Python3 when the v3 devtools are installed and only Python 2 runtime is installed
* Auto detect links with Python2 when both devtools are installed
* Sensible warning is printed if no Python devtools are installed
* 'make PYTHON=x' still automatically sets PYTHON_CONFIG=x-config
* 'make PYTHON=x' fails if x-config doesn't exist
* 'make PYTHON=python3' overrides Python2 devtools
* 'make PYTHON=python2' overrides Python3 devtools
* 'make PYTHON_CONFIG=x-config' works
* 'make PYTHON=x PYTHON_CONFIG=x' works
* 'make PYTHON=missing' reports an error
* 'make PYTHON_CONFIG=missing' reports an error
--- tools/perf/Makefile.config | 39 ++++++++++++++++++++++++++------------ 1 file changed, 27 insertions(+), 12 deletions(-)
tools/perf/Makefile.config +27 -12
@@ -239,18 +239,33 @@ ifdef PARSER_DEBUG endif # Try different combinations to accommodate systems that only have -# python[2][-config] in weird combinations but always preferring -# python2 and python2-config as per pep-0394. If python2 or python -# aren't found, then python3 is used. -PYTHON_AUTO := python -PYTHON_AUTO := $(if $(call get-executable,python3),python3,$(PYTHON_AUTO)) -PYTHON_AUTO := $(if $(call get-executable,python),python,$(PYTHON_AUTO)) -PYTHON_AUTO := $(if $(call get-executable,python2),python2,$(PYTHON_AUTO)) -override PYTHON := $(call get-executable-or-default,PYTHON,$(PYTHON_AUTO)) -PYTHON_AUTO_CONFIG := \ - $(if $(call get-executable,$(PYTHON)-config),$(PYTHON)-config,python-config) -override PYTHON_CONFIG := \ - $(call get-executable-or-default,PYTHON_CONFIG,$(PYTHON_AUTO_CONFIG)) +# python[2][3]-config in weird combinations in the following order of +# priority from lowest to highest: +# * python3-config +# * python-config +# * python2-config as per pep-0394. +# * $(PYTHON)-config (If PYTHON is user supplied but PYTHON_CONFIG isn't) +# +PYTHON_AUTO := python-config +PYTHON_AUTO := $(if $(call get-executable,python3-config),python3-config,$(PYTHON_AUTO)) +PYTHON_AUTO := $(if $(call get-executable,python-config),python-config,$(PYTHON_AUTO)) +PYTHON_AUTO := $(if $(call get-executable,python2-config),python2-config,$(PYTHON_AUTO)) + +# If PYTHON is defined but PYTHON_CONFIG isn't, then take $(PYTHON)-config as if it was the user +# supplied value for PYTHON_CONFIG. Because it's "user supplied", error out if it doesn't exist. +ifdef PYTHON + ifndef PYTHON_CONFIG + PYTHON_CONFIG_AUTO := $(call get-executable,$(PYTHON)-config) + PYTHON_CONFIG := $(if $(PYTHON_CONFIG_AUTO),$(PYTHON_CONFIG_AUTO),\ + $(call $(error $(PYTHON)-config not found))) + endif +endif + +# Select either auto detected python and python-config or use user supplied values if they are +# defined. get-executable-or-default fails with an error if the first argument is supplied but +# doesn't exist. +override PYTHON_CONFIG := $(call get-executable-or-default,PYTHON_CONFIG,$(PYTHON_AUTO)) +override PYTHON := $(call get-executable-or-default,PYTHON,$(subst -config,,$(PYTHON_AUTO))) grep-libs = $(filter -l%,$(1)) strip-libs = $(filter-out -l%,$(1))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 328/772 virtio_blk: fix the discard_granularity and discard_alignment queue limits
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 62952cc5bccd89b76d710de1d0b43244af0f2903 ]
The discard_alignment queue limit is named a bit misleading means the offset into the block device at which the discard granularity starts.
On the other hand the discard_sector_alignment from the virtio 1.1 looks similar to what Linux uses as discard granularity (even if not very well described):
"discard_sector_alignment can be used by OS when splitting a request
based on alignment. "
And at least qemu does set it to the discard granularity.
So stop setting the discard_alignment and use the virtio discard_sector_alignment to set the discard granularity.
--- drivers/block/virtio_blk.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/block/virtio_blk.c +4 -3
@@ -905,11 +905,12 @@ static int virtblk_probe(struct virtio_device *vdev)blk_queue_io_opt (q, blk_size * opt_io_size);if (virtio_has_feature (vdev,VIRTIO_BLK_F_DISCARD )) { - q->limits.discard_granularity = blk_size; - virtio_cread(vdev, struct virtio_blk_config, discard_sector_alignment, &v); - q->limits.discard_alignment = v ? v <<SECTOR_SHIFT :0 ; +if (v) + q->limits.discard_granularity = v <<SECTOR_SHIFT ; +else + q->limits.discard_granularity = blk_size; virtio_cread(vdev, struct virtio_blk_config, max_discard_sectors, &v);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 329/772 nl80211: dont hold RTNL in color change request
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 1b550a0bebfc0b69d6ec08fe6eb58953a8aec48a ]
It's not necessary to hold the RTNL across color change requests, since all the inner locking needs only the wiphy mutex which we already hold as well.
--- net/wireless/nl80211.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/wireless/nl80211.c +1 -2
@@ -16194,8 +16194,7 @@ static const struct genl_small_ops nl80211_small_ops[] = { .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, .doit = nl80211_color_change, .flags = GENL_UNS_ADMIN_PERM, - .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | - NL80211_FLAG_NEED_RTNL, + .internal_flags = NL80211_FLAG_NEED_NETDEV_UP, }, { .cmd = NL80211_CMD_SET_FILS_AAD,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 330/772 x86: Fix return value of __setup handlers
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 12441ccdf5e2f5a01a46e344976cbbd3d46845c9 ]
__setup() handlers should return 1 to obsolete_checksetup() in init/main.c to indicate that the boot option has been handled. A return of 0 causes the boot option/value to be listed as an Unknown kernel parameter and added to init's (limited) argument (no '=') or environment (with '=') strings. So return 1 from these x86 __setup handlers.
Examples:
Unknown kernel command line parameters "apicpmtimer
BOOT_IMAGE=/boot/bzImage-517rc8 vdso=1 ring3mwait=disable", will be passed to user space.
Run /sbin/init as init process
with arguments:
/sbin/init
apicpmtimer
with environment:
HOME=/
TERM=linux
BOOT_IMAGE=/boot/bzImage-517rc8
vdso=1
ring3mwait=disable--- arch/x86/entry/vdso/vma.c | 2 +- arch/x86/kernel/apic/apic.c | 2 +- arch/x86/kernel/cpu/intel.c | 2 +- arch/x86/mm/pat/memtype.c | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-)
arch/x86/entry/vdso/vma.c +1 -1
@@ -438,7 +438,7 @@ bool arch_syscall_is_vdso_sigreturn(struct pt_regs *regs)static __init int vdso_setup (char *s) { vdso64_enabled =simple_strtoul (s,NULL ,0 ); -return 0 ; +return 1 ; }__setup ("vdso=" , vdso_setup);
arch/x86/kernel/apic/apic.c +1 -1
@@ -170,7 +170,7 @@ static __init int setup_apicpmtimer(char *s) { apic_calibrate_pmtmr =1 ;notsc_setup (NULL ); -return 0 ; +return 1 ; }__setup ("apicpmtimer" , setup_apicpmtimer);#endif
arch/x86/kernel/cpu/intel.c +1 -1
@@ -91,7 +91,7 @@ static bool ring3mwait_disabled __read_mostly;static int __init ring3mwait_disable (char *__unused) { ring3mwait_disabled = true; -return 0 ; +return 1 ; }__setup ("ring3mwait=disable" , ring3mwait_disable);
arch/x86/mm/pat/memtype.c +1 -1
@@ -101,7 +101,7 @@ int pat_debug_enable;static int __init pat_debug_setup (char *str) { pat_debug_enable =1 ; -return 0 ; +return 1 ; }__setup ("debugpat" , pat_debug_setup);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 331/772 irqchip/exiu: Fix acknowledgment of edge triggered interrupts
In reply to Greg Kroah-HartmanFrom: Daniel Thompson <[email protected]>
[ Upstream commit 4efc851c36e389f7ed432edac0149acc5f94b0c7 ]
Currently the EXIU uses the fasteoi interrupt flow that is configured by it's parent (irq-gic-v3.c). With this flow the only chance to clear the interrupt request happens during .irq_eoi() and (obviously) this happens after the interrupt handler has run. EXIU requires edge triggered interrupts to be acked prior to interrupt handling. Without this we risk incorrect interrupt dismissal when a new interrupt is delivered after the handler reads and acknowledges the peripheral but before the irq_eoi() takes place.
Fix this by clearing the interrupt request from .irq_ack() if we are configured for edge triggered interrupts. This requires adopting the fasteoi-ack flow instead of the fasteoi to ensure the ack gets called.
These changes have been tested using the power button on a Developerbox/SC2A11 combined with some hackery in gpio-keys so I can play with the different trigger mode [and an mdelay(500) so I can can check what happens on a double click in both modes].
--- arch/arm64/Kconfig.platforms | 1 + drivers/irqchip/irq-sni-exiu.c | 25 ++++++++++++++++++++++--- 2 files changed, 23 insertions(+), 3 deletions(-)
arch/arm64/Kconfig.platforms +1 -0
@@ -253,6 +253,7 @@ config ARCH_INTEL_SOCFPGA config ARCH_SYNQUACER bool "Socionext SynQuacer SoC Family" + select IRQ_FASTEOI_HIERARCHY_HANDLERS config ARCH_TEGRA bool "NVIDIA Tegra SoC Family"
drivers/irqchip/irq-sni-exiu.c +22 -3
@@ -37,11 +37,26 @@ struct exiu_irq_data {u32 spi_base; }; -static void exiu_irq_eoi (struct irq_data *d) +static void exiu_irq_ack (struct irq_data *d) {struct exiu_irq_data *data =irq_data_get_irq_chip_data (d);writel (BIT (d->hwirq), data->base +EIREQCLR ); +} + +static void exiu_irq_eoi (struct irq_data *d) +{ +struct exiu_irq_data *data =irq_data_get_irq_chip_data (d); + +/* +* Level triggered interrupts are latched and must be cleared during +* EOI or the interrupt will be jammed on. Of course if a level +* triggered interrupt is still asserted then the write will not clear +* the interrupt. +*/ +if (irqd_is_level_type (d)) +writel (BIT (d->hwirq), data->base +EIREQCLR ); +irq_chip_eoi_parent (d); }
@@ -91,10 +106,13 @@ static int exiu_irq_set_type(struct irq_data *d, unsigned int type)writel_relaxed (val, data->base +EILVL ); val =readl_relaxed (data->base +EIEDG ); -if (type ==IRQ_TYPE_LEVEL_LOW || type ==IRQ_TYPE_LEVEL_HIGH ) +if (type ==IRQ_TYPE_LEVEL_LOW || type ==IRQ_TYPE_LEVEL_HIGH ) { val &= ~BIT (d->hwirq); -else +irq_set_handler_locked (d, handle_fasteoi_irq); + }else { val |=BIT (d->hwirq); +irq_set_handler_locked (d, handle_fasteoi_ack_irq); + }writel_relaxed (val, data->base +EIEDG );writel_relaxed (BIT (d->hwirq), data->base +EIREQCLR );
@@ -104,6 +122,7 @@ static int exiu_irq_set_type(struct irq_data *d, unsigned int type)static struct irq_chip exiu_irq_chip = { .name ="EXIU" , + .irq_ack = exiu_irq_ack, .irq_eoi = exiu_irq_eoi, .irq_enable = exiu_irq_enable, .irq_mask = exiu_irq_mask,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 332/772 irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 50f0f26e7c8665763d0d7d3372dbcf191f94d077 ]
The irq_of_parse_and_map() returns 0 on failure, not a negative ERRNO.
--- drivers/irqchip/irq-aspeed-i2c-ic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/irqchip/irq-aspeed-i2c-ic.c +2 -2
@@ -77,8 +77,8 @@ static int __init aspeed_i2c_ic_of_init(struct device_node *node, } i2c_ic->parent_irq =irq_of_parse_and_map (node,0 ); -if (i2c_ic->parent_irq <0 ) { - ret = i2c_ic->parent_irq; +if (!i2c_ic->parent_irq) { + ret = -EINVAL ; goto err_iounmap; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 333/772 irqchip/aspeed-scu-ic: Fix irq_of_parse_and_map() return value
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit f03a9670d27d23fe734a456f16e2579b21ec02b4 ]
The irq_of_parse_and_map() returns 0 on failure, not a negative ERRNO.
--- drivers/irqchip/irq-aspeed-scu-ic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/irqchip/irq-aspeed-scu-ic.c +2 -2
@@ -157,8 +157,8 @@ static int aspeed_scu_ic_of_init_common(struct aspeed_scu_ic *scu_ic, } irq =irq_of_parse_and_map (node,0 ); -if (irq <0 ) { - rc = irq; +if (!irq) { + rc = -EINVAL ; goto err; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 334/772 x86/mm: Cleanup the control_va_addr_alignment() __setup handler
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 1ef64b1e89e6d4018da46e08ffc32779a31160c7 ]
Clean up control_va_addr_alignment():
a. Make '=' required instead of optional (as documented). b. Print a warning if an invalid option value is used.
c. Return 1 from the __setup handler when an invalid option value is
used. This prevents the kernel from polluting init's (limited) environment space with the entire string.
--- arch/x86/kernel/sys_x86_64.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
arch/x86/kernel/sys_x86_64.c +2 -5
@@ -68,9 +68,6 @@ static int __init control_va_addr_alignment(char *str)if (*str ==0 )return 1 ; -if (*str =='=' ) - str++; -if (!strcmp (str,"32" )) va_align.flags =ALIGN_VA_32 ;else if (!strcmp (str,"64" ))
@@ -80,11 +77,11 @@ static int __init control_va_addr_alignment(char *str)else if (!strcmp (str,"on" )) va_align.flags =ALIGN_VA_32 |ALIGN_VA_64 ;else -return 0 ; +pr_warn ("invalid option value: 'align_va_addr=%s'\n" , str);return 1 ; } -__setup ("align_va_addr" , control_va_addr_alignment); +__setup ("align_va_addr=" , control_va_addr_alignment); SYSCALL_DEFINE6(mmap, unsigned long, addr, unsigned long, len, unsigned long, prot, unsigned long, flags,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 335/772 arm64: fix types in copy_highpage()
In reply to Greg Kroah-HartmanFrom: Tong Tiangen <[email protected]>
[ Upstream commit 921d161f15d6b090599f6a8c23f131969edbd1fa ]
In copy_highpage() the kto and kfrom local variables are pointers to struct page, but these are used to hold arbitrary pointers to kernel memory . Each call to page_address() returns a void pointer to memory associated with the relevant page, and copy_page() expects void pointers to this memory.
This inconsistency was introduced in commit 2563776b41c3 ("arm64: mte:
Tags-aware copy_{user_,}highpage() implementations") and while this doesn't appear to be harmful in practice it is clearly wrong.
Correct this by making kto and kfrom void pointers.
--- arch/arm64/mm/copypage.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/mm/copypage.c +2 -2
@@ -16,8 +16,8 @@void copy_highpage (struct page *to,struct page *from) { -struct page *kto =page_address (to); -struct page *kfrom =page_address (from); +void *kto =page_address (to); +void *kfrom =page_address (from);copy_page (kto, kfrom);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 336/772 regulator: core: Fix enable_count imbalance with EXCLUSIVE_GET
In reply to Greg Kroah-HartmanFrom: Zev Weiss <[email protected]>
[ Upstream commit c3e3ca05dae37f8f74bb80358efd540911cbc2c8 ]
Since the introduction of regulator->enable_count, a driver that did an exclusive get on an already-enabled regulator would end up with enable_count initialized to 0 but rdev->use_count initialized to 1. With that starting point the regulator is effectively stuck enabled, because if the driver attempted to disable it it would fail the enable_count underflow check in _regulator_handle_consumer_disable().
The EXCLUSIVE_GET path in _regulator_get() now initializes enable_count along with rdev->use_count so that the regulator can be disabled without underflowing the former.
--- drivers/regulator/core.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/regulator/core.c +5 -2
@@ -2133,10 +2133,13 @@ struct regulator *_regulator_get(struct device *dev, const char *id, rdev->exclusive =1 ; ret =_regulator_is_enabled (rdev); -if (ret >0 ) +if (ret >0 ) { rdev->use_count =1 ; -else + regulator->enable_count =1 ; + }else { rdev->use_count =0 ; + regulator->enable_count =0 ; + } } link =device_link_add (dev, &rdev->dev,DL_FLAG_STATELESS );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 337/772 drm/msm/disp/dpu1: avoid clearing hw interrupts if hw_intr is null during drm uninit
In reply to Greg Kroah-HartmanFrom: Vinod Polimera <[email protected]>
[ Upstream commit 01013ba9bbddc62f7d011163cebfd7ed06bb698b ]
If edp modeset init is failed due to panel being not ready and probe defers during drm bind, avoid clearing irqs and dereference hw_intr when hw_intr is null.
BUG: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Call trace: dpu_core_irq_uninstall+0x50/0xb0 dpu_irq_uninstall+0x18/0x24 msm_drm_uninit+0xd8/0x16c msm_drm_bind+0x580/0x5fc try_to_bring_up_master+0x168/0x1c0 __component_add+0xb4/0x178 component_add+0x1c/0x28 dp_display_probe+0x38c/0x400 platform_probe+0xb0/0xd0 really_probe+0xcc/0x2c8 __driver_probe_device+0xbc/0xe8 driver_probe_device+0x48/0xf0 __device_attach_driver+0xa0/0xc8 bus_for_each_drv+0x8c/0xd8 __device_attach+0xc4/0x150 device_initial_probe+0x1c/0x28
Changes in V2:
- Update commit message and coreect fixes tag.
Patchwork: https://patchwork.freedesktop.org/patch/484430/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c +3 -0
@@ -593,6 +593,9 @@ void dpu_core_irq_uninstall(struct dpu_kms *dpu_kms) {int i; +if (!dpu_kms->hw_intr) +return ; +pm_runtime_get_sync (&dpu_kms->pdev->dev);for (i =0 ; i < dpu_kms->hw_intr->total_irqs; i++)if (!list_empty (&dpu_kms->hw_intr->irq_cb_tbl[i]))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 338/772 drm/msm/dsi: fix address for second DSI PHY on SDM660
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 9208c707650354dff5b164b586837454f7285124 ]
Correct a typo in the address of the second DSI PHY in the SDM660 device config.
Patchwork: https://patchwork.freedesktop.org/patch/484697/
--- drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c +1 -1
@@ -1062,7 +1062,7 @@ const struct msm_dsi_phy_cfg dsi_phy_14nm_660_cfgs = { }, .min_pll_rate = VCO_MIN_RATE, .max_pll_rate = VCO_MAX_RATE, - .io_start = { 0xc994400, 0xc996000 }, + .io_start = { 0xc994400, 0xc996400 }, .num_dsi_phy = 2, };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 339/772 drm/msm/dp: fix event thread stuck in wait_event after kthread_stop()
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
[ Upstream commit 2f9b5b3ae2eb625b75a898212a76f3b8c6d0d2b0 ]
Event thread supposed to exit from its while loop after kthread_stop(). However there may has possibility that event thread is pending in the middle of wait_event due to condition checking never become true. To make sure event thread exit its loop after kthread_stop(), this patch OR kthread_should_stop() into wait_event's condition checking so that event thread will exit its loop after kernal_stop().
Changes in v2:
-- correct spelling error at commit title
Changes in v3:
-- remove unnecessary parenthesis
-- while(1) to replace while (!kthread_should_stop())
Patchwork: https://patchwork.freedesktop.org/patch/484576/
--- drivers/gpu/drm/msm/dp/dp_display.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/gpu/drm/msm/dp/dp_display.c +9 -4
@@ -1065,15 +1065,20 @@ static int hpd_event_thread(void *data) dp_priv = (struct dp_display_private *)data; -while (!kthread_should_stop ()) { +while (1 ) {if (timeout_mode) {wait_event_timeout (dp_priv->event_q, - (dp_priv->event_pndx == dp_priv->event_gndx), -EVENT_TIMEOUT ); + (dp_priv->event_pndx == dp_priv->event_gndx) || +kthread_should_stop (),EVENT_TIMEOUT ); }else {wait_event_interruptible (dp_priv->event_q, - (dp_priv->event_pndx != dp_priv->event_gndx)); + (dp_priv->event_pndx != dp_priv->event_gndx) || +kthread_should_stop ()); } + +if (kthread_should_stop ()) +break ; +spin_lock_irqsave (&dp_priv->event_lock, flag); todo = &dp_priv->event_list[dp_priv->event_gndx];if (todo->delay) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 340/772 drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected
In reply to Greg Kroah-HartmanFrom: Jessica Zhang <[email protected]>
[ Upstream commit d59be579fa932c46b908f37509f319cbd4ca9a68 ]
mdp5_get_global_state runs the risk of hitting a -EDEADLK when acquiring the modeset lock, but currently mdp5_pipe_release doesn't check for if an error is returned. Because of this, there is a possibility of mdp5_pipe_release hitting a NULL dereference error.
To avoid this, let's have mdp5_pipe_release check if mdp5_get_global_state returns an error and propogate that error.
