6.8.6-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 6.8.6-rc1 review
This is the start of the stable review cycle for the 6.8.6 release. There are 143 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 13 Apr 2024 09:53:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.8.6-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.8.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.8.6-rc1
Ma Jun <[email protected]>
Revert "drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()"
Borislav Petkov (AMD) <[email protected]>
x86/vdso: Fix rethunk patching for vdso-image-x32.o too
Vasiliy Kovalev <[email protected]>
VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler()
Florian Westphal <[email protected]>
net: mpls: error out if inner headers are not set
Luiz Augusto von Dentz <[email protected]>
Bluetooth: btintel: Fixe build regression
Dave Airlie <[email protected]>
nouveau: fix devinit paths to only handle display on GSP.
Gwendal Grignou <[email protected]>
platform/x86: intel-vbtn: Update tablet mode switch at end of probe
David McFarland <[email protected]>
platform/x86/intel/hid: Don't wake on 5-button releases
Kees Cook <[email protected]>
randomize_kstack: Improve entropy diffusion
Yunfei Dong <[email protected]>
media: mediatek: vcodec: adding lock to protect encoder context list
Yunfei Dong <[email protected]>
media: mediatek: vcodec: adding lock to protect decoder context list
Nicolas Dufresne <[email protected]>
media: mediatek: vcodec: Fix oops when HEVC init fails
Ard Biesheuvel <[email protected]>
gcc-plugins/stackleak: Avoid .head.text section
Ahmad Rehman <[email protected]>
drm/amdgpu: Init zone device and drm client after mode-1 reset on reload
Tim Crawford <[email protected]>
ALSA: hda/realtek: Add quirks for some Clevo laptops
Roman Smirnov <[email protected]>
fbmon: prevent division by zero in fb_videomode_from_videomode()
Jiawei Fu (iBug) <[email protected]>
drivers/nvme: Add quirks for device 126f:2262
Max Kellermann <[email protected]>
modpost: fix null pointer dereference
Jens Axboe <[email protected]>
io_uring: clear opcode specific data for an early failure
Aleksandr Burakov <[email protected]>
fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2
Roger Pau Monne <[email protected]>
x86/xen: attempt to inflate the memory balloon on PVH
Chancel Liu <[email protected]>
ASoC: soc-core.c: Skip dummy codec when adding platforms
Konrad Dybcio <[email protected]>
thermal/of: Assume polling-delay(-passive) 0 when absent
M Cooley <[email protected]>
ASoC: amd: yc: Fix non-functional mic on ASUS M7600RE
Colin Ian King <[email protected]>
usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined
Marco Felsch <[email protected]>
usb: typec: tcpci: add generic tcpci fallback compatible
Mika Westerberg <[email protected]>
thunderbolt: Keep the domain powered when USB4 port is in redrive mode
Andy Shevchenko <[email protected]>
serial: 8250_of: Drop quirk fot NPCM from 8250_port
Abhishek Pandit-Subedi <[email protected]>
usb: typec: ucsi: Limit read size on v1.2
Michael Grzeschik <[email protected]>
usb: gadget: uvc: mark incomplete frames with UVC_STREAM_ERR
Michael Grzeschik <[email protected]>
usb: gadget: uvc: refactor the check for a valid buffer in the pump worker
Gil Fine <[email protected]>
thunderbolt: Calculate DisplayPort tunnel bandwidth after DPRX capabilities read
Luca Weiss <[email protected]>
usb: typec: ucsi: Add qcm6490-pmic-glink as needing PDOS quirk
Tejun Heo <[email protected]>
kernfs: RCU protect kernfs_nodes and avoid kernfs_idr_lock in kernfs_find_and_get_node_by_id()
Jeffrey Hugo <[email protected]>
bus: mhi: host: Add MHI_PM_SYS_ERR_FAIL state
Petre Rodan <[email protected]>
tools: iio: replace seekdir() in iio_generic_buffer
linke li <[email protected]>
ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment
Matt Scialabba <[email protected]>
Input: xpad - add support for Snakebyte GAMEPADs
Ricardo B. Marliere <[email protected]>
ktest: force $buildonly = 1 for 'make_warnings_file' test type
Jichi Zhang <[email protected]>
ALSA: hda/realtek: Add quirk for Lenovo Yoga 9 14IMH9
Sandipan Das <[email protected]>
perf/x86/amd/lbr: Discard erroneous branch entries
Alban Boyé <[email protected]>
platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet
SungHwan Jung <[email protected]>
platform/x86: acer-wmi: Add predator_v4 module parameter
SungHwan Jung <[email protected]>
platform/x86: acer-wmi: Add support for Acer PH16-71
Gergo Koteles <[email protected]>
Input: allocate keycode for Display refresh rate toggle
Duje Mihanović <[email protected]>
Input: imagis - use FIELD_GET where applicable
Manjunath Patil <[email protected]>
RDMA/cm: add timeout to cm_destroy_id wait
Roman Smirnov <[email protected]>
block: prevent division by zero in blk_rq_stat_sum()
Junhao He <[email protected]>
drivers/perf: hisi: Enable HiSilicon Erratum 162700402 quirk for HIP09
Markuss Broks <[email protected]>
input/touchscreen: imagis: Correct the maximum touch area value
Tom Zanussi <[email protected]>
crypto: iaa - Fix async_disable descriptor leak
Ian Rogers <[email protected]>
libperf evlist: Avoid out-of-bounds access
Daniel Drake <[email protected]>
Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default"
Daniel Drake <[email protected]>
PCI: Disable D3cold on Asus B1400 PCI-NVMe bridge
Dai Ngo <[email protected]>
SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int
Shradha Gupta <[email protected]>
drm: Check output polling initialized before disabling
Srinivasan Shanmugam <[email protected]>
drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()
Dmitry Torokhov <[email protected]>
HID: input: avoid polling stylus battery on Chromebook Pompom
Jarkko Nikula <[email protected]>
i2c: designware: Fix RX FIFO depth define on Wangxun 10Gb NIC
Koby Elbaz <[email protected]>
accel/habanalabs: increase HL_MAX_STR to 64 bytes to avoid warnings
Aric Cyr <[email protected]>
drm/amd/display: Fix nanosec stat overflow
Ye Bin <[email protected]>
ext4: forbid commit inconsistent quota data when errors=remount-ro
Zhang Yi <[email protected]>
ext4: add a hint for block bitmap corrupt state in mb_groups
Cezary Rojewski <[email protected]>
ASoC: Intel: avs: Populate board selection with new I2S entries
Josh Poimboeuf <[email protected]>
x86/vdso: Fix rethunk patching for vdso-image-{32,64}.oTony Lindgren <[email protected]>
drm/panel: simple: Add BOE BP082WX1-100 8.2" panel
Takashi Sakamoto <[email protected]>
ALSA: firewire-lib: handle quirk to calculate payload quadlets as data block counter
Arnd Bergmann <[email protected]>
media: sta2x11: fix irq handler cast
Mike Marshall <[email protected]>
Julia Lawall reported this null pointer dereference, this should fix it.
Paul E. McKenney <[email protected]>
rcu-tasks: Repair RCU Tasks Trace quiescence check
Zqiang <[email protected]>
rcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock()
mosomate <[email protected]>
ASoC: Intel: common: DMI remap for rebranded Intel NUC M15 (LAPRC710) laptops
Brent Lu <[email protected]>
ASoC: Intel: sof_rt5682: dmi quirk cleanup for mtl boards
Alex Henrie <[email protected]>
isofs: handle CDs with bad root inode but good Joliet root directory
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Disable idle reallow as part of command/gpint execution
Justin Tee <[email protected]>
scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
Tetsuo Handa <[email protected]>
sysv: don't call sb_bread() with pointers_lock held
Geert Uytterhoeven <[email protected]>
pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs
Sohaib Nadeem <[email protected]>
drm/amd/display: increased min_dcfclk_mhz and min_fclk_mhz
Eric Chanudet <[email protected]>
scsi: ufs: qcom: Avoid re-init quirk when gears match
Christian König <[email protected]>
drm/ttm: return ENOSPC from ttm_bo_mem_space v3
Cristian Ciocaltea <[email protected]>
ASoC: SOF: amd: Optimize quirk for Valve Galileo
Samuel Dionne-Riel <[email protected]>
drm: panel-orientation-quirks: Add quirk for GPD Win Mini
Kunwu Chan <[email protected]>
Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails
Stanley.Yang <[email protected]>
drm/amdgpu: Skip do PCI error slot reset during RAS recovery
Vignesh Raman <[email protected]>
drm/ci: uprev mesa version: fix kdl commit fetch
Maíra Canal <[email protected]>
drm/vc4: don't check if plane->state->fb == state->fb
Vinicius Peixoto <[email protected]>
Bluetooth: Add new quirk for broken read key length on ATS2851
Takashi Iwai <[email protected]>
Bluetooth: btmtk: Add MODULE_FIRMWARE() for MT7922
Edward Adam Davis <[email protected]>
Bluetooth: btintel: Fix null ptr deref in btintel_read_version
Jakub Kicinski <[email protected]>
netdev: let netlink core handle -EMSGSIZE errors
Eric Dumazet <[email protected]>
net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
Jacob Keller <[email protected]>
ice: use relative VSI index for VFs instead of PF VSI number
David Sterba <[email protected]>
btrfs: send: handle path ref underflow in header iterate_inode_ref()
David Sterba <[email protected]>
btrfs: export: handle invalid inode or root reference in btrfs_get_parent()
David Sterba <[email protected]>
btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
Johannes Berg <[email protected]>
wifi: cfg80211: check A-MSDU format more carefully
Takashi Iwai <[email protected]>
wifi: iwlwifi: Add missing MODULE_FIRMWARE() for *.pnvm
Kees Cook <[email protected]>
overflow: Allow non-type arg to type_max() and type_min()
Viresh Kumar <[email protected]>
cpufreq: Don't unregister cpufreq cooling on CPU hotplug
Jason Gunthorpe <[email protected]>
iommu/arm-smmu-v3: Hold arm_smmu_asid_lock during all of attach_dev
Baochen Qiang <[email protected]>
wifi: ath11k: decrease MHI channel buffer length to 8KB
Rick Edgecombe <[email protected]>
dma-direct: Leak pages on dma_set_decrypted() failure
Serge Semin <[email protected]>
net: pcs: xpcs: Return EINVAL in the internal methods
Samasth Norway Ananda <[email protected]>
tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num()
Kunwu Chan <[email protected]>
pstore/zone: Add a null pointer check to the psz_kmsg_read
Hans de Goede <[email protected]>
ACPI: x86: Add DELL0501 handling to acpi_quirk_skip_serdev_enumeration()
Hans de Goede <[email protected]>
ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of CONFIG_X86_ANDROID_TABLETS
Shayne Chen <[email protected]>
wifi: mt76: mt7996: add locking for accessing mapped registers
Peter Chiu <[email protected]>
wifi: mt76: mt7996: disable AMSDU for non-data frames
Shayne Chen <[email protected]>
wifi: mt76: mt7915: add locking for accessing mapped registers
Hans de Goede <[email protected]>
wifi: brcmfmac: Add DMI nvram filename quirk for ACEPC W5 Pro
Markus Elfring <[email protected]>
firmware: tegra: bpmp: Return directly after a failed kzalloc() in get_filename()
Florian Westphal <[email protected]>
net: skbuff: add overflow debug check to pull/push helpers
Shannon Nelson <[email protected]>
ionic: set adminq irq affinity
Sviatoslav Harasymchuk <[email protected]>
ACPI: resource: Add IRQ override quirk for ASUS ExpertBook B2502FBA
Adam Ford <[email protected]>
pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain
Kunwu Chan <[email protected]>
pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
Bjorn Andersson <[email protected]>
arm64: dts: qcom: qcs6490-rb3gen2: Declare GCC clocks protected
Eric Dumazet <[email protected]>
net: add netdev_lockdep_set_classes() to virtual drivers
Johan Jonker <[email protected]>
arm64: dts: rockchip: fix rk3399 hdmi ports node
Johan Jonker <[email protected]>
arm64: dts: rockchip: fix rk3328 hdmi ports node
Johan Jonker <[email protected]>
ARM: dts: rockchip: fix rk322x hdmi ports node
Johan Jonker <[email protected]>
ARM: dts: rockchip: fix rk3288 hdmi ports node
C Cheng <[email protected]>
cpuidle: Avoid potential overflow in integer multiplication
Mukesh Sisodiya <[email protected]>
wifi: iwlwifi: pcie: Add new PCI device id and CNVI
John Ogness <[email protected]>
dump_stack: Do not get cpu_sync for panic CPU
John Ogness <[email protected]>
panic: Flush kernel log buffer at the end
John Ogness <[email protected]>
printk: For @suppress_panic_printk check for other CPU in panic
Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: qrb2210-rb1: disable cluster power domains
Vladimir Oltean <[email protected]>
net: dsa: qca8k: put MDIO controller OF node if unavailable
Hui Liu <[email protected]>
arm64: dts: qcom: qcm6490-idp: Add definition for three LEDs
Mukesh Sisodiya <[email protected]>
wifi: iwlwifi: pcie: Add the PCI device id for new hardware
Harshit Mogalapalli <[email protected]>
VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
Ping-Ke Shih <[email protected]>
wifi: rtw89: pci: enlarge RX DMA buffer to consider size of RX descriptor
Ping-Ke Shih <[email protected]>
wifi: rtw89: pci: validate RX tag for RXQ and RPQ
Andre Werner <[email protected]>
net: phy: phy_device: Prevent nullptr exceptions on ISR
Cristian Ciocaltea <[email protected]>
net: stmmac: dwmac-starfive: Add support for JH7100 SoC
Markus Elfring <[email protected]>
batman-adv: Improve exception handling in batadv_throw_uevent()
Markus Elfring <[email protected]>
batman-adv: Return directly after a failed batadv_dat_select_candidates() in batadv_dat_forward_data()
Kees Cook <[email protected]>
bnx2x: Fix firmware version string character counts
Po-Hao Huang <[email protected]>
wifi: rtw89: fix null pointer access when abort scan
Dmitry Antipov <[email protected]>
wifi: ath9k: fix LNA selection in ath_ant_try_scan()
-------------
Diffstat:
Makefile | 4 +- arch/arm/boot/dts/rockchip/rk322x.dtsi | 16 ++-- arch/arm/boot/dts/rockchip/rk3288.dtsi | 16 +++- arch/arm64/boot/dts/qcom/qcm6490-idp.dts | 28 +++++++ arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts | 17 +++++ arch/arm64/boot/dts/qcom/qrb2210-rb1.dts | 18 +++++ arch/arm64/boot/dts/rockchip/rk3328.dtsi | 11 ++- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 12 ++- arch/x86/entry/vdso/Makefile | 10 ++- arch/x86/events/amd/lbr.c | 6 +- arch/x86/include/asm/xen/hypervisor.h | 5 ++ arch/x86/pci/fixup.c | 48 ++++++++++++ arch/x86/platform/pvh/enlighten.c | 3 + arch/x86/xen/enlighten.c | 32 ++++++++ arch/x86/xen/enlighten_pvh.c | 68 +++++++++++++++++ arch/x86/xen/setup.c | 44 ----------- arch/x86/xen/xen-ops.h | 14 ++++ block/blk-stat.c | 2 +- drivers/accel/habanalabs/common/habanalabs.h | 2 +- drivers/acpi/resource.c | 7 ++ drivers/acpi/sleep.c | 12 --- drivers/acpi/x86/utils.c | 38 +++++++++- drivers/bluetooth/btintel.c | 2 +- drivers/bluetooth/btmtk.c | 1 + drivers/bluetooth/btmtk.h | 1 + drivers/bluetooth/btusb.c | 1 + drivers/bus/mhi/host/init.c | 1 + drivers/bus/mhi/host/internal.h | 9 ++- drivers/bus/mhi/host/pm.c | 20 ++++- drivers/cpufreq/cpufreq.c | 17 +++-- drivers/cpuidle/driver.c | 3 +- drivers/crypto/intel/iaa/iaa_crypto_main.c | 4 +- drivers/firmware/tegra/bpmp-debugfs.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 14 ++++ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 +- drivers/gpu/drm/amd/display/dc/dc.h | 1 + drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 4 +- .../gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 2 +- .../amd/display/dc/resource/dcn35/dcn35_resource.c | 1 + .../gpu/drm/amd/display/modules/inc/mod_stats.h | 4 +- drivers/gpu/drm/ci/gitlab-ci.yml | 14 +++- drivers/gpu/drm/ci/test.yml | 1 + drivers/gpu/drm/drm_modeset_helper.c | 19 ++++- drivers/gpu/drm/drm_panel_orientation_quirks.c | 12 +++ drivers/gpu/drm/drm_probe_helper.c | 13 +++- .../gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c | 12 ++- drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c | 1 + drivers/gpu/drm/panel/panel-simple.c | 20 +++++ drivers/gpu/drm/ttm/ttm_bo.c | 7 +- drivers/gpu/drm/vc4/vc4_plane.c | 5 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-input.c | 2 + drivers/i2c/busses/i2c-designware-core.h | 2 +- drivers/infiniband/core/cm.c | 20 ++++- drivers/input/joystick/xpad.c | 3 + drivers/input/rmi4/rmi_driver.c | 6 +- drivers/input/touchscreen/imagis.c | 20 ++--- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 22 +++--- drivers/media/pci/sta2x11/sta2x11_vip.c | 9 +-- .../mediatek/vcodec/common/mtk_vcodec_fw_vpu.c | 8 +- .../mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c | 5 ++ .../mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h | 2 + .../vcodec/decoder/vdec/vdec_hevc_req_multi_if.c | 2 +- .../platform/mediatek/vcodec/decoder/vdec_vpu_if.c | 2 + .../mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c | 5 ++ .../mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h | 2 + .../platform/mediatek/vcodec/encoder/venc_vpu_if.c | 2 + drivers/misc/vmw_vmci/vmci_datagram.c | 6 +- drivers/net/dsa/qca/qca8k-8xxx.c | 3 +- drivers/net/dummy.c | 1 + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 9 ++- .../net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c | 14 ++-- drivers/net/ethernet/intel/ice/ice_virtchnl.c | 9 +-- drivers/net/ethernet/intel/ice/ice_virtchnl.h | 9 +++ drivers/net/ethernet/pensando/ionic/ionic_lif.c | 5 +- drivers/net/ethernet/stmicro/stmmac/Kconfig | 6 +- .../net/ethernet/stmicro/stmmac/dwmac-starfive.c | 32 +++++++- drivers/net/geneve.c | 1 + drivers/net/loopback.c | 1 + drivers/net/pcs/pcs-xpcs.c | 4 +- drivers/net/phy/phy_device.c | 13 ++-- drivers/net/veth.c | 1 + drivers/net/vxlan/vxlan_core.c | 1 + drivers/net/wireless/ath/ath11k/mhi.c | 2 +- drivers/net/wireless/ath/ath9k/antenna.c | 2 +- .../net/wireless/broadcom/brcm80211/brcmfmac/dmi.c | 9 +++ drivers/net/wireless/intel/iwlwifi/cfg/ax210.c | 6 ++ drivers/net/wireless/intel/iwlwifi/cfg/bz.c | 2 + drivers/net/wireless/intel/iwlwifi/cfg/sc.c | 38 +++++++++- drivers/net/wireless/intel/iwlwifi/iwl-config.h | 8 +- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 16 +++- drivers/net/wireless/mediatek/mt76/mt7915/mmio.c | 45 ++++++++++-- drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h | 1 + drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 5 +- drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 64 ++++++++++------ drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 3 +- drivers/net/wireless/realtek/rtw89/mac80211.c | 4 +- drivers/net/wireless/realtek/rtw89/pci.c | 60 +++++++++++++-- drivers/net/wireless/realtek/rtw89/pci.h | 6 +- drivers/net/wireless/realtek/rtw89/rtw8851be.c | 2 + drivers/net/wireless/realtek/rtw89/rtw8852ae.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8852be.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8852ce.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8922ae.c | 1 + drivers/nvme/host/pci.c | 3 + drivers/perf/hisilicon/hisi_uncore_uc_pmu.c | 42 ++++++++++- drivers/pinctrl/renesas/core.c | 4 +- drivers/platform/x86/acer-wmi.c | 17 ++++- drivers/platform/x86/intel/hid.c | 7 +- drivers/platform/x86/intel/vbtn.c | 5 +- drivers/platform/x86/touchscreen_dmi.c | 9 +++ drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 10 +-- drivers/pmdomain/ti/omap_prm.c | 2 + drivers/scsi/lpfc/lpfc_nportdisc.c | 6 +- drivers/soundwire/dmi-quirks.c | 8 ++ drivers/thermal/thermal_of.c | 12 ++- drivers/thunderbolt/quirks.c | 14 ++++ drivers/thunderbolt/tb.c | 49 ++++++++++++- drivers/thunderbolt/tb.h | 4 + drivers/thunderbolt/tunnel.c | 16 ++-- drivers/tty/serial/8250/8250_of.c | 44 ++++++++++- drivers/tty/serial/8250/8250_port.c | 24 ------ drivers/ufs/host/ufs-qcom.c | 13 +++- drivers/usb/gadget/function/uvc_video.c | 10 ++- drivers/usb/host/sl811-hcd.c | 2 + drivers/usb/typec/tcpm/tcpci.c | 1 + drivers/usb/typec/ucsi/ucsi.c | 26 ++++++- drivers/usb/typec/ucsi/ucsi.h | 11 +++ drivers/usb/typec/ucsi/ucsi_glink.c | 1 + drivers/video/fbdev/core/fbmon.c | 7 +- drivers/video/fbdev/via/accel.c | 4 +- drivers/xen/balloon.c | 2 - fs/btrfs/export.c | 9 ++- fs/btrfs/send.c | 10 ++- fs/btrfs/volumes.c | 12 ++- fs/ext4/mballoc.c | 5 +- fs/ext4/super.c | 12 +++ fs/isofs/inode.c | 18 ++++- fs/kernfs/dir.c | 31 +++++--- fs/kernfs/kernfs-internal.h | 2 + fs/orangefs/super.c | 2 +- fs/pstore/zone.c | 2 + fs/sysv/itree.c | 10 +-- include/acpi/acpi_bus.h | 22 +++--- include/linux/kernfs.h | 2 + include/linux/overflow.h | 12 +-- include/linux/printk.h | 2 + include/linux/randomize_kstack.h | 2 +- include/linux/rcupdate.h | 4 +- include/linux/skbuff.h | 11 +++ include/linux/sunrpc/sched.h | 2 +- include/net/bluetooth/hci.h | 8 ++ include/uapi/linux/input-event-codes.h | 1 + io_uring/io_uring.c | 25 ++++--- kernel/dma/direct.c | 9 ++- kernel/panic.c | 8 ++ kernel/printk/internal.h | 1 - kernel/printk/printk.c | 3 +- kernel/rcu/tree_nocb.h | 2 +- kernel/trace/ring_buffer.c | 2 +- lib/dump_stack.c | 16 +++- net/batman-adv/distributed-arp-table.c | 3 +- net/batman-adv/main.c | 14 ++-- net/bluetooth/hci_event.c | 3 +- net/core/netdev-genl.c | 15 +--- net/core/page_pool_user.c | 2 - net/ipv4/ip_tunnel.c | 1 + net/ipv6/ip6_gre.c | 2 + net/ipv6/ip6_tunnel.c | 1 + net/ipv6/ip6_vti.c | 1 + net/ipv6/sit.c | 1 + net/mpls/mpls_gso.c | 3 + net/smc/smc_pnet.c | 10 +++ net/wireless/util.c | 14 +++- scripts/gcc-plugins/stackleak_plugin.c | 2 + scripts/mod/modpost.c | 4 +- sound/firewire/amdtp-stream.c | 12 ++- sound/firewire/amdtp-stream.h | 4 + sound/pci/hda/patch_realtek.c | 12 +++ sound/soc/amd/yc/acp6x-mach.c | 7 ++ sound/soc/intel/avs/board_selection.c | 85 ++++++++++++++++++++++ sound/soc/intel/boards/sof_rt5682.c | 40 ---------- sound/soc/intel/boards/sof_sdw.c | 11 +++ sound/soc/soc-core.c | 3 + sound/soc/sof/amd/acp.c | 3 +- tools/iio/iio_utils.c | 2 +- tools/lib/perf/evlist.c | 18 +++-- tools/lib/perf/include/internal/evlist.h | 4 +- .../x86_energy_perf_policy.c | 1 + tools/testing/ktest/ktest.pl | 1 + 192 files changed, 1536 insertions(+), 459 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/143 wifi: ath9k: fix LNA selection in ath_ant_try_scan()
6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit d6b27eb997ef9a2aa51633b3111bc4a04748e6d3 ]
In 'ath_ant_try_scan()', (most likely) the 2nd LNA's signal strength should be used in comparison against RSSI when selecting first LNA as the main one. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/ath/ath9k/antenna.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/antenna.c +1 -1
@@ -643,7 +643,7 @@ static void ath_ant_try_scan(struct ath_ant_comb *antcomb, conf->main_lna_conf =ATH_ANT_DIV_COMB_LNA1 ; conf->alt_lna_conf =ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2 ; }else if (antcomb->rssi_sub > - antcomb->rssi_lna1) { + antcomb->rssi_lna2) {/* set to A-B */ conf->main_lna_conf =ATH_ANT_DIV_COMB_LNA1 ; conf->alt_lna_conf =ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/143 wifi: rtw89: fix null pointer access when abort scan
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Po-Hao Huang <[email protected]>
[ Upstream commit 7e11a2966f51695c0af0b1f976a32d64dee243b2 ]
During cancel scan we might use vif that weren't scanning. Fix this by using the actual scanning vif.
--- drivers/net/wireless/realtek/rtw89/mac80211.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/realtek/rtw89/mac80211.c +2 -2
@@ -441,7 +441,7 @@ static void rtw89_ops_bss_info_changed(struct ieee80211_hw *hw,* when disconnected by peer */ if (rtwdev->scanning) -rtw89_hw_scan_abort (rtwdev, vif); +rtw89_hw_scan_abort (rtwdev, rtwdev->scan_info.scanning_vif); } }
@@ -990,7 +990,7 @@ static int rtw89_ops_remain_on_channel(struct ieee80211_hw *hw, }if (rtwdev->scanning) -rtw89_hw_scan_abort (rtwdev, vif); +rtw89_hw_scan_abort (rtwdev, rtwdev->scan_info.scanning_vif);if (type ==IEEE80211_ROC_TYPE_MGMT_TX ) roc->state =RTW89_ROC_MGMT ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/143 bnx2x: Fix firmware version string character counts
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 5642c82b9463c3263c086efb002516244bd4c668 ]
A potential string truncation was reported in bnx2x_fill_fw_str(), when a long bp->fw_ver and a long phy_fw_ver might coexist, but seems unlikely with real-world hardware.
Use scnprintf() to indicate the intent that truncations are tolerated.
While reading this code, I found a collection of various buffer size counting issues. None looked like they might lead to a buffer overflow with current code (the small buffers are 20 bytes and might only ever consume 10 bytes twice with a trailing %NUL). However, early truncation (due to a %NUL in the middle of the string) might be happening under likely rare conditions. Regardless fix the formatters and related functions:
- Switch from a separate strscpy() to just adding an additional "%s" to the format string that immediately follows it in bnx2x_fill_fw_str().
- Use sizeof() universally instead of using unbound defines.
- Fix bnx2x_7101_format_ver() and bnx2x_null_format_ver() to report the number of characters written, not including the trailing %NUL (as already done with the other firmware formatting functions).
- Require space for at least 1 byte in bnx2x_get_ext_phy_fw_version() for the trailing %NUL.
- Correct the needed buffer size in bnx2x_3_seq_format_ver().
--- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 9 +++++---- .../net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c | 14 +++++++------- 3 files changed, 13 insertions(+), 12 deletions(-)
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +5 -4
@@ -147,10 +147,11 @@ void bnx2x_fill_fw_str(struct bnx2x *bp, char *buf, size_t buf_len) phy_fw_ver[0 ] ='\0' ;bnx2x_get_ext_phy_fw_version (&bp->link_params, - phy_fw_ver,PHY_FW_VER_LEN ); -strscpy (buf, bp->fw_ver, buf_len); - snprintf(buf + strlen(bp->fw_ver), 32 - strlen(bp->fw_ver), - "bc %d.%d.%d%s%s", + phy_fw_ver,sizeof (phy_fw_ver)); +/* This may become truncated. */ + scnprintf(buf, buf_len, + "%sbc %d.%d.%d%s%s", + bp->fw_ver, (bp->common.bc_ver & 0xff0000) >> 16, (bp->common.bc_ver & 0xff00) >> 8, (bp->common.bc_ver & 0xff),
drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c +1 -1
@@ -1132,7 +1132,7 @@ static void bnx2x_get_drvinfo(struct net_device *dev, }memset (version,0 ,sizeof (version)); -bnx2x_fill_fw_str (bp, version,ETHTOOL_FWVERS_LEN ); +bnx2x_fill_fw_str (bp, version,sizeof (version));strlcat (info->fw_version, version,sizeof (info->fw_version));strscpy (info->bus_info,pci_name (bp->pdev),sizeof (info->bus_info));
drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c +7 -7
@@ -6163,8 +6163,8 @@ static void bnx2x_link_int_ack(struct link_params *params,static int bnx2x_null_format_ver (u32 spirom_ver,u8 *str,u16 *len) { - str[0 ] ='\0' ; - (*len)--; +if (*len) + str[0 ] ='\0' ;return 0 ; }
@@ -6173,7 +6173,7 @@ static int bnx2x_format_ver(u32 num, u8 *str, u16 *len)u16 ret;if (*len <10 ) { -/* Need more than 10chars for this format */ +/* Need more than 10 chars for this format */ bnx2x_null_format_ver (num, str, len);return -EINVAL ; }
@@ -6188,8 +6188,8 @@ static int bnx2x_3_seq_format_ver(u32 num, u8 *str, u16 *len) {u16 ret; -if (*len <10 ) { -/* Need more than 10chars for this format */ +if (*len <9 ) { +/* Need more than 9 chars for this format */ bnx2x_null_format_ver (num, str, len);return -EINVAL ; }
@@ -6208,7 +6208,7 @@ int bnx2x_get_ext_phy_fw_version(struct link_params *params, u8 *version,int status =0 ;u8 *ver_p = version;u16 remain_len = len; -if (version ==NULL || params ==NULL ) +if (version ==NULL || params ==NULL || len ==0 )return -EINVAL ; bp = params->bp;
@@ -11546,7 +11546,7 @@ static int bnx2x_7101_format_ver(u32 spirom_ver, u8 *str, u16 *len) str[2 ] = (spirom_ver &0xFF0000 ) >>16 ; str[3 ] = (spirom_ver &0xFF000000 ) >>24 ; str[4 ] ='\0' ; - *len -=5 ; + *len -=4 ;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/143 batman-adv: Return directly after a failed batadv_dat_select_candidates() in batadv_dat_forward_data()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Elfring <[email protected]>
[ Upstream commit ffc15626c861f811f9778914be004fcf43810a91 ]
The kfree() function was called in one case by
the batadv_dat_forward_data() function during error handling even if the passed variable contained a null pointer. This issue was detected by using the Coccinelle software.
* Thus return directly after a batadv_dat_select_candidates() call failed at the beginning.
* Delete the label “out” which became unnecessary with this refactoring.
--- net/batman-adv/distributed-arp-table.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/batman-adv/distributed-arp-table.c +1 -2
@@ -684,7 +684,7 @@ static bool batadv_dat_forward_data(struct batadv_priv *bat_priv, cand =batadv_dat_select_candidates (bat_priv, ip, vid);if (!cand) - goto out; +return ret;batadv_dbg (BATADV_DBG_DAT , bat_priv,"DHT_SEND for %pI4\n" , &ip);
@@ -728,7 +728,6 @@ static bool batadv_dat_forward_data(struct batadv_priv *bat_priv,batadv_orig_node_put (cand[i].orig_node); } -out:kfree (cand);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/143 batman-adv: Improve exception handling in batadv_throw_uevent()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Elfring <[email protected]>
[ Upstream commit 5593e9abf1cf2bf096366d8c7fd933bc69d561ce ]
The kfree() function was called in up to three cases by the batadv_throw_uevent() function during error handling even if the passed variable contained a null pointer. This issue was detected by using the Coccinelle software.
* Thus adjust jump targets.
* Reorder kfree() calls at the end.
--- net/batman-adv/main.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
net/batman-adv/main.c +8 -6
@@ -691,29 +691,31 @@ int batadv_throw_uevent(struct batadv_priv *bat_priv, enum batadv_uev_type type,"%s%s" ,BATADV_UEV_TYPE_VAR , batadv_uev_type_str[type]);if (!uevent_env[0 ]) - goto out; + goto report_error; uevent_env[1 ] =kasprintf (GFP_ATOMIC ,"%s%s" ,BATADV_UEV_ACTION_VAR , batadv_uev_action_str[action]);if (!uevent_env[1 ]) - goto out; + goto free_first_env;/* If the event is DEL, ignore the data field */ if (action !=BATADV_UEV_DEL ) { uevent_env[2 ] =kasprintf (GFP_ATOMIC ,"%s%s" ,BATADV_UEV_DATA_VAR , data);if (!uevent_env[2 ]) - goto out; + goto free_second_env; } ret =kobject_uevent_env (bat_kobj,KOBJ_CHANGE , uevent_env); -out: -kfree (uevent_env[0 ]); -kfree (uevent_env[1 ]);kfree (uevent_env[2 ]); +free_second_env: +kfree (uevent_env[1 ]); +free_first_env: +kfree (uevent_env[0 ]);if (ret) +report_error: batadv_dbg(BATADV_DBG_BATMAN, bat_priv, "Impossible to send uevent for (%s,%s,%s) event (err: %d)\n", batadv_uev_type_str[type],
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/143 net: stmmac: dwmac-starfive: Add support for JH7100 SoC
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit 8d4597b871210429bda0f5c3a8816b7d9b6daf7e ]
Add a missing quirk to enable support for the StarFive JH7100 SoC.
Additionally, for greater flexibility in operation, allow using the rgmii-rxid and rgmii-txid phy modes.
--- drivers/net/ethernet/stmicro/stmmac/Kconfig | 6 ++-- .../ethernet/stmicro/stmmac/dwmac-starfive.c | 32 ++++++++++++++++--- 2 files changed, 31 insertions(+), 7 deletions(-)
drivers/net/ethernet/stmicro/stmmac/Kconfig +3 -3
@@ -165,9 +165,9 @@ config DWMAC_STARFIVE help Support for ethernet controllers on StarFive RISC-V SoCs - This selects the StarFive platform specific glue layer support for - the stmmac device driver. This driver is used for StarFive JH7110 - ethernet controller. + This selects the StarFive platform specific glue layer support + for the stmmac device driver. This driver is used for the + StarFive JH7100 and JH7110 ethernet controllers. config DWMAC_STI tristate "STi GMAC support"
drivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c +28 -4
@@ -15,13 +15,20 @@#include "stmmac_platform.h" -#define STARFIVE_DWMAC_PHY_INFT_RGMII 0x1 -#define STARFIVE_DWMAC_PHY_INFT_RMII 0x4 -#define STARFIVE_DWMAC_PHY_INFT_FIELD 0x7U +#define STARFIVE_DWMAC_PHY_INFT_RGMII 0x1 +#define STARFIVE_DWMAC_PHY_INFT_RMII 0x4 +#define STARFIVE_DWMAC_PHY_INFT_FIELD 0x7U + +#define JH7100_SYSMAIN_REGISTER49_DLYCHAIN 0xc8 + +struct starfive_dwmac_data { +unsigned int gtxclk_dlychain; +};struct starfive_dwmac {struct device *dev;struct clk *clk_tx; +const struct starfive_dwmac_data *data; };static void starfive_dwmac_fix_mac_speed (void *priv,unsigned int speed,unsigned int mode)
@@ -67,6 +74,8 @@ static int starfive_dwmac_set_mode(struct plat_stmmacenet_data *plat_dat)case PHY_INTERFACE_MODE_RGMII :case PHY_INTERFACE_MODE_RGMII_ID : +case PHY_INTERFACE_MODE_RGMII_RXID : +case PHY_INTERFACE_MODE_RGMII_TXID : mode =STARFIVE_DWMAC_PHY_INFT_RGMII ;break ;
@@ -89,6 +98,14 @@ static int starfive_dwmac_set_mode(struct plat_stmmacenet_data *plat_dat)if (err)return dev_err_probe (dwmac->dev, err,"error setting phy mode\n" ); +if (dwmac->data) { + err =regmap_write (regmap,JH7100_SYSMAIN_REGISTER49_DLYCHAIN , + dwmac->data->gtxclk_dlychain); +if (err) +return dev_err_probe (dwmac->dev, err, +"error selecting gtxclk delay chain\n" ); + } +return 0 ; }
@@ -114,6 +131,8 @@ static int starfive_dwmac_probe(struct platform_device *pdev)if (!dwmac)return -ENOMEM ; + dwmac->data =device_get_match_data (&pdev->dev); + dwmac->clk_tx =devm_clk_get_enabled (&pdev->dev,"tx" );if (IS_ERR (dwmac->clk_tx)) return dev_err_probe(&pdev->dev, PTR_ERR(dwmac->clk_tx),
@@ -144,8 +163,13 @@ static int starfive_dwmac_probe(struct platform_device *pdev)return stmmac_dvr_probe (&pdev->dev, plat_dat, &stmmac_res); } +static const struct starfive_dwmac_data jh7100_data = { + .gtxclk_dlychain =4 , +}; +static const struct of_device_id starfive_dwmac_match[] = { - { .compatible ="starfive,jh7110-dwmac" }, + { .compatible ="starfive,jh7100-dwmac" , .data = &jh7100_data }, + { .compatible ="starfive,jh7110-dwmac" }, {/* sentinel */ } };MODULE_DEVICE_TABLE (of, starfive_dwmac_match);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/143 net: phy: phy_device: Prevent nullptr exceptions on ISR
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andre Werner <[email protected]>
[ Upstream commit 61c81872815f46006982bb80460c0c80a949b35b ]
If phydev->irq is set unconditionally, check
for valid interrupt handler or fall back to polling mode to prevent nullptr exceptions in interrupt service routine.
--- drivers/net/phy/phy_device.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/net/phy/phy_device.c +8 -5
@@ -1413,6 +1413,11 @@ int phy_sfp_probe(struct phy_device *phydev, }EXPORT_SYMBOL (phy_sfp_probe); +static bool phy_drv_supports_irq (struct phy_driver *phydrv) +{ +return phydrv->config_intr && phydrv->handle_interrupt; +} +/** * phy_attach_direct - attach a network device to a given PHY device pointer * @dev: network device to attach
@@ -1527,6 +1532,9 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,if (phydev->dev_flags &PHY_F_NO_IRQ ) phydev->irq =PHY_POLL ; +if (!phy_drv_supports_irq (phydev->drv) &&phy_interrupt_is_valid (phydev)) + phydev->irq =PHY_POLL ; +/* Port is set to PORT_TP by default and the actual PHY driver will set * it to different value depending on the PHY configuration. If we have * the generic PHY driver we can't figure it out, thus set the old
@@ -2992,11 +3000,6 @@ s32 phy_get_internal_delay(struct phy_device *phydev, struct device *dev, }EXPORT_SYMBOL (phy_get_internal_delay); -static bool phy_drv_supports_irq (struct phy_driver *phydrv) -{ -return phydrv->config_intr && phydrv->handle_interrupt; -} -static int phy_led_set_brightness (struct led_classdev *led_cdev,enum led_brightness value) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/143 wifi: rtw89: pci: validate RX tag for RXQ and RPQ
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <[email protected]>
[ Upstream commit 0bc7d1d4e63cf31ff1b4396b0e2f0e3c76828d26 ]
PCI RX ring is a kind of read/write index ring, and DMA and ring index are asynchronous, so suddenly driver gets newer index ahead before DMA. To resolve this rare situation, we use a RX tag as helpers to make sure DMA is done.
The RX tag is a 13-bit value, and range is from 1 ~ 0x1FFF, but 0 isn't used so should be skipped.
Only enable this validation to coming WiFi 7 chips, because existing chips use different design and don't really meet this situation.
Add missed rx_ring_eq_is_full for 8851BE by the way.
--- drivers/net/wireless/realtek/rtw89/pci.c | 60 +++++++++++++++++-- drivers/net/wireless/realtek/rtw89/pci.h | 4 +- .../net/wireless/realtek/rtw89/rtw8851be.c | 2 + .../net/wireless/realtek/rtw89/rtw8852ae.c | 1 + .../net/wireless/realtek/rtw89/rtw8852be.c | 1 + .../net/wireless/realtek/rtw89/rtw8852ce.c | 1 + .../net/wireless/realtek/rtw89/rtw8922ae.c | 1 + 7 files changed, 63 insertions(+), 7 deletions(-)
drivers/net/wireless/realtek/rtw89/pci.c +54 -6
@@ -155,8 +155,8 @@ static void rtw89_pci_sync_skb_for_device(struct rtw89_dev *rtwdev, DMA_FROM_DEVICE); } -static int rtw89_pci_rxbd_info_update (struct rtw89_dev *rtwdev, -struct sk_buff *skb) +static void rtw89_pci_rxbd_info_update (struct rtw89_dev *rtwdev, +struct sk_buff *skb) {struct rtw89_pci_rxbd_info *rxbd_info;struct rtw89_pci_rx_info *rx_info =RTW89_PCI_RX_SKB_CB (skb);
@@ -166,10 +166,58 @@ static int rtw89_pci_rxbd_info_update(struct rtw89_dev *rtwdev, rx_info->ls =le32_get_bits (rxbd_info->dword,RTW89_PCI_RXBD_LS ); rx_info->len =le32_get_bits (rxbd_info->dword,RTW89_PCI_RXBD_WRITE_SIZE ); rx_info->tag =le32_get_bits (rxbd_info->dword,RTW89_PCI_RXBD_TAG ); +} + +static int rtw89_pci_validate_rx_tag (struct rtw89_dev *rtwdev, +struct rtw89_pci_rx_ring *rx_ring, +struct sk_buff *skb) +{ +struct rtw89_pci_rx_info *rx_info =RTW89_PCI_RX_SKB_CB (skb); +const struct rtw89_pci_info *info = rtwdev->pci_info; +u32 target_rx_tag; + +if (!info->check_rx_tag) +return 0 ; + +/* valid range is 1 ~ 0x1FFF */ +if (rx_ring->target_rx_tag ==0 ) + target_rx_tag =1 ; +else + target_rx_tag = rx_ring->target_rx_tag; + +if (rx_info->tag != target_rx_tag) { +rtw89_debug (rtwdev,RTW89_DBG_UNEXP ,"mismatch RX tag 0x%x 0x%x\n" , + rx_info->tag, target_rx_tag); +return -EAGAIN ; + }return 0 ; } +static +int rtw89_pci_sync_skb_for_device_and_validate_rx_info (struct rtw89_dev *rtwdev, +struct rtw89_pci_rx_ring *rx_ring, +struct sk_buff *skb) +{ +struct rtw89_pci_rx_info *rx_info =RTW89_PCI_RX_SKB_CB (skb); +int rx_tag_retry =100 ; +int ret; + +do { +rtw89_pci_sync_skb_for_cpu (rtwdev, skb); +rtw89_pci_rxbd_info_update (rtwdev, skb); + + ret =rtw89_pci_validate_rx_tag (rtwdev, rx_ring, skb); +if (ret != -EAGAIN ) +break ; + }while (rx_tag_retry--); + +/* update target rx_tag for next RX */ + rx_ring->target_rx_tag = rx_info->tag +1 ; + +return ret; +} +static void rtw89_pci_ctrl_txdma_ch_pcie (struct rtw89_dev *rtwdev,bool enable) {const struct rtw89_pci_info *info = rtwdev->pci_info;
@@ -259,9 +307,8 @@ static u32 rtw89_pci_rxbd_deliver_skbs(struct rtw89_dev *rtwdev, skb_idx =rtw89_pci_get_rx_skb_idx (rtwdev, bd_ring); skb = rx_ring->buf[skb_idx]; -rtw89_pci_sync_skb_for_cpu (rtwdev, skb); - ret =rtw89_pci_rxbd_info_update (rtwdev, skb); + ret =rtw89_pci_sync_skb_for_device_and_validate_rx_info (rtwdev, rx_ring, skb);if (ret) {rtw89_err (rtwdev,"failed to update %d RXBD info: %d\n" , bd_ring->wp, ret);
@@ -549,9 +596,8 @@ static u32 rtw89_pci_release_tx_skbs(struct rtw89_dev *rtwdev, skb_idx =rtw89_pci_get_rx_skb_idx (rtwdev, bd_ring); skb = rx_ring->buf[skb_idx]; -rtw89_pci_sync_skb_for_cpu (rtwdev, skb); - ret =rtw89_pci_rxbd_info_update (rtwdev, skb); + ret =rtw89_pci_sync_skb_for_device_and_validate_rx_info (rtwdev, rx_ring, skb);if (ret) {rtw89_err (rtwdev,"failed to update %d RXBD info: %d\n" , bd_ring->wp, ret);
@@ -1550,6 +1596,7 @@ static void rtw89_pci_reset_trx_rings(struct rtw89_dev *rtwdev) bd_ring->rp =0 ; rx_ring->diliver_skb =NULL ; rx_ring->diliver_desc.ready = false; + rx_ring->target_rx_tag =0 ;rtw89_write16 (rtwdev, addr_num, bd_ring->len);rtw89_write32 (rtwdev, addr_desa_l, bd_ring->dma);
@@ -3148,6 +3195,7 @@ static int rtw89_pci_alloc_rx_ring(struct rtw89_dev *rtwdev, rx_ring->buf_sz = buf_sz; rx_ring->diliver_skb =NULL ; rx_ring->diliver_desc.ready = false; + rx_ring->target_rx_tag =0 ;for (i =0 ; i < len; i++) { skb =dev_alloc_skb (buf_sz);
drivers/net/wireless/realtek/rtw89/pci.h +3 -1
@@ -1234,6 +1234,7 @@ struct rtw89_pci_info {enum mac_ax_pcie_func_ctrl io_rcy_en;enum mac_ax_io_rcy_tmr io_rcy_tmr;bool rx_ring_eq_is_full; +bool check_rx_tag;u32 init_cfg_reg;u32 txhci_en_bit;
@@ -1276,7 +1277,7 @@ struct rtw89_pci_tx_data {struct rtw89_pci_rx_info {dma_addr_t dma; -u32 fs:1 , ls:1 , tag:11 , len:14 ; +u32 fs:1 , ls:1 , tag:13 , len:14 ; };#define RTW89_PCI_TXBD_OPTION_LS BIT(14)
@@ -1405,6 +1406,7 @@ struct rtw89_pci_rx_ring {u32 buf_sz;struct sk_buff *diliver_skb;struct rtw89_rx_desc_info diliver_desc; + u32 target_rx_tag:13; };struct rtw89_pci_isrs {
drivers/net/wireless/realtek/rtw89/rtw8851be.c +2 -0
@@ -25,6 +25,8 @@ static const struct rtw89_pci_info rtw8851b_pci_info = { .autok_en = MAC_AX_PCIE_DISABLE, .io_rcy_en = MAC_AX_PCIE_DISABLE, .io_rcy_tmr = MAC_AX_IO_RCY_ANA_TMR_6MS, + .rx_ring_eq_is_full = false, + .check_rx_tag = false, .init_cfg_reg = R_AX_PCIE_INIT_CFG1, .txhci_en_bit = B_AX_TXHCI_EN,
drivers/net/wireless/realtek/rtw89/rtw8852ae.c +1 -0
@@ -26,6 +26,7 @@ static const struct rtw89_pci_info rtw8852a_pci_info = { .io_rcy_en = MAC_AX_PCIE_DISABLE, .io_rcy_tmr = MAC_AX_IO_RCY_ANA_TMR_6MS, .rx_ring_eq_is_full = false, + .check_rx_tag = false, .init_cfg_reg = R_AX_PCIE_INIT_CFG1, .txhci_en_bit = B_AX_TXHCI_EN,
drivers/net/wireless/realtek/rtw89/rtw8852be.c +1 -0
@@ -26,6 +26,7 @@ static const struct rtw89_pci_info rtw8852b_pci_info = { .io_rcy_en = MAC_AX_PCIE_DISABLE, .io_rcy_tmr = MAC_AX_IO_RCY_ANA_TMR_6MS, .rx_ring_eq_is_full = false, + .check_rx_tag = false, .init_cfg_reg = R_AX_PCIE_INIT_CFG1, .txhci_en_bit = B_AX_TXHCI_EN,
drivers/net/wireless/realtek/rtw89/rtw8852ce.c +1 -0
@@ -35,6 +35,7 @@ static const struct rtw89_pci_info rtw8852c_pci_info = { .io_rcy_en = MAC_AX_PCIE_ENABLE, .io_rcy_tmr = MAC_AX_IO_RCY_ANA_TMR_6MS, .rx_ring_eq_is_full = false, + .check_rx_tag = false, .init_cfg_reg = R_AX_HAXI_INIT_CFG1, .txhci_en_bit = B_AX_TXHCI_EN_V1,
drivers/net/wireless/realtek/rtw89/rtw8922ae.c +1 -0
@@ -26,6 +26,7 @@ static const struct rtw89_pci_info rtw8922a_pci_info = { .io_rcy_en = MAC_AX_PCIE_ENABLE, .io_rcy_tmr = MAC_AX_IO_RCY_ANA_TMR_DEF, .rx_ring_eq_is_full = true, + .check_rx_tag = true, .init_cfg_reg = R_BE_HAXI_INIT_CFG1, .txhci_en_bit = B_BE_TXDMA_EN,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/143 wifi: rtw89: pci: enlarge RX DMA buffer to consider size of RX descriptor
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <[email protected]>
[ Upstream commit c108b4a50dd7650941d4f4ec5c161655a73711db ]
Hardware puts RX descriptor and packet in RX DMA buffer, so it could be over one buffer size if packet size is 11454, and then it will be split into two segments. WiFi 7 chips use larger size of RX descriptor, so enlarge DMA buffer size according to RX descriptor to have better performance and simple flow.
