6.6.31-rc1 review
Subsystems (7)
Greg Kroah-Hartman
maintainercover 6.6.31-rc1 review
This is the start of the stable review cycle for the 6.6.31 release. There are 301 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 16 May 2024 10:09:32 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.31-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.31-rc1
Johan Hovold <[email protected]>
Bluetooth: qca: fix firmware check error path
Johan Hovold <[email protected]>
Bluetooth: qca: fix info leak when fetching fw build id
Johan Hovold <[email protected]>
Bluetooth: qca: fix info leak when fetching board id
Johan Hovold <[email protected]>
Bluetooth: qca: generalise device address check
Johan Hovold <[email protected]>
Bluetooth: qca: fix NVM configuration parsing
Johan Hovold <[email protected]>
Bluetooth: qca: add missing firmware sanity checks
Johan Hovold <[email protected]>
Bluetooth: qca: fix wcn3991 device address check
Johan Hovold <[email protected]>
Bluetooth: qca: fix invalid device address check
Steven Rostedt (Google) <[email protected]>
eventfs: Do not treat events directory different than other directories
Steven Rostedt (Google) <[email protected]>
eventfs: Do not differentiate the toplevel events directory
Steven Rostedt (Google) <[email protected]>
tracefs: Still use mount point as default permissions for instances
Steven Rostedt (Google) <[email protected]>
tracefs: Reset permissions on remount if permissions are options
Namjae Jeon <[email protected]>
ksmbd: do not grant v2 lease if parent lease key and epoch are not set
Namjae Jeon <[email protected]>
ksmbd: avoid to send duplicate lease break notifications
Namjae Jeon <[email protected]>
ksmbd: off ipv6only for both ipv4/ipv6 binding
Conor Dooley <[email protected]>
spi: microchip-core-qspi: fix setting spi bus clock rate
Johan Hovold <[email protected]>
regulator: core: fix debugfs creation regression
Sean Anderson <[email protected]>
nvme-pci: Add quirk for broken MSIs
Peter Xu <[email protected]>
mm/userfaultfd: reset ptes when close() for wr-protected ones
Kefeng Wang <[email protected]>
mm: use memalloc_nofs_save() in page_cache_ra_order()
Michael Ellerman <[email protected]>
selftests/mm: fix powerpc ARCH check
Thomas Gleixner <[email protected]>
x86/apic: Don't access the APIC when disabling x2APIC
Lakshmi Yadlapati <[email protected]>
hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us
Thadeu Lima de Souza Cascardo <[email protected]>
net: fix out-of-bounds access in ops_init
Volodymyr Babchuk <[email protected]>
arm64: dts: qcom: sa8155p-adp: fix SDHC2 CD pin configuration
Hersen Wu <[email protected]>
drm/amd/display: Fix incorrect DSC instance for MST
George Shen <[email protected]>
drm/amd/display: Handle Y carry-over in VCP X.Y calculation
Karthikeyan Ramasubramanian <[email protected]>
drm/i915/bios: Fix parsing backlight BDB data
Andi Shyti <[email protected]>
drm/i915/gt: Automate CCS Mode setting during engine resets
Chaitanya Kumar Borah <[email protected]>
drm/i915/audio: Fix audio time stamp programming for DP
Zack Rusin <[email protected]>
drm/vmwgfx: Fix invalid reads in fence signaled events
Ian Forbes <[email protected]>
drm/vmwgfx: Fix Legacy Display Unit
Zack Rusin <[email protected]>
drm/ttm: Print the memory decryption status just once
Alex Deucher <[email protected]>
drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
Dave Airlie <[email protected]>
Revert "drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()"
Lyude Paul <[email protected]>
drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()
Alexander Usyskin <[email protected]>
mei: me: add lunar lake point M DID
Frank Oltmanns <[email protected]>
clk: sunxi-ng: a64: Set minimum and maximum rate for PLL-MIPI
Frank Oltmanns <[email protected]>
clk: sunxi-ng: common: Support minimum and maximum rate
Viken Dadhaniya <[email protected]>
slimbus: qcom-ngd-ctrl: Add timeout for wait operation
Jim Cromie <[email protected]>
dyndbg: fix old BUG_ON in >control parser
Joao Paulo Goncalves <[email protected]>
ASoC: ti: davinci-mcasp: Fix race condition during probe
Sameer Pujar <[email protected]>
ASoC: tegra: Fix DSPK 16-bit playback
Doug Berger <[email protected]>
net: bcmgenet: synchronize UMAC_CMD access
Doug Berger <[email protected]>
net: bcmgenet: synchronize use of bcmgenet_set_rx_mode()
Doug Berger <[email protected]>
net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access
Max Filippov <[email protected]>
xtensa: fix MAKE_PC_FROM_RA second argument
Paolo Abeni <[email protected]>
tipc: fix UAF in error path
Vitaly Lifshits <[email protected]>
e1000e: change usleep_range to udelay in PHY mdic access
Alexander Potapenko <[email protected]>
kmsan: compiler_types: declare __no_sanitize_or_inline
Hans de Goede <[email protected]>
iio: accel: mxc4005: Interrupt handling fixes
Vasileios Amoiridis <[email protected]>
iio: pressure: Fixes BME280 SPI driver data
Ramona Gradinariu <[email protected]>
iio:imu: adis16475: Fix sync mode setting
Javier Carrasco <[email protected]>
dt-bindings: iio: health: maxim,max30102: fix compatible check
Sven Schnelle <[email protected]>
workqueue: Fix selection of wake_cpu in kick_pool()
Gregory Detal <[email protected]>
mptcp: only allow set existing scheduler for net.mptcp.scheduler
Paolo Abeni <[email protected]>
mptcp: ensure snd_nxt is properly initialized on connect
Dan Carpenter <[email protected]>
mm/slab: make __free(kfree) accept error pointers
Liam R. Howlett <[email protected]>
maple_tree: fix mas_empty_area_rev() null pointer dereference
Qu Wenruo <[email protected]>
btrfs: set correct ram_bytes when splitting ordered extent
Dominique Martinet <[email protected]>
btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
Takashi Sakamoto <[email protected]>
firewire: ohci: fulfill timestamp for some local asynchronous transaction
Aman Dhoot <[email protected]>
ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU
Badhri Jagan Sridharan <[email protected]>
usb: typec: tcpm: Check for port partner validity before consuming it
Amit Sunil Dhamne <[email protected]>
usb: typec: tcpm: unregister existing source caps before re-registration
RD Babiera <[email protected]>
usb: typec: tcpm: clear pd_event queue in PORT_RESET
Thinh Nguyen <[email protected]>
usb: dwc3: core: Prevent phy suspend during init
Thinh Nguyen <[email protected]>
usb: xhci-plat: Don't include xhci.h
Chris Wulff <[email protected]>
usb: gadget: f_fs: Fix a race condition when processing setup packets.
Wesley Cheng <[email protected]>
usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
Ivan Avdeev <[email protected]>
usb: gadget: uvc: use correct buffer size when parsing configfs lists
Peter Korsgaard <[email protected]>
usb: gadget: composite: fix OS descriptors w_value logic
Alan Stern <[email protected]>
USB: core: Fix access violation during port device removal
Guenter Roeck <[email protected]>
usb: ohci: Prevent missed ohci interrupts
Alan Stern <[email protected]>
usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device
Christian A. Ehrhardt <[email protected]>
usb: typec: ucsi: Fix connector check on init
Christian A. Ehrhardt <[email protected]>
usb: typec: ucsi: Check for notifications after init
Linus Torvalds <[email protected]>
Reapply "drm/qxl: simplify qxl_fence_wait"
Thanassis Avgerinos <[email protected]>
firewire: nosy: ensure user_length is taken into account when fetching packet contents
Dmitry Antipov <[email protected]>
btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send()
Christian König <[email protected]>
drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2
Michel Dänzer <[email protected]>
drm/amdgpu: Fix comparison in amdgpu_res_cpu_visible
Gabe Teeger <[email protected]>
drm/amd/display: Atom Integrated System Info v2_2 for DCN35
Kent Gibson <[email protected]>
gpiolib: cdev: fix uninitialised kfifo
Kent Gibson <[email protected]>
gpiolib: cdev: relocate debounce_period_us from struct gpio_desc
Zhongqiu Han <[email protected]>
gpiolib: cdev: Fix use after free in lineinfo_changed_notify
Mario Limonciello <[email protected]>
dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11 users
Douglas Anderson <[email protected]>
drm/connector: Add \n to message about demoting connector force-probes
Jerome Brunet <[email protected]>
drm/meson: dw-hdmi: add bandgap setting for g12
Jerome Brunet <[email protected]>
drm/meson: dw-hdmi: power up phy on device init
Steffen Bätz <[email protected]>
net: dsa: mv88e6xxx: add phylink_get_caps for the mv88e6320/21 family
Yonglong Liu <[email protected]>
net: hns3: fix kernel crash when devlink reload during initialization
Yonglong Liu <[email protected]>
net: hns3: fix port vlan filter not disabled issue
Peiyang Wang <[email protected]>
net: hns3: use appropriate barrier function after setting a bit value
Peiyang Wang <[email protected]>
net: hns3: release PTP resources if pf initialization failed
Peiyang Wang <[email protected]>
net: hns3: change type of numa_node_mask as nodemask_t
Jian Shen <[email protected]>
net: hns3: direct return when receive a unknown mailbox message
Peiyang Wang <[email protected]>
net: hns3: using user configure after hardware reset
Wen Gu <[email protected]>
net/smc: fix neighbour and rtable leak in smc_ib_find_route()
Eric Dumazet <[email protected]>
ipv6: prevent NULL dereference in ip6_output()
Eric Dumazet <[email protected]>
ipv6: annotate data-races around cnf.disable_ipv6
Lukasz Majewski <[email protected]>
hsr: Simplify code for announcing HSR nodes timer setup
Eric Dumazet <[email protected]>
net-sysfs: convert dev->operstate reads to lockless ones
Eric Dumazet <[email protected]>
ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
Daniel Golle <[email protected]>
dt-bindings: net: mediatek: remove wrongly added clocks and SerDes
David Howells <[email protected]>
rxrpc: Only transmit one ACK per jumbo packet received
David Howells <[email protected]>
rxrpc: Fix congestion control algorithm
David Howells <[email protected]>
rxrpc: Fix the names of the fields in the ACK trailer struct
Ido Schimmel <[email protected]>
selftests: test_bridge_neigh_suppress.sh: Fix failures due to duplicate MAC
Hangbin Liu <[email protected]>
selftests/net: convert test_bridge_neigh_suppress.sh to run it in unique namespace
Shigeru Yoshida <[email protected]>
ipv6: Fix potential uninit-value access in __ip6_make_skb()
Felix Fietkau <[email protected]>
net: bridge: fix corrupted ethernet header on multicast-to-unicast
Tetsuo Handa <[email protected]>
nfc: nci: Fix kcov check in nci_rx_work()
Eric Dumazet <[email protected]>
phonet: fix rtm_phonet_notify() skb allocation
Aleksa Savic <[email protected]>
hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock
Aleksa Savic <[email protected]>
hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event()
Aleksa Savic <[email protected]>
hwmon: (corsair-cpro) Use a separate buffer for sending commands
Roded Zats <[email protected]>
rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
Marek Vasut <[email protected]>
net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs
Duoming Zhou <[email protected]>
Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
Sungwoo Kim <[email protected]>
Bluetooth: HCI: Fix potential null-ptr-deref
Sungwoo Kim <[email protected]>
Bluetooth: msft: fix slab-use-after-free in msft_do_close()
Duoming Zhou <[email protected]>
Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
Kuniyuki Iwashima <[email protected]>
tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
Eric Dumazet <[email protected]>
tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
Boy.Wu <[email protected]>
ARM: 9381/1: kasan: clear stale stack poison
Paul Davey <[email protected]>
xfrm: Preserve vlan tags for transport mode software GRO
Al Viro <[email protected]>
qibfs: fix dentry leak
Olga Kornievskaia <[email protected]>
SUNRPC: add a missing rpc_stat for TCP TLS
Li Nan <[email protected]>
blk-iocost: do not WARN if iocg was already offlined
Vanillan Wang <[email protected]>
net:usb:qmi_wwan: support Rolling modules
Alex Deucher <[email protected]>
drm/radeon: silence UBSAN warning (v3)
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Add Granite Rapids-D to HPM CPU list
Lyude Paul <[email protected]>
drm/nouveau/dp: Don't probe eDP ports twice harder
Krzysztof Kozlowski <[email protected]>
gpio: lpc32xx: fix module autoloading
Joakim Sindholt <[email protected]>
fs/9p: drop inodes immediately on non-.L too
Stephen Boyd <[email protected]>
clk: Don't hold prepare_lock when calling kref_put()
Andy Shevchenko <[email protected]>
gpio: crystalcove: Use -ENOTSUPP consistently
Andy Shevchenko <[email protected]>
gpio: wcove: Use -ENOTSUPP consistently
Michael Ellerman <[email protected]>
powerpc/crypto/chacha-p10: Fix failure on non Power10
Jeff Layton <[email protected]>
9p: explicitly deny setlease attempts
Joakim Sindholt <[email protected]>
fs/9p: fix the cache always being enabled on files with qid flags
Joakim Sindholt <[email protected]>
fs/9p: translate O_TRUNC into OTRUNC
Joakim Sindholt <[email protected]>
fs/9p: only translate RWX permissions for plain 9P2000
Krzysztof Kozlowski <[email protected]>
iommu: mtk: fix module autoloading
Steve French <[email protected]>
smb3: fix broken reconnect when password changing on the server by allowing password rotation
Michael Kelley <[email protected]>
Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted
Rick Edgecombe <[email protected]>
uio_hv_generic: Don't free decrypted memory
Rick Edgecombe <[email protected]>
hv_netvsc: Don't free decrypted memory
Rick Edgecombe <[email protected]>
Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
Rick Edgecombe <[email protected]>
Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails
John Stultz <[email protected]>
selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
Zhigang Luo <[email protected]>
amd/amdkfd: sync all devices to wait all processes being evicted
Lijo Lazar <[email protected]>
drm/amdgpu: Fix VCN allocation in CPX partition
Alex Hung <[email protected]>
drm/amd/display: Skip on writeback when it's not applicable
Tao Zhou <[email protected]>
drm/amdgpu: implement IRQ_STATE_ENABLE for SDMA v4.4.2
Lijo Lazar <[email protected]>
drm/amdgpu: Refine IB schedule error logging
Justin Ernst <[email protected]>
tools/power/turbostat: Fix uncore frequency file string
Jiaxun Yang <[email protected]>
MIPS: scall: Save thread_info.syscall unconditionally on entry
Thierry Reding <[email protected]>
gpu: host1x: Do not setup DMA for virtual devices
Rik van Riel <[email protected]>
blk-iocost: avoid out of bounds shift
Xiang Chen <[email protected]>
scsi: hisi_sas: Handle the NCQ error returned by D2H frame
Maurizio Lombardi <[email protected]>
scsi: target: Fix SELinux error when systemd-modules loads the target module
Wei Yang <[email protected]>
memblock tests: fix undefined reference to `BIT'
Wei Yang <[email protected]>
memblock tests: fix undefined reference to `panic'
Wei Yang <[email protected]>
memblock tests: fix undefined reference to `early_pfn_to_nid'
Boris Burkov <[email protected]>
btrfs: always clear PERTRANS metadata during commit
Boris Burkov <[email protected]>
btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
Len Brown <[email protected]>
tools/power turbostat: Fix warning upon failed /dev/cpu_dma_latency read
Patryk Wlazlyn <[email protected]>
tools/power turbostat: Print ucode revision only if valid
Peng Liu <[email protected]>
tools/power turbostat: Fix Bzy_MHz documentation typo
Wyes Karny <[email protected]>
tools/power turbostat: Increase the limit for fd opened
Doug Smythies <[email protected]>
tools/power turbostat: Fix added raw MSR output
Adam Goldman <[email protected]>
firewire: ohci: mask bus reset interrupts between ISR and bottom half
Chen Ni <[email protected]>
ata: sata_gemini: Check clk_enable() result
Jeff Layton <[email protected]>
vboxsf: explicitly deny setlease attempts
Phil Elwell <[email protected]>
net: bcmgenet: Reset RBUF on first open
Li Nan <[email protected]>
block: fix overflow in blk_ioctl_discard()
Takashi Iwai <[email protected]>
ALSA: line6: Zero-initialize message buffers
Peter Wang <[email protected]>
scsi: ufs: core: Fix MCQ mode dev command timeout
Yihang Li <[email protected]>
scsi: libsas: Align SMP request allocation to ARCH_DMA_MINALIGN
Peter Wang <[email protected]>
scsi: ufs: core: WLUN suspend dev/link state error recovery
André Apitzsch <[email protected]>
regulator: tps65132: Add of_match table
Peter Ujfalusi <[email protected]>
ASoC: SOF: Intel: hda-dsp: Skip IMR boot on ACE platforms in case of S3 suspend
Borislav Petkov (AMD) <[email protected]>
kbuild: Disable KCSAN for autogenerated *.mod.c intermediaries
Mark Rutland <[email protected]>
selftests/ftrace: Fix event filter target_func selection
Andrei Matei <[email protected]>
bpf: Check bloom filter map value size
Jonathan Kim <[email protected]>
drm/amdkfd: range check cp bad op exception interrupts
Mukul Joshi <[email protected]>
drm/amdkfd: Check cgroup when returning DMABuf info
Anand Jain <[email protected]>
btrfs: return accurate error code on open failure in open_fs_devices()
Saurav Kashyap <[email protected]>
scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
Shin'ichiro Kawasaki <[email protected]>
scsi: mpi3mr: Avoid memcpy field-spanning write WARNING
linke li <[email protected]>
net: mark racy access on sk->sk_rcvbuf
Benjamin Berg <[email protected]>
wifi: iwlwifi: mvm: guard against invalid STA ID on removal
Johannes Berg <[email protected]>
wifi: iwlwifi: read txq->read_ptr under lock
Johannes Berg <[email protected]>
wifi: mac80211: fix prep_connection error path
Igor Artemiev <[email protected]>
wifi: cfg80211: fix rdev_dump_mpp() arguments order
Jeff Johnson <[email protected]>
wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
Andrew Price <[email protected]>
gfs2: Fix invalid metadata access in punch_hole
Justin Tee <[email protected]>
scsi: lpfc: Use a dedicated lock for ras_fwlog state
Justin Tee <[email protected]>
scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
Justin Tee <[email protected]>
scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port()
Justin Tee <[email protected]>
scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
Justin Tee <[email protected]>
scsi: lpfc: Remove IRQF_ONESHOT flag from threaded IRQ handling
Justin Tee <[email protected]>
scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
Rohit Ner <[email protected]>
scsi: ufs: core: Fix MCQ MAC configuration
Oliver Upton <[email protected]>
KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
Marc Zyngier <[email protected]>
KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
Will Deacon <[email protected]>
swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y
Gaurav Batra <[email protected]>
powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE
Nayna Jain <[email protected]>
powerpc/pseries: make max polling consistent for longer H_CALLs
Jernej Skrabec <[email protected]>
clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
Adam Skladowski <[email protected]>
clk: qcom: smd-rpm: Restore msm8976 num_clk
Richard Gobert <[email protected]>
net: gro: add flush check in udp_gro_receive_segment
Richard Gobert <[email protected]>
net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb
Richard Gobert <[email protected]>
net: gro: parse ipv6 ext headers without frag0 invalidation
Shigeru Yoshida <[email protected]>
ipv4: Fix uninit-value access in __ip_make_skb()
Andy Shevchenko <[email protected]>
drm/panel: ili9341: Use predefined error codes
Andy Shevchenko <[email protected]>
drm/panel: ili9341: Respect deferred probe
Andy Shevchenko <[email protected]>
drm/panel: ili9341: Correct use of device property APIs
Alexandra Winter <[email protected]>
s390/qeth: Fix kernel panic after setting hsuid
Guillaume Nault <[email protected]>
vxlan: Pull inner IP header in vxlan_rcv().
Xin Long <[email protected]>
tipc: fix a possible memleak in tipc_buf_append
Jeffrey Altman <[email protected]>
rxrpc: Clients must accept conn from any address
Felix Fietkau <[email protected]>
net: core: reject skb_copy(_expand) for fraglist GSO skbs
Felix Fietkau <[email protected]>
net: bridge: fix multicast-to-unicast with fraglist GSO
Mans Rullgard <[email protected]>
spi: fix null pointer dereference within spi_sync
Shashank Sharma <[email protected]>
drm/amdgpu: fix doorbell regression
Marek Behún <[email protected]>
net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
Sebastian Andrzej Siewior <[email protected]>
cxgb4: Properly lock TX queue for the selftest.
Bui Quang Minh <[email protected]>
s390/cio: Ensure the copied buf is NUL terminated
Pierre-Louis Bossart <[email protected]>
ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()
Jerome Brunet <[email protected]>
ASoC: meson: cards: select SND_DYNAMIC_MINORS
Jerome Brunet <[email protected]>
ASoC: meson: axg-tdm-interface: manage formatters in trigger
Jerome Brunet <[email protected]>
ASoC: meson: axg-card: make links nonatomic
Jerome Brunet <[email protected]>
ASoC: meson: axg-fifo: use threaded irq to check periods
Jerome Brunet <[email protected]>
ASoC: meson: axg-fifo: use FIELD helpers
Guillaume Nault <[email protected]>
vxlan: Add missing VNI filter counter update in arp_reduce().
Guillaume Nault <[email protected]>
vxlan: Fix racy device stats updates.
Asbjørn Sloth Tønnesen <[email protected]>
net: qede: use return from qede_parse_actions()
Asbjørn Sloth Tønnesen <[email protected]>
net: qede: use return from qede_parse_flow_attr() for flow_spec
Asbjørn Sloth Tønnesen <[email protected]>
net: qede: use return from qede_parse_flow_attr() for flower
Asbjørn Sloth Tønnesen <[email protected]>
net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
Oswald Buddenhagen <[email protected]>
ALSA: emu10k1: fix E-MU dock initialization
Oswald Buddenhagen <[email protected]>
ALSA: emu10k1: move the whole GPIO event handling to the workqueue
Oswald Buddenhagen <[email protected]>
ALSA: emu10k1: factor out snd_emu1010_load_dock_firmware()
Oswald Buddenhagen <[email protected]>
ALSA: emu10k1: fix E-MU card dock presence monitoring
David Howells <[email protected]>
Fix a potential infinite loop in extract_user_to_sg()
Jens Remus <[email protected]>
s390/vdso: Add CFI for RA register to asm macro vdso_func
David Bauer <[email protected]>
net l2tp: drop flow hash on forward
Kuniyuki Iwashima <[email protected]>
nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().Bui Quang Minh <[email protected]>
octeontx2-af: avoid off-by-one read from userspace
Bui Quang Minh <[email protected]>
bna: ensure the copied buf is NUL terminated
Toke Høiland-Jørgensen <[email protected]>
xdp: use flags field to disambiguate broadcast redirect
Claudio Imbrenda <[email protected]>
s390/mm: Fix clearing storage keys for huge pages
Claudio Imbrenda <[email protected]>
s390/mm: Fix storage key clearing for guest huge pages
Srinivas Kandagatla <[email protected]>
ASoC: codecs: wsa881x: set clk_stop_mode1 flag
Amadeusz Sławiński <[email protected]>
ASoC: Intel: avs: Set name of control as in topology
Xu Kuohai <[email protected]>
riscv, bpf: Fix incorrect runtime stats
Xu Kuohai <[email protected]>
bpf, arm64: Fix incorrect runtime stats
Devyn Liu <[email protected]>
spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs
David Lechner <[email protected]>
spi: axi-spi-engine: fix version format string
David Lechner <[email protected]>
spi: axi-spi-engine: use common AXI macros
David Lechner <[email protected]>
spi: axi-spi-engine: move msg state to new struct
David Lechner <[email protected]>
spi: axi-spi-engine: use devm_spi_alloc_host()
David Lechner <[email protected]>
spi: axi-spi-engine: simplify driver data allocation
Li Zetao <[email protected]>
spi: spi-axi-spi-engine: Use helper function devm_clk_get_enabled()
Anton Protopopov <[email protected]>
bpf: Fix a verifier verbose message
Yi Zhang <[email protected]>
nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH
Pierre-Louis Bossart <[email protected]>
ASoC: SOF: Intel: add default firmware library path for LNL
Peter Ujfalusi <[email protected]>
ASoC: SOF: Introduce generic names for IPC types
Richard Fitzgerald <[email protected]>
regmap: Add regmap_read_bypassed()
Jason Xing <[email protected]>
bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
Andrii Nakryiko <[email protected]>
bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition
Matti Vaittinen <[email protected]>
regulator: change devm_regulator_get_enable_optional() stub to return Ok
Matti Vaittinen <[email protected]>
regulator: change stubbed devm_regulator_get_enable to return Ok
AngeloGioacchino Del Regno <[email protected]>
regulator: mt6360: De-capitalize devicetree regulator subnodes
Zeng Heng <[email protected]>
pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
AngeloGioacchino Del Regno <[email protected]>
power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator
Arnd Bergmann <[email protected]>
power: rt9455: hide unused rt9455_boost_voltage_values
Hans de Goede <[email protected]>
pinctrl: baytrail: Fix selecting gpio pinctrl state
Kuniyuki Iwashima <[email protected]>
nfs: Handle error of rpc_proc_register() in nfs_net_init().