Changes since v1:
- Separated declaration and initialization of *new_state to avoid compiler warning
- Fixed some spelling mistakes in commit message
Changes since v2:
- Return 0 in case where hwpipe is NULL as this is considered normal behavior
- Added 2nd patch in series to fix a similar NULL dereference issue in mdp5_mixer_release
Patchwork: https://patchwork.freedesktop.org/patch/485179/
--- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 15 +++++++++++---- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 ++++++++++++++++---- 3 files changed, 28 insertions(+), 9 deletions(-)
drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c +11 -4
@@ -119,18 +119,23 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane,return 0 ; } -void mdp5_pipe_release (struct drm_atomic_state *s,struct mdp5_hw_pipe *hwpipe) +int mdp5_pipe_release (struct drm_atomic_state *s,struct mdp5_hw_pipe *hwpipe) {struct msm_drm_private *priv = s->dev->dev_private;struct mdp5_kms *mdp5_kms =to_mdp5_kms (to_mdp_kms (priv->kms));struct mdp5_global_state *state =mdp5_get_global_state (s); -struct mdp5_hw_pipe_state *new_state = &state->hwpipe; +struct mdp5_hw_pipe_state *new_state;if (!hwpipe) -return ; +return 0 ; + +if (IS_ERR (state)) +return PTR_ERR (state); + + new_state = &state->hwpipe;if (WARN_ON (!new_state->hwpipe_to_plane[hwpipe->idx])) -return ; +return -EINVAL ;DBG ("%s: release from plane %s" , hwpipe->name, new_state->hwpipe_to_plane[hwpipe->idx]->name);
@@ -141,6 +146,8 @@ void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) } new_state->hwpipe_to_plane[hwpipe->idx] =NULL ; + +return 0 ; }void mdp5_pipe_destroy (struct mdp5_hw_pipe *hwpipe)
drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h +1 -1
@@ -37,7 +37,7 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane, uint32_t caps, uint32_t blkcfg, struct mdp5_hw_pipe **hwpipe, struct mdp5_hw_pipe **r_hwpipe); -void mdp5_pipe_release (struct drm_atomic_state *s,struct mdp5_hw_pipe *hwpipe); +int mdp5_pipe_release (struct drm_atomic_state *s,struct mdp5_hw_pipe *hwpipe);struct mdp5_hw_pipe *mdp5_pipe_init (enum mdp5_pipe pipe,uint32_t reg_offset,uint32_t caps);
drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +16 -4
@@ -297,12 +297,24 @@ static int mdp5_plane_atomic_check_with_state(struct drm_crtc_state *crtc_state, mdp5_state->r_hwpipe =NULL ; -mdp5_pipe_release (state->state, old_hwpipe); -mdp5_pipe_release (state->state, old_right_hwpipe); + ret =mdp5_pipe_release (state->state, old_hwpipe); +if (ret) +return ret; + + ret =mdp5_pipe_release (state->state, old_right_hwpipe); +if (ret) +return ret; + } }else { -mdp5_pipe_release (state->state, mdp5_state->hwpipe); -mdp5_pipe_release (state->state, mdp5_state->r_hwpipe); + ret =mdp5_pipe_release (state->state, mdp5_state->hwpipe); +if (ret) +return ret; + + ret =mdp5_pipe_release (state->state, mdp5_state->r_hwpipe); +if (ret) +return ret; + mdp5_state->hwpipe = mdp5_state->r_hwpipe =NULL ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 341/772 drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected
In reply to Greg Kroah-HartmanFrom: Jessica Zhang <[email protected]>
[ Upstream commit ca75f6f7c6f89365e40f10f641b15981b1f07c31 ]
There is a possibility for mdp5_get_global_state to return -EDEADLK when acquiring the modeset lock, but currently global_state in mdp5_mixer_release doesn't check for if an error is returned.
To avoid a NULL dereference error, let's have mdp5_mixer_release check if an error is returned and propagate that error.
Patchwork: https://patchwork.freedesktop.org/patch/485181/
--- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 10 ++++++++-- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c | 15 +++++++++++---- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h | 4 ++-- 3 files changed, 21 insertions(+), 8 deletions(-)
drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +8 -2
@@ -612,9 +612,15 @@ static int mdp5_crtc_setup_pipeline(struct drm_crtc *crtc,if (ret)return ret; -mdp5_mixer_release (new_crtc_state->state, old_mixer); + ret =mdp5_mixer_release (new_crtc_state->state, old_mixer); +if (ret) +return ret; +if (old_r_mixer) { -mdp5_mixer_release (new_crtc_state->state, old_r_mixer); + ret =mdp5_mixer_release (new_crtc_state->state, old_r_mixer); +if (ret) +return ret; +if (!need_right_mixer) pipeline->r_mixer =NULL ; }
drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c +11 -4
@@ -116,21 +116,28 @@ int mdp5_mixer_assign(struct drm_atomic_state *s, struct drm_crtc *crtc,return 0 ; } -void mdp5_mixer_release (struct drm_atomic_state *s,struct mdp5_hw_mixer *mixer) +int mdp5_mixer_release (struct drm_atomic_state *s,struct mdp5_hw_mixer *mixer) {struct mdp5_global_state *global_state =mdp5_get_global_state (s); -struct mdp5_hw_mixer_state *new_state = &global_state->hwmixer; +struct mdp5_hw_mixer_state *new_state;if (!mixer) -return ; +return 0 ; + +if (IS_ERR (global_state)) +return PTR_ERR (global_state); + + new_state = &global_state->hwmixer;if (WARN_ON (!new_state->hwmixer_to_crtc[mixer->idx])) -return ; +return -EINVAL ;DBG ("%s: release from crtc %s" , mixer->name, new_state->hwmixer_to_crtc[mixer->idx]->name); new_state->hwmixer_to_crtc[mixer->idx] =NULL ; + +return 0 ; }void mdp5_mixer_destroy (struct mdp5_hw_mixer *mixer)
drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h +2 -2
@@ -30,7 +30,7 @@ void mdp5_mixer_destroy(struct mdp5_hw_mixer *lm);int mdp5_mixer_assign (struct drm_atomic_state *s,struct drm_crtc *crtc,uint32_t caps,struct mdp5_hw_mixer **mixer,struct mdp5_hw_mixer **r_mixer); -void mdp5_mixer_release (struct drm_atomic_state *s, -struct mdp5_hw_mixer *mixer); +int mdp5_mixer_release (struct drm_atomic_state *s, +struct mdp5_hw_mixer *mixer);#endif /* __MDP5_LM_H__ */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 342/772 drm/msm: return an error pointer in msm_gem_prime_get_sg_table()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit cf575e31611eb6dccf08fad02e57e35b2187704d ]
The msm_gem_prime_get_sg_table() needs to return error pointers on error. This is called from drm_gem_map_dma_buf() and returning a NULL will lead to a crash in that function.
Patchwork: https://patchwork.freedesktop.org/patch/485023/
--- drivers/gpu/drm/msm/msm_gem_prime.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/msm_gem_prime.c +1 -1
@@ -17,7 +17,7 @@ struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj)int npages = obj->size >>PAGE_SHIFT ;if (WARN_ON (!msm_obj->pages))/* should have already pinned! */ -return NULL ; +return ERR_PTR (-ENOMEM );return drm_prime_pages_to_sg (obj->dev, msm_obj->pages, npages); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 343/772 media: uvcvideo: Fix missing check to determine if element is found in list
In reply to Greg Kroah-HartmanFrom: Xiaomeng Tong <[email protected]>
[ Upstream commit 261f33388c29f6f3c12a724e6d89172b7f6d5996 ]
The list iterator will point to a bogus position containing HEAD if the list is empty or the element is not found in list. This case should be checked before any use of the iterator, otherwise it will lead to a invalid memory access. The missing check here is before "pin = iterm->id;", just add check here to fix the security bug.
In addition, the list iterator value will *always* be set and non-NULL by list_for_each_entry(), so it is incorrect to assume that the iterator value will be NULL if the element is not found in list, considering the (mis)use here: "if (iterm == NULL".
Use a new value 'it' as the list iterator, while use the old value 'iterm' as a dedicated pointer to point to the found element, which
1. can fix this bug, due to 'iterm' is NULL only if it's not found.
2. do not need to change all the uses of 'iterm' after the loop.
3. can also limit the scope of the list iterator 'it' *only inside* the traversal loop by simply declaring 'it' inside the loop in the future, as usage of the iterator outside of the list_for_each_entry is considered harmful. https://lkml.org/lkml/2022/2/17/1032
--- drivers/media/usb/uvc/uvc_v4l2.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
drivers/media/usb/uvc/uvc_v4l2.c +11 -9
@@ -871,29 +871,31 @@ static int uvc_ioctl_enum_input(struct file *file, void *fh,struct uvc_video_chain *chain = handle->chain;const struct uvc_entity *selector = chain->selector;struct uvc_entity *iterm =NULL ; +struct uvc_entity *it;u32 index = input->index; -int pin =0 ;if (selector ==NULL || (chain->dev->quirks &UVC_QUIRK_IGNORE_SELECTOR_UNIT )) {if (index !=0 )return -EINVAL ; -list_for_each_entry (iterm, &chain->entities, chain) { -if (UVC_ENTITY_IS_ITERM (iterm)) +list_for_each_entry (it, &chain->entities, chain) { +if (UVC_ENTITY_IS_ITERM (it)) { + iterm = it;break ; + } } - pin = iterm->id; }else if (index < selector->bNrInPins) { - pin = selector->baSourceID[index]; -list_for_each_entry (iterm, &chain->entities, chain) { -if (!UVC_ENTITY_IS_ITERM (iterm)) +list_for_each_entry (it, &chain->entities, chain) { +if (!UVC_ENTITY_IS_ITERM (it))continue ; -if (iterm->id == pin) +if (it->id == selector->baSourceID[index]) { + iterm = it;break ; + } } } -if (iterm ==NULL || iterm->id != pin) +if (iterm ==NULL )return -EINVAL ;memset (input,0 ,sizeof (*input));
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 344/772 arm64: stackleak: fix current_top_of_stack()
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
[ Upstream commit e85094c31ddb794ac41c299a5a7a68243148f829 ]
Due to some historical confusion, arm64's current_top_of_stack() isn't what the stackleak code expects. This could in theory result in a number of problems, and practically results in an unnecessary performance hit. We can avoid this by aligning the arm64 implementation with the x86 implementation.
The arm64 implementation of current_top_of_stack() was added specifically for stackleak in commit:
0b3e336601b82c6a ("arm64: Add support for STACKLEAK gcc plugin")
This was intended to be equivalent to the x86 implementation, but the implementation, semantics, and performance characteristics differ wildly:
* On x86, current_top_of_stack() returns the top of the current task's task stack, regardless of which stack is in active use.
The implementation accesses a percpu variable which the x86 entry code maintains, and returns the location immediately above the pt_regs on the task stack (above which x86 has some padding).
* On arm64 current_top_of_stack() returns the top of the stack in active use (i.e. the one which is currently being used).
The implementation checks the SP against a number of potentially-accessible stacks, and will BUG() if no stack is found.
The core stackleak_erase() code determines the upper bound of stack to erase with:
| if (on_thread_stack()) | boundary = current_stack_pointer; | else | boundary = current_top_of_stack();
On arm64 stackleak_erase() is always called on a task stack, and on_thread_stack() should always be true. On x86, stackleak_erase() is mostly called on a trampoline stack, and is sometimes called on a task stack.
Currently, this results in a lot of unnecessary code being generated for arm64 for the impossible !on_thread_stack() case. Some of this is inlined, bloating stackleak_erase(), while portions of this are left out-of-line and permitted to be instrumented (which would be a functional problem if that code were reachable).
As a first step towards improving this, this patch aligns arm64's implementation of current_top_of_stack() with x86's, always returning the top of the current task's stack. With GCC 11.1.0 this results in the bulk of the unnecessary code being removed, including all of the out-of-line instrumentable code.
While I don't believe there's a functional problem in practice I've marked this as a fix since the semantic was clearly wrong, the fix itself is simple, and other code might rely upon this in future.
--- arch/arm64/include/asm/processor.h | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
arch/arm64/include/asm/processor.h +4 -6
@@ -380,12 +380,10 @@ long get_tagged_addr_ctrl(struct task_struct *task);* of header definitions for the use of task_stack_page. */ -#define current_top_of_stack () \ -({ \ - struct stack_info _info; \ - BUG_ON(!on_accessible_stack(current, current_stack_pointer, 1, &_info)); \ - _info.high; \ -}) +/* +* The top of the current task's task stack +*/ +#define current_top_of_stack () ((unsigned long)current->stack + THREAD_SIZE)#define on_thread_stack () (on_task_stack(current, current_stack_pointer, 1, NULL))#endif /* __ASSEMBLY__ */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 345/772 iomap: iomap_write_failed fix
In reply to Greg Kroah-HartmanFrom: Andreas Gruenbacher <[email protected]>
[ Upstream commit b71450e2cc4b3c79f33c5bd276d152af9bd54f79 ]
The @lend parameter of truncate_pagecache_range() should be the offset of the last byte of the hole, not the first byte beyond it.
--- fs/iomap/buffered-io.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/iomap/buffered-io.c +2 -1
@@ -542,7 +542,8 @@ iomap_write_failed(struct inode *inode, loff_t pos, unsigned len)* write started inside the existing inode size. */ if (pos + len > i_size) -truncate_pagecache_range (inode,max (pos, i_size), pos + len); +truncate_pagecache_range (inode,max (pos, i_size), + pos + len -1 ); } static int iomap_read_folio_sync(loff_t block_start, struct folio *folio,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 346/772 spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit a2b331ac11e1cac56f5b7d367e9f3c5796deaaed ]
It will cause null-ptr-deref if platform_get_resource_byname() returns NULL, we need check the return value.
--- drivers/spi/spi-fsl-qspi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/spi/spi-fsl-qspi.c +4 -0
@@ -876,6 +876,10 @@ static int fsl_qspi_probe(struct platform_device *pdev) res =platform_get_resource_byname (pdev,IORESOURCE_MEM ,"QuadSPI-memory" ); +if (!res) { + ret = -EINVAL ; + goto err_put_ctrl; + } q->memmap_phy = res->start;/* Since there are 4 cs, map size required is 4 times ahb_buf_size */ q->ahb_addr = devm_ioremap(dev, q->memmap_phy,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 347/772 selftests/bpf: Prevent skeleton generation race
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 1e2666e029e5cc2b81dbd7c85af5bcc8c80524e0 ]
Prevent "classic" and light skeleton generation rules from stomping on each other's toes due to the use of the same <obj>.linked{1,2,3}.o naming pattern. There is no coordination and synchronizataion between .skel.h and .lskel.h rules, so they can easily overwrite each other's intermediate object files, leading to errors like:
/bin/sh: line 1: 170928 Bus error (core dumped)
/data/users/andriin/linux/tools/testing/selftests/bpf/tools/sbin/bpftool gen skeleton /data/users/andriin/linux/tools/testing/selftests/bpf/test_ksyms_weak.linked3.o name test_ksyms_weak
Quoted 1 line
/data/users/andriin/linux/tools/testing/selftests/bpf/test_ksyms_weak.skel.h
make: *** [Makefile:507: /data/users/andriin/linux/tools/testing/selftests/bpf/test_ksyms_weak.skel.h] Error 135
make: *** Deleting file '/data/users/andriin/linux/tools/testing/selftests/bpf/test_ksyms_weak.skel.h'
Fix by using different suffix for light skeleton rule.
--- tools/testing/selftests/bpf/Makefile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
tools/testing/selftests/bpf/Makefile +5 -5
@@ -407,11 +407,11 @@ $(TRUNNER_BPF_SKELS): %.skel.h: %.o $(BPFTOOL) | $(TRUNNER_OUTPUT) $(TRUNNER_BPF_LSKELS): %.lskel.h: %.o $(BPFTOOL) | $(TRUNNER_OUTPUT) $$(call msg,GEN-SKEL,$(TRUNNER_BINARY),$$@) - $(Q)$$(BPFTOOL) gen object $$(<:.o=.linked1.o) $$< - $(Q)$$(BPFTOOL) gen object $$(<:.o=.linked2.o) $$(<:.o=.linked1.o) - $(Q)$$(BPFTOOL) gen object $$(<:.o=.linked3.o) $$(<:.o=.linked2.o) - $(Q)diff $$(<:.o=.linked2.o) $$(<:.o=.linked3.o) - $(Q)$$(BPFTOOL) gen skeleton -L $$(<:.o=.linked3.o) name $$(notdir $$(<:.o=_lskel)) > $$@ + $(Q)$$(BPFTOOL) gen object $$(<:.o=.llinked1.o) $$< + $(Q)$$(BPFTOOL) gen object $$(<:.o=.llinked2.o) $$(<:.o=.llinked1.o) + $(Q)$$(BPFTOOL) gen object $$(<:.o=.llinked3.o) $$(<:.o=.llinked2.o) + $(Q)diff $$(<:.o=.llinked2.o) $$(<:.o=.llinked3.o) + $(Q)$$(BPFTOOL) gen skeleton -L $$(<:.o=.llinked3.o) name $$(notdir $$(<:.o=_lskel)) > $$@ $(TRUNNER_BPF_SKELS_LINKED): $(TRUNNER_BPF_OBJS) $(BPFTOOL) | $(TRUNNER_OUTPUT) $$(call msg,LINK-BPF,$(TRUNNER_BINARY),$$(@:.skel.h=.o))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 348/772 Revert "cpufreq: Fix possible race in cpufreq online error path"
In reply to Greg Kroah-HartmanFrom: Viresh Kumar <[email protected]>
[ Upstream commit 85f0e42bd65d01b351d561efb38e584d4c596553 ]
This reverts commit f346e96267cd76175d6c201b40f770c0116a8a04.
The commit tried to fix a possible real bug but it made it even worse. The fix was simply buggy as now an error out to out_offline_policy or out_exit_policy will try to release a semaphore which was never taken in the first place. This works fine only if we failed late, i.e. via out_destroy_policy.
--- drivers/cpufreq/cpufreq.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/cpufreq/cpufreq.c +2 -3
@@ -1534,6 +1534,8 @@ static int cpufreq_online(unsigned int cpu)for_each_cpu (j, policy->real_cpus)remove_cpu_dev_symlink (policy,get_cpu_device (j)); +up_write (&policy->rwsem); + out_offline_policy:if (cpufreq_driver->offline) cpufreq_driver->offline (policy);
@@ -1542,9 +1544,6 @@ static int cpufreq_online(unsigned int cpu)if (cpufreq_driver->exit) cpufreq_driver->exit (policy); -cpumask_clear (policy->cpus); -up_write (&policy->rwsem); - out_free_policy:cpufreq_policy_free (policy);return ret;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 349/772 regulator: qcom_smd: Fix up PM8950 regulator configuration
In reply to Greg Kroah-HartmanFrom: Konrad Dybcio <[email protected]>
[ Upstream commit b11b3d21a94d66bc05d1142e0b210bfa316c62be ]
Following changes have been made:
- S5, L4, L18, L20 and L21 were removed (S5 is managed by SPMI, whereas the rest seems not to exist [or at least it's blocked by Sony Loire /MSM8956/ RPM firmware])
- Supply maps have were adjusted to reflect regulator changes.
--- drivers/regulator/qcom_smd-regulator.c | 35 +++++++++++++------------- 1 file changed, 17 insertions(+), 18 deletions(-)
drivers/regulator/qcom_smd-regulator.c +17 -18
@@ -944,32 +944,31 @@ static const struct rpm_regulator_data rpm_pm8950_regulators[] = { { "s2", QCOM_SMD_RPM_SMPA, 2, &pm8950_hfsmps, "vdd_s2" }, { "s3", QCOM_SMD_RPM_SMPA, 3, &pm8950_hfsmps, "vdd_s3" }, { "s4", QCOM_SMD_RPM_SMPA, 4, &pm8950_hfsmps, "vdd_s4" }, - { "s5", QCOM_SMD_RPM_SMPA, 5, &pm8950_ftsmps2p5, "vdd_s5" }, +/* S5 is managed via SPMI. */ { "s6", QCOM_SMD_RPM_SMPA, 6, &pm8950_hfsmps, "vdd_s6" }, { "l1", QCOM_SMD_RPM_LDOA, 1, &pm8950_ult_nldo, "vdd_l1_l19" }, { "l2", QCOM_SMD_RPM_LDOA, 2, &pm8950_ult_nldo, "vdd_l2_l23" }, { "l3", QCOM_SMD_RPM_LDOA, 3, &pm8950_ult_nldo, "vdd_l3" }, - { "l4", QCOM_SMD_RPM_LDOA, 4, &pm8950_ult_pldo, "vdd_l4_l5_l6_l7_l16" }, - { "l5", QCOM_SMD_RPM_LDOA, 5, &pm8950_pldo_lv, "vdd_l4_l5_l6_l7_l16" }, - { "l6", QCOM_SMD_RPM_LDOA, 6, &pm8950_pldo_lv, "vdd_l4_l5_l6_l7_l16" }, - { "l7", QCOM_SMD_RPM_LDOA, 7, &pm8950_pldo_lv, "vdd_l4_l5_l6_l7_l16" }, +/* L4 seems not to exist. */ + { "l5", QCOM_SMD_RPM_LDOA, 5, &pm8950_pldo_lv, "vdd_l5_l6_l7_l16" }, + { "l6", QCOM_SMD_RPM_LDOA, 6, &pm8950_pldo_lv, "vdd_l5_l6_l7_l16" }, + { "l7", QCOM_SMD_RPM_LDOA, 7, &pm8950_pldo_lv, "vdd_l5_l6_l7_l16" }, { "l8", QCOM_SMD_RPM_LDOA, 8, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22" }, { "l9", QCOM_SMD_RPM_LDOA, 9, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18" }, { "l10", QCOM_SMD_RPM_LDOA, 10, &pm8950_ult_nldo, "vdd_l9_l10_l13_l14_l15_l18"}, - { "l11", QCOM_SMD_RPM_LDOA, 11, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22"}, - { "l12", QCOM_SMD_RPM_LDOA, 12, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22"}, - { "l13", QCOM_SMD_RPM_LDOA, 13, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18"}, - { "l14", QCOM_SMD_RPM_LDOA, 14, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18"}, - { "l15", QCOM_SMD_RPM_LDOA, 15, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18"}, - { "l16", QCOM_SMD_RPM_LDOA, 16, &pm8950_ult_pldo, "vdd_l4_l5_l6_l7_l16"}, - { "l17", QCOM_SMD_RPM_LDOA, 17, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22"}, - { "l18", QCOM_SMD_RPM_LDOA, 18, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18"}, - { "l19", QCOM_SMD_RPM_LDOA, 18, &pm8950_pldo, "vdd_l1_l19"}, - { "l20", QCOM_SMD_RPM_LDOA, 18, &pm8950_pldo, "vdd_l20"}, - { "l21", QCOM_SMD_RPM_LDOA, 18, &pm8950_pldo, "vdd_l21"}, - { "l22", QCOM_SMD_RPM_LDOA, 18, &pm8950_pldo, "vdd_l8_l11_l12_l17_l22"}, - { "l23", QCOM_SMD_RPM_LDOA, 18, &pm8950_pldo, "vdd_l2_l23"}, + { "l11", QCOM_SMD_RPM_LDOA, 11, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22" }, + { "l12", QCOM_SMD_RPM_LDOA, 12, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22" }, + { "l13", QCOM_SMD_RPM_LDOA, 13, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18" }, + { "l14", QCOM_SMD_RPM_LDOA, 14, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18" }, + { "l15", QCOM_SMD_RPM_LDOA, 15, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18" }, + { "l16", QCOM_SMD_RPM_LDOA, 16, &pm8950_ult_pldo, "vdd_l5_l6_l7_l16" }, + { "l17", QCOM_SMD_RPM_LDOA, 17, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22" }, +/* L18 seems not to exist. */ + { "l19", QCOM_SMD_RPM_LDOA, 19, &pm8950_pldo, "vdd_l1_l19" }, +/* L20 & L21 seem not to exist. */ + { "l22", QCOM_SMD_RPM_LDOA, 22, &pm8950_pldo, "vdd_l8_l11_l12_l17_l22" }, + { "l23", QCOM_SMD_RPM_LDOA, 23, &pm8950_pldo, "vdd_l2_l23" }, {} };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 350/772 samples: bpf: Dont fail for a missing VMLINUX_BTF when VMLINUX_H is provided
In reply to Greg Kroah-HartmanFrom: Jerome Marchand <[email protected]>
[ Upstream commit ec24704492d8791a52a75a39e3ad762b6e017bc6 ]
samples/bpf build currently always fails if it can't generate vmlinux.h from vmlinux, even when vmlinux.h is directly provided by VMLINUX_H variable, which makes VMLINUX_H pointless. Only fails when neither method works.