--- drivers/net/wireless/realtek/rtw89/pci.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/realtek/rtw89/pci.h +1 -1
@@ -996,7 +996,7 @@#define RTW89_PCI_TXWD_NUM_MAX 512#define RTW89_PCI_TXWD_PAGE_SIZE 128#define RTW89_PCI_ADDRINFO_MAX 4 -#define RTW89_PCI_RX_BUF_SIZE 11460 +#define RTW89_PCI_RX_BUF_SIZE (11454 + 40)/* +40 for rtw89_rxdesc_long_v2 */ #define RTW89_PCI_POLL_BDRAM_RST_CNT 100#define RTW89_PCI_MULTITAG 8
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/143 VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshit Mogalapalli <[email protected]>
[ Upstream commit 19b070fefd0d024af3daa7329cbc0d00de5302ec ]
Syzkaller hit 'WARNING in dg_dispatch_as_host' bug.
memcpy: detected field-spanning write (size 56) of single field "&dg_info->msg"
at drivers/misc/vmw_vmci/vmci_datagram.c:237 (size 24) WARNING: CPU: 0 PID: 1555 at drivers/misc/vmw_vmci/vmci_datagram.c:237 dg_dispatch_as_host+0x88e/0xa60 drivers/misc/vmw_vmci/vmci_datagram.c:237
Some code commentry, based on my understanding:
544 #define VMCI_DG_SIZE(_dg) (VMCI_DG_HEADERSIZE + (size_t)(_dg)->payload_size) /// This is 24 + payload_size
memcpy(&dg_info->msg, dg, dg_size); Destination = dg_info->msg ---> this is a 24 byte structure(struct vmci_datagram) Source = dg --> this is a 24 byte structure (struct vmci_datagram) Size = dg_size = 24 + payload_size
{payload_size = 56-24 =32} -- Syzkaller managed to set payload_size to 32.
35 struct delayed_datagram_info {
36 struct datagram_entry *entry; 37 struct work_struct work; 38 bool in_dg_host_queue; 39 /* msg and msg_payload must be together. */ 40 struct vmci_datagram msg; 41 u8 msg_payload[];
42 };
So those extra bytes of payload are copied into msg_payload[], a run time warning is seen while fuzzing with Syzkaller.
One possible way to fix the warning is to split the memcpy() into two parts -- one -- direct assignment of msg and second taking care of payload.
Gustavo quoted:
"Under FORTIFY_SOURCE we should not copy data across multiple members in a structure."
--- drivers/misc/vmw_vmci/vmci_datagram.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/misc/vmw_vmci/vmci_datagram.c +2 -1
@@ -234,7 +234,8 @@ static int dg_dispatch_as_host(u32 context_id, struct vmci_datagram *dg) dg_info->in_dg_host_queue = true; dg_info->entry = dst_entry; -memcpy (&dg_info->msg, dg, dg_size); + dg_info->msg = *dg; +memcpy (&dg_info->msg_payload, dg +1 , dg->payload_size);INIT_WORK (&dg_info->work, dg_delayed_dispatch);schedule_work (&dg_info->work);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/143 wifi: iwlwifi: pcie: Add the PCI device id for new hardware
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukesh Sisodiya <[email protected]>
[ Upstream commit 6770eee75148ba10c0c051885379714773e00b48 ]
Add the support for a new PCI device id.
--- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/intel/iwlwifi/pcie/drv.c +1 -0
@@ -502,6 +502,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {/* Bz devices */ {IWL_PCI_DEVICE(0x2727, PCI_ANY_ID, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0x272D, PCI_ANY_ID, iwl_bz_trans_cfg)}, {IWL_PCI_DEVICE(0x272b, PCI_ANY_ID, iwl_bz_trans_cfg)}, {IWL_PCI_DEVICE(0xA840, PCI_ANY_ID, iwl_bz_trans_cfg)}, {IWL_PCI_DEVICE(0x7740, PCI_ANY_ID, iwl_bz_trans_cfg)},
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/143 arm64: dts: qcom: qcm6490-idp: Add definition for three LEDs
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Liu <[email protected]>
[ Upstream commit 8385383cc2c2f7039ecc57864043112cdc7026c7 ]
Add definition for three LEDs to make sure they can be enabled base on QCOM LPG LED driver.
--- arch/arm64/boot/dts/qcom/qcm6490-idp.dts | 28 ++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
arch/arm64/boot/dts/qcom/qcm6490-idp.dts +28 -0
@@ -5,6 +5,7 @@ /dts-v1/; +#include <dt-bindings/leds/common.h> #include <dt-bindings/regulator/qcom,rpmh-regulator.h> #include "sc7280.dtsi" #include "pm7325.dtsi"
@@ -415,6 +416,33 @@ vreg_bob_3p296: bob { }; }; +&pm8350c_pwm { + status = "okay"; + + multi-led { + color = <LED_COLOR_ID_RGB>; + function = LED_FUNCTION_STATUS; + + #address-cells = <1>; + #size-cells = <0>; + + led@1 { + reg = <1>; + color = <LED_COLOR_ID_RED>; + }; + + led@2 { + reg = <2>; + color = <LED_COLOR_ID_GREEN>; + }; + + led@3 { + reg = <3>; + color = <LED_COLOR_ID_BLUE>; + }; + }; +}; + &qupv3_id_0 { status = "okay"; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/143 net: dsa: qca8k: put MDIO controller OF node if unavailable
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit 08932323ccf7f8c4c85db9cb12a791ed81264f66 ]
It was pointed out during the review [1] of commit e66bf63a7f67 ("net:
dsa: qca8k: skip MDIO bus creation if its OF node has status = "disabled"") that we now leak a reference to the "mdio" OF node if it is disabled.
This is only a concern when using dynamic OF as far as I can tell (like probing on an overlay), since OF nodes are never freed in the regular case. Additionally, I'm unaware of any actual device trees (in production or elsewhere) which have status = "disabled" for the MDIO OF node. So handling this as a simple enhancement.
[1] https://lore.kernel.org/netdev/CAJq09z4--Ug+3FAmp=EimQ8HTQYOWOuVon-PUMGB5a1N=RPv4g@mail.gmail.com/
--- drivers/net/dsa/qca/qca8k-8xxx.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/dsa/qca/qca8k-8xxx.c +1 -2
@@ -954,7 +954,7 @@ qca8k_mdio_register(struct qca8k_priv *priv) mdio =of_get_child_by_name (dev->of_node,"mdio" );if (mdio && !of_device_is_available (mdio)) - goto out; + goto out_put_node; bus =devm_mdiobus_alloc (dev);if (!bus) {
@@ -988,7 +988,6 @@ qca8k_mdio_register(struct qca8k_priv *priv) out_put_node:of_node_put (mdio); -out:return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/143 arm64: dts: qcom: qrb2210-rb1: disable cluster power domains
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 7f492d48f08207e4ee23edc926b11de9f720aa61 ]
If cluster domain idle state is enabled on the RB1, the board becomes significantly less responsive. Under certain circumstances (if some of the devices are disabled in kernel config) the board can even lock up.
It seems this is caused by the MPM not updating wakeup timer during CPU idle (in the same way the RPMh updates it when cluster idle state is entered).
Disable cluster domain idle for the RB1 board until MPM driver is fixed to cooperate with the CPU idle states.
--- arch/arm64/boot/dts/qcom/qrb2210-rb1.dts | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
arch/arm64/boot/dts/qcom/qrb2210-rb1.dts +18 -0
@@ -177,6 +177,24 @@ vph_pwr: regulator-vph-pwr { }; }; +&CPU_PD0 { + /delete-property/ power-domains; +}; + +&CPU_PD1 { + /delete-property/ power-domains; +}; + +&CPU_PD2 { + /delete-property/ power-domains; +}; + +&CPU_PD3 { + /delete-property/ power-domains; +}; + +/delete-node/ &CLUSTER_PD; + &gpi_dma0 { status = "okay"; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/143 printk: For @suppress_panic_printk check for other CPU in panic
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Ogness <[email protected]>
[ Upstream commit 0ab7cdd00491b532591ef065be706301de7e448f ]
Currently @suppress_panic_printk is checked along with non-matching @panic_cpu and current CPU. This works because @suppress_panic_printk is only set when panic_in_progress() is true.
Rather than relying on the @suppress_panic_printk semantics, use the concise helper function other_cpu_in_progress(). The helper function exists to avoid open coding such tests.
--- kernel/printk/printk.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
kernel/printk/printk.c +1 -2
@@ -2328,8 +2328,7 @@ asmlinkage int vprintk_emit(int facility, int level,if (unlikely (suppress_printk))return 0 ; -if (unlikely (suppress_panic_printk) && -atomic_read (&panic_cpu) !=raw_smp_processor_id ()) +if (unlikely (suppress_panic_printk) &&other_cpu_in_panic ())return 0 ;if (level ==LOGLEVEL_SCHED ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/143 panic: Flush kernel log buffer at the end
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Ogness <[email protected]>
[ Upstream commit d988d9a9b9d180bfd5c1d353b3b176cb90d6861b ]
If the kernel crashes in a context where printk() calls always defer printing (such as in NMI or inside a printk_safe section) then the final panic messages will be deferred to irq_work. But if irq_work is not available, the messages will not get printed unless explicitly flushed. The result is that the final "end Kernel panic" banner does not get printed.
Add one final flush after the last printk() call to make sure the final panic messages make it out as well.
--- kernel/panic.c | 8 ++++++++ 1 file changed, 8 insertions(+)
kernel/panic.c +8 -0
@@ -446,6 +446,14 @@ void panic(const char *fmt, ...)/* Do not scroll important messages printed above */ suppress_printk =1 ; + +/* +* The final messages may not have been printed if in a context that +* defers printing (such as NMI) and irq_work is not available. +* Explicitly flush the kernel log buffer one last time. +*/ +console_flush_on_panic (CONSOLE_FLUSH_PENDING ); +local_irq_enable ();for (i =0 ; ; i +=PANIC_TIMER_STEP ) {touch_softlockup_watchdog ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/143 dump_stack: Do not get cpu_sync for panic CPU
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Ogness <[email protected]>
[ Upstream commit 7412dc6d55eed6b76180e40ac3601412ebde29bd ]
dump_stack() is called in panic(). If for some reason another CPU is holding the printk_cpu_sync and is unable to release it, the panic CPU will be unable to continue and print the stacktrace.
Since non-panic CPUs are not allowed to store new printk messages anyway, there is no need to synchronize the stacktrace output in a panic situation.
For the panic CPU, do not get the printk_cpu_sync because it is not needed and avoids a potential deadlock scenario in panic().
--- include/linux/printk.h | 2 ++ kernel/printk/internal.h | 1 - lib/dump_stack.c | 16 +++++++++++++--- 3 files changed, 15 insertions(+), 4 deletions(-)
include/linux/printk.h +2 -0
@@ -273,6 +273,8 @@ static inline void printk_trigger_flush(void) }#endif +bool this_cpu_in_panic (void ); +#ifdef CONFIG_SMP extern int __printk_cpu_sync_try_get (void );extern void __printk_cpu_sync_wait (void );
kernel/printk/internal.h +0 -1
@@ -130,7 +130,6 @@ struct printk_message { };bool other_cpu_in_panic (void ); -bool this_cpu_in_panic (void );bool printk_get_next_message (struct printk_message *pmsg,u64 seq,bool is_extended,bool may_supress);
lib/dump_stack.c +13 -3
@@ -96,15 +96,25 @@ static void __dump_stack(const char *log_lvl)*/ asmlinkage __visible void dump_stack_lvl(const char *log_lvl) { +bool in_panic =this_cpu_in_panic ();unsigned long flags;/* * Permit this cpu to perform nested stack dumps while serialising -* against other CPUs +* against other CPUs, unless this CPU is in panic. +* +* When in panic, non-panic CPUs are not permitted to store new +* printk messages so there is no need to synchronize the output. +* This avoids potential deadlock in panic() if another CPU is +* holding and unable to release the printk_cpu_sync. */ -printk_cpu_sync_get_irqsave (flags); +if (!in_panic) +printk_cpu_sync_get_irqsave (flags); +__dump_stack (log_lvl); -printk_cpu_sync_put_irqrestore (flags); + +if (!in_panic) +printk_cpu_sync_put_irqrestore (flags); }EXPORT_SYMBOL (dump_stack_lvl);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/143 wifi: iwlwifi: pcie: Add new PCI device id and CNVI
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukesh Sisodiya <[email protected]>
[ Upstream commit 5f4e0994996fa08d57711b5b247a0cb3085ec66a ]
Add the support for a new PCIE device-id 0x272E and a new CNVI type.
--- drivers/net/wireless/intel/iwlwifi/cfg/sc.c | 38 +++++++++++++++++-- .../net/wireless/intel/iwlwifi/iwl-config.h | 8 +++- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 15 +++++++- 3 files changed, 55 insertions(+), 6 deletions(-)
drivers/net/wireless/intel/iwlwifi/cfg/sc.c +34 -4
@@ -1,7 +1,7 @@// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause /* * Copyright (C) 2015-2017 Intel Deutschland GmbH -* Copyright (C) 2018-2023 Intel Corporation +* Copyright (C) 2018-2024 Intel Corporation */ #include <linux/module.h> #include <linux/stringify.h>
@@ -33,6 +33,10 @@#define IWL_SC_A_GF_A_FW_PRE "iwlwifi-sc-a0-gf-a0"#define IWL_SC_A_GF4_A_FW_PRE "iwlwifi-sc-a0-gf4-a0"#define IWL_SC_A_WH_A_FW_PRE "iwlwifi-sc-a0-wh-a0" +#define IWL_SC2_A_FM_C_FW_PRE "iwlwifi-sc2-a0-fm-c0" +#define IWL_SC2_A_WH_A_FW_PRE "iwlwifi-sc2-a0-wh-a0" +#define IWL_SC2F_A_FM_C_FW_PRE "iwlwifi-sc2f-a0-fm-c0" +#define IWL_SC2F_A_WH_A_FW_PRE "iwlwifi-sc2f-a0-wh-a0"#define IWL_SC_A_FM_B_FW_MODULE_FIRMWARE (api) \ IWL_SC_A_FM_B_FW_PRE "-" __stringify(api) ".ucode"
@@ -48,6 +52,14 @@ IWL_SC_A_GF4_A_FW_PRE "-" __stringify(api) ".ucode"#define IWL_SC_A_WH_A_FW_MODULE_FIRMWARE (api) \ IWL_SC_A_WH_A_FW_PRE "-" __stringify(api) ".ucode" +#define IWL_SC2_A_FM_C_FW_MODULE_FIRMWARE (api) \ + IWL_SC2_A_FM_C_FW_PRE "-" __stringify(api) ".ucode" +#define IWL_SC2_A_WH_A_FW_MODULE_FIRMWARE (api) \ + IWL_SC2_A_WH_A_FW_PRE "-" __stringify(api) ".ucode" +#define IWL_SC2F_A_FM_C_FW_MODULE_FIRMWARE (api) \ + IWL_SC2F_A_FM_C_FW_PRE "-" __stringify(api) ".ucode" +#define IWL_SC2F_A_WH_A_FW_MODULE_FIRMWARE (api) \ + IWL_SC2F_A_WH_A_FW_PRE "-" __stringify(api) ".ucode"static const struct iwl_base_params iwl_sc_base_params = { .eeprom_size =OTP_LOW_IMAGE_SIZE_32K ,
@@ -124,6 +136,9 @@ static const struct iwl_base_params iwl_sc_base_params = {#define IWL_DEVICE_SC \ IWL_DEVICE_BZ_COMMON, \ + .uhb_supported = true, \ + .features = IWL_TX_CSUM_NETIF_FLAGS | NETIF_F_RXCSUM, \ + .num_rbds = IWL_NUM_RBDS_SC_EHT, \ .ht_params = &iwl_22000_ht_params/*
@@ -149,10 +164,21 @@ const char iwl_sc_name[] = "Intel(R) TBD Sc device";const struct iwl_cfg iwl_cfg_sc = { .fw_name_mac ="sc" , - .uhb_supported = true,IWL_DEVICE_SC , - .features =IWL_TX_CSUM_NETIF_FLAGS |NETIF_F_RXCSUM , - .num_rbds =IWL_NUM_RBDS_SC_EHT , +}; + +const char iwl_sc2_name[] ="Intel(R) TBD Sc2 device" ; + +const struct iwl_cfg iwl_cfg_sc2 = { + .fw_name_mac ="sc2" , +IWL_DEVICE_SC , +}; + +const char iwl_sc2f_name[] ="Intel(R) TBD Sc2f device" ; + +const struct iwl_cfg iwl_cfg_sc2f = { + .fw_name_mac ="sc2f" , +IWL_DEVICE_SC , };MODULE_FIRMWARE (IWL_SC_A_FM_B_FW_MODULE_FIRMWARE (IWL_SC_UCODE_API_MAX ));
@@ -162,3 +188,7 @@ MODULE_FIRMWARE(IWL_SC_A_HR_B_FW_MODULE_FIRMWARE(IWL_SC_UCODE_API_MAX));MODULE_FIRMWARE (IWL_SC_A_GF_A_FW_MODULE_FIRMWARE (IWL_SC_UCODE_API_MAX ));MODULE_FIRMWARE (IWL_SC_A_GF4_A_FW_MODULE_FIRMWARE (IWL_SC_UCODE_API_MAX ));MODULE_FIRMWARE (IWL_SC_A_WH_A_FW_MODULE_FIRMWARE (IWL_SC_UCODE_API_MAX )); +MODULE_FIRMWARE (IWL_SC2_A_FM_C_FW_MODULE_FIRMWARE (IWL_SC_UCODE_API_MAX )); +MODULE_FIRMWARE (IWL_SC2_A_WH_A_FW_MODULE_FIRMWARE (IWL_SC_UCODE_API_MAX )); +MODULE_FIRMWARE (IWL_SC2F_A_FM_C_FW_MODULE_FIRMWARE (IWL_SC_UCODE_API_MAX )); +MODULE_FIRMWARE (IWL_SC2F_A_WH_A_FW_MODULE_FIRMWARE (IWL_SC_UCODE_API_MAX ));
drivers/net/wireless/intel/iwlwifi/iwl-config.h +7 -1
@@ -2,7 +2,7 @@/* * Copyright (C) 2005-2014, 2018-2021 Intel Corporation * Copyright (C) 2016-2017 Intel Deutschland GmbH -* Copyright (C) 2018-2023 Intel Corporation +* Copyright (C) 2018-2024 Intel Corporation */ #ifndef __IWL_CONFIG_H__#define __IWL_CONFIG_H__
@@ -418,6 +418,8 @@ struct iwl_cfg {#define IWL_CFG_MAC_TYPE_BZ 0x46#define IWL_CFG_MAC_TYPE_GL 0x47#define IWL_CFG_MAC_TYPE_SC 0x48 +#define IWL_CFG_MAC_TYPE_SC2 0x49 +#define IWL_CFG_MAC_TYPE_SC2F 0x4A#define IWL_CFG_RF_TYPE_TH 0x105#define IWL_CFG_RF_TYPE_TH1 0x108
@@ -527,6 +529,8 @@ extern const char iwl_ax231_name[];extern const char iwl_ax411_name[];extern const char iwl_bz_name[];extern const char iwl_sc_name[]; +extern const char iwl_sc2_name[]; +extern const char iwl_sc2f_name[];#if IS_ENABLED (CONFIG_IWLDVM )extern const struct iwl_cfg iwl5300_agn_cfg;extern const struct iwl_cfg iwl5100_agn_cfg;
@@ -632,6 +636,8 @@ extern const struct iwl_cfg iwl_cfg_bz;extern const struct iwl_cfg iwl_cfg_gl;extern const struct iwl_cfg iwl_cfg_sc; +extern const struct iwl_cfg iwl_cfg_sc2; +extern const struct iwl_cfg iwl_cfg_sc2f;#endif /* CONFIG_IWLMVM */ #endif /* __IWL_CONFIG_H__ */
drivers/net/wireless/intel/iwlwifi/pcie/drv.c +14 -1
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause /* -* Copyright (C) 2005-2014, 2018-2023 Intel Corporation +* Copyright (C) 2005-2014, 2018-2024 Intel Corporation * Copyright (C) 2013-2015 Intel Mobile Communications GmbH * Copyright (C) 2016-2017 Intel Deutschland GmbH */
@@ -509,6 +509,9 @@ static const struct pci_device_id iwl_hw_card_ids[] = { /* Sc devices */ {IWL_PCI_DEVICE(0xE440, PCI_ANY_ID, iwl_sc_trans_cfg)}, + {IWL_PCI_DEVICE(0xE340, PCI_ANY_ID, iwl_sc_trans_cfg)}, + {IWL_PCI_DEVICE(0xD340, PCI_ANY_ID, iwl_sc_trans_cfg)}, + {IWL_PCI_DEVICE(0x6E70, PCI_ANY_ID, iwl_sc_trans_cfg)}, #endif /* CONFIG_IWLMVM */ {0}
@@ -1116,6 +1119,16 @@ static const struct iwl_dev_info iwl_dev_info_table[] = { IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY, iwl_cfg_sc, iwl_sc_name), +_IWL_DEV_INFO (IWL_CFG_ANY ,IWL_CFG_ANY , +IWL_CFG_MAC_TYPE_SC2 ,IWL_CFG_ANY , +IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_ANY , +IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_ANY , + iwl_cfg_sc2, iwl_sc2_name), +_IWL_DEV_INFO (IWL_CFG_ANY ,IWL_CFG_ANY , +IWL_CFG_MAC_TYPE_SC2F ,IWL_CFG_ANY , +IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_ANY , +IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_ANY , + iwl_cfg_sc2f, iwl_sc2f_name), #endif /* CONFIG_IWLMVM */ };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/143 cpuidle: Avoid potential overflow in integer multiplication
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: C Cheng <[email protected]>
[ Upstream commit 88390dd788db485912ee7f9a8d3d56fc5265d52f ]
In detail:
In C language, when you perform a multiplication operation, if both operands are of int type, the multiplication operation is performed on the int type, and then the result is converted to the target type. This means that if the product of int type multiplication exceeds the range that int type can represent, an overflow will occur even if you store the result in a variable of int64_t type.
For a multiplication of two int values, it is better to use mul_u32_u32() rather than s->exit_latency_ns = s->exit_latency * NSEC_PER_USEC to avoid potential overflow happenning.
--- drivers/cpuidle/driver.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/cpuidle/driver.c +2 -1
@@ -16,6 +16,7 @@#include <linux/cpumask.h> #include <linux/tick.h> #include <linux/cpu.h> +#include <linux/math64.h> #include "cpuidle.h"
@@ -187,7 +188,7 @@ static void __cpuidle_driver_init(struct cpuidle_driver *drv) s->target_residency =div_u64 (s->target_residency_ns,NSEC_PER_USEC );if (s->exit_latency >0 ) - s->exit_latency_ns = s->exit_latency *NSEC_PER_USEC ; + s->exit_latency_ns =mul_u32_u32 (s->exit_latency,NSEC_PER_USEC );else if (s->exit_latency_ns <0 ) s->exit_latency_ns =0 ;else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/143 ARM: dts: rockchip: fix rk3288 hdmi ports node
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Jonker <[email protected]>
[ Upstream commit 585e4dc07100a6465b3da8d24e46188064c1c925 ]
Fix rk3288 hdmi ports node so that it matches the rockchip,dw-hdmi.yaml binding with some reordering to align with the (new) documentation about property ordering.
--- arch/arm/boot/dts/rockchip/rk3288.dtsi | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
arch/arm/boot/dts/rockchip/rk3288.dtsi +13 -3
@@ -1240,27 +1240,37 @@ hdmi: hdmi@ff980000 { compatible = "rockchip,rk3288-dw-hdmi"; reg = <0x0 0xff980000 0x0 0x20000>; reg-io-width = <4>; - #sound-dai-cells = <0>; - rockchip,grf = <&grf>; interrupts = <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>; clocks = <&cru PCLK_HDMI_CTRL>, <&cru SCLK_HDMI_HDCP>, <&cru SCLK_HDMI_CEC>; clock-names = "iahb", "isfr", "cec"; power-domains = <&power RK3288_PD_VIO>; + rockchip,grf = <&grf>; + #sound-dai-cells = <0>; status = "disabled"; ports { - hdmi_in: port { + #address-cells = <1>; + #size-cells = <0>; + + hdmi_in: port@0 { + reg = <0>; #address-cells = <1>; #size-cells = <0>; + hdmi_in_vopb: endpoint@0 { reg = <0>; remote-endpoint = <&vopb_out_hdmi>; }; + hdmi_in_vopl: endpoint@1 { reg = <1>; remote-endpoint = <&vopl_out_hdmi>; }; }; + + hdmi_out: port@1 { + reg = <1>; + }; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/143 ARM: dts: rockchip: fix rk322x hdmi ports node
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Jonker <[email protected]>
[ Upstream commit 15a5ed03000cf61daf87d14628085cb1bc8ae72c ]
Fix rk322x hdmi ports node so that it matches the
rockchip,dw-hdmi.yaml binding.
--- arch/arm/boot/dts/rockchip/rk322x.dtsi | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
arch/arm/boot/dts/rockchip/rk322x.dtsi +11 -5
@@ -736,14 +736,20 @@ hdmi: hdmi@200a0000 { status = "disabled"; ports { - hdmi_in: port { - #address-cells = <1>; - #size-cells = <0>; - hdmi_in_vop: endpoint@0 { - reg = <0>; + #address-cells = <1>; + #size-cells = <0>; + + hdmi_in: port@0 { + reg = <0>; + + hdmi_in_vop: endpoint { remote-endpoint = <&vop_out_hdmi>; }; }; + + hdmi_out: port@1 { + reg = <1>; + }; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/143 arm64: dts: rockchip: fix rk3328 hdmi ports node
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Jonker <[email protected]>
[ Upstream commit 1d00ba4700d1e0f88ae70d028d2e17e39078fa1c ]
Fix rk3328 hdmi ports node so that it matches the
rockchip,dw-hdmi.yaml binding.
--- arch/arm64/boot/dts/rockchip/rk3328.dtsi | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3328.dtsi +10 -1
@@ -744,11 +744,20 @@ hdmi: hdmi@ff3c0000 { status = "disabled"; ports { - hdmi_in: port { + #address-cells = <1>; + #size-cells = <0>; + + hdmi_in: port@0 { + reg = <0>; + hdmi_in_vop: endpoint { remote-endpoint = <&vop_out_hdmi>; }; }; + + hdmi_out: port@1 { + reg = <1>; + }; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/143 arm64: dts: rockchip: fix rk3399 hdmi ports node
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Jonker <[email protected]>
[ Upstream commit f051b6ace7ffcc48d6d1017191f167c0a85799f6 ]
Fix rk3399 hdmi ports node so that it matches the
rockchip,dw-hdmi.yaml binding.
--- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/rockchip/rk3399.dtsi +10 -2
@@ -1956,6 +1956,7 @@ simple-audio-card,codec { hdmi: hdmi@ff940000 { compatible = "rockchip,rk3399-dw-hdmi"; reg = <0x0 0xff940000 0x0 0x20000>; + reg-io-width = <4>; interrupts = <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH 0>; clocks = <&cru PCLK_HDMI_CTRL>, <&cru SCLK_HDMI_SFR>,
@@ -1964,13 +1965,16 @@ hdmi: hdmi@ff940000 { <&cru PLL_VPLL>; clock-names = "iahb", "isfr", "cec", "grf", "ref"; power-domains = <&power RK3399_PD_HDCP>; - reg-io-width = <4>; rockchip,grf = <&grf>; #sound-dai-cells = <0>; status = "disabled"; ports { - hdmi_in: port { + #address-cells = <1>; + #size-cells = <0>; + + hdmi_in: port@0 { + reg = <0>; #address-cells = <1>; #size-cells = <0>;
@@ -1983,6 +1987,10 @@ hdmi_in_vopl: endpoint@1 { remote-endpoint = <&vopl_out_hdmi>; }; }; + + hdmi_out: port@1 { + reg = <1>; + }; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/143 net: add netdev_lockdep_set_classes() to virtual drivers
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 0bef512012b1cd8820f0c9ec80e5f8ceb43fdd59 ]
Based on a syzbot report, it appears many virtual drivers do not yet use netdev_lockdep_set_classes(), triggerring lockdep false positives.
WARNING: possible recursive locking detected
6.8.0-rc4-next-20240212-syzkaller #0 Not tainted
syz-executor.0/19016 is trying to acquire lock:
ffff8880162cb298 (_xmit_ETHER#2){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff8880162cb298 (_xmit_ETHER#2){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4452 [inline] ffff8880162cb298 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x1c4/0x5f0 net/sched/sch_generic.c:340
but task is already holding lock:
ffff8880223db4d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff8880223db4d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4452 [inline] ffff8880223db4d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x1c4/0x5f0 net/sched/sch_generic.c:340
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
lock(_xmit_ETHER#2);
lock(_xmit_ETHER#2);
*** DEADLOCK ***
May be due to missing lock nesting notation
9 locks held by syz-executor.0/19016:
#0: ffffffff8f385208 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
#0: ffffffff8f385208 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x82c/0x1040 net/core/rtnetlink.c:6603
#1: ffffc90000a08c00 ((&in_dev->mr_ifc_timer)){+.-.}-{0:0}, at: call_timer_fn+0xc0/0x600 kernel/time/timer.c:1697 #2: ffffffff8e131520 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
#2: ffffffff8e131520 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
#2: ffffffff8e131520 (rcu_read_lock){....}-{1:2}, at: ip_finish_output2+0x45f/0x1360 net/ipv4/ip_output.c:228
#3: ffffffff8e131580 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #3: ffffffff8e131580 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:802 [inline]
#3: ffffffff8e131580 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x2c4/0x3b10 net/core/dev.c:4284
#4: ffff8880416e3258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: spin_trylock include/linux/spinlock.h:361 [inline] #4: ffff8880416e3258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: qdisc_run_begin include/net/sch_generic.h:195 [inline] #4: ffff8880416e3258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3771 [inline] #4: ffff8880416e3258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_queue_xmit+0x1262/0x3b10 net/core/dev.c:4325 #5: ffff8880223db4d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#5: ffff8880223db4d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4452 [inline]
#5: ffff8880223db4d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x1c4/0x5f0 net/sched/sch_generic.c:340
#6: ffffffff8e131520 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
#6: ffffffff8e131520 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
#6: ffffffff8e131520 (rcu_read_lock){....}-{1:2}, at: ip_finish_output2+0x45f/0x1360 net/ipv4/ip_output.c:228
#7: ffffffff8e131580 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #7: ffffffff8e131580 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:802 [inline]
#7: ffffffff8e131580 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x2c4/0x3b10 net/core/dev.c:4284
#8: ffff888014d9d258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: spin_trylock include/linux/spinlock.h:361 [inline] #8: ffff888014d9d258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: qdisc_run_begin include/net/sch_generic.h:195 [inline] #8: ffff888014d9d258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3771 [inline] #8: ffff888014d9d258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_queue_xmit+0x1262/0x3b10 net/core/dev.c:4325
stack backtrace: CPU: 1 PID: 19016 Comm: syz-executor.0 Not tainted 6.8.0-rc4-next-20240212-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 check_deadlock kernel/locking/lockdep.c:3062 [inline] validate_chain+0x15c1/0x58e0 kernel/locking/lockdep.c:3856 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __netif_tx_lock include/linux/netdevice.h:4452 [inline] sch_direct_xmit+0x1c4/0x5f0 net/sched/sch_generic.c:340 __dev_xmit_skb net/core/dev.c:3784 [inline] __dev_queue_xmit+0x1912/0x3b10 net/core/dev.c:4325 neigh_output include/net/neighbour.h:542 [inline] ip_finish_output2+0xe66/0x1360 net/ipv4/ip_output.c:235 iptunnel_xmit+0x540/0x9b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x20ee/0x2960 net/ipv4/ip_tunnel.c:831 erspan_xmit+0x9de/0x1460 net/ipv4/ip_gre.c:720 __netdev_start_xmit include/linux/netdevice.h:4989 [inline] netdev_start_xmit include/linux/netdevice.h:5003 [inline] xmit_one net/core/dev.c:3555 [inline] dev_hard_start_xmit+0x242/0x770 net/core/dev.c:3571 sch_direct_xmit+0x2b6/0x5f0 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3784 [inline] __dev_queue_xmit+0x1912/0x3b10 net/core/dev.c:4325 neigh_output include/net/neighbour.h:542 [inline] ip_finish_output2+0xe66/0x1360 net/ipv4/ip_output.c:235 igmpv3_send_cr net/ipv4/igmp.c:723 [inline] igmp_ifc_timer_expire+0xb71/0xd90 net/ipv4/igmp.c:813 call_timer_fn+0x17e/0x600 kernel/time/timer.c:1700 expire_timers kernel/time/timer.c:1751 [inline] __run_timers+0x621/0x830 kernel/time/timer.c:2038 run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2051 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1076 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1076 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:resched_offsets_ok kernel/sched/core.c:10127 [inline] RIP: 0010:__might_resched+0x16f/0x780 kernel/sched/core.c:10142 Code: 00 4c 89 e8 48 c1 e8 03 48 ba 00 00 00 00 00 fc ff df 48 89 44 24 38 0f b6 04 10 84 c0 0f 85 87 04 00 00 41 8b 45 00 c1 e0 08 <01> d8 44 39 e0 0f 85 d6 00 00 00 44 89 64 24 1c 48 8d bc 24 a0 00 RSP: 0018:ffffc9000ee069e0 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8880296a9e00 RDX: dffffc0000000000 RSI: ffff8880296a9e00 RDI: ffffffff8bfe8fa0 RBP: ffffc9000ee06b00 R08: ffffffff82326877 R09: 1ffff11002b5ad1b R10: dffffc0000000000 R11: ffffed1002b5ad1c R12: 0000000000000000 R13: ffff8880296aa23c R14: 000000000000062a R15: 1ffff92001dc0d44 down_write+0x19/0x50 kernel/locking/rwsem.c:1578 kernfs_activate fs/kernfs/dir.c:1403 [inline] kernfs_add_one+0x4af/0x8b0 fs/kernfs/dir.c:819 __kernfs_create_file+0x22e/0x2e0 fs/kernfs/file.c:1056 sysfs_add_file_mode_ns+0x24a/0x310 fs/sysfs/file.c:307 create_files fs/sysfs/group.c:64 [inline] internal_create_group+0x4f4/0xf20 fs/sysfs/group.c:152 internal_create_groups fs/sysfs/group.c:192 [inline] sysfs_create_groups+0x56/0x120 fs/sysfs/group.c:218 create_dir lib/kobject.c:78 [inline] kobject_add_internal+0x472/0x8d0 lib/kobject.c:240 kobject_add_varg lib/kobject.c:374 [inline] kobject_init_and_add+0x124/0x190 lib/kobject.c:457 netdev_queue_add_kobject net/core/net-sysfs.c:1706 [inline] netdev_queue_update_kobjects+0x1f3/0x480 net/core/net-sysfs.c:1758 register_queue_kobjects net/core/net-sysfs.c:1819 [inline] netdev_register_kobject+0x265/0x310 net/core/net-sysfs.c:2059 register_netdevice+0x1191/0x19c0 net/core/dev.c:10298 bond_newlink+0x3b/0x90 drivers/net/bonding/bond_netlink.c:576 rtnl_newlink_create net/core/rtnetlink.c:3506 [inline] __rtnl_newlink net/core/rtnetlink.c:3726 [inline] rtnl_newlink+0x158f/0x20a0 net/core/rtnetlink.c:3739 rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6606 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367 netlink_sendmsg+0xa3c/0xd70 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 __sys_sendto+0x3a4/0x4f0 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2199 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7fc3fa87fa9c
--- drivers/net/dummy.c | 1 + drivers/net/geneve.c | 1 + drivers/net/loopback.c | 1 + drivers/net/veth.c | 1 + drivers/net/vxlan/vxlan_core.c | 1 + net/ipv4/ip_tunnel.c | 1 + net/ipv6/ip6_gre.c | 2 ++ net/ipv6/ip6_tunnel.c | 1 + net/ipv6/ip6_vti.c | 1 + net/ipv6/sit.c | 1 + 10 files changed, 11 insertions(+)
drivers/net/dummy.c +1 -0
@@ -71,6 +71,7 @@ static int dummy_dev_init(struct net_device *dev)if (!dev->lstats)return -ENOMEM ; +netdev_lockdep_set_classes (dev);return 0 ; }
drivers/net/geneve.c +1 -0
@@ -349,6 +349,7 @@ static int geneve_init(struct net_device *dev)gro_cells_destroy (&geneve->gro_cells);return err; } +netdev_lockdep_set_classes (dev);return 0 ; }
drivers/net/loopback.c +1 -0
@@ -144,6 +144,7 @@ static int loopback_dev_init(struct net_device *dev) dev->lstats = netdev_alloc_pcpu_stats(struct pcpu_lstats);if (!dev->lstats)return -ENOMEM ; +netdev_lockdep_set_classes (dev);return 0 ; }
drivers/net/veth.c +1 -0
@@ -1483,6 +1483,7 @@ static void veth_free_queues(struct net_device *dev)static int veth_dev_init (struct net_device *dev) { +netdev_lockdep_set_classes (dev);return veth_alloc_queues (dev); }
drivers/net/vxlan/vxlan_core.c +1 -0
@@ -2855,6 +2855,7 @@ static int vxlan_init(struct net_device *dev)if (err) goto err_gro_cells_destroy; +netdev_lockdep_set_classes (dev);return 0 ; err_gro_cells_destroy:
net/ipv4/ip_tunnel.c +1 -0
@@ -1298,6 +1298,7 @@ int ip_tunnel_init(struct net_device *dev)if (tunnel->collect_md)netif_keep_dst (dev); +netdev_lockdep_set_classes (dev);return 0 ; }EXPORT_SYMBOL_GPL (ip_tunnel_init);
net/ipv6/ip6_gre.c +2 -0
@@ -1514,6 +1514,7 @@ static int ip6gre_tunnel_init_common(struct net_device *dev)ip6gre_tnl_init_features (dev);netdev_hold (dev, &tunnel->dev_tracker,GFP_KERNEL ); +netdev_lockdep_set_classes (dev);return 0 ; cleanup_dst_cache_init:
@@ -1906,6 +1907,7 @@ static int ip6erspan_tap_init(struct net_device *dev)ip6erspan_tnl_link_config (tunnel,1 );netdev_hold (dev, &tunnel->dev_tracker,GFP_KERNEL ); +netdev_lockdep_set_classes (dev);return 0 ; cleanup_dst_cache_init:
net/ipv6/ip6_tunnel.c +1 -0
@@ -1898,6 +1898,7 @@ ip6_tnl_dev_init_gen(struct net_device *dev) dev->max_mtu =IP6_MAX_MTU - dev->hard_header_len;netdev_hold (dev, &t->dev_tracker,GFP_KERNEL ); +netdev_lockdep_set_classes (dev);return 0 ; destroy_dst:
net/ipv6/ip6_vti.c +1 -0
@@ -935,6 +935,7 @@ static inline int vti6_dev_init_gen(struct net_device *dev)if (!dev->tstats)return -ENOMEM ;netdev_hold (dev, &t->dev_tracker,GFP_KERNEL ); +netdev_lockdep_set_classes (dev);return 0 ; }
net/ipv6/sit.c +1 -0
@@ -1460,6 +1460,7 @@ static int ipip6_tunnel_init(struct net_device *dev)return err; }netdev_hold (dev, &tunnel->dev_tracker,GFP_KERNEL ); +netdev_lockdep_set_classes (dev);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/143 arm64: dts: qcom: qcs6490-rb3gen2: Declare GCC clocks protected
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Andersson <[email protected]>
[ Upstream commit 7c6bef576a8891abce08d448165b53328032aa5f ]
The SC7280 GCC binding describes clocks which, due to the difference in security model, are not accessible on the RB3gen2 - in the same way seen on QCM6490.
Mark these clocks as protected, to allow the board to boot. In contrast to the present QCM6490 boards GCC_EDP_CLKREF_EN is left out, as this does not need to be "protected" and is used on the RB3Gen2 board.
--- arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts +17 -0
@@ -413,6 +413,23 @@ vreg_bob_3p296: bob { }; }; +&gcc { + protected-clocks = <GCC_CFG_NOC_LPASS_CLK>, + <GCC_MSS_CFG_AHB_CLK>, + <GCC_MSS_GPLL0_MAIN_DIV_CLK_SRC>, + <GCC_MSS_OFFLINE_AXI_CLK>, + <GCC_MSS_Q6SS_BOOT_CLK_SRC>, + <GCC_MSS_Q6_MEMNOC_AXI_CLK>, + <GCC_MSS_SNOC_AXI_CLK>, + <GCC_QSPI_CNOC_PERIPH_AHB_CLK>, + <GCC_QSPI_CORE_CLK>, + <GCC_QSPI_CORE_CLK_SRC>, + <GCC_SEC_CTRL_CLK_SRC>, + <GCC_WPSS_AHB_BDG_MST_CLK>, + <GCC_WPSS_AHB_CLK>, + <GCC_WPSS_RSCP_CLK>; +}; + &qupv3_id_0 { status = "okay"; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/143 pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit 5d7f58ee08434a33340f75ac7ac5071eea9673b3 ]
devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity.
--- drivers/pmdomain/ti/omap_prm.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pmdomain/ti/omap_prm.c +2 -0
@@ -695,6 +695,8 @@ static int omap_prm_domain_init(struct device *dev, struct omap_prm *prm) data = prm->data; name =devm_kasprintf (dev,GFP_KERNEL ,"prm_%s" , data->name); +if (!name) +return -ENOMEM ; prmd->dev = dev; prmd->prm = prm;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/143 pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Ford <[email protected]>
[ Upstream commit 697624ee8ad557ab5417f985d2c804241a7ad30d ]
According to i.MX8MP RM and HDMI ADD, the fdcc clock is part of hdmi rx verification IP that should not enable for HDMI TX. But actually if the clock is disabled before HDMI/LCDIF probe, LCDIF will not get pixel clock from HDMI PHY and print the error logs:
[CRTC:39:crtc-2] vblank wait timed out
WARNING: CPU: 2 PID: 9 at drivers/gpu/drm/drm_atomic_helper.c:1634 drm_atomic_helper_wait_for_vblanks.part.0+0x23c/0x260
Add fdcc clock to LCDIF and HDMI TX power domains to fix the issue.
--- drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/pmdomain/imx/imx8mp-blk-ctrl.c +5 -5
@@ -55,7 +55,7 @@ struct imx8mp_blk_ctrl_domain_data {const char *gpc_name; }; -#define DOMAIN_MAX_CLKS 2 +#define DOMAIN_MAX_CLKS 3#define DOMAIN_MAX_PATHS 3struct imx8mp_blk_ctrl_domain {
@@ -457,8 +457,8 @@ static const struct imx8mp_blk_ctrl_domain_data imx8mp_hdmi_domain_data[] = { }, [IMX8MP_HDMIBLK_PD_LCDIF] = { .name = "hdmiblk-lcdif", - .clk_names = (const char *[]){ "axi", "apb" }, - .num_clks = 2, + .clk_names = (const char *[]){ "axi", "apb", "fdcc" }, + .num_clks = 3, .gpc_name = "lcdif", .path_names = (const char *[]){"lcdif-hdmi"}, .num_paths = 1,
@@ -483,8 +483,8 @@ static const struct imx8mp_blk_ctrl_domain_data imx8mp_hdmi_domain_data[] = { }, [IMX8MP_HDMIBLK_PD_HDMI_TX] = { .name = "hdmiblk-hdmi-tx", - .clk_names = (const char *[]){ "apb", "ref_266m" }, - .num_clks = 2, + .clk_names = (const char *[]){ "apb", "ref_266m", "fdcc" }, + .num_clks = 3, .gpc_name = "hdmi-tx", }, [IMX8MP_HDMIBLK_PD_HDMI_TX_PHY] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/143 ACPI: resource: Add IRQ override quirk for ASUS ExpertBook B2502FBA
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sviatoslav Harasymchuk <[email protected]>
[ Upstream commit 0793e511c4c66c38dd26add86f7236bcdc70c3b5 ]
In order to fix the keyboard on ASUS ExpertBook B2502FBA, add an IRQ override quirk for it in analogy with how it was done for other members of this machine family.
--- drivers/acpi/resource.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/acpi/resource.c +7 -0
@@ -489,6 +489,13 @@ static const struct dmi_system_id irq1_level_low_skip_override[] = { DMI_MATCH(DMI_BOARD_NAME, "B2502CBA"), }, }, + { +/* Asus ExpertBook B2502FBA */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_BOARD_NAME, "B2502FBA"), + }, + }, {/* Asus Vivobook E1504GA */ .matches = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/143 ionic: set adminq irq affinity
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shannon Nelson <[email protected]>
[ Upstream commit c699f35d658f3c21b69ed24e64b2ea26381e941d ]
We claim to have the AdminQ on our irq0 and thus cpu id 0, but we need to be sure we set the affinity hint to try to keep it there.
--- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/pensando/ionic/ionic_lif.c +4 -1
@@ -3391,9 +3391,12 @@ static int ionic_lif_adminq_init(struct ionic_lif *lif)napi_enable (&qcq->napi); -if (qcq->flags &IONIC_QCQ_F_INTR ) +if (qcq->flags &IONIC_QCQ_F_INTR ) { +irq_set_affinity_hint (qcq->intr.vector, + &qcq->intr.affinity_mask);ionic_intr_mask (idev->intr_ctrl, qcq->intr.index,IONIC_INTR_MASK_CLEAR ); + } qcq->flags |=IONIC_QCQ_F_INITED ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/143 net: skbuff: add overflow debug check to pull/push helpers
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 219eee9c0d16f1b754a8b85275854ab17df0850a ]
syzbot managed to trigger following splat:
BUG: KASAN: use-after-free in __skb_flow_dissect+0x4a3b/0x5e50 Read of size 1 at addr ffff888208a4000e by task a.out/2313 [..] __skb_flow_dissect+0x4a3b/0x5e50 __skb_get_hash+0xb4/0x400 ip_tunnel_xmit+0x77e/0x26f0 ipip_tunnel_xmit+0x298/0x410 ..
Analysis shows that the skb has a valid ->head, but bogus ->data pointer.
skb->data gets its bogus value via the neigh layer, which does:
1556 __skb_pull(skb, skb_network_offset(skb));
... and the skb was already dodgy at this point:
skb_network_offset(skb) returns a negative value due to an earlier overflow of skb->network_header (u16). __skb_pull thus "adjusts" skb->data by a huge offset, pointing outside skb->head area.
Allow debug builds to splat when we try to pull/push more than INT_MAX bytes.
After this, the syzkaller reproducer yields a more precise splat before the flow dissector attempts to read off skb->data memory:
WARNING: CPU: 5 PID: 2313 at include/linux/skbuff.h:2653 neigh_connected_output+0x28e/0x400 ip_finish_output2+0xb25/0xed0 iptunnel_xmit+0x4ff/0x870 ipgre_xmit+0x78e/0xbb0
--- include/linux/skbuff.h | 6 ++++++ 1 file changed, 6 insertions(+)
include/linux/skbuff.h +6 -0
@@ -2637,6 +2637,8 @@ static inline void skb_put_u8(struct sk_buff *skb, u8 val)void *skb_push (struct sk_buff *skb,unsigned int len);static inline void *__skb_push (struct sk_buff *skb,unsigned int len) { +DEBUG_NET_WARN_ON_ONCE (len >INT_MAX ); + skb->data -= len; skb->len += len;return skb->data;
@@ -2645,6 +2647,8 @@ static inline void *__skb_push(struct sk_buff *skb, unsigned int len)void *skb_pull (struct sk_buff *skb,unsigned int len);static inline void *__skb_pull (struct sk_buff *skb,unsigned int len) { +DEBUG_NET_WARN_ON_ONCE (len >INT_MAX ); + skb->len -= len;if (unlikely (skb->len < skb->data_len)) {#if defined(CONFIG_DEBUG_NET )
@@ -2669,6 +2673,8 @@ void *__pskb_pull_tail(struct sk_buff *skb, int delta);static inline enum skb_drop_reason pskb_may_pull_reason (struct sk_buff *skb,unsigned int len) { +DEBUG_NET_WARN_ON_ONCE (len >INT_MAX ); +if (likely (len <=skb_headlen (skb)))return SKB_NOT_DROPPED_YET ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/143 firmware: tegra: bpmp: Return directly after a failed kzalloc() in get_filename()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Elfring <[email protected]>
[ Upstream commit 1315848f1f8a0100cb6f8a7187bc320c5d98947f ]
The kfree() function was called in one case by the get_filename() function during error handling even if the passed variable contained a null pointer. This issue was detected by using the Coccinelle software.
Thus return directly after a call of the function “kzalloc” failed at the beginning.
--- drivers/firmware/tegra/bpmp-debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/tegra/bpmp-debugfs.c +1 -1
@@ -77,7 +77,7 @@ static const char *get_filename(struct tegra_bpmp *bpmp, root_path_buf =kzalloc (root_path_buf_len,GFP_KERNEL );if (!root_path_buf) - goto out; +return NULL ; root_path =dentry_path (bpmp->debugfs_mirror, root_path_buf, root_path_buf_len);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/143 wifi: brcmfmac: Add DMI nvram filename quirk for ACEPC W5 Pro
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 32167707aa5e7ae4b160c18be79d85a7b4fdfcfb ]
The ACEPC W5 Pro HDMI stick contains quite generic names in the sys_vendor and product_name DMI strings, without this patch brcmfmac will try to load:
"brcmfmac43455-sdio.$(DEFAULT_STRING)-$(DEFAULT_STRING).txt" as nvram file which is both too generic and messy with the $ symbols in the name.
The ACEPC W5 Pro uses the same Ampak AP6255 module as the ACEPC T8 and the nvram for the T8 is already in linux-firmware, so point the new DMI nvram filename quirk to the T8 nvram file.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c +9 -0
@@ -82,6 +82,15 @@ static const struct dmi_system_id dmi_platform_data[] = { }, .driver_data = (void *)&acepc_t8_data, }, + { +/* ACEPC W5 Pro Cherry Trail Z8350 HDMI stick, same wifi as the T8 */ + .matches = { +DMI_MATCH (DMI_BOARD_NAME ,"T3 MRD" ), +DMI_MATCH (DMI_CHASSIS_TYPE ,"3" ), + DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."), + }, + .driver_data = (void *)&acepc_t8_data, + }, {/* Chuwi Hi8 Pro with D2D3_Hi8Pro.233 BIOS */ .matches = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/143 wifi: mt76: mt7915: add locking for accessing mapped registers
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shayne Chen <[email protected]>
[ Upstream commit 0937f95ab07af6e663ae932d592f630d9eb591da ]
Sicne the mapping is global, mapped register access needs to be protected against concurrent access, otherwise a race condition might cause the reads or writes to go towards the wrong register
--- .../net/wireless/mediatek/mt76/mt7915/mmio.c | 45 ++++++++++++++++--- .../wireless/mediatek/mt76/mt7915/mt7915.h | 1 + 2 files changed, 41 insertions(+), 5 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/mmio.c +40 -5
@@ -490,6 +490,11 @@ static u32 __mt7915_reg_addr(struct mt7915_dev *dev, u32 addr)return dev->reg.map[i].maps + ofs; } +return 0 ; +} + +static u32 __mt7915_reg_remap_addr (struct mt7915_dev *dev,u32 addr) +{if ((addr >=MT_INFRA_BASE && addr <MT_WFSYS0_PHY_START ) || (addr >=MT_WFSYS0_PHY_START && addr <MT_WFSYS1_PHY_START ) || (addr >=MT_WFSYS1_PHY_START && addr <=MT_WFSYS1_PHY_END ))
@@ -514,15 +519,30 @@ void mt7915_memcpy_fromio(struct mt7915_dev *dev, void *buf, u32 offset, {u32 addr =__mt7915_reg_addr (dev, offset); -memcpy_fromio (buf, dev->mt76.mmio.regs + addr, len); +if (addr) { +memcpy_fromio (buf, dev->mt76.mmio.regs + addr, len); +return ; + } + +spin_lock_bh (&dev->reg_lock); +memcpy_fromio (buf, dev->mt76.mmio.regs + +__mt7915_reg_remap_addr (dev, offset), len); +spin_unlock_bh (&dev->reg_lock); }static u32 mt7915_rr (struct mt76_dev *mdev,u32 offset) { struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76); -u32 addr =__mt7915_reg_addr (dev, offset); +u32 addr =__mt7915_reg_addr (dev, offset), val; -return dev->bus_ops->rr (mdev, addr); +if (addr) +return dev->bus_ops->rr (mdev, addr); + +spin_lock_bh (&dev->reg_lock); + val = dev->bus_ops->rr (mdev,__mt7915_reg_remap_addr (dev, offset)); +spin_unlock_bh (&dev->reg_lock); + +return val; }static void mt7915_wr (struct mt76_dev *mdev,u32 offset,u32 val)
@@ -530,7 +550,14 @@ static void mt7915_wr(struct mt76_dev *mdev, u32 offset, u32 val) struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);u32 addr =__mt7915_reg_addr (dev, offset); - dev->bus_ops->wr (mdev, addr, val); +if (addr) { + dev->bus_ops->wr (mdev, addr, val); +return ; + } + +spin_lock_bh (&dev->reg_lock); + dev->bus_ops->wr (mdev,__mt7915_reg_remap_addr (dev, offset), val); +spin_unlock_bh (&dev->reg_lock); }static u32 mt7915_rmw (struct mt76_dev *mdev,u32 offset,u32 mask,u32 val)
@@ -538,7 +565,14 @@ static u32 mt7915_rmw(struct mt76_dev *mdev, u32 offset, u32 mask, u32 val) struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);u32 addr =__mt7915_reg_addr (dev, offset); -return dev->bus_ops->rmw (mdev, addr, mask, val); +if (addr) +return dev->bus_ops->rmw (mdev, addr, mask, val); + +spin_lock_bh (&dev->reg_lock); + val = dev->bus_ops->rmw (mdev,__mt7915_reg_remap_addr (dev, offset), mask, val); +spin_unlock_bh (&dev->reg_lock); + +return val; }#ifdef CONFIG_NET_MEDIATEK_SOC_WED
@@ -707,6 +741,7 @@ static int mt7915_mmio_init(struct mt76_dev *mdev, dev = container_of(mdev, struct mt7915_dev, mt76);mt76_mmio_init (&dev->mt76, mem_base); +spin_lock_init (&dev->reg_lock);switch (device_id) {case 0x7915 :
drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +1 -0
@@ -287,6 +287,7 @@ struct mt7915_dev {struct list_head sta_rc_list;struct list_head twt_list; +spinlock_t reg_lock;u32 hw_pattern;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/143 wifi: mt76: mt7996: disable AMSDU for non-data frames
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Chiu <[email protected]>
[ Upstream commit 5d5edc09197cd8c705b42a73cdf8ba03db53c033 ]
Disable AMSDU for non-data frames to prevent TX token leak issues.
--- drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/mac.c +3 -2
@@ -732,6 +732,9 @@ mt7996_mac_write_txwi_8023(struct mt7996_dev *dev, __le32 *txwi,FIELD_PREP (MT_TXD2_SUB_TYPE , fc_stype); txwi[2 ] |=cpu_to_le32 (val); + +if (wcid->amsdu) + txwi[3 ] |=cpu_to_le32 (MT_TXD3_HW_AMSDU ); } static void
@@ -862,8 +865,6 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi, val |=MT_TXD3_PROTECT_FRAME ;if (info->flags &IEEE80211_TX_CTL_NO_ACK ) val |=MT_TXD3_NO_ACK ; -if (wcid->amsdu) - val |=MT_TXD3_HW_AMSDU ; txwi[3 ] =cpu_to_le32 (val); txwi[4 ] =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/143 wifi: mt76: mt7996: add locking for accessing mapped registers
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shayne Chen <[email protected]>
[ Upstream commit 3687854d3e7e7fd760d939dd9e5a3520d5ab60fe ]
A race condition was observed when accessing mapped registers, so add locking to protect against concurrent access.
--- .../net/wireless/mediatek/mt76/mt7996/mmio.c | 64 ++++++++++++------- .../wireless/mediatek/mt76/mt7996/mt7996.h | 3 +- 2 files changed, 43 insertions(+), 24 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/mmio.c +42 -22
@@ -140,7 +140,6 @@ static u32 mt7996_reg_map_l1(struct mt7996_dev *dev, u32 addr)u32 offset =FIELD_GET (MT_HIF_REMAP_L1_OFFSET , addr);u32 base =FIELD_GET (MT_HIF_REMAP_L1_BASE , addr); - dev->reg_l1_backup = dev->bus_ops->rr (&dev->mt76,MT_HIF_REMAP_L1 ); dev->bus_ops->rmw (&dev->mt76,MT_HIF_REMAP_L1 ,MT_HIF_REMAP_L1_MASK ,FIELD_PREP (MT_HIF_REMAP_L1_MASK , base));
@@ -155,7 +154,6 @@ static u32 mt7996_reg_map_l2(struct mt7996_dev *dev, u32 addr)u32 offset =FIELD_GET (MT_HIF_REMAP_L2_OFFSET , addr);u32 base =FIELD_GET (MT_HIF_REMAP_L2_BASE , addr); - dev->reg_l2_backup = dev->bus_ops->rr (&dev->mt76,MT_HIF_REMAP_L2 ); dev->bus_ops->rmw (&dev->mt76,MT_HIF_REMAP_L2 ,MT_HIF_REMAP_L2_MASK ,FIELD_PREP (MT_HIF_REMAP_L2_MASK , base));
@@ -165,26 +163,10 @@ static u32 mt7996_reg_map_l2(struct mt7996_dev *dev, u32 addr)return MT_HIF_REMAP_BASE_L2 + offset; } -static void mt7996_reg_remap_restore (struct mt7996_dev *dev) -{ -/* remap to ori status */ -if (unlikely (dev->reg_l1_backup)) { - dev->bus_ops->wr (&dev->mt76,MT_HIF_REMAP_L1 , dev->reg_l1_backup); - dev->reg_l1_backup =0 ; - } - -if (dev->reg_l2_backup) { - dev->bus_ops->wr (&dev->mt76,MT_HIF_REMAP_L2 , dev->reg_l2_backup); - dev->reg_l2_backup =0 ; - } -} -static u32 __mt7996_reg_addr (struct mt7996_dev *dev,u32 addr) {int i; -mt7996_reg_remap_restore (dev); -if (addr <0x100000 )return addr;
@@ -201,6 +183,11 @@ static u32 __mt7996_reg_addr(struct mt7996_dev *dev, u32 addr)return dev->reg.map[i].mapped + ofs; } +return 0 ; +} + +static u32 __mt7996_reg_remap_addr (struct mt7996_dev *dev,u32 addr) +{if ((addr >=MT_INFRA_BASE && addr <MT_WFSYS0_PHY_START ) || (addr >=MT_WFSYS0_PHY_START && addr <MT_WFSYS1_PHY_START ) || (addr >=MT_WFSYS1_PHY_START && addr <=MT_WFSYS1_PHY_END ))
@@ -225,28 +212,60 @@ void mt7996_memcpy_fromio(struct mt7996_dev *dev, void *buf, u32 offset, {u32 addr =__mt7996_reg_addr (dev, offset); -memcpy_fromio (buf, dev->mt76.mmio.regs + addr, len); +if (addr) { +memcpy_fromio (buf, dev->mt76.mmio.regs + addr, len); +return ; + } + +spin_lock_bh (&dev->reg_lock); +memcpy_fromio (buf, dev->mt76.mmio.regs + +__mt7996_reg_remap_addr (dev, offset), len); +spin_unlock_bh (&dev->reg_lock); }static u32 mt7996_rr (struct mt76_dev *mdev,u32 offset) { struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76); +u32 addr =__mt7996_reg_addr (dev, offset), val; + +if (addr) +return dev->bus_ops->rr (mdev, addr); -return dev->bus_ops->rr (mdev,__mt7996_reg_addr (dev, offset)); +spin_lock_bh (&dev->reg_lock); + val = dev->bus_ops->rr (mdev,__mt7996_reg_remap_addr (dev, offset)); +spin_unlock_bh (&dev->reg_lock); + +return val; }static void mt7996_wr (struct mt76_dev *mdev,u32 offset,u32 val) { struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76); +u32 addr =__mt7996_reg_addr (dev, offset); - dev->bus_ops->wr (mdev,__mt7996_reg_addr (dev, offset), val); +if (addr) { + dev->bus_ops->wr (mdev, addr, val); +return ; + } + +spin_lock_bh (&dev->reg_lock); + dev->bus_ops->wr (mdev,__mt7996_reg_remap_addr (dev, offset), val); +spin_unlock_bh (&dev->reg_lock); }static u32 mt7996_rmw (struct mt76_dev *mdev,u32 offset,u32 mask,u32 val) { struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76); +u32 addr =__mt7996_reg_addr (dev, offset); + +if (addr) +return dev->bus_ops->rmw (mdev, addr, mask, val); + +spin_lock_bh (&dev->reg_lock); + val = dev->bus_ops->rmw (mdev,__mt7996_reg_remap_addr (dev, offset), mask, val); +spin_unlock_bh (&dev->reg_lock); -return dev->bus_ops->rmw (mdev,__mt7996_reg_addr (dev, offset), mask, val); +return val; }#ifdef CONFIG_NET_MEDIATEK_SOC_WED
@@ -421,6 +440,7 @@ static int mt7996_mmio_init(struct mt76_dev *mdev, dev = container_of(mdev, struct mt7996_dev, mt76);mt76_mmio_init (&dev->mt76, mem_base); +spin_lock_init (&dev->reg_lock);switch (device_id) {case 0x7990 :
drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +1 -2
@@ -325,8 +325,7 @@ struct mt7996_dev {u8 n_agrt; } twt; -u32 reg_l1_backup; -u32 reg_l2_backup; +spinlock_t reg_lock;u8 wtbl_size_group; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/143 ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of CONFIG_X86_ANDROID_TABLETS
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 7c86e17455de1a442ec906d3449148b5e9a218a4 ]
Some recent(ish) Dell AIO devices have a backlight controller board connected to an UART.
This UART has a DELL0501 HID with CID set to PNP0501 so that the UART is still handled by 8250_pnp.c. Unfortunately there is no separate ACPI device with an UartSerialBusV2() resource to model the backlight-controller.
The next patch in this series will use acpi_quirk_skip_serdev_enumeration() to still create a serdev for this for a backlight driver to bind to instead of creating a /dev/ttyS0.
This new acpi_quirk_skip_serdev_enumeration() use is not limited to Android X86 tablets, so move it out of the ifdef CONFIG_X86_ANDROID_TABLETS block.
--- drivers/acpi/x86/utils.c | 18 ++++++++++++++---- include/acpi/acpi_bus.h | 14 +++++++------- 2 files changed, 21 insertions(+), 11 deletions(-)
drivers/acpi/x86/utils.c +14 -4
@@ -428,7 +428,7 @@ bool acpi_quirk_skip_i2c_client_enumeration(struct acpi_device *adev) }EXPORT_SYMBOL_GPL (acpi_quirk_skip_i2c_client_enumeration); -int acpi_quirk_skip_serdev_enumeration (struct device *controller_parent,bool *skip) +static int acpi_dmi_skip_serdev_enumeration (struct device *controller_parent,bool *skip) {struct acpi_device *adev =ACPI_COMPANION (controller_parent);const struct dmi_system_id *dmi_id;
@@ -436,8 +436,6 @@ int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *su64 uid;int ret; - *skip = false; - ret =acpi_dev_uid_to_integer (adev, &uid);if (ret)return 0 ;
@@ -463,7 +461,6 @@ int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *sreturn 0 ; } -EXPORT_SYMBOL_GPL (acpi_quirk_skip_serdev_enumeration);bool acpi_quirk_skip_gpio_event_handlers (void ) {
@@ -478,8 +475,21 @@ bool acpi_quirk_skip_gpio_event_handlers(void)return (quirks &ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS ); }EXPORT_SYMBOL_GPL (acpi_quirk_skip_gpio_event_handlers); +#else +static int acpi_dmi_skip_serdev_enumeration (struct device *controller_parent,bool *skip) +{ +return 0 ; +}#endif +int acpi_quirk_skip_serdev_enumeration (struct device *controller_parent,bool *skip) +{ + *skip = false; + +return acpi_dmi_skip_serdev_enumeration (controller_parent, skip); +} +EXPORT_SYMBOL_GPL (acpi_quirk_skip_serdev_enumeration); +/* Lists of PMIC ACPI HIDs with an (often better) native charger driver */ static const struct { const char *hid;
include/acpi/acpi_bus.h +7 -7
@@ -749,6 +749,7 @@ bool acpi_device_override_status(struct acpi_device *adev, unsigned long long *sbool acpi_quirk_skip_acpi_ac_and_battery (void );int acpi_install_cmos_rtc_space_handler (acpi_handle handle);void acpi_remove_cmos_rtc_space_handler (acpi_handle handle); +int acpi_quirk_skip_serdev_enumeration (struct device *controller_parent,bool *skip);#else static inline bool acpi_device_override_status (struct acpi_device *adev,unsigned long long *status)
@@ -766,23 +767,22 @@ static inline int acpi_install_cmos_rtc_space_handler(acpi_handle handle)static inline void acpi_remove_cmos_rtc_space_handler (acpi_handle handle) { } +static inline int +acpi_quirk_skip_serdev_enumeration (struct device *controller_parent,bool *skip) +{ + *skip = false; +return 0 ; +}#endif #if IS_ENABLED (CONFIG_X86_ANDROID_TABLETS )bool acpi_quirk_skip_i2c_client_enumeration (struct acpi_device *adev); -int acpi_quirk_skip_serdev_enumeration (struct device *controller_parent,bool *skip);bool acpi_quirk_skip_gpio_event_handlers (void );#else static inline bool acpi_quirk_skip_i2c_client_enumeration (struct acpi_device *adev) {return false; } -static inline int -acpi_quirk_skip_serdev_enumeration (struct device *controller_parent,bool *skip) -{ - *skip = false; -return 0 ; -}static inline bool acpi_quirk_skip_gpio_event_handlers (void ) {return false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/143 ACPI: x86: Add DELL0501 handling to acpi_quirk_skip_serdev_enumeration()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 99b572e6136eab69a8c91d72cf8595b256e304b5 ]
Some recent(ish) Dell AIO devices have a backlight controller board connected to an UART.
This UART has a DELL0501 HID with CID set to PNP0501 so that the UART is still handled by 8250_pnp.c. Unfortunately there is no separate ACPI device with an UartSerialBusV2() resource to model the backlight-controller. This causes the kernel to create a /dev/ttyS0 char-device for the UART instead of creating an in kernel serdev-controller + serdev-device pair for a kernel backlight driver.
Use the existing acpi_quirk_skip_serdev_enumeration() mechanism to work around this by returning skip=true for tty-ctrl parents with a HID of DELL0501.
Like other cases where the UartSerialBusV2() resource is missing or broken this will only create the serdev-controller device and the serdev-device itself will need to be instantiated by platform code.
Unfortunately in this case there is no device for the platform-code instantiating the serdev-device to bind to. So also create a platform_device for this.
--- drivers/acpi/x86/utils.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/acpi/x86/utils.c +20 -0
@@ -484,8 +484,28 @@ static int acpi_dmi_skip_serdev_enumeration(struct device *controller_parent, boint acpi_quirk_skip_serdev_enumeration (struct device *controller_parent,bool *skip) { +struct acpi_device *adev =ACPI_COMPANION (controller_parent); + *skip = false; +/* +* The DELL0501 ACPI HID represents an UART (CID is set to PNP0501) with +* a backlight-controller attached. There is no separate ACPI device with +* an UartSerialBusV2() resource to model the backlight-controller. +* Set skip to true so that the tty core creates a serdev ctrl device. +* The backlight driver will manually create the serdev client device. +*/ +if (acpi_dev_hid_match (adev,"DELL0501" )) { + *skip = true; +/* +* Create a platform dev for dell-uart-backlight to bind to. +* This is a static device, so no need to store the result. +*/ +platform_device_register_simple ("dell-uart-backlight" ,PLATFORM_DEVID_NONE , +NULL ,0 ); +return 0 ; + } +return acpi_dmi_skip_serdev_enumeration (controller_parent, skip); }EXPORT_SYMBOL_GPL (acpi_quirk_skip_serdev_enumeration);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/143 pstore/zone: Add a null pointer check to the psz_kmsg_read
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit 98bc7e26e14fbb26a6abf97603d59532475e97f8 ]
kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity.
--- fs/pstore/zone.c | 2 ++ 1 file changed, 2 insertions(+)
fs/pstore/zone.c +2 -0
@@ -973,6 +973,8 @@ static ssize_t psz_kmsg_read(struct pstore_zone *zone,char *buf =kasprintf (GFP_KERNEL ,"%s: Total %d times\n" ,kmsg_dump_reason_str (record->reason), record->count); +if (!buf) +return -ENOMEM ; hlen =strlen (buf); record->buf =krealloc (buf, hlen + size,GFP_KERNEL );if (!record->buf) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/143 tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samasth Norway Ananda <[email protected]>
[ Upstream commit f85450f134f0b4ca7e042dc3dc89155656a2299d ]
In function get_pkg_num() if fopen_or_die() succeeds it returns a file pointer to be used. But fclose() is never called before returning from the function.
--- tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 1 + 1 file changed, 1 insertion(+)
tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c +1 -0
@@ -1241,6 +1241,7 @@ unsigned int get_pkg_num(int cpu) retval =fscanf (fp,"%d\n" , &pkg);if (retval !=1 )errx (1 ,"%s: failed to parse" , pathname); +fclose (fp);return pkg; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/143 net: pcs: xpcs: Return EINVAL in the internal methods
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serge Semin <[email protected]>
[ Upstream commit f5151005d379d9ce42e327fd3b2d2aaef61cda81 ]
In particular the xpcs_soft_reset() and xpcs_do_config() functions currently return -1 if invalid auto-negotiation mode is specified. That value might be then passed to the generic kernel subsystems which require a standard kernel errno value. Even though the erroneous conditions are very specific (memory corruption or buggy driver implementation) using a hard-coded -1 literal doesn't seem correct anyway especially when it comes to passing it higher to the network subsystem or printing to the system log. Convert the hard-coded error values to -EINVAL then.
--- drivers/net/pcs/pcs-xpcs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/pcs/pcs-xpcs.c +2 -2
@@ -293,7 +293,7 @@ static int xpcs_soft_reset(struct dw_xpcs *xpcs, dev =MDIO_MMD_VEND2 ;break ;default : -return -1 ; +return -EINVAL ; } ret =xpcs_write (xpcs, dev,MDIO_CTRL1 ,MDIO_CTRL1_RESET );
@@ -891,7 +891,7 @@ int xpcs_do_config(struct dw_xpcs *xpcs, phy_interface_t interface,return ret;break ;default : -return -1 ; +return -EINVAL ; }if (compat->pma_config) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/143 dma-direct: Leak pages on dma_set_decrypted() failure
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rick Edgecombe <[email protected]>
[ Upstream commit b9fa16949d18e06bdf728a560f5c8af56d2bdcaf ]
On TDX it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues.
DMA could free decrypted/shared pages if dma_set_decrypted() fails. This should be a rare case. Just leak the pages in this case instead of freeing them.
--- kernel/dma/direct.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
kernel/dma/direct.c +5 -4
@@ -286,7 +286,7 @@ void *dma_direct_alloc(struct device *dev, size_t size, }else { ret =page_address (page);if (dma_set_decrypted (dev, ret, size)) - goto out_free_pages; + goto out_leak_pages; }memset (ret,0 , size);
@@ -307,6 +307,8 @@ void *dma_direct_alloc(struct device *dev, size_t size, out_free_pages:__dma_direct_free_pages (dev, page, size);return NULL ; +out_leak_pages: +return NULL ; } void dma_direct_free(struct device *dev, size_t size,
@@ -367,12 +369,11 @@ struct page *dma_direct_alloc_pages(struct device *dev, size_t size, ret =page_address (page);if (dma_set_decrypted (dev, ret, size)) - goto out_free_pages; + goto out_leak_pages;memset (ret,0 , size); *dma_handle =phys_to_dma_direct (dev,page_to_phys (page));return page; -out_free_pages: -__dma_direct_free_pages (dev, page, size); +out_leak_pages:return NULL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/143 wifi: ath11k: decrease MHI channel buffer length to 8KB
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit 1cca1bddf9ef080503c15378cecf4877f7510015 ]
Currently buf_len field of ath11k_mhi_config_qca6390 is assigned with 0, making MHI use a default size, 64KB, to allocate channel buffers. This is likely to fail in some scenarios where system memory is highly fragmented and memory compaction or reclaim is not allowed.
There is a fail report which is caused by it:
kworker/u32:45: page allocation failure: order:4, mode:0x40c00(GFP_NOIO|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0
CPU: 0 PID: 19318 Comm: kworker/u32:45 Not tainted 6.8.0-rc3-1.gae4495f-default #1 openSUSE Tumbleweed (unreleased) 493b6d5b382c603654d7a81fc3c144d59a1dfceb Workqueue: events_unbound async_run_entry_fn Call Trace: <TASK> dump_stack_lvl+0x47/0x60 warn_alloc+0x13a/0x1b0 ? srso_alias_return_thunk+0x5/0xfbef5 ? __alloc_pages_direct_compact+0xab/0x210 __alloc_pages_slowpath.constprop.0+0xd3e/0xda0 __alloc_pages+0x32d/0x350 ? mhi_prepare_channel+0x127/0x2d0 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814] __kmalloc_large_node+0x72/0x110 __kmalloc+0x37c/0x480 ? mhi_map_single_no_bb+0x77/0xf0 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814] ? mhi_prepare_channel+0x127/0x2d0 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814] mhi_prepare_channel+0x127/0x2d0 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814] __mhi_prepare_for_transfer+0x44/0x80 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814] ? __pfx_____mhi_prepare_for_transfer+0x10/0x10 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814] device_for_each_child+0x5c/0xa0 ? __pfx_pci_pm_resume+0x10/0x10 ath11k_core_resume+0x65/0x100 [ath11k a5094e22d7223135c40d93c8f5321cf09fd85e4e] ? srso_alias_return_thunk+0x5/0xfbef5 ath11k_pci_pm_resume+0x32/0x60 [ath11k_pci 830b7bfc3ea80ebef32e563cafe2cb55e9cc73ec] ? srso_alias_return_thunk+0x5/0xfbef5 dpm_run_callback+0x8c/0x1e0 device_resume+0x104/0x340 ? __pfx_dpm_watchdog_handler+0x10/0x10 async_resume+0x1d/0x30 async_run_entry_fn+0x32/0x120 process_one_work+0x168/0x330 worker_thread+0x2f5/0x410 ? __pfx_worker_thread+0x10/0x10 kthread+0xe8/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK>
Actually those buffers are used only by QMI target -> host communication. And for WCN6855 and QCA6390, the largest packet size for that is less than 6KB. So change buf_len field to 8KB, which results in order 1 allocation if page size is 4KB. In this way, we can at least save some memory, and as well as decrease the possibility of allocation failure in those scenarios.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30
--- drivers/net/wireless/ath/ath11k/mhi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath11k/mhi.c +1 -1
@@ -106,7 +106,7 @@ static struct mhi_controller_config ath11k_mhi_config_qca6390 = { .max_channels = 128, .timeout_ms = 2000, .use_bounce_buf = false, - .buf_len = 0, + .buf_len = 8192, .num_channels = ARRAY_SIZE(ath11k_mhi_channels_qca6390), .ch_cfg = ath11k_mhi_channels_qca6390, .num_events = ARRAY_SIZE(ath11k_mhi_events_qca6390),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/143 iommu/arm-smmu-v3: Hold arm_smmu_asid_lock during all of attach_dev
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
[ Upstream commit 9f7c68911579bc15c57d227d021ccd253da2b635 ]
The BTM support wants to be able to change the ASID of any smmu_domain. When it goes to do this it holds the arm_smmu_asid_lock and iterates over the target domain's devices list.
During attach of a S1 domain we must ensure that the devices list and CD are in sync, otherwise we could miss CD updates or a parallel CD update could push an out of date CD.
This is pretty complicated, and almost works today because arm_smmu_detach_dev() removes the master from the linked list before working on the CD entries, preventing parallel update of the CD.
However, it does have an issue where the CD can remain programed while the domain appears to be unattached. arm_smmu_share_asid() will then not clear any CD entriess and install its own CD entry with the same ASID concurrently. This creates a small race window where the IOMMU can see two ASIDs pointing to different translations.
CPU0 CPU1arm_smmu_attach_dev()
arm_smmu_detach_dev()
spin_lock_irqsave(&smmu_domain->devices_lock, flags);
list_del(&master->domain_head);
spin_unlock_irqrestore(&smmu_domain->devices_lock, flags);
arm_smmu_mmu_notifier_get()
arm_smmu_alloc_shared_cd()
arm_smmu_share_asid():
// Does nothing due to list_del above
arm_smmu_update_ctx_desc_devices()
arm_smmu_tlb_inv_asid()
arm_smmu_write_ctx_desc()
** Now the ASID is in two CDs
with different translation
arm_smmu_write_ctx_desc(master, IOMMU_NO_PASID, NULL);Solve this by wrapping most of the attach flow in the arm_smmu_asid_lock. This locks more than strictly needed to prepare for the next patch which will reorganize the order of the linked list, STE and CD changes.
Move arm_smmu_detach_dev() till after we have initialized the domain so the lock can be held for less time.
--- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 22 ++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-)
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +13 -9
@@ -2398,8 +2398,6 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)return -EBUSY ; } -arm_smmu_detach_dev (master); -mutex_lock (&smmu_domain->init_mutex);if (!smmu_domain->smmu) {
@@ -2414,6 +2412,16 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)if (ret)return ret; +/* +* Prevent arm_smmu_share_asid() from trying to change the ASID +* of either the old or new domain while we are working on it. +* This allows the STE and the smmu_domain->devices list to +* be inconsistent during this routine. +*/ +mutex_lock (&arm_smmu_asid_lock); + +arm_smmu_detach_dev (master); + master->domain = smmu_domain;/*
@@ -2439,13 +2447,7 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev) } } -/* -* Prevent SVA from concurrently modifying the CD or writing to -* the CD entry -*/ -mutex_lock (&arm_smmu_asid_lock); ret =arm_smmu_write_ctx_desc (master,IOMMU_NO_PASID , &smmu_domain->cd); -mutex_unlock (&arm_smmu_asid_lock);if (ret) { master->domain =NULL ; goto out_list_del;
@@ -2455,13 +2457,15 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)arm_smmu_install_ste_for_dev (master);arm_smmu_enable_ats (master); -return 0 ; + goto out_unlock; out_list_del:spin_lock_irqsave (&smmu_domain->devices_lock, flags);list_del (&master->domain_head);spin_unlock_irqrestore (&smmu_domain->devices_lock, flags); +out_unlock: +mutex_unlock (&arm_smmu_asid_lock);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/143 cpufreq: Dont unregister cpufreq cooling on CPU hotplug
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <[email protected]>
[ Upstream commit c4d61a529db788d2e52654f5b02c8d1de4952c5b ]
Offlining a CPU and bringing it back online is a common operation and it happens frequently during system suspend/resume, where the non-boot CPUs are hotplugged out during suspend and brought back at resume.
The cpufreq core already tries to make this path as fast as possible as the changes are only temporary in nature and full cleanup of resources isn't required in this case. For example the drivers can implement online()/offline() callbacks to avoid a lot of tear down of resources.
On similar lines, there is no need to unregister the cpufreq cooling device during suspend / resume, but only while the policy is getting removed.
Moreover, unregistering the cpufreq cooling device is resulting in an unwanted outcome, where the system suspend is eventually aborted in the process. Currently, during system suspend the cpufreq core unregisters the cooling device, which in turn removes a kobject using device_del() and that generates a notification to the userspace via uevent broadcast. This causes system suspend to abort in some setups.
This was also earlier reported (indirectly) by Roman [1]. Maybe there is another way around to fixing that problem properly, but this change makes sense anyways.
Move the registering and unregistering of the cooling device to policy creation and removal times onlyy.
--- drivers/cpufreq/cpufreq.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
drivers/cpufreq/cpufreq.c +11 -6
@@ -1576,7 +1576,8 @@ static int cpufreq_online(unsigned int cpu)if (cpufreq_driver->ready) cpufreq_driver->ready (policy); -if (cpufreq_thermal_control_enabled (cpufreq_driver)) +/* Register cpufreq cooling only for a new policy */ +if (new_policy &&cpufreq_thermal_control_enabled (cpufreq_driver)) policy->cdev =of_cpufreq_cooling_register (policy);pr_debug ("initialization complete\n" );
@@ -1660,11 +1661,6 @@ static void __cpufreq_offline(unsigned int cpu, struct cpufreq_policy *policy)else policy->last_policy = policy->policy; -if (cpufreq_thermal_control_enabled (cpufreq_driver)) { -cpufreq_cooling_unregister (policy->cdev); - policy->cdev =NULL ; - } -if (has_target ())cpufreq_exit_governor (policy);
@@ -1725,6 +1721,15 @@ static void cpufreq_remove_dev(struct device *dev, struct subsys_interface *sif)return ; } +/* +* Unregister cpufreq cooling once all the CPUs of the policy are +* removed. +*/ +if (cpufreq_thermal_control_enabled (cpufreq_driver)) { +cpufreq_cooling_unregister (policy->cdev); + policy->cdev =NULL ; + } +/* We did light-weight exit earlier, do full tear down now */ if (cpufreq_driver->offline) cpufreq_driver->exit (policy);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/143 overflow: Allow non-type arg to type_max() and type_min()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit bd1ebf2467f9c5d157bec7b025e83f8ffdae1318 ]
A common use of type_max() is to find the max for the type of a variable. Using the pattern type_max(typeof(var)) is needlessly verbose. Instead, since typeof(type) == type we can just explicitly call typeof() on the argument to type_max() and type_min(). Add wrappers for readability.
We can do some replacements right away:
$ git grep '\btype_\(min\|max\)(typeof' | wc -l 11
--- include/linux/overflow.h | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
include/linux/overflow.h +7 -5
@@ -31,8 +31,10 @@* credit to Christian Biere. */ #define __type_half_max (type) ((type)1 << (8*sizeof(type) - 1 - is_signed_type(type))) -#define type_max (T ) ((T)((__type_half_max(T) - 1) + __type_half_max(T))) -#define type_min (T ) ((T)((T)-type_max(T)-(T)1)) +#define __type_max (T ) ((T)((__type_half_max(T) - 1) + __type_half_max(T))) +#define type_max (t) __type_max(typeof(t)) +#define __type_min (T ) ((T)((T)-type_max(T)-(T)1)) +#define type_min (t) __type_min(typeof(t))/* * Avoids triggering -Wtype-limits compilation warning,
@@ -130,10 +132,10 @@ static inline bool __must_check __must_check_overflow(bool overflow)#define __overflows_type_constexpr (x,T ) ( \ is_unsigned_type(typeof(x)) ? \ - (x) > type_max(typeof(T)) : \ + (x) > type_max(T) : \ is_unsigned_type(typeof(T)) ? \ - (x) < 0 || (x) > type_max(typeof(T)) : \ - (x) < type_min(typeof(T)) || (x) > type_max(typeof(T))) + (x) < 0 || (x) > type_max(T) : \ + (x) < type_min(T) || (x) > type_max(T))#define __overflows_type (x,T ) ({ \ typeof(T) v = 0; \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/143 wifi: iwlwifi: Add missing MODULE_FIRMWARE() for *.pnvm
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 4223675d2b5912060a85e48fd8fee51207e00957 ]
A few models require *.pnvm files while we don't declare them via MODULE_FIRMWARE(). This resulted in the breakage of WiFi on the system that relies on the information from modinfo (e.g. openSUSE installer image).
This patch adds those missing MODULE_FIRMWARE() entries for *.pnvm files.
type=feature
ticket=none
--- drivers/net/wireless/intel/iwlwifi/cfg/ax210.c | 6 ++++++ drivers/net/wireless/intel/iwlwifi/cfg/bz.c | 2 ++ 2 files changed, 8 insertions(+)
drivers/net/wireless/intel/iwlwifi/cfg/ax210.c +6 -0
@@ -299,3 +299,9 @@ MODULE_FIRMWARE(IWL_MA_B_HR_B_FW_MODULE_FIRMWARE(IWL_AX210_UCODE_API_MAX));MODULE_FIRMWARE (IWL_MA_B_GF_A_FW_MODULE_FIRMWARE (IWL_AX210_UCODE_API_MAX ));MODULE_FIRMWARE (IWL_MA_B_GF4_A_FW_MODULE_FIRMWARE (IWL_AX210_UCODE_API_MAX ));MODULE_FIRMWARE (IWL_MA_B_MR_A_FW_MODULE_FIRMWARE (IWL_AX210_UCODE_API_MAX )); + +MODULE_FIRMWARE ("iwlwifi-so-a0-gf-a0.pnvm" ); +MODULE_FIRMWARE ("iwlwifi-so-a0-gf4-a0.pnvm" ); +MODULE_FIRMWARE ("iwlwifi-ty-a0-gf-a0.pnvm" ); +MODULE_FIRMWARE ("iwlwifi-ma-b0-gf-a0.pnvm" ); +MODULE_FIRMWARE ("iwlwifi-ma-b0-gf4-a0.pnvm" );
drivers/net/wireless/intel/iwlwifi/cfg/bz.c +2 -0
@@ -179,3 +179,5 @@ MODULE_FIRMWARE(IWL_BZ_A_FM_C_MODULE_FIRMWARE(IWL_BZ_UCODE_API_MAX));MODULE_FIRMWARE (IWL_BZ_A_FM4_B_MODULE_FIRMWARE (IWL_BZ_UCODE_API_MAX ));MODULE_FIRMWARE (IWL_GL_B_FM_B_MODULE_FIRMWARE (IWL_BZ_UCODE_API_MAX ));MODULE_FIRMWARE (IWL_GL_C_FM_C_MODULE_FIRMWARE (IWL_BZ_UCODE_API_MAX )); + +MODULE_FIRMWARE ("iwlwifi-gl-c0-fm-c0.pnvm" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/143 wifi: cfg80211: check A-MSDU format more carefully
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 9ad7974856926129f190ffbe3beea78460b3b7cc ]
If it looks like there's another subframe in the A-MSDU but the header isn't fully there, we can end up reading data out of bounds, only to discard later. Make this a bit more careful and check if the subframe header can even be present.
--- net/wireless/util.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
net/wireless/util.c +10 -4
@@ -791,15 +791,19 @@ ieee80211_amsdu_subframe_length(void *field, u8 mesh_flags, u8 hdr_type)bool ieee80211_is_valid_amsdu (struct sk_buff *skb,u8 mesh_hdr) { -int offset =0 , remaining, subframe_len, padding; +int offset =0 , subframe_len, padding;for (offset =0 ; offset < skb->len; offset += subframe_len + padding) { +int remaining = skb->len - offset;struct {__be16 len;u8 mesh_flags; } hdr;u16 len; +if (sizeof (hdr) > remaining) +return false; +if (skb_copy_bits (skb, offset +2 *ETH_ALEN , &hdr,sizeof (hdr)) <0 )return false;
@@ -807,7 +811,6 @@ bool ieee80211_is_valid_amsdu(struct sk_buff *skb, u8 mesh_hdr) mesh_hdr); subframe_len =sizeof (struct ethhdr ) + len; padding = (4 - subframe_len) &0x3 ; - remaining = skb->len - offset;if (subframe_len > remaining)return false;
@@ -825,7 +828,7 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list, {unsigned int hlen =ALIGN (extra_headroom,4 );struct sk_buff *frame =NULL ; -int offset =0 , remaining; +int offset =0 ;struct {struct ethhdr eth;uint8_t flags;
@@ -839,10 +842,14 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list, copy_len =sizeof (hdr);while (!last) { +int remaining = skb->len - offset;unsigned int subframe_len;int len, mesh_len =0 ;u8 padding; +if (copy_len > remaining) + goto purge; +skb_copy_bits (skb, offset, &hdr, copy_len);if (iftype ==NL80211_IFTYPE_MESH_POINT ) mesh_len =__ieee80211_get_mesh_hdrlen (hdr.flags);
@@ -852,7 +859,6 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list, padding = (4 - subframe_len) &0x3 ;/* the last MSDU has no padding */ - remaining = skb->len - offset;if (subframe_len > remaining) goto purge;/* mitigate A-MSDU aggregation injection attacks */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/143 btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Sterba <[email protected]>
[ Upstream commit 7411055db5ce64f836aaffd422396af0075fdc99 ]
The unhandled case in btrfs_relocate_sys_chunks() loop is a corruption, as it could be caused only by two impossible conditions:
- at first the search key is set up to look for a chunk tree item, with offset -1, this is an inexact search and the key->offset will contain the correct offset upon a successful search, a valid chunk tree item cannot have an offset -1
- after first successful search, the found_key corresponds to a chunk item, the offset is decremented by 1 before the next loop, it's impossible to find a chunk item there due to alignment and size constraints
--- fs/btrfs/volumes.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
fs/btrfs/volumes.c +11 -1
@@ -3440,7 +3440,17 @@ static int btrfs_relocate_sys_chunks(struct btrfs_fs_info *fs_info)mutex_unlock (&fs_info->reclaim_bgs_lock); goto error; } -BUG_ON (ret ==0 );/* Corruption */ +if (ret ==0 ) { +/* +* On the first search we would find chunk tree with +* offset -1, which is not possible. On subsequent +* loops this would find an existing item on an invalid +* offset (one less than the previous one, wrong +* alignment and size). +*/ + ret = -EUCLEAN ; + goto error; + } ret =btrfs_previous_item (chunk_root, path, key.objectid, key.type);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/143 btrfs: export: handle invalid inode or root reference in btrfs_get_parent()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Sterba <[email protected]>
[ Upstream commit 26b66d1d366a375745755ca7365f67110bbf6bd5 ]
The get_parent handler looks up a parent of a given dentry, this can be either a subvolume or a directory. The search is set up with offset -1 but it's never expected to find such item, as it would break allowed range of inode number or a root id. This means it's a corruption (ext4 also returns this error code).