Josef Bacik <[email protected]>
nfs: make the rpc_stat per net namespace
Josef Bacik <[email protected]>
nfs: expose /proc/net/sunrpc/nfs in net namespaces
Josef Bacik <[email protected]>
sunrpc: add a struct rpc_stats arg to rpc_create_args
Chen-Yu Tsai <[email protected]>
pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
Chen-Yu Tsai <[email protected]>
pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
Dan Carpenter <[email protected]>
pinctrl: core: delete incorrect free in pinctrl_enable()
Jan Dakinevich <[email protected]>
pinctrl/meson: fix typo in PDM's pin name
Billy Tsai <[email protected]>
pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T
Tim Jiang <[email protected]>
Bluetooth: qca: add support for QCA2066
Daniel Okazaki <[email protected]>
eeprom: at24: fix memory corruption race condition
Heiner Kallweit <[email protected]>
eeprom: at24: Probe for DDR3 thermal sensor in the SPD case
Wedson Almeida Filho <[email protected]>
rust: kernel: require Send for Module implementations
Johannes Berg <[email protected]>
wifi: nl80211: don't free NULL coalescing rule
Benno Lossin <[email protected]>
rust: macros: fix soundness issue in module! macro
Thomas Bertschinger <[email protected]>
rust: module: place generated init_module() function in .init.text
Christian Marangi <[email protected]>
mtd: limit OTP NVMEM cell parse to non-NAND devices
Rafał Miłecki <[email protected]>
nvmem: add explicit config option to read old syntax fixed OF cells
Vinod Koul <[email protected]>
dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"
Bumyong Lee <[email protected]>
dmaengine: pl330: issue_pending waits until WFP state
-------------
Diffstat:
.../bindings/iio/health/maxim,max30102.yaml | 2 +- .../devicetree/bindings/net/mediatek,net.yaml | 22 +- Makefile | 4 +- arch/arm/kernel/sleep.S | 4 + arch/arm64/boot/dts/qcom/sa8155p-adp.dts | 30 +- arch/arm64/kvm/vgic/vgic-kvm-device.c | 12 +- arch/arm64/net/bpf_jit_comp.c | 6 +- arch/mips/include/asm/ptrace.h | 2 +- arch/mips/kernel/asm-offsets.c | 1 + arch/mips/kernel/ptrace.c | 15 +- arch/mips/kernel/scall32-o32.S | 23 +- arch/mips/kernel/scall64-n32.S | 3 +- arch/mips/kernel/scall64-n64.S | 3 +- arch/mips/kernel/scall64-o32.S | 33 +- arch/powerpc/crypto/chacha-p10-glue.c | 8 +- arch/powerpc/include/asm/plpks.h | 5 +- arch/powerpc/platforms/pseries/iommu.c | 8 + arch/powerpc/platforms/pseries/plpks.c | 10 +- arch/riscv/net/bpf_jit_comp64.c | 6 +- arch/s390/include/asm/dwarf.h | 1 + arch/s390/kernel/vdso64/vdso_user_wrapper.S | 2 + arch/s390/mm/gmap.c | 2 +- arch/s390/mm/hugetlbpage.c | 2 +- arch/x86/kernel/apic/apic.c | 16 +- arch/xtensa/include/asm/processor.h | 8 +- arch/xtensa/include/asm/ptrace.h | 2 +- arch/xtensa/kernel/process.c | 5 +- arch/xtensa/kernel/stacktrace.c | 3 +- block/blk-iocost.c | 14 +- block/ioctl.c | 5 +- drivers/ata/sata_gemini.c | 5 +- drivers/base/regmap/regmap.c | 37 +++ drivers/bluetooth/btqca.c | 208 ++++++++++++- drivers/bluetooth/btqca.h | 8 +- drivers/bluetooth/hci_qca.c | 13 +- drivers/clk/clk.c | 12 +- drivers/clk/qcom/clk-smd-rpm.c | 1 + drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 2 + drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 19 +- drivers/clk/sunxi-ng/ccu_common.c | 19 ++ drivers/clk/sunxi-ng/ccu_common.h | 3 + drivers/firewire/nosy.c | 6 +- drivers/firewire/ohci.c | 14 +- drivers/gpio/gpio-crystalcove.c | 2 +- drivers/gpio/gpio-lpc32xx.c | 1 + drivers/gpio/gpio-wcove.c | 2 +- drivers/gpio/gpiolib-cdev.c | 181 +++++++++-- drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 14 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 56 ++-- drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 15 +- drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 16 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 11 +- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 17 +- drivers/gpu/drm/amd/amdkfd/kfd_int_process_v10.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_int_process_v11.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c | 3 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 + .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 48 ++- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 1 + .../display/dc/dcn31/dcn31_hpo_dp_link_encoder.c | 6 + .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 2 +- drivers/gpu/drm/drm_connector.c | 2 +- drivers/gpu/drm/i915/display/intel_audio.c | 113 +------ drivers/gpu/drm/i915/display/intel_bios.c | 19 +- drivers/gpu/drm/i915/display/intel_vbt_defs.h | 5 - drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.c | 6 +- drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.h | 2 +- drivers/gpu/drm/i915/gt/intel_workarounds.c | 4 +- drivers/gpu/drm/meson/meson_dw_hdmi.c | 70 ++--- drivers/gpu/drm/nouveau/nouveau_dp.c | 13 +- drivers/gpu/drm/panel/Kconfig | 2 +- drivers/gpu/drm/panel/panel-ilitek-ili9341.c | 13 +- drivers/gpu/drm/qxl/qxl_release.c | 50 +--- drivers/gpu/drm/radeon/pptable.h | 10 +- drivers/gpu/drm/ttm/ttm_tt.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 1 + drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 2 +- drivers/gpu/host1x/bus.c | 8 - drivers/hv/channel.c | 29 +- drivers/hv/connection.c | 29 +- drivers/hwmon/corsair-cpro.c | 43 ++- drivers/hwmon/pmbus/ucd9000.c | 6 +- drivers/iio/accel/mxc4005.c | 24 +- drivers/iio/imu/adis16475.c | 4 +- drivers/iio/pressure/bmp280-spi.c | 4 +- drivers/infiniband/hw/qib/qib_fs.c | 1 + drivers/iommu/mtk_iommu.c | 1 + drivers/iommu/mtk_iommu_v1.c | 1 + drivers/misc/eeprom/at24.c | 47 ++- drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 2 + drivers/mtd/mtdcore.c | 2 + drivers/net/dsa/mv88e6xxx/chip.c | 20 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 32 +- drivers/net/ethernet/broadcom/genet/bcmgenet.h | 4 +- drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 8 +- drivers/net/ethernet/broadcom/genet/bcmmii.c | 6 +- drivers/net/ethernet/brocade/bna/bnad_debugfs.c | 4 +- drivers/net/ethernet/chelsio/cxgb4/sge.c | 6 +- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 2 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 52 ++-- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 5 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 7 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 20 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 2 +- drivers/net/ethernet/intel/e1000e/phy.c | 8 +- .../ethernet/marvell/octeontx2/af/rvu_debugfs.c | 4 +- drivers/net/ethernet/micrel/ks8851_common.c | 16 +- drivers/net/ethernet/qlogic/qede/qede_filter.c | 14 +- drivers/net/hyperv/netvsc.c | 7 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/vxlan/vxlan_core.c | 49 ++- drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c | 7 +- drivers/net/wireless/intel/iwlwifi/queue/tx.c | 2 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/nvme.h | 5 + drivers/nvme/host/pci.c | 14 +- drivers/nvmem/apple-efuses.c | 1 + drivers/nvmem/core.c | 8 +- drivers/nvmem/imx-ocotp-scu.c | 1 + drivers/nvmem/imx-ocotp.c | 1 + drivers/nvmem/meson-efuse.c | 1 + drivers/nvmem/meson-mx-efuse.c | 1 + drivers/nvmem/microchip-otpc.c | 1 + drivers/nvmem/mtk-efuse.c | 1 + drivers/nvmem/qcom-spmi-sdam.c | 1 + drivers/nvmem/qfprom.c | 1 + drivers/nvmem/rave-sp-eeprom.c | 1 + drivers/nvmem/rockchip-efuse.c | 1 + drivers/nvmem/sc27xx-efuse.c | 1 + drivers/nvmem/sec-qfprom.c | 1 + drivers/nvmem/sprd-efuse.c | 1 + drivers/nvmem/stm32-romem.c | 1 + drivers/nvmem/sunplus-ocotp.c | 1 + drivers/nvmem/sunxi_sid.c | 1 + drivers/nvmem/uniphier-efuse.c | 1 + drivers/nvmem/zynqmp_nvmem.c | 1 + drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c | 34 +-- drivers/pinctrl/core.c | 8 +- drivers/pinctrl/devicetree.c | 10 +- drivers/pinctrl/intel/pinctrl-baytrail.c | 74 ++--- drivers/pinctrl/intel/pinctrl-intel.h | 4 + drivers/pinctrl/mediatek/pinctrl-paris.c | 40 +-- drivers/pinctrl/meson/pinctrl-meson-a1.c | 6 +- .../x86/intel/speed_select_if/isst_if_common.c | 1 + drivers/power/supply/mt6360_charger.c | 2 +- drivers/power/supply/rt9455_charger.c | 2 + drivers/regulator/core.c | 27 +- drivers/regulator/mt6360-regulator.c | 32 +- drivers/regulator/tps65132-regulator.c | 7 + drivers/rtc/nvmem.c | 1 + drivers/s390/cio/cio_inject.c | 2 +- drivers/s390/net/qeth_core_main.c | 69 ++--- drivers/scsi/bnx2fc/bnx2fc_tgt.c | 2 - drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +- drivers/scsi/libsas/sas_expander.c | 2 +- drivers/scsi/lpfc/lpfc.h | 2 +- drivers/scsi/lpfc/lpfc_attr.c | 4 +- drivers/scsi/lpfc/lpfc_bsg.c | 20 +- drivers/scsi/lpfc/lpfc_debugfs.c | 12 +- drivers/scsi/lpfc/lpfc_els.c | 20 +- drivers/scsi/lpfc/lpfc_hbadisc.c | 5 +- drivers/scsi/lpfc/lpfc_init.c | 5 +- drivers/scsi/lpfc/lpfc_nvme.c | 4 +- drivers/scsi/lpfc/lpfc_scsi.c | 13 +- drivers/scsi/lpfc/lpfc_sli.c | 34 +-- drivers/scsi/lpfc/lpfc_vport.c | 8 +- drivers/scsi/mpi3mr/mpi3mr_app.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 6 +- drivers/spi/spi-axi-spi-engine.c | 229 +++++++------- drivers/spi/spi-hisi-kunpeng.c | 2 - drivers/spi/spi-microchip-core-qspi.c | 1 + drivers/spi/spi.c | 1 + drivers/target/target_core_configfs.c | 12 + drivers/ufs/core/ufs-mcq.c | 2 +- drivers/ufs/core/ufshcd.c | 9 +- drivers/uio/uio_hv_generic.c | 12 +- drivers/usb/core/hub.c | 5 +- drivers/usb/core/port.c | 8 +- drivers/usb/dwc3/core.c | 90 +++--- drivers/usb/dwc3/core.h | 1 + drivers/usb/dwc3/gadget.c | 2 + drivers/usb/dwc3/host.c | 27 ++ drivers/usb/gadget/composite.c | 6 +- drivers/usb/gadget/function/f_fs.c | 9 +- drivers/usb/gadget/function/uvc_configfs.c | 4 +- drivers/usb/host/ohci-hcd.c | 8 + drivers/usb/host/xhci-plat.h | 4 +- drivers/usb/host/xhci-rzv2m.c | 1 + drivers/usb/typec/tcpm/tcpm.c | 36 ++- drivers/usb/typec/ucsi/ucsi.c | 12 +- drivers/w1/slaves/w1_ds250x.c | 1 + fs/9p/fid.h | 3 - fs/9p/vfs_file.c | 2 + fs/9p/vfs_inode.c | 5 +- fs/9p/vfs_super.c | 1 + fs/btrfs/inode.c | 2 +- fs/btrfs/ordered-data.c | 1 + fs/btrfs/send.c | 4 +- fs/btrfs/transaction.c | 2 +- fs/btrfs/volumes.c | 18 +- fs/gfs2/bmap.c | 5 +- fs/nfs/client.c | 5 +- fs/nfs/inode.c | 13 +- fs/nfs/internal.h | 2 - fs/nfs/netns.h | 2 + fs/smb/client/cifsglob.h | 1 + fs/smb/client/connect.c | 8 + fs/smb/client/fs_context.c | 21 ++ fs/smb/client/fs_context.h | 2 + fs/smb/client/misc.c | 1 + fs/smb/client/smb2pdu.c | 11 + fs/smb/server/oplock.c | 35 ++- fs/smb/server/transport_tcp.c | 4 + fs/tracefs/event_inode.c | 74 ++--- fs/tracefs/inode.c | 92 +++++- fs/tracefs/internal.h | 14 +- fs/userfaultfd.c | 4 + fs/vboxsf/file.c | 1 + include/linux/compiler_types.h | 11 + include/linux/dma-fence.h | 7 - include/linux/gfp_types.h | 2 + include/linux/hyperv.h | 1 + include/linux/nvmem-provider.h | 2 + include/linux/regmap.h | 8 + include/linux/regulator/consumer.h | 4 +- include/linux/skbuff.h | 15 + include/linux/skmsg.h | 2 + include/linux/slab.h | 2 +- include/linux/sunrpc/clnt.h | 1 + include/net/gro.h | 9 + include/net/xfrm.h | 3 + include/sound/emu10k1.h | 3 +- include/sound/sof.h | 7 +- include/trace/events/rxrpc.h | 2 +- include/uapi/linux/kfd_ioctl.h | 17 +- include/uapi/scsi/scsi_bsg_mpi3mr.h | 2 +- kernel/bpf/bloom_filter.c | 13 + kernel/bpf/verifier.c | 3 +- kernel/dma/swiotlb.c | 1 + kernel/workqueue.c | 8 +- lib/Kconfig.debug | 5 +- lib/dynamic_debug.c | 6 +- lib/maple_tree.c | 16 +- lib/scatterlist.c | 2 +- mm/readahead.c | 4 + net/8021q/vlan_core.c | 2 + net/bluetooth/hci_core.c | 3 +- net/bluetooth/hci_event.c | 2 + net/bluetooth/l2cap_core.c | 3 + net/bluetooth/msft.c | 2 +- net/bluetooth/msft.h | 4 +- net/bluetooth/sco.c | 4 + net/bridge/br_forward.c | 9 +- net/bridge/br_netlink.c | 3 +- net/core/filter.c | 42 ++- net/core/gro.c | 1 + net/core/link_watch.c | 4 +- net/core/net-sysfs.c | 4 +- net/core/net_namespace.c | 13 +- net/core/rtnetlink.c | 6 +- net/core/skbuff.c | 27 +- net/core/skmsg.c | 5 +- net/core/sock.c | 4 +- net/hsr/hsr_device.c | 31 +- net/ipv4/af_inet.c | 1 + net/ipv4/ip_output.c | 2 +- net/ipv4/raw.c | 3 + net/ipv4/tcp.c | 4 +- net/ipv4/tcp_input.c | 2 + net/ipv4/tcp_ipv4.c | 8 +- net/ipv4/tcp_output.c | 4 +- net/ipv4/udp.c | 3 +- net/ipv4/udp_offload.c | 15 +- net/ipv4/xfrm4_input.c | 6 +- net/ipv6/addrconf.c | 11 +- net/ipv6/fib6_rules.c | 6 +- net/ipv6/ip6_input.c | 4 +- net/ipv6/ip6_offload.c | 52 +++- net/ipv6/ip6_output.c | 4 +- net/ipv6/udp.c | 3 +- net/ipv6/udp_offload.c | 3 +- net/ipv6/xfrm6_input.c | 6 +- net/l2tp/l2tp_eth.c | 3 + net/mac80211/ieee80211_i.h | 4 +- net/mac80211/mlme.c | 5 +- net/mptcp/ctrl.c | 39 ++- net/mptcp/protocol.c | 3 + net/nfc/nci/core.c | 1 + net/nsh/nsh.c | 14 +- net/phonet/pn_netlink.c | 2 +- net/rxrpc/ar-internal.h | 2 +- net/rxrpc/call_object.c | 7 +- net/rxrpc/conn_event.c | 16 +- net/rxrpc/conn_object.c | 9 +- net/rxrpc/input.c | 71 +++-- net/rxrpc/output.c | 14 +- net/rxrpc/protocol.h | 6 +- net/smc/smc_ib.c | 19 +- net/sunrpc/clnt.c | 5 +- net/sunrpc/xprtsock.c | 1 + net/tipc/msg.c | 8 +- net/wireless/nl80211.c | 2 + net/wireless/trace.h | 2 +- net/xfrm/xfrm_input.c | 8 + rust/kernel/lib.rs | 2 +- rust/macros/module.rs | 185 +++++++----- scripts/Makefile.modfinal | 2 +- sound/hda/intel-sdw-acpi.c | 2 + sound/pci/emu10k1/emu10k1.c | 3 +- sound/pci/emu10k1/emu10k1_main.c | 139 +++++---- sound/pci/hda/patch_realtek.c | 1 + sound/soc/codecs/wsa881x.c | 1 + sound/soc/intel/avs/topology.c | 2 + sound/soc/meson/Kconfig | 1 + sound/soc/meson/axg-card.c | 1 + sound/soc/meson/axg-fifo.c | 56 ++-- sound/soc/meson/axg-fifo.h | 12 +- sound/soc/meson/axg-frddr.c | 5 +- sound/soc/meson/axg-tdm-interface.c | 34 ++- sound/soc/meson/axg-toddr.c | 22 +- sound/soc/sof/intel/hda-dsp.c | 20 +- sound/soc/sof/intel/pci-lnl.c | 3 + sound/soc/tegra/tegra186_dspk.c | 7 +- sound/soc/ti/davinci-mcasp.c | 12 +- sound/usb/line6/driver.c | 6 +- tools/include/linux/kernel.h | 1 + tools/include/linux/mm.h | 5 + tools/include/linux/panic.h | 19 ++ tools/power/x86/turbostat/turbostat.8 | 2 +- tools/power/x86/turbostat/turbostat.c | 45 ++- .../selftests/bpf/prog_tests/bloom_filter_map.c | 6 + .../ftrace/test.d/filter/event-filter-function.tc | 2 +- tools/testing/selftests/mm/Makefile | 6 +- .../selftests/net/test_bridge_neigh_suppress.sh | 333 ++++++++++----------- tools/testing/selftests/timers/valid-adjtimex.c | 73 +++-- 338 files changed, 3043 insertions(+), 1798 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/301 dmaengine: pl330: issue_pending waits until WFP state
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bumyong Lee <[email protected]>
[ Upstream commit 22a9d9585812440211b0b34a6bc02ade62314be4 ]
According to DMA-330 errata notice[1] 71930, DMAKILL cannot clear internal signal, named pipeline_req_active. it makes that pl330 would wait forever in WFP state although dma already send dma request if pl330 gets dma request before entering WFP state.
The errata suggests that polling until entering WFP state as workaround and then peripherals allows to issue dma request.
[1]: https://developer.arm.com/documentation/genc008428/latest
Stable-dep-of: afc89870ea67 ("dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"")
--- drivers/dma/pl330.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/dma/pl330.c +3 -0
@@ -1053,6 +1053,9 @@ static bool _trigger(struct pl330_thread *thrd) thrd->req_running = idx; +if (desc->rqtype ==DMA_MEM_TO_DEV || desc->rqtype ==DMA_DEV_TO_MEM ) +UNTIL (thrd,PL330_STATE_WFP ); +return true; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/301 dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinod Koul <[email protected]>
[ Upstream commit afc89870ea677bd5a44516eb981f7a259b74280c ]
This reverts commit 22a9d9585812 ("dmaengine: pl330: issue_pending waits until WFP state") as it seems to cause regression in pl330 driver. Note the issue now exists in mainline so a fix to be done.
--- drivers/dma/pl330.c | 3 --- 1 file changed, 3 deletions(-)
drivers/dma/pl330.c +0 -3
@@ -1053,9 +1053,6 @@ static bool _trigger(struct pl330_thread *thrd) thrd->req_running = idx; -if (desc->rqtype ==DMA_MEM_TO_DEV || desc->rqtype ==DMA_DEV_TO_MEM ) -UNTIL (thrd,PL330_STATE_WFP ); -return true; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/301 nvmem: add explicit config option to read old syntax fixed OF cells
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit 2cc3b37f5b6df8189d55d0e812d9658ce256dfec ]
Binding for fixed NVMEM cells defined directly as NVMEM device subnodes has been deprecated. It has been replaced by the "fixed-layout" NVMEM layout binding.
New syntax is meant to be clearer and should help avoiding imprecise bindings.
NVMEM subsystem already supports the new binding. It should be a good idea to limit support for old syntax to existing drivers that actually support & use it (we can't break backward compatibility!). That way we additionally encourage new bindings & drivers to ignore deprecated binding.
It wasn't clear (to me) if rtc and w1 code actually uses old syntax fixed cells. I enabled them to don't risk any breakage.
Stable-dep-of: d2d73a6dd173 ("mtd: limit OTP NVMEM cell parse to non-NAND devices")
--- drivers/mtd/mtdcore.c | 2 ++ drivers/nvmem/apple-efuses.c | 1 + drivers/nvmem/core.c | 8 +++++--- drivers/nvmem/imx-ocotp-scu.c | 1 + drivers/nvmem/imx-ocotp.c | 1 + drivers/nvmem/meson-efuse.c | 1 + drivers/nvmem/meson-mx-efuse.c | 1 + drivers/nvmem/microchip-otpc.c | 1 + drivers/nvmem/mtk-efuse.c | 1 + drivers/nvmem/qcom-spmi-sdam.c | 1 + drivers/nvmem/qfprom.c | 1 + drivers/nvmem/rave-sp-eeprom.c | 1 + drivers/nvmem/rockchip-efuse.c | 1 + drivers/nvmem/sc27xx-efuse.c | 1 + drivers/nvmem/sec-qfprom.c | 1 + drivers/nvmem/sprd-efuse.c | 1 + drivers/nvmem/stm32-romem.c | 1 + drivers/nvmem/sunplus-ocotp.c | 1 + drivers/nvmem/sunxi_sid.c | 1 + drivers/nvmem/uniphier-efuse.c | 1 + drivers/nvmem/zynqmp_nvmem.c | 1 + drivers/rtc/nvmem.c | 1 + drivers/w1/slaves/w1_ds250x.c | 1 + include/linux/nvmem-provider.h | 2 ++ 24 files changed, 30 insertions(+), 3 deletions(-)
drivers/mtd/mtdcore.c +2 -0
@@ -552,6 +552,7 @@ static int mtd_nvmem_add(struct mtd_info *mtd) config.dev = &mtd->dev; config.name =dev_name (&mtd->dev); config.owner =THIS_MODULE ; + config.add_legacy_fixed_of_cells =of_device_is_compatible (node,"nvmem-cells" ); config.reg_read = mtd_nvmem_reg_read; config.size = mtd->size; config.word_size =1 ;
@@ -898,6 +899,7 @@ static struct nvmem_device *mtd_otp_nvmem_register(struct mtd_info *mtd, config.name = compatible; config.id =NVMEM_DEVID_AUTO ; config.owner =THIS_MODULE ; + config.add_legacy_fixed_of_cells = true; config.type =NVMEM_TYPE_OTP ; config.root_only = true; config.ignore_wp = true;
drivers/nvmem/apple-efuses.c +1 -0
@@ -36,6 +36,7 @@ static int apple_efuses_probe(struct platform_device *pdev)struct resource *res;struct nvmem_config config = { .dev = &pdev->dev, + .add_legacy_fixed_of_cells = true, .read_only = true, .reg_read = apple_efuses_read, .stride =sizeof (u32),
drivers/nvmem/core.c +5 -3
@@ -1003,9 +1003,11 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config)if (rval) goto err_remove_cells; - rval =nvmem_add_cells_from_legacy_of (nvmem); -if (rval) - goto err_remove_cells; +if (config->add_legacy_fixed_of_cells) { + rval =nvmem_add_cells_from_legacy_of (nvmem); +if (rval) + goto err_remove_cells; + } rval =nvmem_add_cells_from_fixed_layout (nvmem);if (rval)
drivers/nvmem/imx-ocotp-scu.c +1 -0
@@ -220,6 +220,7 @@ static int imx_scu_ocotp_write(void *context, unsigned int offset,static struct nvmem_config imx_scu_ocotp_nvmem_config = { .name ="imx-scu-ocotp" , + .add_legacy_fixed_of_cells = true, .read_only = false, .word_size =4 , .stride =1 ,
drivers/nvmem/imx-ocotp.c +1 -0
@@ -615,6 +615,7 @@ static int imx_ocotp_probe(struct platform_device *pdev)return PTR_ERR (priv->clk); priv->params =of_device_get_match_data (&pdev->dev); + imx_ocotp_nvmem_config.add_legacy_fixed_of_cells = true; imx_ocotp_nvmem_config.size =4 * priv->params->nregs; imx_ocotp_nvmem_config.dev = dev; imx_ocotp_nvmem_config.priv = priv;
drivers/nvmem/meson-efuse.c +1 -0
@@ -74,6 +74,7 @@ static int meson_efuse_probe(struct platform_device *pdev) econfig->dev = dev; econfig->name =dev_name (dev); + econfig->add_legacy_fixed_of_cells = true; econfig->stride =1 ; econfig->word_size =1 ; econfig->reg_read = meson_efuse_read;
drivers/nvmem/meson-mx-efuse.c +1 -0
@@ -210,6 +210,7 @@ static int meson_mx_efuse_probe(struct platform_device *pdev) efuse->config.owner =THIS_MODULE ; efuse->config.dev = &pdev->dev; efuse->config.priv = efuse; + efuse->config.add_legacy_fixed_of_cells = true; efuse->config.stride = drvdata->word_size; efuse->config.word_size = drvdata->word_size; efuse->config.size =SZ_512 ;
drivers/nvmem/microchip-otpc.c +1 -0
@@ -261,6 +261,7 @@ static int mchp_otpc_probe(struct platform_device *pdev)return ret; mchp_nvmem_config.dev = otpc->dev; + mchp_nvmem_config.add_legacy_fixed_of_cells = true; mchp_nvmem_config.size = size; mchp_nvmem_config.priv = otpc; nvmem =devm_nvmem_register (&pdev->dev, &mchp_nvmem_config);
drivers/nvmem/mtk-efuse.c +1 -0
@@ -83,6 +83,7 @@ static int mtk_efuse_probe(struct platform_device *pdev)return PTR_ERR (priv->base); pdata =device_get_match_data (dev); + econfig.add_legacy_fixed_of_cells = true; econfig.stride =1 ; econfig.word_size =1 ; econfig.reg_read = mtk_reg_read;
drivers/nvmem/qcom-spmi-sdam.c +1 -0
@@ -142,6 +142,7 @@ static int sdam_probe(struct platform_device *pdev) sdam->sdam_config.name ="spmi_sdam" ; sdam->sdam_config.id =NVMEM_DEVID_AUTO ; sdam->sdam_config.owner =THIS_MODULE ; + sdam->sdam_config.add_legacy_fixed_of_cells = true; sdam->sdam_config.stride =1 ; sdam->sdam_config.word_size =1 ; sdam->sdam_config.reg_read = sdam_read;
drivers/nvmem/qfprom.c +1 -0
@@ -357,6 +357,7 @@ static int qfprom_probe(struct platform_device *pdev) {struct nvmem_config econfig = { .name ="qfprom" , + .add_legacy_fixed_of_cells = true, .stride =1 , .word_size =1 , .id =NVMEM_DEVID_AUTO ,
drivers/nvmem/rave-sp-eeprom.c +1 -0
@@ -328,6 +328,7 @@ static int rave_sp_eeprom_probe(struct platform_device *pdev)of_property_read_string (np,"zii,eeprom-name" , &config.name); config.priv = eeprom; config.dev = dev; + config.add_legacy_fixed_of_cells = true; config.size = size; config.reg_read = rave_sp_eeprom_reg_read; config.reg_write = rave_sp_eeprom_reg_write;
drivers/nvmem/rockchip-efuse.c +1 -0
@@ -205,6 +205,7 @@ static int rockchip_rk3399_efuse_read(void *context, unsigned int offset,static struct nvmem_config econfig = { .name ="rockchip-efuse" , + .add_legacy_fixed_of_cells = true, .stride =1 , .word_size =1 , .read_only = true,
drivers/nvmem/sc27xx-efuse.c +1 -0
@@ -247,6 +247,7 @@ static int sc27xx_efuse_probe(struct platform_device *pdev) econfig.reg_read = sc27xx_efuse_read; econfig.priv = efuse; econfig.dev = &pdev->dev; + econfig.add_legacy_fixed_of_cells = true; nvmem =devm_nvmem_register (&pdev->dev, &econfig);if (IS_ERR (nvmem)) {dev_err (&pdev->dev,"failed to register nvmem config\n" );
drivers/nvmem/sec-qfprom.c +1 -0
@@ -47,6 +47,7 @@ static int sec_qfprom_probe(struct platform_device *pdev) {struct nvmem_config econfig = { .name ="sec-qfprom" , + .add_legacy_fixed_of_cells = true, .stride =1 , .word_size =1 , .id =NVMEM_DEVID_AUTO ,
drivers/nvmem/sprd-efuse.c +1 -0
@@ -408,6 +408,7 @@ static int sprd_efuse_probe(struct platform_device *pdev) econfig.read_only = false; econfig.name ="sprd-efuse" ; econfig.size = efuse->data->blk_nums *SPRD_EFUSE_BLOCK_WIDTH ; + econfig.add_legacy_fixed_of_cells = true; econfig.reg_read = sprd_efuse_read; econfig.reg_write = sprd_efuse_write; econfig.priv = efuse;
drivers/nvmem/stm32-romem.c +1 -0
@@ -207,6 +207,7 @@ static int stm32_romem_probe(struct platform_device *pdev) priv->cfg.priv = priv; priv->cfg.owner =THIS_MODULE ; priv->cfg.type =NVMEM_TYPE_OTP ; + priv->cfg.add_legacy_fixed_of_cells = true; priv->lower =0 ;
drivers/nvmem/sunplus-ocotp.c +1 -0
@@ -145,6 +145,7 @@ static int sp_ocotp_read(void *priv, unsigned int offset, void *value, size_t bystatic struct nvmem_config sp_ocotp_nvmem_config = { .name ="sp-ocotp" , + .add_legacy_fixed_of_cells = true, .read_only = true, .word_size =1 , .size =QAC628_OTP_SIZE ,
drivers/nvmem/sunxi_sid.c +1 -0
@@ -153,6 +153,7 @@ static int sunxi_sid_probe(struct platform_device *pdev) nvmem_cfg->dev = dev; nvmem_cfg->name ="sunxi-sid" ; nvmem_cfg->type =NVMEM_TYPE_OTP ; + nvmem_cfg->add_legacy_fixed_of_cells = true; nvmem_cfg->read_only = true; nvmem_cfg->size = cfg->size; nvmem_cfg->word_size =1 ;
drivers/nvmem/uniphier-efuse.c +1 -0
@@ -52,6 +52,7 @@ static int uniphier_efuse_probe(struct platform_device *pdev) econfig.size =resource_size (res); econfig.priv = priv; econfig.dev = dev; + econfig.add_legacy_fixed_of_cells = true; nvmem =devm_nvmem_register (dev, &econfig);return PTR_ERR_OR_ZERO (nvmem);
drivers/nvmem/zynqmp_nvmem.c +1 -0
@@ -58,6 +58,7 @@ static int zynqmp_nvmem_probe(struct platform_device *pdev) priv->dev = dev; econfig.dev = dev; + econfig.add_legacy_fixed_of_cells = true; econfig.reg_read = zynqmp_nvmem_read; econfig.priv = priv;
drivers/rtc/nvmem.c +1 -0
@@ -21,6 +21,7 @@ int devm_rtc_nvmem_register(struct rtc_device *rtc, nvmem_config->dev = dev; nvmem_config->owner = rtc->owner; + nvmem_config->add_legacy_fixed_of_cells = true; nvmem =devm_nvmem_register (dev, nvmem_config);if (IS_ERR (nvmem))dev_err (dev,"failed to register nvmem device for RTC\n" );
drivers/w1/slaves/w1_ds250x.c +1 -0
@@ -168,6 +168,7 @@ static int w1_eprom_add_slave(struct w1_slave *sl)struct nvmem_device *nvmem;struct nvmem_config nvmem_cfg = { .dev = &sl->dev, + .add_legacy_fixed_of_cells = true, .reg_read = w1_nvmem_read, .type =NVMEM_TYPE_OTP , .read_only = true,
include/linux/nvmem-provider.h +2 -0
@@ -82,6 +82,7 @@ struct nvmem_cell_info {* @owner: Pointer to exporter module. Used for refcounting. * @cells: Optional array of pre-defined NVMEM cells. * @ncells: Number of elements in cells. +* @add_legacy_fixed_of_cells: Read fixed NVMEM cells from old OF syntax. * @keepout: Optional array of keepout ranges (sorted ascending by start). * @nkeepout: Number of elements in the keepout array. * @type: Type of the nvmem storage
@@ -112,6 +113,7 @@ struct nvmem_config {struct module *owner;const struct nvmem_cell_info *cells;int ncells; +bool add_legacy_fixed_of_cells;const struct nvmem_keepout *keepout;unsigned int nkeepout;enum nvmem_type type;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/301 mtd: limit OTP NVMEM cell parse to non-NAND devices
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Marangi <[email protected]>
[ Upstream commit d2d73a6dd17365c43e109263841f7c26da55cfb0 ]
MTD OTP logic is very fragile on parsing NVMEM cell and can be problematic with some specific kind of devices.
The problem was discovered by e87161321a40 ("mtd: rawnand: macronix:
OTP access for MX30LFxG18AC") where OTP support was added to a NAND device. With the case of NAND devices, it does require a node where ECC info are declared and all the fixed partitions, and this cause the OTP codepath to parse this node as OTP NVMEM cells, making probe fail and the NAND device registration fail.
MTD OTP parsing should have been limited to always using compatible to prevent this error by using node with compatible "otp-user" or "otp-factory".
NVMEM across the years had various iteration on how cells could be declared in DT, in some old implementation, no_of_node should have been enabled but now add_legacy_fixed_of_cells should be used to disable NVMEM to parse child node as NVMEM cell.
To fix this and limit any regression with other MTD that makes use of declaring OTP as direct child of the dev node, disable add_legacy_fixed_of_cells if we detect the MTD type is Nand.
With the following logic, the OTP NVMEM entry is correctly created with no cells and the MTD Nand is correctly probed and partitions are correctly exposed.
--- drivers/mtd/mtdcore.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/mtdcore.c +1 -1
@@ -899,7 +899,7 @@ static struct nvmem_device *mtd_otp_nvmem_register(struct mtd_info *mtd, config.name = compatible; config.id =NVMEM_DEVID_AUTO ; config.owner =THIS_MODULE ; - config.add_legacy_fixed_of_cells = true; + config.add_legacy_fixed_of_cells = !mtd_type_is_nand (mtd); config.type =NVMEM_TYPE_OTP ; config.root_only = true; config.ignore_wp = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/301 rust: module: place generated init_module() function in .init.text
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Bertschinger <[email protected]>
[ Upstream commit 1b6170ff7a203a5e8354f19b7839fe8b897a9c0d ]
Currently Rust kernel modules have their init code placed in the .text section of the .ko file. I don't think this causes any real problems for Rust modules as long as all code called during initialization lives in .text.
However, if a Rust init_module() function (that lives in .text) calls a function marked with __init (in C) or #[link_section = ".init.text"] (in Rust), then a warning is generated by modpost because that function lives in .init.text. For example:
WARNING: modpost: fs/bcachefs/bcachefs: section mismatch in reference: init_module+0x6 (section: .text) -> _RNvXCsj7d3tFpT5JS_15bcachefs_moduleNtB2_8BcachefsNtCsjDtqRIL3JAG_6kernel6Module4init (section: .init.text)
I ran into this while experimenting with converting the bcachefs kernel module from C to Rust. The module's init(), written in Rust, calls C functions like bch2_vfs_init() which are placed in .init.text.
This patch places the macro-generated init_module() Rust function in the .init.text section. It also marks init_module() as unsafe--now it may not be called after module initialization completes because it may be freed already.
Note that this is not enough on its own to actually get all the module initialization code in that section. The module author must still add the #[link_section = ".init.text"] attribute to the Rust init() in the impl kernel::Module block in order to then call __init functions. However, this patch enables module authors do so, when previously it would not be possible (without warnings).
Stable-dep-of: 7044dcff8301 ("rust: macros: fix soundness issue in module! macro")
--- rust/macros/module.rs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
rust/macros/module.rs +6 -1
@@ -222,10 +222,15 @@ pub(crate) fn module(ts: TokenStream) -> TokenStream { }};// Loadable modules need to export the `{{init,cleanup}}_module` identifiers. +/// # Safety +/// +/// This function must not be called after module initialization, because it may be +/// freed after that completes. #[cfg( MODULE )] #[doc(hidden)] #[no_mangle] - pub extern \"C\" fn init_module() -> core::ffi::c_int {{ + #[link_section = \".init.text\"] + pub unsafe extern \"C\" fn init_module() -> core::ffi::c_int {{ __init() }}
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/301 rust: macros: fix soundness issue in `module!` macro
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benno Lossin <[email protected]>
[ Upstream commit 7044dcff8301b29269016ebd17df27c4736140d2 ]
The module! macro creates glue code that are called by C to initialize the Rust modules using the Module::init function. Part of this glue code are the local functions __init and __exit that are used to initialize/destroy the Rust module.
These functions are safe and also visible to the Rust mod in which the module! macro is invoked. This means that they can be called by other safe Rust code. But since they contain unsafe blocks that rely on only being called at the right time, this is a soundness issue.
Wrap these generated functions inside of two private modules, this guarantees that the public functions cannot be called from the outside. Make the safe functions unsafe and add SAFETY comments.