--- samples/bpf/Makefile | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
samples/bpf/Makefile +4 -5
@@ -368,16 +368,15 @@ VMLINUX_BTF ?= $(abspath $(firstword $(wildcard $(VMLINUX_BTF_PATHS)))) $(obj)/vmlinux.h: $(VMLINUX_BTF) $(BPFTOOL) ifeq ($(VMLINUX_H),) +ifeq ($(VMLINUX_BTF),) + $(error Cannot find a vmlinux for VMLINUX_BTF at any of "$(VMLINUX_BTF_PATHS)",\ + build the kernel or set VMLINUX_BTF or VMLINUX_H variable) +endif $(Q)$(BPFTOOL) btf dump file $(VMLINUX_BTF) format c > $@ else $(Q)cp "$(VMLINUX_H)" $@ endif -ifeq ($(VMLINUX_BTF),) - $(error Cannot find a vmlinux for VMLINUX_BTF at any of "$(VMLINUX_BTF_PATHS)",\ - build the kernel or set VMLINUX_BTF variable) -endif - clean-files += vmlinux.h # Get Clang's default includes on this system, as opposed to those seen by
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 351/772 perf/amd/ibs: Use interrupt regs ip for stack unwinding
In reply to Greg Kroah-HartmanFrom: Ravi Bangoria <[email protected]>
[ Upstream commit 3d47083b9ff46863e8374ad3bb5edb5e464c75f8 ]
IbsOpRip is recorded when IBS interrupt is triggered. But there is a skid from the time IBS interrupt gets triggered to the time the interrupt is presented to the core. Meanwhile processor would have moved ahead and thus IbsOpRip will be inconsistent with rsp and rbp recorded as part of the interrupt regs. This causes issues while unwinding stack using the ORC unwinder as it needs consistent rip, rsp and rbp. Fix this by using rip from interrupt regs instead of IbsOpRip for stack unwinding.
--- arch/x86/events/amd/ibs.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
arch/x86/events/amd/ibs.c +18 -0
@@ -304,6 +304,16 @@ static int perf_ibs_init(struct perf_event *event) hwc->config_base = perf_ibs->msr; hwc->config = config; +/* +* rip recorded by IbsOpRip will not be consistent with rsp and rbp +* recorded as part of interrupt regs. Thus we need to use rip from +* interrupt regs while unwinding call stack. Setting _EARLY flag +* makes sure we unwind call-stack before perf sample rip is set to +* IbsOpRip. +*/ +if (event->attr.sample_type &PERF_SAMPLE_CALLCHAIN ) + event->attr.sample_type |= __PERF_SAMPLE_CALLCHAIN_EARLY; +return 0 ; }
@@ -687,6 +697,14 @@ static int perf_ibs_handle_irq(struct perf_ibs *perf_ibs, struct pt_regs *iregs) data.raw = &raw; } +/* +* rip recorded by IbsOpRip will not be consistent with rsp and rbp +* recorded as part of interrupt regs. Thus we need to use rip from +* interrupt regs while unwinding call stack. +*/ +if (event->attr.sample_type &PERF_SAMPLE_CALLCHAIN ) + data.callchain =perf_callchain (event, iregs); + throttle =perf_event_overflow (event, &data, ®s); out:if (throttle) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 352/772 ath11k: Dont check arvif->is_started before sending management frames
In reply to Greg Kroah-HartmanFrom: Baochen Qiang <[email protected]>
[ Upstream commit 355333a217541916576351446b5832fec7930566 ]
Commit 66307ca04057 ("ath11k: fix mgmt_tx_wmi cmd sent to FW for deleted vdev") wants both of below two conditions are true before sending management frames:
1: ar->allocated_vdev_map & (1LL << arvif->vdev_id) 2: arvif->is_started
Actually the second one is not necessary because with the first one we can make sure the vdev is present.
Also use ar->conf_mutex to synchronize vdev delete and mgmt. TX.
This issue is found in case of Passpoint scenario where ath11k needs to send action frames before vdev is started.
Fix it by removing the second condition.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
--- drivers/net/wireless/ath/ath11k/mac.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath11k/mac.c +3 -2
@@ -5515,8 +5515,8 @@ static void ath11k_mgmt_over_wmi_tx_work(struct work_struct *work) } arvif =ath11k_vif_to_arvif (skb_cb->vif); -if (ar->allocated_vdev_map & (1LL << arvif->vdev_id) && - arvif->is_started) { +mutex_lock (&ar->conf_mutex); +if (ar->allocated_vdev_map & (1LL << arvif->vdev_id)) { ret =ath11k_mac_mgmt_tx_wmi (ar, arvif, skb);if (ret) { ath11k_warn(ar->ab, "failed to tx mgmt frame, vdev_id %d :%d\n",
@@ -5534,6 +5534,7 @@ static void ath11k_mgmt_over_wmi_tx_work(struct work_struct *work) arvif->is_started);ath11k_mgmt_over_wmi_tx_drop (ar, skb); } +mutex_unlock (&ar->conf_mutex); } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 353/772 wilc1000: fix crash observed in AP mode with cfg80211_register_netdevice()
In reply to Greg Kroah-HartmanFrom: Ajay Singh <[email protected]>
[ Upstream commit 868f0e28290c7a33e8cb79bfe97ebdcbb756e048 ]
Monitor(mon.) interface is used for handling the AP mode and 'ieee80211_ptr' reference is not getting set for it. Like earlier implementation, use register_netdevice() instead of cfg80211_register_netdevice() which expects valid 'ieee80211_ptr' reference to avoid the possible crash.
--- drivers/net/wireless/microchip/wilc1000/mon.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/microchip/wilc1000/mon.c +2 -2
@@ -233,7 +233,7 @@ struct net_device *wilc_wfi_init_mon_interface(struct wilc *wl, wl->monitor_dev->netdev_ops = &wilc_wfi_netdev_ops; wl->monitor_dev->needs_free_netdev = true; -if (cfg80211_register_netdevice (wl->monitor_dev)) { +if (register_netdevice (wl->monitor_dev)) {netdev_err (real_dev,"register_netdevice failed\n" );free_netdev (wl->monitor_dev);return NULL ;
@@ -251,7 +251,7 @@ void wilc_wfi_deinit_mon_interface(struct wilc *wl, bool rtnl_locked)return ;if (rtnl_locked) -cfg80211_unregister_netdevice (wl->monitor_dev); +unregister_netdevice (wl->monitor_dev);else unregister_netdev (wl->monitor_dev); wl->monitor_dev =NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 354/772 HID: amd_sfh: Modify the bus name
In reply to Greg Kroah-HartmanFrom: Basavaraj Natikar <[email protected]>
[ Upstream commit 206c3c2d85de8847fb732a5fb71443bacd287216 ]
Modifying the amd-sfh bus name to meaningful name.
--- drivers/hid/amd-sfh-hid/amd_sfh_hid.c | 2 +- drivers/hid/amd-sfh-hid/amd_sfh_hid.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/hid/amd-sfh-hid/amd_sfh_hid.c +1 -1
@@ -141,7 +141,7 @@ int amdtp_hid_probe(u32 cur_hid_dev, struct amdtp_cl_data *cli_data) hid->driver_data = hid_data; cli_data->hid_sensor_hubs[cur_hid_dev] = hid; - hid->bus =BUS_AMD_AMDTP ; + hid->bus =BUS_AMD_SFH ; hid->vendor =AMD_SFH_HID_VENDOR ; hid->product =AMD_SFH_HID_PRODUCT ; snprintf(hid->name, sizeof(hid->name), "%s %04X:%04X", "hid-amdtp",
drivers/hid/amd-sfh-hid/amd_sfh_hid.h +1 -1
@@ -12,7 +12,7 @@#define AMDSFH_HID_H #define MAX_HID_DEVICES 5 -#define BUS_AMD_AMDTP 0x20 +#define BUS_AMD_SFH 0x20#define AMD_SFH_HID_VENDOR 0x1022#define AMD_SFH_HID_PRODUCT 0x0001
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 355/772 HID: amd_sfh: Modify the hid name
In reply to Greg Kroah-HartmanFrom: Basavaraj Natikar <[email protected]>
[ Upstream commit 10f865cdcf37d26ae5e9595a7b4f9e06538e84e5 ]
Modifying the amd-sfh hid name to meaningful name.
--- drivers/hid/amd-sfh-hid/amd_sfh_hid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/amd-sfh-hid/amd_sfh_hid.c +1 -1
@@ -144,7 +144,7 @@ int amdtp_hid_probe(u32 cur_hid_dev, struct amdtp_cl_data *cli_data) hid->bus =BUS_AMD_SFH ; hid->vendor =AMD_SFH_HID_VENDOR ; hid->product =AMD_SFH_HID_PRODUCT ; -snprintf (hid->name,sizeof (hid->name),"%s %04X:%04X" ,"hid-amdtp" , +snprintf (hid->name,sizeof (hid->name),"%s %04X:%04X" ,"hid-amdsfh" , hid->vendor, hid->product); rc =hid_add_device (hid);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 356/772 ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 41cd312dfe980af869c3503b4d38e62ed20dd3b7 ]
of_find_i2c_device_by_node() takes a reference, In error paths, we should call put_device() to drop the reference to aviod refount leak.
--- sound/soc/fsl/imx-sgtl5000.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
sound/soc/fsl/imx-sgtl5000.c +8 -6
@@ -120,19 +120,19 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) data =devm_kzalloc (&pdev->dev,sizeof (*data),GFP_KERNEL );if (!data) { ret = -ENOMEM ; - goto fail; + goto put_device; } comp =devm_kzalloc (&pdev->dev,3 *sizeof (*comp),GFP_KERNEL );if (!comp) { ret = -ENOMEM ; - goto fail; + goto put_device; } data->codec_clk =clk_get (&codec_dev->dev,NULL );if (IS_ERR (data->codec_clk)) { ret =PTR_ERR (data->codec_clk); - goto fail; + goto put_device; } data->clk_frequency =clk_get_rate (data->codec_clk);
@@ -158,10 +158,10 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) data->card.dev = &pdev->dev; ret =snd_soc_of_parse_card_name (&data->card,"model" );if (ret) - goto fail; + goto put_device; ret =snd_soc_of_parse_audio_routing (&data->card,"audio-routing" );if (ret) - goto fail; + goto put_device; data->card.num_links =1 ; data->card.owner =THIS_MODULE ; data->card.dai_link = &data->dai;
@@ -174,7 +174,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) ret =devm_snd_soc_register_card (&pdev->dev, &data->card);if (ret) {dev_err_probe (&pdev->dev, ret,"snd_soc_register_card failed\n" ); - goto fail; + goto put_device; }of_node_put (ssi_np);
@@ -182,6 +182,8 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)return 0 ; +put_device: +put_device (&codec_dev->dev); fail:if (data && !IS_ERR (data->codec_clk))clk_put (data->codec_clk);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 357/772 ASoC: imx-hdmi: Fix refcount leak in imx_hdmi_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit ed46731d8e86c8d65f5fc717671e1f1f6c3146d2 ]
of_find_device_by_node() takes reference, we should use put_device() to release it. when devm_kzalloc() fails, it doesn't have a put_device(), it will cause refcount leak.
Add missing put_device() to fix this.
--- sound/soc/fsl/imx-hdmi.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/fsl/imx-hdmi.c +1 -0
@@ -126,6 +126,7 @@ static int imx_hdmi_probe(struct platform_device *pdev) data =devm_kzalloc (&pdev->dev,sizeof (*data),GFP_KERNEL );if (!data) { ret = -ENOMEM ; +put_device (&cpu_pdev->dev); goto fail; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 358/772 ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 2be84f73785fa9ed6443e3c5b158730266f1c2ee ]
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when done.
--- sound/soc/mxs/mxs-saif.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/mxs/mxs-saif.c +1 -0
@@ -754,6 +754,7 @@ static int mxs_saif_probe(struct platform_device *pdev) saif->master_id = saif->id; }else { ret =of_alias_get_id (master,"saif" ); +of_node_put (master);if (ret <0 )return ret;else
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 359/772 regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit afaa7b933ef00a2d3262f4d1252087613fb5c06d ]
of_node_get() returns a node with refcount incremented. Calling of_node_put() to drop the reference when not needed anymore.
--- drivers/regulator/pfuze100-regulator.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/regulator/pfuze100-regulator.c +2 -0
@@ -521,6 +521,7 @@ static int pfuze_parse_regulators_dt(struct pfuze_chip *chip) parent =of_get_child_by_name (np,"regulators" );if (!parent) {dev_err (dev,"regulators node not found\n" ); +of_node_put (np);return -EINVAL ; }
@@ -550,6 +551,7 @@ static int pfuze_parse_regulators_dt(struct pfuze_chip *chip) }of_node_put (parent); +of_node_put (np);if (ret <0 ) {dev_err (dev,"Error parsing regulator init data: %d\n" , ret);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 360/772 PM: EM: Decrement policy counter
In reply to Greg Kroah-HartmanFrom: Pierre Gondois <[email protected]>
[ Upstream commit c9d8923bfbcb63f15ea6cb2b5c8426fc3d96f643 ]
In commit e458716a92b57 ("PM: EM: Mark inefficiencies in CPUFreq"), cpufreq_cpu_get() is called without a cpufreq_cpu_put(), permanently increasing the reference counts of the policy struct.
Decrement the reference count once the policy struct is not used anymore.
--- kernel/power/energy_model.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/power/energy_model.c +2 -0
@@ -259,6 +259,8 @@ static void em_cpufreq_update_efficiencies(struct device *dev) found++; } +cpufreq_cpu_put (policy); +if (!found)return ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 361/772 dma-direct: dont fail on highmem CMA pages in dma_direct_alloc_pages
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 92826e967535db2eb117db227b1191aaf98e4bb3 ]
When dma_direct_alloc_pages encounters a highmem page it just gives up currently. But what we really should do is to try memory using the page allocator instead - without this platforms with a global highmem CMA pool will fail all dma_alloc_pages allocations.
--- kernel/dma/direct.c | 27 ++++++++++----------------- 1 file changed, 10 insertions(+), 17 deletions(-)
kernel/dma/direct.c +10 -17
@@ -115,7 +115,7 @@ static struct page *dma_direct_alloc_swiotlb(struct device *dev, size_t size) }static struct page *__dma_direct_alloc_pages (struct device *dev,size_t size, -gfp_t gfp) +gfp_t gfp,bool allow_highmem) {int node =dev_to_node (dev);struct page *page =NULL ;
@@ -129,9 +129,12 @@ static struct page *__dma_direct_alloc_pages(struct device *dev, size_t size, gfp |=dma_direct_optimal_gfp_mask (dev, dev->coherent_dma_mask, &phys_limit); page =dma_alloc_contiguous (dev, size, gfp); -if (page && !dma_coherent_ok (dev,page_to_phys (page), size)) { -dma_free_contiguous (dev, page, size); - page =NULL ; +if (page) { +if (!dma_coherent_ok (dev,page_to_phys (page), size) || + (!allow_highmem &&PageHighMem (page))) { +dma_free_contiguous (dev, page, size); + page =NULL ; + } } again:if (!page)
@@ -189,7 +192,7 @@ static void *dma_direct_alloc_no_mapping(struct device *dev, size_t size, {struct page *page; - page =__dma_direct_alloc_pages (dev, size, gfp & ~__GFP_ZERO); + page =__dma_direct_alloc_pages (dev, size, gfp & ~__GFP_ZERO, true);if (!page)return NULL ;
@@ -262,7 +265,7 @@ void *dma_direct_alloc(struct device *dev, size_t size,return dma_direct_alloc_from_pool (dev, size, dma_handle, gfp);/* we always manually zero the memory once we are done */ - page =__dma_direct_alloc_pages (dev, size, gfp & ~__GFP_ZERO); + page =__dma_direct_alloc_pages (dev, size, gfp & ~__GFP_ZERO, true);if (!page)return NULL ;if (PageHighMem (page)) {
@@ -370,19 +373,9 @@ struct page *dma_direct_alloc_pages(struct device *dev, size_t size,if (force_dma_unencrypted (dev) &&dma_direct_use_pool (dev, gfp))return dma_direct_alloc_from_pool (dev, size, dma_handle, gfp); - page =__dma_direct_alloc_pages (dev, size, gfp); + page =__dma_direct_alloc_pages (dev, size, gfp, false);if (!page)return NULL ; -if (PageHighMem (page)) { -/* -* Depending on the cma= arguments and per-arch setup -* dma_alloc_contiguous could return highmem pages. -* Without remapping there is no way to return them here, -* so log an error and fail. -*/ -dev_info (dev,"Rejecting highmem page from CMA.\n" ); - goto out_free_pages; - } ret =page_address (page);if (dma_set_decrypted (dev, ret, size))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 362/772 ASoC: samsung: Fix refcount leak in aries_audio_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit bf4a9b2467b775717d0e9034ad916888e19713a3 ]
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. If extcon_find_edev_by_node() fails, it doesn't call of_node_put() Calling of_node_put() after extcon_find_edev_by_node() to fix this.
--- sound/soc/samsung/aries_wm8994.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/samsung/aries_wm8994.c +1 -1
@@ -585,10 +585,10 @@ static int aries_audio_probe(struct platform_device *pdev) extcon_np =of_parse_phandle (np,"extcon" ,0 ); priv->usb_extcon =extcon_find_edev_by_node (extcon_np); +of_node_put (extcon_np);if (IS_ERR (priv->usb_extcon))return dev_err_probe (dev,PTR_ERR (priv->usb_extcon),"Failed to get extcon device" ); -of_node_put (extcon_np); priv->adc =devm_iio_channel_get (dev,"headset-detect" );if (IS_ERR (priv->adc))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 363/772 block: Fix the bio.bi_opf comment
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit 5d2ae14276e698c76fa0c8ce870103f343b38263 ]
Commit ef295ecf090d modified the Linux kernel such that the bottom bits of the bi_opf member contain the operation instead of the topmost bits. That commit did not update the comment next to bi_opf. Hence this patch.
Quoted 1 line
From commit
ef295ecf090d:
-#define bio_op(bio) ((bio)->bi_opf >> BIO_OP_SHIFT)
+#define bio_op(bio) ((bio)->bi_opf & REQ_OP_MASK)
--- include/linux/blk_types.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
include/linux/blk_types.h +2 -3
@@ -237,9 +237,8 @@ typedef unsigned int blk_qc_t;struct bio {struct bio *bi_next;/* request queue link */ struct block_device *bi_bdev; -unsigned int bi_opf;/* bottom bits req flags, -* top bits REQ_OP. Use -* accessors. +unsigned int bi_opf;/* bottom bits REQ_OP, top bits +* req_flags. */ unsigned short bi_flags;/* BIO_* below */ unsigned short bi_ioprio;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 364/772 kselftest/cgroup: fix test_stress.sh to use OUTPUT dir
In reply to Greg Kroah-HartmanFrom: Phil Auld <[email protected]>
[ Upstream commit 54de76c0123915e7533ce352de30a1f2d80fe81f ]
Running cgroup kselftest with O= fails to run the with_stress test due to hardcoded ./test_core. Find test_core binary using the OUTPUT directory.
--- tools/testing/selftests/cgroup/test_stress.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/cgroup/test_stress.sh +1 -1
@@ -1,4 +1,4 @@ #!/bin/bash # SPDX-License-Identifier: GPL-2.0 -./with_stress.sh -s subsys -s fork ./test_core +./with_stress.sh -s subsys -s fork ${OUTPUT}/test_core
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 365/772 scripts/faddr2line: Fix overlapping text section failures
In reply to Greg Kroah-HartmanFrom: Josh Poimboeuf <[email protected]>
[ Upstream commit 1d1a0e7c5100d332583e20b40aa8c0a8ed3d7849 ]
There have been some recent reports of faddr2line failures:
$ scripts/faddr2line sound/soundcore.ko sound_devnode+0x5/0x35 bad symbol size: base: 0x0000000000000000 end: 0x0000000000000000
$ ./scripts/faddr2line vmlinux.o enter_from_user_mode+0x24 bad symbol size: base: 0x0000000000005fe0 end: 0x0000000000005fe0
The problem is that faddr2line is based on 'nm', which has a major
limitation: it doesn't know how to distinguish between different text sections. So if an offset exists in multiple text sections in the object, it may fail.
Rewrite faddr2line to be section-aware, by basing it on readelf.