--- fs/btrfs/export.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
fs/btrfs/export.c +8 -1
@@ -174,8 +174,15 @@ struct dentry *btrfs_get_parent(struct dentry *child) ret =btrfs_search_slot (NULL , root, &key, path,0 ,0 );if (ret <0 ) goto fail; +if (ret ==0 ) { +/* +* Key with offset of -1 found, there would have to exist an +* inode with such number or a root with such id. +*/ + ret = -EUCLEAN ; + goto fail; + } -BUG_ON (ret ==0 );/* Key with offset of -1 found */ if (path->slots[0 ] ==0 ) { ret = -ENOENT ; goto fail;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/143 btrfs: send: handle path ref underflow in header iterate_inode_ref()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Sterba <[email protected]>
[ Upstream commit 3c6ee34c6f9cd12802326da26631232a61743501 ]
Change BUG_ON to proper error handling if building the path buffer fails. The pointers are not printed so we don't accidentally leak kernel addresses.
--- fs/btrfs/send.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
fs/btrfs/send.c +9 -1
@@ -1070,7 +1070,15 @@ static int iterate_inode_ref(struct btrfs_root *root, struct btrfs_path *path, ret =PTR_ERR (start); goto out; } -BUG_ON (start < p->buf); +if (unlikely (start < p->buf)) { +btrfs_err (root->fs_info, +"send: path ref buffer underflow for key (%llu %u %llu)" , + found_key->objectid, + found_key->type, + found_key->offset); + ret = -EINVAL ; + goto out; + } } p->start = start; }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/143 ice: use relative VSI index for VFs instead of PF VSI number
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <[email protected]>
[ Upstream commit 11fbb1bfb5bc8c98b2d7db9da332b5e568f4aaab ]
When initializing over virtchnl, the PF is required to pass a VSI ID to the VF as part of its capabilities exchange. The VF driver reports this value back to the PF in a variety of commands. The PF driver validates that this value matches the value it sent to the VF.
Some hardware families such as the E700 series could use this value when reading RSS registers or communicating directly with firmware over the Admin Queue.
However, E800 series hardware does not support any of these interfaces and the VF's only use for this value is to report it back to the PF. Thus, there is no requirement that this value be an actual VSI ID value of any kind.
The PF driver already does not trust that the VF sends it a real VSI ID. The VSI structure is always looked up from the VF structure. The PF does validate that the VSI ID provided matches a VSI associated with the VF, but otherwise does not use the VSI ID for any purpose.
Instead of reporting the VSI number relative to the PF space, report a fixed value of 1. When communicating with the VF over virtchnl, validate that the VSI number is returned appropriately.
This avoids leaking information about the firmware of the PF state. Currently the ice driver only supplies a VF with a single VSI. However, it appears that virtchnl has some support for allowing multiple VSIs. I did not attempt to implement this. However, space is left open to allow further relative indexes if additional VSIs are provided in future feature development. For this reason, keep the ice_vc_isvalid_vsi_id function in place to allow extending it for multiple VSIs in the future.
This change will also simplify handling of live migration in a future series. Since we no longer will provide a real VSI number to the VF, there will be no need to keep track of this number when migrating to a new host.
--- drivers/net/ethernet/intel/ice/ice_virtchnl.c | 9 ++------- drivers/net/ethernet/intel/ice/ice_virtchnl.h | 9 +++++++++ 2 files changed, 11 insertions(+), 7 deletions(-)
drivers/net/ethernet/intel/ice/ice_virtchnl.c +2 -7
@@ -499,7 +499,7 @@ static int ice_vc_get_vf_res_msg(struct ice_vf *vf, u8 *msg) vfres->rss_lut_size =ICE_LUT_VSI_SIZE ; vfres->max_mtu =ice_vc_get_max_frame_size (vf); - vfres->vsi_res[0 ].vsi_id = vf->lan_vsi_num; + vfres->vsi_res[0 ].vsi_id =ICE_VF_VSI_ID ; vfres->vsi_res[0 ].vsi_type =VIRTCHNL_VSI_SRIOV ; vfres->vsi_res[0 ].num_queue_pairs = vsi->num_txq; ether_addr_copy(vfres->vsi_res[0].default_mac_addr,
@@ -545,12 +545,7 @@ static void ice_vc_reset_vf_msg(struct ice_vf *vf)*/ bool ice_vc_isvalid_vsi_id (struct ice_vf *vf,u16 vsi_id) { -struct ice_pf *pf = vf->pf; -struct ice_vsi *vsi; - - vsi =ice_find_vsi (pf, vsi_id); - -return (vsi && (vsi->vf == vf)); +return vsi_id ==ICE_VF_VSI_ID ; }/**
drivers/net/ethernet/intel/ice/ice_virtchnl.h +9 -0
@@ -19,6 +19,15 @@#define ICE_MAX_MACADDR_PER_VF 18#define ICE_FLEX_DESC_RXDID_MAX_NUM 64 +/* VFs only get a single VSI. For ice hardware, the VF does not need to know +* its VSI index. However, the virtchnl interface requires a VSI number, +* mainly due to legacy hardware. +* +* Since the VF doesn't need this information, report a static value to the VF +* instead of leaking any information about the PF or hardware setup. +*/ +#define ICE_VF_VSI_ID 1 +struct ice_virtchnl_ops {int (*get_ver_msg)(struct ice_vf *vf,u8 *msg);int (*get_vf_res_msg)(struct ice_vf *vf,u8 *msg);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/143 net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 00af2aa93b76b1bade471ad0d0525d4d29ca5cc0 ]
Many syzbot reports show extreme rtnl pressure, and many of them hint that smc acquires rtnl in netns creation for no good reason [1]
This patch returns early from smc_pnet_net_init()
if there is no netdevice yet.
I am not even sure why smc_pnet_create_pnetids_list() even exists, because smc_pnet_netdev_event() is also calling smc_pnet_add_base_pnetid() when handling NETDEV_UP event.
[1] extract of typical syzbot reports
2 locks held by syz-executor.3/12252:
#0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878
2 locks held by syz-executor.4/12253:
#0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878
2 locks held by syz-executor.1/12257:
#0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878
2 locks held by syz-executor.2/12261:
#0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878
2 locks held by syz-executor.0/12265:
#0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878
2 locks held by syz-executor.3/12268:
#0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878
2 locks held by syz-executor.4/12271:
#0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878
2 locks held by syz-executor.1/12274:
#0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878
2 locks held by syz-executor.2/12280:
#0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878
--- net/smc/smc_pnet.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
net/smc/smc_pnet.c +10 -0
@@ -806,6 +806,16 @@ static void smc_pnet_create_pnetids_list(struct net *net)u8 ndev_pnetid[SMC_MAX_PNETID_LEN ];struct net_device *dev; +/* Newly created netns do not have devices. +* Do not even acquire rtnl. +*/ +if (list_empty (&net->dev_base_head)) +return ; + +/* Note: This might not be needed, because smc_pnet_netdev_event() +* is also calling smc_pnet_add_base_pnetid() when handling +* NETDEV_UP event. +*/ rtnl_lock ();for_each_netdev (net, dev)smc_pnet_add_base_pnetid (net, dev, ndev_pnetid);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/143 netdev: let netlink core handle -EMSGSIZE errors
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 0b11b1c5c320555483e8a94c44549db24c289987 ]
Previous change added -EMSGSIZE handling to af_netlink, we don't have to hide these errors any longer.
Theoretically the error handling changes from:
if (err == -EMSGSIZE)
to
if (err == -EMSGSIZE && skb->len)
everywhere, but in practice it doesn't matter.
All messages fit into NLMSG_GOODSIZE, so overflow of an empty skb cannot happen.
--- net/core/netdev-genl.c | 15 +++------------ net/core/page_pool_user.c | 2 -- 2 files changed, 3 insertions(+), 14 deletions(-)
net/core/netdev-genl.c +3 -12
@@ -152,10 +152,7 @@ int netdev_nl_dev_get_dumpit(struct sk_buff *skb, struct netlink_callback *cb) }rtnl_unlock (); -if (err != -EMSGSIZE ) -return err; - -return skb->len; +return err; } static int
@@ -287,10 +284,7 @@ int netdev_nl_napi_get_dumpit(struct sk_buff *skb, struct netlink_callback *cb) }rtnl_unlock (); -if (err != -EMSGSIZE ) -return err; - -return skb->len; +return err; } static int
@@ -463,10 +457,7 @@ int netdev_nl_queue_get_dumpit(struct sk_buff *skb, struct netlink_callback *cb) }rtnl_unlock (); -if (err != -EMSGSIZE ) -return err; - -return skb->len; +return err; } static int netdev_genl_netdevice_event(struct notifier_block *nb,
net/core/page_pool_user.c +0 -2
@@ -103,8 +103,6 @@ netdev_nl_page_pool_get_dump(struct sk_buff *skb, struct netlink_callback *cb,mutex_unlock (&page_pools_lock);rtnl_unlock (); -if (skb->len && err == -EMSGSIZE ) -return skb->len;return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/143 Bluetooth: btintel: Fix null ptr deref in btintel_read_version
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit b79e040910101b020931ba0c9a6b77e81ab7f645 ]
If hci_cmd_sync_complete() is triggered and skb is NULL, then hdev->req_skb is NULL, which will cause this issue.
--- drivers/bluetooth/btintel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/bluetooth/btintel.c +1 -1
@@ -435,7 +435,7 @@ int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver)struct sk_buff *skb; skb =__hci_cmd_sync (hdev,0xfc05 ,0 ,NULL ,HCI_CMD_TIMEOUT ); -if (IS_ERR (skb)) { +if (IS_ERR_OR_NULL (skb)) {bt_dev_err (hdev,"Reading Intel version information failed (%ld)" ,PTR_ERR (skb));return PTR_ERR (skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/143 Bluetooth: btmtk: Add MODULE_FIRMWARE() for MT7922
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 3e465a07cdf444140f16bc57025c23fcafdde997 ]
Since dracut refers to the module info for defining the required firmware files and btmtk driver doesn't provide the firmware info for MT7922, the generate initrd misses the firmware, resulting in the broken Bluetooth.
This patch simply adds the MODULE_FIRMWARE() for the missing entry for covering that.
--- drivers/bluetooth/btmtk.c | 1 + drivers/bluetooth/btmtk.h | 1 + 2 files changed, 2 insertions(+)
drivers/bluetooth/btmtk.c +1 -0
@@ -422,5 +422,6 @@ MODULE_LICENSE("GPL");MODULE_FIRMWARE (FIRMWARE_MT7622 );MODULE_FIRMWARE (FIRMWARE_MT7663 );MODULE_FIRMWARE (FIRMWARE_MT7668 ); +MODULE_FIRMWARE (FIRMWARE_MT7922 );MODULE_FIRMWARE (FIRMWARE_MT7961 );MODULE_FIRMWARE (FIRMWARE_MT7925 );
drivers/bluetooth/btmtk.h +1 -0
@@ -4,6 +4,7 @@#define FIRMWARE_MT7622 "mediatek/mt7622pr2h.bin"#define FIRMWARE_MT7663 "mediatek/mt7663pr2h.bin"#define FIRMWARE_MT7668 "mediatek/mt7668pr2h.bin" +#define FIRMWARE_MT7922 "mediatek/BT_RAM_CODE_MT7922_1_1_hdr.bin"#define FIRMWARE_MT7961 "mediatek/BT_RAM_CODE_MT7961_1_2_hdr.bin"#define FIRMWARE_MT7925 "mediatek/mt7925/BT_RAM_CODE_MT7925_1_1_hdr.bin"
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/143 Bluetooth: Add new quirk for broken read key length on ATS2851
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinicius Peixoto <[email protected]>
[ Upstream commit 48201a3b3f398be6a01f78a14b18bd5d31c47458 ]
The ATS2851 controller erroneously reports support for the "Read Encryption Key Length" HCI command. This makes it unable to connect to any devices, since this command is issued by the kernel during the connection process in response to an "Encryption Change" HCI event.
Add a new quirk (HCI_QUIRK_BROKEN_ENC_KEY_SIZE) to hint that the command is unsupported, preventing it from interrupting the connection process.
This is the error log from btmon before this patch:
Quoted 1 line
HCI Event: Encryption Change (
0x08) plen 4
Status: Success (0x00)
Handle: 2048 Address: ...
Encryption: Enabled with E0 (0x01)
< HCI Command: Read Encryption Key Size (0x05|0x0008) plen 2
Handle: 2048 Address: ...Quoted 1 line
HCI Event: Command Status (
0x0f) plen 4
Read Encryption Key Size (0x05|0x0008) ncmd 1
Status: Unknown HCI Command (0x01)--- drivers/bluetooth/btusb.c | 1 + include/net/bluetooth/hci.h | 8 ++++++++ net/bluetooth/hci_event.c | 3 ++- 3 files changed, 11 insertions(+), 1 deletion(-)
drivers/bluetooth/btusb.c +1 -0
@@ -4483,6 +4483,7 @@ static int btusb_probe(struct usb_interface *intf,set_bit (HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER , &hdev->quirks);set_bit (HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT , &hdev->quirks);set_bit (HCI_QUIRK_BROKEN_EXT_SCAN , &hdev->quirks); +set_bit (HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE , &hdev->quirks); }if (!reset)
include/net/bluetooth/hci.h +8 -0
@@ -339,6 +339,14 @@ enum {* during the hdev->setup vendor callback. */ HCI_QUIRK_BROKEN_LE_CODED , + +/* +* When this quirk is set, the HCI_OP_READ_ENC_KEY_SIZE command is +* skipped during an HCI_EV_ENCRYPT_CHANGE event. This is required +* for Actions Semiconductor ATS2851 based controllers, which erroneously +* claim to support it. +*/ + HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE, };/* HCI device flags */
net/bluetooth/hci_event.c +2 -1
@@ -3679,7 +3679,8 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,* controller really supports it. If it doesn't, assume * the default size (16). */ -if (!(hdev->commands[20 ] &0x10 )) { +if (!(hdev->commands[20 ] &0x10 ) || +test_bit (HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE , &hdev->quirks)) { conn->enc_key_size =HCI_LINK_KEY_SIZE ; goto notify; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/143 drm/vc4: dont check if plane->state->fb == state->fb
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maíra Canal <[email protected]>
[ Upstream commit 5ee0d47dcf33efd8950b347dcf4d20bab12a3fa9 ]
Currently, when using non-blocking commits, we can see the following kernel warning:
[ 110.908514] ------------[ cut here ]------------ [ 110.908529] refcount_t: underflow; use-after-free. [ 110.908620] WARNING: CPU: 0 PID: 1866 at lib/refcount.c:87 refcount_dec_not_one+0xb8/0xc0 [ 110.908664] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device cmac algif_hash aes_arm64 aes_generic algif_skcipher af_alg bnep hid_logitech_hidpp vc4 brcmfmac hci_uart btbcm brcmutil bluetooth snd_soc_hdmi_codec cfg80211 cec drm_display_helper drm_dma_helper drm_kms_helper snd_soc_core snd_compress snd_pcm_dmaengine fb_sys_fops sysimgblt syscopyarea sysfillrect raspberrypi_hwmon ecdh_generic ecc rfkill libaes i2c_bcm2835 binfmt_misc joydev snd_bcm2835(C) bcm2835_codec(C) bcm2835_isp(C) v4l2_mem2mem videobuf2_dma_contig snd_pcm bcm2835_v4l2(C) raspberrypi_gpiomem bcm2835_mmal_vchiq(C) videobuf2_v4l2 snd_timer videobuf2_vmalloc videobuf2_memops videobuf2_common snd videodev vc_sm_cma(C) mc hid_logitech_dj uio_pdrv_genirq uio i2c_dev drm fuse dm_mod drm_panel_orientation_quirks backlight ip_tables x_tables ipv6 [ 110.909086] CPU: 0 PID: 1866 Comm: kodi.bin Tainted: G C 6.1.66-v8+ #32 [ 110.909104] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT) [ 110.909114] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 110.909132] pc : refcount_dec_not_one+0xb8/0xc0 [ 110.909152] lr : refcount_dec_not_one+0xb4/0xc0 [ 110.909170] sp : ffffffc00913b9c0 [ 110.909177] x29: ffffffc00913b9c0 x28: 000000556969bbb0 x27: 000000556990df60 [ 110.909205] x26: 0000000000000002 x25: 0000000000000004 x24: ffffff8004448480 [ 110.909230] x23: ffffff800570b500 x22: ffffff802e03a7bc x21: ffffffecfca68c78 [ 110.909257] x20: ffffff8002b42000 x19: ffffff802e03a600 x18: 0000000000000000 [ 110.909283] x17: 0000000000000011 x16: ffffffffffffffff x15: 0000000000000004 [ 110.909308] x14: 0000000000000fff x13: ffffffed577e47e0 x12: 0000000000000003 [ 110.909333] x11: 0000000000000000 x10: 0000000000000027 x9 : c912d0d083728c00 [ 110.909359] x8 : c912d0d083728c00 x7 : 65646e75203a745f x6 : 746e756f63666572 [ 110.909384] x5 : ffffffed579f62ee x4 : ffffffed579eb01e x3 : 0000000000000000 [ 110.909409] x2 : 0000000000000000 x1 : ffffffc00913b750 x0 : 0000000000000001 [ 110.909434] Call trace: [ 110.909441] refcount_dec_not_one+0xb8/0xc0 [ 110.909461] vc4_bo_dec_usecnt+0x4c/0x1b0 [vc4] [ 110.909903] vc4_cleanup_fb+0x44/0x50 [vc4] [ 110.910315] drm_atomic_helper_cleanup_planes+0x88/0xa4 [drm_kms_helper] [ 110.910669] vc4_atomic_commit_tail+0x390/0x9dc [vc4] [ 110.911079] commit_tail+0xb0/0x164 [drm_kms_helper] [ 110.911397] drm_atomic_helper_commit+0x1d0/0x1f0 [drm_kms_helper] [ 110.911716] drm_atomic_commit+0xb0/0xdc [drm] [ 110.912569] drm_mode_atomic_ioctl+0x348/0x4b8 [drm] [ 110.913330] drm_ioctl_kernel+0xec/0x15c [drm] [ 110.914091] drm_ioctl+0x24c/0x3b0 [drm] [ 110.914850] __arm64_sys_ioctl+0x9c/0xd4 [ 110.914873] invoke_syscall+0x4c/0x114 [ 110.914897] el0_svc_common+0xd0/0x118 [ 110.914917] do_el0_svc+0x38/0xd0 [ 110.914936] el0_svc+0x30/0x8c [ 110.914958] el0t_64_sync_handler+0x84/0xf0 [ 110.914979] el0t_64_sync+0x18c/0x190 [ 110.914996] ---[ end trace 0000000000000000 ]---
This happens because, although prepare_fb and cleanup_fb are perfectly balanced, we cannot guarantee consistency in the check plane->state->fb == state->fb. This means that sometimes we can increase the refcount in prepare_fb and don't decrease it in cleanup_fb. The opposite can also be true.
In fact, the struct drm_plane .state shouldn't be accessed directly but instead, the drm_atomic_get_new_plane_state() helper function should be used. So, we could stick to this check, but using drm_atomic_get_new_plane_state(). But actually, this check is not really needed. We can increase and decrease the refcount symmetrically without problems.
This is going to make the code more simple and consistent.
--- drivers/gpu/drm/vc4/vc4_plane.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/gpu/drm/vc4/vc4_plane.c +1 -4
@@ -1505,9 +1505,6 @@ static int vc4_prepare_fb(struct drm_plane *plane,drm_gem_plane_helper_prepare_fb (plane, state); -if (plane->state->fb == state->fb) -return 0 ; -return vc4_bo_inc_usecnt (bo); }
@@ -1516,7 +1513,7 @@ static void vc4_cleanup_fb(struct drm_plane *plane, {struct vc4_bo *bo; -if (plane->state->fb == state->fb || !state->fb) +if (!state->fb)return ; bo =to_vc4_bo (&drm_fb_dma_get_gem_obj (state->fb,0 )->base);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/143 drm/ci: uprev mesa version: fix kdl commit fetch
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vignesh Raman <[email protected]>
[ Upstream commit d315a68e94a76310c349add3f9c914cefda0a87f ]
build-kdl.sh was doing a clone --depth 1 of the default branch, then checking out a commit that might not be the latest of that branch, resulting in container build error.
https://gitlab.freedesktop.org/mesa/mesa/-/commit/5efa4d56 fixes kdl commit fetch issue. Uprev mesa in drm-ci to fix this.
This commit updates the kernel tag and adds .never-post-merge-rules due to the mesa uprev. It also fixes an issue where the virtio-gpu pipeline was not getting created with the mesa uprev.
--- drivers/gpu/drm/ci/gitlab-ci.yml | 14 ++++++++++++-- drivers/gpu/drm/ci/test.yml | 1 + 2 files changed, 13 insertions(+), 2 deletions(-)
drivers/gpu/drm/ci/gitlab-ci.yml +12 -2
@@ -1,6 +1,6 @@ variables: DRM_CI_PROJECT_PATH: &drm-ci-project-path mesa/mesa - DRM_CI_COMMIT_SHA: &drm-ci-commit-sha edfbf74df1d4d6ce54ffe24566108be0e1a98c3d + DRM_CI_COMMIT_SHA: &drm-ci-commit-sha 9d162de9a05155e1c4041857a5848842749164cf UPSTREAM_REPO: git://anongit.freedesktop.org/drm/drm TARGET_BRANCH: drm-next
@@ -25,7 +25,9 @@ variables: # per-job artifact storage on MinIO JOB_ARTIFACTS_BASE: ${PIPELINE_ARTIFACTS_BASE}/${CI_JOB_ID} # default kernel for rootfs before injecting the current kernel tree - KERNEL_IMAGE_BASE: https://${S3_HOST}/mesa-lava/gfx-ci/linux/v6.4.12-for-mesa-ci-f6b4ad45f48d + KERNEL_REPO: "gfx-ci/linux" + KERNEL_TAG: "v6.6.4-for-mesa-ci-e4f4c500f7fb" + KERNEL_IMAGE_BASE: https://${S3_HOST}/mesa-lava/${KERNEL_REPO}/${KERNEL_TAG} LAVA_TAGS: subset-1-gfx LAVA_JOB_PRIORITY: 30
@@ -133,6 +135,11 @@ stages: - if: &is-pre-merge-for-marge '$GITLAB_USER_LOGIN == "marge-bot" && $CI_PIPELINE_SOURCE == "merge_request_event"' when: on_success +.never-post-merge-rules: + rules: + - if: *is-post-merge + when: never + # Rule to filter for only scheduled pipelines. .scheduled_pipeline-rules: rules:
@@ -150,6 +157,7 @@ stages: .build-rules: rules: - !reference [.no_scheduled_pipelines-rules, rules] + - !reference [.never-post-merge-rules, rules] # Run automatically once all dependency jobs have passed - when: on_success
@@ -157,6 +165,7 @@ stages: .container+build-rules: rules: - !reference [.no_scheduled_pipelines-rules, rules] + - !reference [.never-post-merge-rules, rules] - when: manual .ci-deqp-artifacts:
@@ -175,6 +184,7 @@ stages: .container-rules: rules: - !reference [.no_scheduled_pipelines-rules, rules] + - !reference [.never-post-merge-rules, rules] # Run pipeline by default in the main project if any CI pipeline # configuration files were changed, to ensure docker images are up to date - if: *is-post-merge
drivers/gpu/drm/ci/test.yml +1 -0
@@ -327,6 +327,7 @@ virtio_gpu:none: GPU_VERSION: none extends: - .test-gl + - .test-rules tags: - kvm script:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/143 drm/amdgpu: Skip do PCI error slot reset during RAS recovery
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanley.Yang <[email protected]>
[ Upstream commit 601429cca96b4af3be44172c3b64e4228515dbe1 ]
Why:
The PCI error slot reset maybe triggered after inject ue to UMC multi times, this
caused system hang.
[ 557.371857] amdgpu 0000:af:00.0: amdgpu: GPU reset succeeded, trying to resume
[ 557.373718] [drm] PCIE GART of 512M enabled.
[ 557.373722] [drm] PTB located at 0x0000031FED700000
[ 557.373788] [drm] VRAM is lost due to GPU reset!
[ 557.373789] [drm] PSP is resuming...
[ 557.547012] mlx5_core 0000:55:00.0: mlx5_pci_err_detected Device state = 1 pci_status: 0. Exit, result = 3, need reset
[ 557.547067] [drm] PCI error: detected callback, state(1)!!
[ 557.547069] [drm] No support for XGMI hive yet...
[ 557.548125] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 0. Enter
[ 557.607763] mlx5_core 0000:55:00.0: wait vital counter value 0x16b5b after 1 iterations
[ 557.607777] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 1. Exit, err = 0, result = 5, recovered
[ 557.610492] [drm] PCI error: slot reset callback!!
...
[ 560.689382] amdgpu 0000:3f:00.0: amdgpu: GPU reset(2) succeeded!
[ 560.689546] amdgpu 0000:5a:00.0: amdgpu: GPU reset(2) succeeded!
[ 560.689562] general protection fault, probably for non-canonical address 0x5f080b54534f611f: 0000 [#1] SMP NOPTI
[ 560.701008] CPU: 16 PID: 2361 Comm: kworker/u448:9 Tainted: G OE 5.15.0-91-generic #101-Ubuntu
[ 560.712057] Hardware name: Microsoft C278A/C278A, BIOS C2789.5.BS.1C11.AG.1 11/08/2023
[ 560.720959] Workqueue: amdgpu-reset-hive amdgpu_ras_do_recovery [amdgpu]
[ 560.728887] RIP: 0010:amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu]
[ 560.736891] Code: ff 41 89 c6 e9 1b ff ff ff 44 0f b6 45 b0 e9 4f ff ff ff be 01 00 00 00 4c 89 e7 e8 76 c9 8b ff 44 0f b6 45 b0 e9 3c fd ff ff <48> 83 ba 18 02 00 00 00 0f 84 6a f8 ff ff 48 8d 7a 78 be 01 00 00
[ 560.757967] RSP: 0018:ffa0000032e53d80 EFLAGS: 00010202
[ 560.763848] RAX: ffa00000001dfd10 RBX: ffa0000000197090 RCX: ffa0000032e53db0
[ 560.771856] RDX: 5f080b54534f5f07 RSI: 0000000000000000 RDI: ff11000128100010
[ 560.779867] RBP: ffa0000032e53df0 R08: 0000000000000000 R09: ffffffffffe77f08
[ 560.787879] R10: 0000000000ffff0a R11: 0000000000000001 R12: 0000000000000000
[ 560.795889] R13: ffa0000032e53e00 R14: 0000000000000000 R15: 0000000000000000
[ 560.803889] FS: 0000000000000000(0000) GS:ff11007e7e800000(0000) knlGS:0000000000000000
[ 560.812973] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 560.819422] CR2: 000055a04c118e68 CR3: 0000000007410005 CR4: 0000000000771ee0
[ 560.827433] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 560.835433] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
[ 560.843444] PKRU: 55555554
[ 560.846480] Call Trace:
[ 560.849225] <TASK>
[ 560.851580] ? show_trace_log_lvl+0x1d6/0x2ea
[ 560.856488] ? show_trace_log_lvl+0x1d6/0x2ea
[ 560.861379] ? amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu]
[ 560.867778] ? show_regs.part.0+0x23/0x29
[ 560.872293] ? __die_body.cold+0x8/0xd
[ 560.876502] ? die_addr+0x3e/0x60
[ 560.880238] ? exc_general_protection+0x1c5/0x410
[ 560.885532] ? asm_exc_general_protection+0x27/0x30
[ 560.891025] ? amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu]
[ 560.898323] amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu]
[ 560.904520] process_one_work+0x228/0x3d0How:
In RAS recovery, mode-1 reset is issued from RAS fatal error handling and expected all the nodes in a hive to be reset. no need to issue another mode-1 during this procedure.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +14 -0
@@ -6109,6 +6109,20 @@ pci_ers_result_t amdgpu_pci_slot_reset(struct pci_dev *pdev)struct amdgpu_reset_context reset_context;u32 memsize;struct list_head device_list; +struct amdgpu_hive_info *hive; +int hive_ras_recovery =0 ; +struct amdgpu_ras *ras; + +/* PCI error slot reset should be skipped During RAS recovery */ + hive =amdgpu_get_xgmi_hive (adev); +if (hive) { + hive_ras_recovery =atomic_read (&hive->ras_recovery); +amdgpu_put_xgmi_hive (hive); + } + ras =amdgpu_ras_get_context (adev); +if ((amdgpu_ip_version (adev,GC_HWIP ,0 ) ==IP_VERSION (9 ,4 ,3 )) && + ras && (atomic_read (&ras->in_recovery) || hive_ras_recovery)) +return PCI_ERS_RESULT_RECOVERED ;DRM_INFO ("PCI error: slot reset callback!!\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/143 Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit bc4996184d56cfaf56d3811ac2680c8a0e2af56e ]
While input core can work with input->phys set to NULL userspace might depend on it, so better fail probing if allocation fails. The system must be in a pretty bad shape for it to happen anyway.
--- drivers/input/rmi4/rmi_driver.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/input/rmi4/rmi_driver.c +5 -1
@@ -1196,7 +1196,11 @@ static int rmi_driver_probe(struct device *dev) }rmi_driver_set_input_params (rmi_dev, data->input); data->input->phys =devm_kasprintf (dev,GFP_KERNEL , -"%s/input0" ,dev_name (dev)); +"%s/input0" ,dev_name (dev)); +if (!data->input->phys) { + retval = -ENOMEM ; + goto err; + } } retval =rmi_init_functions (data);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/143 drm: panel-orientation-quirks: Add quirk for GPD Win Mini
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Dionne-Riel <[email protected]>
[ Upstream commit 2f862fdc0fd802e728b6ca96bc78ec3f01bf161e ]
This adds a DMI orientation quirk for the GPD Win Mini panel.
--- drivers/gpu/drm/drm_panel_orientation_quirks.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/gpu/drm/drm_panel_orientation_quirks.c +12 -0
@@ -117,6 +117,12 @@ static const struct drm_dmi_panel_orientation_data lcd1080x1920_leftside_up = { .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP, }; +static const struct drm_dmi_panel_orientation_data lcd1080x1920_rightside_up = { + .width =1080 , + .height =1920 , + .orientation =DRM_MODE_PANEL_ORIENTATION_RIGHT_UP , +}; +static const struct drm_dmi_panel_orientation_data lcd1200x1920_rightside_up = { .width =1200 , .height =1920 ,
@@ -279,6 +285,12 @@ static const struct dmi_system_id orientation_data[] = {DMI_EXACT_MATCH (DMI_PRODUCT_NAME ,"G1618-03" ) }, .driver_data = (void *)&lcd720x1280_rightside_up, + }, { /* GPD Win Mini */ + .matches = { +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"GPD" ), +DMI_EXACT_MATCH (DMI_PRODUCT_NAME ,"G1617-01" ) + }, + .driver_data = (void *)&lcd1080x1920_rightside_up, }, { /* I.T.Works TW891 */ .matches = { DMI_EXACT_MATCH(DMI_SYS_VENDOR, "To be filled by O.E.M."),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/143 ASoC: SOF: amd: Optimize quirk for Valve Galileo
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit a13f0c3c0e8fb3e61fbfd99c6b350cf9be0c4660 ]
Valve's Steam Deck OLED is uniquely identified by vendor and product name (Galileo) DMI fields.
Simplify the quirk by removing the unnecessary match on product family.
Additionally, fix the related comment as it points to the old product variant.
--- sound/soc/sof/amd/acp.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/soc/sof/amd/acp.c +1 -2
@@ -31,11 +31,10 @@ static struct acp_quirk_entry quirk_valve_galileo = {const struct dmi_system_id acp_sof_quirk_table[] = { { -/* Valve Jupiter device */ +/* Steam Deck OLED device */ .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"Valve" ),DMI_MATCH (DMI_PRODUCT_NAME ,"Galileo" ), -DMI_MATCH (DMI_PRODUCT_FAMILY ,"Sephiroth" ), }, .driver_data = &quirk_valve_galileo, },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/143 drm/ttm: return ENOSPC from ttm_bo_mem_space v3
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian König <[email protected]>
[ Upstream commit 28e5126718c7b306b8c29d2ae8f48417e9303aa1 ]
Only convert it to ENOMEM in ttm_bo_validate.
This allows ttm_bo_validate to distinguish between an out of memory situation and just out of space in a placement domain.
v2: improve commit message
v3: fix kerneldoc typos
--- drivers/gpu/drm/ttm/ttm_bo.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpu/drm/ttm/ttm_bo.c +5 -2
@@ -770,7 +770,7 @@ static int ttm_bo_mem_force_space(struct ttm_buffer_object *bo,* This function may sleep while waiting for space to become available. * Returns: * -EBUSY: No space available (only if no_wait == 1). -* -ENOMEM: Could not allocate memory for the buffer object, either due to +* -ENOSPC: Could not allocate space for the buffer object, either due to * fragmentation or concurrent allocators. * -ERESTARTSYS: An interruptible sleep was interrupted by a signal. */
@@ -830,7 +830,7 @@ int ttm_bo_mem_space(struct ttm_buffer_object *bo, goto error; } - ret = -ENOMEM ; + ret = -ENOSPC ;if (!type_found) {pr_err (TTM_PFX "No compatible memory type found\n" ); ret = -EINVAL ;
@@ -916,6 +916,9 @@ int ttm_bo_validate(struct ttm_buffer_object *bo,return -EINVAL ; ret =ttm_bo_move_buffer (bo, placement, ctx); +/* For backward compatibility with userspace */ +if (ret == -ENOSPC ) +return -ENOMEM ;if (ret)return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/143 scsi: ufs: qcom: Avoid re-init quirk when gears match
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Chanudet <[email protected]>
[ Upstream commit 10a39667a117daf0c1baaebcbe589715ee79178b ]
On sa8775p-ride, probing the HBA will go through the UFSHCD_QUIRK_REINIT_AFTER_MAX_GEAR_SWITCH path although the power info is the same during the second init.
The REINIT quirk only applies starting with controller v4. For these, ufs_qcom_get_hs_gear() reads the highest supported gear when setting the host_params. After the negotiation, if the host and device are on the same gear, it is the highest gear supported between the two. Skip REINIT to save some time.
--- drivers/ufs/host/ufs-qcom.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/ufs/host/ufs-qcom.c +11 -2
@@ -738,8 +738,17 @@ static int ufs_qcom_pwr_change_notify(struct ufs_hba *hba,* the second init can program the optimal PHY settings. This allows one to start * the first init with either the minimum or the maximum support gear. */ -if (hba->ufshcd_state ==UFSHCD_STATE_RESET ) - host->phy_gear = dev_req_params->gear_tx; +if (hba->ufshcd_state ==UFSHCD_STATE_RESET ) { +/* +* Skip REINIT if the negotiated gear matches with the +* initial phy_gear. Otherwise, update the phy_gear to +* program the optimal gear setting during REINIT. +*/ +if (host->phy_gear == dev_req_params->gear_tx) + hba->quirks &= ~UFSHCD_QUIRK_REINIT_AFTER_MAX_GEAR_SWITCH ; +else + host->phy_gear = dev_req_params->gear_tx; + }/* enable the device ref clock before changing to HS mode */ if (!ufshcd_is_hs_mode(&hba->pwr_info) &&
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/143 drm/amd/display: increased min_dcfclk_mhz and min_fclk_mhz
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sohaib Nadeem <[email protected]>
[ Upstream commit d46fb0068c54d3dc95ae8298299c4d9edb0fb7c1 ]
[why]
Originally, PMFW said min FCLK is 300Mhz, but min DCFCLK can be increased to 400Mhz because min FCLK is now 600Mhz so FCLK >= 1.5 * DCFCLK hardware requirement will still be satisfied. Increasing min DCFCLK addresses underflow issues (underflow occurs when phantom pipe is turned on for some Sub-Viewport configs).
[how]
Increasing DCFCLK by raising the min_dcfclk_mhz
--- drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +1 -1
@@ -2760,7 +2760,7 @@ static int build_synthetic_soc_states(bool disable_dc_mode_overwrite, struct clkstruct _vcs_dpi_voltage_scaling_st entry = {0 };struct clk_limit_table_entry max_clk_data = {0 }; -unsigned int min_dcfclk_mhz =199 , min_fclk_mhz =299 ; +unsigned int min_dcfclk_mhz =399 , min_fclk_mhz =599 ;static const unsigned int num_dcfclk_stas =5 ;unsigned int dcfclk_sta_targets[DC__VOLTAGE_STATES ] = {199 ,615 ,906 ,1324 ,1564 };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/143 pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 3803584a4e9b65bb5b013f862f55c5055aa86c25 ]
If the number of provided enum IDs in a variable width config register description does not match the expected number, the checker uses the expected number for validating the individual enum IDs.
However, this may cause out-of-bounds accesses on the array holding the enum IDs, leading to bogus enum_id conflict warnings. Worse, if the bug is an incorrect bit field description (e.g. accidentally using "12" instead of "-12" for a reserved field), thousands of warnings may be printed, overflowing the kernel log buffer.
Fix this by limiting the enum ID check to the number of provided enum IDs.
--- drivers/pinctrl/renesas/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/pinctrl/renesas/core.c +3 -1
@@ -909,9 +909,11 @@ static void __init sh_pfc_check_cfg_reg(const char *drvname,sh_pfc_err ("reg 0x%x: var_field_width declares %u instead of %u bits\n" , cfg_reg->reg, rw, cfg_reg->reg_width); -if (n != cfg_reg->nr_enum_ids) +if (n != cfg_reg->nr_enum_ids) {sh_pfc_err ("reg 0x%x: enum_ids[] has %u instead of %u values\n" , cfg_reg->reg, cfg_reg->nr_enum_ids, n); + n = cfg_reg->nr_enum_ids; + } check_enum_ids:sh_pfc_check_reg_enums (drvname, cfg_reg->reg, cfg_reg->enum_ids, n);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/143 sysv: dont call sb_bread() with pointers_lock held
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit f123dc86388cb669c3d6322702dc441abc35c31e ]
syzbot is reporting sleep in atomic context in SysV filesystem [1], for sb_bread() is called with rw_spinlock held.
A "write_lock(&pointers_lock) => read_lock(&pointers_lock) deadlock" bug and a "sb_bread() with write_lock(&pointers_lock)" bug were introduced by "Replace BKL for chain locking with sysvfs-private rwlock" in Linux 2.5.12.
Then, "[PATCH] err1-40: sysvfs locking fix" in Linux 2.6.8 fixed the former bug by moving pointers_lock lock to the callers, but instead introduced a "sb_bread() with read_lock(&pointers_lock)" bug (which made this problem easier to hit).
Al Viro suggested that why not to do like get_branch()/get_block()/ find_shared() in Minix filesystem does. And doing like that is almost a revert of "[PATCH] err1-40: sysvfs locking fix" except that get_branch()
from with find_shared() is called without write_lock(&pointers_lock).
--- fs/sysv/itree.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
fs/sysv/itree.c +4 -6
@@ -83,9 +83,6 @@ static inline sysv_zone_t *block_end(struct buffer_head *bh)return (sysv_zone_t *)((char *)bh->b_data + bh->b_size); } -/* -* Requires read_lock(&pointers_lock) or write_lock(&pointers_lock) -*/ static Indirect *get_branch(struct inode *inode, int depth, int offsets[],
@@ -105,15 +102,18 @@ static Indirect *get_branch(struct inode *inode, bh =sb_bread (sb, block);if (!bh) goto failure; +read_lock (&pointers_lock);if (!verify_chain (chain, p)) goto changed;add_chain (++p, bh, (sysv_zone_t *)bh->b_data + *++offsets); +read_unlock (&pointers_lock);if (!p->key) goto no_block; }return NULL ; changed: +read_unlock (&pointers_lock);brelse (bh); *err = -EAGAIN ; goto no_block;
@@ -219,9 +219,7 @@ static int get_block(struct inode *inode, sector_t iblock, struct buffer_head *b goto out; reread: -read_lock (&pointers_lock); partial =get_branch (inode, depth, offsets, chain, &err); -read_unlock (&pointers_lock);/* Simplest case - block found, no allocation needed */ if (!partial) {
@@ -291,9 +289,9 @@ static Indirect *find_shared(struct inode *inode, *top =0 ;for (k = depth; k >1 && !offsets[k-1 ]; k--) ; + partial =get_branch (inode, k, offsets, chain, &err);write_lock (&pointers_lock); - partial =get_branch (inode, k, offsets, chain, &err);if (!partial) partial = chain + k-1 ;/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/143 scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 2ae917d4bcab80ab304b774d492e2fcd6c52c06b ]
The call to lpfc_sli4_resume_rpi() in lpfc_rcv_padisc() may return an unsuccessful status. In such cases, the elsiocb is not issued, the completion is not called, and thus the elsiocb resource is leaked.
Check return value after calling lpfc_sli4_resume_rpi() and conditionally release the elsiocb resource.
--- drivers/scsi/lpfc/lpfc_nportdisc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/scsi/lpfc/lpfc_nportdisc.c +4 -2
@@ -748,8 +748,10 @@ lpfc_rcv_padisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,/* Save the ELS cmd */ elsiocb->drvrTimeout = cmd; -lpfc_sli4_resume_rpi (ndlp, - lpfc_mbx_cmpl_resume_rpi, elsiocb); +if (lpfc_sli4_resume_rpi (ndlp, + lpfc_mbx_cmpl_resume_rpi, + elsiocb)) +kfree (elsiocb); goto out; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/143 drm/amd/display: Disable idle reallow as part of command/gpint execution
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Kazlauskas <[email protected]>
[ Upstream commit 6226a5aa77370329e01ee8abe50a95e60618ce97 ]
[Why]
Workaroud for a race condition where DMCUB is in the process of committing to IPS1 during the handshake causing us to miss the transition into IPS2 and touch the INBOX1 RPTR causing a HW hang.
[How]
Disable the reallow to ensure that we have enough of a gap between entry and exit and we're not seeing back-to-back wake_and_executes.
--- drivers/gpu/drm/amd/display/dc/dc.h | 1 + drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 4 ++-- .../gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c | 1 + 3 files changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dc.h +1 -0
@@ -987,6 +987,7 @@ struct dc_debug_options {bool psp_disabled_wa;unsigned int ips2_eval_delay_us;unsigned int ips2_entry_delay_us; +bool disable_dmub_reallow_idle;bool disable_timeout;bool disable_extblankadj;unsigned int static_screen_wait_frames;
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c +2 -2
@@ -1364,7 +1364,7 @@ bool dc_wake_and_execute_dmub_cmd_list(const struct dc_context *ctx, unsigned inelse result =dm_execute_dmub_cmd (ctx, cmd, wait_type); -if (result && reallow_idle) +if (result && reallow_idle && !ctx->dc->debug.disable_dmub_reallow_idle)dc_dmub_srv_apply_idle_power_optimizations (ctx->dc, true);return result;
@@ -1413,7 +1413,7 @@ bool dc_wake_and_execute_gpint(const struct dc_context *ctx, enum dmub_gpint_com result =dc_dmub_execute_gpint (ctx, command_code, param, response, wait_type); -if (result && reallow_idle) +if (result && reallow_idle && !ctx->dc->debug.disable_dmub_reallow_idle)dc_dmub_srv_apply_idle_power_optimizations (ctx->dc, true);return result;
drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c +1 -0
@@ -782,6 +782,7 @@ static const struct dc_debug_options debug_defaults_drv = { .psp_disabled_wa = true, .ips2_eval_delay_us = 2000, .ips2_entry_delay_us = 800, + .disable_dmub_reallow_idle = true, .static_screen_wait_frames = 2, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/143 isofs: handle CDs with bad root inode but good Joliet root directory
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Henrie <[email protected]>
[ Upstream commit 4243bf80c79211a8ca2795401add9c4a3b1d37ca ]
I have a CD copy of the original Tom Clancy's Ghost Recon game from 2001. The disc mounts without error on Windows, but on Linux mounting fails with the message "isofs_fill_super: get root inode failed". The error originates in isofs_read_inode, which returns -EIO because de_len is 0. The superblock on this disc appears to be intentionally corrupt as a form of copy protection.
When the root inode is unusable, instead of giving up immediately, try to continue with the Joliet file table. This fixes the Ghost Recon CD and probably other copy-protected CDs too.
Message-Id: <[email protected]>
--- fs/isofs/inode.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
fs/isofs/inode.c +16 -2
@@ -908,8 +908,22 @@ static int isofs_fill_super(struct super_block *s, void *data, int silent)* we then decide whether to use the Joliet descriptor. */ inode =isofs_iget (s, sbi->s_firstdatazone,0 ); -if (IS_ERR (inode)) - goto out_no_root; + +/* +* Fix for broken CDs with a corrupt root inode but a correct Joliet +* root directory. +*/ +if (IS_ERR (inode)) { +if (joliet_level && sbi->s_firstdatazone != first_data_zone) { +printk (KERN_NOTICE +"ISOFS: root inode is unusable. " +"Disabling Rock Ridge and switching to Joliet." ); + sbi->s_rock =0 ; + inode =NULL ; + }else { + goto out_no_root; + } + }/* * Fix for broken CDs with Rock Ridge and empty ISO root directory but
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/143 ASoC: Intel: sof_rt5682: dmi quirk cleanup for mtl boards
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brent Lu <[email protected]>
[ Upstream commit 7a2a8730d51f95b263a1e8b888598dc6395220dc ]
Some dmi quirks are duplicated since codec and amplifier type are removed from board quirk. Remove redundant quirks.