[ Moved THIS_MODULE out of the private-in-private modules since it
should remain public, as Dirk Behme noticed [1]. Capitalized comments, avoided newline in non-list SAFETY comments and reworded to add Reported-by and newline. ]
--- rust/macros/module.rs | 190 +++++++++++++++++++++++++----------------- 1 file changed, 115 insertions(+), 75 deletions(-)
rust/macros/module.rs +115 -75
@@ -199,17 +199,6 @@ pub(crate) fn module(ts: TokenStream) -> TokenStream {/// Used by the printing macros, e.g. [`info!`]. const __LOG_PREFIX: &[u8] = b\"{name}\\0\"; -/// The \"Rust loadable module\" mark. -// -// This may be best done another way later on, e.g. as a new modinfo -// key or a new section. For the moment, keep it simple. -#[cfg( MODULE )] -#[doc(hidden)] -#[used] -static __IS_RUST_MODULE: () = (); - -static mut __MOD:Option <{type_}> =None ; -// SAFETY: `__this_module` is constructed by the kernel at load time and will not be // freed until the module is unloaded. #[cfg( MODULE )]
@@ -221,81 +210,132 @@ pub(crate) fn module(ts: TokenStream) -> TokenStream { kernel::ThisModule ::from_ptr (core::ptr::null_mut ()) }}; -// Loadable modules need to export the `{{init,cleanup}}_module` identifiers. -/// # Safety -/// -/// This function must not be called after module initialization, because it may be -/// freed after that completes. -#[cfg( MODULE )] -#[doc(hidden)] -#[no_mangle] - #[link_section = \".init.text\"] - pub unsafe extern \"C\" fn init_module() -> core::ffi::c_int {{ - __init() - }} - - #[cfg(MODULE)] - #[doc(hidden)] - #[no_mangle] - pub extern \"C\" fn cleanup_module() {{ - __exit() - }} +// Double nested modules, since then nobody can access the public items inside. + mod __module_init {{ + mod __module_init {{ +use super ::super ::{type_}; + +/// The \"Rust loadable module\" mark. +// +// This may be best done another way later on, e.g. as a new modinfo +// key or a new section. For the moment, keep it simple. +#[cfg( MODULE )] +#[doc(hidden)] +#[used] +static __IS_RUST_MODULE: () = (); + +static mut __MOD:Option <{type_}> =None ; + +// Loadable modules need to export the `{{init,cleanup}}_module` identifiers. +/// # Safety +/// +/// This function must not be called after module initialization, because it may be +/// freed after that completes. +#[cfg( MODULE )] +#[doc(hidden)] +#[no_mangle] + #[link_section = \".init.text\"] + pub unsafe extern \"C\" fn init_module() -> core::ffi::c_int {{ + // SAFETY: This function is inaccessible to the outside due to the double + // module wrapping it. It is called exactly once by the C side via its + // unique name. + unsafe {{ __init() }} + }} - // Built-in modules are initialized through an initcall pointer - // and the identifiers need to be unique. - #[cfg(not(MODULE))] - #[cfg(not(CONFIG_HAVE_ARCH_PREL32_RELOCATIONS))] - #[doc(hidden)] - #[link_section = \"{initcall_section}\"] - #[used] - pub static __{name}_initcall: extern \"C\" fn() -> core::ffi::c_int = __{name}_init; + #[cfg(MODULE)] + #[doc(hidden)] + #[no_mangle] + pub extern \"C\" fn cleanup_module() {{ + // SAFETY: + // - This function is inaccessible to the outside due to the double + // module wrapping it. It is called exactly once by the C side via its + // unique name, + // - furthermore it is only called after `init_module` has returned `0` + // (which delegates to `__init`). + unsafe {{ __exit() }} + }} - #[cfg(not(MODULE))] - #[cfg(CONFIG_HAVE_ARCH_PREL32_RELOCATIONS)] - core::arch::global_asm!( - r#\".section \"{initcall_section}\", \"a\" - __{name}_initcall: - .long __{name}_init - . - .previous - \"# - ); + // Built-in modules are initialized through an initcall pointer + // and the identifiers need to be unique. + #[cfg(not(MODULE))] + #[cfg(not(CONFIG_HAVE_ARCH_PREL32_RELOCATIONS))] + #[doc(hidden)] + #[link_section = \"{initcall_section}\"] + #[used] + pub static __{name}_initcall: extern \"C\" fn() -> core::ffi::c_int = __{name}_init; + + #[cfg(not(MODULE))] + #[cfg(CONFIG_HAVE_ARCH_PREL32_RELOCATIONS)] + core::arch::global_asm!( + r#\".section \"{initcall_section}\", \"a\" + __{name}_initcall: + .long __{name}_init - . + .previous + \"# + ); + + #[cfg(not(MODULE))] + #[doc(hidden)] + #[no_mangle] + pub extern \"C\" fn __{name}_init() -> core::ffi::c_int {{ + // SAFETY: This function is inaccessible to the outside due to the double + // module wrapping it. It is called exactly once by the C side via its + // placement above in the initcall section. + unsafe {{ __init() }} + }} - #[cfg(not(MODULE))] - #[doc(hidden)] - #[no_mangle] - pub extern \"C\" fn __{name}_init() -> core::ffi::c_int {{ - __init() - }} + #[cfg(not(MODULE))] + #[doc(hidden)] + #[no_mangle] + pub extern \"C\" fn __{name}_exit() {{ + // SAFETY: + // - This function is inaccessible to the outside due to the double + // module wrapping it. It is called exactly once by the C side via its + // unique name, + // - furthermore it is only called after `__{name}_init` has returned `0` + // (which delegates to `__init`). + unsafe {{ __exit() }} + }} - #[cfg(not(MODULE))] - #[doc(hidden)] - #[no_mangle] - pub extern \"C\" fn __{name}_exit() {{ - __exit() - }} + /// # Safety + /// + /// This function must only be called once. + unsafe fn __init() -> core::ffi::c_int {{ + match <{type_} as kernel::Module>::init(&super::super::THIS_MODULE) {{ + Ok(m) => {{ + // SAFETY: No data race, since `__MOD` can only be accessed by this + // module and there only `__init` and `__exit` access it. These + // functions are only called once and `__exit` cannot be called + // before or during `__init`. + unsafe {{ + __MOD = Some(m); + }} + return 0; + }} + Err(e) => {{ + return e.to_errno(); + }} + }} + }} - fn __init() -> core::ffi::c_int {{ - match <{type_} as kernel::Module>::init(&THIS_MODULE) {{ - Ok(m) => {{ + /// # Safety + /// + /// This function must + /// - only be called once, + /// - be called after `__init` has been called and returned `0`. + unsafe fn __exit() {{ + // SAFETY: No data race, since `__MOD` can only be accessed by this module + // and there only `__init` and `__exit` access it. These functions are only + // called once and `__init` was already called. unsafe {{ - __MOD = Some(m); + // Invokes `drop()` on `__MOD`, which should be used for cleanup. + __MOD = None; }} - return 0; - }} - Err(e) => {{ - return e.to_errno(); }} - }} - }} - fn __exit() {{ - unsafe {{ - // Invokes `drop()` on `__MOD`, which should be used for cleanup. - __MOD = None; + {modinfo} }} }} - - {modinfo} ", type_ = info.type_, name = info.name,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/301 wifi: nl80211: dont free NULL coalescing rule
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 801ea33ae82d6a9d954074fbcf8ea9d18f1543a7 ]
If the parsing fails, we can dereference a NULL pointer here.
--- net/wireless/nl80211.c | 2 ++ 1 file changed, 2 insertions(+)
net/wireless/nl80211.c +2 -0
@@ -14052,6 +14052,8 @@ static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info) error:for (i =0 ; i < new_coalesce.n_rules; i++) { tmp_rule = &new_coalesce.rules[i]; +if (!tmp_rule) +continue ;for (j =0 ; j < tmp_rule->n_patterns; j++)kfree (tmp_rule->patterns[j].mask);kfree (tmp_rule->patterns);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/301 rust: kernel: require `Send` for `Module` implementations
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wedson Almeida Filho <[email protected]>
[ Upstream commit 323617f649c0966ad5e741e47e27e06d3a680d8f ]
The thread that calls the module initialisation code when a module is loaded is not guaranteed [in fact, it is unlikely] to be the same one that calls the module cleanup code on module unload, therefore, Module implementations must be Send to account for them moving from one thread to another implicitly.
--- rust/kernel/lib.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
rust/kernel/lib.rs +1 -1
@@ -60,7 +60,7 @@/// The top level entrypoint to implementing a kernel module. /// /// For any teardown or cleanup operations, your type may implement [`Drop`]. -pub trait Module :Sized +Sync { +pub trait Module :Sized +Sync +Send {/// Called at module initialization time. /// /// Use this method to perform whatever setup or registration your module
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/301 eeprom: at24: Probe for DDR3 thermal sensor in the SPD case
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
[ Upstream commit caba40ec3531b0849f44502a03117796e8c9f4a1 ]
The DDR3 SPD data structure advertises the presence of a thermal sensor on a DDR3 module in byte 32, bit 7. Let's use this information to explicitly instantiate the thermal sensor I2C client instead of having to rely on class-based I2C probing.
The temp sensor i2c address can be derived from the SPD i2c address, so we can directly instantiate the device and don't have to probe for it. If the temp sensor has been instantiated already by other means (e.g. class-based auto-detection), then the busy-check in i2c_new_client_device will detect this.
Note: Thermal sensors on DDR4 DIMM's are instantiated from the
ee1004 driver.
Stable-dep-of: f42c97027fb7 ("eeprom: at24: fix memory corruption race condition")
--- drivers/misc/eeprom/at24.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+)
drivers/misc/eeprom/at24.c +29 -0
@@ -581,6 +581,31 @@ static unsigned int at24_get_offset_adj(u8 flags, unsigned int byte_len) } } +static void at24_probe_temp_sensor (struct i2c_client *client) +{ +struct at24_data *at24 =i2c_get_clientdata (client); +struct i2c_board_info info = { .type ="jc42" }; +int ret; +u8 val; + +/* +* Byte 2 has value 11 for DDR3, earlier versions don't +* support the thermal sensor present flag +*/ + ret =at24_read (at24,2 , &val,1 ); +if (ret || val !=11 ) +return ; + +/* Byte 32, bit 7 is set if temp sensor is present */ + ret =at24_read (at24,32 , &val,1 ); +if (ret || !(val &BIT (7 ))) +return ; + + info.addr =0x18 | (client->addr &7 ); + +i2c_new_client_device (client->adapter, &info); +} +static int at24_probe (struct i2c_client *client) {struct regmap_config regmap_config = { };
@@ -780,6 +805,10 @@ static int at24_probe(struct i2c_client *client) } } +/* If this a SPD EEPROM, probe for DDR3 thermal sensor */ +if (cdata == &at24_data_spd) +at24_probe_temp_sensor (client); +pm_runtime_idle (dev);if (writable)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/301 eeprom: at24: fix memory corruption race condition
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Okazaki <[email protected]>
[ Upstream commit f42c97027fb75776e2e9358d16bf4a99aeb04cf2 ]
If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory.
Move the failure point before registering the nvmem device.
--- drivers/misc/eeprom/at24.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/misc/eeprom/at24.c +9 -9
@@ -781,15 +781,6 @@ static int at24_probe(struct i2c_client *client) }pm_runtime_enable (dev); - at24->nvmem =devm_nvmem_register (dev, &nvmem_config); -if (IS_ERR (at24->nvmem)) { -pm_runtime_disable (dev); -if (!pm_runtime_status_suspended (dev)) -regulator_disable (at24->vcc_reg); -return dev_err_probe (dev,PTR_ERR (at24->nvmem), -"failed to register nvmem\n" ); - } -/* * Perform a one-byte test read to verify that the chip is functional, * unless powering on the device is to be avoided during probe (i.e.
@@ -805,6 +796,15 @@ static int at24_probe(struct i2c_client *client) } } + at24->nvmem =devm_nvmem_register (dev, &nvmem_config); +if (IS_ERR (at24->nvmem)) { +pm_runtime_disable (dev); +if (!pm_runtime_status_suspended (dev)) +regulator_disable (at24->vcc_reg); +return dev_err_probe (dev,PTR_ERR (at24->nvmem), +"failed to register nvmem\n" ); + } +/* If this a SPD EEPROM, probe for DDR3 thermal sensor */ if (cdata == &at24_data_spd)at24_probe_temp_sensor (client);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/301 Bluetooth: qca: add support for QCA2066
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Jiang <[email protected]>
[ Upstream commit a7f8dedb4be2cc930a29af24427b885405ecd15d ]
This patch adds support for QCA2066 firmware patch and NVM downloading. as the RF performance of QCA2066 SOC chip from different foundries may vary. Therefore we use different NVM to configure them based on board ID.
Changes in v2
- optimize the function qca_generate_hsp_nvm_name
- remove redundant debug code for function qca_read_fw_board_id
Stable-dep-of: 32868e126c78 ("Bluetooth: qca: fix invalid device address check")
--- drivers/bluetooth/btqca.c | 68 +++++++++++++++++++++++++++++++++++++ drivers/bluetooth/btqca.h | 5 ++- drivers/bluetooth/hci_qca.c | 11 ++++++ 3 files changed, 83 insertions(+), 1 deletion(-)
drivers/bluetooth/btqca.c +68 -0
@@ -205,6 +205,44 @@ static int qca_send_reset(struct hci_dev *hdev)return 0 ; } +static int qca_read_fw_board_id (struct hci_dev *hdev,u16 *bid) +{ +u8 cmd; +struct sk_buff *skb; +struct edl_event_hdr *edl; +int err =0 ; + + cmd =EDL_GET_BID_REQ_CMD ; + skb =__hci_cmd_sync_ev (hdev,EDL_PATCH_CMD_OPCODE ,EDL_PATCH_CMD_LEN , + &cmd,0 ,HCI_INIT_TIMEOUT ); +if (IS_ERR (skb)) { + err =PTR_ERR (skb); +bt_dev_err (hdev,"Reading QCA board ID failed (%d)" , err); +return err; + } + + edl =skb_pull_data (skb,sizeof (*edl)); +if (!edl) { +bt_dev_err (hdev,"QCA read board ID with no header" ); + err = -EILSEQ ; + goto out; + } + +if (edl->cresp !=EDL_CMD_REQ_RES_EVT || + edl->rtype !=EDL_GET_BID_REQ_CMD ) { +bt_dev_err (hdev,"QCA Wrong packet: %d %d" , edl->cresp, edl->rtype); + err = -EIO ; + goto out; + } + + *bid = (edl->data[1 ] <<8 ) + edl->data[2 ]; +bt_dev_dbg (hdev,"%s: bid = %x" , __func__, *bid); + +out: +kfree_skb (skb); +return err; +} +int qca_send_pre_shutdown_cmd (struct hci_dev *hdev) {struct sk_buff *skb;
@@ -574,6 +612,23 @@ int qca_set_bdaddr_rome(struct hci_dev *hdev, const bdaddr_t *bdaddr) }EXPORT_SYMBOL_GPL (qca_set_bdaddr_rome); +static void qca_generate_hsp_nvm_name (char *fwname,size_t max_size, +struct qca_btsoc_version ver,u8 rom_ver,u16 bid) +{ +const char *variant; + +/* hsp gf chip */ +if ((le32_to_cpu (ver.soc_id) &QCA_HSP_GF_SOC_MASK ) ==QCA_HSP_GF_SOC_ID ) + variant ="g" ; +else + variant ="" ; + +if (bid ==0x0 ) +snprintf (fwname, max_size,"qca/hpnv%02x%s.bin" , rom_ver, variant); +else +snprintf (fwname, max_size,"qca/hpnv%02x%s.%x" , rom_ver, variant, bid); +} +int qca_uart_setup (struct hci_dev *hdev,uint8_t baudrate,enum qca_btsoc_type soc_type,struct qca_btsoc_version ver,const char *firmware_name)
@@ -582,6 +637,7 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,int err;u8 rom_ver =0 ;u32 soc_ver; +u16 boardid =0 ;bt_dev_dbg (hdev,"QCA setup on UART" );
@@ -615,6 +671,10 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,snprintf (config.fwname,sizeof (config.fwname),"qca/apbtfw%02x.tlv" , rom_ver);break ; +case QCA_QCA2066 : +snprintf (config.fwname,sizeof (config.fwname), +"qca/hpbtfw%02x.tlv" , rom_ver); +break ;case QCA_QCA6390 :snprintf (config.fwname,sizeof (config.fwname),"qca/htbtfw%02x.tlv" , rom_ver);
@@ -649,6 +709,9 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,/* Give the controller some time to get ready to receive the NVM */ msleep (10 ); +if (soc_type ==QCA_QCA2066 ) +qca_read_fw_board_id (hdev, &boardid); +/* Download NVM configuration */ config.type =TLV_TYPE_NVM ;if (firmware_name) {
@@ -671,6 +734,10 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,snprintf (config.fwname,sizeof (config.fwname),"qca/apnv%02x.bin" , rom_ver);break ; +case QCA_QCA2066 : +qca_generate_hsp_nvm_name (config.fwname, +sizeof (config.fwname), ver, rom_ver, boardid); +break ;case QCA_QCA6390 :snprintf (config.fwname,sizeof (config.fwname),"qca/htnv%02x.bin" , rom_ver);
@@ -702,6 +769,7 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,switch (soc_type) {case QCA_WCN3991 : +case QCA_QCA2066 :case QCA_QCA6390 :case QCA_WCN6750 :case QCA_WCN6855 :
drivers/bluetooth/btqca.h +4 -1
@@ -12,6 +12,7 @@#define EDL_PATCH_VER_REQ_CMD (0x19)#define EDL_PATCH_TLV_REQ_CMD (0x1E)#define EDL_GET_BUILD_INFO_CMD (0x20) +#define EDL_GET_BID_REQ_CMD (0x23)#define EDL_NVM_ACCESS_SET_REQ_CMD (0x01)#define EDL_PATCH_CONFIG_CMD (0x28)#define MAX_SIZE_PER_TLV_SEGMENT (243)
@@ -47,7 +48,8 @@ ((le32_to_cpu(soc_id) << 16) | (le16_to_cpu(rom_ver)))#define QCA_FW_BUILD_VER_LEN 255 - +#define QCA_HSP_GF_SOC_ID 0x1200 +#define QCA_HSP_GF_SOC_MASK 0x0000ff00enum qca_baudrate {QCA_BAUDRATE_115200 =0 ,
@@ -146,6 +148,7 @@ enum qca_btsoc_type {QCA_WCN3990 ,QCA_WCN3998 ,QCA_WCN3991 , +QCA_QCA2066 ,QCA_QCA6390 ,QCA_WCN6750 , QCA_WCN6855,
drivers/bluetooth/hci_qca.c +11 -0
@@ -1845,6 +1845,10 @@ static int qca_setup(struct hci_uart *hu)set_bit (HCI_QUIRK_SIMULTANEOUS_DISCOVERY , &hdev->quirks);switch (soc_type) { +case QCA_QCA2066 : + soc_name ="qca2066" ; +break ; +case QCA_WCN3988 :case QCA_WCN3990 :case QCA_WCN3991 :
@@ -2043,6 +2047,11 @@ static const struct qca_device_data qca_soc_data_wcn3998 __maybe_unused = { .num_vregs = 4, }; +static const struct qca_device_data qca_soc_data_qca2066__maybe_unused = { + .soc_type =QCA_QCA2066 , + .num_vregs =0 , +}; +static const struct qca_device_data qca_soc_data_qca6390__maybe_unused = { .soc_type =QCA_QCA6390 , .num_vregs =0 ,
@@ -2582,6 +2591,7 @@ static SIMPLE_DEV_PM_OPS(qca_pm_ops, qca_suspend, qca_resume);#ifdef CONFIG_OF static const struct of_device_id qca_bluetooth_of_match[] = { + { .compatible ="qcom,qca2066-bt" , .data = &qca_soc_data_qca2066}, { .compatible ="qcom,qca6174-bt" }, { .compatible ="qcom,qca6390-bt" , .data = &qca_soc_data_qca6390}, { .compatible = "qcom,qca9377-bt" },
@@ -2599,6 +2609,7 @@ MODULE_DEVICE_TABLE(of, qca_bluetooth_of_match);#ifdef CONFIG_ACPI static const struct acpi_device_id qca_bluetooth_acpi_match[] = { + {"QCOM2066" , (kernel_ulong_t)&qca_soc_data_qca2066 }, {"QCOM6390" , (kernel_ulong_t)&qca_soc_data_qca6390 }, {"DLA16390" , (kernel_ulong_t)&qca_soc_data_qca6390 }, { "DLB16390", (kernel_ulong_t)&qca_soc_data_qca6390 },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/301 pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Billy Tsai <[email protected]>
[ Upstream commit c10cd03d69403fa0f00be8631bd4cb4690440ebd ]
The register offset to disable the internal pull-down of GPIOR~T is 0x630 instead of 0x620, as specified in the Ast2600 datasheet v15 The datasheet can download from the official Aspeed website.
Message-ID: <[email protected]>
--- drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c | 34 +++++++++++----------- 1 file changed, 17 insertions(+), 17 deletions(-)
drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c +17 -17
@@ -43,7 +43,7 @@#define SCU614 0x614/* Disable GPIO Internal Pull-Down #1 */ #define SCU618 0x618/* Disable GPIO Internal Pull-Down #2 */ #define SCU61C 0x61c/* Disable GPIO Internal Pull-Down #3 */ -#define SCU620 0x620/* Disable GPIO Internal Pull-Down #4 */ +#define SCU630 0x630/* Disable GPIO Internal Pull-Down #4 */ #define SCU634 0x634/* Disable GPIO Internal Pull-Down #5 */ #define SCU638 0x638/* Disable GPIO Internal Pull-Down #6 */ #define SCU690 0x690/* Multi-function Pin Control #24 */
@@ -2494,38 +2494,38 @@ static struct aspeed_pin_config aspeed_g6_configs[] = {ASPEED_PULL_DOWN_PINCONF (D14 ,SCU61C ,0 ),/* GPIOS7 */ -ASPEED_PULL_DOWN_PINCONF (T24 ,SCU620 ,23 ), +ASPEED_PULL_DOWN_PINCONF (T24 ,SCU630 ,23 ),/* GPIOS6 */ -ASPEED_PULL_DOWN_PINCONF (P23 ,SCU620 ,22 ), +ASPEED_PULL_DOWN_PINCONF (P23 ,SCU630 ,22 ),/* GPIOS5 */ -ASPEED_PULL_DOWN_PINCONF (P24 ,SCU620 ,21 ), +ASPEED_PULL_DOWN_PINCONF (P24 ,SCU630 ,21 ),/* GPIOS4 */ -ASPEED_PULL_DOWN_PINCONF (R26 ,SCU620 ,20 ), +ASPEED_PULL_DOWN_PINCONF (R26 ,SCU630 ,20 ),/* GPIOS3*/ -ASPEED_PULL_DOWN_PINCONF (R24 ,SCU620 ,19 ), +ASPEED_PULL_DOWN_PINCONF (R24 ,SCU630 ,19 ),/* GPIOS2 */ -ASPEED_PULL_DOWN_PINCONF (T26 ,SCU620 ,18 ), +ASPEED_PULL_DOWN_PINCONF (T26 ,SCU630 ,18 ),/* GPIOS1 */ -ASPEED_PULL_DOWN_PINCONF (T25 ,SCU620 ,17 ), +ASPEED_PULL_DOWN_PINCONF (T25 ,SCU630 ,17 ),/* GPIOS0 */ -ASPEED_PULL_DOWN_PINCONF (R23 ,SCU620 ,16 ), +ASPEED_PULL_DOWN_PINCONF (R23 ,SCU630 ,16 ),/* GPIOR7 */ -ASPEED_PULL_DOWN_PINCONF (U26 ,SCU620 ,15 ), +ASPEED_PULL_DOWN_PINCONF (U26 ,SCU630 ,15 ),/* GPIOR6 */ -ASPEED_PULL_DOWN_PINCONF (W26 ,SCU620 ,14 ), +ASPEED_PULL_DOWN_PINCONF (W26 ,SCU630 ,14 ),/* GPIOR5 */ -ASPEED_PULL_DOWN_PINCONF (T23 ,SCU620 ,13 ), +ASPEED_PULL_DOWN_PINCONF (T23 ,SCU630 ,13 ),/* GPIOR4 */ -ASPEED_PULL_DOWN_PINCONF (U25 ,SCU620 ,12 ), +ASPEED_PULL_DOWN_PINCONF (U25 ,SCU630 ,12 ),/* GPIOR3*/ -ASPEED_PULL_DOWN_PINCONF (V26 ,SCU620 ,11 ), +ASPEED_PULL_DOWN_PINCONF (V26 ,SCU630 ,11 ),/* GPIOR2 */ -ASPEED_PULL_DOWN_PINCONF (V24 ,SCU620 ,10 ), +ASPEED_PULL_DOWN_PINCONF (V24 ,SCU630 ,10 ),/* GPIOR1 */ -ASPEED_PULL_DOWN_PINCONF (U24 ,SCU620 ,9 ), +ASPEED_PULL_DOWN_PINCONF (U24 ,SCU630 ,9 ),/* GPIOR0 */ -ASPEED_PULL_DOWN_PINCONF (V25 ,SCU620 ,8 ), +ASPEED_PULL_DOWN_PINCONF (V25 ,SCU630 ,8 ),/* GPIOX7 */ ASPEED_PULL_DOWN_PINCONF(AB10, SCU634, 31),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/301 pinctrl/meson: fix typo in PDMs pin name
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Dakinevich <[email protected]>
[ Upstream commit 368a90e651faeeb7049a876599cf2b0d74954796 ]
Other pins have _a or _x suffix, but this one doesn't have any. Most likely this is a typo.
Message-ID: <[email protected]>
--- drivers/pinctrl/meson/pinctrl-meson-a1.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/pinctrl/meson/pinctrl-meson-a1.c +3 -3
@@ -250,7 +250,7 @@ static const unsigned int pdm_dclk_x_pins[] = { GPIOX_10 };static const unsigned int pdm_din2_a_pins[] = {GPIOA_6 };static const unsigned int pdm_din1_a_pins[] = {GPIOA_7 };static const unsigned int pdm_din0_a_pins[] = {GPIOA_8 }; -static const unsigned int pdm_dclk_pins[] = {GPIOA_9 }; +static const unsigned int pdm_dclk_a_pins[] = {GPIOA_9 };/* gen_clk */ static const unsigned int gen_clk_x_pins[] = {GPIOX_7 };
@@ -591,7 +591,7 @@ static struct meson_pmx_group meson_a1_periphs_groups[] = {GROUP (pdm_din2_a,3 ),GROUP (pdm_din1_a,3 ),GROUP (pdm_din0_a,3 ), -GROUP (pdm_dclk,3 ), +GROUP (pdm_dclk_a,3 ),GROUP (pwm_c_a,3 ), GROUP(pwm_b_a, 3),
@@ -755,7 +755,7 @@ static const char * const spi_a_groups[] = {static const char *const pdm_groups[] = {"pdm_din0_x" ,"pdm_din1_x" ,"pdm_din2_x" ,"pdm_dclk_x" ,"pdm_din2_a" , -"pdm_din1_a" ,"pdm_din0_a" ,"pdm_dclk" , +"pdm_din1_a" ,"pdm_din0_a" ,"pdm_dclk_a" , };static const char *const gen_clk_groups[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/301 pinctrl: core: delete incorrect free in pinctrl_enable()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 5038a66dad0199de60e5671603ea6623eb9e5c79 ]
The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free.
The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well.
Message-ID: <[email protected]>
--- drivers/pinctrl/core.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/pinctrl/core.c +1 -7
@@ -2116,13 +2116,7 @@ int pinctrl_enable(struct pinctrl_dev *pctldev) error =pinctrl_claim_hogs (pctldev);if (error) { -dev_err (pctldev->dev,"could not claim hogs: %i\n" , - error); -pinctrl_free_pindescs (pctldev, pctldev->desc->pins, - pctldev->desc->npins); -mutex_destroy (&pctldev->mutex); -kfree (pctldev); - +dev_err (pctldev->dev,"could not claim hogs: %i\n" , error);return error; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/301 pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 08f66a8edd08f6f7cfa769c81634b29a2b123908 ]
In the generic pin config library, readback of some options are handled differently compared to the setting of those options: the argument value is used to convey enable/disable of an option in the set path, but success or -EINVAL is used to convey if an option is enabled or disabled in the debugfs readback path.
PIN_CONFIG_INPUT_SCHMITT_ENABLE is one such option. Fix the readback of the option in the mediatek-paris library, so that the debugfs dump is not showing "input schmitt enabled" for pins that don't have it enabled.
Message-ID: <[email protected]>
--- drivers/pinctrl/mediatek/pinctrl-paris.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pinctrl/mediatek/pinctrl-paris.c +2 -0
@@ -193,6 +193,8 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev, } err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_SMT , &ret); +if (!ret) + err = -EINVAL ;break ;case PIN_CONFIG_DRIVE_STRENGTH :if (!hw->soc->drive_get)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/301 pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit c5d3b64c568a344e998830e0e94a7c04e372f89b ]
There is a misinterpretation of some of the PIN_CONFIG_* options in this driver library. PIN_CONFIG_OUTPUT_ENABLE should refer to a buffer or switch in the output direction of the electrical path. The MediaTek hardware does not have such a thing. The driver incorrectly maps this option to the GPIO function's direction.
Likewise, PIN_CONFIG_INPUT_ENABLE should refer to a buffer or switch in the input direction. The hardware does have such a mechanism, and is mapped to the IES bit. The driver however sets the direction in addition to the IES bit, which is incorrect. On readback, the IES bit isn't even considered.
Ironically, the driver does not support readback for PIN_CONFIG_OUTPUT, while its readback of PIN_CONFIG_{INPUT,OUTPUT}_ENABLE is what it should be doing for PIN_CONFIG_OUTPUT.
Rework support for these three options, so that PIN_CONFIG_OUTPUT_ENABLE is completely removed, PIN_CONFIG_INPUT_ENABLE is only linked to the IES bit, and PIN_CONFIG_OUTPUT is linked to the GPIO function's direction and output level.
Message-ID: <[email protected]>
--- drivers/pinctrl/mediatek/pinctrl-paris.c | 38 +++++++----------------- 1 file changed, 11 insertions(+), 27 deletions(-)
drivers/pinctrl/mediatek/pinctrl-paris.c +11 -27
@@ -165,20 +165,21 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev, err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_SR , &ret);break ;case PIN_CONFIG_INPUT_ENABLE : -case PIN_CONFIG_OUTPUT_ENABLE : + err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_IES , &ret); +if (!ret) + err = -EINVAL ; +break ; +case PIN_CONFIG_OUTPUT : err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_DIR , &ret);if (err)break ; -/* CONFIG Current direction return value -* ------------- ----------------- ---------------------- -* OUTPUT_ENABLE output 1 (= HW value) -* input 0 (= HW value) -* INPUT_ENABLE output 0 (= reverse HW value) -* input 1 (= reverse HW value) -*/ -if (param ==PIN_CONFIG_INPUT_ENABLE ) - ret = !ret; +if (!ret) { + err = -EINVAL ; +break ; + } + + err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_DO , &ret);break ;case PIN_CONFIG_INPUT_SCHMITT_ENABLE : err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_DIR , &ret);
@@ -283,26 +284,9 @@ static int mtk_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin,break ; err = hw->soc->bias_set_combo (hw, desc,0 , arg);break ; -case PIN_CONFIG_OUTPUT_ENABLE : - err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_SMT , -MTK_DISABLE ); -/* Keep set direction to consider the case that a GPIO pin -* does not have SMT control -*/ -if (err != -ENOTSUPP ) -break ; - - err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_DIR , -MTK_OUTPUT ); -break ;case PIN_CONFIG_INPUT_ENABLE :/* regard all non-zero value as enable */ err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_IES , !!arg); -if (err) -break ; - - err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_DIR , -MTK_INPUT );break ;case PIN_CONFIG_SLEW_RATE :/* regard all non-zero value as enable */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/301 sunrpc: add a struct rpc_stats arg to rpc_create_args
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
[ Upstream commit 2057a48d0dd00c6a2a94ded7df2bf1d3f2a4a0da ]
We want to be able to have our rpc stats handled in a per network namespace manner, so add an option to rpc_create_args to specify a different rpc_stats struct instead of using the one on the rpc_program.
Stable-dep-of: 24457f1be29f ("nfs: Handle error of rpc_proc_register() in nfs_net_init().")
--- include/linux/sunrpc/clnt.h | 1 + net/sunrpc/clnt.c | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-)
include/linux/sunrpc/clnt.h +1 -0
@@ -139,6 +139,7 @@ struct rpc_create_args {const char *servername;const char *nodename;const struct rpc_program *program; +struct rpc_stat *stats;u32 prognumber;/* overrides program->number */ u32 version;rpc_authflavor_t authflavor;
net/sunrpc/clnt.c +4 -1
@@ -399,7 +399,7 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, clnt->cl_maxproc = version->nrprocs; clnt->cl_prog = args->prognumber ? : program->number; clnt->cl_vers = version->number; - clnt->cl_stats = program->stats; + clnt->cl_stats = args->stats ? : program->stats; clnt->cl_metrics =rpc_alloc_iostats (clnt);rpc_init_pipe_dir_head (&clnt->cl_pipedir_objects); err = -ENOMEM ;
@@ -685,6 +685,7 @@ struct rpc_clnt *rpc_clone_client(struct rpc_clnt *clnt) .version = clnt->cl_vers, .authflavor = clnt->cl_auth->au_flavor, .cred = clnt->cl_cred, + .stats = clnt->cl_stats, };return __rpc_clone_client (&args, clnt); }
@@ -707,6 +708,7 @@ rpc_clone_client_set_auth(struct rpc_clnt *clnt, rpc_authflavor_t flavor) .version = clnt->cl_vers, .authflavor = flavor, .cred = clnt->cl_cred, + .stats = clnt->cl_stats, };return __rpc_clone_client (&args, clnt); }
@@ -1053,6 +1055,7 @@ struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *old, .version = vers, .authflavor = old->cl_auth->au_flavor, .cred = old->cl_cred, + .stats = old->cl_stats, };struct rpc_clnt *clnt;int err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/301 nfs: expose /proc/net/sunrpc/nfs in net namespaces
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
[ Upstream commit d47151b79e3220e72ae323b8b8e9d6da20dc884e ]
We're using nfs mounts inside of containers in production and noticed that the nfs stats are not exposed in /proc. This is a problem for us as we use these stats for monitoring, and have to do this awkward bind mount from the main host into the container in order to get to these states.
Add the rpc_proc_register call to the pernet operations entry and exit points so these stats can be exposed inside of network namespaces.
Stable-dep-of: 24457f1be29f ("nfs: Handle error of rpc_proc_register() in nfs_net_init().")
--- fs/nfs/inode.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
fs/nfs/inode.c +2 -4
@@ -2427,11 +2427,13 @@ EXPORT_SYMBOL_GPL(nfs_net_id);static int nfs_net_init (struct net *net) {nfs_clients_init (net); +rpc_proc_register (net, &nfs_rpcstat);return nfs_fs_proc_net_init (net); }static void nfs_net_exit (struct net *net) { +rpc_proc_unregister (net,"nfs" );nfs_fs_proc_net_exit (net);nfs_clients_exit (net); }
@@ -2486,15 +2488,12 @@ static int __init init_nfs_fs(void)if (err) goto out1; -rpc_proc_register (&init_net, &nfs_rpcstat); - err =register_nfs_fs ();if (err) goto out0;return 0 ; out0: -rpc_proc_unregister (&init_net,"nfs" );nfs_destroy_directcache (); out1:nfs_destroy_writepagecache ();
@@ -2524,7 +2523,6 @@ static void __exit exit_nfs_fs(void)nfs_destroy_inodecache ();nfs_destroy_nfspagecache ();unregister_pernet_subsys (&nfs_net_ops); -rpc_proc_unregister (&init_net,"nfs" );unregister_nfs_fs ();nfs_fs_proc_exit ();nfsiod_stop ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/301 nfs: make the rpc_stat per net namespace
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
[ Upstream commit 1548036ef1204df65ca5a16e8b199c858cb80075 ]
Now that we're exposing the rpc stats on a per-network namespace basis, move this struct into struct nfs_net and use that to make sure only the per-network namespace stats are exposed.