--- scripts/faddr2line | 150 +++++++++++++++++++++++++++++---------------- 1 file changed, 97 insertions(+), 53 deletions(-)
scripts/faddr2line +97 -53
@@ -44,17 +44,6 @@ set -o errexit set -o nounset -READELF="${CROSS_COMPILE:-}readelf" -ADDR2LINE="${CROSS_COMPILE:-}addr2line" -SIZE="${CROSS_COMPILE:-}size" -NM="${CROSS_COMPILE:-}nm" - -command -v awk >/dev/null 2>&1 || die "awk isn't installed" -command -v ${READELF} >/dev/null 2>&1 || die "readelf isn't installed" -command -v ${ADDR2LINE} >/dev/null 2>&1 || die "addr2line isn't installed" -command -v ${SIZE} >/dev/null 2>&1 || die "size isn't installed" -command -v ${NM} >/dev/null 2>&1 || die "nm isn't installed" - usage() { echo "usage: faddr2line [--list] <object file> <func+offset> <func+offset>..." >&2 exit 1
@@ -69,6 +58,14 @@ die() { exit 1 } +READELF="${CROSS_COMPILE:-}readelf" +ADDR2LINE="${CROSS_COMPILE:-}addr2line" +AWK="awk" + +command -v ${AWK} >/dev/null 2>&1 || die "${AWK} isn't installed" +command -v ${READELF} >/dev/null 2>&1 || die "${READELF} isn't installed" +command -v ${ADDR2LINE} >/dev/null 2>&1 || die "${ADDR2LINE} isn't installed" + # Try to figure out the source directory prefix so we can remove it from the # addr2line output. HACK ALERT: This assumes that start_kernel() is in # init/main.c! This only works for vmlinux. Otherwise it falls back to
@@ -76,7 +73,7 @@ die() { find_dir_prefix() { local objfile=$1 - local start_kernel_addr=$(${READELF} -sW $objfile | awk '$8 == "start_kernel" {printf "0x%s", $2}') + local start_kernel_addr=$(${READELF} --symbols --wide $objfile | ${AWK} '$8 == "start_kernel" {printf "0x%s", $2}') [[ -z $start_kernel_addr ]] && return local file_line=$(${ADDR2LINE} -e $objfile $start_kernel_addr)
@@ -97,86 +94,133 @@ __faddr2line() { local dir_prefix=$3 local print_warnings=$4 - local func=${func_addr%+*} + local sym_name=${func_addr%+*} local offset=${func_addr#*+} offset=${offset%/*} - local size= - [[ $func_addr =~ "/" ]] && size=${func_addr#*/} + local user_size= + [[ $func_addr =~ "/" ]] && user_size=${func_addr#*/} - if [[ -z $func ]] || [[ -z $offset ]] || [[ $func = $func_addr ]]; then + if [[ -z $sym_name ]] || [[ -z $offset ]] || [[ $sym_name = $func_addr ]]; then warn "bad func+offset $func_addr" DONE=1 return fi # Go through each of the object's symbols which match the func name. - # In rare cases there might be duplicates. - file_end=$(${SIZE} -Ax $objfile | awk '$1 == ".text" {print $2}') - while read symbol; do - local fields=($symbol) - local sym_base=0x${fields[0]} - local sym_type=${fields[1]} - local sym_end=${fields[3]} - - # calculate the size - local sym_size=$(($sym_end - $sym_base)) + # In rare cases there might be duplicates, in which case we print all + # matches. + while read line; do + local fields=($line) + local sym_addr=0x${fields[1]} + local sym_elf_size=${fields[2]} + local sym_sec=${fields[6]} + + # Get the section size: + local sec_size=$(${READELF} --section-headers --wide $objfile | + sed 's/\[ /\[/' | + ${AWK} -v sec=$sym_sec '$1 == "[" sec "]" { print "0x" $6; exit }') + + if [[ -z $sec_size ]]; then + warn "bad section size: section: $sym_sec" + DONE=1 + return + fi + + # Calculate the symbol size. + # + # Unfortunately we can't use the ELF size, because kallsyms + # also includes the padding bytes in its size calculation. For + # kallsyms, the size calculation is the distance between the + # symbol and the next symbol in a sorted list. + local sym_size + local cur_sym_addr + local found=0 + while read line; do + local fields=($line) + cur_sym_addr=0x${fields[1]} + local cur_sym_elf_size=${fields[2]} + local cur_sym_name=${fields[7]:-} + + if [[ $cur_sym_addr = $sym_addr ]] && + [[ $cur_sym_elf_size = $sym_elf_size ]] && + [[ $cur_sym_name = $sym_name ]]; then + found=1 + continue + fi + + if [[ $found = 1 ]]; then + sym_size=$(($cur_sym_addr - $sym_addr)) + [[ $sym_size -lt $sym_elf_size ]] && continue; + found=2 + break + fi + done < <(${READELF} --symbols --wide $objfile | ${AWK} -v sec=$sym_sec '$7 == sec' | sort --key=2) + + if [[ $found = 0 ]]; then + warn "can't find symbol: sym_name: $sym_name sym_sec: $sym_sec sym_addr: $sym_addr sym_elf_size: $sym_elf_size" + DONE=1 + return + fi + + # If nothing was found after the symbol, assume it's the last + # symbol in the section. + [[ $found = 1 ]] && sym_size=$(($sec_size - $sym_addr)) + if [[ -z $sym_size ]] || [[ $sym_size -le 0 ]]; then - warn "bad symbol size: base: $sym_base end: $sym_end" + warn "bad symbol size: sym_addr: $sym_addr cur_sym_addr: $cur_sym_addr" DONE=1 return fi + sym_size=0x$(printf %x $sym_size) - # calculate the address - local addr=$(($sym_base + $offset)) + # Calculate the section address from user-supplied offset: + local addr=$(($sym_addr + $offset)) if [[ -z $addr ]] || [[ $addr = 0 ]]; then - warn "bad address: $sym_base + $offset" + warn "bad address: $sym_addr + $offset" DONE=1 return fi addr=0x$(printf %x $addr) - # weed out non-function symbols - if [[ $sym_type != t ]] && [[ $sym_type != T ]]; then - [[ $print_warnings = 1 ]] && - echo "skipping $func address at $addr due to non-function symbol of type '$sym_type'" - continue - fi - - # if the user provided a size, make sure it matches the symbol's size - if [[ -n $size ]] && [[ $size -ne $sym_size ]]; then + # If the user provided a size, make sure it matches the symbol's size: + if [[ -n $user_size ]] && [[ $user_size -ne $sym_size ]]; then [[ $print_warnings = 1 ]] && - echo "skipping $func address at $addr due to size mismatch ($size != $sym_size)" + echo "skipping $sym_name address at $addr due to size mismatch ($user_size != $sym_size)" continue; fi - # make sure the provided offset is within the symbol's range + # Make sure the provided offset is within the symbol's range: if [[ $offset -gt $sym_size ]]; then [[ $print_warnings = 1 ]] && - echo "skipping $func address at $addr due to size mismatch ($offset > $sym_size)" + echo "skipping $sym_name address at $addr due to size mismatch ($offset > $sym_size)" continue fi - # separate multiple entries with a blank line + # In case of duplicates or multiple addresses specified on the + # cmdline, separate multiple entries with a blank line: [[ $FIRST = 0 ]] && echo FIRST=0 - # pass real address to addr2line - echo "$func+$offset/$sym_size:" - local file_lines=$(${ADDR2LINE} -fpie $objfile $addr | sed "s; $dir_prefix\(\./\)*; ;") - [[ -z $file_lines ]] && return + echo "$sym_name+$offset/$sym_size:" + # Pass section address to addr2line and strip absolute paths + # from the output: + local output=$(${ADDR2LINE} -fpie $objfile $addr | sed "s; $dir_prefix\(\./\)*; ;") + [[ -z $output ]] && continue + + # Default output (non --list): if [[ $LIST = 0 ]]; then - echo "$file_lines" | while read -r line + echo "$output" | while read -r line do echo $line done DONE=1; - return + continue fi - # show each line with context - echo "$file_lines" | while read -r line + # For --list, show each line with its corresponding source code: + echo "$output" | while read -r line do echo echo $line
@@ -184,12 +228,12 @@ __faddr2line() { n1=$[$n-5] n2=$[$n+5] f=$(echo $line | sed 's/.*at \(.\+\):.*/\1/g') - awk 'NR>=strtonum("'$n1'") && NR<=strtonum("'$n2'") { if (NR=='$n') printf(">%d<", NR); else printf(" %d ", NR); printf("\t%s\n", $0)}' $f + ${AWK} 'NR>=strtonum("'$n1'") && NR<=strtonum("'$n2'") { if (NR=='$n') printf(">%d<", NR); else printf(" %d ", NR); printf("\t%s\n", $0)}' $f done DONE=1 - done < <(${NM} -n $objfile | awk -v fn=$func -v end=$file_end '$3 == fn { found=1; line=$0; start=$1; next } found == 1 { found=0; print line, "0x"$1 } END {if (found == 1) print line, end; }') + done < <(${READELF} --symbols --wide $objfile | ${AWK} -v fn=$sym_name '$4 == "FUNC" && $8 == fn') } [[ $# -lt 2 ]] && usage
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 366/772 media: aspeed: Fix an error handling path in aspeed_video_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 310fda622bbd38be17fb444f7f049b137af3bc0d ]
A dma_free_coherent() call is missing in the error handling path of the probe, as already done in the remove function.
In fact, this call is included in aspeed_video_free_buf(). So use the latter both in the error handling path of the probe and in the remove function.
It is easier to see the relation with aspeed_video_alloc_buf() this way.
--- drivers/media/platform/aspeed-video.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/platform/aspeed-video.c +2 -2
@@ -1828,6 +1828,7 @@ static int aspeed_video_probe(struct platform_device *pdev) rc =aspeed_video_setup_video (video);if (rc) { +aspeed_video_free_buf (video, &video->jpeg);clk_unprepare (video->vclk);clk_unprepare (video->eclk);return rc;
@@ -1859,8 +1860,7 @@ static int aspeed_video_remove(struct platform_device *pdev)v4l2_device_unregister (v4l2_dev); -dma_free_coherent (video->dev,VE_JPEG_HEADER_SIZE , video->jpeg.virt, - video->jpeg.dma); +aspeed_video_free_buf (video, &video->jpeg);of_reserved_mem_device_release (dev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 367/772 media: exynos4-is: Fix PM disable depth imbalance in fimc_is_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 5c0db68ce0faeb000c3540d095eb272d671a6e03 ]
If probe fails then we need to call pm_runtime_disable() to balance out the previous pm_runtime_enable() call.
--- drivers/media/platform/exynos4-is/fimc-is.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/platform/exynos4-is/fimc-is.c +3 -1
@@ -830,7 +830,7 @@ static int fimc_is_probe(struct platform_device *pdev) ret =pm_runtime_resume_and_get (dev);if (ret <0 ) - goto err_irq; + goto err_pm_disable;vb2_dma_contig_set_max_seg_size (dev,DMA_BIT_MASK (32 ));
@@ -864,6 +864,8 @@ static int fimc_is_probe(struct platform_device *pdev)pm_runtime_put_noidle (dev);if (!pm_runtime_enabled (dev))fimc_is_runtime_suspend (dev); +err_pm_disable: +pm_runtime_disable (dev); err_irq:free_irq (is->irq, is); err_clk:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 368/772 mt76: mt7921: Fix the error handling path of mt7921_pci_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 4e90db5e21eb3bb272fe47386dc3506755e209e9 ]
In case of error, some resources must be freed, as already done above and below the devm_kmemdup() and __mt7921e_mcu_drv_pmctrl() calls added in the commit in Fixes:.
--- drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7921/pci.c +5 -3
@@ -300,8 +300,10 @@ static int mt7921_pci_probe(struct pci_dev *pdev, dev->bus_ops = dev->mt76.bus; bus_ops =devm_kmemdup (dev->mt76.dev, dev->bus_ops,sizeof (*bus_ops),GFP_KERNEL ); -if (!bus_ops) -return -ENOMEM ; +if (!bus_ops) { + ret = -ENOMEM ; + goto err_free_dev; + } bus_ops->rr = mt7921_rr; bus_ops->wr = mt7921_wr;
@@ -310,7 +312,7 @@ static int mt7921_pci_probe(struct pci_dev *pdev, ret =__mt7921e_mcu_drv_pmctrl (dev);if (ret) -return ret; + goto err_free_dev; mdev->rev = (mt7921_l1_rr (dev,MT_HW_CHIPID ) <<16 ) | (mt7921_l1_rr (dev,MT_HW_REV ) &0xff );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 369/772 mt76: mt7915: do not pass data pointer to mt7915_mcu_muru_debug_set
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit badb6ffaa1439fce30fc6ef10571dcf45a622b44 ]
Fix typo in mt7915_muru_debug_set routine and pass muru_debug value to mt7915_mcu_muru_debug_set() instead of data pointer.
--- drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c +1 -1
@@ -87,7 +87,7 @@ mt7915_muru_debug_set(void *data, u64 val)struct mt7915_dev *dev = data; dev->muru_debug = val; -mt7915_mcu_muru_debug_set (dev, data); +mt7915_mcu_muru_debug_set (dev, dev->muru_debug);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 370/772 mt76: fix antenna config missing in 6G cap
In reply to Greg Kroah-HartmanFrom: Deren Wu <[email protected]>
[ Upstream commit abba345311a740d9dca1b5eb293b3b1c296715dd ]
To make sure we have the proper antenna config in 6g cap, move IEEE80211_VHT_CAP_[T/R]X_ANTENNA_PATTERN to stream init.
--- drivers/net/wireless/mediatek/mt76/mac80211.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mac80211.c +2 -2
@@ -248,6 +248,8 @@ static void mt76_init_stream_cap(struct mt76_phy *phy, vht_cap->cap |=IEEE80211_VHT_CAP_TXSTBC ; else vht_cap->cap &= ~IEEE80211_VHT_CAP_TXSTBC; + vht_cap->cap |=IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN | +IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN ;for (i =0 ; i <8 ; i++) {if (i < nstream)
@@ -323,8 +325,6 @@ mt76_init_sband(struct mt76_phy *phy, struct mt76_sband *msband, vht_cap->cap |=IEEE80211_VHT_CAP_RXLDPC |IEEE80211_VHT_CAP_RXSTBC_1 |IEEE80211_VHT_CAP_SHORT_GI_80 | -IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN | -IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN | (3 <<IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT );return 0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 371/772 mt76: mt7921: fix kernel crash at mt7921_pci_remove
In reply to Greg Kroah-HartmanFrom: Sean Wang <[email protected]>
[ Upstream commit ad483ed9dd5193a54293269c852a29051813b7bd ]
The crash log shown it is possible that mt7921_irq_handler is called while devm_free_irq is being handled so mt76_free_device need to be postponed until devm_free_irq is completed to solve the crash we free the mt76 device too early.
[ 9299.339655] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 9299.339705] #PF: supervisor read access in kernel mode [ 9299.339735] #PF: error_code(0x0000) - not-present page [ 9299.339768] PGD 0 P4D 0 [ 9299.339786] Oops: 0000 [#1] SMP PTI [ 9299.339812] CPU: 1 PID: 1624 Comm: prepare-suspend Not tainted 5.15.14-1.fc32.qubes.x86_64 #1 [ 9299.339863] Hardware name: Xen HVM domU, BIOS 4.14.3 01/20/2022 [ 9299.339901] RIP: 0010:mt7921_irq_handler+0x1e/0x70 [mt7921e] [ 9299.340048] RSP: 0018:ffffa81b80c27cb0 EFLAGS: 00010082 [ 9299.340081] RAX: 0000000000000000 RBX: ffff98a4cb752020 RCX: ffffffffa96211c5 [ 9299.340123] RDX: 0000000000000000 RSI: 00000000000d4204 RDI: ffff98a4cb752020 [ 9299.340165] RBP: ffff98a4c28a62a4 R08: ffff98a4c37a96c0 R09: 0000000080150011 [ 9299.340207] R10: 0000000040000000 R11: 0000000000000000 R12: ffff98a4c4eaa080 [ 9299.340249] R13: ffff98a4c28a6360 R14: ffff98a4cb752020 R15: ffff98a4c28a6228 [ 9299.340297] FS: 00007260840d3740(0000) GS:ffff98a4ef700000(0000) knlGS:0000000000000000 [ 9299.340345] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9299.340383] CR2: 0000000000000008 CR3: 0000000004c56001 CR4: 0000000000770ee0 [ 9299.340432] PKRU: 55555554 [ 9299.340449] Call Trace: [ 9299.340467] <TASK> [ 9299.340485] __free_irq+0x221/0x350 [ 9299.340527] free_irq+0x30/0x70 [ 9299.340553] devm_free_irq+0x55/0x80 [ 9299.340579] mt7921_pci_remove+0x2f/0x40 [mt7921e] [ 9299.340616] pci_device_remove+0x3b/0xa0 [ 9299.340651] __device_release_driver+0x17a/0x240 [ 9299.340686] device_driver_detach+0x3c/0xa0 [ 9299.340714] unbind_store+0x113/0x130 [ 9299.340740] kernfs_fop_write_iter+0x124/0x1b0 [ 9299.340775] new_sync_write+0x15c/0x1f0 [ 9299.340806] vfs_write+0x1d2/0x270 [ 9299.340831] ksys_write+0x67/0xe0 [ 9299.340857] do_syscall_64+0x3b/0x90 [ 9299.340887] entry_SYSCALL_64_after_hwframe+0x44/0xae
--- drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7921/pci.c +1 -1
@@ -118,7 +118,6 @@ static void mt7921e_unregister_device(struct mt7921_dev *dev)mt7921_mcu_exit (dev);tasklet_disable (&dev->irq_tasklet); -mt76_free_device (&dev->mt76); }static u32 __mt7921_reg_addr (struct mt7921_dev *dev,u32 addr)
@@ -354,6 +353,7 @@ static void mt7921_pci_remove(struct pci_dev *pdev)mt7921e_unregister_device (dev);devm_free_irq (&pdev->dev, pdev->irq, dev); +mt76_free_device (&dev->mt76);pci_free_irq_vectors (pdev); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 372/772 mt76: do not attempt to reorder received 802.3 packets without agg session
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
[ Upstream commit 3968a66475b40691c37b5e6c76975f699671e10e ]
Fixes potential latency / packet drop issues in cases where a BA session has not (yet) been established.
--- drivers/net/wireless/mediatek/mt76/agg-rx.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/agg-rx.c +3 -2
@@ -162,8 +162,9 @@ void mt76_rx_aggr_reorder(struct sk_buff *skb, struct sk_buff_head *frames)if (!sta)return ; -if (!status->aggr && !(status->flag &RX_FLAG_8023 )) { -mt76_rx_aggr_check_ctl (skb, frames); +if (!status->aggr) { +if (!(status->flag &RX_FLAG_8023 )) +mt76_rx_aggr_check_ctl (skb, frames);return ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 373/772 mt76: fix tx status related use-after-free race on station removal
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
[ Upstream commit fcfe1b5e162bf473c1d47760962cec8523c00466 ]
There is a small race window where ongoing tx activity can lead to a skb getting added to the status tracking idr after that idr has already been cleaned up, which will keep the wcid linked in the status poll list. Fix this by only adding status skbs if the wcid pointer is still assigned in dev->wcid, which gets cleared early by mt76_sta_pre_rcu_remove
--- drivers/net/wireless/mediatek/mt76/mac80211.c | 2 ++ drivers/net/wireless/mediatek/mt76/tx.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mac80211.c +2 -0
@@ -1344,7 +1344,9 @@ void mt76_sta_pre_rcu_remove(struct ieee80211_hw *hw, struct ieee80211_vif *vif,struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;mutex_lock (&dev->mutex); +spin_lock_bh (&dev->status_lock);rcu_assign_pointer (dev->wcid[wcid->idx],NULL ); +spin_unlock_bh (&dev->status_lock);mutex_unlock (&dev->mutex); }EXPORT_SYMBOL_GPL (mt76_sta_pre_rcu_remove);
drivers/net/wireless/mediatek/mt76/tx.c +1 -1
@@ -120,7 +120,7 @@ mt76_tx_status_skb_add(struct mt76_dev *dev, struct mt76_wcid *wcid,memset (cb,0 ,sizeof (*cb)); -if (!wcid) +if (!wcid || !rcu_access_pointer (dev->wcid[wcid->idx]))return MT_PACKET_ID_NO_ACK ;if (info->flags &IEEE80211_TX_CTL_NO_ACK )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 374/772 mt76: mt7915: fix twt table_mask to u16 in mt7915_dev
In reply to Greg Kroah-HartmanFrom: Peter Chiu <[email protected]>
[ Upstream commit 3620c8821ae15902eb995a32918e34b7a0c773a3 ]
mt7915 can support 16 twt stations so modify table_mask to u16.
--- drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +1 -1
@@ -279,7 +279,7 @@ struct mt7915_dev {void *cal;struct { -u8 table_mask; +u16 table_mask;u8 n_agrt; } twt; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 375/772 media: st-delta: Fix PM disable depth imbalance in delta_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 94e3dba710fe0afc772172305444250023fc2d30 ]
The pm_runtime_enable will decrease power disable depth. If the probe fails, we should use pm_runtime_disable() to balance pm_runtime_enable().
--- drivers/media/platform/sti/delta/delta-v4l2.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/media/platform/sti/delta/delta-v4l2.c +4 -2
@@ -1859,7 +1859,7 @@ static int delta_probe(struct platform_device *pdev)if (ret) {dev_err (delta->dev,"%s failed to initialize firmware ipc channel\n" ,DELTA_PREFIX ); - goto err; + goto err_pm_disable; }/* register all available decoders */
@@ -1873,7 +1873,7 @@ static int delta_probe(struct platform_device *pdev)if (ret) {dev_err (delta->dev,"%s failed to register V4L2 device\n" ,DELTA_PREFIX ); - goto err; + goto err_pm_disable; } delta->work_queue =create_workqueue (DELTA_NAME );
@@ -1898,6 +1898,8 @@ static int delta_probe(struct platform_device *pdev)destroy_workqueue (delta->work_queue); err_v4l2:v4l2_device_unregister (&delta->v4l2_dev); +err_pm_disable: +pm_runtime_disable (dev); err:return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 376/772 media: atmel: atmel-isc: Fix PM disable depth imbalance in atmel_isc_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 395829c61a196a0821a703a49c4db3ac51daff73 ]
The pm_runtime_enable will decrease power disable depth. If the probe fails, we should use pm_runtime_disable() to balance pm_runtime_enable().
--- drivers/media/platform/atmel/atmel-sama5d2-isc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/media/platform/atmel/atmel-sama5d2-isc.c +4 -1
@@ -538,7 +538,7 @@ static int atmel_isc_probe(struct platform_device *pdev) ret =clk_prepare_enable (isc->ispck);if (ret) {dev_err (dev,"failed to enable ispck: %d\n" , ret); - goto cleanup_subdev; + goto disable_pm; }/* ispck should be greater or equal to hclock */
@@ -556,6 +556,9 @@ static int atmel_isc_probe(struct platform_device *pdev) unprepare_clk:clk_disable_unprepare (isc->ispck); +disable_pm: +pm_runtime_disable (dev); + cleanup_subdev:isc_subdev_cleanup (isc);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 377/772 media: i2c: rdacm2x: properly set subdev entity function
In reply to Greg Kroah-HartmanFrom: Laurentiu Palcu <[email protected]>
[ Upstream commit d2facee67b4883bb3e7461a0a93fd70d0c7b7261 ]
The subdevice entity function was left unset, which produces a warning when probing the device:
mxc-md bus@58000000:camera: Entity type for entity rdacm20 19-0051 was not initialized!
This patch will set entity function to MEDIA_ENT_F_CAM_SENSOR and leave flags unset.
--- drivers/media/i2c/rdacm20.c | 2 +- drivers/media/i2c/rdacm21.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/media/i2c/rdacm20.c +1 -1
@@ -611,7 +611,7 @@ static int rdacm20_probe(struct i2c_client *client) goto error_free_ctrls; dev->pad.flags =MEDIA_PAD_FL_SOURCE ; - dev->sd.entity.flags |=MEDIA_ENT_F_CAM_SENSOR ; + dev->sd.entity.function =MEDIA_ENT_F_CAM_SENSOR ; ret =media_entity_pads_init (&dev->sd.entity,1 , &dev->pad);if (ret <0 ) goto error_free_ctrls;
drivers/media/i2c/rdacm21.c +1 -1
@@ -583,7 +583,7 @@ static int rdacm21_probe(struct i2c_client *client) goto error_free_ctrls; dev->pad.flags =MEDIA_PAD_FL_SOURCE ; - dev->sd.entity.flags |=MEDIA_ENT_F_CAM_SENSOR ; + dev->sd.entity.function =MEDIA_ENT_F_CAM_SENSOR ; ret =media_entity_pads_init (&dev->sd.entity,1 , &dev->pad);if (ret <0 ) goto error_free_ctrls;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 378/772 media: exynos4-is: Change clk_disable to clk_disable_unprepare
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 9fadab72a6916c7507d7fedcd644859eef995078 ]
The corresponding API for clk_prepare_enable is clk_disable_unprepare, other than clk_disable.
Fix this by changing clk_disable to clk_disable_unprepare.