--- sound/soc/intel/boards/sof_rt5682.c | 40 ----------------------------- 1 file changed, 40 deletions(-)
sound/soc/intel/boards/sof_rt5682.c +0 -40
@@ -154,46 +154,6 @@ static const struct dmi_system_id sof_rt5682_quirk_table[] = {SOF_RT5682_SSP_AMP (2 ) | SOF_RT5682_NUM_HDMIDEV(4)), }, - { - .callback = sof_rt5682_quirk_cb, - .matches = { -DMI_MATCH (DMI_PRODUCT_FAMILY ,"Google_Rex" ), - DMI_MATCH(DMI_OEM_STRING, "AUDIO-MAX98360_ALC5682I_I2S"), - }, - .driver_data = (void *)(SOF_RT5682_MCLK_EN | -SOF_RT5682_SSP_CODEC (2 ) | -SOF_RT5682_SSP_AMP (0 ) | -SOF_RT5682_NUM_HDMIDEV (3 ) | -SOF_BT_OFFLOAD_SSP (1 ) | -SOF_SSP_BT_OFFLOAD_PRESENT - ), - }, - { - .callback = sof_rt5682_quirk_cb, - .matches = { -DMI_MATCH (DMI_PRODUCT_FAMILY ,"Google_Rex" ), - DMI_MATCH(DMI_OEM_STRING, "AUDIO-MAX98360_ALC5682I_DISCRETE_I2S_BT"), - }, - .driver_data = (void *)(SOF_RT5682_MCLK_EN | -SOF_RT5682_SSP_CODEC (2 ) | -SOF_RT5682_SSP_AMP (0 ) | -SOF_RT5682_NUM_HDMIDEV (3 ) | -SOF_BT_OFFLOAD_SSP (1 ) | -SOF_SSP_BT_OFFLOAD_PRESENT - ), - }, - { - .callback = sof_rt5682_quirk_cb, - .matches = { -DMI_MATCH (DMI_PRODUCT_FAMILY ,"Google_Rex" ), - DMI_MATCH(DMI_OEM_STRING, "AUDIO-ALC1019_ALC5682I_I2S"), - }, - .driver_data = (void *)(SOF_RT5682_MCLK_EN | -SOF_RT5682_SSP_CODEC (2 ) | -SOF_RT5682_SSP_AMP (0 ) | -SOF_RT5682_NUM_HDMIDEV (3 ) - ), - }, { .callback = sof_rt5682_quirk_cb, .matches = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/143 ASoC: Intel: common: DMI remap for rebranded Intel NUC M15 (LAPRC710) laptops
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: mosomate <[email protected]>
[ Upstream commit c13e03126a5be90781084437689724254c8226e1 ]
Added DMI quirk to handle the rebranded variants of Intel NUC M15 (LAPRC710) laptops. The DMI matching is based on motherboard attributes.
--- drivers/soundwire/dmi-quirks.c | 8 ++++++++ sound/soc/intel/boards/sof_sdw.c | 11 +++++++++++ 2 files changed, 19 insertions(+)
drivers/soundwire/dmi-quirks.c +8 -0
@@ -130,6 +130,14 @@ static const struct dmi_system_id adr_remap_quirk_table[] = { }, .driver_data = (void *)intel_rooks_county, }, + { +/* quirk used for NUC15 LAPRC710 skew */ + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"Intel Corporation" ), + DMI_MATCH(DMI_BOARD_NAME, "LAPRC710"), + }, + .driver_data = (void *)intel_rooks_county, + }, { .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"),
sound/soc/intel/boards/sof_sdw.c +11 -0
@@ -236,6 +236,17 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {SOF_SDW_PCH_DMIC | RT711_JD2_100K), }, + { +/* NUC15 LAPRC710 skews */ + .callback = sof_sdw_quirk_cb, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"Intel Corporation" ), + DMI_MATCH(DMI_BOARD_NAME, "LAPRC710"), + }, + .driver_data = (void *)(SOF_SDW_TGL_HDMI | +SOF_SDW_PCH_DMIC | + RT711_JD2_100K), + }, /* TigerLake-SDCA devices */ { .callback = sof_sdw_quirk_cb,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/143 rcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zqiang <[email protected]>
[ Upstream commit dda98810b552fc6bf650f4270edeebdc2f28bd3f ]
For the kernels built with CONFIG_RCU_NOCB_CPU_DEFAULT_ALL=y and CONFIG_RCU_LAZY=y, the following scenarios will trigger WARN_ON_ONCE() in the rcu_nocb_bypass_lock() and rcu_nocb_wait_contended() functions:
CPU2 CPU11
kthread
rcu_nocb_cb_kthread ksys_write
rcu_do_batch vfs_write
rcu_torture_timer_cb proc_sys_write
__kmem_cache_free proc_sys_call_handler
kmemleak_free drop_caches_sysctl_handler
delete_object_full drop_slab
__delete_object shrink_slab
put_object lazy_rcu_shrink_scan
call_rcu rcu_nocb_flush_bypass
__call_rcu_commn rcu_nocb_bypass_lock
raw_spin_trylock(&rdp->nocb_bypass_lock) fail
atomic_inc(&rdp->nocb_lock_contended);
rcu_nocb_wait_contended WARN_ON_ONCE(smp_processor_id() != rdp->cpu);
WARN_ON_ONCE(atomic_read(&rdp->nocb_lock_contended)) |
|_ _ _ _ _ _ _ _ _ _same rdp and rdp->cpu != 11_ _ _ _ _ _ _ _ _ __|Reproduce this bug with "echo 3 > /proc/sys/vm/drop_caches".
This commit therefore uses rcu_nocb_try_flush_bypass() instead of rcu_nocb_flush_bypass() in lazy_rcu_shrink_scan(). If the nocb_bypass queue is being flushed, then rcu_nocb_try_flush_bypass will return directly.
--- kernel/rcu/tree_nocb.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/rcu/tree_nocb.h +1 -1
@@ -1383,7 +1383,7 @@ lazy_rcu_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)rcu_nocb_unlock_irqrestore (rdp, flags);continue ; } -WARN_ON_ONCE (!rcu_nocb_flush_bypass (rdp,NULL , jiffies, false)); +rcu_nocb_try_flush_bypass (rdp, jiffies);rcu_nocb_unlock_irqrestore (rdp, flags);wake_nocb_gp (rdp, false); sc->nr_to_scan -= _count;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/143 rcu-tasks: Repair RCU Tasks Trace quiescence check
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul E. McKenney <[email protected]>
[ Upstream commit 2eb52fa8900e642b3b5054c4bf9776089d2a935f ]
The context-switch-time check for RCU Tasks Trace quiescence expects current->trc_reader_special.b.need_qs to be zero, and if so, updates it to TRC_NEED_QS_CHECKED. This is backwards, because if this value is zero, there is no RCU Tasks Trace grace period in flight, an thus no need for a quiescent state. Instead, when a grace period starts, this field is set to TRC_NEED_QS.
This commit therefore changes the check from zero to TRC_NEED_QS.
--- include/linux/rcupdate.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/rcupdate.h +2 -2
@@ -184,9 +184,9 @@ void rcu_tasks_trace_qs_blkd(struct task_struct *t); do { \ int ___rttq_nesting = READ_ONCE((t)->trc_reader_nesting); \ \ - if (likely(!READ_ONCE((t)->trc_reader_special.b.need_qs)) && \ + if (unlikely(READ_ONCE((t)->trc_reader_special.b.need_qs) == TRC_NEED_QS) && \ likely(!___rttq_nesting)) { \ - rcu_trc_cmpxchg_need_qs((t), 0, TRC_NEED_QS_CHECKED); \ + rcu_trc_cmpxchg_need_qs((t), TRC_NEED_QS, TRC_NEED_QS_CHECKED); \ } else if (___rttq_nesting && ___rttq_nesting != INT_MIN && \ !READ_ONCE((t)->trc_reader_special.b.blocked)) { \ rcu_tasks_trace_qs_blkd(t); \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/143 Julia Lawall reported this null pointer dereference, this should fix it.
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marshall <[email protected]>
[ Upstream commit 9bf93dcfc453fae192fe5d7874b89699e8f800ac ]
--- fs/orangefs/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/orangefs/super.c +1 -1
@@ -527,7 +527,7 @@ struct dentry *orangefs_mount(struct file_system_type *fst, sb->s_fs_info =kzalloc (sizeof (struct orangefs_sb_info_s ),GFP_KERNEL );if (!ORANGEFS_SB (sb)) { d =ERR_PTR (-ENOMEM ); - goto free_sb_and_op; + goto free_op; } ret = orangefs_fill_sb(sb,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/143 media: sta2x11: fix irq handler cast
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 3de49ae81c3a0f83a554ecbce4c08e019f30168e ]
clang-16 warns about casting incompatible function pointers:
drivers/media/pci/sta2x11/sta2x11_vip.c:1057:6: error: cast from 'irqreturn_t (*)(int, struct sta2x11_vip *)' (aka 'enum irqreturn (*)(int, struct sta2x11_vip *)') to 'irq_handler_t' (aka 'enum irqreturn (*)(int, void *)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
Change the prototype of the irq handler to the regular version with a local variable to adjust the argument type.
--- drivers/media/pci/sta2x11/sta2x11_vip.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/media/pci/sta2x11/sta2x11_vip.c +4 -5
@@ -757,7 +757,7 @@ static const struct video_device video_dev_template = {/** * vip_irq - interrupt routine * @irq: Number of interrupt ( not used, correct number is assumed ) -* @vip: local data structure containing all information +* @data: local data structure containing all information * * check for both frame interrupts set ( top and bottom ). * check FIFO overflow, but limit number of log messages after open.
@@ -767,8 +767,9 @@ static const struct video_device video_dev_template = {* * IRQ_HANDLED, interrupt done. */ -static irqreturn_t vip_irq (int irq,struct sta2x11_vip *vip) +static irqreturn_t vip_irq (int irq,void *data) { +struct sta2x11_vip *vip = data;unsigned int status; status =reg_read (vip,DVP_ITS );
@@ -1053,9 +1054,7 @@ static int sta2x11_vip_init_one(struct pci_dev *pdev,spin_lock_init (&vip->slock); - ret =request_irq (pdev->irq, - (irq_handler_t ) vip_irq, -IRQF_SHARED ,KBUILD_MODNAME , vip); + ret =request_irq (pdev->irq, vip_irq,IRQF_SHARED ,KBUILD_MODNAME , vip);if (ret) {dev_err (&pdev->dev,"request_irq failed\n" ); ret = -ENODEV ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/143 ALSA: firewire-lib: handle quirk to calculate payload quadlets as data block counter
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <[email protected]>
[ Upstream commit 4a486439d2ca85752c46711f373b6ddc107bb35d ]
Miglia Harmony Audio (OXFW970) has a quirk to put the number of accumulated quadlets in CIP payload into the dbc field of CIP header.
This commit handles the quirk in the packet processing layer.
--- sound/firewire/amdtp-stream.c | 12 ++++++++---- sound/firewire/amdtp-stream.h | 4 ++++ 2 files changed, 12 insertions(+), 4 deletions(-)
sound/firewire/amdtp-stream.c +8 -4
@@ -773,10 +773,14 @@ static int check_cip_header(struct amdtp_stream *s, const __be32 *buf, }else {unsigned int dbc_interval; -if (*data_blocks >0 && s->ctx_data.tx.dbc_interval >0 ) - dbc_interval = s->ctx_data.tx.dbc_interval; -else - dbc_interval = *data_blocks; +if (!(s->flags &CIP_DBC_IS_PAYLOAD_QUADLETS )) { +if (*data_blocks >0 && s->ctx_data.tx.dbc_interval >0 ) + dbc_interval = s->ctx_data.tx.dbc_interval; +else + dbc_interval = *data_blocks; + }else { + dbc_interval = payload_length /sizeof (__be32); + } lost = dbc != ((*data_block_counter + dbc_interval) &0xff ); }
sound/firewire/amdtp-stream.h +4 -0
@@ -37,6 +37,9 @@* the value of current SYT_INTERVAL; e.g. initial value is not zero. * @CIP_UNAWARE_SYT: For outgoing packet, the value in SYT field of CIP is 0xffff. * For incoming packet, the value in SYT field of CIP is not handled. +* @CIP_DBC_IS_PAYLOAD_QUADLETS: Available for incoming packet, and only effective with +* CIP_DBC_IS_END_EVENT flag. The value of dbc field is the number of accumulated quadlets +* in CIP payload, instead of the number of accumulated data blocks. */ enum cip_flags {CIP_NONBLOCKING =0x00 ,
@@ -51,6 +54,7 @@ enum cip_flags {CIP_NO_HEADER =0x100 ,CIP_UNALIGHED_DBC =0x200 ,CIP_UNAWARE_SYT =0x400 , + CIP_DBC_IS_PAYLOAD_QUADLETS = 0x800, };/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/143 drm/panel: simple: Add BOE BP082WX1-100 8.2" panel
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
[ Upstream commit dc90214ff58be575fdceb549f901506cdef5d093 ]
The BOE BP082WX1-100 is a 8.2" panel similar to the 10.1" panel BP101WX1-100. Both panels use the same timings.
--- drivers/gpu/drm/panel/panel-simple.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/gpu/drm/panel/panel-simple.c +20 -0
@@ -1367,6 +1367,23 @@ static const struct drm_display_mode boe_bp101wx1_100_mode = { .vtotal = 800 + 6 + 8 + 2, }; +static const struct panel_desc boe_bp082wx1_100 = { + .modes = &boe_bp101wx1_100_mode, + .num_modes =1 , + .bpc =8 , + .size = { + .width =177 , + .height =110 , + }, + .delay = { + .enable =50 , + .disable =50 , + }, + .bus_format =MEDIA_BUS_FMT_RGB888_1X7X4_JEIDA , + .bus_flags =DRM_BUS_FLAG_DE_HIGH , + .connector_type =DRM_MODE_CONNECTOR_LVDS , +}; +static const struct panel_desc boe_bp101wx1_100 = { .modes = &boe_bp101wx1_100_mode, .num_modes =1 ,
@@ -4345,6 +4362,9 @@ static const struct of_device_id platform_of_match[] = { }, { .compatible = "bananapi,s070wv20-ct16", .data = &bananapi_s070wv20_ct16, + }, { + .compatible = "boe,bp082wx1-100", + .data = &boe_bp082wx1_100, }, { .compatible = "boe,bp101wx1-100", .data = &boe_bp101wx1_100,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/143 x86/vdso: Fix rethunk patching for vdso-image-{32,64}.o
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit b388e57d4628eb22782bdad4cd5b83ca87a1b7c9 ]
For CONFIG_RETHUNK kernels, objtool annotates all the function return sites so they can be patched during boot. By design, after apply_returns() is called, all tail-calls to the compiler-generated default return thunk (__x86_return_thunk) should be patched out and replaced with whatever's needed for any mitigations (or lack thereof).
The commit
4461438a8405 ("x86/retpoline: Ensure default return thunk isn't used at runtime")
adds a runtime check and a WARN_ONCE() if the default return thunk ever gets executed after alternatives have been applied. This warning is a sanity check to make sure objtool and apply_returns() are doing their job.
As Nathan reported, that check found something:
Unpatched return thunk in use. This should not happen!
WARNING: CPU: 0 PID: 1 at arch/x86/kernel/cpu/bugs.c:2856 __warn_thunk+0x27/0x40 RIP: 0010:__warn_thunk+0x27/0x40 Call Trace: <TASK> ? show_regs ? __warn ? __warn_thunk ? report_bug ? console_unlock ? handle_bug ? exc_invalid_op ? asm_exc_invalid_op ? ia32_binfmt_init ? __warn_thunk warn_thunk_thunk do_one_initcall kernel_init_freeable ? __pfx_kernel_init kernel_init ret_from_fork ? __pfx_kernel_init ret_from_fork_asm </TASK>
Boris debugged to find that the unpatched return site was in init_vdso_image_64(), and its translation unit wasn't being analyzed by objtool, so it never got annotated. So it got ignored by apply_returns().
This is only a minor issue, as this function is only called during boot. Still, objtool needs full visibility to the kernel. Fix it by enabling objtool on vdso-image-{32,64}.o.
Note this problem can only be seen with !CONFIG_X86_KERNEL_IBT, as that requires objtool to run individually on all translation units rather on vmlinux.o.
[ bp: Massage commit message. ]
--- arch/x86/entry/vdso/Makefile | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
arch/x86/entry/vdso/Makefile +6 -3
@@ -34,8 +34,12 @@ obj-y += vma.o extable.o KASAN_SANITIZE_vma.o := y UBSAN_SANITIZE_vma.o := y KCSAN_SANITIZE_vma.o := y -OBJECT_FILES_NON_STANDARD_vma.o := n -OBJECT_FILES_NON_STANDARD_extable.o := n + +OBJECT_FILES_NON_STANDARD_extable.o := n +OBJECT_FILES_NON_STANDARD_vdso-image-32.o := n +OBJECT_FILES_NON_STANDARD_vdso-image-64.o := n +OBJECT_FILES_NON_STANDARD_vdso32-setup.o := n +OBJECT_FILES_NON_STANDARD_vma.o := n # vDSO images to build vdso_img-$(VDSO64-y) += 64
@@ -43,7 +47,6 @@ vdso_img-$(VDSOX32-y) += x32 vdso_img-$(VDSO32-y) += 32 obj-$(VDSO32-y) += vdso32-setup.o -OBJECT_FILES_NON_STANDARD_vdso32-setup.o := n vobjs := $(foreach F,$(vobjs-y),$(obj)/$F) vobjs32 := $(foreach F,$(vobjs32-y),$(obj)/$F)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/143 ASoC: Intel: avs: Populate board selection with new I2S entries
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cezary Rojewski <[email protected]>
[ Upstream commit 5b417fe0cded0b5917683398e6519aae8045cd40 ]
Update board selection with tables specifying supported I2S configurations. DMIC/HDAudio board selection require no update as dmic/hdaudio machine boards are generic and not tied to any specific codec.
--- sound/soc/intel/avs/board_selection.c | 85 +++++++++++++++++++++++++++ 1 file changed, 85 insertions(+)
sound/soc/intel/avs/board_selection.c +85 -0
@@ -236,6 +236,82 @@ static struct snd_soc_acpi_mach avs_gml_i2s_machines[] = { {}, }; +static struct snd_soc_acpi_mach avs_cnl_i2s_machines[] = { + { + .id ="INT34C2" , + .drv_name ="avs_rt274" , + .mach_params = { + .i2s_link_mask =AVS_SSP (0 ), + }, + .tplg_filename ="rt274-tplg.bin" , + }, + { + .id ="10EC5682" , + .drv_name ="avs_rt5682" , + .mach_params = { + .i2s_link_mask =AVS_SSP (1 ), + }, + .tplg_filename ="rt5682-tplg.bin" , + }, + {}, +}; + +static struct snd_soc_acpi_mach avs_icl_i2s_machines[] = { + { + .id ="INT343A" , + .drv_name ="avs_rt298" , + .mach_params = { + .i2s_link_mask =AVS_SSP (0 ), + }, + .tplg_filename ="rt298-tplg.bin" , + }, + { + .id ="INT34C2" , + .drv_name ="avs_rt274" , + .mach_params = { + .i2s_link_mask =AVS_SSP (0 ), + }, + .tplg_filename ="rt274-tplg.bin" , + }, + {}, +}; + +static struct snd_soc_acpi_mach avs_tgl_i2s_machines[] = { + { + .id ="INT34C2" , + .drv_name ="avs_rt274" , + .mach_params = { + .i2s_link_mask =AVS_SSP (0 ), + }, + .tplg_filename ="rt274-tplg.bin" , + }, + { + .id ="10EC0298" , + .drv_name ="avs_rt298" , + .mach_params = { + .i2s_link_mask =AVS_SSP (0 ), + }, + .tplg_filename ="rt298-tplg.bin" , + }, + { + .id ="10EC1308" , + .drv_name ="avs_rt1308" , + .mach_params = { + .i2s_link_mask =AVS_SSP (1 ), + }, + .tplg_filename ="rt1308-tplg.bin" , + }, + { + .id ="ESSX8336" , + .drv_name ="avs_es8336" , + .mach_params = { + .i2s_link_mask =AVS_SSP (0 ), + }, + .tplg_filename ="es8336-tplg.bin" , + }, + {}, +}; +static struct snd_soc_acpi_mach avs_test_i2s_machines[] = { { .drv_name ="avs_i2s_test" ,
@@ -296,6 +372,15 @@ static const struct avs_acpi_boards i2s_boards[] = {AVS_MACH_ENTRY (HDA_KBL_LP , avs_kbl_i2s_machines),AVS_MACH_ENTRY (HDA_APL , avs_apl_i2s_machines),AVS_MACH_ENTRY (HDA_GML , avs_gml_i2s_machines), +AVS_MACH_ENTRY (HDA_CNL_LP , avs_cnl_i2s_machines), +AVS_MACH_ENTRY (HDA_CNL_H , avs_cnl_i2s_machines), +AVS_MACH_ENTRY (HDA_CML_LP , avs_cnl_i2s_machines), +AVS_MACH_ENTRY (HDA_ICL_LP , avs_icl_i2s_machines), +AVS_MACH_ENTRY (HDA_TGL_LP , avs_tgl_i2s_machines), +AVS_MACH_ENTRY (HDA_EHL_0 , avs_tgl_i2s_machines), +AVS_MACH_ENTRY (HDA_ADL_P , avs_tgl_i2s_machines), +AVS_MACH_ENTRY (HDA_RPL_P_0 , avs_tgl_i2s_machines), + AVS_MACH_ENTRY(HDA_RPL_M, avs_tgl_i2s_machines), {}, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/143 ext4: add a hint for block bitmap corrupt state in mb_groups
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
[ Upstream commit 68ee261fb15457ecb17e3683cb4e6a4792ca5b71 ]
If one group is marked as block bitmap corrupted, its free blocks cannot be used and its free count is also deducted from the global sbi->s_freeclusters_counter. User might be confused about the absent free space because we can't query the information about corrupted block groups except unreliable error messages in syslog. So add a hint to show block bitmap corrupted groups in mb_groups.
--- fs/ext4/mballoc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/ext4/mballoc.c +4 -1
@@ -3059,7 +3059,10 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v)for (i =0 ; i <=13 ; i++)seq_printf (seq," %-5u" , i <= blocksize_bits +1 ? sg.info.bb_counters[i] :0 ); -seq_puts (seq," ]\n" ); +seq_puts (seq," ]" ); +if (EXT4_MB_GRP_BBITMAP_CORRUPT (&sg.info)) +seq_puts (seq," Block bitmap corrupted!" ); +seq_puts (seq,"\n" );return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/143 ext4: forbid commit inconsistent quota data when errors=remount-ro
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
[ Upstream commit d8b945fa475f13d787df00c26a6dc45a3e2e1d1d ]
There's issue as follows When do IO fault injection test:
Quota error (device dm-3): find_block_dqentry: Quota for id 101 referenced but not present Quota error (device dm-3): qtree_read_dquot: Can't read quota structure for id 101 Quota error (device dm-3): do_check_range: Getting block 2021161007 out of range 1-186 Quota error (device dm-3): qtree_read_dquot: Can't read quota structure for id 661
Now, ext4_write_dquot()/ext4_acquire_dquot()/ext4_release_dquot() may commit inconsistent quota data even if process failed. This may lead to filesystem corruption.
To ensure filesystem consistent when errors=remount-ro there is need to call ext4_handle_error() to abort journal.
--- fs/ext4/super.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
fs/ext4/super.c +12 -0
@@ -6864,6 +6864,10 @@ static int ext4_write_dquot(struct dquot *dquot)if (IS_ERR (handle))return PTR_ERR (handle); ret =dquot_commit (dquot); +if (ret <0 ) +ext4_error_err (dquot->dq_sb, -ret, +"Failed to commit dquot type %d" , + dquot->dq_id.type); err =ext4_journal_stop (handle);if (!ret) ret = err;
@@ -6880,6 +6884,10 @@ static int ext4_acquire_dquot(struct dquot *dquot)if (IS_ERR (handle))return PTR_ERR (handle); ret =dquot_acquire (dquot); +if (ret <0 ) +ext4_error_err (dquot->dq_sb, -ret, +"Failed to acquire dquot type %d" , + dquot->dq_id.type); err =ext4_journal_stop (handle);if (!ret) ret = err;
@@ -6899,6 +6907,10 @@ static int ext4_release_dquot(struct dquot *dquot)return PTR_ERR (handle); } ret =dquot_release (dquot); +if (ret <0 ) +ext4_error_err (dquot->dq_sb, -ret, +"Failed to release dquot type %d" , + dquot->dq_id.type); err =ext4_journal_stop (handle);if (!ret) ret = err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/143 drm/amd/display: Fix nanosec stat overflow
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aric Cyr <[email protected]>
[ Upstream commit 14d68acfd04b39f34eea7bea65dda652e6db5bf6 ]
[Why]
Nanosec stats can overflow on long running systems potentially causing statistic logging issues.
[How]
Use 64bit types for nanosec stats to ensure no overflow.
--- drivers/gpu/drm/amd/display/modules/inc/mod_stats.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/modules/inc/mod_stats.h +2 -2
@@ -57,10 +57,10 @@ void mod_stats_update_event(struct mod_stats *mod_stats, unsigned int length);void mod_stats_update_flip (struct mod_stats *mod_stats, -unsigned long timestamp_in_ns); +unsigned long long timestamp_in_ns);void mod_stats_update_vupdate (struct mod_stats *mod_stats, -unsigned long timestamp_in_ns); +unsigned long long timestamp_in_ns); void mod_stats_update_freesync(struct mod_stats *mod_stats, unsigned int v_total_min,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/143 accel/habanalabs: increase HL_MAX_STR to 64 bytes to avoid warnings
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koby Elbaz <[email protected]>
[ Upstream commit 8c075401f2dbda43600c61f780a165abde77877a ]
Fix a warning of a buffer overflow:
‘snprintf’ output between 38 and 47 bytes into a destination of size 32
--- drivers/accel/habanalabs/common/habanalabs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/accel/habanalabs/common/habanalabs.h +1 -1
@@ -2547,7 +2547,7 @@ struct hl_state_dump_specs {* DEVICES */ -#define HL_STR_MAX 32 +#define HL_STR_MAX 64#define HL_DEV_STS_MAX (HL_DEVICE_STATUS_LAST + 1)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/143 i2c: designware: Fix RX FIFO depth define on Wangxun 10Gb NIC
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Nikula <[email protected]>
[ Upstream commit c94612a72ac87b0337a0d85b9263266776ed4190 ]
I believe RX FIFO depth define 0 is incorrect on Wangxun 10Gb NIC. It must be at least 1 since code is able to read received data from the DW_IC_DATA_CMD register.
For now this define is irrelevant since the txgbe_i2c_dw_xfer_quirk() doesn't use the rx_fifo_depth member variable of struct dw_i2c_dev but is needed when converting code into generic polling mode implementation.
--- drivers/i2c/busses/i2c-designware-core.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-designware-core.h +1 -1
@@ -318,7 +318,7 @@ struct dw_i2c_dev {#define AMD_UCSI_INTR_EN 0xd#define TXGBE_TX_FIFO_DEPTH 4 -#define TXGBE_RX_FIFO_DEPTH 0 +#define TXGBE_RX_FIFO_DEPTH 1struct i2c_dw_semaphore_callbacks {int (*probe)(struct dw_i2c_dev *dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/143 HID: input: avoid polling stylus battery on Chromebook Pompom
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit 9a5b1521e2d0d7ace70c6e5eed073babcec91409 ]
Internal touchscreen on Trogdor Pompom (AKA Dynabook Chromebook C1) supports USI stylus. Unfortunately the HID descriptor for the stylus interface does not contain "Stylus" physical collection, which makes the kernel to try and pull battery information, resulting in errors.
Apply HID_BATTERY_QUIRK_AVOID_QUERY to the device.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-input.c | 2 ++ 2 files changed, 3 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -430,6 +430,7 @@#define I2C_DEVICE_ID_HP_SPECTRE_X360_14T_EA100_V1 0x2BED#define I2C_DEVICE_ID_HP_SPECTRE_X360_14T_EA100_V2 0x2BEE#define I2C_DEVICE_ID_HP_ENVY_X360_15_EU0556NG 0x2D02 +#define I2C_DEVICE_ID_CHROMEBOOK_TROGDOR_POMPOM 0x2F81#define USB_VENDOR_ID_ELECOM 0x056e#define USB_DEVICE_ID_ELECOM_BM084 0x0061
drivers/hid/hid-input.c +2 -0
@@ -411,6 +411,8 @@ static const struct hid_device_id hid_battery_quirks[] = { HID_BATTERY_QUIRK_IGNORE }, {HID_I2C_DEVICE (USB_VENDOR_ID_ELAN ,I2C_DEVICE_ID_HP_ENVY_X360_15_EU0556NG ), HID_BATTERY_QUIRK_IGNORE }, + { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_CHROMEBOOK_TROGDOR_POMPOM), + HID_BATTERY_QUIRK_AVOID_QUERY }, {} };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/143 drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit eb4f139888f636614dab3bcce97ff61cefc4b3a7 ]
This ensures that the memory mapped by ioremap for adev->rmmio, is properly handled in amdgpu_device_init(). If the function exits early due to an error, the memory is unmapped. If the function completes successfully, the memory remains mapped.
Reported by smatch:drivers/gpu/drm/amd/amdgpu/amdgpu_device.c:4337 amdgpu_device_init() warn: 'adev->rmmio' from ioremap() not released on lines: 4035,4045,4051,4058,4068,4337
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +10 -6
@@ -4025,8 +4025,10 @@ int amdgpu_device_init(struct amdgpu_device *adev,* early on during init and before calling to RREG32. */ adev->reset_domain =amdgpu_reset_create_reset_domain (SINGLE_DEVICE ,"amdgpu-reset-dev" ); -if (!adev->reset_domain) -return -ENOMEM ; +if (!adev->reset_domain) { + r = -ENOMEM ; + goto unmap_memory; + }/* detect hw virtualization here */ amdgpu_detect_virtualization (adev);
@@ -4036,20 +4038,20 @@ int amdgpu_device_init(struct amdgpu_device *adev, r =amdgpu_device_get_job_timeout_settings (adev);if (r) {dev_err (adev->dev,"invalid lockup_timeout parameter syntax\n" ); -return r; + goto unmap_memory; }/* early init functions */ r =amdgpu_device_ip_early_init (adev);if (r) -return r; + goto unmap_memory;amdgpu_device_set_mcbp (adev);/* Get rid of things like offb */ r =drm_aperture_remove_conflicting_pci_framebuffers (adev->pdev, &amdgpu_kms_driver);if (r) -return r; + goto unmap_memory;/* Enable TMZ based on IP_VERSION */ amdgpu_gmc_tmz_set (adev);
@@ -4059,7 +4061,7 @@ int amdgpu_device_init(struct amdgpu_device *adev,if (adev->gmc.xgmi.supported) { r = adev->gfxhub.funcs->get_xgmi_info (adev);if (r) -return r; + goto unmap_memory; }/* enable PCIE atomic ops */
@@ -4328,6 +4330,8 @@ int amdgpu_device_init(struct amdgpu_device *adev, failed:amdgpu_vf_error_trans_all (adev); +unmap_memory: +iounmap (adev->rmmio);return r; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/143 drm: Check output polling initialized before disabling
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shradha Gupta <[email protected]>
[ Upstream commit 5abffb66d12bcac84bf7b66389c571b8bb6e82bd ]
In drm_kms_helper_poll_disable() check if output polling support is initialized before disabling polling. If not flag this as a warning.
Additionally in drm_mode_config_helper_suspend() and drm_mode_config_helper_resume() calls, that re the callers of these functions, avoid invoking them if polling is not initialized. For drivers like hyperv-drm, that do not initialize connector polling, if suspend is called without this check, it leads to suspend failure with following stack
[ 770.719392] Freezing remaining freezable tasks ... (elapsed 0.001 seconds) done. [ 770.720592] printk: Suspending console(s) (use no_console_suspend to debug) [ 770.948823] ------------[ cut here ]------------ [ 770.948824] WARNING: CPU: 1 PID: 17197 at kernel/workqueue.c:3162 __flush_work.isra.0+0x212/0x230 [ 770.948831] Modules linked in: rfkill nft_counter xt_conntrack xt_owner udf nft_compat crc_itu_t nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables nfnetlink vfat fat mlx5_ib ib_uverbs ib_core mlx5_core intel_rapl_msr intel_rapl_common kvm_amd ccp mlxfw kvm psample hyperv_drm tls drm_shmem_helper drm_kms_helper irqbypass pcspkr syscopyarea sysfillrect sysimgblt hv_balloon hv_utils joydev drm fuse xfs libcrc32c pci_hyperv pci_hyperv_intf sr_mod sd_mod cdrom t10_pi sg hv_storvsc scsi_transport_fc hv_netvsc serio_raw hyperv_keyboard hid_hyperv crct10dif_pclmul crc32_pclmul crc32c_intel hv_vmbus ghash_clmulni_intel dm_mirror dm_region_hash dm_log dm_mod [ 770.948863] CPU: 1 PID: 17197 Comm: systemd-sleep Not tainted 5.14.0-362.2.1.el9_3.x86_64 #1 [ 770.948865] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 05/09/2022 [ 770.948866] RIP: 0010:__flush_work.isra.0+0x212/0x230 [ 770.948869] Code: 8b 4d 00 4c 8b 45 08 89 ca 48 c1 e9 04 83 e2 08 83 e1 0f 83 ca 02 89 c8 48 0f ba 6d 00 03 e9 25 ff ff ff 0f 0b e9 4e ff ff ff <0f> 0b 45 31 ed e9 44 ff ff ff e8 8f 89 b2 00 66 66 2e 0f 1f 84 00 [ 770.948870] RSP: 0018:ffffaf4ac213fb10 EFLAGS: 00010246 [ 770.948871] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8c992857 [ 770.948872] RDX: 0000000000000001 RSI: 0000000000000001 RDI: ffff9aad82b00330 [ 770.948873] RBP: ffff9aad82b00330 R08: 0000000000000000 R09: ffff9aad87ee3d10 [ 770.948874] R10: 0000000000000200 R11: 0000000000000000 R12: ffff9aad82b00330 [ 770.948874] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 770.948875] FS: 00007ff1b2f6bb40(0000) GS:ffff9aaf37d00000(0000) knlGS:0000000000000000 [ 770.948878] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 770.948878] CR2: 0000555f345cb666 CR3: 00000001462dc005 CR4: 0000000000370ee0 [ 770.948879] Call Trace: [ 770.948880] <TASK> [ 770.948881] ? show_trace_log_lvl+0x1c4/0x2df [ 770.948884] ? show_trace_log_lvl+0x1c4/0x2df [ 770.948886] ? __cancel_work_timer+0x103/0x190 [ 770.948887] ? __flush_work.isra.0+0x212/0x230 [ 770.948889] ? __warn+0x81/0x110 [ 770.948891] ? __flush_work.isra.0+0x212/0x230 [ 770.948892] ? report_bug+0x10a/0x140 [ 770.948895] ? handle_bug+0x3c/0x70 [ 770.948898] ? exc_invalid_op+0x14/0x70 [ 770.948899] ? asm_exc_invalid_op+0x16/0x20 [ 770.948903] ? __flush_work.isra.0+0x212/0x230 [ 770.948905] __cancel_work_timer+0x103/0x190 [ 770.948907] ? _raw_spin_unlock_irqrestore+0xa/0x30 [ 770.948910] drm_kms_helper_poll_disable+0x1e/0x40 [drm_kms_helper] [ 770.948923] drm_mode_config_helper_suspend+0x1c/0x80 [drm_kms_helper] [ 770.948933] ? __pfx_vmbus_suspend+0x10/0x10 [hv_vmbus] [ 770.948942] hyperv_vmbus_suspend+0x17/0x40 [hyperv_drm] [ 770.948944] ? __pfx_vmbus_suspend+0x10/0x10 [hv_vmbus] [ 770.948951] dpm_run_callback+0x4c/0x140 [ 770.948954] __device_suspend_noirq+0x74/0x220 [ 770.948956] dpm_noirq_suspend_devices+0x148/0x2a0 [ 770.948958] dpm_suspend_end+0x54/0xe0 [ 770.948960] create_image+0x14/0x290 [ 770.948963] hibernation_snapshot+0xd6/0x200 [ 770.948964] hibernate.cold+0x8b/0x1fb [ 770.948967] state_store+0xcd/0xd0 [ 770.948969] kernfs_fop_write_iter+0x124/0x1b0 [ 770.948973] new_sync_write+0xff/0x190 [ 770.948976] vfs_write+0x1ef/0x280 [ 770.948978] ksys_write+0x5f/0xe0 [ 770.948979] do_syscall_64+0x5c/0x90 [ 770.948981] ? syscall_exit_work+0x103/0x130 [ 770.948983] ? syscall_exit_to_user_mode+0x12/0x30 [ 770.948985] ? do_syscall_64+0x69/0x90 [ 770.948986] ? do_syscall_64+0x69/0x90 [ 770.948987] ? do_user_addr_fault+0x1d6/0x6a0 [ 770.948989] ? do_syscall_64+0x69/0x90 [ 770.948990] ? exc_page_fault+0x62/0x150 [ 770.948992] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 770.948995] RIP: 0033:0x7ff1b293eba7 [ 770.949010] Code: 0b 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 [ 770.949011] RSP: 002b:00007ffde3912128 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 770.949012] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007ff1b293eba7 [ 770.949013] RDX: 0000000000000005 RSI: 00007ffde3912210 RDI: 0000000000000004 [ 770.949014] RBP: 00007ffde3912210 R08: 000055d7dd4c9510 R09: 00007ff1b29b14e0 [ 770.949014] R10: 00007ff1b29b13e0 R11: 0000000000000246 R12: 0000000000000005 [ 770.949015] R13: 000055d7dd4c53e0 R14: 0000000000000005 R15: 00007ff1b29f69e0 [ 770.949016] </TASK> [ 770.949017] ---[ end trace e6fa0618bfa2f31d ]---
Built-on: Rhel9, Ubuntu22
--- drivers/gpu/drm/drm_modeset_helper.c | 19 ++++++++++++++++--- drivers/gpu/drm/drm_probe_helper.c | 13 +++++++++++-- 2 files changed, 27 insertions(+), 5 deletions(-)
drivers/gpu/drm/drm_modeset_helper.c +16 -3
@@ -193,13 +193,22 @@ int drm_mode_config_helper_suspend(struct drm_device *dev)if (!dev)return 0 ; +/* +* Don't disable polling if it was never initialized +*/ +if (dev->mode_config.poll_enabled) +drm_kms_helper_poll_disable (dev); -drm_kms_helper_poll_disable (dev);drm_fb_helper_set_suspend_unlocked (dev->fb_helper,1 ); state =drm_atomic_helper_suspend (dev);if (IS_ERR (state)) {drm_fb_helper_set_suspend_unlocked (dev->fb_helper,0 ); -drm_kms_helper_poll_enable (dev); +/* +* Don't enable polling if it was never initialized +*/ +if (dev->mode_config.poll_enabled) +drm_kms_helper_poll_enable (dev); +return PTR_ERR (state); }
@@ -239,7 +248,11 @@ int drm_mode_config_helper_resume(struct drm_device *dev) dev->mode_config.suspend_state =NULL ;drm_fb_helper_set_suspend_unlocked (dev->fb_helper,0 ); -drm_kms_helper_poll_enable (dev); +/* +* Don't enable polling if it is not initialized +*/ +if (dev->mode_config.poll_enabled) +drm_kms_helper_poll_enable (dev);return ret; }
drivers/gpu/drm/drm_probe_helper.c +11 -2
@@ -293,14 +293,17 @@ static void reschedule_output_poll_work(struct drm_device *dev)* Drivers can call this helper from their device resume implementation. It is * not an error to call this even when output polling isn't enabled. * +* If device polling was never initialized before, this call will trigger a +* warning and return. +* * Note that calls to enable and disable polling must be strictly ordered, which * is automatically the case when they're only call from suspend/resume * callbacks. */ void drm_kms_helper_poll_enable (struct drm_device *dev) { -if (!dev->mode_config.poll_enabled || !drm_kms_helper_poll || - dev->mode_config.poll_running) +if (drm_WARN_ON_ONCE (dev, !dev->mode_config.poll_enabled) || + !drm_kms_helper_poll || dev->mode_config.poll_running)return ; if (drm_kms_helper_enable_hpd(dev) ||
@@ -880,12 +883,18 @@ EXPORT_SYMBOL(drm_kms_helper_is_poll_worker);* not an error to call this even when output polling isn't enabled or already * disabled. Polling is re-enabled by calling drm_kms_helper_poll_enable(). * +* If however, the polling was never initialized, this call will trigger a +* warning and return +* * Note that calls to enable and disable polling must be strictly ordered, which * is automatically the case when they're only call from suspend/resume * callbacks. */ void drm_kms_helper_poll_disable (struct drm_device *dev) { +if (drm_WARN_ON (dev, !dev->mode_config.poll_enabled)) +return ; +if (dev->mode_config.poll_running)drm_kms_helper_disable_hpd (dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/143 SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dai Ngo <[email protected]>
[ Upstream commit 2c35f43b5a4b9cdfaa6fdd946f5a212615dac8eb ]
When the NFS client is under extreme load the rpc_wait_queue.qlen counter can be overflowed. Here is an instant of the backlog queue overflow in a real world environment shown by drgn helper:
rpc_task_stats(rpc_clnt):
-------------------------rpc_clnt: 0xffff92b65d2bae00rpc_xprt: 0xffff9275db64f000
Queue: sending[64887] pending[524] backlog[30441] binding[0]
XMIT task: 0xffff925c6b1d8e98
WRITE: 750654
__dta_call_status_580: 65463
__dta_call_transmit_status_579: 1
call_reserveresult: 685189
nfs_client_init_is_complete: 1
COMMIT: 584
call_reserveresult: 573
__dta_call_status_580: 11
ACCESS: 1
__dta_call_status_580: 1
GETATTR: 10
__dta_call_status_580: 4
call_reserveresult: 6751249 tasks for server 111.222.333.444
Total tasks: 751249
count_rpc_wait_queues(xprt):
----------------------------
**** rpc_xprt: 0xffff9275db64f000 num_reqs: 65511wait_queue: xprt_binding[0] cnt: 0wait_queue: xprt_binding[1] cnt: 0wait_queue: xprt_binding[2] cnt: 0wait_queue: xprt_binding[3] cnt: 0 rpc_wait_queue[xprt_binding].qlen: 0 maxpriority: 0wait_queue: xprt_sending[0] cnt: 0wait_queue: xprt_sending[1] cnt: 64887wait_queue: xprt_sending[2] cnt: 0wait_queue: xprt_sending[3] cnt: 0 rpc_wait_queue[xprt_sending].qlen: 64887 maxpriority: 3wait_queue: xprt_pending[0] cnt: 524wait_queue: xprt_pending[1] cnt: 0wait_queue: xprt_pending[2] cnt: 0wait_queue: xprt_pending[3] cnt: 0 rpc_wait_queue[xprt_pending].qlen: 524 maxpriority: 0wait_queue: xprt_backlog[0] cnt: 0wait_queue: xprt_backlog[1] cnt: 685801wait_queue: xprt_backlog[2] cnt: 0wait_queue: xprt_backlog[3] cnt: 0 rpc_wait_queue[xprt_backlog].qlen: 30441 maxpriority: 3 [task cnt mismatch]
There is no effect on operations when this overflow occurs. However it causes confusion when trying to diagnose the performance problem.
--- include/linux/sunrpc/sched.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/sunrpc/sched.h +1 -1
@@ -197,7 +197,7 @@ struct rpc_wait_queue {unsigned char maxpriority;/* maximum priority (0 if queue is not a priority queue) */ unsigned char priority;/* current priority */ unsigned char nr;/* # tasks remaining for cookie */ -unsigned short qlen;/* total # tasks waiting in queue */ +unsigned int qlen;/* total # tasks waiting in queue */ struct rpc_timer timer_list;#if IS_ENABLED (CONFIG_SUNRPC_DEBUG ) ||IS_ENABLED (CONFIG_TRACEPOINTS )const char * name;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/143 PCI: Disable D3cold on Asus B1400 PCI-NVMe bridge
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Drake <[email protected]>
[ Upstream commit cdea98bf1faef23166262825ce44648be6ebff42 ]
The Asus B1400 with original shipped firmware versions and VMD disabled cannot resume from suspend: the NVMe device becomes unresponsive and inaccessible.
This appears to be an untested D3cold transition by the vendor; Intel socwatch shows that Windows leaves the NVMe device and parent bridge in D0 during suspend, even though these firmware versions have StorageD3Enable=1.
The NVMe device and parent PCI bridge both share the same "PXP" ACPI power resource, which gets turned off as both devices are put into D3cold during suspend. The _OFF() method calls DL23() which sets a L23E bit at offset 0xe2 into the PCI configuration space for this root port. This is the specific write that the _ON() routine is unable to recover from. This register is not documented in the public chipset datasheet.
Disallow D3cold on the PCI bridge to enable successful suspend/resume.