Stable-dep-of: 24457f1be29f ("nfs: Handle error of rpc_proc_register() in nfs_net_init().")
--- fs/nfs/client.c | 5 ++++- fs/nfs/inode.c | 4 +++- fs/nfs/internal.h | 2 -- fs/nfs/netns.h | 2 ++ 4 files changed, 9 insertions(+), 4 deletions(-)
fs/nfs/client.c +4 -1
@@ -73,7 +73,6 @@ const struct rpc_program nfs_program = { .number = NFS_PROGRAM, .nrvers = ARRAY_SIZE(nfs_version), .version = nfs_version, - .stats = &nfs_rpcstat, .pipe_dir_name = NFS_PIPE_DIRNAME, };
@@ -502,6 +501,7 @@ int nfs_create_rpc_client(struct nfs_client *clp,const struct nfs_client_initdata *cl_init, rpc_authflavor_t flavor) { + struct nfs_net *nn = net_generic(clp->cl_net, nfs_net_id);struct rpc_clnt *clnt =NULL ; struct rpc_create_args args = { .net = clp->cl_net,
@@ -513,6 +513,7 @@ int nfs_create_rpc_client(struct nfs_client *clp, .servername = clp->cl_hostname, .nodename = cl_init->nodename, .program = &nfs_program, + .stats = &nn->rpcstats, .version = clp->rpc_ops->version, .authflavor = flavor, .cred = cl_init->cred,
@@ -1175,6 +1176,8 @@ void nfs_clients_init(struct net *net)#endif spin_lock_init (&nn->nfs_client_lock); nn->boot_time =ktime_get_real (); +memset (&nn->rpcstats,0 ,sizeof (nn->rpcstats)); + nn->rpcstats.program = &nfs_program;nfs_netns_sysfs_setup (nn, net); }
fs/nfs/inode.c +3 -1
@@ -2426,8 +2426,10 @@ EXPORT_SYMBOL_GPL(nfs_net_id);static int nfs_net_init (struct net *net) { +struct nfs_net *nn =net_generic (net, nfs_net_id); +nfs_clients_init (net); -rpc_proc_register (net, &nfs_rpcstat); +rpc_proc_register (net, &nn->rpcstats);return nfs_fs_proc_net_init (net); }
fs/nfs/internal.h +0 -2
@@ -449,8 +449,6 @@ int nfs_try_get_tree(struct fs_context *);int nfs_get_tree_common (struct fs_context *);void nfs_kill_super (struct super_block *); -extern struct rpc_stat nfs_rpcstat; -extern int __init register_nfs_fs (void ); extern void __exit unregister_nfs_fs(void);extern bool nfs_sb_active (struct super_block *sb);
fs/nfs/netns.h +2 -0
@@ -9,6 +9,7 @@#include <linux/nfs4.h> #include <net/net_namespace.h> #include <net/netns/generic.h> +#include <linux/sunrpc/stats.h> struct bl_dev_msg {int32_t status;
@@ -34,6 +35,7 @@ struct nfs_net {struct nfs_netns_client *nfs_client;spinlock_t nfs_client_lock;ktime_t boot_time; +struct rpc_stat rpcstats;#ifdef CONFIG_PROC_FS struct proc_dir_entry *proc_nfsfs;#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/301 nfs: Handle error of rpc_proc_register() in nfs_net_init().
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 24457f1be29f1e7042e50a7749f5c2dde8c433c8 ]
syzkaller reported a warning [0] triggered while destroying immature netns.
rpc_proc_register() was called in init_nfs_fs(), but its error has been ignored since at least the initial commit 1da177e4c3f4 ("Linux-2.6.12-rc2").
Recently, commit d47151b79e32 ("nfs: expose /proc/net/sunrpc/nfs in net namespaces") converted the procfs to per-netns and made the problem more visible.
Even when rpc_proc_register() fails, nfs_net_init() could succeed, and thus nfs_net_exit() will be called while destroying the netns.
Then, remove_proc_entry() will be called for non-existing proc directory and trigger the warning below.
Let's handle the error of rpc_proc_register() properly in nfs_net_init().
[0]:
name 'nfs'
WARNING: CPU: 1 PID: 1710 at fs/proc/generic.c:711 remove_proc_entry+0x1bb/0x2d0 fs/proc/generic.c:711 Modules linked in: CPU: 1 PID: 1710 Comm: syz-executor.2 Not tainted 6.8.0-12822-gcd51db110a7e #12 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:remove_proc_entry+0x1bb/0x2d0 fs/proc/generic.c:711 Code: 41 5d 41 5e c3 e8 85 09 b5 ff 48 c7 c7 88 58 64 86 e8 09 0e 71 02 e8 74 09 b5 ff 4c 89 e6 48 c7 c7 de 1b 80 84 e8 c5 ad 97 ff <0f> 0b eb b1 e8 5c 09 b5 ff 48 c7 c7 88 58 64 86 e8 e0 0d 71 02 eb RSP: 0018:ffffc9000c6d7ce0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8880422b8b00 RCX: ffffffff8110503c RDX: ffff888030652f00 RSI: ffffffff81105045 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: ffffffff81bb62cb R12: ffffffff84807ffc R13: ffff88804ad6fcc0 R14: ffffffff84807ffc R15: ffffffff85741ff8 FS: 00007f30cfba8640(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff51afe8000 CR3: 000000005a60a005 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> rpc_proc_unregister+0x64/0x70 net/sunrpc/stats.c:310 nfs_net_exit+0x1c/0x30 fs/nfs/inode.c:2438 ops_exit_list+0x62/0xb0 net/core/net_namespace.c:170 setup_net+0x46c/0x660 net/core/net_namespace.c:372 copy_net_ns+0x244/0x590 net/core/net_namespace.c:505 create_new_namespaces+0x2ed/0x770 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xae/0x160 kernel/nsproxy.c:228 ksys_unshare+0x342/0x760 kernel/fork.c:3322 __do_sys_unshare kernel/fork.c:3393 [inline] __se_sys_unshare kernel/fork.c:3391 [inline] __x64_sys_unshare+0x1f/0x30 kernel/fork.c:3391 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x4f/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x46/0x4e RIP: 0033:0x7f30d0febe5d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007f30cfba7cc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007f30d0febe5d RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c020600 RBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 R13: 000000000000000b R14: 00007f30d104c530 R15: 0000000000000000 </TASK>
--- fs/nfs/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/nfs/inode.c +6 -1
@@ -2429,7 +2429,12 @@ static int nfs_net_init(struct net *net)struct nfs_net *nn =net_generic (net, nfs_net_id);nfs_clients_init (net); -rpc_proc_register (net, &nn->rpcstats); + +if (!rpc_proc_register (net, &nn->rpcstats)) { +nfs_clients_exit (net); +return -ENOMEM ; + } +return nfs_fs_proc_net_init (net); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/301 pinctrl: baytrail: Fix selecting gpio pinctrl state
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit fed6d9a8e6a60ecf6506d0ea004040fbaa109927 ]
For all the "score" pin-groups all the intel_pingroup-s to select the non GPIO function are re-used for byt_score_gpio_groups[].
But this is incorrect since a pin-group includes the mode setting, which for the non GPIO functions generally is 1, where as to select the GPIO function mode must be set to 0.
So the GPIO function needs separate intel_pingroup-s with their own mode value of 0.
Add a new PIN_GROUP_GPIO macro which adds a foo_gpio entry to each pin-group defined this way and update byt_score_gpio_groups[] to point to the new foo_gpio entries.
The "sus" usb_oc_grp usb_ulpi_grp and pcu_spi_grp pin-groups are special because these have a non 0 mode value to select the GPIO functions and these already have matching foo_gpio pin-groups, leave these are unchanged.
The pmu_clk "sus" groups added in commit 2f46d7f7e959 ("pinctrl: baytrail:
Add pinconf group + function for the pmu_clk") do need to use the new PIN_GROUP_GPIO macro.
--- drivers/pinctrl/intel/pinctrl-baytrail.c | 74 ++++++++++++------------ drivers/pinctrl/intel/pinctrl-intel.h | 4 ++ 2 files changed, 42 insertions(+), 36 deletions(-)
drivers/pinctrl/intel/pinctrl-baytrail.c +38 -36
@@ -277,33 +277,33 @@ static const unsigned int byt_score_plt_clk5_pins[] = { 101 };static const unsigned int byt_score_smbus_pins[] = {51 ,52 ,53 };static const struct intel_pingroup byt_score_groups[] = { -PIN_GROUP ("uart1_grp" , byt_score_uart1_pins,1 ), -PIN_GROUP ("uart2_grp" , byt_score_uart2_pins,1 ), -PIN_GROUP ("pwm0_grp" , byt_score_pwm0_pins,1 ), -PIN_GROUP ("pwm1_grp" , byt_score_pwm1_pins,1 ), -PIN_GROUP ("ssp2_grp" , byt_score_ssp2_pins,1 ), -PIN_GROUP ("sio_spi_grp" , byt_score_sio_spi_pins,1 ), -PIN_GROUP ("i2c5_grp" , byt_score_i2c5_pins,1 ), -PIN_GROUP ("i2c6_grp" , byt_score_i2c6_pins,1 ), -PIN_GROUP ("i2c4_grp" , byt_score_i2c4_pins,1 ), -PIN_GROUP ("i2c3_grp" , byt_score_i2c3_pins,1 ), -PIN_GROUP ("i2c2_grp" , byt_score_i2c2_pins,1 ), -PIN_GROUP ("i2c1_grp" , byt_score_i2c1_pins,1 ), -PIN_GROUP ("i2c0_grp" , byt_score_i2c0_pins,1 ), -PIN_GROUP ("ssp0_grp" , byt_score_ssp0_pins,1 ), -PIN_GROUP ("ssp1_grp" , byt_score_ssp1_pins,1 ), -PIN_GROUP ("sdcard_grp" , byt_score_sdcard_pins, byt_score_sdcard_mux_values), -PIN_GROUP ("sdio_grp" , byt_score_sdio_pins,1 ), -PIN_GROUP ("emmc_grp" , byt_score_emmc_pins,1 ), -PIN_GROUP ("lpc_grp" , byt_score_ilb_lpc_pins,1 ), -PIN_GROUP ("sata_grp" , byt_score_sata_pins,1 ), -PIN_GROUP ("plt_clk0_grp" , byt_score_plt_clk0_pins,1 ), -PIN_GROUP ("plt_clk1_grp" , byt_score_plt_clk1_pins,1 ), -PIN_GROUP ("plt_clk2_grp" , byt_score_plt_clk2_pins,1 ), -PIN_GROUP ("plt_clk3_grp" , byt_score_plt_clk3_pins,1 ), -PIN_GROUP ("plt_clk4_grp" , byt_score_plt_clk4_pins,1 ), -PIN_GROUP ("plt_clk5_grp" , byt_score_plt_clk5_pins,1 ), -PIN_GROUP ("smbus_grp" , byt_score_smbus_pins,1 ), +PIN_GROUP_GPIO ("uart1_grp" , byt_score_uart1_pins,1 ), +PIN_GROUP_GPIO ("uart2_grp" , byt_score_uart2_pins,1 ), +PIN_GROUP_GPIO ("pwm0_grp" , byt_score_pwm0_pins,1 ), +PIN_GROUP_GPIO ("pwm1_grp" , byt_score_pwm1_pins,1 ), +PIN_GROUP_GPIO ("ssp2_grp" , byt_score_ssp2_pins,1 ), +PIN_GROUP_GPIO ("sio_spi_grp" , byt_score_sio_spi_pins,1 ), +PIN_GROUP_GPIO ("i2c5_grp" , byt_score_i2c5_pins,1 ), +PIN_GROUP_GPIO ("i2c6_grp" , byt_score_i2c6_pins,1 ), +PIN_GROUP_GPIO ("i2c4_grp" , byt_score_i2c4_pins,1 ), +PIN_GROUP_GPIO ("i2c3_grp" , byt_score_i2c3_pins,1 ), +PIN_GROUP_GPIO ("i2c2_grp" , byt_score_i2c2_pins,1 ), +PIN_GROUP_GPIO ("i2c1_grp" , byt_score_i2c1_pins,1 ), +PIN_GROUP_GPIO ("i2c0_grp" , byt_score_i2c0_pins,1 ), +PIN_GROUP_GPIO ("ssp0_grp" , byt_score_ssp0_pins,1 ), +PIN_GROUP_GPIO ("ssp1_grp" , byt_score_ssp1_pins,1 ), +PIN_GROUP_GPIO ("sdcard_grp" , byt_score_sdcard_pins, byt_score_sdcard_mux_values), +PIN_GROUP_GPIO ("sdio_grp" , byt_score_sdio_pins,1 ), +PIN_GROUP_GPIO ("emmc_grp" , byt_score_emmc_pins,1 ), +PIN_GROUP_GPIO ("lpc_grp" , byt_score_ilb_lpc_pins,1 ), +PIN_GROUP_GPIO ("sata_grp" , byt_score_sata_pins,1 ), +PIN_GROUP_GPIO ("plt_clk0_grp" , byt_score_plt_clk0_pins,1 ), +PIN_GROUP_GPIO ("plt_clk1_grp" , byt_score_plt_clk1_pins,1 ), +PIN_GROUP_GPIO ("plt_clk2_grp" , byt_score_plt_clk2_pins,1 ), +PIN_GROUP_GPIO ("plt_clk3_grp" , byt_score_plt_clk3_pins,1 ), +PIN_GROUP_GPIO ("plt_clk4_grp" , byt_score_plt_clk4_pins,1 ), +PIN_GROUP_GPIO ("plt_clk5_grp" , byt_score_plt_clk5_pins,1 ), +PIN_GROUP_GPIO ("smbus_grp" , byt_score_smbus_pins,1 ), };static const char *const byt_score_uart_groups[] = {
@@ -331,12 +331,14 @@ static const char * const byt_score_plt_clk_groups[] = { };static const char *const byt_score_smbus_groups[] = {"smbus_grp" };static const char *const byt_score_gpio_groups[] = { -"uart1_grp" ,"uart2_grp" ,"pwm0_grp" ,"pwm1_grp" ,"ssp0_grp" , -"ssp1_grp" ,"ssp2_grp" ,"sio_spi_grp" ,"i2c0_grp" ,"i2c1_grp" , -"i2c2_grp" ,"i2c3_grp" ,"i2c4_grp" ,"i2c5_grp" ,"i2c6_grp" , -"sdcard_grp" ,"sdio_grp" ,"emmc_grp" ,"lpc_grp" ,"sata_grp" , -"plt_clk0_grp" ,"plt_clk1_grp" ,"plt_clk2_grp" ,"plt_clk3_grp" , -"plt_clk4_grp" ,"plt_clk5_grp" ,"smbus_grp" , +"uart1_grp_gpio" ,"uart2_grp_gpio" ,"pwm0_grp_gpio" , +"pwm1_grp_gpio" ,"ssp0_grp_gpio" ,"ssp1_grp_gpio" ,"ssp2_grp_gpio" , +"sio_spi_grp_gpio" ,"i2c0_grp_gpio" ,"i2c1_grp_gpio" ,"i2c2_grp_gpio" , +"i2c3_grp_gpio" ,"i2c4_grp_gpio" ,"i2c5_grp_gpio" ,"i2c6_grp_gpio" , +"sdcard_grp_gpio" ,"sdio_grp_gpio" ,"emmc_grp_gpio" ,"lpc_grp_gpio" , +"sata_grp_gpio" ,"plt_clk0_grp_gpio" ,"plt_clk1_grp_gpio" , +"plt_clk2_grp_gpio" ,"plt_clk3_grp_gpio" ,"plt_clk4_grp_gpio" , +"plt_clk5_grp_gpio" ,"smbus_grp_gpio" , };static const struct intel_function byt_score_functions[] = {
@@ -455,8 +457,8 @@ static const struct intel_pingroup byt_sus_groups[] = {PIN_GROUP ("usb_oc_grp_gpio" , byt_sus_usb_over_current_pins, byt_sus_usb_over_current_gpio_mode_values),PIN_GROUP ("usb_ulpi_grp_gpio" , byt_sus_usb_ulpi_pins, byt_sus_usb_ulpi_gpio_mode_values),PIN_GROUP ("pcu_spi_grp_gpio" , byt_sus_pcu_spi_pins, byt_sus_pcu_spi_gpio_mode_values), -PIN_GROUP ("pmu_clk1_grp" , byt_sus_pmu_clk1_pins,1 ), - PIN_GROUP("pmu_clk2_grp", byt_sus_pmu_clk2_pins, 1), +PIN_GROUP_GPIO ("pmu_clk1_grp" , byt_sus_pmu_clk1_pins,1 ), + PIN_GROUP_GPIO("pmu_clk2_grp", byt_sus_pmu_clk2_pins, 1), }; static const char * const byt_sus_usb_groups[] = {
@@ -468,7 +470,7 @@ static const char * const byt_sus_pmu_clk_groups[] = { };static const char *const byt_sus_gpio_groups[] = {"usb_oc_grp_gpio" ,"usb_ulpi_grp_gpio" ,"pcu_spi_grp_gpio" , -"pmu_clk1_grp" ,"pmu_clk2_grp" , +"pmu_clk1_grp_gpio" ,"pmu_clk2_grp_gpio" , };static const struct intel_function byt_sus_functions[] = {
drivers/pinctrl/intel/pinctrl-intel.h +4 -0
@@ -179,6 +179,10 @@ struct intel_community { .modes = __builtin_choose_expr(__builtin_constant_p((m)), NULL, (m)), \ } +#define PIN_GROUP_GPIO (n, p, m) \ + PIN_GROUP(n, p, m), \ + PIN_GROUP(n "_gpio", p, 0) +#define FUNCTION (n, g) \ { \ .func = PINCTRL_PINFUNCTION((n), (g), ARRAY_SIZE(g)), \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/301 power: rt9455: hide unused rt9455_boost_voltage_values
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 452d8950db3e839aba1bb13bc5378f4bac11fa04 ]
The rt9455_boost_voltage_values[] array is only used when USB PHY support is enabled, causing a W=1 warning otherwise:
drivers/power/supply/rt9455_charger.c:200:18: error: 'rt9455_boost_voltage_values' defined but not used [-Werror=unused-const-variable=]
Enclose the definition in the same #ifdef as the references to it.
--- drivers/power/supply/rt9455_charger.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/power/supply/rt9455_charger.c +2 -0
@@ -192,6 +192,7 @@ static const int rt9455_voreg_values[] = { 4450000, 4450000, 4450000, 4450000, 4450000, 4450000, 4450000, 4450000 }; +#if IS_ENABLED (CONFIG_USB_PHY )/* * When the charger is in boost mode, REG02[7:2] represent boost output * voltage.
@@ -207,6 +208,7 @@ static const int rt9455_boost_voltage_values[] = {5600000 ,5600000 ,5600000 ,5600000 ,5600000 ,5600000 ,5600000 ,5600000 , 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, }; +#endif /* REG07[3:0] (VMREG) in uV */ static const int rt9455_vmreg_values[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/301 power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 1e0fb113646182e073539db96016b00cfeb18ecc ]
The of_match shall correspond to the name of the regulator subnode, or the deprecated regulator-compatible property must be used:
failing to do so, the regulator won't probe (and the driver will as well not probe).
Since the devicetree binding for this driver is actually correct and wants DTs to use the "usb-otg-vbus-regulator" subnode name, fix this driver by aligning the of_match string to what the DT binding wants.
--- drivers/power/supply/mt6360_charger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/supply/mt6360_charger.c +1 -1
@@ -588,7 +588,7 @@ static const struct regulator_ops mt6360_chg_otg_ops = { };static const struct regulator_desc mt6360_otg_rdesc = { - .of_match ="usb-otg-vbus" , + .of_match ="usb-otg-vbus-regulator" , .name ="usb-otg-vbus" , .ops = &mt6360_chg_otg_ops, .owner =THIS_MODULE ,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/301 pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zeng Heng <[email protected]>
[ Upstream commit a0cedbcc8852d6c77b00634b81e41f17f29d9404 ]
If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() includes the droping operation, here we call it directly.
Message-ID: <[email protected]>
--- drivers/pinctrl/devicetree.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/pinctrl/devicetree.c +6 -4
@@ -220,14 +220,16 @@ int pinctrl_dt_to_map(struct pinctrl *p, struct pinctrl_dev *pctldev)for (state =0 ; ; state++) {/* Retrieve the pinctrl-* property */ propname =kasprintf (GFP_KERNEL ,"pinctrl-%d" , state); -if (!propname) -return -ENOMEM ; +if (!propname) { + ret = -ENOMEM ; + goto err; + } prop =of_find_property (np, propname, &size);kfree (propname);if (!prop) {if (state ==0 ) { -of_node_put (np); -return -ENODEV ; + ret = -ENODEV ; + goto err; }break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/301 regulator: mt6360: De-capitalize devicetree regulator subnodes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit d3cf8a17498dd9104c04ad28eeac3ef3339f9f9f ]
The MT6360 regulator binding, the example in the MT6360 mfd binding, and the devicetree users of those bindings are rightfully declaring MT6360 regulator subnodes with non-capital names, and luckily without using the deprecated regulator-compatible property.
With this driver declaring capitalized BUCKx/LDOx as of_match string for the node names, obviously no regulator gets probed: fix that by changing the MT6360_REGULATOR_DESC macro to add a "match" parameter which gets assigned to the of_match.
--- drivers/regulator/mt6360-regulator.c | 32 +++++++++++++++++----------- 1 file changed, 20 insertions(+), 12 deletions(-)
drivers/regulator/mt6360-regulator.c +20 -12
@@ -319,15 +319,15 @@ static unsigned int mt6360_regulator_of_map_mode(unsigned int hw_mode) } } -#define MT6360_REGULATOR_DESC (_name, _sname, ereg, emask, vreg, vmask, \ - mreg, mmask, streg, stmask, vranges, \ - vcnts, offon_delay, irq_tbls) \ +#define MT6360_REGULATOR_DESC (match, _name, _sname, ereg, emask, vreg, \ + vmask, mreg, mmask, streg, stmask, \ + vranges, vcnts, offon_delay, irq_tbls) \ { \ .desc = { \ .name = #_name, \ .supply_name = #_sname, \ .id = MT6360_REGULATOR_##_name, \ - .of_match = of_match_ptr(#_name), \ + .of_match = of_match_ptr(match), \ .regulators_node = of_match_ptr("regulator"), \ .of_map_mode = mt6360_regulator_of_map_mode, \ .owner = THIS_MODULE, \
@@ -351,21 +351,29 @@ static unsigned int mt6360_regulator_of_map_mode(unsigned int hw_mode) }static const struct mt6360_regulator_desc mt6360_regulator_descs[] = { -MT6360_REGULATOR_DESC (BUCK1 ,BUCK1_VIN ,0x117 ,0x40 ,0x110 ,0xff ,0x117 ,0x30 ,0x117 ,0x04 , +MT6360_REGULATOR_DESC ("buck1" ,BUCK1 ,BUCK1_VIN , +0x117 ,0x40 ,0x110 ,0xff ,0x117 ,0x30 ,0x117 ,0x04 , buck_vout_ranges,256 ,0 , buck1_irq_tbls), -MT6360_REGULATOR_DESC (BUCK2 ,BUCK2_VIN ,0x127 ,0x40 ,0x120 ,0xff ,0x127 ,0x30 ,0x127 ,0x04 , +MT6360_REGULATOR_DESC ("buck2" ,BUCK2 ,BUCK2_VIN , +0x127 ,0x40 ,0x120 ,0xff ,0x127 ,0x30 ,0x127 ,0x04 , buck_vout_ranges,256 ,0 , buck2_irq_tbls), -MT6360_REGULATOR_DESC (LDO6 ,LDO_VIN3 ,0x137 ,0x40 ,0x13B ,0xff ,0x137 ,0x30 ,0x137 ,0x04 , +MT6360_REGULATOR_DESC ("ldo6" ,LDO6 ,LDO_VIN3 , +0x137 ,0x40 ,0x13B ,0xff ,0x137 ,0x30 ,0x137 ,0x04 , ldo_vout_ranges1,256 ,0 , ldo6_irq_tbls), -MT6360_REGULATOR_DESC (LDO7 ,LDO_VIN3 ,0x131 ,0x40 ,0x135 ,0xff ,0x131 ,0x30 ,0x131 ,0x04 , +MT6360_REGULATOR_DESC ("ldo7" ,LDO7 ,LDO_VIN3 , +0x131 ,0x40 ,0x135 ,0xff ,0x131 ,0x30 ,0x131 ,0x04 , ldo_vout_ranges1,256 ,0 , ldo7_irq_tbls), -MT6360_REGULATOR_DESC (LDO1 ,LDO_VIN1 ,0x217 ,0x40 ,0x21B ,0xff ,0x217 ,0x30 ,0x217 ,0x04 , +MT6360_REGULATOR_DESC ("ldo1" ,LDO1 ,LDO_VIN1 , +0x217 ,0x40 ,0x21B ,0xff ,0x217 ,0x30 ,0x217 ,0x04 , ldo_vout_ranges2,256 ,0 , ldo1_irq_tbls), -MT6360_REGULATOR_DESC (LDO2 ,LDO_VIN1 ,0x211 ,0x40 ,0x215 ,0xff ,0x211 ,0x30 ,0x211 ,0x04 , +MT6360_REGULATOR_DESC ("ldo2" ,LDO2 ,LDO_VIN1 , +0x211 ,0x40 ,0x215 ,0xff ,0x211 ,0x30 ,0x211 ,0x04 , ldo_vout_ranges2,256 ,0 , ldo2_irq_tbls), -MT6360_REGULATOR_DESC (LDO3 ,LDO_VIN1 ,0x205 ,0x40 ,0x209 ,0xff ,0x205 ,0x30 ,0x205 ,0x04 , +MT6360_REGULATOR_DESC ("ldo3" ,LDO3 ,LDO_VIN1 , +0x205 ,0x40 ,0x209 ,0xff ,0x205 ,0x30 ,0x205 ,0x04 , ldo_vout_ranges2,256 ,100 , ldo3_irq_tbls), -MT6360_REGULATOR_DESC (LDO5 ,LDO_VIN2 ,0x20B ,0x40 ,0x20F ,0x7f ,0x20B ,0x30 ,0x20B ,0x04 , +MT6360_REGULATOR_DESC ("ldo5" ,LDO5 ,LDO_VIN2 , +0x20B ,0x40 ,0x20F ,0x7f ,0x20B ,0x30 ,0x20B ,0x04 , ldo_vout_ranges3,128 ,100 , ldo5_irq_tbls), };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/301 regulator: change stubbed devm_regulator_get_enable to return Ok
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matti Vaittinen <[email protected]>
[ Upstream commit 96e20adc43c4f81e9163a5188cee75a6dd393e09 ]
The devm_regulator_get_enable() should be a 'call and forget' API, meaning, when it is used to enable the regulators, the API does not provide a handle to do any further control of the regulators. It gives no real benefit to return an error from the stub if CONFIG_REGULATOR is not set.
On the contrary, returning and error is causing problems to drivers when hardware is such it works out just fine with no regulator control. Returning an error forces drivers to specifically handle the case where CONFIG_REGULATOR is not set, making the mere existence of the stub questionalble. Furthermore, the stub of the regulator_enable() seems to be returning Ok.
Change the stub implementation for the devm_regulator_get_enable() to return Ok so drivers do not separately handle the case where the CONFIG_REGULATOR is not set.
--- include/linux/regulator/consumer.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/regulator/consumer.h +1 -1
@@ -365,7 +365,7 @@ devm_regulator_get_exclusive(struct device *dev, const char *id)static inline int devm_regulator_get_enable (struct device *dev,const char *id) { -return -ENODEV ; +return 0 ; } static inline int devm_regulator_get_enable_optional(struct device *dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/301 regulator: change devm_regulator_get_enable_optional() stub to return Ok
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matti Vaittinen <[email protected]>
[ Upstream commit ff33132605c1a0acea59e4c523cb7c6fabe856b2 ]
The devm_regulator_get_enable_optional() should be a 'call and forget' API, meaning, when it is used to enable the regulators, the API does not provide a handle to do any further control of the regulators. It gives no real benefit to return an error from the stub if CONFIG_REGULATOR is not set.
On the contrary, returning an error is causing problems to drivers when hardware is such it works out just fine with no regulator control. Returning an error forces drivers to specifically handle the case where CONFIG_REGULATOR is not set, making the mere existence of the stub questionalble.
Change the stub implementation for the devm_regulator_get_enable_optional() to return Ok so drivers do not separately handle the case where the CONFIG_REGULATOR is not set.
--- include/linux/regulator/consumer.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/regulator/consumer.h +1 -1
@@ -371,7 +371,7 @@ static inline int devm_regulator_get_enable(struct device *dev, const char *id)static inline int devm_regulator_get_enable_optional (struct device *dev,const char *id) { -return -ENODEV ; +return 0 ; } static inline struct regulator *__must_check
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/301 bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit 229087f6f1dc2d0c38feba805770f28529980ec0 ]
Turns out that due to CONFIG_DEBUG_INFO_BTF_MODULES not having an explicitly specified "menu item name" in Kconfig, it's basically impossible to turn it off (see [0]).
This patch fixes the issue by defining menu name for CONFIG_DEBUG_INFO_BTF_MODULES, which makes it actually adjustable and independent of CONFIG_DEBUG_INFO_BTF, in the sense that one can have DEBUG_INFO_BTF=y and DEBUG_INFO_BTF_MODULES=n.
We still keep it as defaulting to Y, of course.
--- lib/Kconfig.debug | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
lib/Kconfig.debug +3 -2
@@ -373,7 +373,7 @@ config DEBUG_INFO_SPLIT Incompatible with older versions of ccache. config DEBUG_INFO_BTF - bool "Generate BTF typeinfo" + bool "Generate BTF type information" depends on !DEBUG_INFO_SPLIT && !DEBUG_INFO_REDUCED depends on !GCC_PLUGIN_RANDSTRUCT || COMPILE_TEST depends on BPF_SYSCALL
@@ -404,7 +404,8 @@ config PAHOLE_HAS_LANG_EXCLUDE using DEBUG_INFO_BTF_MODULES. config DEBUG_INFO_BTF_MODULES - def_bool y + bool "Generate BTF type information for kernel modules" + default y depends on DEBUG_INFO_BTF && MODULES && PAHOLE_HAS_SPLIT_BTF help Generate compact split BTF type information for kernel modules.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/301 bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <[email protected]>
[ Upstream commit 6648e613226e18897231ab5e42ffc29e63fa3365 ]
Fix NULL pointer data-races in sk_psock_skb_ingress_enqueue() which syzbot reported [1].
[1]
BUG: KCSAN: data-race in sk_psock_drop / sk_psock_skb_ingress_enqueue
write to 0xffff88814b3278b8 of 8 bytes by task 10724 on cpu 1:
sk_psock_stop_verdict net/core/skmsg.c:1257 [inline] sk_psock_drop+0x13e/0x1f0 net/core/skmsg.c:843 sk_psock_put include/linux/skmsg.h:459 [inline] sock_map_close+0x1a7/0x260 net/core/sock_map.c:1648 unix_release+0x4b/0x80 net/unix/af_unix.c:1048 __sock_release net/socket.c:659 [inline] sock_close+0x68/0x150 net/socket.c:1421 __fput+0x2c1/0x660 fs/file_table.c:422 __fput_sync+0x44/0x60 fs/file_table.c:507 __do_sys_close fs/open.c:1556 [inline] __se_sys_close+0x101/0x1b0 fs/open.c:1541 __x64_sys_close+0x1f/0x30 fs/open.c:1541 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75
read to 0xffff88814b3278b8 of 8 bytes by task 10713 on cpu 0:
sk_psock_data_ready include/linux/skmsg.h:464 [inline] sk_psock_skb_ingress_enqueue+0x32d/0x390 net/core/skmsg.c:555 sk_psock_skb_ingress_self+0x185/0x1e0 net/core/skmsg.c:606 sk_psock_verdict_apply net/core/skmsg.c:1008 [inline] sk_psock_verdict_recv+0x3e4/0x4a0 net/core/skmsg.c:1202 unix_read_skb net/unix/af_unix.c:2546 [inline] unix_stream_read_skb+0x9e/0xf0 net/unix/af_unix.c:2682 sk_psock_verdict_data_ready+0x77/0x220 net/core/skmsg.c:1223 unix_stream_sendmsg+0x527/0x860 net/unix/af_unix.c:2339 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x140/0x180 net/socket.c:745 ____sys_sendmsg+0x312/0x410 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x1e9/0x280 net/socket.c:2667 __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x46/0x50 net/socket.c:2674 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75
value changed: 0xffffffff83d7feb0 -> 0x0000000000000000
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 10713 Comm: syz-executor.4 Tainted: G W 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Prior to this, commit 4cd12c6065df ("bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()") fixed one NULL pointer similarly due to no protection of saved_data_ready. Here is another different caller causing the same issue because of the same reason. So we should protect it with sk_callback_lock read lock because the writer side in the sk_psock_drop() uses "write_lock_bh(&sk->sk_callback_lock);".