--- drivers/media/platform/exynos4-is/fimc-is.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/exynos4-is/fimc-is.c +1 -1
@@ -140,7 +140,7 @@ static int fimc_is_enable_clocks(struct fimc_is *is)dev_err (&is->pdev->dev,"clock %s enable failed\n" , fimc_is_clocks[i]);for (--i; i >=0 ; i--) -clk_disable (is->clocks[i]); +clk_disable_unprepare (is->clocks[i]);return ret; }pr_debug ("enabled clock: %s\n" , fimc_is_clocks[i]);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 379/772 media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit 471bec68457aaf981add77b4f590d65dd7da1059 ]
Syzbot reported that -1 is used as array index. The problem was in missing validation check.
hdw->unit_number is initialized with -1 and then if init table walk fails this value remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the easiest fix for that.
hdw->workpoll initialization moved upper to prevent warning in __flush_work.
--- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/media/usb/pvrusb2/pvrusb2-hdw.c +5 -2
@@ -2569,6 +2569,11 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf, }while (0 );mutex_unlock (&pvr2_unit_mtx); +INIT_WORK (&hdw->workpoll, pvr2_hdw_worker_poll); + +if (hdw->unit_number ==-1 ) + goto fail; + cnt1 =0 ; cnt2 =scnprintf (hdw->name+cnt1,sizeof (hdw->name)-cnt1,"pvrusb2" ); cnt1 += cnt2;
@@ -2580,8 +2585,6 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,if (cnt1 >=sizeof (hdw->name)) cnt1 =sizeof (hdw->name)-1 ; hdw->name[cnt1] =0 ; -INIT_WORK (&hdw->workpoll,pvr2_hdw_worker_poll); -pvr2_trace (PVR2_TRACE_INIT ,"Driver unit number is %d, name is %s" , hdw->unit_number,hdw->name);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 380/772 media: vsp1: Fix offset calculation for plane cropping
In reply to Greg Kroah-HartmanFrom: Michael Rodin <[email protected]>
[ Upstream commit 5f25abec8f21b7527c1223a354d23c270befddb3 ]
The vertical subsampling factor is currently not considered in the offset calculation for plane cropping done in rpf_configure_partition. This causes a distortion (shift of the color plane) when formats with the vsub factor larger than 1 are used (e.g. NV12, see vsp1_video_formats in vsp1_pipe.c). This commit considers vsub factor for all planes except plane 0 (luminance).
Drop generalization of the offset calculation to reduce the binary size.
--- drivers/media/platform/vsp1/vsp1_rpf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/media/platform/vsp1/vsp1_rpf.c +3 -3
@@ -291,11 +291,11 @@ static void rpf_configure_partition(struct vsp1_entity *entity, + crop.left * fmtinfo->bpp[0 ] /8 ;if (format->num_planes >1 ) { +unsigned int bpl = format->plane_fmt[1 ].bytesperline;unsigned int offset; - offset = crop.top * format->plane_fmt[1 ].bytesperline - + crop.left / fmtinfo->hsub - * fmtinfo->bpp[1 ] /8 ; + offset = crop.top / fmtinfo->vsub * bpl + + crop.left / fmtinfo->hsub * fmtinfo->bpp[1 ] /8 ; mem.addr[1 ] += offset; mem.addr[2 ] += offset; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 381/772 media: atmel: atmel-sama5d2-isc: fix wrong mask in YUYV format check
In reply to Greg Kroah-HartmanFrom: Eugen Hristev <[email protected]>
[ Upstream commit 91f49b80983f7bffdea9498209b2b896231ac776 ]
While this does not happen in production, this check should be done versus the mask, as checking with the YCYC value may not include some bits that may be set.
It is correct and safe to check the whole mask.
--- drivers/media/platform/atmel/atmel-sama5d2-isc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/atmel/atmel-sama5d2-isc.c +1 -1
@@ -267,7 +267,7 @@ static void isc_sama5d2_config_rlp(struct isc_device *isc)* Thus, if the YCYC mode is selected, replace it with the * sama5d2-compliant mode which is YYCC . */ -if ((rlp_mode &ISC_RLP_CFG_MODE_YCYC ) ==ISC_RLP_CFG_MODE_YCYC ) { +if ((rlp_mode &ISC_RLP_CFG_MODE_MASK ) ==ISC_RLP_CFG_MODE_YCYC ) { rlp_mode &= ~ISC_RLP_CFG_MODE_MASK ; rlp_mode |=ISC_RLP_CFG_MODE_YYCC ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 382/772 media: hantro: HEVC: Fix tile info buffer value computation
In reply to Greg Kroah-HartmanFrom: Benjamin Gaignard <[email protected]>
[ Upstream commit d7f4149df818463c1d7094b35db6ebd79f46c7bd ]
Use pps->column_width_minus1[j] + 1 as value for the tile info buffer instead of pps->column_width_minus1[j + 1].
The patch fixes DBLK_E_VIXS_2, DBLK_F_VIXS_2, DBLK_G_VIXS_2, SAO_B_MediaTek_5, TILES_A_Cisco_2 and TILES_B_Cisco_1 tests in fluster.
--- drivers/staging/media/hantro/hantro_g2_hevc_dec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/media/hantro/hantro_g2_hevc_dec.c +1 -1
@@ -60,7 +60,7 @@ static void prepare_tile_info_buffer(struct hantro_ctx *ctx) no_chroma =1 ;for (j =0 , tmp_w =0 ; j < num_tile_cols -1 ; j++) { tmp_w += pps->column_width_minus1[j] +1 ; - *p++ = pps->column_width_minus1[j +1 ]; + *p++ = pps->column_width_minus1[j] +1 ; *p++ = h;if (i ==0 && h ==1 && ctb_size ==16 ) no_chroma =1 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 383/772 Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
In reply to Greg Kroah-HartmanFrom: Ying Hsu <[email protected]>
[ Upstream commit 7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2 ]
Connecting the same socket twice consecutively in sco_sock_connect() could lead to a race condition where two sco_conn objects are created but only one is associated with the socket. If the socket is closed before the SCO connection is established, the timer associated with the dangling sco_conn object won't be canceled. As the sock object is being freed, the use-after-free problem happens when the timer callback function sco_sock_timeout() accesses the socket. Here's the call trace:
dump_stack+0x107/0x163 ? refcount_inc+0x1c/ print_address_description.constprop.0+0x1c/0x47e ? refcount_inc+0x1c/0x7b kasan_report+0x13a/0x173 ? refcount_inc+0x1c/0x7b check_memory_region+0x132/0x139 refcount_inc+0x1c/0x7b sco_sock_timeout+0xb2/0x1ba process_one_work+0x739/0xbd1 ? cancel_delayed_work+0x13f/0x13f ? __raw_spin_lock_init+0xf0/0xf0 ? to_kthread+0x59/0x85 worker_thread+0x593/0x70e kthread+0x346/0x35a ? drain_workqueue+0x31a/0x31a ? kthread_bind+0x4b/0x4b ret_from_fork+0x1f/0x30
--- net/bluetooth/sco.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-)
net/bluetooth/sco.c +13 -8
@@ -574,19 +574,24 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen addr->sa_family != AF_BLUETOOTH)return -EINVAL ; -if (sk->sk_state !=BT_OPEN && sk->sk_state !=BT_BOUND ) -return -EBADFD ; +lock_sock (sk); +if (sk->sk_state !=BT_OPEN && sk->sk_state !=BT_BOUND ) { + err = -EBADFD ; + goto done; + } -if (sk->sk_type !=SOCK_SEQPACKET ) -return -EINVAL ; +if (sk->sk_type !=SOCK_SEQPACKET ) { + err = -EINVAL ; + goto done; + } hdev =hci_get_route (&sa->sco_bdaddr, &sco_pi (sk)->src,BDADDR_BREDR ); -if (!hdev) -return -EHOSTUNREACH ; +if (!hdev) { + err = -EHOSTUNREACH ; + goto done; + }hci_dev_lock (hdev); -lock_sock (sk); -/* Set destination address and psm */ bacpy (&sco_pi (sk)->dst, &sa->sco_bdaddr);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 384/772 Bluetooth: use hdev lock in activate_scan for hci_is_adv_monitoring
In reply to Greg Kroah-HartmanFrom: Niels Dossche <[email protected]>
[ Upstream commit 50a3633ae5e98cf1b80ef5b73c9e341aee9ad896 ]
hci_is_adv_monitoring's function documentation states that it must be called under the hdev lock. Paths that leads to an unlocked call are:discov_update => start_discovery => interleaved_discov => active_scan
and: discov_update => start_discovery => active_scan
The solution is to take the lock in active_scan during the duration of the call to hci_is_adv_monitoring.
--- net/bluetooth/hci_request.c | 2 ++ 1 file changed, 2 insertions(+)
net/bluetooth/hci_request.c +2 -0
@@ -2260,6 +2260,7 @@ static int active_scan(struct hci_request *req, unsigned long opt)if (err <0 ) own_addr_type =ADDR_LE_DEV_PUBLIC ; +hci_dev_lock (hdev);if (hci_is_adv_monitoring (hdev)) {/* Duplicate filter should be disabled when some advertisement * monitor is activated, otherwise AdvMon can only receive one
@@ -2276,6 +2277,7 @@ static int active_scan(struct hci_request *req, unsigned long opt)*/ filter_dup =LE_SCAN_FILTER_DUP_DISABLE ; } +hci_dev_unlock (hdev); hci_req_start_scan(req, LE_SCAN_ACTIVE, interval, hdev->le_scan_window_discovery, own_addr_type,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 385/772 Bluetooth: use hdev lock for accept_list and reject_list in conn req
In reply to Greg Kroah-HartmanFrom: Niels Dossche <[email protected]>
[ Upstream commit fb048cae51bacdfbbda2954af3c213fdb1d484f4 ]
All accesses (both reads and modifications) to hdev->{accept,reject}_list are protected by hdev lock, except the ones in hci_conn_request_evt. This can cause a race condition in the form of a list corruption.
The solution is to protect these lists in hci_conn_request_evt as well.
I was unable to find the exact commit that introduced the issue for the reject list, I was only able to find it for the accept list.
--- net/bluetooth/hci_event.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
net/bluetooth/hci_event.c +9 -6
@@ -3224,10 +3224,12 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data,return ; } +hci_dev_lock (hdev); +if (hci_bdaddr_list_lookup (&hdev->reject_list, &ev->bdaddr,BDADDR_BREDR )) {hci_reject_conn (hdev, &ev->bdaddr); -return ; + goto unlock; }/* Require HCI_CONNECTABLE or an accept list entry to accept the
@@ -3239,13 +3241,11 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data, !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr, BDADDR_BREDR)) {hci_reject_conn (hdev, &ev->bdaddr); -return ; + goto unlock; }/* Connection accepted */ -hci_dev_lock (hdev); - ie =hci_inquiry_cache_lookup (hdev, &ev->bdaddr);if (ie)memcpy (ie->data.dev_class, ev->dev_class,3 );
@@ -3257,8 +3257,7 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data, HCI_ROLE_SLAVE);if (!conn) {bt_dev_err (hdev,"no memory for new connection" ); -hci_dev_unlock (hdev); -return ; + goto unlock; } }
@@ -3298,6 +3297,10 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data, conn->state =BT_CONNECT2 ;hci_connect_cfm (conn,0 ); } + +return ; +unlock: +hci_dev_unlock (hdev); }static u8 hci_to_mgmt_reason (u8 err)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 386/772 Bluetooth: protect le accept and resolv lists with hdev->lock
In reply to Greg Kroah-HartmanFrom: Niels Dossche <[email protected]>
[ Upstream commit 5e2b6064cbc5fd582396768c5f9583f65085e368 ]
Concurrent operations from events on le_{accept,resolv}_list are currently unprotected by hdev->lock.
Most existing code do already protect the lists with that lock. This can be observed in hci_debugfs and hci_sync.
Add the protection for these events too.
--- net/bluetooth/hci_event.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
net/bluetooth/hci_event.c +12 -0
@@ -1835,7 +1835,9 @@ static u8 hci_cc_le_clear_accept_list(struct hci_dev *hdev, void *data,if (rp->status)return rp->status; +hci_dev_lock (hdev);hci_bdaddr_list_clear (&hdev->le_accept_list); +hci_dev_unlock (hdev);return rp->status; }
@@ -1855,8 +1857,10 @@ static u8 hci_cc_le_add_to_accept_list(struct hci_dev *hdev, void *data,if (!sent)return rp->status; +hci_dev_lock (hdev);hci_bdaddr_list_add (&hdev->le_accept_list, &sent->bdaddr, sent->bdaddr_type); +hci_dev_unlock (hdev);return rp->status; }
@@ -1876,8 +1880,10 @@ static u8 hci_cc_le_del_from_accept_list(struct hci_dev *hdev, void *data,if (!sent)return rp->status; +hci_dev_lock (hdev);hci_bdaddr_list_del (&hdev->le_accept_list, &sent->bdaddr, sent->bdaddr_type); +hci_dev_unlock (hdev);return rp->status; }
@@ -1949,9 +1955,11 @@ static u8 hci_cc_le_add_to_resolv_list(struct hci_dev *hdev, void *data,if (!sent)return rp->status; +hci_dev_lock (hdev);hci_bdaddr_list_add_with_irk (&hdev->le_resolv_list, &sent->bdaddr, sent->bdaddr_type, sent->peer_irk, sent->local_irk); +hci_dev_unlock (hdev);return rp->status; }
@@ -1971,8 +1979,10 @@ static u8 hci_cc_le_del_from_resolv_list(struct hci_dev *hdev, void *data,if (!sent)return rp->status; +hci_dev_lock (hdev);hci_bdaddr_list_del_with_irk (&hdev->le_resolv_list, &sent->bdaddr, sent->bdaddr_type); +hci_dev_unlock (hdev);return rp->status; }
@@ -1987,7 +1997,9 @@ static u8 hci_cc_le_clear_resolv_list(struct hci_dev *hdev, void *data,if (rp->status)return rp->status; +hci_dev_lock (hdev);hci_bdaddr_list_clear (&hdev->le_resolv_list); +hci_dev_unlock (hdev);return rp->status; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 387/772 Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event
In reply to Greg Kroah-HartmanFrom: Sean Wang <[email protected]>
[ Upstream commit 0fab6361c4ba17d1b43a991bef4238a3c1754d35 ]
We should not access skb buffer data anymore after hci_recv_frame was called.
[ 39.634809] BUG: KASAN: use-after-free in btmtksdio_recv_event+0x1b0
[ 39.634855] Read of size 1 at addr ffffff80cf28a60d by task kworker
[ 39.634962] Call trace:
[ 39.634974] dump_backtrace+0x0/0x3b8
[ 39.634999] show_stack+0x20/0x2c
[ 39.635016] dump_stack_lvl+0x60/0x78
[ 39.635040] print_address_description+0x70/0x2f0
[ 39.635062] kasan_report+0x154/0x194
[ 39.635079] __asan_report_load1_noabort+0x44/0x50
[ 39.635099] btmtksdio_recv_event+0x1b0/0x1c4
[ 39.635129] btmtksdio_txrx_work+0x6cc/0xac4
[ 39.635157] process_one_work+0x560/0xc5c
[ 39.635177] worker_thread+0x7ec/0xcc0
[ 39.635195] kthread+0x2d0/0x3d0
[ 39.635215] ret_from_fork+0x10/0x20
[ 39.635247] Allocated by task 0:
[ 39.635260] (stack is not available)
[ 39.635281] Freed by task 2392:
[ 39.635295] kasan_save_stack+0x38/0x68
[ 39.635319] kasan_set_track+0x28/0x3c
[ 39.635338] kasan_set_free_info+0x28/0x4c
[ 39.635357] ____kasan_slab_free+0x104/0x150
[ 39.635374] __kasan_slab_free+0x18/0x28
[ 39.635391] slab_free_freelist_hook+0x114/0x248
[ 39.635410] kfree+0xf8/0x2b4
[ 39.635427] skb_free_head+0x58/0x98
[ 39.635447] skb_release_data+0x2f4/0x410
[ 39.635464] skb_release_all+0x50/0x60
[ 39.635481] kfree_skb+0xc8/0x25c
[ 39.635498] hci_event_packet+0x894/0xca4 [bluetooth]
[ 39.635721] hci_rx_work+0x1c8/0x68c [bluetooth]
[ 39.635925] process_one_work+0x560/0xc5c
[ 39.635951] worker_thread+0x7ec/0xcc0
[ 39.635970] kthread+0x2d0/0x3d0
[ 39.635990] ret_from_fork+0x10/0x20
[ 39.636021] The buggy address belongs to the object at ffffff80cf28a600
which belongs to the cache kmalloc-512 of size 512
[ 39.636039] The buggy address is located 13 bytes inside of
512-byte region [ffffff80cf28a600, ffffff80cf28a800)--- drivers/bluetooth/btmtksdio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/bluetooth/btmtksdio.c +2 -1
@@ -368,6 +368,7 @@ static int btmtksdio_recv_event(struct hci_dev *hdev, struct sk_buff *skb) {struct btmtksdio_dev *bdev =hci_get_drvdata (hdev);struct hci_event_hdr *hdr = (void *)skb->data; +u8 evt = hdr->evt;int err;/* When someone waits for the WMT event, the skb is being cloned
@@ -385,7 +386,7 @@ static int btmtksdio_recv_event(struct hci_dev *hdev, struct sk_buff *skb)if (err <0 ) goto err_free_skb; -if (hdr->evt ==HCI_EV_WMT ) { +if (evt ==HCI_EV_WMT ) {if (test_and_clear_bit (BTMTKSDIO_TX_WAIT_VND_EVT , &bdev->tx_state)) {/* Barrier to sync with other CPUs */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 388/772 media: mediatek: vcodec: Fix v4l2 compliance decoder cmd test fail
In reply to Greg Kroah-HartmanFrom: Yunfei Dong <[email protected]>
[ Upstream commit 08a83828825cbf3bc2c9f582a4cd4da9f40c77d6 ]
Will return -EINVAL using standard framework api when test stateless decoder with cmd VIDIOC_(TRY)DECODER_CMD. Disable them to adjust v4l2 compliance test for user driver(GStreamer/Chrome) won't use decoder cmd.
--- drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.c | 13 +------------ .../media/platform/mtk-vcodec/mtk_vcodec_dec_drv.c | 3 +++ 2 files changed, 4 insertions(+), 12 deletions(-)
drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.c +1 -12
@@ -47,14 +47,7 @@ static struct mtk_q_data *mtk_vdec_get_q_data(struct mtk_vcodec_ctx *ctx,static int vidioc_try_decoder_cmd (struct file *file,void *priv,struct v4l2_decoder_cmd *cmd) { -struct mtk_vcodec_ctx *ctx =fh_to_ctx (priv); - -/* Use M2M stateless helper if relevant */ -if (ctx->dev->vdec_pdata->uses_stateless_api) -return v4l2_m2m_ioctl_stateless_try_decoder_cmd (file, priv, - cmd); -else -return v4l2_m2m_ioctl_try_decoder_cmd (file, priv, cmd); +return v4l2_m2m_ioctl_try_decoder_cmd (file, priv, cmd); }
@@ -69,10 +62,6 @@ static int vidioc_decoder_cmd(struct file *file, void *priv,if (ret)return ret; -/* Use M2M stateless helper if relevant */ -if (ctx->dev->vdec_pdata->uses_stateless_api) -return v4l2_m2m_ioctl_stateless_decoder_cmd (file, priv, cmd); -mtk_v4l2_debug (1 ,"decoder cmd=%u" , cmd->cmd); dst_vq =v4l2_m2m_get_vq (ctx->m2m_ctx,V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE );
drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_drv.c +3 -0
@@ -315,6 +315,9 @@ static int mtk_vcodec_probe(struct platform_device *pdev) }if (dev->vdec_pdata->uses_stateless_api) { +v4l2_disable_ioctl (vfd_dec,VIDIOC_DECODER_CMD ); +v4l2_disable_ioctl (vfd_dec,VIDIOC_TRY_DECODER_CMD ); + dev->mdev_dec.dev = &pdev->dev;strscpy (dev->mdev_dec.model,MTK_VCODEC_DEC_NAME ,sizeof (dev->mdev_dec.model));
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 389/772 io_uring: avoid io-wq -EAGAIN looping for !IOPOLL
In reply to Greg Kroah-HartmanFrom: Pavel Begunkov <[email protected]>
[ Upstream commit e0deb6a025ae8c850dc8685be39fb27b06c88736 ]
If an opcode handler semi-reliably returns -EAGAIN, io_wq_submit_work() might continue busily hammer the same handler over and over again, which is not ideal. The -EAGAIN handling in question was put there only for IOPOLL, so restrict it to IOPOLL mode only where there is no other recourse than to retry as we cannot wait.
--- fs/io_uring.c | 2 ++ 1 file changed, 2 insertions(+)
fs/io_uring.c +2 -0
@@ -6939,6 +6939,8 @@ static void io_wq_submit_work(struct io_wq_work *work)* wait for request slots on the block side. */ if (!needs_poll) { +if (!(req->ctx->flags &IORING_SETUP_IOPOLL )) +break ;cond_resched ();continue ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 390/772 io_uring: cache poll/double-poll state with a request flag
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
[ Upstream commit 91eac1c69c202d9dad8bf717ae5b92db70bfe5cf ]
With commit "io_uring: cache req->apoll->events in req->cflags" applied, we now have just io_poll_remove_entries() dipping into req->apoll when it isn't strictly necessary.
Mark poll and double-poll with a flag, so we know if we need to look at apoll->double_poll. This avoids pulling in those cachelines if we don't need them. The common case is that the poll wake handler already removed these entries while hot off the completion path.