--- arch/x86/pci/fixup.c | 48 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+)
arch/x86/pci/fixup.c +48 -0
@@ -907,6 +907,54 @@ static void chromeos_fixup_apl_pci_l1ss_capability(struct pci_dev *dev)DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x5ad6 , chromeos_save_apl_pci_l1ss_capability);DECLARE_PCI_FIXUP_RESUME (PCI_VENDOR_ID_INTEL ,0x5ad6 , chromeos_fixup_apl_pci_l1ss_capability); +/* +* Disable D3cold on Asus B1400 PCI-NVMe bridge +* +* On this platform with VMD off, the NVMe device cannot successfully power +* back on from D3cold. This appears to be an untested transition by the +* vendor: Windows leaves the NVMe and parent bridge in D0 during suspend. +* +* We disable D3cold on the parent bridge for simplicity, and the fact that +* both parent bridge and NVMe device share the same power resource. +* +* This is only needed on BIOS versions before 308; the newer versions flip +* StorageD3Enable from 1 to 0. +*/ +static const struct dmi_system_id asus_nvme_broken_d3cold_table[] = { + { + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), +DMI_MATCH (DMI_BIOS_VERSION ,"B1400CEAE.304" ), + }, + }, + { + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), +DMI_MATCH (DMI_BIOS_VERSION ,"B1400CEAE.305" ), + }, + }, + { + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), +DMI_MATCH (DMI_BIOS_VERSION ,"B1400CEAE.306" ), + }, + }, + { + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), +DMI_MATCH (DMI_BIOS_VERSION ,"B1400CEAE.307" ), + }, + }, + {} +}; + +static void asus_disable_nvme_d3cold (struct pci_dev *pdev) +{ +if (dmi_check_system (asus_nvme_broken_d3cold_table) >0 ) +pci_d3cold_disable (pdev); +} +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x9a09 , asus_disable_nvme_d3cold); +#ifdef CONFIG_SUSPEND /* * Root Ports on some AMD SoCs advertise PME_Support for D3hot and D3cold, but
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/143 Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default"
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Drake <[email protected]>
[ Upstream commit cb98555fcd8eee98c30165537c7e394f3a66e809 ]
This reverts commit d52848620de00cde4a3a5df908e231b8c8868250, which was originally put in place to work around a s2idle failure on this platform where the NVMe device was inaccessible upon resume.
After extended testing, we found that the firmware's implementation of S3 is buggy and intermittently fails to wake up the system. We need to revert to s2idle mode.
The NVMe issue has now been solved more precisely in the commit titled "PCI: Disable D3cold on Asus B1400 PCI-NVMe bridge"
--- drivers/acpi/sleep.c | 12 ------------ 1 file changed, 12 deletions(-)
drivers/acpi/sleep.c +0 -12
@@ -385,18 +385,6 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = { DMI_MATCH(DMI_PRODUCT_NAME, "20GGA00L00"), }, }, -/* -* ASUS B1400CEAE hangs on resume from suspend (see -* https://bugzilla.kernel.org/show_bug.cgi?id=215742). -*/ - { - .callback = init_default_s3, - .ident = "ASUS B1400CEAE", - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), - DMI_MATCH(DMI_PRODUCT_NAME, "ASUS EXPERTBOOK B1400CEAE"), - }, - }, {}, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/143 libperf evlist: Avoid out-of-bounds access
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 1947b92464c3268381604bbe2ac977a3fd78192f ]
Parallel testing appears to show a race between allocating and setting evsel ids. As there is a bounds check on the xyarray it yields a segv like:
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==484408==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010
==484408==The signal is caused by a WRITE memory access.
==484408==Hint: address points to the zero page.
#0 0x55cef5d4eff4 in perf_evlist__id_hash tools/lib/perf/evlist.c:256
#1 0x55cef5d4f132 in perf_evlist__id_add tools/lib/perf/evlist.c:274
#2 0x55cef5d4f545 in perf_evlist__id_add_fd tools/lib/perf/evlist.c:315
#3 0x55cef5a1923f in store_evsel_ids util/evsel.c:3130
#4 0x55cef5a19400 in evsel__store_ids util/evsel.c:3147
#5 0x55cef5888204 in __run_perf_stat tools/perf/builtin-stat.c:832
#6 0x55cef5888c06 in run_perf_stat tools/perf/builtin-stat.c:960
#7 0x55cef58932db in cmd_stat tools/perf/builtin-stat.c:2878
...
```Avoid this crash by early exiting the perf_evlist__id_add_fd and perf_evlist__id_add is the access is out-of-bounds.
--- tools/lib/perf/evlist.c | 18 ++++++++++++------ tools/lib/perf/include/internal/evlist.h | 4 ++-- 2 files changed, 14 insertions(+), 8 deletions(-)
tools/lib/perf/evlist.c +12 -6
@@ -248,10 +248,10 @@ u64 perf_evlist__read_format(struct perf_evlist *evlist)static void perf_evlist__id_hash (struct perf_evlist *evlist,struct perf_evsel *evsel, -int cpu,int thread,u64 id) +int cpu_map_idx,int thread,u64 id) {int hash; -struct perf_sample_id *sid =SID (evsel, cpu, thread); +struct perf_sample_id *sid =SID (evsel, cpu_map_idx, thread); sid->id = id; sid->evsel = evsel;
@@ -269,21 +269,27 @@ void perf_evlist__reset_id_hash(struct perf_evlist *evlist)void perf_evlist__id_add (struct perf_evlist *evlist,struct perf_evsel *evsel, -int cpu,int thread,u64 id) +int cpu_map_idx,int thread,u64 id) { -perf_evlist__id_hash (evlist, evsel, cpu, thread, id); +if (!SID (evsel, cpu_map_idx, thread)) +return ; + +perf_evlist__id_hash (evlist, evsel, cpu_map_idx, thread, id); evsel->id[evsel->ids++] = id; }int perf_evlist__id_add_fd (struct perf_evlist *evlist,struct perf_evsel *evsel, -int cpu,int thread,int fd) +int cpu_map_idx,int thread,int fd) {u64 read_data[4 ] = {0 , };int id_idx =1 ;/* The first entry is the counter value */ u64 id;int ret; +if (!SID (evsel, cpu_map_idx, thread)) +return -1 ; + ret =ioctl (fd,PERF_EVENT_IOC_ID , &id);if (!ret) goto add;
@@ -312,7 +318,7 @@ int perf_evlist__id_add_fd(struct perf_evlist *evlist, id = read_data[id_idx]; add: -perf_evlist__id_add (evlist, evsel, cpu, thread, id); +perf_evlist__id_add (evlist, evsel, cpu_map_idx, thread, id);return 0 ; }
tools/lib/perf/include/internal/evlist.h +2 -2
@@ -126,11 +126,11 @@ u64 perf_evlist__read_format(struct perf_evlist *evlist);void perf_evlist__id_add (struct perf_evlist *evlist,struct perf_evsel *evsel, -int cpu,int thread,u64 id); +int cpu_map_idx,int thread,u64 id);int perf_evlist__id_add_fd (struct perf_evlist *evlist,struct perf_evsel *evsel, -int cpu,int thread,int fd); +int cpu_map_idx,int thread,int fd);void perf_evlist__reset_id_hash (struct perf_evlist *evlist);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/143 crypto: iaa - Fix async_disable descriptor leak
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Zanussi <[email protected]>
[ Upstream commit 262534ddc88dfea7474ed18adfecf856e4fbe054 ]
The disable_async paths of iaa_compress/decompress() don't free idxd descriptors in the async_disable case. Currently this only happens in the testcases where req->dst is set to null. Add a test to free them in those paths.
--- drivers/crypto/intel/iaa/iaa_crypto_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/crypto/intel/iaa/iaa_crypto_main.c +2 -2
@@ -1328,7 +1328,7 @@ static int iaa_compress(struct crypto_tfm *tfm, struct acomp_req *req, *compression_crc = idxd_desc->iax_completion->crc; -if (!ctx->async_mode) +if (!ctx->async_mode || disable_async)idxd_free_desc (wq, idxd_desc); out:return ret;
@@ -1574,7 +1574,7 @@ static int iaa_decompress(struct crypto_tfm *tfm, struct acomp_req *req, *dlen = req->dlen; -if (!ctx->async_mode) +if (!ctx->async_mode || disable_async)idxd_free_desc (wq, idxd_desc);/* Update stats */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/143 input/touchscreen: imagis: Correct the maximum touch area value
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markuss Broks <[email protected]>
[ Upstream commit 54a62ed17a705ef1ac80ebca2b62136b19243e19 ]
As specified in downstream IST3038B driver and proved by testing, the correct maximum reported value of touch area is 16.
--- drivers/input/touchscreen/imagis.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/touchscreen/imagis.c +1 -1
@@ -210,7 +210,7 @@ static int imagis_init_input_dev(struct imagis_ts *ts)input_set_capability (input_dev,EV_ABS ,ABS_MT_POSITION_X );input_set_capability (input_dev,EV_ABS ,ABS_MT_POSITION_Y ); -input_set_abs_params (input_dev,ABS_MT_TOUCH_MAJOR ,0 ,255 ,0 ,0 ); +input_set_abs_params (input_dev,ABS_MT_TOUCH_MAJOR ,0 ,16 ,0 ,0 );touchscreen_parse_properties (input_dev, true, &ts->prop);if (!ts->prop.max_x || !ts->prop.max_y) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/143 drivers/perf: hisi: Enable HiSilicon Erratum 162700402 quirk for HIP09
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junhao He <[email protected]>
[ Upstream commit e10b6976f6b9afdf3564f88c851e42d139bb19c0 ]
HiSilicon UC PMU v2 suffers the erratum 162700402 that the PMU counter cannot be set due to the lack of clock under power saving mode. This will lead to error or inaccurate counts. The clock can be enabled by the PMU global enabling control.
This patch tries to fix this by set the UC PMU enable before set event period to turn on the clock, and then restore the UC PMU configuration. The counter register can hold its value without a clock.
--- drivers/perf/hisilicon/hisi_uncore_uc_pmu.c | 42 ++++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-)
drivers/perf/hisilicon/hisi_uncore_uc_pmu.c +41 -1
@@ -287,12 +287,52 @@ static u64 hisi_uc_pmu_read_counter(struct hisi_pmu *uc_pmu,return readq (uc_pmu->base +HISI_UC_CNTR_REGn (hwc->idx)); } -static void hisi_uc_pmu_write_counter (struct hisi_pmu *uc_pmu, +static bool hisi_uc_pmu_get_glb_en_state (struct hisi_pmu *uc_pmu) +{ +u32 val; + + val =readl (uc_pmu->base +HISI_UC_EVENT_CTRL_REG ); +return !!FIELD_GET (HISI_UC_EVENT_GLB_EN , val); +} + +static void hisi_uc_pmu_write_counter_normal (struct hisi_pmu *uc_pmu,struct hw_perf_event *hwc,u64 val) {writeq (val, uc_pmu->base +HISI_UC_CNTR_REGn (hwc->idx)); } +static void hisi_uc_pmu_write_counter_quirk_v2 (struct hisi_pmu *uc_pmu, +struct hw_perf_event *hwc,u64 val) +{ +hisi_uc_pmu_start_counters (uc_pmu); +hisi_uc_pmu_write_counter_normal (uc_pmu, hwc, val); +hisi_uc_pmu_stop_counters (uc_pmu); +} + +static void hisi_uc_pmu_write_counter (struct hisi_pmu *uc_pmu, +struct hw_perf_event *hwc,u64 val) +{ +bool enable =hisi_uc_pmu_get_glb_en_state (uc_pmu); +bool erratum = uc_pmu->identifier ==HISI_PMU_V2 ; + +/* +* HiSilicon UC PMU v2 suffers the erratum 162700402 that the +* PMU counter cannot be set due to the lack of clock under power +* saving mode. This will lead to error or inaccurate counts. +* The clock can be enabled by the PMU global enabling control. +* The irq handler and pmu_start() will call the function to set +* period. If the function under irq context, the PMU has been +* enabled therefore we set counter directly. Other situations +* the PMU is disabled, we need to enable it to turn on the +* counter clock to set period, and then restore PMU enable +* status, the counter can hold its value without a clock. +*/ +if (enable || !erratum) +hisi_uc_pmu_write_counter_normal (uc_pmu, hwc, val); +else +hisi_uc_pmu_write_counter_quirk_v2 (uc_pmu, hwc, val); +} +static void hisi_uc_pmu_enable_counter_int (struct hisi_pmu *uc_pmu,struct hw_perf_event *hwc) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/143 block: prevent division by zero in blk_rq_stat_sum()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Smirnov <[email protected]>
[ Upstream commit 93f52fbeaf4b676b21acfe42a5152620e6770d02 ]
The expression dst->nr_samples + src->nr_samples may have zero value on overflow. It is necessary to add a check to avoid division by zero.
Found by Linux Verification Center (linuxtesting.org) with Svace.
--- block/blk-stat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/blk-stat.c +1 -1
@@ -27,7 +27,7 @@ void blk_rq_stat_init(struct blk_rq_stat *stat)/* src is a per-cpu stat, mean isn't initialized */ void blk_rq_stat_sum (struct blk_rq_stat *dst,struct blk_rq_stat *src) { -if (!src->nr_samples) +if (dst->nr_samples + src->nr_samples <= dst->nr_samples)return ; dst->min =min (dst->min, src->min);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/143 RDMA/cm: add timeout to cm_destroy_id wait
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manjunath Patil <[email protected]>
[ Upstream commit 96d9cbe2f2ff7abde021bac75eafaceabe9a51fa ]
Add timeout to cm_destroy_id, so that userspace can trigger any data collection that would help in analyzing the cause of delay in destroying the cm_id.
New noinline function helps dtrace/ebpf programs to hook on to it. Existing functionality isn't changed except triggering a probe-able new function at every timeout interval.
We have seen cases where CM messages stuck with MAD layer (either due to software bug or faulty HCA), leading to cm_id getting stuck in the following call stack. This patch helps in resolving such issues faster.
kernel: ... INFO: task XXXX:56778 blocked for more than 120 seconds.
...
Call Trace: __schedule+0x2bc/0x895 schedule+0x36/0x7c schedule_timeout+0x1f6/0x31f ? __slab_free+0x19c/0x2ba wait_for_completion+0x12b/0x18a ? wake_up_q+0x80/0x73 cm_destroy_id+0x345/0x610 [ib_cm] ib_destroy_cm_id+0x10/0x20 [ib_cm] rdma_destroy_id+0xa8/0x300 [rdma_cm] ucma_destroy_id+0x13e/0x190 [rdma_ucm] ucma_write+0xe0/0x160 [rdma_ucm] __vfs_write+0x3a/0x16d vfs_write+0xb2/0x1a1 ? syscall_trace_enter+0x1ce/0x2b8 SyS_write+0x5c/0xd3 do_syscall_64+0x79/0x1b9 entry_SYSCALL_64_after_hwframe+0x16d/0x0
--- drivers/infiniband/core/cm.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
drivers/infiniband/core/cm.c +19 -1
@@ -34,6 +34,7 @@ MODULE_AUTHOR("Sean Hefty");MODULE_DESCRIPTION ("InfiniBand CM" );MODULE_LICENSE ("Dual BSD/GPL" ); +#define CM_DESTROY_ID_WAIT_TIMEOUT 10000/* msecs */ static const char *const ibcm_rej_reason_strs[] = { [IB_CM_REJ_NO_QP ] ="no QP" , [IB_CM_REJ_NO_EEC ] ="no EEC" ,
@@ -1025,10 +1026,20 @@ static void cm_reset_to_idle(struct cm_id_private *cm_id_priv) } } +static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id) +{ +struct cm_id_private *cm_id_priv; + + cm_id_priv = container_of(cm_id, struct cm_id_private, id); +pr_err ("%s: cm_id=%p timed out. state=%d refcnt=%d\n" , __func__, + cm_id, cm_id->state,refcount_read (&cm_id_priv->refcount)); +} +static void cm_destroy_id (struct ib_cm_id *cm_id,int err) {struct cm_id_private *cm_id_priv;struct cm_work *work; +int ret; cm_id_priv = container_of(cm_id, struct cm_id_private, id);spin_lock_irq (&cm_id_priv->lock);
@@ -1135,7 +1146,14 @@ static void cm_destroy_id(struct ib_cm_id *cm_id, int err)xa_erase (&cm.local_id_table,cm_local_id (cm_id->local_id));cm_deref_id (cm_id_priv); -wait_for_completion (&cm_id_priv->comp); +do { + ret =wait_for_completion_timeout (&cm_id_priv->comp, +msecs_to_jiffies ( +CM_DESTROY_ID_WAIT_TIMEOUT )); +if (!ret)/* timeout happened */ +cm_destroy_id_wait_timeout (cm_id); + }while (!ret); +while ((work =cm_dequeue_work (cm_id_priv)) !=NULL )cm_free_work (work);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/143 Input: imagis - use FIELD_GET where applicable
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duje Mihanović <[email protected]>
[ Upstream commit c0ca3dbd03d66c6b9e044f48720e6ab5cef37ae5 ]
Instead of manually extracting certain bits from registers with binary ANDs and shifts, the FIELD_GET macro can be used. With this in mind, the *_SHIFT macros can be dropped.
--- drivers/input/touchscreen/imagis.c | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-)
drivers/input/touchscreen/imagis.c +7 -11
@@ -1,5 +1,6 @@// SPDX-License-Identifier: GPL-2.0-only +#include <linux/bitfield.h> #include <linux/bits.h> #include <linux/delay.h> #include <linux/i2c.h>
@@ -23,12 +24,9 @@#define IST3038C_I2C_RETRY_COUNT 3#define IST3038C_MAX_FINGER_NUM 10#define IST3038C_X_MASK GENMASK(23, 12) -#define IST3038C_X_SHIFT 12#define IST3038C_Y_MASK GENMASK(11, 0)#define IST3038C_AREA_MASK GENMASK(27, 24) -#define IST3038C_AREA_SHIFT 24#define IST3038C_FINGER_COUNT_MASK GENMASK(15, 12) -#define IST3038C_FINGER_COUNT_SHIFT 12#define IST3038C_FINGER_STATUS_MASK GENMASK(9, 0)struct imagis_ts {
@@ -92,8 +90,7 @@ static irqreturn_t imagis_interrupt(int irq, void *dev_id) goto out; } - finger_count = (intr_message &IST3038C_FINGER_COUNT_MASK ) >> -IST3038C_FINGER_COUNT_SHIFT ; + finger_count =FIELD_GET (IST3038C_FINGER_COUNT_MASK , intr_message);if (finger_count >IST3038C_MAX_FINGER_NUM ) { dev_err(&ts->client->dev, "finger count %d is more than maximum supported\n",
@@ -101,7 +98,7 @@ static irqreturn_t imagis_interrupt(int irq, void *dev_id) goto out; } - finger_pressed = intr_message &IST3038C_FINGER_STATUS_MASK ; + finger_pressed =FIELD_GET (IST3038C_FINGER_STATUS_MASK , intr_message);for (i =0 ; i < finger_count; i++) { error = imagis_i2c_read_reg(ts,
@@ -118,12 +115,11 @@ static irqreturn_t imagis_interrupt(int irq, void *dev_id)input_mt_report_slot_state (ts->input_dev,MT_TOOL_FINGER , finger_pressed &BIT (i));touchscreen_report_pos (ts->input_dev, &ts->prop, - (finger_status &IST3038C_X_MASK ) >> -IST3038C_X_SHIFT , - finger_status &IST3038C_Y_MASK ,1 ); +FIELD_GET (IST3038C_X_MASK , finger_status), +FIELD_GET (IST3038C_Y_MASK , finger_status), + true);input_report_abs (ts->input_dev,ABS_MT_TOUCH_MAJOR , - (finger_status &IST3038C_AREA_MASK ) >> -IST3038C_AREA_SHIFT ); +FIELD_GET (IST3038C_AREA_MASK , finger_status)); }input_mt_sync_frame (ts->input_dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/143 Input: allocate keycode for Display refresh rate toggle
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gergo Koteles <[email protected]>
[ Upstream commit cfeb98b95fff25c442f78a6f616c627bc48a26b7 ]
Newer Lenovo Yogas and Legions with 60Hz/90Hz displays send a wmi event when Fn + R is pressed. This is intended for use to switch between the two refresh rates.
Allocate a new KEY_REFRESH_RATE_TOGGLE keycode for it.
--- include/uapi/linux/input-event-codes.h | 1 + 1 file changed, 1 insertion(+)
include/uapi/linux/input-event-codes.h +1 -0
@@ -602,6 +602,7 @@#define KEY_ALS_TOGGLE 0x230/* Ambient light sensor */ #define KEY_ROTATE_LOCK_TOGGLE 0x231/* Display rotation lock */ +#define KEY_REFRESH_RATE_TOGGLE 0x232/* Display refresh rate toggle */ #define KEY_BUTTONCONFIG 0x240/* AL Button Configuration */ #define KEY_TASKMANAGER 0x241/* AL Task/Project Manager */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/143 platform/x86: acer-wmi: Add support for Acer PH16-71
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: SungHwan Jung <[email protected]>
[ Upstream commit 20a36ec343d4c5abc2378a45ab5e7ea1ca85020a ]
Add Acer Predator PH16-71 to Acer_quirks with predator_v4 to support mode button and fan speed sensor.
--- drivers/platform/x86/acer-wmi.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/platform/x86/acer-wmi.c +9 -0
@@ -584,6 +584,15 @@ static const struct dmi_system_id acer_quirks[] __initconst = { }, .driver_data = &quirk_acer_predator_v4, }, + { + .callback = dmi_matched, + .ident = "Acer Predator PH16-71", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), + DMI_MATCH(DMI_PRODUCT_NAME, "Predator PH16-71"), + }, + .driver_data = &quirk_acer_predator_v4, + }, { .callback = set_force_caps, .ident = "Acer Aspire Switch 10E SW3-016",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/143 platform/x86: acer-wmi: Add predator_v4 module parameter
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: SungHwan Jung <[email protected]>
[ Upstream commit f9124f2a454a6f1edb4eae9f0646b1a61fd74dba ]
This parameter allows predator laptop users to test and use features (mode button, platform profile, fan speed monitoring) without adding model names to acer_quirks and compiling kernel.
--- drivers/platform/x86/acer-wmi.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/platform/x86/acer-wmi.c +7 -1
@@ -276,6 +276,7 @@ static bool has_type_aa;static u16 commun_func_bitmap;static u8 commun_fn_key_number;static bool cycle_gaming_thermal_profile = true; +static bool predator_v4;module_param (mailled, int,0444 );module_param (brightness, int,0444 );
@@ -284,6 +285,7 @@ module_param(force_series, int, 0444);module_param (force_caps, int,0444 );module_param (ec_raw_mode, bool,0444 );module_param (cycle_gaming_thermal_profile, bool,0644 ); +module_param (predator_v4, bool,0444 );MODULE_PARM_DESC (mailled,"Set initial state of Mail LED" );MODULE_PARM_DESC (brightness,"Set initial LCD backlight brightness" );MODULE_PARM_DESC (threeg,"Set initial state of 3G hardware" );
@@ -292,6 +294,8 @@ MODULE_PARM_DESC(force_caps, "Force the capability bitmask to this value");MODULE_PARM_DESC (ec_raw_mode,"Enable EC raw mode" );MODULE_PARM_DESC (cycle_gaming_thermal_profile,"Set thermal mode key in cycle mode. Disabling it sets the mode key in turbo toggle mode" ); +MODULE_PARM_DESC (predator_v4, +"Enable features for predator laptops that use predator sense v4" );struct acer_data {int mailled;
@@ -734,7 +738,9 @@ enum acer_predator_v4_thermal_profile_wmi {/* Find which quirks are needed for a particular vendor/ model pair */ static void __init find_quirks (void ) { -if (!force_series) { +if (predator_v4) { + quirks = &quirk_acer_predator_v4; + }else if (!force_series) {dmi_check_system (acer_quirks);dmi_check_system (non_acer_quirks); }else if (force_series ==2490 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/143 platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alban Boyé <[email protected]>
[ Upstream commit 1266e2efb7512dbf20eac820ca2ed34de6b1c3e7 ]
--- drivers/platform/x86/touchscreen_dmi.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/platform/x86/touchscreen_dmi.c +9 -0
@@ -1217,6 +1217,15 @@ const struct dmi_system_id touchscreen_dmi_table[] = { DMI_MATCH(DMI_BIOS_VERSION, "CHUWI.D86JLBNR"), }, }, + { +/* Chuwi Vi8 dual-boot (CWI506) */ + .driver_data = (void *)&chuwi_vi8_data, + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Insyde" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"i86" ), + DMI_MATCH(DMI_BIOS_VERSION, "CHUWI2.D86JHBNR02"), + }, + }, {/* Chuwi Vi8 Plus (CWI519) */ .driver_data = (void *)&chuwi_vi8_plus_data,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/143 perf/x86/amd/lbr: Discard erroneous branch entries
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sandipan Das <[email protected]>
[ Upstream commit 29297ffffb0bf388778bd4b581a43cee6929ae65 ]
The Revision Guide for AMD Family 19h Model 10-1Fh processors declares Erratum 1452 which states that non-branch entries may erroneously be recorded in the Last Branch Record (LBR) stack with the valid and spec bits set.
Such entries can be recognized by inspecting bit 61 of the corresponding LastBranchStackToIp register. This bit is currently reserved but if found to be set, the associated branch entry should be discarded.
--- arch/x86/events/amd/lbr.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/x86/events/amd/lbr.c +4 -2
@@ -173,9 +173,11 @@ void amd_pmu_lbr_read(void)/* * Check if a branch has been logged; if valid = 0, spec = 0 -* then no branch was recorded +* then no branch was recorded; if reserved = 1 then an +* erroneous branch was recorded (see Erratum 1452) */ -if (!entry.to.split.valid && !entry.to.split.spec) +if ((!entry.to.split.valid && !entry.to.split.spec) || + entry.to.split.reserved)continue ;perf_clear_branch_entry_bitfields (br + out);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/143 ALSA: hda/realtek: Add quirk for Lenovo Yoga 9 14IMH9
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jichi Zhang <[email protected]>
[ Upstream commit 9b714a59b719b1ba9382c092f0f7aa4bbe94eba1 ]
The speakers on the Lenovo Yoga 9 14IMH9 are similar to previous generations such as the 14IAP7, and the bass speakers can be fixed using similar methods with one caveat: 14IMH9 uses CS35L41 amplifiers which need to be activated separately.
Message-ID: <[email protected]>
--- sound/pci/hda/patch_realtek.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/pci/hda/patch_realtek.c +9 -0
@@ -7521,6 +7521,7 @@ enum {ALC287_FIXUP_LEGION_16ITHG6 ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN , +ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN ,ALC295_FIXUP_DELL_INSPIRON_TOP_SPEAKERS ,ALC236_FIXUP_DELL_DUAL_CODECS , ALC287_FIXUP_CS35L41_I2C_2_THINKPAD_ACPI,
@@ -9650,6 +9651,12 @@ static const struct hda_fixup alc269_fixups[] = { .chained = true, .chain_id = ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK, }, + [ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc287_fixup_yoga9_14iap7_bass_spk_pin, + .chained = true, + .chain_id = ALC287_FIXUP_CS35L41_I2C_2, + }, [ALC295_FIXUP_DELL_INSPIRON_TOP_SPEAKERS] = { .type = HDA_FIXUP_FUNC, .v.func = alc295_fixup_dell_inspiron_top_speakers,
@@ -10384,6 +10391,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x17aa ,0x38c3 ,"Y980 DUAL" ,ALC287_FIXUP_TAS2781_I2C ),SND_PCI_QUIRK (0x17aa ,0x38cb ,"Y790 YG DUAL" ,ALC287_FIXUP_TAS2781_I2C ),SND_PCI_QUIRK (0x17aa ,0x38cd ,"Y790 VECO DUAL" ,ALC287_FIXUP_TAS2781_I2C ), +SND_PCI_QUIRK (0x17aa ,0x38d2 ,"Lenovo Yoga 9 14IMH9" ,ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN ), +SND_PCI_QUIRK (0x17aa ,0x38d7 ,"Lenovo Yoga 9 14IMH9" ,ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN ),SND_PCI_QUIRK (0x17aa ,0x3902 ,"Lenovo E50-80" ,ALC269_FIXUP_DMIC_THINKPAD_ACPI ),SND_PCI_QUIRK (0x17aa ,0x3977 ,"IdeaPad S210" ,ALC283_FIXUP_INT_MIC ), SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/143 ktest: force $buildonly = 1 for make_warnings_file test type
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marliere <[email protected]>
[ Upstream commit 07283c1873a4d0eaa0e822536881bfdaea853910 ]
The test type "make_warnings_file" should have no mandatory configuration parameters other than the ones required by the "build" test type, because its purpose is to create a file with build warnings that may or may not be used by other subsequent tests. Currently, the only way to use it as a stand-alone test is by setting POWER_CYCLE, CONSOLE, SSH_USER, BUILD_TARGET, TARGET_IMAGE, REBOOT_TYPE and GRUB_MENU.
--- tools/testing/ktest/ktest.pl | 1 + 1 file changed, 1 insertion(+)
tools/testing/ktest/ktest.pl +1 -0
@@ -843,6 +843,7 @@ sub set_value { if ($lvalue =~ /^(TEST|BISECT|CONFIG_BISECT)_TYPE(\[.*\])?$/ && $prvalue !~ /^(config_|)bisect$/ && $prvalue !~ /^build$/ && + $prvalue !~ /^make_warnings_file$/ && $buildonly) { # Note if a test is something other than build, then we
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/143 Input: xpad - add support for Snakebyte GAMEPADs
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Scialabba <[email protected]>
[ Upstream commit 81c32343d04f8ca974681d5fb5d939d2e1f58851 ]
Add Snakebyte GAMEPAD BASE X and Snakebyte GAMEPAD RGB X to the list of supported devices.
--- drivers/input/joystick/xpad.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/input/joystick/xpad.c +3 -0
@@ -366,6 +366,8 @@ static const struct xpad_device { { 0x24c6, 0x5d04, "Razer Sabertooth", 0, XTYPE_XBOX360 }, { 0x24c6, 0xfafe, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 }, { 0x2563, 0x058d, "OneXPlayer Gamepad", 0, XTYPE_XBOX360 }, + { 0x294b, 0x3303, "Snakebyte GAMEPAD BASE X", 0, XTYPE_XBOXONE }, + { 0x294b, 0x3404, "Snakebyte GAMEPAD RGB X", 0, XTYPE_XBOXONE }, { 0x2dc8, 0x2000, "8BitDo Pro 2 Wired Controller fox Xbox", 0, XTYPE_XBOXONE }, { 0x2dc8, 0x3106, "8BitDo Pro 2 Wired Controller", 0, XTYPE_XBOX360 }, { 0x31e3, 0x1100, "Wooting One", 0, XTYPE_XBOX360 },
@@ -507,6 +509,7 @@ static const struct usb_device_id xpad_table[] = {XPAD_XBOXONE_VENDOR (0x24c6 ),/* PowerA controllers */ XPAD_XBOX360_VENDOR (0x2563 ),/* OneXPlayer Gamepad */ XPAD_XBOX360_VENDOR (0x260d ),/* Dareu H101 */ +XPAD_XBOXONE_VENDOR (0x294b ),/* Snakebyte */ XPAD_XBOX360_VENDOR (0x2c22 ),/* Qanba Controllers */ XPAD_XBOX360_VENDOR (0x2dc8 ),/* 8BitDo Pro 2 Wired Controller */ XPAD_XBOXONE_VENDOR(0x2dc8), /* 8BitDo Pro 2 Wired Controller for Xbox */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/143 ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: linke li <[email protected]>
[ Upstream commit f1e30cb6369251c03f63c564006f96a54197dcc4 ]
In function ring_buffer_iter_empty(), cpu_buffer->commit_page is read while other threads may change it. It may cause the time_stamp that read in the next line come from a different page. Use READ_ONCE() to avoid having to reason about compiler optimizations now and in future.
--- kernel/trace/ring_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/ring_buffer.c +1 -1
@@ -4395,7 +4395,7 @@ int ring_buffer_iter_empty(struct ring_buffer_iter *iter) cpu_buffer = iter->cpu_buffer; reader = cpu_buffer->reader_page; head_page = cpu_buffer->head_page; - commit_page = cpu_buffer->commit_page; + commit_page =READ_ONCE (cpu_buffer->commit_page); commit_ts = commit_page->page->time_stamp;/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/143 tools: iio: replace seekdir() in iio_generic_buffer
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petre Rodan <[email protected]>
[ Upstream commit 4e6500bfa053dc133021f9c144261b77b0ba7dc8 ]
Replace seekdir() with rewinddir() in order to fix a localized glibc bug.
One of the glibc patches that stable Gentoo is using causes an improper directory stream positioning bug on 32bit arm. That in turn ends up as a floating point exception in iio_generic_buffer.
The attached patch provides a fix by using an equivalent function which should not cause trouble for other distros and is easier to reason about in general as it obviously always goes back to to the start.
https://sourceware.org/bugzilla/show_bug.cgi?id=31212
--- tools/iio/iio_utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/iio/iio_utils.c +1 -1
@@ -376,7 +376,7 @@ int build_channel_array(const char *device_dir, int buffer_idx, goto error_close_dir; } -seekdir (dp,0 ); +rewinddir (dp);while (ent =readdir (dp), ent) {if (strcmp (ent->d_name +strlen (ent->d_name) -strlen ("_en" ),"_en" ) ==0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/143 bus: mhi: host: Add MHI_PM_SYS_ERR_FAIL state
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeffrey Hugo <[email protected]>
[ Upstream commit bce3f770684cc1d91ff9edab431b71ac991faf29 ]
When processing a SYSERR, if the device does not respond to the MHI_RESET from the host, the host will be stuck in a difficult to recover state. The host will remain in MHI_PM_SYS_ERR_PROCESS and not clean up the host channels. Clients will not be notified of the SYSERR via the destruction of their channel devices, which means clients may think that the device is still up. Subsequent SYSERR events such as a device fatal error will not be processed as the state machine cannot transition from PROCESS back to DETECT. The only way to recover from this is to unload the mhi module (wipe the state machine state) or for the mhi controller to initiate SHUTDOWN.
This issue was discovered by stress testing soc_reset events on AIC100 via the sysfs node.
soc_reset is processed entirely in hardware. When the register write hits the endpoint hardware, it causes the soc to reset without firmware involvement. In stress testing, there is a rare race where soc_reset N will cause the soc to reset and PBL to signal SYSERR (fatal error). If soc_reset N+1 is triggered before PBL can process the MHI_RESET from the host, then the soc will reset again, and re-run PBL from the beginning. This will cause PBL to lose all state. PBL will be waiting for the host to respond to the new syserr, but host will be stuck expecting the previous MHI_RESET to be processed.
Additionally, the AMSS EE firmware (QSM) was hacked to synthetically reproduce the issue by simulating a FW hang after the QSM issued a SYSERR. In this case, soc_reset would not recover the device.
For this failure case, to recover the device, we need a state similar to PROCESS, but can transition to DETECT. There is not a viable existing state to use. POR has the needed transitions, but assumes the device is in a good state and could allow the host to attempt to use the device. Allowing PROCESS to transition to DETECT invites the possibility of parallel SYSERR processing which could get the host and device out of sync.
Thus, invent a new state - MHI_PM_SYS_ERR_FAIL
This essentially a holding state. It allows us to clean up the host elements that are based on the old state of the device (channels), but does not allow us to directly advance back to an operational state. It does allow the detection and processing of another SYSERR which may recover the device, or allows the controller to do a clean shutdown.
--- drivers/bus/mhi/host/init.c | 1 + drivers/bus/mhi/host/internal.h | 9 ++++++--- drivers/bus/mhi/host/pm.c | 20 +++++++++++++++++--- 3 files changed, 24 insertions(+), 6 deletions(-)
drivers/bus/mhi/host/init.c +1 -0
@@ -62,6 +62,7 @@ static const char * const mhi_pm_state_str[] = { [MHI_PM_STATE_FW_DL_ERR] = "Firmware Download Error", [MHI_PM_STATE_SYS_ERR_DETECT] = "SYS ERROR Detect", [MHI_PM_STATE_SYS_ERR_PROCESS] = "SYS ERROR Process", + [MHI_PM_STATE_SYS_ERR_FAIL] = "SYS ERROR Failure", [MHI_PM_STATE_SHUTDOWN_PROCESS] = "SHUTDOWN Process", [MHI_PM_STATE_LD_ERR_FATAL_DETECT] = "Linkdown or Error Fatal Detect", };
drivers/bus/mhi/host/internal.h +6 -3
@@ -88,6 +88,7 @@ enum mhi_pm_state {MHI_PM_STATE_FW_DL_ERR ,MHI_PM_STATE_SYS_ERR_DETECT ,MHI_PM_STATE_SYS_ERR_PROCESS , +MHI_PM_STATE_SYS_ERR_FAIL ,MHI_PM_STATE_SHUTDOWN_PROCESS ,MHI_PM_STATE_LD_ERR_FATAL_DETECT ,MHI_PM_STATE_MAX
@@ -104,14 +105,16 @@ enum mhi_pm_state {#define MHI_PM_FW_DL_ERR BIT(7)#define MHI_PM_SYS_ERR_DETECT BIT(8)#define MHI_PM_SYS_ERR_PROCESS BIT(9) -#define MHI_PM_SHUTDOWN_PROCESS BIT(10) +#define MHI_PM_SYS_ERR_FAIL BIT(10) +#define MHI_PM_SHUTDOWN_PROCESS BIT(11)/* link not accessible */ -#define MHI_PM_LD_ERR_FATAL_DETECT BIT(11) +#define MHI_PM_LD_ERR_FATAL_DETECT BIT(12)#define MHI_REG_ACCESS_VALID (pm_state) ((pm_state & (MHI_PM_POR | MHI_PM_M0 | \ MHI_PM_M2 | MHI_PM_M3_ENTER | MHI_PM_M3_EXIT | \ MHI_PM_SYS_ERR_DETECT | MHI_PM_SYS_ERR_PROCESS | \ - MHI_PM_SHUTDOWN_PROCESS | MHI_PM_FW_DL_ERR))) + MHI_PM_SYS_ERR_FAIL | MHI_PM_SHUTDOWN_PROCESS | \ + MHI_PM_FW_DL_ERR)))#define MHI_PM_IN_ERROR_STATE (pm_state) (pm_state >= MHI_PM_FW_DL_ERR)#define MHI_PM_IN_FATAL_STATE (pm_state) (pm_state == MHI_PM_LD_ERR_FATAL_DETECT)#define MHI_DB_ACCESS_VALID (mhi_cntrl) (mhi_cntrl->pm_state & mhi_cntrl->db_access)
drivers/bus/mhi/host/pm.c +17 -3
@@ -36,7 +36,10 @@* M0 <--> M0 * M0 -> FW_DL_ERR * M0 -> M3_ENTER -> M3 -> M3_EXIT --> M0 -* L1: SYS_ERR_DETECT -> SYS_ERR_PROCESS --> POR +* L1: SYS_ERR_DETECT -> SYS_ERR_PROCESS +* SYS_ERR_PROCESS -> SYS_ERR_FAIL +* SYS_ERR_FAIL -> SYS_ERR_DETECT +* SYS_ERR_PROCESS --> POR * L2: SHUTDOWN_PROCESS -> LD_ERR_FATAL_DETECT * SHUTDOWN_PROCESS -> DISABLE * L3: LD_ERR_FATAL_DETECT <--> LD_ERR_FATAL_DETECT
@@ -93,7 +96,12 @@ static const struct mhi_pm_transitions dev_state_transitions[] = { }, {MHI_PM_SYS_ERR_PROCESS , -MHI_PM_POR |MHI_PM_SHUTDOWN_PROCESS | +MHI_PM_POR |MHI_PM_SYS_ERR_FAIL |MHI_PM_SHUTDOWN_PROCESS | +MHI_PM_LD_ERR_FATAL_DETECT + }, + { +MHI_PM_SYS_ERR_FAIL , +MHI_PM_SYS_ERR_DETECT |MHI_PM_SHUTDOWN_PROCESS |MHI_PM_LD_ERR_FATAL_DETECT },/* L2 States */
@@ -629,7 +637,13 @@ static void mhi_pm_sys_error_transition(struct mhi_controller *mhi_cntrl) !in_reset, timeout);if (!ret || in_reset) {dev_err (dev,"Device failed to exit MHI Reset state\n" ); - goto exit_sys_error_transition; +write_lock_irq (&mhi_cntrl->pm_lock); + cur_state =mhi_tryset_pm_state (mhi_cntrl, +MHI_PM_SYS_ERR_FAIL ); +write_unlock_irq (&mhi_cntrl->pm_lock); +/* Shutdown may have occurred, otherwise cleanup now */ +if (cur_state !=MHI_PM_SYS_ERR_FAIL ) + goto exit_sys_error_transition; }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/143 kernfs: RCU protect kernfs_nodes and avoid kernfs_idr_lock in kernfs_find_and_get_node_by_id()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
[ Upstream commit 4207b556e62f0a8915afc5da4c5d5ad915a253a5 ]
The BPF helper bpf_cgroup_from_id() calls kernfs_find_and_get_node_by_id() which acquires kernfs_idr_lock, which is an non-raw non-IRQ-safe lock. This can lead to deadlocks as bpf_cgroup_from_id() can be called from any BPF programs including e.g. the ones that attach to functions which are holding the scheduler rq lock.
Consider the following BPF program:
SEC("fentry/__set_cpus_allowed_ptr_locked")
int BPF_PROG(__set_cpus_allowed_ptr_locked, struct task_struct *p,
struct affinity_context *affn_ctx, struct rq *rq, struct rq_flags *rf)
{
struct cgroup *cgrp = bpf_cgroup_from_id(p->cgroups->dfl_cgrp->kn->id);
if (cgrp) {
bpf_printk("%d[%s] in %s", p->pid, p->comm, cgrp->kn->name);
bpf_cgroup_release(cgrp);
}
return 0;}
__set_cpus_allowed_ptr_locked() is called with rq lock held and the above BPF program calls bpf_cgroup_from_id() within leading to the following lockdep warning:
=====================================================
WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected 6.7.0-rc3-work-00053-g07124366a1d7-dirty #147 Not tainted
-----------------------------------------------------
repro/1620 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
ffffffff833b3688 (kernfs_idr_lock){+.+.}-{2:2}, at: kernfs_find_and_get_node_by_id+0x1e/0x70
and this task is already holding:
ffff888237ced698 (&rq->__lock){-.-.}-{2:2}, at: task_rq_lock+0x4e/0xf0 which would create a new lock dependency:
(&rq->__lock){-.-.}-{2:2} -> (kernfs_idr_lock){+.+.}-{2:2}
...
Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(kernfs_idr_lock);
local_irq_disable();
lock(&rq->__lock);
lock(kernfs_idr_lock);
<Interrupt>
lock(&rq->__lock);
*** DEADLOCK ***
...
Call Trace:
dump_stack_lvl+0x55/0x70
dump_stack+0x10/0x20
__lock_acquire+0x781/0x2a40
lock_acquire+0xbf/0x1f0
_raw_spin_lock+0x2f/0x40
kernfs_find_and_get_node_by_id+0x1e/0x70
cgroup_get_from_id+0x21/0x240
bpf_cgroup_from_id+0xe/0x20
bpf_prog_98652316e9337a5a___set_cpus_allowed_ptr_locked+0x96/0x11a
bpf_trampoline_6442545632+0x4f/0x1000
__set_cpus_allowed_ptr_locked+0x5/0x5a0
sched_setaffinity+0x1b3/0x290
__x64_sys_sched_setaffinity+0x4f/0x60
do_syscall_64+0x40/0xe0
entry_SYSCALL_64_after_hwframe+0x46/0x4eLet's fix it by protecting kernfs_node and kernfs_root with RCU and making kernfs_find_and_get_node_by_id() acquire rcu_read_lock() instead of kernfs_idr_lock.
This adds an rcu_head to kernfs_node making it larger by 16 bytes on 64bit. Combined with the preceding rearrange patch, the net increase is 8 bytes.
--- fs/kernfs/dir.c | 31 ++++++++++++++++++++----------- fs/kernfs/kernfs-internal.h | 2 ++ include/linux/kernfs.h | 2 ++ 3 files changed, 24 insertions(+), 11 deletions(-)
fs/kernfs/dir.c +20 -11
@@ -529,6 +529,20 @@ void kernfs_get(struct kernfs_node *kn) }EXPORT_SYMBOL_GPL (kernfs_get); +static void kernfs_free_rcu (struct rcu_head *rcu) +{ + struct kernfs_node *kn = container_of(rcu, struct kernfs_node, rcu); + +kfree_const (kn->name); + +if (kn->iattr) { +simple_xattrs_free (&kn->iattr->xattrs,NULL ); +kmem_cache_free (kernfs_iattrs_cache, kn->iattr); + } + +kmem_cache_free (kernfs_node_cache, kn); +} +/** * kernfs_put - put a reference count on a kernfs_node * @kn: the target kernfs_node
@@ -557,16 +571,11 @@ void kernfs_put(struct kernfs_node *kn)if (kernfs_type (kn) ==KERNFS_LINK )kernfs_put (kn->symlink.target_kn); -kfree_const (kn->name); - -if (kn->iattr) { -simple_xattrs_free (&kn->iattr->xattrs,NULL ); -kmem_cache_free (kernfs_iattrs_cache, kn->iattr); - }spin_lock (&kernfs_idr_lock);idr_remove (&root->ino_idr, (u32 )kernfs_ino (kn));spin_unlock (&kernfs_idr_lock); -kmem_cache_free (kernfs_node_cache, kn); + +call_rcu (&kn->rcu, kernfs_free_rcu); kn = parent;if (kn) {
@@ -575,7 +584,7 @@ void kernfs_put(struct kernfs_node *kn) }else {/* just released the root kn, free @root too */ idr_destroy (&root->ino_idr); -kfree (root); +kfree_rcu (root, rcu); } }EXPORT_SYMBOL_GPL (kernfs_put);
@@ -715,7 +724,7 @@ struct kernfs_node *kernfs_find_and_get_node_by_id(struct kernfs_root *root,ino_t ino =kernfs_id_ino (id);u32 gen =kernfs_id_gen (id); -spin_lock (&kernfs_idr_lock); +rcu_read_lock (); kn =idr_find (&root->ino_idr, (u32 )ino);if (!kn)
@@ -739,10 +748,10 @@ struct kernfs_node *kernfs_find_and_get_node_by_id(struct kernfs_root *root,if (unlikely (!__kernfs_active (kn) || !atomic_inc_not_zero (&kn->count))) goto err_unlock; -spin_unlock (&kernfs_idr_lock); +rcu_read_unlock ();return kn; err_unlock: -spin_unlock (&kernfs_idr_lock); +rcu_read_unlock ();return NULL ; }
fs/kernfs/kernfs-internal.h +2 -0
@@ -49,6 +49,8 @@ struct kernfs_root {struct rw_semaphore kernfs_rwsem;struct rw_semaphore kernfs_iattr_rwsem;struct rw_semaphore kernfs_supers_rwsem; + +struct rcu_head rcu; };/* +1 to avoid triggering overflow warning when negating it */
include/linux/kernfs.h +2 -0
@@ -223,6 +223,8 @@ struct kernfs_node {unsigned short flags;umode_t mode;struct kernfs_iattrs *iattr; + +struct rcu_head rcu; };/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/143 usb: typec: ucsi: Add qcm6490-pmic-glink as needing PDOS quirk
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit 88bae831f3810e02c9c951233c7ee662aa13dc2c ]
The QCM6490 Linux Android firmware needs this workaround as well. Add it to the list.