To avoid errors that could happen in future, I move those two pairs of lock into the sk_psock_data_ready(), which is suggested by John Fastabend.
--- include/linux/skmsg.h | 2 ++ net/core/skmsg.c | 5 +---- 2 files changed, 3 insertions(+), 4 deletions(-)
include/linux/skmsg.h +2 -0
@@ -456,10 +456,12 @@ static inline void sk_psock_put(struct sock *sk, struct sk_psock *psock)static inline void sk_psock_data_ready (struct sock *sk,struct sk_psock *psock) { +read_lock_bh (&sk->sk_callback_lock);if (psock->saved_data_ready) psock->saved_data_ready (sk);else sk->sk_data_ready (sk); +read_unlock_bh (&sk->sk_callback_lock); } static inline void psock_set_prog(struct bpf_prog **pprog,
net/core/skmsg.c +1 -4
@@ -1226,11 +1226,8 @@ static void sk_psock_verdict_data_ready(struct sock *sk)rcu_read_lock (); psock =sk_psock (sk); -if (psock) { -read_lock_bh (&sk->sk_callback_lock); +if (psock)sk_psock_data_ready (sk, psock); -read_unlock_bh (&sk->sk_callback_lock); - }rcu_read_unlock (); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/301 regmap: Add regmap_read_bypassed()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit 70ee853eec5693fefd8348a2b049d9cb83362e58 ]
Add a regmap_read_bypassed() to allow reads from the hardware registers while the regmap is in cache-only mode.
A typical use for this is to keep the cache in cache-only mode until the hardware has reached a valid state, but one or more status registers must be polled to determine when this state is reached.
For example, firmware download on the cs35l56 can take several seconds if there are multiple amps sharing limited bus bandwidth. This is too long to block in probe() so it is done as a background task. The device must be soft-reset to reboot the firmware and during this time the registers are not accessible, so the cache should be in cache-only. But the driver must poll a register to detect when reboot has completed.
--- drivers/base/regmap/regmap.c | 37 ++++++++++++++++++++++++++++++++++++ include/linux/regmap.h | 8 ++++++++ 2 files changed, 45 insertions(+)
drivers/base/regmap/regmap.c +37 -0
@@ -2836,6 +2836,43 @@ int regmap_read(struct regmap *map, unsigned int reg, unsigned int *val) }EXPORT_SYMBOL_GPL (regmap_read); +/** +* regmap_read_bypassed() - Read a value from a single register direct +* from the device, bypassing the cache +* +* @map: Register map to read from +* @reg: Register to be read from +* @val: Pointer to store read value +* +* A value of zero will be returned on success, a negative errno will +* be returned in error cases. +*/ +int regmap_read_bypassed (struct regmap *map,unsigned int reg,unsigned int *val) +{ +int ret; +bool bypass, cache_only; + +if (!IS_ALIGNED (reg, map->reg_stride)) +return -EINVAL ; + + map->lock (map->lock_arg); + + bypass = map->cache_bypass; + cache_only = map->cache_only; + map->cache_bypass = true; + map->cache_only = false; + + ret =_regmap_read (map, reg, val); + + map->cache_bypass = bypass; + map->cache_only = cache_only; + + map->unlock (map->lock_arg); + +return ret; +} +EXPORT_SYMBOL_GPL (regmap_read_bypassed); +/** * regmap_raw_read() - Read raw data from the device *
include/linux/regmap.h +8 -0
@@ -1225,6 +1225,7 @@ int regmap_multi_reg_write_bypassed(struct regmap *map,int regmap_raw_write_async (struct regmap *map,unsigned int reg,const void *val,size_t val_len);int regmap_read (struct regmap *map,unsigned int reg,unsigned int *val); +int regmap_read_bypassed (struct regmap *map,unsigned int reg,unsigned int *val);int regmap_raw_read (struct regmap *map,unsigned int reg,void *val,size_t val_len); int regmap_noinc_read(struct regmap *map, unsigned int reg,
@@ -1734,6 +1735,13 @@ static inline int regmap_read(struct regmap *map, unsigned int reg,return -EINVAL ; } +static inline int regmap_read_bypassed (struct regmap *map,unsigned int reg, +unsigned int *val) +{ +WARN_ONCE (1 ,"regmap API is disabled" ); +return -EINVAL ; +} +static inline int regmap_raw_read (struct regmap *map,unsigned int reg,void *val,size_t val_len) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/301 ASoC: SOF: Introduce generic names for IPC types
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit 6974f2cd2fa94fef663133af23722cf607853e22 ]
Change the enum names for the IPC types to be more descriptive and drop tying the IPC4 to Intel SoCs.
Add defines to avoid build breakage while the related code is modified to use the new enum names.
Stable-dep-of: 305539a25a1c ("ASoC: SOF: Intel: add default firmware library path for LNL")
--- include/sound/sof.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
include/sound/sof.h +5 -2
@@ -52,11 +52,14 @@ enum sof_dsp_power_states {/* Definitions for multiple IPCs */ enum sof_ipc_type { -SOF_IPC , -SOF_INTEL_IPC4 , +SOF_IPC_TYPE_3 , +SOF_IPC_TYPE_4 ,SOF_IPC_TYPE_COUNT }; +#define SOF_IPC SOF_IPC_TYPE_3 +#define SOF_INTEL_IPC4 SOF_IPC_TYPE_4 +/* * SOF Platform data. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/301 ASoC: SOF: Intel: add default firmware library path for LNL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 305539a25a1c9929b058381aac6104bd939c0fee ]
The commit cd6f2a2e6346 ("ASoC: SOF: Intel: Set the default firmware library path for IPC4") added the default_lib_path field for all platforms, but this was missed when LunarLake was later introduced.
--- sound/soc/sof/intel/pci-lnl.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/sof/intel/pci-lnl.c +3 -0
@@ -35,6 +35,9 @@ static const struct sof_dev_desc lnl_desc = { .default_fw_path = { [SOF_INTEL_IPC4] = "intel/sof-ipc4/lnl", }, + .default_lib_path = { + [SOF_IPC_TYPE_4] = "intel/sof-ipc4-lib/lnl", + }, .default_tplg_path = { [SOF_INTEL_IPC4] = "intel/sof-ace-tplg", },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/301 nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Zhang <[email protected]>
[ Upstream commit 0bc2e80b9be51712b19e919db5abc97a418f8292 ]
Move the stray '.' that is currently at the end of the line after newline '\n' to before newline character which is the right position.
--- drivers/nvme/host/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/core.c +1 -1
@@ -3540,7 +3540,7 @@ static int nvme_init_ns_head(struct nvme_ns *ns, struct nvme_ns_info *info)"Found shared namespace %d, but multipathing not supported.\n" , info->nsid);dev_warn_once (ctrl->device, -"Support for shared namespaces without CONFIG_NVME_MULTIPATH is deprecated and will be removed in Linux 6.0\n." ); +"Support for shared namespaces without CONFIG_NVME_MULTIPATH is deprecated and will be removed in Linux 6.0.\n" ); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/301 bpf: Fix a verifier verbose message
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Protopopov <[email protected]>
[ Upstream commit 37eacb9f6e89fb399a79e952bc9c78eb3e16290e ]
Long ago a map file descriptor in a pseudo ldimm64 instruction could only be present as an immediate value insn[0].imm, and thus this value was used in a verbose verifier message printed when the file descriptor wasn't valid. Since addition of BPF_PSEUDO_MAP_IDX_VALUE/BPF_PSEUDO_MAP_IDX the insn[0].imm field can also contain an index pointing to the file descriptor in the attr.fd_array array. However, if the file descriptor is invalid, the verifier still prints the verbose message containing value of insn[0].imm. Patch the verifier message to always print the actual file descriptor value.
--- kernel/bpf/verifier.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
kernel/bpf/verifier.c +1 -2
@@ -17655,8 +17655,7 @@ static int resolve_pseudo_ldimm64(struct bpf_verifier_env *env) f =fdget (fd); map =__bpf_map_get (f);if (IS_ERR (map)) { -verbose (env,"fd %d is not pointing to valid bpf_map\n" , - insn[0 ].imm); +verbose (env,"fd %d is not pointing to valid bpf_map\n" , fd);return PTR_ERR (map); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/301 spi: spi-axi-spi-engine: Use helper function devm_clk_get_enabled()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zetao <[email protected]>
[ Upstream commit a08199b309f833fd4221ab5ee2391c791fe26385 ]
Since commit 7ef9651e9792 ("clk: Provide new devm_clk helpers for prepared and enabled clocks"), devm_clk_get() and clk_prepare_enable() can now be replaced by devm_clk_get_enabled() when driver enables (and possibly prepares) the clocks for the whole lifetime of the device. Moreover, it is no longer necessary to unprepare and disable the clocks explicitly.
Stable-dep-of: 0064db9ce4aa ("spi: axi-spi-engine: fix version format string")
--- drivers/spi/spi-axi-spi-engine.c | 25 +++++-------------------- 1 file changed, 5 insertions(+), 20 deletions(-)
drivers/spi/spi-axi-spi-engine.c +5 -20
@@ -485,30 +485,22 @@ static int spi_engine_probe(struct platform_device *pdev)spin_lock_init (&spi_engine->lock); - spi_engine->clk =devm_clk_get (&pdev->dev,"s_axi_aclk" ); + spi_engine->clk =devm_clk_get_enabled (&pdev->dev,"s_axi_aclk" );if (IS_ERR (spi_engine->clk)) { ret =PTR_ERR (spi_engine->clk); goto err_put_host; } - spi_engine->ref_clk =devm_clk_get (&pdev->dev,"spi_clk" ); + spi_engine->ref_clk =devm_clk_get_enabled (&pdev->dev,"spi_clk" );if (IS_ERR (spi_engine->ref_clk)) { ret =PTR_ERR (spi_engine->ref_clk); goto err_put_host; } - ret =clk_prepare_enable (spi_engine->clk); -if (ret) - goto err_put_host; - - ret =clk_prepare_enable (spi_engine->ref_clk); -if (ret) - goto err_clk_disable; - spi_engine->base =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (spi_engine->base)) { ret =PTR_ERR (spi_engine->base); - goto err_ref_clk_disable; + goto err_put_host; } version =readl (spi_engine->base +SPI_ENGINE_REG_VERSION );
@@ -518,7 +510,7 @@ static int spi_engine_probe(struct platform_device *pdev)SPI_ENGINE_VERSION_MINOR (version), SPI_ENGINE_VERSION_PATCH(version)); ret = -ENODEV ; - goto err_ref_clk_disable; + goto err_put_host; }writel_relaxed (0x00 , spi_engine->base +SPI_ENGINE_REG_RESET );
@@ -527,7 +519,7 @@ static int spi_engine_probe(struct platform_device *pdev) ret =request_irq (irq, spi_engine_irq,0 , pdev->name, host);if (ret) - goto err_ref_clk_disable; + goto err_put_host; host->dev.of_node = pdev->dev.of_node; host->mode_bits =SPI_CPOL |SPI_CPHA |SPI_3WIRE ;
@@ -545,10 +537,6 @@ static int spi_engine_probe(struct platform_device *pdev)return 0 ; err_free_irq:free_irq (irq, host); -err_ref_clk_disable: -clk_disable_unprepare (spi_engine->ref_clk); -err_clk_disable: -clk_disable_unprepare (spi_engine->clk); err_put_host:spi_controller_put (host);return ret;
@@ -569,9 +557,6 @@ static void spi_engine_remove(struct platform_device *pdev)writel_relaxed (0xff , spi_engine->base +SPI_ENGINE_REG_INT_PENDING );writel_relaxed (0x00 , spi_engine->base +SPI_ENGINE_REG_INT_ENABLE );writel_relaxed (0x01 , spi_engine->base +SPI_ENGINE_REG_RESET ); - -clk_disable_unprepare (spi_engine->ref_clk); -clk_disable_unprepare (spi_engine->clk); }static const struct of_device_id spi_engine_match_table[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/301 spi: axi-spi-engine: simplify driver data allocation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 9e4ce5220eedea2cc440f3961dec1b5122e815b2 ]
This simplifies the private data allocation in the AXI SPI Engine driver by making use of the feature built into the spi_alloc_host() function instead of doing it manually.
Stable-dep-of: 0064db9ce4aa ("spi: axi-spi-engine: fix version format string")
--- drivers/spi/spi-axi-spi-engine.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/spi/spi-axi-spi-engine.c +2 -6
@@ -473,15 +473,11 @@ static int spi_engine_probe(struct platform_device *pdev)if (irq <0 )return irq; - spi_engine =devm_kzalloc (&pdev->dev,sizeof (*spi_engine),GFP_KERNEL ); -if (!spi_engine) -return -ENOMEM ; - - host =spi_alloc_host (&pdev->dev,0 ); + host =spi_alloc_host (&pdev->dev,sizeof (*spi_engine));if (!host)return -ENOMEM ; -spi_controller_set_devdata (host, spi_engine); + spi_engine =spi_controller_get_devdata (host);spin_lock_init (&spi_engine->lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/301 spi: axi-spi-engine: use devm_spi_alloc_host()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit e12cd96e8e93044646fdf4b2c9a1de62cfa01e7c ]
This modifies the AXI SPI Engine driver to use devm_spi_alloc_host() instead of spi_alloc_host() to simplify the code a bit.
In addition to simplifying the error paths in the probe function, we can also remove spi_controller_get/put() calls in the remove function since devm_spi_alloc_host() sets a flag to no longer decrement the controller reference count in the spi_unregister_controller() function.
Stable-dep-of: 0064db9ce4aa ("spi: axi-spi-engine: fix version format string")
--- drivers/spi/spi-axi-spi-engine.c | 31 ++++++++++--------------------- 1 file changed, 10 insertions(+), 21 deletions(-)
drivers/spi/spi-axi-spi-engine.c +10 -21
@@ -473,7 +473,7 @@ static int spi_engine_probe(struct platform_device *pdev)if (irq <0 )return irq; - host =spi_alloc_host (&pdev->dev,sizeof (*spi_engine)); + host =devm_spi_alloc_host (&pdev->dev,sizeof (*spi_engine));if (!host)return -ENOMEM ;
@@ -482,22 +482,16 @@ static int spi_engine_probe(struct platform_device *pdev)spin_lock_init (&spi_engine->lock); spi_engine->clk =devm_clk_get_enabled (&pdev->dev,"s_axi_aclk" ); -if (IS_ERR (spi_engine->clk)) { - ret =PTR_ERR (spi_engine->clk); - goto err_put_host; - } +if (IS_ERR (spi_engine->clk)) +return PTR_ERR (spi_engine->clk); spi_engine->ref_clk =devm_clk_get_enabled (&pdev->dev,"spi_clk" ); -if (IS_ERR (spi_engine->ref_clk)) { - ret =PTR_ERR (spi_engine->ref_clk); - goto err_put_host; - } +if (IS_ERR (spi_engine->ref_clk)) +return PTR_ERR (spi_engine->ref_clk); spi_engine->base =devm_platform_ioremap_resource (pdev,0 ); -if (IS_ERR (spi_engine->base)) { - ret =PTR_ERR (spi_engine->base); - goto err_put_host; - } +if (IS_ERR (spi_engine->base)) +return PTR_ERR (spi_engine->base); version =readl (spi_engine->base +SPI_ENGINE_REG_VERSION );if (SPI_ENGINE_VERSION_MAJOR (version) !=1 ) {
@@ -505,8 +499,7 @@ static int spi_engine_probe(struct platform_device *pdev)SPI_ENGINE_VERSION_MAJOR (version),SPI_ENGINE_VERSION_MINOR (version), SPI_ENGINE_VERSION_PATCH(version)); - ret = -ENODEV ; - goto err_put_host; +return -ENODEV ; }writel_relaxed (0x00 , spi_engine->base +SPI_ENGINE_REG_RESET );
@@ -515,7 +508,7 @@ static int spi_engine_probe(struct platform_device *pdev) ret =request_irq (irq, spi_engine_irq,0 , pdev->name, host);if (ret) - goto err_put_host; +return ret; host->dev.of_node = pdev->dev.of_node; host->mode_bits =SPI_CPOL |SPI_CPHA |SPI_3WIRE ;
@@ -533,14 +526,12 @@ static int spi_engine_probe(struct platform_device *pdev)return 0 ; err_free_irq:free_irq (irq, host); -err_put_host: -spi_controller_put (host);return ret; }static void spi_engine_remove (struct platform_device *pdev) { -struct spi_controller *host =spi_controller_get (platform_get_drvdata (pdev)); +struct spi_controller *host =platform_get_drvdata (pdev);struct spi_engine *spi_engine =spi_controller_get_devdata (host);int irq =platform_get_irq (pdev,0 );
@@ -548,8 +539,6 @@ static void spi_engine_remove(struct platform_device *pdev)free_irq (irq, host); -spi_controller_put (host); -writel_relaxed (0xff , spi_engine->base +SPI_ENGINE_REG_INT_PENDING );writel_relaxed (0x00 , spi_engine->base +SPI_ENGINE_REG_INT_ENABLE );writel_relaxed (0x01 , spi_engine->base +SPI_ENGINE_REG_RESET );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/301 spi: axi-spi-engine: move msg state to new struct
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 7f970ecb77b6759d37ee743fc36fc0daba960e75 ]
This moves the message state in the AXI SPI Engine driver to a new struct spi_engine_msg_state.
Previously, the driver state contained various pointers that pointed to memory owned by a struct spi_message. However, it did not set any of these pointers to NULL when a message was completed. This could lead to use after free bugs.
Example of how this could happen:
1. SPI core calls into spi_engine_transfer_one_message() with msg1.
2. Assume something was misconfigured and spi_engine_tx_next() is not called enough times in interrupt callbacks for msg1 such that spi_engine->tx_xfer is never set to NULL before the msg1 completes.
3. SYNC interrupt is received and spi_finalize_current_message() is called for msg1. spi_engine->msg is set to NULL but no other message-specific state is reset.
4. Caller that sent msg1 is notified of the completion and frees msg1 and the associated xfers and tx/rx buffers.
4. SPI core calls into spi_engine_transfer_one_message() with msg2.
5. When spi_engine_tx_next() is called for msg2, spi_engine->tx_xfer is still be pointing to an xfer from msg1, which was already freed. spi_engine_xfer_next() tries to access xfer->transfer_list of one of the freed xfers and we get a segfault or undefined behavior.
To avoid issues like this, instead of putting per-message state in the driver state struct, we can make use of the struct spi_message::state field to store a pointer to a new struct spi_engine_msg_state. This way, all of the state that belongs to specific message stays with that message and we don't have to remember to manually reset all aspects of the message state when a message is completed. Rather, a new state is allocated for each message.
Most of the changes are just renames where the state is accessed. One place where this wasn't straightforward was the sync_id member. This has been changed to use ida_alloc_range() since we needed to separate the per-message sync_id from the per-controller next available sync_id.
Stable-dep-of: 0064db9ce4aa ("spi: axi-spi-engine: fix version format string")
--- drivers/spi/spi-axi-spi-engine.c | 150 ++++++++++++++++++++----------- 1 file changed, 96 insertions(+), 54 deletions(-)
drivers/spi/spi-axi-spi-engine.c +96 -54
@@ -6,6 +6,7 @@*/ #include <linux/clk.h> +#include <linux/idr.h> #include <linux/interrupt.h> #include <linux/io.h> #include <linux/of.h>
@@ -78,28 +79,42 @@ struct spi_engine_program {uint16_t instructions[]; }; -struct spi_engine { -struct clk *clk; -struct clk *ref_clk; - -spinlock_t lock; - -void __iomem *base; - -struct spi_message *msg; +/** +* struct spi_engine_message_state - SPI engine per-message state +*/ +struct spi_engine_message_state { +/** Instructions for executing this message. */ struct spi_engine_program *p; +/** Number of elements in cmd_buf array. */ unsigned cmd_length; +/** Array of commands not yet written to CMD FIFO. */ const uint16_t *cmd_buf; - +/** Next xfer with tx_buf not yet fully written to TX FIFO. */ struct spi_transfer *tx_xfer; +/** Size of tx_buf in bytes. */ unsigned int tx_length; +/** Bytes not yet written to TX FIFO. */ const uint8_t *tx_buf; - +/** Next xfer with rx_buf not yet fully written to RX FIFO. */ struct spi_transfer *rx_xfer; +/** Size of tx_buf in bytes. */ unsigned int rx_length; +/** Bytes not yet written to the RX FIFO. */ uint8_t *rx_buf; +/** ID to correlate SYNC interrupts with this message. */ +u8 sync_id; +}; + +struct spi_engine { +struct clk *clk; +struct clk *ref_clk; -unsigned int sync_id; +spinlock_t lock; + +void __iomem *base; + +struct spi_message *msg; +struct ida sync_ida;unsigned int completed_id;unsigned int int_enable;
@@ -258,100 +273,105 @@ static void spi_engine_xfer_next(struct spi_engine *spi_engine,static void spi_engine_tx_next (struct spi_engine *spi_engine) { -struct spi_transfer *xfer = spi_engine->tx_xfer; +struct spi_engine_message_state *st = spi_engine->msg->state; +struct spi_transfer *xfer = st->tx_xfer;do {spi_engine_xfer_next (spi_engine, &xfer); }while (xfer && !xfer->tx_buf); - spi_engine->tx_xfer = xfer; + st->tx_xfer = xfer;if (xfer) { - spi_engine->tx_length = xfer->len; - spi_engine->tx_buf = xfer->tx_buf; + st->tx_length = xfer->len; + st->tx_buf = xfer->tx_buf; }else { - spi_engine->tx_buf =NULL ; + st->tx_buf =NULL ; } }static void spi_engine_rx_next (struct spi_engine *spi_engine) { -struct spi_transfer *xfer = spi_engine->rx_xfer; +struct spi_engine_message_state *st = spi_engine->msg->state; +struct spi_transfer *xfer = st->rx_xfer;do {spi_engine_xfer_next (spi_engine, &xfer); }while (xfer && !xfer->rx_buf); - spi_engine->rx_xfer = xfer; + st->rx_xfer = xfer;if (xfer) { - spi_engine->rx_length = xfer->len; - spi_engine->rx_buf = xfer->rx_buf; + st->rx_length = xfer->len; + st->rx_buf = xfer->rx_buf; }else { - spi_engine->rx_buf =NULL ; + st->rx_buf =NULL ; } }static bool spi_engine_write_cmd_fifo (struct spi_engine *spi_engine) {void __iomem *addr = spi_engine->base +SPI_ENGINE_REG_CMD_FIFO ; +struct spi_engine_message_state *st = spi_engine->msg->state;unsigned int n, m, i;const uint16_t *buf; n =readl_relaxed (spi_engine->base +SPI_ENGINE_REG_CMD_FIFO_ROOM ); -while (n && spi_engine->cmd_length) { - m =min (n, spi_engine->cmd_length); - buf = spi_engine->cmd_buf; +while (n && st->cmd_length) { + m =min (n, st->cmd_length); + buf = st->cmd_buf;for (i =0 ; i < m; i++)writel_relaxed (buf[i], addr); - spi_engine->cmd_buf += m; - spi_engine->cmd_length -= m; + st->cmd_buf += m; + st->cmd_length -= m; n -= m; } -return spi_engine->cmd_length !=0 ; +return st->cmd_length !=0 ; }static bool spi_engine_write_tx_fifo (struct spi_engine *spi_engine) {void __iomem *addr = spi_engine->base +SPI_ENGINE_REG_SDO_DATA_FIFO ; +struct spi_engine_message_state *st = spi_engine->msg->state;unsigned int n, m, i;const uint8_t *buf; n =readl_relaxed (spi_engine->base +SPI_ENGINE_REG_SDO_FIFO_ROOM ); -while (n && spi_engine->tx_length) { - m =min (n, spi_engine->tx_length); - buf = spi_engine->tx_buf; +while (n && st->tx_length) { + m =min (n, st->tx_length); + buf = st->tx_buf;for (i =0 ; i < m; i++)writel_relaxed (buf[i], addr); - spi_engine->tx_buf += m; - spi_engine->tx_length -= m; + st->tx_buf += m; + st->tx_length -= m; n -= m; -if (spi_engine->tx_length ==0 ) +if (st->tx_length ==0 )spi_engine_tx_next (spi_engine); } -return spi_engine->tx_length !=0 ; +return st->tx_length !=0 ; }static bool spi_engine_read_rx_fifo (struct spi_engine *spi_engine) {void __iomem *addr = spi_engine->base +SPI_ENGINE_REG_SDI_DATA_FIFO ; +struct spi_engine_message_state *st = spi_engine->msg->state;unsigned int n, m, i;uint8_t *buf; n =readl_relaxed (spi_engine->base +SPI_ENGINE_REG_SDI_FIFO_LEVEL ); -while (n && spi_engine->rx_length) { - m =min (n, spi_engine->rx_length); - buf = spi_engine->rx_buf; +while (n && st->rx_length) { + m =min (n, st->rx_length); + buf = st->rx_buf;for (i =0 ; i < m; i++) buf[i] =readl_relaxed (addr); - spi_engine->rx_buf += m; - spi_engine->rx_length -= m; + st->rx_buf += m; + st->rx_length -= m; n -= m; -if (spi_engine->rx_length ==0 ) +if (st->rx_length ==0 )spi_engine_rx_next (spi_engine); } -return spi_engine->rx_length !=0 ; +return st->rx_length !=0 ; }static irqreturn_t spi_engine_irq (int irq,void *devid)
@@ -387,12 +407,16 @@ static irqreturn_t spi_engine_irq(int irq, void *devid) disable_int |=SPI_ENGINE_INT_SDI_ALMOST_FULL ; } -if (pending &SPI_ENGINE_INT_SYNC ) { -if (spi_engine->msg && - spi_engine->completed_id == spi_engine->sync_id) { +if (pending &SPI_ENGINE_INT_SYNC && spi_engine->msg) { +struct spi_engine_message_state *st = spi_engine->msg->state; + +if (spi_engine->completed_id == st->sync_id) {struct spi_message *msg = spi_engine->msg; +struct spi_engine_message_state *st = msg->state; -kfree (spi_engine->p); +ida_free (&spi_engine->sync_ida, st->sync_id); +kfree (st->p); +kfree (st); msg->status =0 ; msg->actual_length = msg->frame_length; spi_engine->msg =NULL ;
@@ -417,29 +441,46 @@ static int spi_engine_transfer_one_message(struct spi_controller *host, {struct spi_engine_program p_dry, *p;struct spi_engine *spi_engine =spi_controller_get_devdata (host); +struct spi_engine_message_state *st;unsigned int int_enable =0 ;unsigned long flags;size_t size; +int ret; + + st =kzalloc (sizeof (*st),GFP_KERNEL ); +if (!st) +return -ENOMEM ; p_dry.length =0 ;spi_engine_compile_message (spi_engine, msg, true, &p_dry); size =sizeof (*p->instructions) * (p_dry.length +1 ); p =kzalloc (sizeof (*p) + size,GFP_KERNEL ); -if (!p) +if (!p) { +kfree (st);return -ENOMEM ; + } + + ret =ida_alloc_range (&spi_engine->sync_ida,0 ,U8_MAX ,GFP_KERNEL ); +if (ret <0 ) { +kfree (p); +kfree (st); +return ret; + } + + st->sync_id = ret; +spi_engine_compile_message (spi_engine, msg, false, p);spin_lock_irqsave (&spi_engine->lock, flags); - spi_engine->sync_id = (spi_engine->sync_id +1 ) &0xff ; -spi_engine_program_add_cmd (p, false, -SPI_ENGINE_CMD_SYNC (spi_engine->sync_id)); +spi_engine_program_add_cmd (p, false,SPI_ENGINE_CMD_SYNC (st->sync_id)); + msg->state = st; spi_engine->msg = msg; - spi_engine->p = p; + st->p = p; - spi_engine->cmd_buf = p->instructions; - spi_engine->cmd_length = p->length; + st->cmd_buf = p->instructions; + st->cmd_length = p->length;if (spi_engine_write_cmd_fifo (spi_engine)) int_enable |=SPI_ENGINE_INT_CMD_ALMOST_EMPTY ;
@@ -448,7 +489,7 @@ static int spi_engine_transfer_one_message(struct spi_controller *host, int_enable |=SPI_ENGINE_INT_SDO_ALMOST_EMPTY ;spi_engine_rx_next (spi_engine); -if (spi_engine->rx_length !=0 ) +if (st->rx_length !=0 ) int_enable |=SPI_ENGINE_INT_SDI_ALMOST_FULL ; int_enable |=SPI_ENGINE_INT_SYNC ;
@@ -480,6 +521,7 @@ static int spi_engine_probe(struct platform_device *pdev) spi_engine =spi_controller_get_devdata (host);spin_lock_init (&spi_engine->lock); +ida_init (&spi_engine->sync_ida); spi_engine->clk =devm_clk_get_enabled (&pdev->dev,"s_axi_aclk" );if (IS_ERR (spi_engine->clk))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/301 spi: axi-spi-engine: use common AXI macros
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 88c2b56c2690061121cad03f0f551db465287575 ]
This avoid duplicating the same macros in multiple drivers by reusing the common AXI macros for the version register.
Stable-dep-of: 0064db9ce4aa ("spi: axi-spi-engine: fix version format string")
--- drivers/spi/spi-axi-spi-engine.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-)
drivers/spi/spi-axi-spi-engine.c +6 -11
@@ -6,6 +6,7 @@*/ #include <linux/clk.h> +#include <linux/fpga/adi-axi-common.h> #include <linux/idr.h> #include <linux/interrupt.h> #include <linux/io.h>
@@ -14,12 +15,6 @@#include <linux/platform_device.h> #include <linux/spi/spi.h> -#define SPI_ENGINE_VERSION_MAJOR (x) ((x >> 16) & 0xff) -#define SPI_ENGINE_VERSION_MINOR (x) ((x >> 8) & 0xff) -#define SPI_ENGINE_VERSION_PATCH (x) (x & 0xff) - -#define SPI_ENGINE_REG_VERSION 0x00 -#define SPI_ENGINE_REG_RESET 0x40#define SPI_ENGINE_REG_INT_ENABLE 0x80
@@ -535,12 +530,12 @@ static int spi_engine_probe(struct platform_device *pdev)if (IS_ERR (spi_engine->base))return PTR_ERR (spi_engine->base); - version =readl (spi_engine->base +SPI_ENGINE_REG_VERSION ); -if (SPI_ENGINE_VERSION_MAJOR (version) !=1 ) { + version =readl (spi_engine->base +ADI_AXI_REG_VERSION ); +if (ADI_AXI_PCORE_VER_MAJOR (version) !=1 ) {dev_err (&pdev->dev,"Unsupported peripheral version %u.%u.%c\n" , -SPI_ENGINE_VERSION_MAJOR (version), -SPI_ENGINE_VERSION_MINOR (version), -SPI_ENGINE_VERSION_PATCH (version)); +ADI_AXI_PCORE_VER_MAJOR (version), +ADI_AXI_PCORE_VER_MINOR (version), +ADI_AXI_PCORE_VER_PATCH (version));return -ENODEV ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/301 spi: axi-spi-engine: fix version format string
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 0064db9ce4aa7cc794e6f4aed60dee0f94fc9bcf ]
The version format string in the AXI SPI Engine driver was probably intended to print the version number in the same format as the DT compatible string (e.g. 1.00.a). However, the version just uses semantic versioning so formatting the patch number as a character is not correct and would result in printing control characters for patch numbers less than 32.
--- drivers/spi/spi-axi-spi-engine.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-axi-spi-engine.c +1 -1
@@ -532,7 +532,7 @@ static int spi_engine_probe(struct platform_device *pdev) version =readl (spi_engine->base +ADI_AXI_REG_VERSION );if (ADI_AXI_PCORE_VER_MAJOR (version) !=1 ) { -dev_err (&pdev->dev,"Unsupported peripheral version %u.%u.%c\n" , +dev_err (&pdev->dev,"Unsupported peripheral version %u.%u.%u\n" ,ADI_AXI_PCORE_VER_MAJOR (version),ADI_AXI_PCORE_VER_MINOR (version),ADI_AXI_PCORE_VER_PATCH (version));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/301 spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devyn Liu <[email protected]>
[ Upstream commit 7430764f5a85d30314aeef2d5438dff1fb0b1d68 ]
Due to the reading of FIFO during the dump of data registers in debugfs, if SPI transmission is in progress, it will be affected and may result in transmission failure. Therefore, the dump interface of data registers in debugfs is removed.