--- fs/io_uring.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-)
fs/io_uring.c +19 -5
@@ -740,6 +740,8 @@ enum {REQ_F_ARM_LTIMEOUT_BIT ,REQ_F_ASYNC_DATA_BIT ,REQ_F_SKIP_LINK_CQES_BIT , +REQ_F_SINGLE_POLL_BIT , +REQ_F_DOUBLE_POLL_BIT ,/* keep async read/write and isreg together and in order */ REQ_F_SUPPORT_NOWAIT_BIT , REQ_F_ISREG_BIT,
@@ -798,6 +800,10 @@ enum {REQ_F_ASYNC_DATA =BIT (REQ_F_ASYNC_DATA_BIT ),/* don't post CQEs while failing linked requests */ REQ_F_SKIP_LINK_CQES =BIT (REQ_F_SKIP_LINK_CQES_BIT ), +/* single poll may be active */ +REQ_F_SINGLE_POLL =BIT (REQ_F_SINGLE_POLL_BIT ), +/* double poll may active */ + REQ_F_DOUBLE_POLL = BIT(REQ_F_DOUBLE_POLL_BIT), }; struct async_poll {
@@ -5464,8 +5470,12 @@ static inline void io_poll_remove_entry(struct io_poll_iocb *poll)static void io_poll_remove_entries (struct io_kiocb *req) { -struct io_poll_iocb *poll =io_poll_get_single (req); -struct io_poll_iocb *poll_double =io_poll_get_double (req); +/* +* Nothing to do if neither of those flags are set. Avoid dipping +* into the poll/apoll/double cachelines if we can. +*/ +if (!(req->flags & (REQ_F_SINGLE_POLL |REQ_F_DOUBLE_POLL ))) +return ;/* * While we hold the waitqueue lock and the waitqueue is nonempty,
@@ -5483,9 +5493,10 @@ static void io_poll_remove_entries(struct io_kiocb *req)* In that case, only RCU prevents the queue memory from being freed. */ rcu_read_lock (); -io_poll_remove_entry (poll); -if (poll_double) -io_poll_remove_entry (poll_double); +if (req->flags &REQ_F_SINGLE_POLL ) +io_poll_remove_entry (io_poll_get_single (req)); +if (req->flags &REQ_F_DOUBLE_POLL ) +io_poll_remove_entry (io_poll_get_double (req));rcu_read_unlock (); }
@@ -5662,6 +5673,7 @@ static int io_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,if (mask && poll->events &EPOLLONESHOT ) {list_del_init (&poll->wait.entry); poll->head =NULL ; + req->flags &= ~REQ_F_SINGLE_POLL ; }__io_poll_execute (req, mask); }
@@ -5698,12 +5710,14 @@ static void __io_queue_proc(struct io_poll_iocb *poll, struct io_poll_table *pt, pt->error = -ENOMEM ;return ; } + req->flags |=REQ_F_DOUBLE_POLL ;io_init_poll_iocb (poll, first->events, first->wait.func); *poll_ptr = poll;if (req->opcode ==IORING_OP_POLL_ADD ) req->flags |=REQ_F_ASYNC_DATA ; } + req->flags |=REQ_F_SINGLE_POLL ; pt->nr_entries++; poll->head = head; poll->wait.private = req;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 391/772 io_uring: fix assuming triggered poll waitqueue is the single poll
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
[ Upstream commit d89a4fac0fbc6fe5fc24d1c9a889440dcf410368 ]
syzbot reports a recent regression:
BUG: KASAN: use-after-free in __wake_up_common+0x637/0x650 kernel/sched/wait.c:101 Read of size 8 at addr ffff888011e8a130 by task syz-executor413/3618 CPU: 0 PID: 3618 Comm: syz-executor413 Tainted: G W 5.17.0-syzkaller-01402-g8565d64430f8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 __wake_up_common+0x637/0x650 kernel/sched/wait.c:101 __wake_up_common_lock+0xd0/0x130 kernel/sched/wait.c:138 tty_release+0x657/0x1200 drivers/tty/tty_io.c:1781 __fput+0x286/0x9f0 fs/file_table.c:317 task_work_run+0xdd/0x1a0 kernel/task_work.c:164 exit_task_work include/linux/task_work.h:32 [inline] do_exit+0xaff/0x29d0 kernel/exit.c:806 do_group_exit+0xd2/0x2f0 kernel/exit.c:936 __do_sys_exit_group kernel/exit.c:947 [inline] __se_sys_exit_group kernel/exit.c:945 [inline] __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:945 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f439a1fac69
which is due to leaving the request on the waitqueue mistakenly. The reproducer is using a tty device, which means we end up arming the same poll queue twice (it uses the same poll waitqueue for both), but in io_poll_wake() we always just clear REQ_F_SINGLE_POLL regardless of which entry triggered. This leaves one waitqueue potentially armed after we're done, which then blows up in tty when the waitqueue is attempted removed.
We have no room to store this information, so simply encode it in the wait_queue_entry->private where we store the io_kiocb request pointer.
--- fs/io_uring.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
fs/io_uring.c +12 -4
@@ -5632,10 +5632,13 @@ static void io_poll_cancel_req(struct io_kiocb *req)io_poll_execute (req,0 ); } +#define wqe_to_req (wait) ((void *)((unsigned long) (wait)->private & ~1)) +#define wqe_is_double (wait) ((unsigned long) (wait)->private & 1) +static int io_poll_wake (struct wait_queue_entry *wait,unsigned mode,int sync,void *key) { -struct io_kiocb *req = wait->private; +struct io_kiocb *req =wqe_to_req (wait); struct io_poll_iocb *poll = container_of(wait, struct io_poll_iocb, wait);__poll_t mask =key_to_poll (key);
@@ -5673,7 +5676,10 @@ static int io_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,if (mask && poll->events &EPOLLONESHOT ) {list_del_init (&poll->wait.entry); poll->head =NULL ; - req->flags &= ~REQ_F_SINGLE_POLL ; +if (wqe_is_double (wait)) + req->flags &= ~REQ_F_DOUBLE_POLL ; +else + req->flags &= ~REQ_F_SINGLE_POLL ; }__io_poll_execute (req, mask); }
@@ -5685,6 +5691,7 @@ static void __io_queue_proc(struct io_poll_iocb *poll, struct io_poll_table *pt, struct io_poll_iocb **poll_ptr) {struct io_kiocb *req = pt->req; +unsigned long wqe_private = (unsigned long ) req;/* * The file being polled uses multiple waitqueues for poll handling
@@ -5710,6 +5717,8 @@ static void __io_queue_proc(struct io_poll_iocb *poll, struct io_poll_table *pt, pt->error = -ENOMEM ;return ; } +/* mark as double wq entry */ + wqe_private |=1 ; req->flags |=REQ_F_DOUBLE_POLL ;io_init_poll_iocb (poll, first->events, first->wait.func); *poll_ptr = poll;
@@ -5720,7 +5729,7 @@ static void __io_queue_proc(struct io_poll_iocb *poll, struct io_poll_table *pt, req->flags |=REQ_F_SINGLE_POLL ; pt->nr_entries++; poll->head = head; - poll->wait.private = req; + poll->wait.private = (void *) wqe_private;if (poll->events &EPOLLEXCLUSIVE )add_wait_queue_exclusive (head, &poll->wait);
@@ -5747,7 +5756,6 @@ static int __io_arm_poll_handler(struct io_kiocb *req,INIT_HLIST_NODE (&req->hash_node);io_init_poll_iocb (poll, mask, io_poll_wake); poll->file = req->file; - poll->wait.private = req; ipt->pt._key = mask; ipt->req = req;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 392/772 io_uring: only wake when the correct events are set
In reply to Greg Kroah-HartmanFrom: Dylan Yudaken <[email protected]>
[ Upstream commit 1b1d7b4bf1d9948c8dba5ee550459ce7c65ac019 ]
The check for waking up a request compares the poll_t bits, however this will always contain some common flags so this always wakes up.
For files with single wait queues such as sockets this can cause the request to be sent to the async worker unnecesarily. Further if it is non-blocking will complete the request with EAGAIN which is not desired.
Here exclude these common events, making sure to not exclude POLLERR which might be important.
--- fs/io_uring.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/io_uring.c +3 -2
@@ -5634,6 +5634,7 @@ static void io_poll_cancel_req(struct io_kiocb *req)#define wqe_to_req (wait) ((void *)((unsigned long) (wait)->private & ~1))#define wqe_is_double (wait) ((unsigned long) (wait)->private & 1) +#define IO_ASYNC_POLL_COMMON (EPOLLONESHOT | POLLPRI)static int io_poll_wake (struct wait_queue_entry *wait,unsigned mode,int sync,void *key)
@@ -5668,7 +5669,7 @@ static int io_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync, }/* for instances that support it check for an event match first */ -if (mask && !(mask & poll->events)) +if (mask && !(mask & (poll->events & ~IO_ASYNC_POLL_COMMON )))return 0 ;if (io_poll_get_ownership (req)) {
@@ -5824,7 +5825,7 @@ static int io_arm_poll_handler(struct io_kiocb *req)struct io_ring_ctx *ctx = req->ctx;struct async_poll *apoll;struct io_poll_table ipt; -__poll_t mask =EPOLLONESHOT |POLLERR |POLLPRI ; +__poll_t mask =IO_ASYNC_POLL_COMMON |POLLERR ;int ret;if (!def->pollin && !def->pollout)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 393/772 irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
[ Upstream commit adf14453d2c037ab529040c1186ea32e277e783a ]
There are cases where a context synchronization event is necessary between an IRQ being raised and being handled, and there are races such that we cannot rely upon the exception entry being subsequent to the interrupt being raised.
We identified and fixes this for regular IRQs in commit:
39a06b67c2c1256b ("irqchip/gic: Ensure we have an ISB between ack and ->handle_irq")
Unfortunately, we forgot to do the same for psuedo-NMIs when support for those was added in commit:
f32c926651dcd168 ("irqchip/gic-v3: Handle pseudo-NMIs")
Which means that when pseudo-NMIs are used for PMU support, we'll hit the same problem.
Apply the same fix as for regular IRQs. Note that when EOI mode 1 is in use, the call to gic_write_eoir() will provide an ISB.
--- drivers/irqchip/irq-gic-v3.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/irqchip/irq-gic-v3.c +3 -0
@@ -654,6 +654,9 @@ static inline void gic_handle_nmi(u32 irqnr, struct pt_regs *regs)if (static_branch_likely (&supports_deactivate_key))gic_write_eoir (irqnr); +else +isb () +/* * Leave the PSR.I bit set to prevent other NMIs to be * received while handling this one.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 394/772 irqchip/gic-v3: Refactor ISB + EOIR at ack time
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
[ Upstream commit 6efb50923771f392122f5ce69dfc43b08f16e449 ]
There are cases where a context synchronization event is necessary between an IRQ being raised and being handled, and there are races such that we cannot rely upon the exception entry being subsequent to the interrupt being raised. To fix this, we place an ISB between a read of IAR and the subsequent invocation of an IRQ handler.
When EOI mode 1 is in use, we need to EOI an interrupt prior to invoking its handler, and we have a write to EOIR for this. As this write to EOIR requires an ISB, and this is provided by the gic_write_eoir() helper, we omit the usual ISB in this case, with the logic being:
| if (static_branch_likely(&supports_deactivate_key)) | gic_write_eoir(irqnr); | else | isb();
This is somewhat opaque, and it would be a little clearer if there were an unconditional ISB, with only the write to EOIR being conditional, e.g.
| if (static_branch_likely(&supports_deactivate_key)) | write_gicreg(irqnr, ICC_EOIR1_EL1); | | isb();
This patch rewrites the code that way, with this logic factored into a new helper function with comments explaining what the ISB is for, as were originally laid out in commit:
39a06b67c2c1256b ("irqchip/gic: Ensure we have an ISB between ack and ->handle_irq")
Note that since then, we removed the IAR polling in commit:
342677d70ab92142 ("irqchip/gic-v3: Remove acknowledge loop")
... which removed one of the two race conditions.
For consistency, other portions of the driver are made to manipulate EOIR using write_gicreg() and explcit ISBs, and the gic_write_eoir() helper function is removed.
There should be no functional change as a result of this patch.
--- arch/arm/include/asm/arch_gicv3.h | 7 +---- arch/arm64/include/asm/arch_gicv3.h | 6 ---- drivers/irqchip/irq-gic-v3.c | 43 ++++++++++++++++++++++------- 3 files changed, 34 insertions(+), 22 deletions(-)
arch/arm/include/asm/arch_gicv3.h +1 -6
@@ -48,6 +48,7 @@ static inline u32 read_ ## a64(void) \return read_sysreg (a32); \ } \ +CPUIF_MAP(ICC_EOIR1, ICC_EOIR1_EL1) CPUIF_MAP(ICC_PMR, ICC_PMR_EL1) CPUIF_MAP(ICC_AP0R0, ICC_AP0R0_EL1)CPUIF_MAP (ICC_AP0R1 ,ICC_AP0R1_EL1 )
@@ -63,12 +64,6 @@ CPUIF_MAP(ICC_AP1R3, ICC_AP1R3_EL1)/* Low-level accessors */ -static inline void gic_write_eoir (u32 irq) -{ -write_sysreg (irq,ICC_EOIR1 ); -isb (); -} -static inline void gic_write_dir (u32 val) {write_sysreg (val,ICC_DIR );
arch/arm64/include/asm/arch_gicv3.h +0 -6
@@ -26,12 +26,6 @@* sets the GP register's most significant bits to 0 with an explicit cast. */ -static inline void gic_write_eoir (u32 irq) -{ -write_sysreg_s (irq,SYS_ICC_EOIR1_EL1 ); -isb (); -} - static __always_inline void gic_write_dir(u32 irq) {write_sysreg_s (irq,SYS_ICC_DIR_EL1 );
drivers/irqchip/irq-gic-v3.c +33 -10
70 lines not on this page · raw message
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 395/772 irqchip/gic-v3: Fix priority mask handling
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
[ Upstream commit 614ab80c96474682157cabb14f8c8602b3422e90 ]
When a kernel is built with CONFIG_ARM64_PSEUDO_NMI=y and pseudo-NMIs are enabled at runtime, GICv3's gic_handle_irq() can leave DAIF and ICC_PMR_EL1 in an unexpected state in some cases, breaking subsequent usage of local_irq_enable() and resulting in softirqs being run with IRQs erroneously masked (possibly resulting in deadlocks).
This can happen when an IRQ exception is taken from a context where regular IRQs were unmasked, and either:
(1) ICC_IAR1_EL1 indicates a special INTID (e.g. as a result of an IRQ being withdrawn since the IRQ exception was taken).
(2) ICC_IAR1_EL1 and ICC_RPR_EL1 indicate an NMI was acknowledged.
When an NMI is taken from a context where regular IRQs were masked, there is no problem.
When CONFIG_ARM64_DEBUG_PRIORITY_MASKING=y, this can be detected with perf, e.g.
| # ./perf record -a -g -e cycles:k ls -alR / > /dev/null 2>&1 | ------------[ cut here ]------------ | WARNING: CPU: 0 PID: 14 at arch/arm64/include/asm/irqflags.h:32 arch_local_irq_enable+0x4c/0x6c | Modules linked in: | CPU: 0 PID: 14 Comm: ksoftirqd/0 Not tainted 5.18.0-rc5-00004-g876c38e3d20b #12 | Hardware name: linux,dummy-virt (DT) | pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : arch_local_irq_enable+0x4c/0x6c | lr : __do_softirq+0x110/0x5d8 | sp : ffff8000080bbbc0 | pmr_save: 000000f0 | x29: ffff8000080bbbc0 x28: ffff316ac3a6ca40 x27: 0000000000000000 | x26: 0000000000000000 x25: ffffa04611c06008 x24: ffffa04611c06008 | x23: 0000000040400005 x22: 0000000000000200 x21: ffff8000080bbe20 | x20: ffffa0460fe10320 x19: 0000000000000009 x18: 0000000000000000 | x17: ffff91252dfa9000 x16: ffff800008004000 x15: 0000000000004000 | x14: 0000000000000028 x13: ffffa0460fe17578 x12: ffffa0460fed4294 | x11: ffffa0460fedc168 x10: ffffffffffffff80 x9 : ffffa0460fe10a70 | x8 : ffffa0460fedc168 x7 : 000000000000b762 x6 : 00000000057c3bdf | x5 : ffff8000080bbb18 x4 : 0000000000000000 x3 : 0000000000000001 | x2 : ffff91252dfa9000 x1 : 0000000000000060 x0 : 00000000000000f0 | Call trace: | arch_local_irq_enable+0x4c/0x6c | __irq_exit_rcu+0x180/0x1ac | irq_exit_rcu+0x1c/0x44 | el1_interrupt+0x4c/0xe4 | el1h_64_irq_handler+0x18/0x24 | el1h_64_irq+0x74/0x78 | smpboot_thread_fn+0x68/0x2c0 | kthread+0x124/0x130 | ret_from_fork+0x10/0x20 | irq event stamp: 193241 | hardirqs last enabled at (193240): [<ffffa0460fe10a9c>] __do_softirq+0x10c/0x5d8 | hardirqs last disabled at (193241): [<ffffa0461102ffe4>] el1_dbg+0x24/0x90 | softirqs last enabled at (193234): [<ffffa0460fe10e00>] __do_softirq+0x470/0x5d8 | softirqs last disabled at (193239): [<ffffa0460fea9944>] __irq_exit_rcu+0x180/0x1ac | ---[ end trace 0000000000000000 ]---
The necessary manipulation of DAIF and ICC_PMR_EL1 depends on the interrupted context, but the structure of gic_handle_irq() makes this also depend on whether the GIC reports an IRQ, NMI, or special INTID:
* When the interrupted context had regular IRQs masked (and hence the interrupt must be an NMI), the entry code performs the NMI entry/exit and gic_handle_irq() should return with DAIF and ICC_PMR_EL1 unchanged.
This is handled correctly today.
* When the interrupted context had regular IRQs unmasked, the entry code performs IRQ entry/exit, but expects gic_handle_irq() to always update ICC_PMR_EL1 and DAIF.IF to unmask NMIs (but not regular IRQs) prior to returning (which it must do prior to invoking any regular IRQ handler).
This unbalanced calling convention is necessary because we don't know whether an NMI has been taken until acknowledged by a read from ICC_IAR1_EL1, and so we need to perform the read with NMI masked in case an NMI has been taken (and needs to be handled with NMIs masked).
Unfortunately, this is not handled consistently:
- When ICC_IAR1_EL1 reports a special INTID, gic_handle_irq() returns immediately without manipulating ICC_PMR_EL1 and DAIF.
- When RPR_EL1 indicates an NMI, gic_handle_irq() calls gic_handle_nmi() to invoke the NMI handler, then returns without manipulating ICC_PMR_EL1 and DAIF.
- For regular IRQs, gic_handle_irq() manipulates ICC_PMR_EL1 and DAIF prior to invoking the IRQ handler.
There were related problems with special INTID handling in the past, where if an exception was taken from a context with regular IRQs masked and ICC_IAR_EL1 reported a special INTID, gic_handle_irq() would erroneously unmask NMIs in NMI context permitted an unexpected nested NMI. That case specifically was fixed by commit:
a97709f563a078e2 ("irqchip/gic-v3: Do not enable irqs when handling spurious interrups")
... but unfortunately that commit added an inverse problem, where if an exception was taken from a context with regular IRQs *unmasked* and ICC_IAR_EL1 reported a special INTID, gic_handle_irq() would erroneously fail to unmask NMIs (and consequently regular IRQs could not be unmasked during softirq processing). Before and after that commit, if an NMI was taken from a context with regular IRQs unmasked gic_handle_irq() would not unmask NMIs prior to returning, leading to the same problem with softirq handling.
This patch fixes this by restructuring gic_handle_irq(), splitting it into separate irqson/irqsoff helper functions which consistently perform the DAIF + ICC_PMR1_EL1 manipulation based upon the interrupted context, regardless of the event indicated by ICC_IAR1_EL1.
The special INTID handling is moved into the low-level IRQ/NMI handler invocation helper functions, so that early returns don't prevent the required manipulation of DAIF + ICC_PMR_EL1.
--- drivers/irqchip/irq-gic-v3.c | 147 +++++++++++++++++++++-------------- 1 file changed, 89 insertions(+), 58 deletions(-)
drivers/irqchip/irq-gic-v3.c +89 -58
@@ -673,78 +673,69 @@ static inline void gic_complete_ack(u32 irqnr)isb (); } -static inline void gic_handle_nmi (u32 irqnr,struct pt_regs *regs) +static bool gic_rpr_is_nmi_prio (void ) { -bool irqs_enabled =interrupts_enabled (regs); -int err; +if (!gic_supports_nmi ()) +return false; -if (irqs_enabled) -nmi_enter (); +return unlikely (gic_read_rpr () ==GICD_INT_RPR_PRI (GICD_INT_NMI_PRI )); +} + +static bool gic_irqnr_is_special (u32 irqnr) +{ +return irqnr >=1020 && irqnr <=1023 ; +} + +static void __gic_handle_irq (u32 irqnr,struct pt_regs *regs) +{ +if (gic_irqnr_is_special (irqnr)) +return ;gic_complete_ack (irqnr); -/* -* Leave the PSR.I bit set to prevent other NMIs to be -* received while handling this one. -* PSR.I will be restored when we ERET to the -* interrupted context. -*/ - err =generic_handle_domain_nmi (gic_data.domain, irqnr); -if (err) +if (generic_handle_domain_irq (gic_data.domain, irqnr)) { +WARN_ONCE (true,"Unexpected interrupt (irqnr %u)\n" , irqnr);gic_deactivate_unhandled (irqnr); - -if (irqs_enabled) -nmi_exit (); + } } -static u32 do_read_iar (struct pt_regs *regs) +static void __gic_handle_nmi (u32 irqnr,struct pt_regs *regs) { -u32 iar; - -if (gic_supports_nmi () &&unlikely (!interrupts_enabled (regs))) { -u64 pmr; - -/* -* We were in a context with IRQs disabled. However, the -* entry code has set PMR to a value that allows any -* interrupt to be acknowledged, and not just NMIs. This can -* lead to surprising effects if the NMI has been retired in -* the meantime, and that there is an IRQ pending. The IRQ -* would then be taken in NMI context, something that nobody -* wants to debug twice. -* -* Until we sort this, drop PMR again to a level that will -* actually only allow NMIs before reading IAR, and then -* restore it to what it was. -*/ - pmr =gic_read_pmr (); -gic_pmr_mask_irqs (); -isb (); +if (gic_irqnr_is_special (irqnr)) +return ; - iar =gic_read_iar (); +gic_complete_ack (irqnr); -gic_write_pmr (pmr); - }else { - iar =gic_read_iar (); +if (generic_handle_domain_nmi (gic_data.domain, irqnr)) { +WARN_ONCE (true,"Unexpected pseudo-NMI (irqnr %u)\n" , irqnr); +gic_deactivate_unhandled (irqnr); } - -return iar; } -static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs) +/* +* An exception has been taken from a context with IRQs enabled, and this could +* be an IRQ or an NMI. +* +* The entry code called us with DAIF.IF set to keep NMIs masked. We must clear +* DAIF.IF (and update ICC_PMR_EL1 to mask regular IRQs) prior to returning, +* after handling any NMI but before handling any IRQ. +* +* The entry code has performed IRQ entry, and if an NMI is detected we must +* perform NMI entry/exit around invoking the handler. +*/ +static void __gic_handle_irq_from_irqson (struct pt_regs *regs) { +bool is_nmi;u32 irqnr; - irqnr =do_read_iar (regs); + irqnr =gic_read_iar (); -/* Check for special IDs first */ -if ((irqnr >=1020 && irqnr <=1023 )) -return ; + is_nmi =gic_rpr_is_nmi_prio (); -if (gic_supports_nmi () && -unlikely (gic_read_rpr () ==GICD_INT_RPR_PRI (GICD_INT_NMI_PRI ))) { -gic_handle_nmi (irqnr, regs); -return ; +if (is_nmi) { +nmi_enter (); +__gic_handle_nmi (irqnr, regs); +nmi_exit (); }if (gic_prio_masking_enabled ()) {
@@ -752,12 +743,52 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regsgic_arch_enable_irqs (); } -gic_complete_ack (irqnr); +if (!is_nmi) +__gic_handle_irq (irqnr, regs); +} -if (generic_handle_domain_irq (gic_data.domain, irqnr)) { -WARN_ONCE (true,"Unexpected interrupt received!\n" ); -gic_deactivate_unhandled (irqnr); - } +/* +* An exception has been taken from a context with IRQs disabled, which can only +* be an NMI. +* +* The entry code called us with DAIF.IF set to keep NMIs masked. We must leave +* DAIF.IF (and ICC_PMR_EL1) unchanged. +* +* The entry code has performed NMI entry. +*/ +static void __gic_handle_irq_from_irqsoff (struct pt_regs *regs) +{ +u64 pmr; +u32 irqnr; + +/* +* We were in a context with IRQs disabled. However, the +* entry code has set PMR to a value that allows any +* interrupt to be acknowledged, and not just NMIs. This can +* lead to surprising effects if the NMI has been retired in +* the meantime, and that there is an IRQ pending. The IRQ +* would then be taken in NMI context, something that nobody +* wants to debug twice. +* +* Until we sort this, drop PMR again to a level that will +* actually only allow NMIs before reading IAR, and then +* restore it to what it was. +*/ + pmr =gic_read_pmr (); +gic_pmr_mask_irqs (); +isb (); + irqnr =gic_read_iar (); +gic_write_pmr (pmr); + +__gic_handle_nmi (irqnr, regs); +} + +static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs) +{ +if (unlikely (gic_supports_nmi () && !interrupts_enabled (regs))) +__gic_handle_irq_from_irqsoff (regs); +else +__gic_handle_irq_from_irqson (regs); }static u32 gic_get_pribits (void )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 396/772 nvme: set dma alignment to dword
In reply to Greg Kroah-HartmanFrom: Keith Busch <[email protected]>
[ Upstream commit 52fde2c07da606f3f120af4f734eadcfb52b04be ]
The nvme specification only requires qword alignment for segment descriptors, and the driver already guarantees that. The spec has always allowed user data to be dword aligned, which is what the queue's attribute is for, so relax the alignment requirement to that value.