--- drivers/usb/typec/ucsi/ucsi_glink.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/typec/ucsi/ucsi_glink.c +1 -0
@@ -312,6 +312,7 @@ static void pmic_glink_ucsi_destroy(void *data) }static const struct of_device_id pmic_glink_ucsi_of_quirks[] = { + { .compatible ="qcom,qcm6490-pmic-glink" , .data = (void *)UCSI_NO_PARTNER_PDOS , }, { .compatible ="qcom,sc8180x-pmic-glink" , .data = (void *)UCSI_NO_PARTNER_PDOS , }, { .compatible ="qcom,sc8280xp-pmic-glink" , .data = (void *)UCSI_NO_PARTNER_PDOS , }, { .compatible ="qcom,sm8350-pmic-glink" , .data = (void *)UCSI_NO_PARTNER_PDOS , },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/143 thunderbolt: Calculate DisplayPort tunnel bandwidth after DPRX capabilities read
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gil Fine <[email protected]>
[ Upstream commit ccd845021147dc8257a05ed8f5a7f9c61a9101e3 ]
According to USB4 Connection Manager guide, after DisplayPort tunnel was setup, the DPRX capabilities read is performed by the DPTX. According to VESA spec, this shall be completed within 5 seconds after the DisplayPort tunnel was setup. Hence, if the bit: DPRX Capabilities Read Done, was not set to '1' by this time, we timeout and fail calculating DisplayPort tunnel consumed bandwidth.
--- drivers/thunderbolt/tunnel.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-)
drivers/thunderbolt/tunnel.c +6 -10
@@ -1196,17 +1196,13 @@ static int tb_dp_consumed_bandwidth(struct tb_tunnel *tunnel, int *consumed_up,/* * Then see if the DPRX negotiation is ready and if yes * return that bandwidth (it may be smaller than the -* reduced one). Otherwise return the remote (possibly -* reduced) caps. +* reduced one). According to VESA spec, the DPRX +* negotiation shall compete in 5 seconds after tunnel +* established. We give it 100ms extra just in case. */ - ret =tb_dp_wait_dprx (tunnel,150 ); -if (ret) { -if (ret == -ETIMEDOUT ) - ret =tb_dp_read_cap (tunnel,DP_REMOTE_CAP , - &rate, &lanes); -if (ret) -return ret; - } + ret =tb_dp_wait_dprx (tunnel,5100 ); +if (ret) +return ret; ret =tb_dp_read_cap (tunnel,DP_COMMON_CAP , &rate, &lanes);if (ret)return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/143 usb: gadget: uvc: refactor the check for a valid buffer in the pump worker
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Grzeschik <[email protected]>
[ Upstream commit 5e7ea65daf13a95a6cc63d1377e4c500e4e1340f ]
By toggling the condition check for a valid buffer, the else path can be completely avoided.
--- drivers/usb/gadget/function/uvc_video.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/usb/gadget/function/uvc_video.c +3 -4
@@ -594,10 +594,7 @@ static void uvcg_video_pump(struct work_struct *work)*/ spin_lock_irqsave (&queue->irqlock, flags); buf =uvcg_queue_head (queue); - -if (buf !=NULL ) { - video->encode (req, video, buf); - }else { +if (!buf) {/* * Either the queue has been disconnected or no video buffer * available for bulk transfer. Either way, stop processing
@@ -607,6 +604,8 @@ static void uvcg_video_pump(struct work_struct *work)break ; } + video->encode (req, video, buf); +spin_unlock_irqrestore (&queue->irqlock, flags);spin_lock_irqsave (&video->req_lock, flags);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/143 usb: gadget: uvc: mark incomplete frames with UVC_STREAM_ERR
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Grzeschik <[email protected]>
[ Upstream commit 2a3b7af120477d0571b815ccb8600cafd5ebf02f ]
If an frame was transmitted incomplete to the host, we set the UVC_STREAM_ERR bit in the header for the last request that is going to be queued. This way the host will know that it should drop the frame instead of trying to display the corrupted content.
--- drivers/usb/gadget/function/uvc_video.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/gadget/function/uvc_video.c +3 -0
@@ -35,6 +35,9 @@ uvc_video_encode_header(struct uvc_video *video, struct uvc_buffer *buf, data[1 ] =UVC_STREAM_EOH | video->fid; +if (video->queue.flags &UVC_QUEUE_DROP_INCOMPLETE ) + data[1 ] |=UVC_STREAM_ERR ; +if (video->queue.buf_used ==0 && ts.tv_sec) {/* dwClockFrequency is 48 MHz */ u32 pts = ((u64 )ts.tv_sec *USEC_PER_SEC + ts.tv_nsec /NSEC_PER_USEC ) *48 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/143 usb: typec: ucsi: Limit read size on v1.2
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhishek Pandit-Subedi <[email protected]>
[ Upstream commit b3db266fb031fba88c423d4bb8983a73a3db6527 ]
Between UCSI 1.2 and UCSI 2.0, the size of the MESSAGE_IN region was increased from 16 to 256. In order to avoid overflowing reads for older systems, add a mechanism to use the read UCSI version to truncate read sizes on UCSI v1.2.
--- drivers/usb/typec/ucsi/ucsi.c | 26 ++++++++++++++++++++++++-- drivers/usb/typec/ucsi/ucsi.h | 11 +++++++++++ 2 files changed, 35 insertions(+), 2 deletions(-)
drivers/usb/typec/ucsi/ucsi.c +24 -2
@@ -36,6 +36,19 @@*/ #define UCSI_SWAP_TIMEOUT_MS 5000 +static int ucsi_read_message_in (struct ucsi *ucsi,void *buf, +size_t buf_size) +{ +/* +* Below UCSI 2.0, MESSAGE_IN was limited to 16 bytes. Truncate the +* reads here. +*/ +if (ucsi->version <=UCSI_VERSION_1_2 ) + buf_size =clamp (buf_size,0 ,16 ); + +return ucsi->ops->read (ucsi,UCSI_MESSAGE_IN , buf, buf_size); +} +static int ucsi_acknowledge_command (struct ucsi *ucsi) {u64 ctrl;
@@ -72,7 +85,7 @@ static int ucsi_read_error(struct ucsi *ucsi)if (ret <0 )return ret; - ret = ucsi->ops->read (ucsi,UCSI_MESSAGE_IN , &error,sizeof (error)); + ret =ucsi_read_message_in (ucsi, &error,sizeof (error));if (ret)return ret;
@@ -174,7 +187,7 @@ int ucsi_send_command(struct ucsi *ucsi, u64 command, length = ret;if (data) { - ret = ucsi->ops->read (ucsi,UCSI_MESSAGE_IN , data, size); + ret =ucsi_read_message_in (ucsi, data, size);if (ret) goto out; }
@@ -1596,6 +1609,15 @@ int ucsi_register(struct ucsi *ucsi)if (!ucsi->version)return -ENODEV ; +/* +* Version format is JJ.M.N (JJ = Major version, M = Minor version, +* N = sub-minor version). +*/ +dev_dbg (ucsi->dev,"Registered UCSI interface with version %x.%x.%x" , +UCSI_BCD_GET_MAJOR (ucsi->version), +UCSI_BCD_GET_MINOR (ucsi->version), +UCSI_BCD_GET_SUBMINOR (ucsi->version)); +queue_delayed_work (system_long_wq, &ucsi->work,0 );ucsi_debugfs_register (ucsi);
drivers/usb/typec/ucsi/ucsi.h +11 -0
@@ -23,6 +23,17 @@ struct dentry;#define UCSI_CONTROL 8#define UCSI_MESSAGE_IN 16#define UCSI_MESSAGE_OUT 32 +#define UCSIv2_MESSAGE_OUT 272 + +/* UCSI versions */ +#define UCSI_VERSION_1_2 0x0120 +#define UCSI_VERSION_2_0 0x0200 +#define UCSI_VERSION_2_1 0x0210 +#define UCSI_VERSION_3_0 0x0300 + +#define UCSI_BCD_GET_MAJOR (_v_) (((_v_) >> 8) & 0xFF) +#define UCSI_BCD_GET_MINOR (_v_) (((_v_) >> 4) & 0x0F) +#define UCSI_BCD_GET_SUBMINOR (_v_) ((_v_) & 0x0F)/* Command Status and Connector Change Indication (CCI) bits */ #define UCSI_CCI_CONNECTOR (_c_) (((_c_) & GENMASK(7, 1)) >> 1)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/143 serial: 8250_of: Drop quirk fot NPCM from 8250_port
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit cd0eb354d441488feed6685adbeb1acd45db1b8d ]
We are not supposed to spread quirks in 8250_port module especially when we have a separate driver for the hardware in question.
Move quirk from generic module to the driver that uses it.
--- drivers/tty/serial/8250/8250_of.c | 44 +++++++++++++++++++++++++++-- drivers/tty/serial/8250/8250_port.c | 24 ---------------- 2 files changed, 42 insertions(+), 26 deletions(-)
drivers/tty/serial/8250/8250_of.c +42 -2
@@ -4,7 +4,10 @@* * Copyright (C) 2006 Arnd Bergmann <[email protected]>, IBM Corp. */ + +#include <linux/bits.h> #include <linux/console.h> +#include <linux/math.h> #include <linux/module.h> #include <linux/slab.h> #include <linux/serial_core.h>
@@ -25,6 +28,36 @@ struct of_serial_info {int line; }; +/* Nuvoton NPCM timeout register */ +#define UART_NPCM_TOR 7 +#define UART_NPCM_TOIE BIT(7)/* Timeout Interrupt Enable */ + +static int npcm_startup (struct uart_port *port) +{ +/* +* Nuvoton calls the scratch register 'UART_TOR' (timeout +* register). Enable it, and set TIOC (timeout interrupt +* comparator) to be 0x20 for correct operation. +*/ +serial_port_out (port,UART_NPCM_TOR ,UART_NPCM_TOIE |0x20 ); + +return serial8250_do_startup (port); +} + +/* Nuvoton NPCM UARTs have a custom divisor calculation */ +static unsigned int npcm_get_divisor (struct uart_port *port,unsigned int baud, +unsigned int *frac) +{ +return DIV_ROUND_CLOSEST (port->uartclk,16 * baud +2 ) -2 ; +} + +static int npcm_setup (struct uart_port *port) +{ + port->get_divisor = npcm_get_divisor; + port->startup = npcm_startup; +return 0 ; +} +/* * Fill a struct uart_port for a given device node */
@@ -164,10 +197,17 @@ static int of_platform_serial_setup(struct platform_device *ofdev,switch (type) {case PORT_RT2880 : ret =rt288x_setup (port); -if (ret) - goto err_pmruntime; +break ; +case PORT_NPCM : + ret =npcm_setup (port); +break ; +default : +/* Nothing to do */ + ret =0 ;break ; } +if (ret) + goto err_pmruntime; if (IS_REACHABLE(CONFIG_SERIAL_8250_FSL) && (of_device_is_compatible(np, "fsl,ns16550") ||
drivers/tty/serial/8250/8250_port.c +0 -24
@@ -38,10 +38,6 @@#include "8250.h" -/* Nuvoton NPCM timeout register */ -#define UART_NPCM_TOR 7 -#define UART_NPCM_TOIE BIT(7)/* Timeout Interrupt Enable */ -/* * Debugging. */
@@ -2229,15 +2225,6 @@ int serial8250_do_startup(struct uart_port *port) UART_DA830_PWREMU_MGMT_FREE); } -if (port->type ==PORT_NPCM ) { -/* -* Nuvoton calls the scratch register 'UART_TOR' (timeout -* register). Enable it, and set TIOC (timeout interrupt -* comparator) to be 0x20 for correct operation. -*/ -serial_port_out (port,UART_NPCM_TOR ,UART_NPCM_TOIE |0x20 ); - } -#ifdef CONFIG_SERIAL_8250_RSA /* * If this is an RSA port, see if we can kick it up to the
@@ -2539,15 +2526,6 @@ static void serial8250_shutdown(struct uart_port *port)serial8250_do_shutdown (port); } -/* Nuvoton NPCM UARTs have a custom divisor calculation */ -static unsigned int npcm_get_divisor (struct uart_8250_port *up, -unsigned int baud) -{ -struct uart_port *port = &up->port; - -return DIV_ROUND_CLOSEST (port->uartclk,16 * baud +2 ) -2 ; -} -static unsigned int serial8250_do_get_divisor (struct uart_port *port,unsigned int baud,unsigned int *frac)
@@ -2592,8 +2570,6 @@ static unsigned int serial8250_do_get_divisor(struct uart_port *port, quot =0x8001 ; else if (magic_multiplier && baud >= port->uartclk / 12) quot =0x8002 ; - else if (up->port.type == PORT_NPCM) - quot =npcm_get_divisor (up, baud); else quot =uart_get_divisor (port, baud);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/143 thunderbolt: Keep the domain powered when USB4 port is in redrive mode
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <[email protected]>
[ Upstream commit a75e0684efe567ae5f6a8e91a8360c4c1773cf3a ]
If a DiplayPort cable is directly connected to the host routers USB4 port, there is no tunnel involved but the port is in "redrive" mode meaning that it is re-driving the DisplayPort signals from its DisplayPort source. In this case we need to keep the domain powered on otherwise once the domain enters D3cold the connected monitor blanks too.
Since this happens only on Intel Barlow Ridge add a quirk that takes runtime PM reference if we detect that the USB4 port entered redrive mode (and release it once it exits the mode).
--- drivers/thunderbolt/quirks.c | 14 +++++++++++ drivers/thunderbolt/tb.c | 49 +++++++++++++++++++++++++++++++++++- drivers/thunderbolt/tb.h | 4 +++ 3 files changed, 66 insertions(+), 1 deletion(-)
drivers/thunderbolt/quirks.c +14 -0
@@ -43,6 +43,12 @@ static void quirk_usb3_maximum_bandwidth(struct tb_switch *sw) } } +static void quirk_block_rpm_in_redrive (struct tb_switch *sw) +{ + sw->quirks |=QUIRK_KEEP_POWER_IN_DP_REDRIVE ; +tb_sw_dbg (sw,"preventing runtime PM in DP redrive mode\n" ); +} +struct tb_quirk {u16 hw_vendor_id;u16 hw_device_id;
@@ -86,6 +92,14 @@ static const struct tb_quirk tb_quirks[] = { quirk_usb3_maximum_bandwidth }, {0x8087 ,PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_40G_BRIDGE ,0x0000 ,0x0000 , quirk_usb3_maximum_bandwidth }, +/* +* Block Runtime PM in DP redrive mode for Intel Barlow Ridge host +* controllers. +*/ + { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI, 0x0000, 0x0000, + quirk_block_rpm_in_redrive }, + { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI, 0x0000, 0x0000, + quirk_block_rpm_in_redrive },/* * CLx is not supported on AMD USB4 Yellow Carp and Pink Sardine platforms. */
drivers/thunderbolt/tb.c +48 -1
67 lines not on this page · raw message
drivers/thunderbolt/tb.h +4 -0
@@ -23,6 +23,8 @@#define QUIRK_FORCE_POWER_LINK_CONTROLLER BIT(0)/* Disable CLx if not supported */ #define QUIRK_NO_CLX BIT(1) +/* Need to keep power on while USB4 port is in redrive mode */ +#define QUIRK_KEEP_POWER_IN_DP_REDRIVE BIT(2)/** * struct tb_nvm - Structure holding NVM information
@@ -258,6 +260,7 @@ struct tb_bandwidth_group {* @group_list: The adapter is linked to the group's list of ports through this * @max_bw: Maximum possible bandwidth through this adapter if set to * non-zero. +* @redrive: For DP IN, if true the adapter is in redrive mode. * * In USB4 terminology this structure represents an adapter (protocol or * lane adapter).
@@ -286,6 +289,7 @@ struct tb_port {struct tb_bandwidth_group *group;struct list_head group_list;unsigned int max_bw; +bool redrive; };/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/143 usb: typec: tcpci: add generic tcpci fallback compatible
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Felsch <[email protected]>
[ Upstream commit 8774ea7a553e2aec323170d49365b59af0a2b7e0 ]
The driver already support the tcpci binding for the i2c_device_id so add the support for the of_device_id too.
--- drivers/usb/typec/tcpm/tcpci.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/typec/tcpm/tcpci.c +1 -0
@@ -889,6 +889,7 @@ MODULE_DEVICE_TABLE(i2c, tcpci_id);#ifdef CONFIG_OF static const struct of_device_id tcpci_of_match[] = { { .compatible ="nxp,ptn5110" , }, + { .compatible ="tcpci" , }, {}, };MODULE_DEVICE_TABLE (of, tcpci_of_match);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/143 usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
[ Upstream commit 12f371e2b6cb4b79c788f1f073992e115f4ca918 ]
Function checkdone is only required if QUIRK2 is defined, so add appropriate #if / #endif around the function.
Cleans up clang scan build warning:drivers/usb/host/sl811-hcd.c:588:18: warning: unused function 'checkdone' [-Wunused-function]
--- drivers/usb/host/sl811-hcd.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/host/sl811-hcd.c +2 -0
@@ -585,6 +585,7 @@ done(struct sl811 *sl811, struct sl811h_ep *ep, u8 bank)finish_request (sl811, ep, urb, urbstat); } +#ifdef QUIRK2 static inline u8 checkdone (struct sl811 *sl811) {u8 ctl;
@@ -616,6 +617,7 @@ static inline u8 checkdone(struct sl811 *sl811)#endif return irqstat; } +#endif static irqreturn_t sl811h_irq (struct usb_hcd *hcd) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/143 ASoC: amd: yc: Fix non-functional mic on ASUS M7600RE
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: M Cooley <[email protected]>
[ Upstream commit db185362fca554b201e2c62beb15a02bb39a064b ]
The ASUS M7600RE (Vivobook Pro 16X OLED) needs a quirks-table entry for the internal microphone to function properly.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -311,6 +311,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "E1504FA"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_PRODUCT_NAME, "M7600RE"), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/143 thermal/of: Assume polling-delay(-passive) 0 when absent
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 488164006a281986d95abbc4b26e340c19c4c85b ]
Currently, thermal zones associated with providers that have interrupts for signaling hot/critical trips are required to set a polling-delay of 0 to indicate no polling. This feels a bit backwards.
Change the code such that "no polling delay" also means "no polling".
--- drivers/thermal/thermal_of.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/thermal/thermal_of.c +8 -4
@@ -225,14 +225,18 @@ static int thermal_of_monitor_init(struct device_node *np, int *delay, int *pdelint ret; ret =of_property_read_u32 (np,"polling-delay-passive" , pdelay); -if (ret <0 ) { -pr_err ("%pOFn: missing polling-delay-passive property\n" , np); +if (ret == -EINVAL ) { + *pdelay =0 ; + }else if (ret <0 ) { +pr_err ("%pOFn: Couldn't get polling-delay-passive: %d\n" , np, ret);return ret; } ret =of_property_read_u32 (np,"polling-delay" , delay); -if (ret <0 ) { -pr_err ("%pOFn: missing polling-delay property\n" , np); +if (ret == -EINVAL ) { + *delay =0 ; + }else if (ret <0 ) { +pr_err ("%pOFn: Couldn't get polling-delay: %d\n" , np, ret);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/143 ASoC: soc-core.c: Skip dummy codec when adding platforms
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chancel Liu <[email protected]>
[ Upstream commit 23fb6bc2696119391ec3a92ccaffe50e567c515e ]
When pcm_runtime is adding platform components it will scan all registered components. In case of DPCM FE/BE some DAI links will configure dummy platform. However both dummy codec and dummy platform are using "snd-soc-dummy" as component->name. Dummy codec should be skipped when adding platforms otherwise there'll be overflow and UBSAN complains.
--- sound/soc/soc-core.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/soc-core.c +3 -0
@@ -1218,6 +1218,9 @@ static int snd_soc_add_pcm_runtime(struct snd_soc_card *card,if (!snd_soc_is_matching_component (platform, component))continue ; +if (snd_soc_component_is_dummy (component) && component->num_dai) +continue ; +snd_soc_rtd_add_component (rtd, component); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/143 x86/xen: attempt to inflate the memory balloon on PVH
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Pau Monne <[email protected]>
[ Upstream commit 38620fc4e8934f1801c7811ef39a041914ac4c1d ]
When running as PVH or HVM Linux will use holes in the memory map as scratch space to map grants, foreign domain pages and possibly miscellaneous other stuff. However the usage of such memory map holes for Xen purposes can be problematic. The request of holesby Xen happen quite early in the kernel boot process (grant table setup already uses scratch map space), and it's possible that by then not all devices have reclaimed their MMIO space. It's not unlikely for chunks of Xen scratch map space to end up using PCI bridge MMIO window memory, which (as expected) causes quite a lot of issues in the system.
At least for PVH dom0 we have the possibility of using regions marked as UNUSABLE in the e820 memory map. Either if the region is UNUSABLE in the native memory map, or it has been converted into UNUSABLE in order to hide RAM regions from dom0, the second stage translation page-tables can populate those areas without issues.
PV already has this kind of logic, where the balloon driver is inflated at boot. Re-use the current logic in order to also inflate it when running as PVH. onvert UNUSABLE regions up to the ratio specified in EXTRA_MEM_RATIO to RAM, while reserving them using xen_add_extra_mem() (which is also moved so it's no longer tied to CONFIG_PV).
[jgross: fixed build for CONFIG_PVH without CONFIG_XEN_PVH]
--- arch/x86/include/asm/xen/hypervisor.h | 5 ++ arch/x86/platform/pvh/enlighten.c | 3 ++ arch/x86/xen/enlighten.c | 32 +++++++++++++ arch/x86/xen/enlighten_pvh.c | 68 +++++++++++++++++++++++++++ arch/x86/xen/setup.c | 44 ----------------- arch/x86/xen/xen-ops.h | 14 ++++++ drivers/xen/balloon.c | 2 - 7 files changed, 122 insertions(+), 46 deletions(-)
arch/x86/include/asm/xen/hypervisor.h +5 -0
@@ -62,6 +62,11 @@ void xen_arch_unregister_cpu(int num);#ifdef CONFIG_PVH void __init xen_pvh_init (struct boot_params *boot_params);void __init mem_map_via_hcall (struct boot_params *boot_params_p); +#ifdef CONFIG_XEN_PVH +void __init xen_reserve_extra_memory (struct boot_params *bootp); +#else +static inline void xen_reserve_extra_memory (struct boot_params *bootp) { } +#endif #endif /* Lazy mode for batching updates / context switch */
arch/x86/platform/pvh/enlighten.c +3 -0
@@ -74,6 +74,9 @@ static void __init init_pvh_bootparams(bool xen_guest) }else xen_raw_printk ("Warning: Can fit ISA range into e820\n" ); +if (xen_guest) +xen_reserve_extra_memory (&pvh_bootparams); + pvh_bootparams.hdr.cmd_line_ptr = pvh_start_info.cmdline_paddr;
arch/x86/xen/enlighten.c +32 -0
@@ -6,6 +6,7 @@#include <linux/console.h> #include <linux/cpu.h> #include <linux/kexec.h> +#include <linux/memblock.h> #include <linux/slab.h> #include <linux/panic_notifier.h>
@@ -350,3 +351,34 @@ void xen_arch_unregister_cpu(int num) }EXPORT_SYMBOL (xen_arch_unregister_cpu);#endif + +/* Amount of extra memory space we add to the e820 ranges */ +struct xen_memory_region xen_extra_mem[XEN_EXTRA_MEM_MAX_REGIONS ]__initdata ; + +void __init xen_add_extra_mem (unsigned long start_pfn,unsigned long n_pfns) +{ +unsigned int i; + +/* +* No need to check for zero size, should happen rarely and will only +* write a new entry regarded to be unused due to zero size. +*/ +for (i =0 ; i <XEN_EXTRA_MEM_MAX_REGIONS ; i++) { +/* Add new region. */ +if (xen_extra_mem[i].n_pfns ==0 ) { + xen_extra_mem[i].start_pfn = start_pfn; + xen_extra_mem[i].n_pfns = n_pfns; +break ; + } +/* Append to existing region. */ +if (xen_extra_mem[i].start_pfn + xen_extra_mem[i].n_pfns == + start_pfn) { + xen_extra_mem[i].n_pfns += n_pfns; +break ; + } + } +if (i ==XEN_EXTRA_MEM_MAX_REGIONS ) +printk (KERN_WARNING "Warning: not enough extra memory regions\n" ); + +memblock_reserve (PFN_PHYS (start_pfn),PFN_PHYS (n_pfns)); +}
arch/x86/xen/enlighten_pvh.c +68 -0
77 lines not on this page · raw message
arch/x86/xen/setup.c +0 -44
62 lines not on this page · raw message
arch/x86/xen/xen-ops.h +14 -0
@@ -163,4 +163,18 @@ void xen_hvm_post_suspend(int suspend_cancelled);static inline void xen_hvm_post_suspend (int suspend_cancelled) {}#endif +/* +* The maximum amount of extra memory compared to the base size. The +* main scaling factor is the size of struct page. At extreme ratios +* of base:extra, all the base memory can be filled with page +* structures for the extra memory, leaving no space for anything +* else. +* +* 10x seems like a reasonable balance between scaling flexibility and +* leaving a practically usable system. +*/ +#define EXTRA_MEM_RATIO (10) + +void xen_add_extra_mem (unsigned long start_pfn,unsigned long n_pfns); +#endif /* XEN_OPS_H */
drivers/xen/balloon.c +0 -2
@@ -672,7 +672,6 @@ EXPORT_SYMBOL(xen_free_ballooned_pages);static void __init balloon_add_regions (void ) { -#if defined(CONFIG_XEN_PV )unsigned long start_pfn, pages;unsigned long pfn, extra_pfn_end;unsigned int i;
@@ -696,7 +695,6 @@ static void __init balloon_add_regions(void) balloon_stats.total_pages += extra_pfn_end - start_pfn; } -#endif }static int __init balloon_init (void )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/143 fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Burakov <[email protected]>
[ Upstream commit bc87bb342f106a0402186bcb588fcbe945dced4b ]
There are some actions with value 'tmp' but 'dst_addr' is checked instead. It is obvious that a copy-paste error was made here and the value of variable 'tmp' should be checked here.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/video/fbdev/via/accel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/video/fbdev/via/accel.c +2 -2
@@ -115,7 +115,7 @@ static int hw_bitblt_1(void __iomem *engine, u8 op, u32 width, u32 height,if (op !=VIA_BITBLT_FILL ) { tmp = src_mem ?0 : src_addr; -if (dst_addr &0xE0000007 ) { +if (tmp &0xE0000007 ) {printk (KERN_WARNING "hw_bitblt_1: Unsupported source " "address %X\n" , tmp);return -EINVAL ;
@@ -260,7 +260,7 @@ static int hw_bitblt_2(void __iomem *engine, u8 op, u32 width, u32 height,writel (tmp, engine +0x18 ); tmp = src_mem ?0 : src_addr; -if (dst_addr &0xE0000007 ) { +if (tmp &0xE0000007 ) {printk (KERN_WARNING "hw_bitblt_2: Unsupported source " "address %X\n" , tmp);return -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/143 io_uring: clear opcode specific data for an early failure
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
[ Upstream commit e21e1c45e1fe2e31732f40256b49c04e76a17cee ]
If failure happens before the opcode prep handler is called, ensure that we clear the opcode specific area of the request, which holds data specific to that request type. This prevents errors where opcode handlers either don't get to clear per-request private data since prep isn't even called.
--- io_uring/io_uring.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-)
io_uring/io_uring.c +16 -9
@@ -2143,6 +2143,13 @@ static void io_init_req_drain(struct io_kiocb *req) } } +static __cold int io_init_fail_req (struct io_kiocb *req,int err) +{ +/* ensure per-opcode data is cleared if we fail before prep */ +memset (&req->cmd.data,0 ,sizeof (req->cmd.data)); +return err; +} + static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, const struct io_uring_sqe *sqe) __must_hold(&ctx->uring_lock)
@@ -2163,29 +2170,29 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req,if (unlikely (opcode >=IORING_OP_LAST )) { req->opcode =0 ; -return -EINVAL ; +return io_init_fail_req (req, -EINVAL ); } def = &io_issue_defs[opcode];if (unlikely (sqe_flags & ~SQE_COMMON_FLAGS )) {/* enforce forwards compatibility on users */ if (sqe_flags & ~SQE_VALID_FLAGS ) -return -EINVAL ; +return io_init_fail_req (req, -EINVAL );if (sqe_flags &IOSQE_BUFFER_SELECT ) {if (!def->buffer_select) -return -EOPNOTSUPP ; +return io_init_fail_req (req, -EOPNOTSUPP ); req->buf_index =READ_ONCE (sqe->buf_group); }if (sqe_flags &IOSQE_CQE_SKIP_SUCCESS ) ctx->drain_disabled = true;if (sqe_flags &IOSQE_IO_DRAIN ) {if (ctx->drain_disabled) -return -EOPNOTSUPP ; +return io_init_fail_req (req, -EOPNOTSUPP );io_init_req_drain (req); } }if (unlikely (ctx->restricted || ctx->drain_active || ctx->drain_next)) {if (ctx->restricted && !io_check_restriction (ctx, req, sqe_flags)) -return -EACCES ; +return io_init_fail_req (req, -EACCES );/* knock it to the slow queue path, will be drained there */ if (ctx->drain_active) req->flags |=REQ_F_FORCE_ASYNC ;
@@ -2198,9 +2205,9 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, }if (!def->ioprio && sqe->ioprio) -return -EINVAL ; +return io_init_fail_req (req, -EINVAL );if (!def->iopoll && (ctx->flags &IORING_SETUP_IOPOLL )) -return -EINVAL ; +return io_init_fail_req (req, -EINVAL );if (def->needs_file) {struct io_submit_state *state = &ctx->submit_state;
@@ -2224,12 +2231,12 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, req->creds =xa_load (&ctx->personalities, personality);if (!req->creds) -return -EINVAL ; +return io_init_fail_req (req, -EINVAL );get_cred (req->creds); ret =security_uring_override_creds (req->creds);if (ret) {put_cred (req->creds); -return ret; +return io_init_fail_req (req, ret); } req->flags |=REQ_F_CREDS ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/143 modpost: fix null pointer dereference
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <[email protected]>
[ Upstream commit 23dfd914d2bfc4c9938b0084dffd7105de231d98 ]
If the find_fromsym() call fails and returns NULL, the warn() call will dereference this NULL pointer and cause the program to crash.
This happened when I tried to build with "test_user_copy" module. With this fix, it prints lots of warnings like this:
WARNING: modpost: lib/test_user_copy: section mismatch in reference: (unknown)+0x4 (section: .text.fixup) -> (unknown) (section: .init.text)
[email protected]:
The issue is reproduced with ARCH=arm allnoconfig + CONFIG_MODULES=y + CONFIG_RUNTIME_TESTING_MENU=y + CONFIG_TEST_USER_COPY=m
--- scripts/mod/modpost.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
scripts/mod/modpost.c +3 -1
@@ -1053,7 +1053,9 @@ static void default_mismatch_handler(const char *modname, struct elf_info *elf, sec_mismatch_count++;warn ("%s: section mismatch in reference: %s+0x%x (section: %s) -> %s (section: %s)\n" , - modname, fromsym, (unsigned int )(faddr - from->st_value), fromsec, tosym, tosec); + modname, fromsym, + (unsigned int )(faddr - (from ? from->st_value :0 )), + fromsec, tosym, tosec);if (mismatch->mismatch ==EXTABLE_TO_NON_TEXT ) {if (match (tosec, mismatch->bad_tosec))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/143 drivers/nvme: Add quirks for device 126f:2262
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawei Fu (iBug) <[email protected]>
[ Upstream commit e89086c43f0500bc7c4ce225495b73b8ce234c1f ]
This commit adds NVME_QUIRK_NO_DEEPEST_PS and NVME_QUIRK_BOGUS_NID for device [126f:2262], which appears to be a generic VID:PID pair used for many SSDs based on the Silicon Motion SM2262/SM2262EN controller.
Two of my SSDs with this VID:PID pair exhibit the same behavior:
* They frequently have trouble exiting the deepest power state (5), resulting in the entire disk unresponsive.
Verified by setting nvme_core.default_ps_max_latency_us=10000 and observing them behaving normally.
* They produce all-zero nguid and eui64 with nvme id-ns command.
The offending products are:
* HP SSD EX950 1TB
* HIKVISION C2000Pro 2TB
--- drivers/nvme/host/pci.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/nvme/host/pci.c +3 -0
@@ -3363,6 +3363,9 @@ static const struct pci_device_id nvme_id_table[] = { NVME_QUIRK_BOGUS_NID, }, { PCI_VDEVICE(REDHAT, 0x0010), /* Qemu emulated controller */ .driver_data = NVME_QUIRK_BOGUS_NID, }, + { PCI_DEVICE(0x126f, 0x2262), /* Silicon Motion generic */ + .driver_data = NVME_QUIRK_NO_DEEPEST_PS | + NVME_QUIRK_BOGUS_NID, }, { PCI_DEVICE(0x126f, 0x2263), /* Silicon Motion unidentified */ .driver_data = NVME_QUIRK_NO_NS_DESC_LIST | NVME_QUIRK_BOGUS_NID, },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/143 fbmon: prevent division by zero in fb_videomode_from_videomode()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Smirnov <[email protected]>
[ Upstream commit c2d953276b8b27459baed1277a4fdd5dd9bd4126 ]
The expression htotal * vtotal can have a zero value on overflow. It is necessary to prevent division by zero like in fb_var_to_videomode().
Found by Linux Verification Center (linuxtesting.org) with Svace.
--- drivers/video/fbdev/core/fbmon.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/video/fbdev/core/fbmon.c +4 -3
@@ -1311,7 +1311,7 @@ int fb_get_mode(int flags, u32 val, struct fb_var_screeninfo *var, struct fb_infint fb_videomode_from_videomode (const struct videomode *vm,struct fb_videomode *fbmode) { -unsigned int htotal, vtotal; +unsigned int htotal, vtotal, total; fbmode->xres = vm->hactive; fbmode->left_margin = vm->hback_porch;
@@ -1344,8 +1344,9 @@ int fb_videomode_from_videomode(const struct videomode *vm, vtotal = vm->vactive + vm->vfront_porch + vm->vback_porch + vm->vsync_len;/* prevent division by zero */ -if (htotal && vtotal) { - fbmode->refresh = vm->pixelclock / (htotal * vtotal); + total = htotal * vtotal; +if (total) { + fbmode->refresh = vm->pixelclock / total;/* a mode must have htotal and vtotal != 0 or it is invalid */ }else { fbmode->refresh =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/143 ALSA: hda/realtek: Add quirks for some Clevo laptops
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Crawford <[email protected]>
[ Upstream commit 33affa7fb46c0c07f6c49d4ddac9dd436715064c ]
Add audio quirks to fix speaker output and headset detection on some new Clevo models:
- L240TU (ALC245)
- PE60SNE-G (ALC1220)
- V350SNEQ (ALC245)
Message-ID: <[email protected]>
--- sound/pci/hda/patch_realtek.c | 3 +++ 1 file changed, 3 insertions(+)
sound/pci/hda/patch_realtek.c +3 -0
@@ -2646,6 +2646,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {SND_PCI_QUIRK (0x1558 ,0x65f1 ,"Clevo PC50HS" ,ALC1220_FIXUP_CLEVO_PB51ED_PINS ),SND_PCI_QUIRK (0x1558 ,0x65f5 ,"Clevo PD50PN[NRT]" ,ALC1220_FIXUP_CLEVO_PB51ED_PINS ),SND_PCI_QUIRK (0x1558 ,0x66a2 ,"Clevo PE60RNE" ,ALC1220_FIXUP_CLEVO_PB51ED_PINS ), +SND_PCI_QUIRK (0x1558 ,0x66a6 ,"Clevo PE60SN[CDE]-[GS]" ,ALC1220_FIXUP_CLEVO_PB51ED_PINS ),SND_PCI_QUIRK (0x1558 ,0x67d1 ,"Clevo PB71[ER][CDF]" ,ALC1220_FIXUP_CLEVO_PB51ED_PINS ),SND_PCI_QUIRK (0x1558 ,0x67e1 ,"Clevo PB71[DE][CDF]" ,ALC1220_FIXUP_CLEVO_PB51ED_PINS ), SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
@@ -10214,12 +10215,14 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1462 ,0xb120 ,"MSI Cubi MS-B120" ,ALC283_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x1462 ,0xb171 ,"Cubi N 8GL (MS-B171)" ,ALC283_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x152d ,0x1082 ,"Quanta NL3" ,ALC269_FIXUP_LIFEBOOK ), +SND_PCI_QUIRK (0x1558 ,0x0353 ,"Clevo V35[05]SN[CDE]Q" ,ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x1323 ,"Clevo N130ZU" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x1325 ,"Clevo N15[01][CW]U" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x1401 ,"Clevo L140[CZ]U" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x1403 ,"Clevo N140CU" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x1404 ,"Clevo N150CU" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x14a1 ,"Clevo L141MU" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0x1558 ,0x2624 ,"Clevo L240TU" ,ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x4018 ,"Clevo NV40M[BE]" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x4019 ,"Clevo NV40MZ" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ), SND_PCI_QUIRK(0x1558, 0x4020, "Clevo NV40MB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/143 drm/amdgpu: Init zone device and drm client after mode-1 reset on reload
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmad Rehman <[email protected]>
[ Upstream commit f679fd6057fbf5ab34aaee28d58b7f81af0cbf48 ]
In passthrough environment, when amdgpu is reloaded after unload, mode-1 is triggered after initializing the necessary IPs, That init does not include KFD, and KFD init waits until the reset is completed. KFD init is called in the reset handler, but in this case, the zone device and drm client is not initialized, causing app to create kernel panic.
v2: Removing the init KFD condition from amdgpu_amdkfd_drm_client_create. As the previous version has the potential of creating DRM client twice.
v3: v2 patch results in SDMA engine hung as DRM open causes VM clear to SDMA before SDMA init. Adding the condition to in drm client creation, on top of v1, to guard against drm client creation call multiple times.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c +1 -1
@@ -146,7 +146,7 @@ int amdgpu_amdkfd_drm_client_create(struct amdgpu_device *adev) {int ret; -if (!adev->kfd.init_complete) +if (!adev->kfd.init_complete || adev->kfd.client.dev)return 0 ; ret = drm_client_init(&adev->ddev, &adev->kfd.client, "kfd",
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +4 -1
@@ -2451,8 +2451,11 @@ static void amdgpu_drv_delayed_reset_work_handler(struct work_struct *work) }for (i =0 ; i < mgpu_info.num_dgpu; i++) { adev = mgpu_info.gpu_ins[i].adev; -if (!adev->kfd.init_complete) +if (!adev->kfd.init_complete) { +kgd2kfd_init_zone_device (adev);amdgpu_amdkfd_device_init (adev); +amdgpu_amdkfd_drm_client_create (adev); + }amdgpu_ttm_set_buffer_funcs_status (adev, true); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/143 gcc-plugins/stackleak: Avoid .head.text section
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit e7d24c0aa8e678f41457d1304e2091cac6fd1a2e upstream.
The .head.text section carries the startup code that runs with the MMU off or with a translation of memory that deviates from the ordinary one. So avoid instrumentation with the stackleak plugin, which already avoids .init.text and .noinstr.text entirely.
--- scripts/gcc-plugins/stackleak_plugin.c | 2 ++ 1 file changed, 2 insertions(+)
scripts/gcc-plugins/stackleak_plugin.c +2 -0
@@ -467,6 +467,8 @@ static bool stackleak_gate(void)return false;if (STRING_EQUAL (section,".entry.text" ))return false; +if (STRING_EQUAL (section,".head.text" )) +return false; }return track_frame_size >=0 ;
Greg Kroah-Hartman
maintainerPATCH 132/143 media: mediatek: vcodec: Fix oops when HEVC init fails
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Dufresne <[email protected]>
[ Upstream commit 97c75ee5de060d271d80109b0c47cb6008439e5b ]
The stateless HEVC decoder saves the instance pointer in the context regardless if the initialization worked or not. This caused a use after free, when the pointer is freed in case of a failure in the deinit function.
Only store the instance pointer when the initialization was successful, to solve this issue.
Hardware name: Acer Tomato (rev3 - 4) board (DT) pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec] lr : vcodec_send_ap_ipi+0x78/0x170 [mtk_vcodec_dec] sp : ffff80008750bc20 x29: ffff80008750bc20 x28: ffff1299f6d70000 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: ffff80008750bc98 x22: 000000000000a003 x21: ffffd45c4cfae000 x20: 0000000000000010 x19: ffff1299fd668310 x18: 000000000000001a x17: 000000040044ffff x16: ffffd45cb15dc648 x15: 0000000000000000 x14: ffff1299c08da1c0 x13: ffffd45cb1f87a10 x12: ffffd45cb2f5fe80 x11: 0000000000000001 x10: 0000000000001b30 x9 : ffffd45c4d12b488 x8 : 1fffe25339380d81 x7 : 0000000000000001 x6 : ffff1299c9c06c00 x5 : 0000000000000132 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000010 x1 : ffff80008750bc98 x0 : 0000000000000000 Call trace: vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec] vcodec_send_ap_ipi+0x78/0x170 [mtk_vcodec_dec] vpu_dec_deinit+0x1c/0x30 [mtk_vcodec_dec] vdec_hevc_slice_deinit+0x30/0x98 [mtk_vcodec_dec] vdec_if_deinit+0x38/0x68 [mtk_vcodec_dec] mtk_vcodec_dec_release+0x20/0x40 [mtk_vcodec_dec] fops_vcodec_release+0x64/0x118 [mtk_vcodec_dec] v4l2_release+0x7c/0x100 __fput+0x80/0x2d8 __fput_sync+0x58/0x70 __arm64_sys_close+0x40/0x90 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x38/0xd8 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x1a8/0x1b0 Code: d503201f f9401660 b900127f b900227f (f9400400)
--- .../mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c +1 -1
@@ -869,7 +869,6 @@ static int vdec_hevc_slice_init(struct mtk_vcodec_dec_ctx *ctx) inst->vpu.codec_type = ctx->current_codec; inst->vpu.capture_type = ctx->capture_fourcc; - ctx->drv_handle = inst; err =vpu_dec_init (&inst->vpu);if (err) {mtk_vdec_err (ctx,"vdec_hevc init err=%d" , err);
@@ -898,6 +897,7 @@ static int vdec_hevc_slice_init(struct mtk_vcodec_dec_ctx *ctx)mtk_vdec_debug (ctx,"lat hevc instance >> %p, codec_type = 0x%x" , inst, inst->vpu.codec_type); + ctx->drv_handle = inst;return 0 ; error_free_inst:kfree (inst);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/143 media: mediatek: vcodec: adding lock to protect decoder context list
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunfei Dong <[email protected]>
[ Upstream commit 6467cda18c9f9b5f2f9a0aa1e2861c653e41f382 ]
Add a lock for the ctx_list, to avoid accessing a NULL pointer within the 'vpu_dec_ipi_handler' function when the ctx_list has been deleted due to an unexpected behavior on the SCP IP block.