--- drivers/spi/spi-hisi-kunpeng.c | 2 -- 1 file changed, 2 deletions(-)
drivers/spi/spi-hisi-kunpeng.c +0 -2
@@ -151,8 +151,6 @@ static const struct debugfs_reg32 hisi_spi_regs[] = {HISI_SPI_DBGFS_REG ("ENR" ,HISI_SPI_ENR ),HISI_SPI_DBGFS_REG ("FIFOC" ,HISI_SPI_FIFOC ),HISI_SPI_DBGFS_REG ("IMR" ,HISI_SPI_IMR ), -HISI_SPI_DBGFS_REG ("DIN" ,HISI_SPI_DIN ), -HISI_SPI_DBGFS_REG ("DOUT" ,HISI_SPI_DOUT ),HISI_SPI_DBGFS_REG ("SR" ,HISI_SPI_SR ),HISI_SPI_DBGFS_REG ("RISR" ,HISI_SPI_RISR ), HISI_SPI_DBGFS_REG("ISR", HISI_SPI_ISR),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/301 bpf, arm64: Fix incorrect runtime stats
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Kuohai <[email protected]>
[ Upstream commit dc7d7447b56bcc9cf79a9c22e4edad200a298e4c ]
When __bpf_prog_enter() returns zero, the arm64 register x20 that stores prog start time is not assigned to zero, causing incorrect runtime stats.
To fix it, assign the return value of bpf_prog_enter() to x20 register immediately upon its return.
--- arch/arm64/net/bpf_jit_comp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/net/bpf_jit_comp.c +3 -3
@@ -1738,15 +1738,15 @@ static void invoke_bpf_prog(struct jit_ctx *ctx, struct bpf_tramp_link *l,emit_call (enter_prog, ctx); +/* save return value to callee saved register x20 */ +emit (A64_MOV (1 ,A64_R (20 ),A64_R (0 )), ctx); +/* if (__bpf_prog_enter(prog) == 0) * goto skip_exec_of_prog; */ branch = ctx->image + ctx->idx;emit (A64_NOP , ctx); -/* save return value to callee saved register x20 */ -emit (A64_MOV (1 ,A64_R (20 ),A64_R (0 )), ctx); -emit (A64_ADD_I (1 ,A64_R (0 ),A64_SP , args_off), ctx);if (!p->jited)emit_addr_mov_i64 (A64_R (1 ), (const u64 )p->insnsi, ctx);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/301 riscv, bpf: Fix incorrect runtime stats
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Kuohai <[email protected]>
[ Upstream commit 10541b374aa05c8118cc6a529a615882e53f261b ]
When __bpf_prog_enter() returns zero, the s1 register is not set to zero, resulting in incorrect runtime stats. Fix it by setting s1 immediately upon the return of __bpf_prog_enter().
--- arch/riscv/net/bpf_jit_comp64.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/riscv/net/bpf_jit_comp64.c +3 -3
@@ -740,6 +740,9 @@ static int invoke_bpf_prog(struct bpf_tramp_link *l, int args_off, int retval_ofif (ret)return ret; +/* store prog start time */ +emit_mv (RV_REG_S1 ,RV_REG_A0 , ctx); +/* if (__bpf_prog_enter(prog) == 0) * goto skip_exec_of_prog; */
@@ -747,9 +750,6 @@ static int invoke_bpf_prog(struct bpf_tramp_link *l, int args_off, int retval_of/* nop reserved for conditional jump */ emit (rv_nop (), ctx); -/* store prog start time */ -emit_mv (RV_REG_S1 ,RV_REG_A0 , ctx); -/* arg1: &args_off */ emit_addi (RV_REG_A0 ,RV_REG_FP , -args_off, ctx);if (!p->jited)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/301 ASoC: Intel: avs: Set name of control as in topology
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amadeusz Sławiński <[email protected]>
[ Upstream commit 4cbb5050bffc49c716381ea2ecb07306dd46f83a ]
When creating controls attached to widgets, there are a lot of rules if they get their name prefixed with widget name or not. Due to that controls ended up with weirdly looking names like "ssp0_fe DSP Volume", while topology set it to "DSP Volume".
Fix this by setting no_wname_in_kcontrol_name to true in avs topology widgets which disables unwanted behaviour.
--- sound/soc/intel/avs/topology.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/intel/avs/topology.c +2 -0
@@ -1412,6 +1412,8 @@ static int avs_widget_load(struct snd_soc_component *comp, int index,if (!le32_to_cpu (dw->priv.size))return 0 ; + w->no_wname_in_kcontrol_name = true; +if (w->ignore_suspend && !AVS_S0IX_SUPPORTED ) {dev_info_once (comp->dev,"Device does not support S0IX, check BIOS settings\n" ); w->ignore_suspend = false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/301 ASoC: codecs: wsa881x: set clk_stop_mode1 flag
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
[ Upstream commit 32ac501957e5f68fe0e4bf88fb4db75cfb8f6566 ]
WSA881x codecs do not retain the state while clock is stopped, so mark this with clk_stop_mode1 flag.
--- sound/soc/codecs/wsa881x.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/wsa881x.c +1 -0
@@ -1155,6 +1155,7 @@ static int wsa881x_probe(struct sdw_slave *pdev, pdev->prop.sink_ports =GENMASK (WSA881X_MAX_SWR_PORTS ,0 ); pdev->prop.sink_dpn_prop = wsa_sink_dpn_prop; pdev->prop.scp_int1_mask =SDW_SCP_INT1_BUS_CLASH |SDW_SCP_INT1_PARITY ; + pdev->prop.clk_stop_mode1 = true;gpiod_direction_output (wsa881x->sd_n, !wsa881x->sd_n_val); wsa881x->regmap =devm_regmap_init_sdw (pdev, &wsa881x_regmap_config);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/301 s390/mm: Fix storage key clearing for guest huge pages
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudio Imbrenda <[email protected]>
[ Upstream commit 843c3280686fc1a83d89ee1e0b5599c9f6b09d0c ]
The function __storage_key_init_range() expects the end address to be the first byte outside the range to be initialized. I.e. end - start should be the size of the area to be initialized.
The current code works because __storage_key_init_range() will still loop over every page in the range, but it is slower than using sske_frame().
--- arch/s390/mm/gmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/mm/gmap.c +1 -1
@@ -2659,7 +2659,7 @@ static int __s390_enable_skey_hugetlb(pte_t *pte, unsigned long addr,return 0 ; start =pmd_val (*pmd) &HPAGE_MASK ; - end = start +HPAGE_SIZE -1 ; + end = start +HPAGE_SIZE ;__storage_key_init_range (start, end);set_bit (PG_arch_1, &page->flags);cond_resched ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/301 s390/mm: Fix clearing storage keys for huge pages
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudio Imbrenda <[email protected]>
[ Upstream commit 412050af2ea39407fe43324b0be4ab641530ce88 ]
The function __storage_key_init_range() expects the end address to be the first byte outside the range to be initialized. I.e. end - start should be the size of the area to be initialized.
The current code works because __storage_key_init_range() will still loop over every page in the range, but it is slower than using sske_frame().
--- arch/s390/mm/hugetlbpage.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/mm/hugetlbpage.c +1 -1
@@ -139,7 +139,7 @@ static void clear_huge_pte_skeys(struct mm_struct *mm, unsigned long rste) }if (!test_and_set_bit (PG_arch_1, &page->flags)) -__storage_key_init_range (paddr, paddr + size -1 ); +__storage_key_init_range (paddr, paddr + size); } void __set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/301 xdp: use flags field to disambiguate broadcast redirect
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 5bcf0dcbf9066348058b88a510c57f70f384c92c ]
When redirecting a packet using XDP, the bpf_redirect_map() helper will set up the redirect destination information in struct bpf_redirect_info (using the __bpf_xdp_redirect_map() helper function), and the xdp_do_redirect() function will read this information after the XDP program returns and pass the frame on to the right redirect destination.
When using the BPF_F_BROADCAST flag to do multicast redirect to a whole map, __bpf_xdp_redirect_map() sets the 'map' pointer in struct bpf_redirect_info to point to the destination map to be broadcast. And xdp_do_redirect() reacts to the value of this map pointer to decide whether it's dealing with a broadcast or a single-value redirect. However, if the destination map is being destroyed before xdp_do_redirect() is called, the map pointer will be cleared out (by bpf_clear_redirect_map()) without waiting for any XDP programs to stop running. This causes xdp_do_redirect() to think that the redirect was to a single target, but the target pointer is also NULL (since broadcast redirects don't have a single target), so this causes a crash when a NULL pointer is passed to dev_map_enqueue().
To fix this, change xdp_do_redirect() to react directly to the presence of the BPF_F_BROADCAST flag in the 'flags' value in struct bpf_redirect_info to disambiguate between a single-target and a broadcast redirect. And only read the 'map' pointer if the broadcast flag is set, aborting if that has been cleared out in the meantime. This prevents the crash, while keeping the atomic (cmpxchg-based) clearing of the map pointer itself, and without adding any more checks in the non-broadcast fast path.
--- net/core/filter.c | 42 ++++++++++++++++++++++++++++++++---------- 1 file changed, 32 insertions(+), 10 deletions(-)
net/core/filter.c +32 -10
@@ -4334,10 +4334,12 @@ static __always_inline int __xdp_do_redirect_frame(struct bpf_redirect_info *ri,enum bpf_map_type map_type = ri->map_type;void *fwd = ri->tgt_value;u32 map_id = ri->map_id; +u32 flags = ri->flags;struct bpf_map *map;int err; ri->map_id =0 ;/* Valid map id idr range: [1,INT_MAX[ */ + ri->flags =0 ; ri->map_type =BPF_MAP_TYPE_UNSPEC ;if (unlikely (!xdpf)) {
@@ -4349,11 +4351,20 @@ static __always_inline int __xdp_do_redirect_frame(struct bpf_redirect_info *ri,case BPF_MAP_TYPE_DEVMAP : fallthrough;case BPF_MAP_TYPE_DEVMAP_HASH : - map =READ_ONCE (ri->map); -if (unlikely (map)) { +if (unlikely (flags &BPF_F_BROADCAST )) { + map =READ_ONCE (ri->map); + +/* The map pointer is cleared when the map is being torn +* down by bpf_clear_redirect_map() +*/ +if (unlikely (!map)) { + err = -ENOENT ; +break ; + } +WRITE_ONCE (ri->map,NULL ); err =dev_map_enqueue_multi (xdpf, dev, map, - ri->flags &BPF_F_EXCLUDE_INGRESS ); + flags &BPF_F_EXCLUDE_INGRESS ); }else { err =dev_map_enqueue (fwd, xdpf, dev); }
@@ -4416,9 +4427,9 @@ EXPORT_SYMBOL_GPL(xdp_do_redirect_frame);static int xdp_do_generic_redirect_map (struct net_device *dev,struct sk_buff *skb,struct xdp_buff *xdp, -struct bpf_prog *xdp_prog, -void *fwd, -enum bpf_map_type map_type,u32 map_id) +struct bpf_prog *xdp_prog,void *fwd, +enum bpf_map_type map_type,u32 map_id, +u32 flags) {struct bpf_redirect_info *ri =this_cpu_ptr (&bpf_redirect_info);struct bpf_map *map;
@@ -4428,11 +4439,20 @@ static int xdp_do_generic_redirect_map(struct net_device *dev,case BPF_MAP_TYPE_DEVMAP : fallthrough;case BPF_MAP_TYPE_DEVMAP_HASH : - map =READ_ONCE (ri->map); -if (unlikely (map)) { +if (unlikely (flags &BPF_F_BROADCAST )) { + map =READ_ONCE (ri->map); + +/* The map pointer is cleared when the map is being torn +* down by bpf_clear_redirect_map() +*/ +if (unlikely (!map)) { + err = -ENOENT ; +break ; + } +WRITE_ONCE (ri->map,NULL ); err =dev_map_redirect_multi (dev, skb, xdp_prog, map, - ri->flags &BPF_F_EXCLUDE_INGRESS ); + flags &BPF_F_EXCLUDE_INGRESS ); }else { err =dev_map_generic_redirect (fwd, skb, xdp_prog); }
@@ -4469,9 +4489,11 @@ int xdp_do_generic_redirect(struct net_device *dev, struct sk_buff *skb,enum bpf_map_type map_type = ri->map_type;void *fwd = ri->tgt_value;u32 map_id = ri->map_id; +u32 flags = ri->flags;int err; ri->map_id =0 ;/* Valid map id idr range: [1,INT_MAX[ */ + ri->flags =0 ; ri->map_type =BPF_MAP_TYPE_UNSPEC ;if (map_type ==BPF_MAP_TYPE_UNSPEC && map_id ==INT_MAX ) {
@@ -4491,7 +4513,7 @@ int xdp_do_generic_redirect(struct net_device *dev, struct sk_buff *skb,return 0 ; } -return xdp_do_generic_redirect_map (dev, skb, xdp, xdp_prog, fwd, map_type, map_id); +return xdp_do_generic_redirect_map (dev, skb, xdp, xdp_prog, fwd, map_type, map_id, flags); err:_trace_xdp_redirect_err (dev, xdp_prog, ri->tgt_index, err);return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/301 bna: ensure the copied buf is NUL terminated
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Quang Minh <[email protected]>
[ Upstream commit 8c34096c7fdf272fd4c0c37fe411cd2e3ed0ee9f ]
Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using sscanf. Fix this issue by using memdup_user_nul instead of memdup_user.
--- drivers/net/ethernet/brocade/bna/bnad_debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/brocade/bna/bnad_debugfs.c +2 -2
@@ -312,7 +312,7 @@ bnad_debugfs_write_regrd(struct file *file, const char __user *buf,void *kern_buf;/* Copy the user space buf */ - kern_buf =memdup_user (buf, nbytes); + kern_buf =memdup_user_nul (buf, nbytes);if (IS_ERR (kern_buf))return PTR_ERR (kern_buf);
@@ -372,7 +372,7 @@ bnad_debugfs_write_regwr(struct file *file, const char __user *buf,void *kern_buf;/* Copy the user space buf */ - kern_buf =memdup_user (buf, nbytes); + kern_buf =memdup_user_nul (buf, nbytes);if (IS_ERR (kern_buf))return PTR_ERR (kern_buf);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/301 octeontx2-af: avoid off-by-one read from userspace
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Quang Minh <[email protected]>
[ Upstream commit f299ee709fb45036454ca11e90cb2810fe771878 ]
We try to access count + 1 byte from userspace with memdup_user(buffer, count + 1). However, the userspace only provides buffer of count bytes and only these count bytes are verified to be okay to access. To ensure the copied buffer is NUL terminated, we use memdup_user_nul instead.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c +1 -3
@@ -999,12 +999,10 @@ static ssize_t rvu_dbg_qsize_write(struct file *filp,u16 pcifunc;int ret, lf; - cmd_buf =memdup_user (buffer, count +1 ); + cmd_buf =memdup_user_nul (buffer, count);if (IS_ERR (cmd_buf))return -ENOMEM ; - cmd_buf[count] ='\0' ; - cmd_buf_tmp =strchr (cmd_buf,'\n' );if (cmd_buf_tmp) { *cmd_buf_tmp ='\0' ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/301 nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 4b911a9690d72641879ea6d13cce1de31d346d79 ]
syzbot triggered various splats (see [0] and links) by a crafted GSO packet of VIRTIO_NET_HDR_GSO_UDP layering the following protocols:
ETH_P_8021AD + ETH_P_NSH + ETH_P_IPV6 + IPPROTO_UDP
NSH can encapsulate IPv4, IPv6, Ethernet, NSH, and MPLS. As the inner protocol can be Ethernet, NSH GSO handler, nsh_gso_segment(), calls skb_mac_gso_segment() to invoke inner protocol GSO handlers.
nsh_gso_segment() does the following for the original skb before calling skb_mac_gso_segment()
1. reset skb->network_header
2. save the original skb->{mac_heaeder,mac_len} in a local variable
3. pull the NSH header
4. resets skb->mac_header
5. set up skb->mac_len and skb->protocol for the inner protocol.
and does the following for the segmented skb
6. set ntohs(ETH_P_NSH) to skb->protocol
7. push the NSH header
8. restore skb->mac_header
9. set skb->mac_header + mac_len to skb->network_header
10. restore skb->mac_len
There are two problems in 6-7 and 8-9.
(a)
After 6 & 7, skb->data points to the NSH header, so the outer header (ETH_P_8021AD in this case) is stripped when skb is sent out of netdev.
Also, if NSH is encapsulated by NSH + Ethernet (so NSH-Ethernet-NSH), skb_pull() in the first nsh_gso_segment() will make skb->data point to the middle of the outer NSH or Ethernet header because the Ethernet header is not pulled by the second nsh_gso_segment().
(b)
While restoring skb->{mac_header,network_header} in 8 & 9, nsh_gso_segment() does not assume that the data in the linear buffer is shifted.
However, udp6_ufo_fragment() could shift the data and change skb->mac_header accordingly as demonstrated by syzbot.
If this happens, even the restored skb->mac_header points to the middle of the outer header.
It seems nsh_gso_segment() has never worked with outer headers so far.
At the end of nsh_gso_segment(), the outer header must be restored for the segmented skb, instead of the NSH header.
To do that, let's calculate the outer header position relatively from the inner header and set skb->{data,mac_header,protocol} properly.
[0]:
BUG: KMSAN: uninit-value in ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [inline] BUG: KMSAN: uninit-value in ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] BUG: KMSAN: uninit-value in ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668 ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [inline] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668 ipvlan_start_xmit+0x5c/0x1a0 drivers/net/ipvlan/ipvlan_main.c:222 __netdev_start_xmit include/linux/netdevice.h:4989 [inline] netdev_start_xmit include/linux/netdevice.h:5003 [inline] xmit_one net/core/dev.c:3547 [inline] dev_hard_start_xmit+0x244/0xa10 net/core/dev.c:3563 __dev_queue_xmit+0x33ed/0x51c0 net/core/dev.c:4351 dev_queue_xmit include/linux/netdevice.h:3171 [inline] packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3819 [inline] slab_alloc_node mm/slub.c:3860 [inline] __do_kmalloc_node mm/slub.c:3980 [inline] __kmalloc_node_track_caller+0x705/0x1000 mm/slub.c:4001 kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582 __alloc_skb+0x352/0x790 net/core/skbuff.c:651 skb_segment+0x20aa/0x7080 net/core/skbuff.c:4647 udp6_ufo_fragment+0xcab/0x1150 net/ipv6/udp_offload.c:109 ipv6_gso_segment+0x14be/0x2ca0 net/ipv6/ip6_offload.c:152 skb_mac_gso_segment+0x3e8/0x760 net/core/gso.c:53 nsh_gso_segment+0x6f4/0xf70 net/nsh/nsh.c:108 skb_mac_gso_segment+0x3e8/0x760 net/core/gso.c:53 __skb_gso_segment+0x4b0/0x730 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x107f/0x1930 net/core/dev.c:3628 __dev_queue_xmit+0x1f28/0x51c0 net/core/dev.c:4343 dev_queue_xmit include/linux/netdevice.h:3171 [inline] packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b CPU: 1 PID: 5101 Comm: syz-executor421 Not tainted 6.8.0-rc5-syzkaller-00297-gf2e367d6ad3b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
--- net/nsh/nsh.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
net/nsh/nsh.c +8 -6
@@ -77,13 +77,15 @@ EXPORT_SYMBOL_GPL(nsh_pop);static struct sk_buff *nsh_gso_segment (struct sk_buff *skb,netdev_features_t features) { +unsigned int outer_hlen, mac_len, nsh_len;struct sk_buff *segs =ERR_PTR (-EINVAL );u16 mac_offset = skb->mac_header; -unsigned int nsh_len, mac_len; -__be16 proto; +__be16 outer_proto, proto;skb_reset_network_header (skb); + outer_proto = skb->protocol; + outer_hlen =skb_mac_header_len (skb); mac_len = skb->mac_len;if (unlikely (!pskb_may_pull (skb,NSH_BASE_HDR_LEN )))
@@ -113,10 +115,10 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb, }for (skb = segs; skb; skb = skb->next) { - skb->protocol =htons (ETH_P_NSH ); -__skb_push (skb, nsh_len); - skb->mac_header = mac_offset; - skb->network_header = skb->mac_header + mac_len; + skb->protocol = outer_proto; +__skb_push (skb, nsh_len + outer_hlen); +skb_reset_mac_header (skb); +skb_set_network_header (skb, outer_hlen); skb->mac_len = mac_len; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/301 net l2tp: drop flow hash on forward
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Bauer <[email protected]>
[ Upstream commit 42f853b42899d9b445763b55c3c8adc72be0f0e1 ]
Drop the flow-hash of the skb when forwarding to the L2TP netdev.
This avoids the L2TP qdisc from using the flow-hash from the outer packet, which is identical for every flow within the tunnel.
This does not affect every platform but is specific for the ethernet driver. It depends on the platform including L4 information in the flow-hash.
One such example is the Mediatek Filogic MT798x family of networking processors.
--- net/l2tp/l2tp_eth.c | 3 +++ 1 file changed, 3 insertions(+)
net/l2tp/l2tp_eth.c +3 -0
@@ -136,6 +136,9 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,/* checksums verified by L2TP */ skb->ip_summed =CHECKSUM_NONE ; +/* drop outer flow-hash */ +skb_clear_hash (skb); +skb_dst_drop (skb);nf_reset_ct (skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/301 s390/vdso: Add CFI for RA register to asm macro vdso_func
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Remus <[email protected]>
[ Upstream commit b961ec10b9f9719987470236feb50c967db5a652 ]
The return-address (RA) register r14 is specified as volatile in the s390x ELF ABI [1]. Nevertheless proper CFI directives must be provided for an unwinder to restore the return address, if the RA register value is changed from its value at function entry, as it is the case.
[1]: s390x ELF ABI, https://github.com/IBM/s390x-abi/releases
--- arch/s390/include/asm/dwarf.h | 1 + arch/s390/kernel/vdso64/vdso_user_wrapper.S | 2 ++ 2 files changed, 3 insertions(+)
arch/s390/include/asm/dwarf.h +1 -0
@@ -9,6 +9,7 @@#define CFI_DEF_CFA_OFFSET .cfi_def_cfa_offset#define CFI_ADJUST_CFA_OFFSET .cfi_adjust_cfa_offset#define CFI_RESTORE .cfi_restore +#define CFI_REL_OFFSET .cfi_rel_offset#ifdef CONFIG_AS_CFI_VAL_OFFSET #define CFI_VAL_OFFSET .cfi_val_offset
arch/s390/kernel/vdso64/vdso_user_wrapper.S +2 -0
@@ -24,8 +24,10 @@ __kernel_\func: CFI_DEF_CFA_OFFSET (STACK_FRAME_OVERHEAD + WRAPPER_FRAME_SIZE) CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD stg %r14,STACK_FRAME_OVERHEAD(%r15) + CFI_REL_OFFSET 14, STACK_FRAME_OVERHEAD brasl %r14,__s390_vdso_\func lg %r14,STACK_FRAME_OVERHEAD(%r15) + CFI_RESTORE 14 aghi %r15,WRAPPER_FRAME_SIZE CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD CFI_RESTORE 15
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/301 Fix a potential infinite loop in extract_user_to_sg()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 6a30653b604aaad1bf0f2e74b068ceb8b6fc7aea ]
Fix extract_user_to_sg() so that it will break out of the loop if iov_iter_extract_pages() returns 0 rather than looping around forever.
[Note that I've included two fixes lines as the function got moved to a different file and renamed]
--- lib/scatterlist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/scatterlist.c +1 -1
@@ -1124,7 +1124,7 @@ static ssize_t extract_user_to_sg(struct iov_iter *iter, do { res = iov_iter_extract_pages(iter, &pages, maxsize, sg_max, extraction_flags, &off); - if (res < 0) + if (res <= 0) goto failed; len = res;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/301 ALSA: emu10k1: fix E-MU card dock presence monitoring
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oswald Buddenhagen <[email protected]>
[ Upstream commit 398321d7531963b95841865eb371fe65c44c6921 ]
While there are two separate IRQ status bits for dock attach and detach, the hardware appears to mix them up more or less randomly, making them useless for tracking what actually happened. It is much safer to check the dock status separately and proceed based on that, as the old polling code did.
Note that the code assumes that only the dock can be hot-plugged - if other option card bits changed, the logic would break.
Message-ID: <[email protected]>
--- sound/pci/emu10k1/emu10k1_main.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
sound/pci/emu10k1/emu10k1_main.c +10 -7
@@ -778,6 +778,11 @@ static void emu1010_firmware_work(struct work_struct *work)msleep (10 );/* Unmute all. Default is muted after a firmware load */ snd_emu1010_fpga_write (emu,EMU_HANA_UNMUTE ,EMU_UNMUTE ); + }else if (!(reg &EMU_HANA_OPTION_DOCK_ONLINE )) { +/* Audio Dock removed */ +dev_info (emu->card->dev,"emu1010: Audio Dock detached\n" ); +/* The hardware auto-mutes all, so we unmute again */ +snd_emu1010_fpga_write (emu,EMU_HANA_UNMUTE ,EMU_UNMUTE ); } }
@@ -810,14 +815,12 @@ static void emu1010_interrupt(struct snd_emu10k1 *emu)u32 sts;snd_emu1010_fpga_read (emu,EMU_HANA_IRQ_STATUS , &sts); -if (sts &EMU_HANA_IRQ_DOCK_LOST ) { -/* Audio Dock removed */ -dev_info (emu->card->dev,"emu1010: Audio Dock detached\n" ); -/* The hardware auto-mutes all, so we unmute again */ -snd_emu1010_fpga_write (emu,EMU_HANA_UNMUTE ,EMU_UNMUTE ); - }else if (sts &EMU_HANA_IRQ_DOCK ) { + +// The distinction of the IRQ status bits is unreliable, +// so we dispatch later based on option card status. +if (sts & (EMU_HANA_IRQ_DOCK |EMU_HANA_IRQ_DOCK_LOST ))schedule_work (&emu->emu1010.firmware_work); - } +if (sts &EMU_HANA_IRQ_WCLK_CHANGED )schedule_work (&emu->emu1010.clock_work); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/301 ALSA: emu10k1: factor out snd_emu1010_load_dock_firmware()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oswald Buddenhagen <[email protected]>
[ Upstream commit 28deafd0fbdc45cc9c63bd7dd4efc35137958862 ]
Pulled out of the next patch to improve its legibility.
As the function is now available, call it directly from snd_emu10k1_emu1010_init(), thus making the MicroDock firmware loading synchronous - there isn't really a reason not to. Note that this does not affect the AudioDocks of rev1 cards, as these have no independent power supplies, and thus come up only a while after the main card is initialized.
As a drive-by, adjust the priorities of two messages to better reflect their impact.
Message-ID: <[email protected]>
Stable-dep-of: f848337cd801 ("ALSA: emu10k1: move the whole GPIO event handling to the workqueue")
--- sound/pci/emu10k1/emu10k1_main.c | 66 +++++++++++++++++--------------- 1 file changed, 36 insertions(+), 30 deletions(-)
sound/pci/emu10k1/emu10k1_main.c +36 -30
@@ -732,11 +732,43 @@ static int snd_emu1010_load_firmware(struct snd_emu10k1 *emu, int dock,return snd_emu1010_load_firmware_entry (emu, *fw); } +static void snd_emu1010_load_dock_firmware (struct snd_emu10k1 *emu) +{ +u32 tmp, tmp2; +int err; + +dev_info (emu->card->dev,"emu1010: Loading Audio Dock Firmware\n" ); +/* Return to Audio Dock programming mode */ +snd_emu1010_fpga_write (emu,EMU_HANA_FPGA_CONFIG , +EMU_HANA_FPGA_CONFIG_AUDIODOCK ); + err =snd_emu1010_load_firmware (emu,1 , &emu->dock_fw); +if (err <0 ) +return ; +snd_emu1010_fpga_write (emu,EMU_HANA_FPGA_CONFIG ,0 ); + +snd_emu1010_fpga_read (emu,EMU_HANA_ID , &tmp); +dev_dbg (emu->card->dev,"emu1010: EMU_HANA+DOCK_ID = 0x%x\n" , tmp); +if ((tmp &0x1f ) !=0x15 ) { +/* FPGA failed to be programmed */ +dev_err (emu->card->dev, +"emu1010: Loading Audio Dock Firmware failed, reg = 0x%x\n" , + tmp); +return ; + } +dev_info (emu->card->dev,"emu1010: Audio Dock Firmware loaded\n" ); + +snd_emu1010_fpga_read (emu,EMU_DOCK_MAJOR_REV , &tmp); +snd_emu1010_fpga_read (emu,EMU_DOCK_MINOR_REV , &tmp2); +dev_info (emu->card->dev,"Audio Dock ver: %u.%u\n" , tmp, tmp2); + +/* Allow DLL to settle, to sync clocking between 1010 and Dock */ +msleep (10 ); +} +static void emu1010_firmware_work (struct work_struct *work) {struct snd_emu10k1 *emu; -u32 tmp, tmp2, reg; -int err; +u32 reg; emu = container_of(work, struct snd_emu10k1, emu1010.firmware_work);
@@ -749,33 +781,7 @@ static void emu1010_firmware_work(struct work_struct *work)snd_emu1010_fpga_read (emu,EMU_HANA_OPTION_CARDS , ®);/* OPTIONS: Which cards are attached to the EMU */ if (reg &EMU_HANA_OPTION_DOCK_OFFLINE ) {/* Audio Dock attached */ -/* Return to Audio Dock programming mode */ -dev_info (emu->card->dev, -"emu1010: Loading Audio Dock Firmware\n" ); -snd_emu1010_fpga_write (emu,EMU_HANA_FPGA_CONFIG , -EMU_HANA_FPGA_CONFIG_AUDIODOCK ); - err =snd_emu1010_load_firmware (emu,1 , &emu->dock_fw); -if (err <0 ) -return ; -snd_emu1010_fpga_write (emu,EMU_HANA_FPGA_CONFIG ,0 ); -snd_emu1010_fpga_read (emu,EMU_HANA_ID , &tmp); -dev_info (emu->card->dev, -"emu1010: EMU_HANA+DOCK_ID = 0x%x\n" , tmp); -if ((tmp &0x1f ) !=0x15 ) { -/* FPGA failed to be programmed */ -dev_info (emu->card->dev, -"emu1010: Loading Audio Dock Firmware file failed, reg = 0x%x\n" , - tmp); -return ; - } -dev_info (emu->card->dev, -"emu1010: Audio Dock Firmware loaded\n" ); -snd_emu1010_fpga_read (emu,EMU_DOCK_MAJOR_REV , &tmp); -snd_emu1010_fpga_read (emu,EMU_DOCK_MINOR_REV , &tmp2); -dev_info (emu->card->dev,"Audio Dock ver: %u.%u\n" , tmp, tmp2); -/* Sync clocking between 1010 and Dock */ -/* Allow DLL to settle */ -msleep (10 ); +snd_emu1010_load_dock_firmware (emu);/* Unmute all. Default is muted after a firmware load */ snd_emu1010_fpga_write (emu,EMU_HANA_UNMUTE ,EMU_UNMUTE ); }else if (!(reg &EMU_HANA_OPTION_DOCK_ONLINE )) {
@@ -892,7 +898,7 @@ static int snd_emu10k1_emu1010_init(struct snd_emu10k1 *emu)snd_emu1010_fpga_read (emu,EMU_HANA_OPTION_CARDS , ®);dev_info (emu->card->dev,"emu1010: Card options = 0x%x\n" , reg);if (reg &EMU_HANA_OPTION_DOCK_OFFLINE ) -schedule_work (&emu->emu1010.firmware_work); +snd_emu1010_load_dock_firmware (emu);if (emu->card_capabilities->no_adat) { emu->emu1010.optical_in =0 ;/* IN_SPDIF */ emu->emu1010.optical_out =0 ;/* OUT_SPDIF */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/301 ALSA: emu10k1: move the whole GPIO event handling to the workqueue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oswald Buddenhagen <[email protected]>
[ Upstream commit f848337cd801c7106a4ec0d61765771dab2a5909 ]
The actual event processing was already done by workqueue items. We can move the event dispatching there as well, rather than doing it already in the interrupt handler callback.
This change has a rather profound "side effect" on the reliability of the FPGA programming: once we enter programming mode, we must not issue any snd_emu1010_fpga_{read,write}() calls until we're done, as these would badly mess up the programming protocol. But exactly that would happen when trying to program the dock, as that triggers GPIO interrupts as a side effect. This is mitigated by deferring the actual interrupt handling, as workqueue items are not re-entrant.
To avoid scheduling the dispatcher on non-events, we now explicitly ignore GPIO IRQs triggered by "uninteresting" pins, which happens a lot as a side effect of calling snd_emu1010_fpga_{read,write}().