While we could allow byte alignment for some controllers when using SGLs, we still need to support PRP, and that only allows dword.
--- drivers/nvme/host/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/core.c +1 -1
@@ -1796,7 +1796,7 @@ static void nvme_set_queue_limits(struct nvme_ctrl *ctrl,blk_queue_max_segments (q,min_t (u32, max_segments,USHRT_MAX )); }blk_queue_virt_boundary (q,NVME_CTRL_PAGE_SIZE -1 ); -blk_queue_dma_alignment (q,7 ); +blk_queue_dma_alignment (q,3 );blk_queue_write_cache (q, vwc, vwc); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 397/772 m68k: math-emu: Fix dependencies of math emulation support
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit ed6bc6bf0a7d75e80eb1df883c09975ebb74e590 ]
If CONFIG_M54xx=y, CONFIG_MMU=y, and CONFIG_M68KFPU_EMU=y:
{standard input}:272: Error: invalid instruction for this architecture; needs 68000 or higher (68000 [68ec000, 68hc000, 68hc001, 68008, 68302, 68306, 68307, 68322, 68356], 68010, 68020 [68k, 68ec020], 68030 [68ec030], 68040 [68ec040], 68060 [68ec060], cpu32 [68330, 68331, 68332, 68333, 68334, 68336, 68340, 68341, 68349, 68360], fidoa [fido]) -- statement `sub.b %d1,%d3' ignored
{standard input}:609: Error: invalid instruction for this architecture; needs 68020 or higher (68020 [68k, 68ec020], 68030 [68ec030], 68040 [68ec040], 68060 [68ec060]) -- statement `bfextu 4(%a1){%d0,#8},%d0' ignored
{standard input}:752: Error: operands mismatch -- statement `mulu.l 4(%a0),%d3:%d0' ignored
{standard input}:1155: Error: operands mismatch -- statement `divu.l %d0,%d3:%d7' ignoredThe math emulation support code is intended for 68020 and higher, and uses several instructions or instruction modes not available on coldfire or 68000.
Originally, the dependency of M68KFPU_EMU on MMU was fine, as MMU support was only available on 68020 or higher. But this assumption was broken by the introduction of MMU support for M547x and M548x.
Drop the dependency on MMU, as the code should work fine on 68020 and up without MMU (which are not yet supported by Linux, though). Add dependencies on M68KCLASSIC (to rule out Coldfire) and FPU (kernel has some type of floating-point support --- be it hardware or software emulated, to rule out anything below 68020).
--- arch/m68k/Kconfig.cpu | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/m68k/Kconfig.cpu +1 -1
@@ -327,7 +327,7 @@ comment "Processor Specific Options" config M68KFPU_EMU bool "Math emulation support" - depends on MMU + depends on M68KCLASSIC && FPU help At some point in the future, this will cause floating-point math instructions to be emulated by the kernel on machines that lack a
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 398/772 sctp: read sk->sk_bound_dev_if once in sctp_rcv()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit a20ea298071f46effa3aaf965bf9bb34c901db3f ]
sctp_rcv() reads sk->sk_bound_dev_if twice while the socket is not locked. Another cpu could change this field under us.
--- net/sctp/input.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/sctp/input.c +3 -1
@@ -92,6 +92,7 @@ int sctp_rcv(struct sk_buff *skb)struct sctp_chunk *chunk;union sctp_addr src;union sctp_addr dest; +int bound_dev_if;int family;struct sctp_af *af;struct net *net =dev_net (skb->dev);
@@ -169,7 +170,8 @@ int sctp_rcv(struct sk_buff *skb)* If a frame arrives on an interface and the receiving socket is * bound to another interface, via SO_BINDTODEVICE, treat it as OOTB */ -if (sk->sk_bound_dev_if && (sk->sk_bound_dev_if != af->skb_iif (skb))) { + bound_dev_if =READ_ONCE (sk->sk_bound_dev_if); +if (bound_dev_if && (bound_dev_if != af->skb_iif (skb))) {if (transport) {sctp_transport_put (transport); asoc =NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 399/772 net: hinic: add missing destroy_workqueue in hinic_pf_to_mgmt_init
In reply to Greg Kroah-HartmanFrom: Zheng Bin <[email protected]>
[ Upstream commit 382d917bfc1e92339dae3c8a636b2730e8bb5132 ]
hinic_pf_to_mgmt_init misses destroy_workqueue in error path, this patch fixes that.
--- drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c +2 -0
@@ -643,6 +643,7 @@ int hinic_pf_to_mgmt_init(struct hinic_pf_to_mgmt *pf_to_mgmt, err =alloc_msg_buf (pf_to_mgmt);if (err) {dev_err (&pdev->dev,"Failed to allocate msg buffers\n" ); +destroy_workqueue (pf_to_mgmt->workq);hinic_health_reporters_destroy (hwdev->devlink_dev);return err; }
@@ -650,6 +651,7 @@ int hinic_pf_to_mgmt_init(struct hinic_pf_to_mgmt *pf_to_mgmt, err =hinic_api_cmd_init (pf_to_mgmt->cmd_chain, hwif);if (err) {dev_err (&pdev->dev,"Failed to initialize cmd chains\n" ); +destroy_workqueue (pf_to_mgmt->workq);hinic_health_reporters_destroy (hwdev->devlink_dev);return err; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 400/772 ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_*
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit a34840c4eb3278a7c29c9c57a65ce7541c66f9f2 ]
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
--- sound/soc/ti/j721e-evm.c | 44 ++++++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 11 deletions(-)
sound/soc/ti/j721e-evm.c +33 -11
@@ -630,17 +630,18 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, codec_node =of_parse_phandle (node,"ti,cpb-codec" ,0 );if (!codec_node) {dev_err (priv->dev,"CPB codec node is not provided\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto put_dai_node; } domain = &priv->audio_domains[J721E_AUDIO_DOMAIN_CPB ]; ret =j721e_get_clocks (priv->dev, &domain->codec,"cpb-codec-scki" );if (ret) -return ret; + goto put_codec_node; ret =j721e_get_clocks (priv->dev, &domain->mcasp,"cpb-mcasp-auxclk" );if (ret) -return ret; + goto put_codec_node;/* * Common Processor Board, two links
@@ -650,8 +651,10 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, comp_count =6 ; compnent =devm_kzalloc (priv->dev, comp_count *sizeof (*compnent),GFP_KERNEL ); -if (!compnent) -return -ENOMEM ; +if (!compnent) { + ret = -ENOMEM ; + goto put_codec_node; + } comp_idx =0 ; priv->dai_links[*link_idx].cpus = &compnent[comp_idx++];
@@ -702,6 +705,12 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, (*conf_idx)++;return 0 ; + +put_codec_node: +of_node_put (codec_node); +put_dai_node: +of_node_put (dai_node); +return ret; } static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx,
@@ -726,23 +735,25 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, codeca_node =of_parse_phandle (node,"ti,ivi-codec-a" ,0 );if (!codeca_node) {dev_err (priv->dev,"IVI codec-a node is not provided\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto put_dai_node; } codecb_node =of_parse_phandle (node,"ti,ivi-codec-b" ,0 );if (!codecb_node) {dev_warn (priv->dev,"IVI codec-b node is not provided\n" ); -return 0 ; + ret =0 ; + goto put_codeca_node; } domain = &priv->audio_domains[J721E_AUDIO_DOMAIN_IVI ]; ret =j721e_get_clocks (priv->dev, &domain->codec,"ivi-codec-scki" );if (ret) -return ret; + goto put_codecb_node; ret =j721e_get_clocks (priv->dev, &domain->mcasp,"ivi-mcasp-auxclk" );if (ret) -return ret; + goto put_codecb_node;/* * IVI extension, two links
@@ -754,8 +765,10 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, comp_count =8 ; compnent =devm_kzalloc (priv->dev, comp_count *sizeof (*compnent),GFP_KERNEL ); -if (!compnent) -return -ENOMEM ; +if (!compnent) { + ret = -ENOMEM ; + goto put_codecb_node; + } comp_idx =0 ; priv->dai_links[*link_idx].cpus = &compnent[comp_idx++];
@@ -816,6 +829,15 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, (*conf_idx)++;return 0 ; + + +put_codecb_node: +of_node_put (codecb_node); +put_codeca_node: +of_node_put (codeca_node); +put_dai_node: +of_node_put (dai_node); +return ret; }static int j721e_soc_probe (struct platform_device *pdev)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 401/772 kselftest/arm64: bti: force static linking
In reply to Greg Kroah-HartmanFrom: Andre Przywara <[email protected]>
[ Upstream commit d7a49291d786b4400996afe3afcc3ef5eeb6f0ef ]
The "bti" selftests are built with -nostdlib, which apparently automatically creates a statically linked binary, which is what we want and need for BTI (to avoid interactions with the dynamic linker).
However this is not true when building a PIE binary, which some toolchains (Ubuntu) configure as the default.
When compiling btitest with such a toolchain, it will create a dynamically linked binary, which will probably fail some tests, as the dynamic linker might not support BTI:
===================
TAP version 13
1..18
not ok 1 nohint_func/call_using_br_x0
not ok 2 nohint_func/call_using_br_x16
not ok 3 nohint_func/call_using_blr
....
===================
To make sure we create static binaries, add an explicit -static on the linker command line. This forces static linking even if the toolchain defaults to PIE builds, and fixes btitest runs on BTI enabled machines.
--- tools/testing/selftests/arm64/bti/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/arm64/bti/Makefile +2 -2
@@ -39,7 +39,7 @@ BTI_OBJS = \ teststubs-bti.o \ trampoline-bti.o gen/btitest: $(BTI_OBJS) - $(CC) $(CFLAGS_BTI) $(CFLAGS_COMMON) -nostdlib -o $@ $^ + $(CC) $(CFLAGS_BTI) $(CFLAGS_COMMON) -nostdlib -static -o $@ $^ NOBTI_OBJS = \ test-nobti.o \
@@ -50,7 +50,7 @@ NOBTI_OBJS = \ teststubs-nobti.o \ trampoline-nobti.o gen/nobtitest: $(NOBTI_OBJS) - $(CC) $(CFLAGS_BTI) $(CFLAGS_COMMON) -nostdlib -o $@ $^ + $(CC) $(CFLAGS_BTI) $(CFLAGS_COMMON) -nostdlib -static -o $@ $^ # Including KSFT lib.mk here will also mangle the TEST_GEN_PROGS list # to account for any OUTPUT target-dirs optionally provided by
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 402/772 media: ov7670: remove ov7670_power_off from ov7670_remove
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
[ Upstream commit 5bf19572e31375368f19edd2dbb2e0789518bb99 ]
In ov7670_probe, it always invokes ov7670_power_off() no matter the execution is successful or failed. So we cannot invoke it agiain in ov7670_remove().
Fix this by removing ov7670_power_off from ov7670_remove.
--- drivers/media/i2c/ov7670.c | 1 - 1 file changed, 1 deletion(-)
drivers/media/i2c/ov7670.c +0 -1
@@ -2017,7 +2017,6 @@ static int ov7670_remove(struct i2c_client *client)v4l2_async_unregister_subdev (sd);v4l2_ctrl_handler_free (&info->hdl);media_entity_cleanup (&info->sd.entity); -ov7670_power_off (sd);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 403/772 media: i2c: ov5648: fix wrong pointer passed to IS_ERR() and PTR_ERR()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit a6dd5265c21c28d0a782befe41a97c347e78f22f ]
IS_ERR() and PTR_ERR() use wrong pointer, it should be sensor->dovdd, fix it.
--- drivers/media/i2c/ov5648.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/i2c/ov5648.c +2 -2
@@ -2498,9 +2498,9 @@ static int ov5648_probe(struct i2c_client *client)/* DOVDD: digital I/O */ sensor->dovdd =devm_regulator_get (dev,"dovdd" ); -if (IS_ERR (sensor->dvdd)) { +if (IS_ERR (sensor->dovdd)) {dev_err (dev,"cannot get DOVDD (digital I/O) regulator\n" ); - ret =PTR_ERR (sensor->dvdd); + ret =PTR_ERR (sensor->dovdd); goto error_endpoint; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 404/772 media: rkvdec: Stop overclocking the decoder
In reply to Greg Kroah-HartmanFrom: Nicolas Dufresne <[email protected]>
[ Upstream commit 9998943f6dfc5d5472bfab2e38527fb6ba5e9da7 ]
While this overclock hack seems to work on some implementations (some ChromeBooks, RockPi4) it also causes instability on other implementations (notably LibreComputer Renegade, but there were more reports in the LibreELEC project, where this has been removed). While performance is indeed affected (tested with GStreamer), 4K playback still works as long as you don't operate in lock step and keep at least 1 frame ahead of time in the decode queue.
After discussion with ChromeOS members, it would seem that their implementation indeed used to synchronously decode each frame, so this hack was simply compensating for their code being less efficient. In my opinion, this hack should not have been included upstream.
--- drivers/staging/media/rkvdec/rkvdec.c | 6 ------ 1 file changed, 6 deletions(-)
drivers/staging/media/rkvdec/rkvdec.c +0 -6
@@ -1027,12 +1027,6 @@ static int rkvdec_probe(struct platform_device *pdev)if (ret)return ret; -/* -* Bump ACLK to max. possible freq. (500 MHz) to improve performance -* When 4k video playback. -*/ -clk_set_rate (rkvdec->clocks[0 ].clk,500 *1000 *1000 ); - rkvdec->regs =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (rkvdec->regs))return PTR_ERR (rkvdec->regs);
Signature · 1 line
2.35.1
Re: [PATCH 5.17 404/772] media: rkvdec: Stop overclocking the decoder
Hi,
Quoted 18 lines · Greg Kroah-Hartman
From: Nicolas Dufresne <[email protected]>
[ Upstream commit
9998943f6dfc5d5472bfab2e38527fb6ba5e9da7]While this overclock hack seems to work on some implementations (some ChromeBooks, RockPi4) it also causes instability on other implementations (notably LibreComputer Renegade, but there were more reports in the LibreELEC project, where this has been removed). While performance is indeed affected (tested with GStreamer), 4K playback still works as long as you don't operate in lock step and keep at least 1 frame ahead of time in the decode queue.
After discussion with ChromeOS members, it would seem that their implementation indeed used to synchronously decode each frame, so this hack was simply compensating for their code being less efficient. In my opinion, this hack should not have been included upstream.
Quoted 7 lines
Fixes cd33c830448ba ("media: rkvdec: Add the rkvdec driver")Signed-off-by Nicolas Dufresne <[email protected]>Reviewed-by Sebastian Fricke <[email protected]>Reviewed-by Ezequiel Garcia <[email protected]>Signed-off-by Hans Verkuil <[email protected]>Signed-off-by Mauro Carvalho Chehab <[email protected]>Signed-off-by Sasha Levin <[email protected]>
FWIW, I've noticed a problem that is uncovered by this patch, because the default clock rate is not currently acceptable all the time. See my fix here:
https://lore.kernel.org/all/20220607141535.1.Idafe043ffc94756a69426ec68872db0645c5d6e2@changeid/
[PATCH] arm64: dts: rockchip: Assign RK3399 VDU clock rate
It might be nice if $subject patch could be delayed until the fix is in too. The 5.19 cycle is only in -rc1, after all.
(The same seems to apply for the 5.{18,15,10}.y series too.)
Brian
Greg Kroah-Hartman
maintainerRe: [PATCH 5.17 404/772] media: rkvdec: Stop overclocking the decoder
Quoted 33 lines · Brian Norris
Hi,
Quoted 18 lines · Greg Kroah-Hartman
From: Nicolas Dufresne <[email protected]>
[ Upstream commit
9998943f6dfc5d5472bfab2e38527fb6ba5e9da7]While this overclock hack seems to work on some implementations (some ChromeBooks, RockPi4) it also causes instability on other implementations (notably LibreComputer Renegade, but there were more reports in the LibreELEC project, where this has been removed). While performance is indeed affected (tested with GStreamer), 4K playback still works as long as you don't operate in lock step and keep at least 1 frame ahead of time in the decode queue.
After discussion with ChromeOS members, it would seem that their implementation indeed used to synchronously decode each frame, so this hack was simply compensating for their code being less efficient. In my opinion, this hack should not have been included upstream.
Quoted 7 lines
Fixes cd33c830448ba ("media: rkvdec: Add the rkvdec driver")Signed-off-by Nicolas Dufresne <[email protected]>Reviewed-by Sebastian Fricke <[email protected]>Reviewed-by Ezequiel Garcia <[email protected]>Signed-off-by Hans Verkuil <[email protected]>Signed-off-by Mauro Carvalho Chehab <[email protected]>Signed-off-by Sasha Levin <[email protected]>FWIW, I've noticed a problem that is uncovered by this patch, because the default clock rate is not currently acceptable all the time. See my fix here:
Quoted 7 lines
https://lore.kernel.org/all/20220607141535.1.Idafe043ffc94756a69426ec68872db0645c5d6e2@changeid/
[PATCH] arm64: dts: rockchip: Assign RK3399 VDU clock rateIt might be nice if $subject patch could be delayed until the fix is in too. The 5.19 cycle is only in -rc1, after all.
(The same seems to apply for the 5.{18,15,10}.y series too.)
Thanks, will go drop this from all branches now.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 405/772 media: rkvdec: h264: Fix dpb_valid implementation
In reply to Greg Kroah-HartmanFrom: Nicolas Dufresne <[email protected]>
[ Upstream commit 7ab889f09dfa70e8097ec1b9186fd228124112cb ]
The ref builder only provided references that are marked as valid in the dpb. Thus the current implementation of dpb_valid would always set the flag to 1. This is not representing missing frames (this is called 'non-existing' pictures in the spec). In some context, these non-existing pictures still need to occupy a slot in the reference list according to the spec.
--- drivers/staging/media/rkvdec/rkvdec-h264.c | 33 ++++++++++++++++------ 1 file changed, 24 insertions(+), 9 deletions(-)
drivers/staging/media/rkvdec/rkvdec-h264.c +24 -9
@@ -112,6 +112,7 @@ struct rkvdec_h264_run {const struct v4l2_ctrl_h264_sps *sps;const struct v4l2_ctrl_h264_pps *pps;const struct v4l2_ctrl_h264_scaling_matrix *scaling_matrix; +int ref_buf_idx[V4L2_H264_NUM_DPB_ENTRIES ]; };struct rkvdec_h264_ctx {
@@ -725,6 +726,26 @@ static void assemble_hw_pps(struct rkvdec_ctx *ctx, } } +static void lookup_ref_buf_idx (struct rkvdec_ctx *ctx, +struct rkvdec_h264_run *run) +{ +const struct v4l2_ctrl_h264_decode_params *dec_params = run->decode_params; +u32 i; + +for (i =0 ; i <ARRAY_SIZE (dec_params->dpb); i++) { +struct v4l2_m2m_ctx *m2m_ctx = ctx->fh.m2m_ctx; +const struct v4l2_h264_dpb_entry *dpb = run->decode_params->dpb; +struct vb2_queue *cap_q = &m2m_ctx->cap_q_ctx.q; +int buf_idx =-1 ; + +if (dpb[i].flags &V4L2_H264_DPB_ENTRY_FLAG_ACTIVE ) + buf_idx =vb2_find_timestamp (cap_q, + dpb[i].reference_ts,0 ); + + run->ref_buf_idx[i] = buf_idx; + } +} +static void assemble_hw_rps (struct rkvdec_ctx *ctx,struct rkvdec_h264_run *run) {
@@ -762,7 +783,7 @@ static void assemble_hw_rps(struct rkvdec_ctx *ctx,for (j =0 ; j <RKVDEC_NUM_REFLIST ; j++) {for (i =0 ; i < h264_ctx->reflists.num_valid; i++) { -u8 dpb_valid =0 ; +bool dpb_valid = run->ref_buf_idx[i] >=0 ;u8 idx =0 ;switch (j) {
@@ -779,8 +800,6 @@ static void assemble_hw_rps(struct rkvdec_ctx *ctx,if (idx >=ARRAY_SIZE (dec_params->dpb))continue ; - dpb_valid = !!(dpb[idx].flags & -V4L2_H264_DPB_ENTRY_FLAG_ACTIVE );set_ps_field (hw_rps,DPB_INFO (i, j), idx | dpb_valid <<4 );
@@ -859,13 +878,8 @@ get_ref_buf(struct rkvdec_ctx *ctx, struct rkvdec_h264_run *run, unsigned int dpb_idx) {struct v4l2_m2m_ctx *m2m_ctx = ctx->fh.m2m_ctx; -const struct v4l2_h264_dpb_entry *dpb = run->decode_params->dpb;struct vb2_queue *cap_q = &m2m_ctx->cap_q_ctx.q; -int buf_idx =-1 ; - -if (dpb[dpb_idx].flags &V4L2_H264_DPB_ENTRY_FLAG_ACTIVE ) - buf_idx =vb2_find_timestamp (cap_q, - dpb[dpb_idx].reference_ts,0 ); +int buf_idx = run->ref_buf_idx[dpb_idx];/* * If a DPB entry is unused or invalid, address of current destination
@@ -1102,6 +1116,7 @@ static int rkvdec_h264_run(struct rkvdec_ctx *ctx)assemble_hw_scaling_list (ctx, &run);assemble_hw_pps (ctx, &run); +lookup_ref_buf_idx (ctx, &run);assemble_hw_rps (ctx, &run);config_registers (ctx, &run);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 406/772 media: rkvdec: h264: Fix bit depth wrap in pps packet
In reply to Greg Kroah-HartmanFrom: Jonas Karlman <[email protected]>
[ Upstream commit a074aa4760d1dad0bd565c0f66e7250f5f219ab0 ]
The luma and chroma bit depth fields in the pps packet are 3 bits wide. 8 is wrongly added to the bit depth values written to these 3 bit fields. Because only the 3 LSB are written, the hardware was configured correctly.