Hardware name: Google juniper sku16 board (DT) pstate: 20400005 (nzCv daif +PAN -UAO -TCO BTYPE=--) pc : vpu_dec_ipi_handler+0x58/0x1f8 [mtk_vcodec_dec] lr : scp_ipi_handler+0xd0/0x194 [mtk_scp]
sp : ffffffc0131dbbd0
x29: ffffffc0131dbbd0 x28: 0000000000000000
x27: ffffff9bb277f348 x26: ffffff9bb242ad00
x25: ffffffd2d440d3b8 x24: ffffffd2a13ff1d4
x23: ffffff9bb7fe85a0 x22: ffffffc0133fbdb0
x21: 0000000000000010 x20: ffffff9b050ea328
x19: ffffffc0131dbc08 x18: 0000000000001000
x17: 0000000000000000 x16: ffffffd2d461c6e0
x15: 0000000000000242 x14: 000000000000018f
x13: 000000000000004d x12: 0000000000000000
x11: 0000000000000001 x10: fffffffffffffff0
x9 : ffffff9bb6e793a8 x8 : 0000000000000000
x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : fffffffffffffff0
x3 : 0000000000000020 x2 : ffffff9bb6e79080
x1 : 0000000000000010 x0 : ffffffc0131dbc08
Call trace: vpu_dec_ipi_handler+0x58/0x1f8 [mtk_vcodec_dec (HASH:6c3f 2)] scp_ipi_handler+0xd0/0x194 [mtk_scp (HASH:7046 3)] mt8183_scp_irq_handler+0x44/0x88 [mtk_scp (HASH:7046 3)] scp_irq_handler+0x48/0x90 [mtk_scp (HASH:7046 3)] irq_thread_fn+0x38/0x94 irq_thread+0x100/0x1c0 kthread+0x140/0x1fc ret_from_fork+0x10/0x30 Code: 54000088 f94ca50a eb14015f 54000060 (f9400108) ---[ end trace ace43ce36cbd5c93 ]--- Kernel panic - not syncing: Oops: Fatal exception
SMP: stopping secondary CPUs
Kernel Offset: 0x12c4000000 from 0xffffffc010000000PHYS_OFFSET: 0xffffffe580000000
CPU features: 0x08240002,2188200c
Memory Limit: none
--- .../platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c | 4 ++-- .../platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c | 5 +++++ .../platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h | 2 ++ drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c | 2 ++ 4 files changed, 11 insertions(+), 2 deletions(-)
drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c +2 -2
@@ -50,12 +50,12 @@ static void mtk_vcodec_vpu_reset_dec_handler(void *priv)dev_err (&dev->plat_dev->dev,"Watchdog timeout!!" ); -mutex_lock (&dev->dev_mutex); +mutex_lock (&dev->dev_ctx_lock);list_for_each_entry (ctx, &dev->ctx_list, list) { ctx->state =MTK_STATE_ABORT ;mtk_v4l2_vdec_dbg (0 , ctx,"[%d] Change to state MTK_STATE_ABORT" , ctx->id); } -mutex_unlock (&dev->dev_mutex); +mutex_unlock (&dev->dev_ctx_lock); }static void mtk_vcodec_vpu_reset_enc_handler (void *priv)
drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c +5 -0
@@ -268,7 +268,9 @@ static int fops_vcodec_open(struct file *file) ctx->dev->vdec_pdata->init_vdec_params (ctx); +mutex_lock (&dev->dev_ctx_lock);list_add (&ctx->list, &dev->ctx_list); +mutex_unlock (&dev->dev_ctx_lock);mtk_vcodec_dbgfs_create (ctx);mutex_unlock (&dev->dev_mutex);
@@ -311,7 +313,9 @@ static int fops_vcodec_release(struct file *file)v4l2_ctrl_handler_free (&ctx->ctrl_hdl);mtk_vcodec_dbgfs_remove (dev, ctx->id); +mutex_lock (&dev->dev_ctx_lock);list_del_init (&ctx->list); +mutex_unlock (&dev->dev_ctx_lock);kfree (ctx);mutex_unlock (&dev->dev_mutex);return 0 ;
@@ -404,6 +408,7 @@ static int mtk_vcodec_probe(struct platform_device *pdev)for (i =0 ; i <MTK_VDEC_HW_MAX ; i++)mutex_init (&dev->dec_mutex[i]);mutex_init (&dev->dev_mutex); +mutex_init (&dev->dev_ctx_lock);spin_lock_init (&dev->irqlock); snprintf(dev->v4l2_dev.name, sizeof(dev->v4l2_dev.name), "%s",
drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h +2 -0
@@ -241,6 +241,7 @@ struct mtk_vcodec_dec_ctx {* * @dec_mutex: decoder hardware lock * @dev_mutex: video_device lock +* @dev_ctx_lock: the lock of context list * @decode_workqueue: decode work queue * * @irqlock: protect data access by irq handler and work thread
@@ -282,6 +283,7 @@ struct mtk_vcodec_dec_dev {/* decoder hardware mutex lock */ struct mutex dec_mutex[MTK_VDEC_HW_MAX ];struct mutex dev_mutex; +struct mutex dev_ctx_lock;struct workqueue_struct *decode_workqueue;spinlock_t irqlock;
drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c +2 -0
@@ -77,12 +77,14 @@ static bool vpu_dec_check_ap_inst(struct mtk_vcodec_dec_dev *dec_dev, struct vdestruct mtk_vcodec_dec_ctx *ctx;int ret = false; +mutex_lock (&dec_dev->dev_ctx_lock);list_for_each_entry (ctx, &dec_dev->ctx_list, list) {if (!IS_ERR_OR_NULL (ctx) && ctx->vpu_inst == vpu) { ret = true;break ; } } +mutex_unlock (&dec_dev->dev_ctx_lock);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/143 media: mediatek: vcodec: adding lock to protect encoder context list
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunfei Dong <[email protected]>
[ Upstream commit afaaf3a0f647a24a7bf6a2145d8ade37baaf75ad ]
Add a lock for the ctx_list, to avoid accessing a NULL pointer within the 'vpu_enc_ipi_handler' function when the ctx_list has been deleted due to an unexpected behavior on the SCP IP block.
--- .../platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c | 4 ++-- .../platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c | 5 +++++ .../platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h | 2 ++ drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c | 2 ++ 4 files changed, 11 insertions(+), 2 deletions(-)
drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c +2 -2
@@ -65,12 +65,12 @@ static void mtk_vcodec_vpu_reset_enc_handler(void *priv)dev_err (&dev->plat_dev->dev,"Watchdog timeout!!" ); -mutex_lock (&dev->dev_mutex); +mutex_lock (&dev->dev_ctx_lock);list_for_each_entry (ctx, &dev->ctx_list, list) { ctx->state =MTK_STATE_ABORT ;mtk_v4l2_vdec_dbg (0 , ctx,"[%d] Change to state MTK_STATE_ABORT" , ctx->id); } -mutex_unlock (&dev->dev_mutex); +mutex_unlock (&dev->dev_ctx_lock); }static const struct mtk_vcodec_fw_ops mtk_vcodec_vpu_msg = {
drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c +5 -0
@@ -177,7 +177,9 @@ static int fops_vcodec_open(struct file *file)mtk_v4l2_venc_dbg (2 , ctx,"Create instance [%d]@%p m2m_ctx=%p " , ctx->id, ctx, ctx->m2m_ctx); +mutex_lock (&dev->dev_ctx_lock);list_add (&ctx->list, &dev->ctx_list); +mutex_unlock (&dev->dev_ctx_lock);mutex_unlock (&dev->dev_mutex); mtk_v4l2_venc_dbg(0, ctx, "%s encoder [%d]", dev_name(&dev->plat_dev->dev),
@@ -212,7 +214,9 @@ static int fops_vcodec_release(struct file *file)v4l2_fh_exit (&ctx->fh);v4l2_ctrl_handler_free (&ctx->ctrl_hdl); +mutex_lock (&dev->dev_ctx_lock);list_del_init (&ctx->list); +mutex_unlock (&dev->dev_ctx_lock);kfree (ctx);mutex_unlock (&dev->dev_mutex);return 0 ;
@@ -294,6 +298,7 @@ static int mtk_vcodec_probe(struct platform_device *pdev)mutex_init (&dev->enc_mutex);mutex_init (&dev->dev_mutex); +mutex_init (&dev->dev_ctx_lock);spin_lock_init (&dev->irqlock); snprintf(dev->v4l2_dev.name, sizeof(dev->v4l2_dev.name), "%s",
drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h +2 -0
@@ -178,6 +178,7 @@ struct mtk_vcodec_enc_ctx {* * @enc_mutex: encoder hardware lock. * @dev_mutex: video_device lock +* @dev_ctx_lock: the lock of context list * @encode_workqueue: encode work queue * * @enc_irq: h264 encoder irq resource
@@ -205,6 +206,7 @@ struct mtk_vcodec_enc_dev {/* encoder hardware mutex lock */ struct mutex enc_mutex;struct mutex dev_mutex; +struct mutex dev_ctx_lock;struct workqueue_struct *encode_workqueue;int enc_irq;
drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c +2 -0
@@ -47,12 +47,14 @@ static bool vpu_enc_check_ap_inst(struct mtk_vcodec_enc_dev *enc_dev, struct venstruct mtk_vcodec_enc_ctx *ctx;int ret = false; +mutex_lock (&enc_dev->dev_ctx_lock);list_for_each_entry (ctx, &enc_dev->ctx_list, list) {if (!IS_ERR_OR_NULL (ctx) && ctx->vpu_inst == vpu) { ret = true;break ; } } +mutex_unlock (&enc_dev->dev_ctx_lock);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/143 randomize_kstack: Improve entropy diffusion
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 9c573cd313433f6c1f7236fe64b9b743500c1628 ]
The kstack_offset variable was really only ever using the low bits for kernel stack offset entropy. Add a ror32() to increase bit diffusion.
--- include/linux/randomize_kstack.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/randomize_kstack.h +1 -1
@@ -80,7 +80,7 @@ DECLARE_PER_CPU(u32, kstack_offset);if (static_branch_maybe (CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT , \ &randomize_kstack_offset)) { \u32 offset =raw_cpu_read (kstack_offset); \ - offset ^= (rand); \ + offset =ror32 (offset,5 ) ^ (rand); \raw_cpu_write (kstack_offset, offset); \ } \ }while (0 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/143 platform/x86/intel/hid: Dont wake on 5-button releases
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: David McFarland <[email protected]>
[ Upstream commit 5864e479ca4344f3a5df8074524da24c960f440b ]
If, for example, the power button is configured to suspend, holding it and releasing it after the machine has suspended, will wake the machine.
Also on some machines, power button release events are sent during hibernation, even if the button wasn't used to hibernate the machine. This causes hibernation to be aborted.
--- drivers/platform/x86/intel/hid.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/platform/x86/intel/hid.c +6 -1
@@ -504,6 +504,7 @@ static void notify_handler(acpi_handle handle, u32 event, void *context)struct platform_device *device = context;struct intel_hid_priv *priv =dev_get_drvdata (&device->dev);unsigned long long ev_index; +struct key_entry *ke;int err;/*
@@ -545,11 +546,15 @@ static void notify_handler(acpi_handle handle, u32 event, void *context)if (event ==0xc0 || !priv->array)return ; -if (!sparse_keymap_entry_from_scancode (priv->array, event)) { + ke =sparse_keymap_entry_from_scancode (priv->array, event); +if (!ke) {dev_info (&device->dev,"unknown event 0x%x\n" , event);return ; } +if (ke->type ==KE_IGNORE ) +return ; + wakeup:pm_wakeup_hard_event (&device->dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/143 platform/x86: intel-vbtn: Update tablet mode switch at end of probe
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gwendal Grignou <[email protected]>
[ Upstream commit 434e5781d8cd2d0ed512d920c6cdeba4b33a2e81 ]
ACER Vivobook Flip (TP401NAS) virtual intel switch is implemented as follow:
Device (VGBI)
{
Name (_HID, EisaId ("INT33D6") ...
Name (VBDS, Zero)
Method (_STA, 0, Serialized) // _STA: Status ...
Method (VBDL, 0, Serialized)
{
PB1E |= 0x20
VBDS |= 0x40
}
Method (VGBS, 0, Serialized)
{
Return (VBDS) /* \_SB_.PCI0.SBRG.EC0_.VGBI.VBDS */
}
...
}By default VBDS is set to 0. At boot it is set to clamshell (bit 6 set) only after method VBDL is executed.
Since VBDL is now evaluated in the probe routine later, after the device is registered, the retrieved value of VBDS was still 0 ("tablet mode") when setting up the virtual switch.
Make sure to evaluate VGBS after VBDL, to ensure the convertible boots in clamshell mode, the expected default.
--- drivers/platform/x86/intel/vbtn.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/platform/x86/intel/vbtn.c +3 -2
@@ -136,8 +136,6 @@ static int intel_vbtn_input_setup(struct platform_device *device) priv->switches_dev->id.bustype =BUS_HOST ;if (priv->has_switches) { -detect_tablet_mode (&device->dev); - ret =input_register_device (priv->switches_dev);if (ret)return ret;
@@ -316,6 +314,9 @@ static int intel_vbtn_probe(struct platform_device *device)if (ACPI_FAILURE (status))dev_err (&device->dev,"Error VBDL failed with ACPI status %d\n" , status); } +// Check switches after buttons since VBDL may have side effects. +if (has_switches) +detect_tablet_mode (&device->dev);device_init_wakeup (&device->dev, true);/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/143 nouveau: fix devinit paths to only handle display on GSP.
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Airlie <[email protected]>
[ Upstream commit 718c4fb221dbeff9072810841b949413c5ffc345 ]
This reverts:
nouveau/gsp: don't check devinit disable on GSP.
and applies a further fix.
It turns out the open gpu driver, checks this register, but only for display.
Match that behaviour and in the turing path only disable the display block. (ampere already only does displays).
--- drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c | 12 ++++++++---- drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c | 1 + 2 files changed, 9 insertions(+), 4 deletions(-)
drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c +8 -4
@@ -25,6 +25,7 @@#include <subdev/bios.h> #include <subdev/bios/init.h> +#include <subdev/gsp.h> void gm107_devinit_disable (struct nvkm_devinit *init)
@@ -33,10 +34,13 @@ gm107_devinit_disable(struct nvkm_devinit *init)u32 r021c00 =nvkm_rd32 (device,0x021c00 );u32 r021c04 =nvkm_rd32 (device,0x021c04 ); -if (r021c00 &0x00000001 ) -nvkm_subdev_disable (device,NVKM_ENGINE_CE ,0 ); -if (r021c00 &0x00000004 ) -nvkm_subdev_disable (device,NVKM_ENGINE_CE ,2 ); +/* gsp only wants to enable/disable display */ +if (!nvkm_gsp_rm (device->gsp)) { +if (r021c00 &0x00000001 ) +nvkm_subdev_disable (device,NVKM_ENGINE_CE ,0 ); +if (r021c00 &0x00000004 ) +nvkm_subdev_disable (device,NVKM_ENGINE_CE ,2 ); + }if (r021c04 &0x00000001 )nvkm_subdev_disable (device,NVKM_ENGINE_DISP ,0 ); }
drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c +1 -0
@@ -41,6 +41,7 @@ r535_devinit_new(const struct nvkm_devinit_func *hw, rm->dtor = r535_devinit_dtor; rm->post = hw->post; + rm->disable = hw->disable; ret =nv50_devinit_new_ (rm, device, type, inst, pdevinit);if (ret)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 139/143 Bluetooth: btintel: Fixe build regression
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
commit 6e62ebfb49eb65bdcbfc5797db55e0ce7f79c3dd upstream.
This fixes the following build regression:
drivers-bluetooth-btintel.c-btintel_read_version()-warn:
passing-zero-to-PTR_ERR
--- drivers/bluetooth/btintel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/bluetooth/btintel.c +2 -2
@@ -435,13 +435,13 @@ int btintel_read_version(struct hci_devstruct sk_buff *skb; skb =__hci_cmd_sync (hdev,0xfc05 ,0 ,NULL ,HCI_CMD_TIMEOUT ); -if (IS_ERR_OR_NULL (skb)) { +if (IS_ERR (skb)) {bt_dev_err (hdev,"Reading Intel version information failed (%ld)" ,PTR_ERR (skb));return PTR_ERR (skb); } -if (skb->len !=sizeof (*ver)) { +if (!skb || skb->len !=sizeof (*ver)) {bt_dev_err (hdev,"Intel version event size mismatch" );kfree_skb (skb);return -EILSEQ ;
Greg Kroah-Hartman
maintainerPATCH 140/143 net: mpls: error out if inner headers are not set
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
commit 025f8ad20f2e3264d11683aa9cbbf0083eefbdcd upstream.
mpls_gso_segment() assumes skb_inner_network_header() returns a valid result:
mpls_hlen = skb_inner_network_header(skb) - skb_network_header(skb);
if (unlikely(!mpls_hlen || mpls_hlen % MPLS_HLEN))
goto out;
if (unlikely(!pskb_may_pull(skb, mpls_hlen)))With syzbot reproducer, skb_inner_network_header() yields 0, skb_network_header() returns 108, so this will "pskb_may_pull(skb, -108)))" which triggers a newly added DEBUG_NET_WARN_ON_ONCE() check:
------------[ cut here ]------------ WARNING: CPU: 0 PID: 5068 at include/linux/skbuff.h:2723 pskb_may_pull_reason include/linux/skbuff.h:2723 [inline] WARNING: CPU: 0 PID: 5068 at include/linux/skbuff.h:2723 pskb_may_pull include/linux/skbuff.h:2739 [inline] WARNING: CPU: 0 PID: 5068 at include/linux/skbuff.h:2723 mpls_gso_segment+0x773/0xaa0 net/mpls/mpls_gso.c:34 [..] skb_mac_gso_segment+0x383/0x740 net/core/gso.c:53 nsh_gso_segment+0x40a/0xad0 net/nsh/nsh.c:108 skb_mac_gso_segment+0x383/0x740 net/core/gso.c:53 __skb_gso_segment+0x324/0x4c0 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] [..] sch_direct_xmit+0x11a/0x5f0 net/sched/sch_generic.c:327 [..] packet_sendmsg+0x46a9/0x6130 net/packet/af_packet.c:3113 [..]
First iteration of this patch made mpls_hlen signed and changed test to error out to "mpls_hlen <= 0 || ..".
Quoted 3 lines · Eric Dumazet
I was thinking about adding a debug check in
skb_inner_network_header()ifinner_network_headeris zero (that would mean it is not 'set' yet), but this would trigger even after your patch.
So add new skb_inner_network_header_was_set() helper and use that.
The syzbot reproducer injects data via packet socket. The skb that gets allocated and passed down the stack has ->protocol set to NSH (0x894f) and gso_type set to SKB_GSO_UDP | SKB_GSO_DODGY.
This gets passed to skb_mac_gso_segment(), which sees NSH as ptype to find a callback for. nsh_gso_segment() retrieves next type:
proto = tun_p_to_eth_p(nsh_hdr(skb)->np);
... which is MPLS (TUN_P_MPLS_UC). It updates skb->protocol and then calls mpls_gso_segment(). Inner offsets are all 0, so mpls_gso_segment() ends up with a negative header size.
In case more callers rely on silent handling of such large may_pull values we could also 'legalize' this behaviour, either replacing the debug check with (len > INT_MAX) test or removing it and instead adding a comment before existing
if (unlikely(len > skb->len))
return SKB_DROP_REASON_PKT_TOO_SMALL;
test in pskb_may_pull_reason(), saying that this check also implicitly takes care of callers that miscompute header sizes.
--- include/linux/skbuff.h | 5 +++++ net/mpls/mpls_gso.c | 3 +++ 2 files changed, 8 insertions(+)
include/linux/skbuff.h +5 -0
@@ -2847,6 +2847,11 @@ static inline void skb_set_inner_network skb->inner_network_header += offset; } +static inline bool skb_inner_network_header_was_set (const struct sk_buff *skb) +{ +return skb->inner_network_header >0 ; +} +static inline unsigned char *skb_inner_mac_header (const struct sk_buff *skb) {return skb->head + skb->inner_mac_header;
net/mpls/mpls_gso.c +3 -0
@@ -27,6 +27,9 @@ static struct sk_buff *mpls_gso_segment(__be16 mpls_protocol;unsigned int mpls_hlen; +if (!skb_inner_network_header_was_set (skb)) + goto out; +skb_reset_network_header (skb); mpls_hlen =skb_inner_network_header (skb) -skb_network_header (skb);if (unlikely (!mpls_hlen || mpls_hlen %MPLS_HLEN ))
Greg Kroah-Hartman
maintainerPATCH 141/143 VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <[email protected]>
commit e606e4b71798cc1df20e987dde2468e9527bd376 upstream.
The changes are similar to those given in the commit 19b070fefd0d ("VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()").
Fix filling of the msg and msg_payload in dg_info struct, which prevents a possible "detected field-spanning write" of memcpy warning that is issued by the tracking mechanism __fortify_memcpy_chk.
--- drivers/misc/vmw_vmci/vmci_datagram.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/misc/vmw_vmci/vmci_datagram.c +2 -1
@@ -378,7 +378,8 @@ int vmci_datagram_invoke_guest_handler(s dg_info->in_dg_host_queue = false; dg_info->entry = dst_entry; -memcpy (&dg_info->msg, dg,VMCI_DG_SIZE (dg)); + dg_info->msg = *dg; +memcpy (&dg_info->msg_payload, dg +1 , dg->payload_size);INIT_WORK (&dg_info->work, dg_delayed_dispatch);schedule_work (&dg_info->work);
Greg Kroah-Hartman
maintainerPATCH 142/143 x86/vdso: Fix rethunk patching for vdso-image-x32.o too
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
commit 4969d75dd9077e19e175e60f3c5a6c7653252e63 upstream.
In a similar fashion to
b388e57d4628 ("x86/vdso: Fix rethunk patching for vdso-image-{32,64}.o")
annotate vdso-image-x32.o too for objtool so that it gets annotated properly and the unused return thunk warning doesn't fire.
--- arch/x86/entry/vdso/Makefile | 1 + 1 file changed, 1 insertion(+)
arch/x86/entry/vdso/Makefile +1 -0
@@ -37,6 +37,7 @@ KCSAN_SANITIZE_vma.o := y OBJECT_FILES_NON_STANDARD_extable.o := n OBJECT_FILES_NON_STANDARD_vdso-image-32.o := n +OBJECT_FILES_NON_STANDARD_vdso-image-x32.o := n OBJECT_FILES_NON_STANDARD_vdso-image-64.o := n OBJECT_FILES_NON_STANDARD_vdso32-setup.o := n OBJECT_FILES_NON_STANDARD_vma.o := n
Greg Kroah-Hartman
maintainerPATCH 143/143 Revert "drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()"
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
commit 03c6284df179de3a4a6e0684764b1c71d2a405e2 upstream.
This patch causes the following iounmap erorr and calltrace
iounmap: bad address 00000000d0b3631f
The original patch was unjustified because amdgpu_device_fini_sw() will always cleanup the rmmio mapping.
This reverts commit eb4f139888f636614dab3bcce97ff61cefc4b3a7.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +6 -10
@@ -4025,10 +4025,8 @@ int amdgpu_device_init(struct amdgpu_dev* early on during init and before calling to RREG32. */ adev->reset_domain =amdgpu_reset_create_reset_domain (SINGLE_DEVICE ,"amdgpu-reset-dev" ); -if (!adev->reset_domain) { - r = -ENOMEM ; - goto unmap_memory; - } +if (!adev->reset_domain) +return -ENOMEM ;/* detect hw virtualization here */ amdgpu_detect_virtualization (adev);
@@ -4038,20 +4036,20 @@ int amdgpu_device_init(struct amdgpu_dev r =amdgpu_device_get_job_timeout_settings (adev);if (r) {dev_err (adev->dev,"invalid lockup_timeout parameter syntax\n" ); - goto unmap_memory; +return r; }/* early init functions */ r =amdgpu_device_ip_early_init (adev);if (r) - goto unmap_memory; +return r;amdgpu_device_set_mcbp (adev);/* Get rid of things like offb */ r =drm_aperture_remove_conflicting_pci_framebuffers (adev->pdev, &amdgpu_kms_driver);if (r) - goto unmap_memory; +return r;/* Enable TMZ based on IP_VERSION */ amdgpu_gmc_tmz_set (adev);
@@ -4061,7 +4059,7 @@ int amdgpu_device_init(struct amdgpu_devif (adev->gmc.xgmi.supported) { r = adev->gfxhub.funcs->get_xgmi_info (adev);if (r) - goto unmap_memory; +return r; }/* enable PCIE atomic ops */
@@ -4330,8 +4328,6 @@ release_ras_con: failed:amdgpu_vf_error_trans_all (adev); -unmap_memory: -iounmap (adev->rmmio);return r; }
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.8.6 release. There are 143 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 13 Apr 2024 09:53:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.8.6-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.8.y
and the diffstat can be found below.thanks,
greg k-h
Tested rc1 against the Fedora build system (aarch64, ppc64le, s390x, x86_64), and boot tested x86_64. No regressions noted.
Hello,
Quoted 5 lines · On Thu, 11 Apr 2024 11:54:28 +0200 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.8.6 release. There are 143 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Sat, 13 Apr 2024 09:53:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.8.6-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.8.y
and the diffstat can be found below.
This rc kernel passes DAMON functionality test[1] on my test machine. Attaching the test results summary below. Please note that I retrieved the kernel from linux-stable-rc tree[2].
[1] https://github.com/awslabs/damon-tests/tree/next/corr
[2] 1e41d76814ed ("Linux 6.8.6-rc1")
Thanks,
SJ
[...]
---
ok 1 selftests: damon: debugfs_attrs.sh
ok 2 selftests: damon: debugfs_schemes.sh
ok 3 selftests: damon: debugfs_target_ids.sh
ok 4 selftests: damon: debugfs_empty_targets.sh
ok 5 selftests: damon: debugfs_huge_count_read_write.sh
ok 6 selftests: damon: debugfs_duplicate_context_creation.sh
ok 7 selftests: damon: debugfs_rm_non_contexts.sh
ok 8 selftests: damon: sysfs.sh
ok 9 selftests: damon: sysfs_update_removed_scheme_dir.sh
ok 10 selftests: damon: sysfs_update_schemes_tried_regions_hang.py ok 11 selftests: damon: sysfs_update_schemes_tried_regions_wss_estimation.py ok 12 selftests: damon: reclaim.sh
ok 13 selftests: damon: lru_sort.sh
ok 1 selftests: damon-tests: kunit.sh
ok 2 selftests: damon-tests: huge_count_read_write.sh
ok 3 selftests: damon-tests: buffer_overflow.sh
ok 4 selftests: damon-tests: rm_contexts.sh
ok 5 selftests: damon-tests: record_null_deref.sh
ok 6 selftests: damon-tests: dbgfs_target_ids_read_before_terminate_race.sh ok 7 selftests: damon-tests: dbgfs_target_ids_pid_leak.sh
ok 8 selftests: damon-tests: damo_tests.sh
ok 9 selftests: damon-tests: masim-record.sh
ok 10 selftests: damon-tests: build_i386.sh
ok 11 selftests: damon-tests: build_arm64.sh
ok 12 selftests: damon-tests: build_m68k.sh
ok 13 selftests: damon-tests: build_i386_idle_flag.sh
ok 14 selftests: damon-tests: build_i386_highpte.sh
ok 15 selftests: damon-tests: build_nomemcg.sh
PASS
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.8.6 release. There are 143 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
With this -rc1 I see the following WARNING noise on my AMD Zen2 Thinkpad during boot:
--snip--
Apr 11 16:08:45 hho kernel: [drm] Initialized amdgpu 3.57.0 20150101 for 0000:06:00.0 on minor 0 Apr 11 16:08:45 hho kernel: ------------[ cut here ]------------ Apr 11 16:08:45 hho kernel: amdgpu 0000:06:00.0: drm_WARN_ON_ONCE(!dev->mode_config.poll_enabled) Apr 11 16:08:45 hho kernel: WARNING: CPU: 10 PID: 728 at drivers/gpu/drm/drm_probe_helper.c:305 drm_kms_helper_poll_enable+0x129/0x130 [drm_kms_helper] Apr 11 16:08:45 hho kernel: Modules linked in: sch_fq_codel bpf_preload uvcvideo videobuf2_vmalloc videobuf2_memops uvc videobuf2_v4l2 mousedev videodev videobuf2_common mc snd_ctl_led snd_hda_codec_realtek iwlmvm amdgpu(+) snd_hda_codec_generic mac80211 libarc4 snd_hda_codec_hdmi pkcs8_key_parser edac_mce_amd i2c_algo_bit drm_ttm_helper crct10dif_pclmul crc32_pclmul crc32c_intel ttm snd_hda_intel ghash_clmulni_intel drm_exec snd_intel_dspcfg sha512_ssse3 drm_suballoc_helper amdxcp sha256_ssse3 snd_hda_codec drm_buddy gpu_sched sha1_ssse3 snd_hwdep iwlwifi snd_hda_core lm92 drm_display_helper thinkpad_acpi snd_pcm cec snd_rn_pci_acp3x ledtrig_audio snd_timer wmi_bmof drivetemp drm_kms_helper psmouse rapl r8169 platform_profile snd_acp_config cfg80211 serio_raw realtek k10temp snd_soc_acpi ipmi_devintf snd ucsi_acpi mdio_devres drm snd_pci_acp3x i2c_piix4 soundcore rfkill typec_ucsi ipmi_msghandler libphy video roles typec battery ac wmi i2c_scmi button Apr 11 16:08:45 hho kernel: CPU: 10 PID: 728 Comm: (udev-worker) Not tainted 6.8.6 #1 Apr 11 16:08:45 hho kernel: Hardware name: LENOVO 20U50001GE/20U50001GE, BIOS R19ET32W (1.16 ) 01/26/2021 Apr 11 16:08:45 hho kernel: RIP: 0010:drm_kms_helper_poll_enable+0x129/0x130 [drm_kms_helper] Apr 11 16:08:45 hho kernel: Code: 48 8b 5f 50 48 85 db 75 03 48 8b 1f e8 90 58 f8 e0 48 c7 c1 a0 0a 67 a0 48 89 da 48 c7 c7 84 14 67 a0 48 89 c6 e8 27 b2 a6 e0 <0f> 0b e9 08 ff ff ff 0f 1f 44 00 00 48 b8 e0 ff ff ff 0f 00 00 00 Apr 11 16:08:45 hho kernel: RSP: 0018:ffffc900005ff918 EFLAGS: 00010296 Apr 11 16:08:45 hho kernel: RAX: 0000000000000045 RBX: ffff88810173c5b0 RCX: 0000000000000027 Apr 11 16:08:45 hho kernel: RDX: ffff8887ef69c6c8 RSI: 0000000000000001 RDI: ffff8887ef69c6c0 Apr 11 16:08:45 hho kernel: RBP: 0000000000000000 R08: 00000000fffeffff R09: 0000000000000001 Apr 11 16:08:45 hho kernel: R10: 0000000000000000 R11: ffff8887eec80000 R12: ffff88810e380010 Apr 11 16:08:45 hho kernel: R13: ffff88810e380010 R14: 0000000000000003 R15: ffffffffa03b69ce Apr 11 16:08:45 hho kernel: FS: 00007f7472869800(0000) GS:ffff8887ef680000(0000) knlGS:0000000000000000 Apr 11 16:08:45 hho kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Apr 11 16:08:45 hho kernel: CR2: 00005607b50f5000 CR3: 0000000104f3e000 CR4: 0000000000350ef0 Apr 11 16:08:45 hho kernel: Call Trace: Apr 11 16:08:45 hho kernel: <TASK> Apr 11 16:08:45 hho kernel: ? drm_kms_helper_poll_enable+0x129/0x130 [drm_kms_helper] Apr 11 16:08:45 hho kernel: ? __warn+0x7d/0x120 Apr 11 16:08:45 hho kernel: ? drm_kms_helper_poll_enable+0x129/0x130 [drm_kms_helper] Apr 11 16:08:45 hho kernel: ? report_bug+0x155/0x180 Apr 11 16:08:45 hho kernel: ? handle_bug+0x36/0x70 Apr 11 16:08:45 hho kernel: ? exc_invalid_op+0x13/0x60 Apr 11 16:08:45 hho kernel: ? asm_exc_invalid_op+0x16/0x20 Apr 11 16:08:45 hho kernel: ? drm_kms_helper_poll_enable+0x129/0x130 [drm_kms_helper] Apr 11 16:08:45 hho kernel: ? drm_kms_helper_poll_enable+0x129/0x130 [drm_kms_helper] Apr 11 16:08:45 hho kernel: drm_helper_probe_single_connector_modes+0x167/0x4f0 [drm_kms_helper] Apr 11 16:08:45 hho kernel: drm_client_modeset_probe+0x1e0/0x1350 [drm] Apr 11 16:08:45 hho kernel: ? __cond_resched+0x16/0x40 Apr 11 16:08:45 hho kernel: ? kmalloc_trace+0xfd/0x280 Apr 11 16:08:45 hho kernel: ? __pm_runtime_suspend+0x67/0xb0 Apr 11 16:08:45 hho kernel: __drm_fb_helper_initial_config_and_unlock+0x2d/0x490 [drm_kms_helper] Apr 11 16:08:45 hho kernel: ? drm_file_alloc+0x1af/0x250 [drm] Apr 11 16:08:45 hho kernel: ? __cond_resched+0x16/0x40 Apr 11 16:08:45 hho kernel: drm_fbdev_generic_client_hotplug+0x62/0xb0 [drm_kms_helper] Apr 11 16:08:45 hho kernel: drm_client_register+0x5a/0x90 [drm] Apr 11 16:08:45 hho kernel: amdgpu_pci_probe+0x465/0x4d0 [amdgpu] Apr 11 16:08:45 hho kernel: local_pci_probe+0x39/0x80 Apr 11 16:08:45 hho kernel: pci_device_probe+0xa1/0x1b0 Apr 11 16:08:45 hho kernel: really_probe+0x156/0x2e0 Apr 11 16:08:45 hho kernel: ? __device_attach_driver+0x100/0x100 Apr 11 16:08:45 hho kernel: __driver_probe_device+0x73/0x110 Apr 11 16:08:45 hho kernel: driver_probe_device+0x1f/0xe0 Apr 11 16:08:45 hho kernel: __driver_attach+0x7d/0x180 Apr 11 16:08:45 hho kernel: bus_for_each_dev+0x60/0x90 Apr 11 16:08:45 hho kernel: bus_add_driver+0xe4/0x1e0 Apr 11 16:08:45 hho kernel: driver_register+0x55/0xf0 Apr 11 16:08:45 hho kernel: ? 0xffffffffa020a000 Apr 11 16:08:45 hho kernel: do_one_initcall+0x41/0x1c0 Apr 11 16:08:45 hho kernel: ? kmalloc_trace+0x1d5/0x280 Apr 11 16:08:45 hho kernel: do_init_module+0x60/0x230 Apr 11 16:08:45 hho kernel: init_module_from_file+0x79/0xb0 Apr 11 16:08:45 hho kernel: __x64_sys_finit_module+0x155/0x280 Apr 11 16:08:45 hho kernel: do_syscall_64+0x49/0x110 Apr 11 16:08:45 hho kernel: entry_SYSCALL_64_after_hwframe+0x4b/0x53 Apr 11 16:08:45 hho kernel: RIP: 0033:0x7f7472a740e9 Apr 11 16:08:45 hho kernel: Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 07 ed 0c 00 f7 d8 64 89 01 48 Apr 11 16:08:45 hho kernel: RSP: 002b:00007ffcff3f42d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 Apr 11 16:08:45 hho kernel: RAX: ffffffffffffffda RBX: 0000564f9b3f5d50 RCX: 00007f7472a740e9 Apr 11 16:08:45 hho kernel: RDX: 0000000000000004 RSI: 00007f7472c50369 RDI: 0000000000000017 Apr 11 16:08:45 hho kernel: RBP: 0000000000000004 R08: 00007f7472b43b20 R09: 0000564f9b3af700 Apr 11 16:08:45 hho kernel: R10: 0000000000000050 R11: 0000000000000246 R12: 00007f7472c50369 Apr 11 16:08:45 hho kernel: R13: 0000000000020000 R14: 0000564f9b41d6b0 R15: 0000000000000000 Apr 11 16:08:45 hho kernel: </TASK> Apr 11 16:08:45 hho kernel: ---[ end trace 0000000000000000 ]--- Apr 11 16:08:45 hho kernel: fbcon: amdgpudrmfb (fb0) is primary device
--snap--
This is due to "drm-check-output-polling-initialized-before-disablin.patch" which needs a followup patch to work properly, otherwise the above drm_WARN_ON_ONCE always fires for the wrong reason.
The commit in mainline is:
048a36d8a608 "drm: Check polling initialized before enabling in drm_helper_probe_single_connector_modes"
With that commit amdgpu initialisation is happy again: no more WARN_ON_ONCE on boot.
cheers
Holger
Greg Kroah-Hartman
maintainerQuoted 85 lines · Holger Hoffstätte
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.8.6 release. There are 143 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
With this -rc1 I see the following WARNING noise on my AMD Zen2 Thinkpad during boot:
--snip--
Apr 11 16:08:45 hho kernel: [drm] Initialized amdgpu 3.57.0 20150101 for 0000:06:00.0 on minor 0 Apr 11 16:08:45 hho kernel: ------------[ cut here ]------------ Apr 11 16:08:45 hho kernel: amdgpu 0000:06:00.0: drm_WARN_ON_ONCE(!dev->mode_config.poll_enabled) Apr 11 16:08:45 hho kernel: WARNING: CPU: 10 PID: 728 at drivers/gpu/drm/drm_probe_helper.c:305 drm_kms_helper_poll_enable+0x129/0x130 [drm_kms_helper] Apr 11 16:08:45 hho kernel: Modules linked in: sch_fq_codel bpf_preload uvcvideo videobuf2_vmalloc videobuf2_memops uvc videobuf2_v4l2 mousedev videodev videobuf2_common mc snd_ctl_led snd_hda_codec_realtek iwlmvm amdgpu(+) snd_hda_codec_generic mac80211 libarc4 snd_hda_codec_hdmi pkcs8_key_parser edac_mce_amd i2c_algo_bit drm_ttm_helper crct10dif_pclmul crc32_pclmul crc32c_intel ttm snd_hda_intel ghash_clmulni_intel drm_exec snd_intel_dspcfg sha512_ssse3 drm_suballoc_helper amdxcp sha256_ssse3 snd_hda_codec drm_buddy gpu_sched sha1_ssse3 snd_hwdep iwlwifi snd_hda_core lm92 drm_display_helper thinkpad_acpi snd_pcm cec snd_rn_pci_acp3x ledtrig_audio snd_timer wmi_bmof drivetemp drm_kms_helper psmouse rapl r8169 platform_profile snd_acp_config cfg80211 serio_raw realtek k10temp snd_soc_acpi ipmi_devintf snd ucsi_acpi mdio_devres drm snd_pci_acp3x i2c_piix4 soundcore rfkill typec_ucsi ipmi_msghandler libphy video roles typec battery ac wmi i2c_scmi button Apr 11 16:08:45 hho kernel: CPU: 10 PID: 728 Comm: (udev-worker) Not tainted 6.8.6 #1 Apr 11 16:08:45 hho kernel: Hardware name: LENOVO 20U50001GE/20U50001GE, BIOS R19ET32W (1.16 ) 01/26/2021 Apr 11 16:08:45 hho kernel: RIP: 0010:drm_kms_helper_poll_enable+0x129/0x130 [drm_kms_helper] Apr 11 16:08:45 hho kernel: Code: 48 8b 5f 50 48 85 db 75 03 48 8b 1f e8 90 58 f8 e0 48 c7 c1 a0 0a 67 a0 48 89 da 48 c7 c7 84 14 67 a0 48 89 c6 e8 27 b2 a6 e0 <0f> 0b e9 08 ff ff ff 0f 1f 44 00 00 48 b8 e0 ff ff ff 0f 00 00 00 Apr 11 16:08:45 hho kernel: RSP: 0018:ffffc900005ff918 EFLAGS: 00010296 Apr 11 16:08:45 hho kernel: RAX: 0000000000000045 RBX: ffff88810173c5b0 RCX: 0000000000000027 Apr 11 16:08:45 hho kernel: RDX: ffff8887ef69c6c8 RSI: 0000000000000001 RDI: ffff8887ef69c6c0 Apr 11 16:08:45 hho kernel: RBP: 0000000000000000 R08: 00000000fffeffff R09: 0000000000000001 Apr 11 16:08:45 hho kernel: R10: 0000000000000000 R11: ffff8887eec80000 R12: ffff88810e380010 Apr 11 16:08:45 hho kernel: R13: ffff88810e380010 R14: 0000000000000003 R15: ffffffffa03b69ce Apr 11 16:08:45 hho kernel: FS: 00007f7472869800(0000) GS:ffff8887ef680000(0000) knlGS:0000000000000000 Apr 11 16:08:45 hho kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Apr 11 16:08:45 hho kernel: CR2: 00005607b50f5000 CR3: 0000000104f3e000 CR4: 0000000000350ef0 Apr 11 16:08:45 hho kernel: Call Trace: Apr 11 16:08:45 hho kernel: <TASK> Apr 11 16:08:45 hho kernel: ? drm_kms_helper_poll_enable+0x129/0x130 [drm_kms_helper] Apr 11 16:08:45 hho kernel: ? __warn+0x7d/0x120 Apr 11 16:08:45 hho kernel: ? drm_kms_helper_poll_enable+0x129/0x130 [drm_kms_helper] Apr 11 16:08:45 hho kernel: ? report_bug+0x155/0x180 Apr 11 16:08:45 hho kernel: ? handle_bug+0x36/0x70 Apr 11 16:08:45 hho kernel: ? exc_invalid_op+0x13/0x60 Apr 11 16:08:45 hho kernel: ? asm_exc_invalid_op+0x16/0x20 Apr 11 16:08:45 hho kernel: ? drm_kms_helper_poll_enable+0x129/0x130 [drm_kms_helper] Apr 11 16:08:45 hho kernel: ? drm_kms_helper_poll_enable+0x129/0x130 [drm_kms_helper] Apr 11 16:08:45 hho kernel: drm_helper_probe_single_connector_modes+0x167/0x4f0 [drm_kms_helper] Apr 11 16:08:45 hho kernel: drm_client_modeset_probe+0x1e0/0x1350 [drm] Apr 11 16:08:45 hho kernel: ? __cond_resched+0x16/0x40 Apr 11 16:08:45 hho kernel: ? kmalloc_trace+0xfd/0x280 Apr 11 16:08:45 hho kernel: ? __pm_runtime_suspend+0x67/0xb0 Apr 11 16:08:45 hho kernel: __drm_fb_helper_initial_config_and_unlock+0x2d/0x490 [drm_kms_helper] Apr 11 16:08:45 hho kernel: ? drm_file_alloc+0x1af/0x250 [drm] Apr 11 16:08:45 hho kernel: ? __cond_resched+0x16/0x40 Apr 11 16:08:45 hho kernel: drm_fbdev_generic_client_hotplug+0x62/0xb0 [drm_kms_helper] Apr 11 16:08:45 hho kernel: drm_client_register+0x5a/0x90 [drm] Apr 11 16:08:45 hho kernel: amdgpu_pci_probe+0x465/0x4d0 [amdgpu] Apr 11 16:08:45 hho kernel: local_pci_probe+0x39/0x80 Apr 11 16:08:45 hho kernel: pci_device_probe+0xa1/0x1b0 Apr 11 16:08:45 hho kernel: really_probe+0x156/0x2e0 Apr 11 16:08:45 hho kernel: ? __device_attach_driver+0x100/0x100 Apr 11 16:08:45 hho kernel: __driver_probe_device+0x73/0x110 Apr 11 16:08:45 hho kernel: driver_probe_device+0x1f/0xe0 Apr 11 16:08:45 hho kernel: __driver_attach+0x7d/0x180 Apr 11 16:08:45 hho kernel: bus_for_each_dev+0x60/0x90 Apr 11 16:08:45 hho kernel: bus_add_driver+0xe4/0x1e0 Apr 11 16:08:45 hho kernel: driver_register+0x55/0xf0 Apr 11 16:08:45 hho kernel: ? 0xffffffffa020a000 Apr 11 16:08:45 hho kernel: do_one_initcall+0x41/0x1c0 Apr 11 16:08:45 hho kernel: ? kmalloc_trace+0x1d5/0x280 Apr 11 16:08:45 hho kernel: do_init_module+0x60/0x230 Apr 11 16:08:45 hho kernel: init_module_from_file+0x79/0xb0 Apr 11 16:08:45 hho kernel: __x64_sys_finit_module+0x155/0x280 Apr 11 16:08:45 hho kernel: do_syscall_64+0x49/0x110 Apr 11 16:08:45 hho kernel: entry_SYSCALL_64_after_hwframe+0x4b/0x53 Apr 11 16:08:45 hho kernel: RIP: 0033:0x7f7472a740e9 Apr 11 16:08:45 hho kernel: Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 07 ed 0c 00 f7 d8 64 89 01 48 Apr 11 16:08:45 hho kernel: RSP: 002b:00007ffcff3f42d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 Apr 11 16:08:45 hho kernel: RAX: ffffffffffffffda RBX: 0000564f9b3f5d50 RCX: 00007f7472a740e9 Apr 11 16:08:45 hho kernel: RDX: 0000000000000004 RSI: 00007f7472c50369 RDI: 0000000000000017 Apr 11 16:08:45 hho kernel: RBP: 0000000000000004 R08: 00007f7472b43b20 R09: 0000564f9b3af700 Apr 11 16:08:45 hho kernel: R10: 0000000000000050 R11: 0000000000000246 R12: 00007f7472c50369 Apr 11 16:08:45 hho kernel: R13: 0000000000020000 R14: 0000564f9b41d6b0 R15: 0000000000000000 Apr 11 16:08:45 hho kernel: </TASK> Apr 11 16:08:45 hho kernel: ---[ end trace 0000000000000000 ]--- Apr 11 16:08:45 hho kernel: fbcon: amdgpudrmfb (fb0) is primary device--snap--
This is due to "drm-check-output-polling-initialized-before-disablin.patch" which needs a followup patch to work properly, otherwise the above
drm_WARN_ON_ONCEalways fires for the wrong reason.
Quoted 5 lines
The commit in mainline is:
048a36d8a608"drm: Check polling initialized before enabling indrm_helper_probe_single_connector_modes"With that commit amdgpu initialisation is happy again: no more
WARN_ON_ONCEon boot.
Thanks, now queued up here, and in 6.6.y
greg k-h
Hi Greg
*no* regressions here on x86_64 (RKL, Intel 11th Gen. CPU)
Thanks
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.8.6 release. There are 143 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 13 Apr 2024 09:53:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.8.6-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.8.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.8.6 release. There are 143 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 13 Apr 2024 09:53:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.8.6-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.8.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.8.6 release. There are 143 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Successfully compiled and installed the kernel on my computer (Acer Aspire E15, Intel Core i3 Haswell). No noticeable regressions.
Signature · 1 line
An old man doll... just what I always wanted! - Clara
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.8.6 release. There are 143 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 13 Apr 2024 09:53:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.8.6-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.8.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.8.6 release. There are 143 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 13 Apr 2024 09:53:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.8.6-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.8.y
and the diffstat can be found below.thanks,
greg k-h
No new regressions for Tegra ...
Test results for stable-v6.8:
10 builds: 10 pass, 0 fail
26 boots: 26 pass, 0 fail
116 tests: 115 pass, 1 failLinux version: 6.8.6-rc1-g1e41d76814ed
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Test failures: tegra194-p2972-0000: boot.py
Jon
Signature · 1 line
nvpublic
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.8.6 release. There are 143 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 13 Apr 2024 09:53:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.8.6-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.8.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 6.8.6-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-6.8.y
* git commit: 1e41d76814ede65e1f73876f3316ea0f9e8aacdf
* git describe: v6.8.5-144-g1e41d76814ed
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.8.y/build/v6.8.5-144-g1e41d76814ed
## Test Regressions (compared to v6.8.4)
## Metric Regressions (compared to v6.8.4)
## Test Fixes (compared to v6.8.4)
## Metric Fixes (compared to v6.8.4)
## Test result summary
total: 289169, pass: 251149, fail: 3767, skip: 33889, xfail: 364
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 129 total, 129 passed, 0 failed
* arm64: 38 total, 38 passed, 0 failed
* i386: 29 total, 29 passed, 0 failed
* mips: 24 total, 24 passed, 0 failed
* parisc: 3 total, 3 passed, 0 failed
* powerpc: 34 total, 34 passed, 0 failed
* riscv: 17 total, 17 passed, 0 failed
* s390: 12 total, 12 passed, 0 failed
* sh: 10 total, 10 passed, 0 failed
* sparc: 6 total, 6 passed, 0 failed
* x86_64: 33 total, 33 passed, 0 failed
## Test suites summary
* boot
* kselftest-android
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-filesystems-epoll
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mm
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-net-forwarding
* kselftest-net-mptcp
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-user_events
* kselftest-vDSO
* kselftest-watchdog
* kselftest-x86
* kselftest-zram
* kunit
* libgpiod
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-co[
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-smoketest
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
--
Linaro LKFT
https://lkft.linaro.org