Message-ID: <[email protected]>
--- include/sound/emu10k1.h | 3 +- sound/pci/emu10k1/emu10k1.c | 3 +- sound/pci/emu10k1/emu10k1_main.c | 56 ++++++++++++++++---------------- 3 files changed, 30 insertions(+), 32 deletions(-)
include/sound/emu10k1.h +1 -2
@@ -1684,8 +1684,7 @@ struct snd_emu1010 {unsigned int clock_fallback;unsigned int optical_in;/* 0:SPDIF, 1:ADAT */ unsigned int optical_out;/* 0:SPDIF, 1:ADAT */ -struct work_struct firmware_work; -struct work_struct clock_work; +struct work_struct work; };struct snd_emu10k1 {
sound/pci/emu10k1/emu10k1.c +1 -2
@@ -189,8 +189,7 @@ static int snd_emu10k1_suspend(struct device *dev) emu->suspend =1 ; -cancel_work_sync (&emu->emu1010.firmware_work); -cancel_work_sync (&emu->emu1010.clock_work); +cancel_work_sync (&emu->emu1010.work);snd_ac97_suspend (emu->ac97);
sound/pci/emu10k1/emu10k1_main.c +28 -28
102 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/301 ALSA: emu10k1: fix E-MU dock initialization
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oswald Buddenhagen <[email protected]>
[ Upstream commit e8289fd3fa65d60cf04dab6f7845eda352c04ea6 ]
A side effect of making the dock monitoring interrupt-driven was that we'd be very quick to program a freshly connected dock. However, for unclear reasons, the dock does not work when we do that - despite the FPGA netlist upload going just fine. We work around this by adding a delay before programming the dock; for safety, the value is several times as much as was determined empirically.
Note that a badly timed dock hot-plug would have triggered the problem even before the referenced commit - but now it would happen 100% instead of about 3% of the time, thus making it impossible to work around by re-plugging.
Message-ID: <[email protected]>
--- sound/pci/emu10k1/emu10k1_main.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/pci/emu10k1/emu10k1_main.c +6 -0
@@ -737,6 +737,12 @@ static void snd_emu1010_load_dock_firmware(struct snd_emu10k1 *emu)u32 tmp, tmp2;int err; +// The docking events clearly arrive prematurely - while the +// Dock's FPGA seems to be successfully programmed, the Dock +// fails to initialize subsequently if we don't give it some +// time to "warm up" here. +msleep (200 ); +dev_info (emu->card->dev,"emu1010: Loading Audio Dock Firmware\n" );/* Return to Audio Dock programming mode */ snd_emu1010_fpga_write(emu, EMU_HANA_FPGA_CONFIG,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/301 net: qede: sanitize rc in qede_add_tc_flower_fltr()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit e25714466abd9d96901b15efddf82c60a38abd86 ]
Explicitly set 'rc' (return code), before jumping to the unlock and return path.
By not having any code depend on that 'rc' remains at it's initial value of -EINVAL, then we can re-use 'rc' for the return code of function calls in subsequent patches.
Only compile tested.
Stable-dep-of: fcee2065a178 ("net: qede: use return from qede_parse_flow_attr() for flower")
--- drivers/net/ethernet/qlogic/qede/qede_filter.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/net/ethernet/qlogic/qede/qede_filter.c +8 -3
@@ -1868,8 +1868,8 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto, struct flow_cls_offload *f) {struct qede_arfs_fltr_node *n; -int min_hlen, rc = -EINVAL ;struct qede_arfs_tuple t; +int min_hlen, rc;__qede_lock (edev);
@@ -1879,8 +1879,10 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto, }/* parse flower attribute and prepare filter */ -if (qede_parse_flow_attr (edev, proto, f->rule, &t)) +if (qede_parse_flow_attr (edev, proto, f->rule, &t)) { + rc = -EINVAL ; goto unlock; + }/* Validate profile mode and number of filters */ if ((edev->arfs->filter_count && edev->arfs->mode != t.mode) ||
@@ -1888,12 +1890,15 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto,DP_NOTICE (edev,"Filter configuration invalidated, filter mode=0x%x, configured mode=0x%x, filter count=0x%x\n" , t.mode, edev->arfs->mode, edev->arfs->filter_count); + rc = -EINVAL ; goto unlock; }/* parse tc actions and get the vf_id */ -if (qede_parse_actions (edev, &f->rule->action, f->common.extack)) +if (qede_parse_actions (edev, &f->rule->action, f->common.extack)) { + rc = -EINVAL ; goto unlock; + }if (qede_flow_find_fltr (edev, &t)) { rc = -EEXIST ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/301 net: qede: use return from qede_parse_flow_attr() for flower
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit fcee2065a178f78be6fd516302830378b17dba3d ]
In qede_add_tc_flower_fltr(), when callingqede_parse_flow_attr() then the return code
was only used for a non-zero check, and then-EINVAL was returned.
qede_parse_flow_attr() can currently fail with:
* -EINVAL
* -EOPNOTSUPP
* -EPROTONOSUPPORT
This patch changes the code to use the actual
return code, not just return -EINVAL.
The blaimed commit introduced these functions.
Only compile tested.
--- drivers/net/ethernet/qlogic/qede/qede_filter.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/qlogic/qede/qede_filter.c +2 -3
@@ -1879,10 +1879,9 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto, }/* parse flower attribute and prepare filter */ -if (qede_parse_flow_attr (edev, proto, f->rule, &t)) { - rc = -EINVAL ; + rc =qede_parse_flow_attr (edev, proto, f->rule, &t); +if (rc) goto unlock; - }/* Validate profile mode and number of filters */ if ((edev->arfs->filter_count && edev->arfs->mode != t.mode) ||
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/301 net: qede: use return from qede_parse_flow_attr() for flow_spec
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit 27b44414a34b108c5a37cd5b4894f606061d86e7 ]
In qede_flow_spec_to_rule(), when callingqede_parse_flow_attr() then the return code
was only used for a non-zero check, and then-EINVAL was returned.
qede_parse_flow_attr() can currently fail with:
* -EINVAL
* -EOPNOTSUPP
* -EPROTONOSUPPORT
This patch changes the code to use the actual
return code, not just return -EINVAL.
The blaimed commit introduced qede_flow_spec_to_rule(), and this call to qede_parse_flow_attr(), it looks like it just duplicated how it was already used.
Only compile tested.
--- drivers/net/ethernet/qlogic/qede/qede_filter.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/qlogic/qede/qede_filter.c +2 -3
@@ -2002,10 +2002,9 @@ static int qede_flow_spec_to_rule(struct qede_dev *edev,if (IS_ERR (flow))return PTR_ERR (flow); -if (qede_parse_flow_attr (edev, proto, flow->rule, t)) { - err = -EINVAL ; + err =qede_parse_flow_attr (edev, proto, flow->rule, t); +if (err) goto err_out; - }/* Make sure location is valid and filter isn't already set */ err = qede_flow_spec_validate(edev, &flow->rule->action, t,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/301 net: qede: use return from qede_parse_actions()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit f26f719a36e56381a1f4230e5364e7ad4d485888 ]
When calling qede_parse_actions() then the
return code was only used for a non-zero check,
and then -EINVAL was returned.
qede_parse_actions() can currently fail with:
* -EINVAL
* -EOPNOTSUPP
This patch changes the code to use the actual
return code, not just return -EINVAL.
The blaimed commit broke the implicit assumption
that only -EINVAL would ever be returned.
Only compile tested.
--- drivers/net/ethernet/qlogic/qede/qede_filter.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/qlogic/qede/qede_filter.c +2 -3
@@ -1894,10 +1894,9 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto, }/* parse tc actions and get the vf_id */ -if (qede_parse_actions (edev, &f->rule->action, f->common.extack)) { - rc = -EINVAL ; + rc =qede_parse_actions (edev, &f->rule->action, f->common.extack); +if (rc) goto unlock; - }if (qede_flow_find_fltr (edev, &t)) { rc = -EEXIST ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/301 vxlan: Fix racy device stats updates.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit 6dee402daba4eb8677a9438ebdcd8fe90ddd4326 ]
VXLAN devices update their stats locklessly. Therefore these counters should either be stored in per-cpu data structures or the updates should be done using atomic increments.
Since the net_device_core_stats infrastructure is already used in vxlan_rcv(), use it for the other rx_dropped and tx_dropped counter updates. Update the other counters atomically using DEV_STATS_INC().
--- drivers/net/vxlan/vxlan_core.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-)
drivers/net/vxlan/vxlan_core.c +14 -14
@@ -1766,8 +1766,8 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)skb_reset_network_header (skb);if (!vxlan_ecn_decapsulate (vs, oiph, skb)) { - ++vxlan->dev->stats.rx_frame_errors; - ++vxlan->dev->stats.rx_errors; +DEV_STATS_INC (vxlan->dev, rx_frame_errors); +DEV_STATS_INC (vxlan->dev, rx_errors);vxlan_vnifilter_count (vxlan, vni, vninode,VXLAN_VNI_STATS_RX_ERRORS ,0 ); goto drop;
@@ -1837,7 +1837,7 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) goto out;if (!pskb_may_pull (skb,arp_hdr_len (dev))) { - dev->stats.tx_dropped++; +dev_core_stats_tx_dropped_inc (dev); goto out; } parp =arp_hdr (skb);
@@ -1893,7 +1893,7 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) reply->pkt_type =PACKET_HOST ;if (netif_rx (reply) ==NET_RX_DROP ) { - dev->stats.rx_dropped++; +dev_core_stats_rx_dropped_inc (dev);vxlan_vnifilter_count (vxlan, vni,NULL ,VXLAN_VNI_STATS_RX_DROPS ,0 ); }
@@ -2052,7 +2052,7 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) goto out;if (netif_rx (reply) ==NET_RX_DROP ) { - dev->stats.rx_dropped++; +dev_core_stats_rx_dropped_inc (dev);vxlan_vnifilter_count (vxlan, vni,NULL ,VXLAN_VNI_STATS_RX_DROPS ,0 ); }
@@ -2371,7 +2371,7 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan, len); }else { drop: - dev->stats.rx_dropped++; +dev_core_stats_rx_dropped_inc (dev);vxlan_vnifilter_count (dst_vxlan, vni,NULL ,VXLAN_VNI_STATS_RX_DROPS ,0 ); }
@@ -2403,7 +2403,7 @@ static int encap_bypass_if_local(struct sk_buff *skb, struct net_device *dev, daddr->sa.sa_family, dst_port, vxlan->cfg.flags);if (!dst_vxlan) { - dev->stats.tx_errors++; +DEV_STATS_INC (dev, tx_errors);vxlan_vnifilter_count (vxlan, vni,NULL ,VXLAN_VNI_STATS_TX_ERRORS ,0 );kfree_skb (skb);
@@ -2664,7 +2664,7 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,return ; drop: - dev->stats.tx_dropped++; +dev_core_stats_tx_dropped_inc (dev);vxlan_vnifilter_count (vxlan, vni,NULL ,VXLAN_VNI_STATS_TX_DROPS ,0 );dev_kfree_skb (skb);return ;
@@ -2672,11 +2672,11 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, tx_error:rcu_read_unlock ();if (err == -ELOOP ) - dev->stats.collisions++; +DEV_STATS_INC (dev, collisions);else if (err == -ENETUNREACH ) - dev->stats.tx_carrier_errors++; +DEV_STATS_INC (dev, tx_carrier_errors);dst_release (ndst); - dev->stats.tx_errors++; +DEV_STATS_INC (dev, tx_errors);vxlan_vnifilter_count (vxlan, vni,NULL ,VXLAN_VNI_STATS_TX_ERRORS ,0 );kfree_skb (skb); }
@@ -2709,7 +2709,7 @@ static void vxlan_xmit_nh(struct sk_buff *skb, struct net_device *dev,return ; drop: - dev->stats.tx_dropped++; +dev_core_stats_tx_dropped_inc (dev);vxlan_vnifilter_count (netdev_priv (dev), vni,NULL ,VXLAN_VNI_STATS_TX_DROPS ,0 );dev_kfree_skb (skb);
@@ -2747,7 +2747,7 @@ static netdev_tx_t vxlan_xmit_nhid(struct sk_buff *skb, struct net_device *dev,return NETDEV_TX_OK ; drop: - dev->stats.tx_dropped++; +dev_core_stats_tx_dropped_inc (dev);vxlan_vnifilter_count (netdev_priv (dev), vni,NULL ,VXLAN_VNI_STATS_TX_DROPS ,0 );dev_kfree_skb (skb);
@@ -2844,7 +2844,7 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev) !is_multicast_ether_addr(eth->h_dest))vxlan_fdb_miss (vxlan, eth->h_dest); - dev->stats.tx_dropped++; +dev_core_stats_tx_dropped_inc (dev);vxlan_vnifilter_count (vxlan, vni,NULL ,VXLAN_VNI_STATS_TX_DROPS ,0 );kfree_skb (skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/301 vxlan: Add missing VNI filter counter update in arp_reduce().
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit b22ea4ef4c3438817fcb604255b55b0058ed8c64 ]
VXLAN stores per-VNI statistics using vxlan_vnifilter_count(). These statistics were not updated when arp_reduce() failed its pskb_may_pull() call.
Use vxlan_vnifilter_count() to update the VNI counter when that happens.
--- drivers/net/vxlan/vxlan_core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/vxlan/vxlan_core.c +2 -0
@@ -1838,6 +1838,8 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni)if (!pskb_may_pull (skb,arp_hdr_len (dev))) {dev_core_stats_tx_dropped_inc (dev); +vxlan_vnifilter_count (vxlan, vni,NULL , +VXLAN_VNI_STATS_TX_DROPS ,0 ); goto out; } parp =arp_hdr (skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/301 ASoC: meson: axg-fifo: use FIELD helpers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 9e6f39535c794adea6ba802a52c722d193c28124 ]
Use FIELD_GET() and FIELD_PREP() helpers instead of doing it manually.
Stable-dep-of: b11d26660dff ("ASoC: meson: axg-fifo: use threaded irq to check periods")
--- sound/soc/meson/axg-fifo.c | 25 +++++++++++++------------ sound/soc/meson/axg-fifo.h | 12 +++++------- sound/soc/meson/axg-frddr.c | 5 +++-- sound/soc/meson/axg-toddr.c | 22 ++++++++++------------ 4 files changed, 31 insertions(+), 33 deletions(-)
sound/soc/meson/axg-fifo.c +13 -12
@@ -3,6 +3,7 @@// Copyright (c) 2018 BayLibre, SAS. // Author: Jerome Brunet <[email protected]> +#include <linux/bitfield.h> #include <linux/clk.h> #include <linux/of_irq.h> #include <linux/of_platform.h>
@@ -145,8 +146,8 @@ int axg_fifo_pcm_hw_params(struct snd_soc_component *component,/* Enable irq if necessary */ irq_en = runtime->no_period_wakeup ?0 :FIFO_INT_COUNT_REPEAT ;regmap_update_bits (fifo->map,FIFO_CTRL0 , -CTRL0_INT_EN (FIFO_INT_COUNT_REPEAT ), -CTRL0_INT_EN (irq_en)); +CTRL0_INT_EN , +FIELD_PREP (CTRL0_INT_EN , irq_en));return 0 ; }
@@ -176,9 +177,9 @@ int axg_fifo_pcm_hw_free(struct snd_soc_component *component, {struct axg_fifo *fifo =axg_fifo_data (ss); -/* Disable the block count irq */ +/* Disable irqs */ regmap_update_bits (fifo->map,FIFO_CTRL0 , -CTRL0_INT_EN (FIFO_INT_COUNT_REPEAT ),0 ); +CTRL0_INT_EN ,0 );return 0 ; }
@@ -187,13 +188,13 @@ EXPORT_SYMBOL_GPL(axg_fifo_pcm_hw_free);static void axg_fifo_ack_irq (struct axg_fifo *fifo,u8 mask) {regmap_update_bits (fifo->map,FIFO_CTRL1 , -CTRL1_INT_CLR (FIFO_INT_MASK ), -CTRL1_INT_CLR (mask)); +CTRL1_INT_CLR , +FIELD_PREP (CTRL1_INT_CLR , mask));/* Clear must also be cleared */ regmap_update_bits (fifo->map,FIFO_CTRL1 , -CTRL1_INT_CLR (FIFO_INT_MASK ), -0 ); +CTRL1_INT_CLR , +FIELD_PREP (CTRL1_INT_CLR ,0 )); }static irqreturn_t axg_fifo_pcm_irq_block (int irq,void *dev_id)
@@ -204,7 +205,7 @@ static irqreturn_t axg_fifo_pcm_irq_block(int irq, void *dev_id)regmap_read (fifo->map,FIFO_STATUS1 , &status); - status =STATUS1_INT_STS (status) &FIFO_INT_MASK ; + status =FIELD_GET (STATUS1_INT_STS , status);if (status &FIFO_INT_COUNT_REPEAT )snd_pcm_period_elapsed (ss);else
@@ -254,15 +255,15 @@ int axg_fifo_pcm_open(struct snd_soc_component *component,/* Setup status2 so it reports the memory pointer */ regmap_update_bits (fifo->map,FIFO_CTRL1 , -CTRL1_STATUS2_SEL_MASK , -CTRL1_STATUS2_SEL (STATUS2_SEL_DDR_READ )); +CTRL1_STATUS2_SEL , +FIELD_PREP (CTRL1_STATUS2_SEL ,STATUS2_SEL_DDR_READ ));/* Make sure the dma is initially disabled */ __dma_enable (fifo, false);/* Disable irqs until params are ready */ regmap_update_bits (fifo->map,FIFO_CTRL0 , -CTRL0_INT_EN (FIFO_INT_MASK ),0 ); +CTRL0_INT_EN ,0 );/* Clear any pending interrupt */ axg_fifo_ack_irq (fifo,FIFO_INT_MASK );
sound/soc/meson/axg-fifo.h +5 -7
@@ -42,21 +42,19 @@ struct snd_soc_pcm_runtime;#define FIFO_CTRL0 0x00#define CTRL0_DMA_EN BIT(31) -#define CTRL0_INT_EN (x) ((x) << 16) +#define CTRL0_INT_EN GENMASK(23, 16)#define CTRL0_SEL_MASK GENMASK(2, 0)#define CTRL0_SEL_SHIFT 0#define FIFO_CTRL1 0x04 -#define CTRL1_INT_CLR (x) ((x) << 0) -#define CTRL1_STATUS2_SEL_MASK GENMASK(11, 8) -#define CTRL1_STATUS2_SEL (x) ((x) << 8) +#define CTRL1_INT_CLR GENMASK(7, 0) +#define CTRL1_STATUS2_SEL GENMASK(11, 8)#define STATUS2_SEL_DDR_READ 0 -#define CTRL1_FRDDR_DEPTH_MASK GENMASK(31, 24) -#define CTRL1_FRDDR_DEPTH (x) ((x) << 24) +#define CTRL1_FRDDR_DEPTH GENMASK(31, 24)#define FIFO_START_ADDR 0x08#define FIFO_FINISH_ADDR 0x0c#define FIFO_INT_ADDR 0x10#define FIFO_STATUS1 0x14 -#define STATUS1_INT_STS (x) ((x) << 0) +#define STATUS1_INT_STS GENMASK(7, 0)#define FIFO_STATUS2 0x18#define FIFO_INIT_ADDR 0x24#define FIFO_CTRL2 0x28
sound/soc/meson/axg-frddr.c +3 -2
@@ -7,6 +7,7 @@* This driver implements the frontend playback DAI of AXG and G12A based SoCs */ +#include <linux/bitfield.h> #include <linux/clk.h> #include <linux/regmap.h> #include <linux/module.h>
@@ -59,8 +60,8 @@ static int axg_frddr_dai_hw_params(struct snd_pcm_substream *substream,/* Trim the FIFO depth if the period is small to improve latency */ depth =min (period, fifo->depth); val = (depth /AXG_FIFO_BURST ) -1 ; -regmap_update_bits (fifo->map,FIFO_CTRL1 ,CTRL1_FRDDR_DEPTH_MASK , -CTRL1_FRDDR_DEPTH (val)); +regmap_update_bits (fifo->map,FIFO_CTRL1 ,CTRL1_FRDDR_DEPTH , +FIELD_PREP (CTRL1_FRDDR_DEPTH , val));return 0 ; }
sound/soc/meson/axg-toddr.c +10 -12
@@ -5,6 +5,7 @@/* This driver implements the frontend capture DAI of AXG based SoCs */ +#include <linux/bitfield.h> #include <linux/clk.h> #include <linux/regmap.h> #include <linux/module.h>
@@ -19,12 +20,9 @@#define CTRL0_TODDR_EXT_SIGNED BIT(29)#define CTRL0_TODDR_PP_MODE BIT(28)#define CTRL0_TODDR_SYNC_CH BIT(27) -#define CTRL0_TODDR_TYPE_MASK GENMASK(15, 13) -#define CTRL0_TODDR_TYPE (x) ((x) << 13) -#define CTRL0_TODDR_MSB_POS_MASK GENMASK(12, 8) -#define CTRL0_TODDR_MSB_POS (x) ((x) << 8) -#define CTRL0_TODDR_LSB_POS_MASK GENMASK(7, 3) -#define CTRL0_TODDR_LSB_POS (x) ((x) << 3) +#define CTRL0_TODDR_TYPE GENMASK(15, 13) +#define CTRL0_TODDR_MSB_POS GENMASK(12, 8) +#define CTRL0_TODDR_LSB_POS GENMASK(7, 3)#define CTRL1_TODDR_FORCE_FINISH BIT(25)#define CTRL1_SEL_SHIFT 28
@@ -76,12 +74,12 @@ static int axg_toddr_dai_hw_params(struct snd_pcm_substream *substream, width =params_width (params);regmap_update_bits (fifo->map,FIFO_CTRL0 , -CTRL0_TODDR_TYPE_MASK | -CTRL0_TODDR_MSB_POS_MASK | -CTRL0_TODDR_LSB_POS_MASK , -CTRL0_TODDR_TYPE (type) | -CTRL0_TODDR_MSB_POS (TODDR_MSB_POS ) | -CTRL0_TODDR_LSB_POS (TODDR_MSB_POS - (width -1 ))); +CTRL0_TODDR_TYPE | +CTRL0_TODDR_MSB_POS | +CTRL0_TODDR_LSB_POS , +FIELD_PREP (CTRL0_TODDR_TYPE , type) | +FIELD_PREP (CTRL0_TODDR_MSB_POS ,TODDR_MSB_POS ) | +FIELD_PREP (CTRL0_TODDR_LSB_POS ,TODDR_MSB_POS - (width -1 )));return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/301 ASoC: meson: axg-fifo: use threaded irq to check periods
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit b11d26660dff8d7430892008616452dc8e5fb0f3 ]
With the AXG audio subsystem, there is a possible random channel shift on TDM capture, when the slot number per lane is more than 2, and there is more than one lane used.
The problem has been there since the introduction of the axg audio support but such scenario is pretty uncommon. This is why there is no loud complains about the problem.
Solving the problem require to make the links non-atomic and use the trigger() callback to start FEs and BEs in the appropriate order.
This was tried in the past and reverted because it caused the block irq to sleep while atomic. However, instead of reverting, the solution is to call snd_pcm_period_elapsed() in a non atomic context.
Use the bottom half of a threaded IRQ to do so.
--- sound/soc/meson/axg-fifo.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-)
sound/soc/meson/axg-fifo.c +19 -10
@@ -204,18 +204,26 @@ static irqreturn_t axg_fifo_pcm_irq_block(int irq, void *dev_id)unsigned int status;regmap_read (fifo->map,FIFO_STATUS1 , &status); - status =FIELD_GET (STATUS1_INT_STS , status); +axg_fifo_ack_irq (fifo, status); + +/* Use the thread to call period elapsed on nonatomic links */ if (status &FIFO_INT_COUNT_REPEAT ) -snd_pcm_period_elapsed (ss); -else -dev_dbg (axg_fifo_dev (ss),"unexpected irq - STS 0x%02x\n" , - status); +return IRQ_WAKE_THREAD ; -/* Ack irqs */ -axg_fifo_ack_irq (fifo, status); +dev_dbg (axg_fifo_dev (ss),"unexpected irq - STS 0x%02x\n" , + status); + +return IRQ_NONE ; +} + +static irqreturn_t axg_fifo_pcm_irq_block_thread (int irq,void *dev_id) +{ +struct snd_pcm_substream *ss = dev_id; + +snd_pcm_period_elapsed (ss); -return IRQ_RETVAL (status); +return IRQ_HANDLED ; } int axg_fifo_pcm_open(struct snd_soc_component *component,
@@ -243,8 +251,9 @@ int axg_fifo_pcm_open(struct snd_soc_component *component,if (ret)return ret; - ret =request_irq (fifo->irq, axg_fifo_pcm_irq_block,0 , -dev_name (dev), ss); + ret =request_threaded_irq (fifo->irq, axg_fifo_pcm_irq_block, + axg_fifo_pcm_irq_block_thread, +IRQF_ONESHOT ,dev_name (dev), ss);if (ret)return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/301 ASoC: meson: axg-card: make links nonatomic
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit dcba52ace7d4c12e2c8c273eff55ea03a84c8baf ]
Non atomic operations need to be performed in the trigger callback of the TDM interfaces. Those are BEs but what matters is the nonatomic flag of the FE in the DPCM context. Just set nonatomic for everything so, at least, what is done is clear.
--- sound/soc/meson/axg-card.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/meson/axg-card.c +1 -0
@@ -318,6 +318,7 @@ static int axg_card_add_link(struct snd_soc_card *card, struct device_node *np, dai_link->cpus = cpu; dai_link->num_cpus =1 ; + dai_link->nonatomic = true; ret =meson_card_parse_dai (card, np, dai_link->cpus);if (ret)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/301 ASoC: meson: axg-tdm-interface: manage formatters in trigger
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit f949ed458ad15a00d41b37c745ebadaef171aaae ]
So far, the formatters have been reset/enabled using the .prepare() callback. This was done in this callback because walking the formatters use a mutex. A mutex is used because formatter handling require dealing possibly slow clock operation.
With the support of non-atomic, .trigger() callback may be used which also allows to properly enable and disable formatters on start but also pause/resume.
This solve a random shift on TDMIN as well repeated samples on for TDMOUT.
--- sound/soc/meson/axg-tdm-interface.c | 34 ++++++++++++++++------------- 1 file changed, 19 insertions(+), 15 deletions(-)
sound/soc/meson/axg-tdm-interface.c +19 -15
@@ -349,26 +349,31 @@ static int axg_tdm_iface_hw_params(struct snd_pcm_substream *substream,return 0 ; } -static int axg_tdm_iface_hw_free (struct snd_pcm_substream *substream, +static int axg_tdm_iface_trigger (struct snd_pcm_substream *substream, +int cmd,struct snd_soc_dai *dai) { -struct axg_tdm_stream *ts =snd_soc_dai_get_dma_data (dai, substream); +struct axg_tdm_stream *ts = +snd_soc_dai_get_dma_data (dai, substream); -/* Stop all attached formatters */ -axg_tdm_stream_stop (ts); +switch (cmd) { +case SNDRV_PCM_TRIGGER_START : +case SNDRV_PCM_TRIGGER_RESUME : +case SNDRV_PCM_TRIGGER_PAUSE_RELEASE : +axg_tdm_stream_start (ts); +break ; +case SNDRV_PCM_TRIGGER_SUSPEND : +case SNDRV_PCM_TRIGGER_PAUSE_PUSH : +case SNDRV_PCM_TRIGGER_STOP : +axg_tdm_stream_stop (ts); +break ; +default : +return -EINVAL ; + }return 0 ; } -static int axg_tdm_iface_prepare (struct snd_pcm_substream *substream, -struct snd_soc_dai *dai) -{ -struct axg_tdm_stream *ts =snd_soc_dai_get_dma_data (dai, substream); - -/* Force all attached formatters to update */ -return axg_tdm_stream_reset (ts); -} -static int axg_tdm_iface_remove_dai (struct snd_soc_dai *dai) {int stream;
@@ -412,8 +417,7 @@ static const struct snd_soc_dai_ops axg_tdm_iface_ops = { .set_fmt = axg_tdm_iface_set_fmt, .startup = axg_tdm_iface_startup, .hw_params = axg_tdm_iface_hw_params, - .prepare = axg_tdm_iface_prepare, - .hw_free = axg_tdm_iface_hw_free, + .trigger = axg_tdm_iface_trigger, };/* TDM Backend DAIs */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/301 ASoC: meson: cards: select SND_DYNAMIC_MINORS
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 6db26f9ea4edd8a17d39ab3c20111e3ccd704aef ]
Amlogic sound cards do create a lot of pcm interfaces, possibly more than
8. Some pcm interfaces are internal (like DPCM backends and c2c) and not exposed to userspace.
Those interfaces still increase the number passed to snd_find_free_minor(), which eventually exceeds 8 causing -EBUSY error on card registration if CONFIG_SND_DYNAMIC_MINORS=n and the interface is exposed to userspace.
select CONFIG_SND_DYNAMIC_MINORS for Amlogic cards to avoid the problem.
--- sound/soc/meson/Kconfig | 1 + 1 file changed, 1 insertion(+)
sound/soc/meson/Kconfig +1 -0
@@ -99,6 +99,7 @@ config SND_MESON_AXG_PDM config SND_MESON_CARD_UTILS tristate + select SND_DYNAMIC_MINORS config SND_MESON_CODEC_GLUE tristate
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/301 ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit c158cf914713efc3bcdc25680c7156c48c12ef6a ]
The documentation for device_get_named_child_node() mentions this important point:
"
The caller is responsible for calling fwnode_handle_put() on the returned fwnode pointer.
"
Add fwnode_handle_put() to avoid a leaked reference.
Message-ID: <[email protected]>
--- sound/hda/intel-sdw-acpi.c | 2 ++ 1 file changed, 2 insertions(+)
sound/hda/intel-sdw-acpi.c +2 -0
@@ -41,6 +41,8 @@ static bool is_link_enabled(struct fwnode_handle *fw_node, u8 idx)"intel-quirk-mask" , &quirk_mask); +fwnode_handle_put (link); +if (quirk_mask &SDW_INTEL_QUIRK_MASK_BUS_DISABLE )return false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/301 s390/cio: Ensure the copied buf is NUL terminated
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Quang Minh <[email protected]>
[ Upstream commit da7c622cddd4fe36be69ca61e8c42e43cde94784 ]
Currently, we allocate a lbuf-sized kernel buffer and copy lbuf from userspace to that buffer. Later, we use scanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using scanf. Fix this issue by using memdup_user_nul instead.
--- drivers/s390/cio/cio_inject.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/s390/cio/cio_inject.c +1 -1
@@ -95,7 +95,7 @@ static ssize_t crw_inject_write(struct file *file, const char __user *buf,return -EINVAL ; } - buffer =vmemdup_user (buf, lbuf); + buffer =memdup_user_nul (buf, lbuf);if (IS_ERR (buffer))return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/301 cxgb4: Properly lock TX queue for the selftest.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 9067eccdd7849dd120d5495dbd5a686fa6ed2c1a ]
The selftest for the driver sends a dummy packet and checks if the packet will be received properly as it should be. The regular TX path and the selftest can use the same network queue so locking is required and was missing in the selftest path. This was addressed in the commit cited below.
Unfortunately locking the TX queue requires BH to be disabled which is not the case in selftest path which is invoked in process context. Lockdep should be complaining about this.
Use __netif_tx_lock_bh() for TX queue locking.
--- drivers/net/ethernet/chelsio/cxgb4/sge.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/chelsio/cxgb4/sge.c +3 -3
@@ -2684,12 +2684,12 @@ int cxgb4_selftest_lb_pkt(struct net_device *netdev) lb->loopback =1 ; q = &adap->sge.ethtxq[pi->first_qset]; -__netif_tx_lock (q->txq,smp_processor_id ()); +__netif_tx_lock_bh (q->txq);reclaim_completed_tx (adap, &q->q,-1 , true); credits =txq_avail (&q->q) - ndesc;if (unlikely (credits <0 )) { -__netif_tx_unlock (q->txq); +__netif_tx_unlock_bh (q->txq);return -ENOMEM ; }
@@ -2724,7 +2724,7 @@ int cxgb4_selftest_lb_pkt(struct net_device *netdev)init_completion (&lb->completion);txq_advance (&q->q, ndesc);cxgb4_ring_tx_db (adap, &q->q, ndesc); -__netif_tx_unlock (q->txq); +__netif_tx_unlock_bh (q->txq);/* wait for the pkt to return */ ret =wait_for_completion_timeout (&lb->completion,10 *HZ );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/301 net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <[email protected]>
[ Upstream commit b9a61c20179fda7bdfe2c1210aa72451991ab81a ]
The Topaz family (88E6141 and 88E6341) only support 256 Forwarding Information Tables.