Correct this by not adding 8 to the luma and chroma bit depth value.
--- drivers/staging/media/rkvdec/rkvdec-h264.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/staging/media/rkvdec/rkvdec-h264.c +2 -2
@@ -662,8 +662,8 @@ static void assemble_hw_pps(struct rkvdec_ctx *ctx,WRITE_PPS (0xff ,PROFILE_IDC );WRITE_PPS (1 ,CONSTRAINT_SET3_FLAG );WRITE_PPS (sps->chroma_format_idc,CHROMA_FORMAT_IDC ); -WRITE_PPS (sps->bit_depth_luma_minus8 +8 ,BIT_DEPTH_LUMA ); -WRITE_PPS (sps->bit_depth_chroma_minus8 +8 ,BIT_DEPTH_CHROMA ); +WRITE_PPS (sps->bit_depth_luma_minus8,BIT_DEPTH_LUMA ); +WRITE_PPS (sps->bit_depth_chroma_minus8,BIT_DEPTH_CHROMA );WRITE_PPS (0 ,QPPRIME_Y_ZERO_TRANSFORM_BYPASS_FLAG );WRITE_PPS (sps->log2_max_frame_num_minus4,LOG2_MAX_FRAME_NUM_MINUS4 );WRITE_PPS (sps->max_num_ref_frames,MAX_NUM_REF_FRAMES );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 407/772 regulator: scmi: Fix refcount leak in scmi_regulator_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 68d6c8476fd4f448e70e0ab31ff972838ac41dae ]
of_find_node_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak.
--- drivers/regulator/scmi-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/scmi-regulator.c +1 -1
@@ -352,7 +352,7 @@ static int scmi_regulator_probe(struct scmi_device *sdev)return ret; } } - +of_node_put (np);/* * Register a regulator for each valid regulator-DT-entry that we * can successfully reach via SCMI and has a valid associated voltage
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 408/772 erofs: fix buffer copy overflow of ztailpacking feature
In reply to Greg Kroah-HartmanFrom: Gao Xiang <[email protected]>
[ Upstream commit dcbe6803fffd387f72b48c2373b5f5ed12a5804b ]
I got some KASAN report as below:
[ 46.959738] ================================================================== [ 46.960430] BUG: KASAN: use-after-free in z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] Read of size 4074 at addr ffff8880300c2f8e by task fssum/188 ... [ 46.960430] Call Trace: [ 46.960430] <TASK> [ 46.960430] dump_stack_lvl+0x41/0x5e [ 46.960430] print_report.cold+0xb2/0x6b7 [ 46.960430] ? z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] kasan_report+0x8a/0x140 [ 46.960430] ? z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] kasan_check_range+0x14d/0x1d0 [ 46.960430] memcpy+0x20/0x60 [ 46.960430] z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] z_erofs_decompress_pcluster+0xaae/0x1080
The root cause is that the tail pcluster won't be a complete filesystem block anymore. So if ztailpacking is used, the second part of an uncompressed tail pcluster may not be ``rq->pageofs_out``.
--- fs/erofs/decompressor.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/erofs/decompressor.c +3 -2
@@ -322,6 +322,7 @@ static int z_erofs_shifted_transform(struct z_erofs_decompress_req *rq,PAGE_ALIGN (rq->pageofs_out + rq->outputsize) >>PAGE_SHIFT ; const unsigned int righthalf = min_t(unsigned int, rq->outputsize,PAGE_SIZE - rq->pageofs_out); +const unsigned int lefthalf = rq->outputsize - righthalf;unsigned char *src, *dst;if (nrpages_out >2 ) {
@@ -344,10 +345,10 @@ static int z_erofs_shifted_transform(struct z_erofs_decompress_req *rq,if (nrpages_out ==2 ) {DBG_BUGON (!rq->out[1 ]);if (rq->out[1 ] == *rq->in) { -memmove (src, src + righthalf, rq->pageofs_out); +memmove (src, src + righthalf, lefthalf); }else { dst =kmap_atomic (rq->out[1 ]); -memcpy (dst, src + righthalf, rq->pageofs_out); +memcpy (dst, src + righthalf, lefthalf);kunmap_atomic (dst); } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 409/772 net/mlx5e: Correct the calculation of max channels for rep
In reply to Greg Kroah-HartmanFrom: Moshe Tal <[email protected]>
[ Upstream commit 6d0ba49321a40a8dada22c223bbe91c063b08db4 ]
Correct the calculation of maximum channels of rep to better utilize the hardware resources and allow a larger scale of reps.
This will allow creation of all virtual ports configured.
--- drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 9 +++++++++ drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 10 ++++++++-- 3 files changed, 18 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en.h +1 -0
@@ -1188,6 +1188,7 @@ mlx5e_tx_mpwqe_supported(struct mlx5_core_dev *mdev)MLX5_CAP_ETH (mdev, enhanced_multi_pkt_send_wqe); } +int mlx5e_get_pf_num_tirs (struct mlx5_core_dev *mdev); int mlx5e_priv_init(struct mlx5e_priv *priv, const struct mlx5e_profile *profile, struct net_device *netdev,
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +9 -0
@@ -5206,6 +5206,15 @@ mlx5e_calc_max_nch(struct mlx5_core_dev *mdev, struct net_device *netdev,return max_nch; } +int mlx5e_get_pf_num_tirs (struct mlx5_core_dev *mdev) +{ +/* Indirect TIRS: 2 sets of TTCs (inner + outer steering) +* and 1 set of direct TIRS +*/ +return 2 *MLX5E_NUM_INDIR_TIRS + +mlx5e_profile_max_num_channels (mdev, &mlx5e_nic_profile); +} +/* mlx5e generic netdev management API (move to en_common.c) */ int mlx5e_priv_init(struct mlx5e_priv *priv, const struct mlx5e_profile *profile,
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +8 -2
@@ -592,10 +592,16 @@ bool mlx5e_eswitch_vf_rep(const struct net_device *netdev)return netdev->netdev_ops == &mlx5e_netdev_ops_rep; } +/* One indirect TIR set for outer. Inner not supported in reps. */ +#define REP_NUM_INDIR_TIRS MLX5E_NUM_INDIR_TIRS +static int mlx5e_rep_max_nch_limit (struct mlx5_core_dev *mdev) { -return (1 <<MLX5_CAP_GEN (mdev, log_max_tir)) / -mlx5_eswitch_get_total_vports (mdev); +int max_tir_num =1 <<MLX5_CAP_GEN (mdev, log_max_tir); +int num_vports =mlx5_eswitch_get_total_vports (mdev); + +return (max_tir_num -mlx5e_get_pf_num_tirs (mdev) + - (num_vports *REP_NUM_INDIR_TIRS )) / num_vports; }static void mlx5e_build_rep_params (struct net_device *netdev)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 410/772 ext4: reject the commit option on ext2 filesystems
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
[ Upstream commit cb8435dc8ba33bcafa41cf2aa253794320a3b8df ]
The 'commit' option is only applicable for ext3 and ext4 filesystems, and has never been accepted by the ext2 filesystem driver, so the ext4 driver shouldn't allow it on ext2 filesystems.
This fixes a failure in xfstest ext4/053.
--- fs/ext4/super.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/super.c +1 -0
@@ -1913,6 +1913,7 @@ static const struct mount_opts { MOPT_EXT4_ONLY | MOPT_CLEAR}, {Opt_warn_on_error, EXT4_MOUNT_WARN_ON_ERROR, MOPT_SET}, {Opt_nowarn_on_error, EXT4_MOUNT_WARN_ON_ERROR, MOPT_CLEAR}, + {Opt_commit, 0, MOPT_NO_EXT2}, {Opt_nojournal_checksum, EXT4_MOUNT_JOURNAL_CHECKSUM, MOPT_EXT4_ONLY | MOPT_CLEAR}, {Opt_journal_checksum, EXT4_MOUNT_JOURNAL_CHECKSUM,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 411/772 drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit c56de483093d7ad0782327f95dda7da97bc4c315 ]
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore.
a6xx_gmu_init() passes the node to of_find_device_by_node() and of_dma_configure(), of_find_device_by_node() will takes its reference, of_dma_configure() doesn't need the node after usage.
Add missing of_node_put() to avoid refcount leak.
--- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/msm/adreno/a6xx_gpu.c +1 -0
@@ -1875,6 +1875,7 @@ struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)BUG_ON (!node); ret =a6xx_gmu_init (a6xx_gpu, node); +of_node_put (node);if (ret) {a6xx_destroy (&(a6xx_gpu->base.base));return ERR_PTR (ret);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 412/772 drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
In reply to Greg Kroah-HartmanFrom: Hangyu Hua <[email protected]>
[ Upstream commit 947a844bb3ebff0f4736d244d792ce129f6700d7 ]
drm_gem_object_lookup will call drm_gem_object_get inside. So cursor_bo needs to be put when msm_gem_get_and_pin_iova fails.
--- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +3 -1
@@ -989,8 +989,10 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc, ret =msm_gem_get_and_pin_iova (cursor_bo, kms->aspace, &mdp5_crtc->cursor.iova); -if (ret) +if (ret) { +drm_gem_object_put (cursor_bo);return -EINVAL ; + }pm_runtime_get_sync (&pdev->dev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 413/772 x86/sev: Annotate stack change in the #VC handler
In reply to Greg Kroah-HartmanFrom: Lai Jiangshan <[email protected]>
[ Upstream commit c42b145181aafd59ed31ccd879493389e3ea5a08 ]
In idtentry_vc(), vc_switch_off_ist() determines a safe stack to switch to, off of the IST stack. Annotate the new stack switch with ENCODE_FRAME_POINTER in case UNWINDER_FRAME_POINTER is used.
A stack walk before looks like this:
CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0-rc7+ #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl dump_stack kernel_exc_vmm_communication asm_exc_vmm_communication ? native_read_msr ? __x2apic_disable.part.0 ? x2apic_setup ? cpu_init ? trap_init ? start_kernel ? x86_64_start_reservations ? x86_64_start_kernel ? secondary_startup_64_no_verify </TASK>
and with the fix, the stack dump is exact:
CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0-rc7+ #3 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl dump_stack kernel_exc_vmm_communication asm_exc_vmm_communication RIP: 0010:native_read_msr Code: ... < snipped regs > ? __x2apic_disable.part.0 x2apic_setup cpu_init trap_init start_kernel x86_64_start_reservations x86_64_start_kernel secondary_startup_64_no_verify </TASK>
[ bp: Test in a SEV-ES guest and rewrite the commit message to
explain what exactly this does. ]
--- arch/x86/entry/entry_64.S | 1 + 1 file changed, 1 insertion(+)
arch/x86/entry/entry_64.S +1 -0
@@ -499,6 +499,7 @@ SYM_CODE_START(\asmsym) call vc_switch_off_ist movq %rax, %rsp /* Switch to new stack */ + ENCODE_FRAME_POINTER UNWIND_HINT_REGS /* Update pt_regs */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 414/772 drm/msm: dont free the IRQ if it was not requested
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 577e2a9dfc8fba7938aaf75db63fae7e328cc3cb ]
As msm_drm_uninit() is called from the msm_drm_init() error path, additional care should be necessary as not to call the free_irq() for the IRQ that was not requested before (because an error occured earlier than the request_irq() call).
This fixed the issue reported with the following backtrace:
[ 8.571329] Trying to free already-free IRQ 187 [ 8.571339] WARNING: CPU: 0 PID: 76 at kernel/irq/manage.c:1895 free_irq+0x1e0/0x35c [ 8.588746] Modules linked in: pmic_glink pdr_interface fastrpc qrtr_smd snd_soc_hdmi_codec msm fsa4480 gpu_sched drm_dp_aux_bus qrtr i2c_qcom_geni crct10dif_ce qcom_stats qcom_q6v5_pas drm_display_helper gpi qcom_pil_info drm_kms_helper qcom_q6v5 qcom_sysmon qcom_common qcom_glink_smem qcom_rng mdt_loader qmi_helpers phy_qcom_qmp ufs_qcom typec qnoc_sm8350 socinfo rmtfs_mem fuse drm ipv6 [ 8.624154] CPU: 0 PID: 76 Comm: kworker/u16:2 Not tainted 5.18.0-rc5-next-20220506-00033-g6cee8cab6089-dirty #419 [ 8.624161] Hardware name: Qualcomm Technologies, Inc. SM8350 HDK (DT) [ 8.641496] Workqueue: events_unbound deferred_probe_work_func [ 8.647510] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 8.654681] pc : free_irq+0x1e0/0x35c [ 8.658454] lr : free_irq+0x1e0/0x35c [ 8.662228] sp : ffff800008ab3950 [ 8.665642] x29: ffff800008ab3950 x28: 0000000000000000 x27: ffff16350f56a700 [ 8.672994] x26: ffff1635025df080 x25: ffff16350251badc x24: ffff16350251bb90 [ 8.680343] x23: 0000000000000000 x22: 00000000000000bb x21: ffff16350e8f9800 [ 8.687690] x20: ffff16350251ba00 x19: ffff16350cbd5880 x18: ffffffffffffffff [ 8.695039] x17: 0000000000000000 x16: ffffa2dd12179434 x15: ffffa2dd1431d02d [ 8.702391] x14: 0000000000000000 x13: ffffa2dd1431d028 x12: 662d79646165726c [ 8.709740] x11: ffffa2dd13fd2438 x10: 000000000000000a x9 : 00000000000000bb [ 8.717111] x8 : ffffa2dd13fd23f0 x7 : ffff800008ab3750 x6 : 00000000fffff202 [ 8.724487] x5 : ffff16377e870a18 x4 : 00000000fffff202 x3 : ffff735a6ae1b000 [ 8.731851] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff1635015f8000 [ 8.739217] Call trace: [ 8.741755] free_irq+0x1e0/0x35c [ 8.745198] msm_drm_uninit.isra.0+0x14c/0x294 [msm] [ 8.750548] msm_drm_bind+0x28c/0x5d0 [msm] [ 8.755081] try_to_bring_up_aggregate_device+0x164/0x1d0 [ 8.760657] __component_add+0xa0/0x170 [ 8.764626] component_add+0x14/0x20 [ 8.768337] dp_display_probe+0x2a4/0x464 [msm] [ 8.773242] platform_probe+0x68/0xe0 [ 8.777043] really_probe.part.0+0x9c/0x28c [ 8.781368] __driver_probe_device+0x98/0x144 [ 8.785871] driver_probe_device+0x40/0x140 [ 8.790191] __device_attach_driver+0xb4/0x120 [ 8.794788] bus_for_each_drv+0x78/0xd0 [ 8.798751] __device_attach+0xdc/0x184 [ 8.802713] device_initial_probe+0x14/0x20 [ 8.807031] bus_probe_device+0x9c/0xa4 [ 8.810991] deferred_probe_work_func+0x88/0xc0 [ 8.815667] process_one_work+0x1d0/0x320 [ 8.819809] worker_thread+0x14c/0x444 [ 8.823688] kthread+0x10c/0x110 [ 8.827036] ret_from_fork+0x10/0x20
Patchwork: https://patchwork.freedesktop.org/patch/485422/
--- drivers/gpu/drm/msm/msm_drv.c | 7 ++++++- drivers/gpu/drm/msm/msm_kms.h | 1 + 2 files changed, 7 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/msm_drv.c +6 -1
@@ -266,6 +266,8 @@ static int msm_irq_postinstall(struct drm_device *dev)static int msm_irq_install (struct drm_device *dev,unsigned int irq) { +struct msm_drm_private *priv = dev->dev_private; +struct msm_kms *kms = priv->kms;int ret;if (irq ==IRQ_NOTCONNECTED )
@@ -277,6 +279,8 @@ static int msm_irq_install(struct drm_device *dev, unsigned int irq)if (ret)return ret; + kms->irq_requested = true; + ret =msm_irq_postinstall (dev);if (ret) {free_irq (irq, dev);
@@ -292,7 +296,8 @@ static void msm_irq_uninstall(struct drm_device *dev)struct msm_kms *kms = priv->kms; kms->funcs->irq_uninstall (kms); -free_irq (kms->irq, dev); +if (kms->irq_requested) +free_irq (kms->irq, dev); }struct msm_vblank_work {
drivers/gpu/drm/msm/msm_kms.h +1 -0
@@ -148,6 +148,7 @@ struct msm_kms {/* irq number to be passed on to msm_irq_install */ int irq; +bool irq_requested;/* mapper-id used to request GEM buffer mapped for scanout: */ struct msm_gem_address_space *aspace;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 415/772 selftests/bpf: Add missed ima_setup.sh in Makefile
In reply to Greg Kroah-HartmanFrom: Hangbin Liu <[email protected]>
[ Upstream commit 70a1b25326dd77e145157ccf1a31c1948032eec4 ]
When build bpf test and install it to another folder, e.g.
make -j10 install -C tools/testing/selftests/ TARGETS="bpf" \
SKIP_TARGETS="" INSTALL_PATH=/tmp/kselftests
The ima_setup.sh is missed in target folder, which makes test_ima failed.
Fix it by adding ima_setup.sh to TEST_PROGS_EXTENDED.
--- tools/testing/selftests/bpf/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/Makefile +1 -1
@@ -75,7 +75,7 @@ TEST_PROGS := test_kmod.sh \ test_xsk.sh TEST_PROGS_EXTENDED := with_addr.sh \ - with_tunnels.sh \ + with_tunnels.sh ima_setup.sh \ test_xdp_vlan.sh test_bpftool.py # Compile but not part of 'make run_tests'
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 416/772 drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path
In reply to Greg Kroah-HartmanFrom: Abhinav Kumar <[email protected]>
[ Upstream commit 64b22a0da12adb571c01edd671ee43634ebd7e41 ]
If there are errors while trying to enable the pm in the bind path, it will lead to unclocked access of hw revision register thereby crashing the device.
This will not address why the pm_runtime_get_sync() fails but at the very least we should be able to prevent the crash by handling the error and bailing out earlier.
changes in v2:
- use pm_runtime_resume_and_get() instead of pm_runtime_get_sync()
Patchwork: https://patchwork.freedesktop.org/patch/486721/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +3 -1
@@ -1075,7 +1075,9 @@ static int dpu_kms_hw_init(struct msm_kms *kms)dpu_kms_parse_data_bus_icc_path (dpu_kms); -pm_runtime_get_sync (&dpu_kms->pdev->dev); + rc =pm_runtime_resume_and_get (&dpu_kms->pdev->dev); +if (rc <0 ) + goto error; dpu_kms->core_rev =readl_relaxed (dpu_kms->mmio +0x0 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 417/772 drm/i915: Fix CFI violation with show_dynamic_id()
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit 58606220a2f1407a7516c547f09a1ba7b4350a73 ]
When an attribute group is created with sysfs_create_group(), the ->sysfs_ops() callback is set to kobj_sysfs_ops, which sets the ->show() callback to kobj_attr_show(). kobj_attr_show() uses container_of() to get the ->show() callback from the attribute it was passed, meaning the ->show() callback needs to be the same type as the ->show() callback in 'struct kobj_attribute'.
However, show_dynamic_id() has the type of the ->show() callback in 'struct device_attribute', which causes a CFI violation when opening the 'id' sysfs node under drm/card0/metrics. This happens to work because the layout of 'struct kobj_attribute' and 'struct device_attribute' are the same, so the container_of() cast happens to allow the ->show() callback to still work.
Change the type of show_dynamic_id() to match the ->show() callback in 'struct kobj_attributes' and update the type of sysfs_metric_id to match, which resolves the CFI violation.
--- drivers/gpu/drm/i915/i915_perf.c | 4 ++-- drivers/gpu/drm/i915/i915_perf_types.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/i915_perf.c +2 -2
@@ -4008,8 +4008,8 @@ static struct i915_oa_reg *alloc_oa_regs(struct i915_perf *perf,return ERR_PTR (err); } -static ssize_t show_dynamic_id (struct device *dev, -struct device_attribute *attr, +static ssize_t show_dynamic_id (struct kobject *kobj, +struct kobj_attribute *attr,char *buf) { struct i915_oa_config *oa_config =
drivers/gpu/drm/i915/i915_perf_types.h +1 -1
@@ -55,7 +55,7 @@ struct i915_oa_config {struct attribute_group sysfs_metric;struct attribute *attrs[2 ]; -struct device_attribute sysfs_metric_id; +struct kobj_attribute sysfs_metric_id;struct kref ref;struct rcu_head rcu;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 418/772 thermal/drivers/bcm2711: Dont clamp temperature at zero
In reply to Greg Kroah-HartmanFrom: Stefan Wahren <[email protected]>
[ Upstream commit 106e0121e243de4da7d634338089a68a8da2abe9 ]
The thermal sensor on BCM2711 is capable of negative temperatures, so don't clamp the measurements at zero. Since this was the only use for variable t, drop it.
This change based on a patch by Dom Cobley, who also tested the fix.
--- drivers/thermal/broadcom/bcm2711_thermal.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/thermal/broadcom/bcm2711_thermal.c +1 -4
@@ -38,7 +38,6 @@ static int bcm2711_get_temp(void *data, int *temp)int offset =thermal_zone_get_offset (priv->thermal);u32 val;int ret; -long t; ret =regmap_read (priv->regmap,AVS_RO_TEMP_STATUS , &val);if (ret)
@@ -50,9 +49,7 @@ static int bcm2711_get_temp(void *data, int *temp) val &=AVS_RO_TEMP_STATUS_DATA_MSK ;/* Convert a HW code to a temperature reading (millidegree celsius) */ - t = slope * val + offset; - - *temp = t <0 ?0 : t; + *temp = slope * val + offset;return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 419/772 thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe
In reply to Greg Kroah-HartmanFrom: Zheng Yongjun <[email protected]>
[ Upstream commit e20d136ec7d6f309989c447638365840d3424c8e ]
platform_get_resource() may return NULL, add proper check to avoid potential NULL dereferencing.
--- drivers/thermal/broadcom/sr-thermal.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/thermal/broadcom/sr-thermal.c +3 -0
@@ -60,6 +60,9 @@ static int sr_thermal_probe(struct platform_device *pdev)return -ENOMEM ; res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); +if (!res) +return -ENOENT ; + sr_thermal->regs = (void __iomem *)devm_memremap (&pdev->dev, res->start,resource_size (res),MEMREMAP_WB );
Signature · 1 line
2.35.1