--- drivers/net/dsa/mv88e6xxx/chip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/dsa/mv88e6xxx/chip.c +2 -2
@@ -5588,7 +5588,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { .prod_num = MV88E6XXX_PORT_SWITCH_ID_PROD_6141, .family = MV88E6XXX_FAMILY_6341, .name = "Marvell 88E6141", - .num_databases = 4096, + .num_databases = 256, .num_macs = 2048, .num_ports = 6, .num_internal_phys = 5,
@@ -6047,7 +6047,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { .prod_num = MV88E6XXX_PORT_SWITCH_ID_PROD_6341, .family = MV88E6XXX_FAMILY_6341, .name = "Marvell 88E6341", - .num_databases = 4096, + .num_databases = 256, .num_macs = 2048, .num_internal_phys = 5, .num_ports = 6,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/301 drm/amdgpu: fix doorbell regression
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shashank Sharma <[email protected]>
[ Upstream commit 705d0480e6ae5a73ca3a9c04316d0678e19a46ed ]
This patch adds a missed handling of PL domain doorbell while handling VRAM faults.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +1 -1
@@ -424,7 +424,7 @@ bool amdgpu_res_cpu_visible(struct amdgpu_device *adev,return false;if (res->mem_type ==TTM_PL_SYSTEM || res->mem_type ==TTM_PL_TT || - res->mem_type ==AMDGPU_PL_PREEMPT ) + res->mem_type ==AMDGPU_PL_PREEMPT || res->mem_type ==AMDGPU_PL_DOORBELL )return true;if (res->mem_type !=TTM_PL_VRAM )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/301 spi: fix null pointer dereference within spi_sync
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mans Rullgard <[email protected]>
[ Upstream commit 4756fa529b2f12b7cb8f21fe229b0f6f47190829 ]
If spi_sync() is called with the non-empty queue and the same spi_message is then reused, the complete callback for the message remains set while the context is cleared, leading to a null pointer dereference when the callback is invoked from spi_finalize_current_message().
With function inlining disabled, the call stack might look like this:
_raw_spin_lock_irqsave from complete_with_flags+0x18/0x58 complete_with_flags from spi_complete+0x8/0xc
spi_complete from spi_finalize_current_message+0xec/0x184 spi_finalize_current_message from spi_transfer_one_message+0x2a8/0x474 spi_transfer_one_message from __spi_pump_transfer_message+0x104/0x230 __spi_pump_transfer_message from __spi_transfer_message_noqueue+0x30/0xc4 __spi_transfer_message_noqueue from __spi_sync+0x204/0x248 __spi_sync from spi_sync+0x24/0x3c
spi_sync from mcp251xfd_regmap_crc_read+0x124/0x28c [mcp251xfd] mcp251xfd_regmap_crc_read [mcp251xfd] from _regmap_raw_read+0xf8/0x154 _regmap_raw_read from _regmap_bus_read+0x44/0x70
_regmap_bus_read from _regmap_read+0x60/0xd8
_regmap_read from regmap_read+0x3c/0x5c
regmap_read from mcp251xfd_alloc_can_err_skb+0x1c/0x54 [mcp251xfd] mcp251xfd_alloc_can_err_skb [mcp251xfd] from mcp251xfd_irq+0x194/0xe70 [mcp251xfd] mcp251xfd_irq [mcp251xfd] from irq_thread_fn+0x1c/0x78
irq_thread_fn from irq_thread+0x118/0x1f4
irq_thread from kthread+0xd8/0xf4
kthread from ret_from_fork+0x14/0x28
Fix this by also setting message->complete to NULL when the transfer is complete.
--- drivers/spi/spi.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi.c +1 -0
@@ -4261,6 +4261,7 @@ static int __spi_sync(struct spi_device *spi, struct spi_message *message)wait_for_completion (&done); status = message->status; } + message->complete =NULL ; message->context =NULL ;return status;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/301 net: bridge: fix multicast-to-unicast with fraglist GSO
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 59c878cbcdd80ed39315573b3511d0acfd3501b5 ]
Calling skb_copy on a SKB_GSO_FRAGLIST skb is not valid, since it returns an invalid linearized skb. This code only needs to change the ethernet header, so pskb_copy is the right function to call here.
--- net/bridge/br_forward.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bridge/br_forward.c +1 -1
@@ -266,7 +266,7 @@ static void maybe_deliver_addr(struct net_bridge_port *p, struct sk_buff *skb,if (skb->dev == p->dev &ðer_addr_equal (src, addr))return ; - skb =skb_copy (skb,GFP_ATOMIC ); + skb =pskb_copy (skb,GFP_ATOMIC );if (!skb) {DEV_STATS_INC (dev, tx_dropped);return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/301 net: core: reject skb_copy(_expand) for fraglist GSO skbs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit d091e579b864fa790dd6a0cd537a22c383126681 ]
SKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become invalid. Return NULL if such an skb is passed to skb_copy or skb_copy_expand, in order to prevent a crash on a potential later call to skb_gso_segment.
--- net/core/skbuff.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-)
net/core/skbuff.c +19 -8
@@ -1971,11 +1971,17 @@ static inline int skb_alloc_rx_flag(const struct sk_buff *skb)struct sk_buff *skb_copy (const struct sk_buff *skb,gfp_t gfp_mask) { -int headerlen =skb_headroom (skb); -unsigned int size =skb_end_offset (skb) + skb->data_len; -struct sk_buff *n =__alloc_skb (size, gfp_mask, -skb_alloc_rx_flag (skb),NUMA_NO_NODE ); +struct sk_buff *n; +unsigned int size; +int headerlen; + +if (WARN_ON_ONCE (skb_shinfo (skb)->gso_type &SKB_GSO_FRAGLIST )) +return NULL ; + headerlen =skb_headroom (skb); + size =skb_end_offset (skb) + skb->data_len; + n =__alloc_skb (size, gfp_mask, +skb_alloc_rx_flag (skb),NUMA_NO_NODE );if (!n)return NULL ;
@@ -2303,12 +2309,17 @@ struct sk_buff *skb_copy_expand(const struct sk_buff *skb,/* * Allocate the copy buffer */ -struct sk_buff *n =__alloc_skb (newheadroom + skb->len + newtailroom, - gfp_mask,skb_alloc_rx_flag (skb), -NUMA_NO_NODE ); -int oldheadroom =skb_headroom (skb);int head_copy_len, head_copy_off; +struct sk_buff *n; +int oldheadroom; + +if (WARN_ON_ONCE (skb_shinfo (skb)->gso_type &SKB_GSO_FRAGLIST )) +return NULL ; + oldheadroom =skb_headroom (skb); + n =__alloc_skb (newheadroom + skb->len + newtailroom, + gfp_mask,skb_alloc_rx_flag (skb), +NUMA_NO_NODE );if (!n)return NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/301 rxrpc: Clients must accept conn from any address
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeffrey Altman <[email protected]>
[ Upstream commit 8953285d7bd63c12b007432a9b4587fa2fad49fb ]
The find connection logic of Transarc's Rx was modified in the mid-1990s to support multi-homed servers which might send a response packet from an address other than the destination address in the received packet. The rules for accepting a packet by an Rx initiator (RX_CLIENT_CONNECTION) were altered to permit acceptance of a packet from any address provided that the port number was unchanged and all of the connection identifiers matched (Epoch, CID, SecurityClass, ...).
This change applies the same rules to the Linux implementation which makes it consistent with IBM AFS 3.6, Arla, OpenAFS and AuriStorFS.
--- net/rxrpc/conn_object.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
net/rxrpc/conn_object.c +2 -7
@@ -118,18 +118,13 @@ struct rxrpc_connection *rxrpc_find_client_connection_rcu(struct rxrpc_local *loswitch (srx->transport.family) {case AF_INET :if (peer->srx.transport.sin.sin_port != - srx->transport.sin.sin_port || - peer->srx.transport.sin.sin_addr.s_addr != - srx->transport.sin.sin_addr.s_addr) + srx->transport.sin.sin_port) goto not_found;break ;#ifdef CONFIG_AF_RXRPC_IPV6 case AF_INET6 :if (peer->srx.transport.sin6.sin6_port != - srx->transport.sin6.sin6_port || -memcmp (&peer->srx.transport.sin6.sin6_addr, - &srx->transport.sin6.sin6_addr, -sizeof (struct in6_addr )) !=0 ) + srx->transport.sin6.sin6_port) goto not_found;break ;#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/301 tipc: fix a possible memleak in tipc_buf_append
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 97bf6f81b29a8efaf5d0983251a7450e5794370d ]
__skb_linearize() doesn't free the skb when it fails, so move '*buf = NULL' after __skb_linearize(), so that the skb can be freed on the err path.
--- net/tipc/msg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tipc/msg.c +1 -1
@@ -142,9 +142,9 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)if (fragid ==FIRST_FRAGMENT ) {if (unlikely (head)) goto err; - *buf =NULL ;if (skb_has_frag_list (frag) &&__skb_linearize (frag)) goto err; + *buf =NULL ; frag =skb_unshare (frag,GFP_ATOMIC );if (unlikely (!frag)) goto err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/301 vxlan: Pull inner IP header in vxlan_rcv().
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit f7789419137b18e3847d0cc41afd788c3c00663d ]
Ensure the inner IP header is part of skb's linear data before reading its ECN bits. Otherwise we might read garbage.
One symptom is the system erroneously logging errors like "vxlan: non-ECT from xxx.xxx.xxx.xxx with TOS=xxxx".
Similar bugs have been fixed in geneve, ip_tunnel and ip6_tunnel (see commit 1ca1ba465e55 ("geneve: make sure to pull inner header in geneve_rx()") for example). So let's reuse the same code structure for consistency. Maybe we'll can add a common helper in the future.
--- drivers/net/vxlan/vxlan_core.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
drivers/net/vxlan/vxlan_core.c +18 -1
@@ -1674,6 +1674,7 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)bool raw_proto = false;void *oiph;__be32 vni =0 ; +int nh;/* Need UDP and VXLAN header to be present */ if (!pskb_may_pull (skb,VXLAN_HLEN ))
@@ -1762,9 +1763,25 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb) skb->pkt_type =PACKET_HOST ; } - oiph =skb_network_header (skb); +/* Save offset of outer header relative to skb->head, +* because we are going to reset the network header to the inner header +* and might change skb->head. +*/ + nh =skb_network_header (skb) - skb->head; +skb_reset_network_header (skb); +if (!pskb_inet_may_pull (skb)) { +DEV_STATS_INC (vxlan->dev, rx_length_errors); +DEV_STATS_INC (vxlan->dev, rx_errors); +vxlan_vnifilter_count (vxlan, vni, vninode, +VXLAN_VNI_STATS_RX_ERRORS ,0 ); + goto drop; + } + +/* Get the outer header. */ + oiph = skb->head + nh; +if (!vxlan_ecn_decapsulate (vs, oiph, skb)) {DEV_STATS_INC (vxlan->dev, rx_frame_errors);DEV_STATS_INC (vxlan->dev, rx_errors);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/301 s390/qeth: Fix kernel panic after setting hsuid
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandra Winter <[email protected]>
[ Upstream commit 8a2e4d37afb8500b276e5ee903dee06f50ab0494 ]
Symptom:
When the hsuid attribute is set for the first time on an IQD Layer3 device while the corresponding network interface is already UP, the kernel will try to execute a napi function pointer that is NULL.
Example:
---------------------------------------------------------------------------
[ 2057.572696] illegal operation: 0001 ilc:1 [#1] SMP
[ 2057.572702] Modules linked in: af_iucv qeth_l3 zfcp scsi_transport_fc sunrpc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6
nft_reject nft_ct nf_tables_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink ghash_s390 prng xts aes_s390 des_s390 de
s_generic sha3_512_s390 sha3_256_s390 sha512_s390 vfio_ccw vfio_mdev mdev vfio_iommu_type1 eadm_sch vfio ext4 mbcache jbd2 qeth_l2 bridge stp llc dasd_eckd_mod qeth dasd_mod
qdio ccwgroup pkey zcrypt
[ 2057.572739] CPU: 6 PID: 60182 Comm: stress_client Kdump: loaded Not tainted 4.18.0-541.el8.s390x #1
[ 2057.572742] Hardware name: IBM 3931 A01 704 (LPAR)
[ 2057.572744] Krnl PSW : 0704f00180000000 0000000000000002 (0x2)
[ 2057.572748] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3
[ 2057.572751] Krnl GPRS: 0000000000000004 0000000000000000 00000000a3b008d8 0000000000000000
[ 2057.572754] 00000000a3b008d8 cb923a29c779abc5 0000000000000000 00000000814cfd80
[ 2057.572756] 000000000000012c 0000000000000000 00000000a3b008d8 00000000a3b008d8
[ 2057.572758] 00000000bab6d500 00000000814cfd80 0000000091317e46 00000000814cfc68
[ 2057.572762] Krnl Code:#0000000000000000: 0000 illegal
>0000000000000002: 0000 illegal
0000000000000004: 0000 illegal
0000000000000006: 0000 illegal
0000000000000008: 0000 illegal
000000000000000a: 0000 illegal
000000000000000c: 0000 illegal
000000000000000e: 0000 illegal
[ 2057.572800] Call Trace:
[ 2057.572801] ([<00000000ec639700>] 0xec639700)
[ 2057.572803] [<00000000913183e2>] net_rx_action+0x2ba/0x398
[ 2057.572809] [<0000000091515f76>] __do_softirq+0x11e/0x3a0
[ 2057.572813] [<0000000090ce160c>] do_softirq_own_stack+0x3c/0x58
[ 2057.572817] ([<0000000090d2cbd6>] do_softirq.part.1+0x56/0x60)
[ 2057.572822] [<0000000090d2cc60>] __local_bh_enable_ip+0x80/0x98
[ 2057.572825] [<0000000091314706>] __dev_queue_xmit+0x2be/0xd70
[ 2057.572827] [<000003ff803dd6d6>] afiucv_hs_send+0x24e/0x300 [af_iucv]
[ 2057.572830] [<000003ff803dd88a>] iucv_send_ctrl+0x102/0x138 [af_iucv]
[ 2057.572833] [<000003ff803de72a>] iucv_sock_connect+0x37a/0x468 [af_iucv]
[ 2057.572835] [<00000000912e7e90>] __sys_connect+0xa0/0xd8
[ 2057.572839] [<00000000912e9580>] sys_socketcall+0x228/0x348
[ 2057.572841] [<0000000091514e1a>] system_call+0x2a6/0x2c8
[ 2057.572843] Last Breaking-Event-Address:
[ 2057.572844] [<0000000091317e44>] __napi_poll+0x4c/0x1d8
[ 2057.572846]
[ 2057.572847] Kernel panic - not syncing: Fatal exception in interrupt-------------------------------------------------------------------------------------------
Analysis:
There is one napi structure per out_q: card->qdio.out_qs[i].napi The napi.poll functions are set during qeth_open().
Since
commit 1cfef80d4c2b ("s390/qeth: Don't call dev_close/dev_open (DOWN/UP)") qeth_set_offline()/qeth_set_online() no longer call dev_close()/ dev_open(). So if qeth_free_qdio_queues() cleared card->qdio.out_qs[i].napi.poll while the network interface was UP and the card was offline, they are not set again.
Reproduction:
chzdev -e $devno layer2=0
ip link set dev $network_interface up
echo 0 > /sys/bus/ccwgroup/devices/0.0.$devno/online
echo foo > /sys/bus/ccwgroup/devices/0.0.$devno/hsuid
echo 1 > /sys/bus/ccwgroup/devices/0.0.$devno/online
-> Crash (can be enforced e.g. by af_iucv connect(), ip link down/up, ...)
Note that a Completion Queue (CQ) is only enabled or disabled, when hsuid is set for the first time or when it is removed.
Workarounds:
- Set hsuid before setting the device online for the first time or
- Use chzdev -d $devno; chzdev $devno hsuid=xxx; chzdev -e $devno; to set hsuid on an existing device. (this will remove and recreate the network interface)
Fix:
There is no need to free the output queues when a completion queue is added or removed.card->qdio.state now indicates whether the inbound buffer pool and the outbound queues are allocated.card->qdio.c_q indicates whether a CQ is allocated.
--- drivers/s390/net/qeth_core_main.c | 61 ++++++++++++++----------------- 1 file changed, 27 insertions(+), 34 deletions(-)
drivers/s390/net/qeth_core_main.c +27 -34
@@ -364,30 +364,33 @@ static int qeth_cq_init(struct qeth_card *card)return rc; } +static void qeth_free_cq (struct qeth_card *card) +{ +if (card->qdio.c_q) { +qeth_free_qdio_queue (card->qdio.c_q); + card->qdio.c_q =NULL ; + } +} +static int qeth_alloc_cq (struct qeth_card *card) {if (card->options.cq ==QETH_CQ_ENABLED ) {QETH_CARD_TEXT (card,2 ,"cqon" ); - card->qdio.c_q =qeth_alloc_qdio_queue ();if (!card->qdio.c_q) { -dev_err (&card->gdev->dev,"Failed to create completion queue\n" ); -return -ENOMEM ; + card->qdio.c_q =qeth_alloc_qdio_queue (); +if (!card->qdio.c_q) { +dev_err (&card->gdev->dev, +"Failed to create completion queue\n" ); +return -ENOMEM ; + } } }else {QETH_CARD_TEXT (card,2 ,"nocq" ); - card->qdio.c_q =NULL ; +qeth_free_cq (card); }return 0 ; } -static void qeth_free_cq (struct qeth_card *card) -{ -if (card->qdio.c_q) { -qeth_free_qdio_queue (card->qdio.c_q); - card->qdio.c_q =NULL ; - } -} -static enum iucv_tx_notify qeth_compute_cq_notification (int sbalf15,int delayed) {
@@ -2628,6 +2631,10 @@ static int qeth_alloc_qdio_queues(struct qeth_card *card)QETH_CARD_TEXT (card,2 ,"allcqdbf" ); +/* completion */ +if (qeth_alloc_cq (card)) + goto out_err; +if (atomic_cmpxchg (&card->qdio.state,QETH_QDIO_UNINITIALIZED ,QETH_QDIO_ALLOCATED ) !=QETH_QDIO_UNINITIALIZED )return 0 ;
@@ -2663,10 +2670,6 @@ static int qeth_alloc_qdio_queues(struct qeth_card *card) queue->priority =QETH_QIB_PQUE_PRIO_DEFAULT ; } -/* completion */ -if (qeth_alloc_cq (card)) - goto out_freeoutq; -return 0 ; out_freeoutq:
@@ -2677,6 +2680,8 @@ static int qeth_alloc_qdio_queues(struct qeth_card *card)qeth_free_buffer_pool (card); out_buffer_pool:atomic_set (&card->qdio.state,QETH_QDIO_UNINITIALIZED ); +qeth_free_cq (card); +out_err:return -ENOMEM ; }
@@ -2684,11 +2689,12 @@ static void qeth_free_qdio_queues(struct qeth_card *card) {int i, j; +qeth_free_cq (card); +if (atomic_xchg (&card->qdio.state,QETH_QDIO_UNINITIALIZED ) ==QETH_QDIO_UNINITIALIZED )return ; -qeth_free_cq (card);for (j =0 ; j <QDIO_MAX_BUFFERS_PER_Q ; ++j) {if (card->qdio.in_q->bufs[j].rx_skb) {consume_skb (card->qdio.in_q->bufs[j].rx_skb);
@@ -3742,24 +3748,11 @@ static void qeth_qdio_poll(struct ccw_device *cdev, unsigned long card_ptr)int qeth_configure_cq (struct qeth_card *card,enum qeth_cq cq) { -int rc; - -if (card->options.cq ==QETH_CQ_NOTAVAILABLE ) { - rc =-1 ; - goto out; - }else { -if (card->options.cq == cq) { - rc =0 ; - goto out; - } - -qeth_free_qdio_queues (card); - card->options.cq = cq; - rc =0 ; - } -out: -return rc; +if (card->options.cq ==QETH_CQ_NOTAVAILABLE ) +return -1 ; + card->options.cq = cq; +return 0 ; }EXPORT_SYMBOL_GPL (qeth_configure_cq);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/301 drm/panel: ili9341: Correct use of device property APIs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit d43cd48ef1791801c61a54fade4a88d294dedf77 ]
It seems driver missed the point of proper use of device property APIs. Correct this by updating headers and calls respectively.
--- drivers/gpu/drm/panel/Kconfig | 2 +- drivers/gpu/drm/panel/panel-ilitek-ili9341.c | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-)
drivers/gpu/drm/panel/Kconfig +1 -1
@@ -184,7 +184,7 @@ config DRM_PANEL_ILITEK_IL9322 config DRM_PANEL_ILITEK_ILI9341 tristate "Ilitek ILI9341 240x320 QVGA panels" - depends on OF && SPI + depends on SPI select DRM_KMS_HELPER select DRM_GEM_DMA_HELPER depends on BACKLIGHT_CLASS_DEVICE
drivers/gpu/drm/panel/panel-ilitek-ili9341.c +3 -2
@@ -22,8 +22,9 @@#include <linux/bitops.h> #include <linux/delay.h> #include <linux/gpio/consumer.h> +#include <linux/mod_devicetable.h> #include <linux/module.h> -#include <linux/of.h> +#include <linux/property.h> #include <linux/regulator/consumer.h> #include <linux/spi/spi.h>
@@ -691,7 +692,7 @@ static int ili9341_dpi_probe(struct spi_device *spi, struct gpio_desc *dc,* Every new incarnation of this display must have a unique * data entry for the system in this driver. */ - ili->conf =of_device_get_match_data (dev); + ili->conf =device_get_match_data (dev);if (!ili->conf) {dev_err (dev,"missing device configuration\n" );return -ENODEV ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/301 drm/panel: ili9341: Respect deferred probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 740fc1e0509be3f7e2207e89125b06119ed62943 ]
GPIO controller might not be available when driver is being probed. There are plenty of reasons why, one of which is deferred probe.
Since GPIOs are optional, return any error code we got to the upper layer, including deferred probe. With that in mind, use dev_err_probe() in order to avoid spamming the logs.
--- drivers/gpu/drm/panel/panel-ilitek-ili9341.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/panel/panel-ilitek-ili9341.c +2 -2
@@ -715,11 +715,11 @@ static int ili9341_probe(struct spi_device *spi) reset =devm_gpiod_get_optional (dev,"reset" ,GPIOD_OUT_HIGH );if (IS_ERR (reset)) -dev_err (dev,"Failed to get gpio 'reset'\n" ); +return dev_err_probe (dev,PTR_ERR (reset),"Failed to get gpio 'reset'\n" ); dc =devm_gpiod_get_optional (dev,"dc" ,GPIOD_OUT_LOW );if (IS_ERR (dc)) -dev_err (dev,"Failed to get gpio 'dc'\n" ); +return dev_err_probe (dev,PTR_ERR (dc),"Failed to get gpio 'dc'\n" );if (!strcmp (id->name,"sf-tc240t-9370-t" ))return ili9341_dpi_probe (spi, dc, reset);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/301 drm/panel: ili9341: Use predefined error codes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit da85f0aaa9f21999753b01d45c0343f885a8f905 ]
In one case the -1 is returned which is quite confusing code for the wrong device ID, in another the ret is returning instead of plain 0 that also confusing as readed may ask the possible meaning of positive codes, which are never the case there. Convert both to use explicit predefined error codes to make it clear what's going on there.
--- drivers/gpu/drm/panel/panel-ilitek-ili9341.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/panel/panel-ilitek-ili9341.c +2 -2
@@ -422,7 +422,7 @@ static int ili9341_dpi_prepare(struct drm_panel *panel)ili9341_dpi_init (ili); -return ret; +return 0 ; }static int ili9341_dpi_enable (struct drm_panel *panel)
@@ -726,7 +726,7 @@ static int ili9341_probe(struct spi_device *spi)else if (!strcmp (id->name,"yx240qv29" ))return ili9341_dbi_probe (spi, dc, reset); -return -1 ; +return -ENODEV ; }static void ili9341_remove (struct spi_device *spi)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/301 ipv4: Fix uninit-value access in __ip_make_skb()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <[email protected]>
[ Upstream commit fc1092f51567277509563800a3c56732070b6aa4 ]
KMSAN reported uninit-value access in __ip_make_skb() [1]. __ip_make_skb() tests HDRINCL to know if the skb has icmphdr. However, HDRINCL can cause a race condition. If calling setsockopt(2) with IP_HDRINCL changes HDRINCL while __ip_make_skb() is running, the function will access icmphdr in the skb even if it is not included. This causes the issue reported by KMSAN.
Check FLOWI_FLAG_KNOWN_NH on fl4->flowi4_flags instead of testing HDRINCL on the socket.
Also, fl4->fl4_icmp_type and fl4->fl4_icmp_code are not initialized. These are union in struct flowi4 and are implicitly initialized by flowi4_init_output(), but we should not rely on specific union layout.
Initialize these explicitly in raw_sendmsg().
[1]
BUG: KMSAN: uninit-value in __ip_make_skb+0x2b74/0x2d20 net/ipv4/ip_output.c:1481 __ip_make_skb+0x2b74/0x2d20 net/ipv4/ip_output.c:1481 ip_finish_skb include/net/ip.h:243 [inline] ip_push_pending_frames+0x4c/0x5c0 net/ipv4/ip_output.c:1508 raw_sendmsg+0x2381/0x2690 net/ipv4/raw.c:654 inet_sendmsg+0x27b/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x274/0x3c0 net/socket.c:745 __sys_sendto+0x62c/0x7b0 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x130/0x200 net/socket.c:2199 do_syscall_64+0xd8/0x1f0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6d/0x75
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3804 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc_node+0x5f6/0xc50 mm/slub.c:3888 kmalloc_reserve+0x13c/0x4a0 net/core/skbuff.c:577 __alloc_skb+0x35a/0x7c0 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1318 [inline] __ip_append_data+0x49ab/0x68c0 net/ipv4/ip_output.c:1128 ip_append_data+0x1e7/0x260 net/ipv4/ip_output.c:1365 raw_sendmsg+0x22b1/0x2690 net/ipv4/raw.c:648 inet_sendmsg+0x27b/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x274/0x3c0 net/socket.c:745 __sys_sendto+0x62c/0x7b0 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x130/0x200 net/socket.c:2199 do_syscall_64+0xd8/0x1f0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6d/0x75 CPU: 1 PID: 15709 Comm: syz-executor.7 Not tainted 6.8.0-11567-gb3603fcb79b1 #25 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014
--- net/ipv4/ip_output.c | 2 +- net/ipv4/raw.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-)
net/ipv4/ip_output.c +1 -1
@@ -1469,7 +1469,7 @@ struct sk_buff *__ip_make_skb(struct sock *sk,* by icmp_hdr(skb)->type. */ if (sk->sk_type ==SOCK_RAW && - !inet_test_bit (HDRINCL , sk)) + !(fl4->flowi4_flags &FLOWI_FLAG_KNOWN_NH )) icmp_type = fl4->fl4_icmp_type;else icmp_type =icmp_hdr (skb)->type;
net/ipv4/raw.c +3 -0
@@ -604,6 +604,9 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) (hdrincl ?FLOWI_FLAG_KNOWN_NH :0 ), daddr, saddr, 0, 0, sk->sk_uid); + fl4.fl4_icmp_type =0 ; + fl4.fl4_icmp_code =0 ; +if (!hdrincl) { rfv.msg = msg; rfv.hlen =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/301 net: gro: parse ipv6 ext headers without frag0 invalidation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Gobert <[email protected]>
[ Upstream commit dff0b0161ad571f888d37f5e7163a07dcafdef60 ]
The existing code always pulls the IPv6 header and sets the transport offset initially. Then optionally again pulls any extension headers in ipv6_gso_pull_exthdrs and sets the transport offset again on return from that call. skb->data is set at the start of the first extension header before calling ipv6_gso_pull_exthdrs, and must disable the frag0 optimization because that function uses pskb_may_pull/pskb_pull instead of skb_gro_ helpers. It sets the GRO offset to the TCP header with skb_gro_pull and sets the transport header. Then returns skb->data to its position before this block.
This commit introduces a new helper function - ipv6_gro_pull_exthdrs - which is used in ipv6_gro_receive to pull ipv6 ext headers instead of ipv6_gso_pull_exthdrs. Thus, there is no modification of skb->data, all operations use skb_gro_* helpers, and the frag0 fast path can be taken for IPv6 packets with ext headers.
Stable-dep-of: 5ef31ea5d053 ("net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb")
--- net/ipv6/ip6_offload.c | 51 +++++++++++++++++++++++++++++++++--------- 1 file changed, 41 insertions(+), 10 deletions(-)
net/ipv6/ip6_offload.c +41 -10
@@ -37,6 +37,40 @@INDIRECT_CALL_L4 (cb, f2, f1, head, skb); \ }) +static int ipv6_gro_pull_exthdrs (struct sk_buff *skb,int off,int proto) +{ +const struct net_offload *ops =NULL ; +struct ipv6_opt_hdr *opth; + +for (;;) { +int len; + + ops =rcu_dereference (inet6_offloads[proto]); + +if (unlikely (!ops)) +break ; + +if (!(ops->flags &INET6_PROTO_GSO_EXTHDR )) +break ; + + opth =skb_gro_header (skb, off +sizeof (*opth), off); +if (unlikely (!opth)) +break ; + + len =ipv6_optlen (opth); + + opth =skb_gro_header (skb, off + len, off); +if (unlikely (!opth)) +break ; + proto = opth->nexthdr; + + off += len; + } + +skb_gro_pull (skb, off -skb_network_offset (skb)); +return proto; +} +static int ipv6_gso_pull_exthdrs (struct sk_buff *skb,int proto) {const struct net_offload *ops =NULL ;
@@ -206,28 +240,25 @@ INDIRECT_CALLABLE_SCOPE struct sk_buff *ipv6_gro_receive(struct list_head *head, goto out;skb_set_network_header (skb, off); -skb_gro_pull (skb,sizeof (*iph)); -skb_set_transport_header (skb,skb_gro_offset (skb)); - flush +=ntohs (iph->payload_len) !=skb_gro_len (skb); + flush +=ntohs (iph->payload_len) != skb->len - hlen; proto = iph->nexthdr; ops =rcu_dereference (inet6_offloads[proto]);if (!ops || !ops->callbacks.gro_receive) { -pskb_pull (skb,skb_gro_offset (skb)); -skb_gro_frag0_invalidate (skb); - proto =ipv6_gso_pull_exthdrs (skb, proto); -skb_gro_pull (skb, -skb_transport_offset (skb)); -skb_reset_transport_header (skb); -__skb_push (skb,skb_gro_offset (skb)); + proto =ipv6_gro_pull_exthdrs (skb, hlen, proto); ops =rcu_dereference (inet6_offloads[proto]);if (!ops || !ops->callbacks.gro_receive) goto out; - iph =ipv6_hdr (skb); + iph =skb_gro_network_header (skb); + }else { +skb_gro_pull (skb,sizeof (*iph)); } +skb_set_transport_header (skb,skb_gro_offset (skb)); +NAPI_GRO_CB (skb)->proto = proto; flush--;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/301 net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Gobert <[email protected]>
[ Upstream commit 5ef31ea5d053a8f493a772ebad3f3ce82c35d845 ]
Commits a602456 ("udp: Add GRO functions to UDP socket") and 57c67ff ("udp:
additional GRO support") introduce incorrect usage of {ip,ipv6}_hdr in the complete phase of gro. The functions always return skb->network_header, which in the case of encapsulated packets at the gro complete phase, is always set to the innermost L3 of the packet. That means that calling {ip,ipv6}_hdr for skbs which completed the GRO receive phase (both in gro_list and *_gro_complete) when parsing an encapsulated packet's _outer_ L3/L4 may return an unexpected value.
This incorrect usage leads to a bug in GRO's UDP socket lookup. udp{4,6}_lib_lookup_skb functions use ip_hdr/ipv6_hdr respectively. These *_hdr functions return network_header which will point to the innermost L3, resulting in the wrong offset being used in __udp{4,6}_lib_lookup with encapsulated packets.
This patch adds network_offset and inner_network_offset to napi_gro_cb, and makes sure both are set correctly.
To fix the issue, network_offsets union is used inside napi_gro_cb, in which both the outer and the inner network offsets are saved.
Reproduction example:
Endpoint configuration example (fou + local address bind)
# ip fou add port 6666 ipproto 4
# ip link add name tun1 type ipip remote 2.2.2.1 local 2.2.2.2 encap fou encap-dport 5555 encap-sport 6666 mode ipip
# ip link set tun1 up
# ip a add 1.1.1.2/24 dev tun1Netperf TCP_STREAM result on net-next before patch is applied:
net-next main, GRO enabled:
$ netperf -H 1.1.1.2 -t TCP_STREAM -l 5
Recv Send Send
Socket Socket Message Elapsed
Size Size Size Time Throughput
bytes bytes bytes secs. 10^6bits/sec131072 16384 16384 5.28 2.37
net-next main, GRO disabled:
$ netperf -H 1.1.1.2 -t TCP_STREAM -l 5
Recv Send Send
Socket Socket Message Elapsed
Size Size Size Time Throughput
bytes bytes bytes secs. 10^6bits/sec131072 16384 16384 5.01 2745.06
patch applied, GRO enabled:
$ netperf -H 1.1.1.2 -t TCP_STREAM -l 5
Recv Send Send
Socket Socket Message Elapsed
Size Size Size Time Throughput
bytes bytes bytes secs. 10^6bits/sec131072 16384 16384 5.01 2877.38
--- include/net/gro.h | 9 +++++++++ net/8021q/vlan_core.c | 2 ++ net/core/gro.c | 1 + net/ipv4/af_inet.c | 1 + net/ipv4/udp.c | 3 ++- net/ipv4/udp_offload.c | 3 ++- net/ipv6/ip6_offload.c | 1 + net/ipv6/udp.c | 3 ++- net/ipv6/udp_offload.c | 3 ++- 9 files changed, 22 insertions(+), 4 deletions(-)
include/net/gro.h +9 -0
@@ -86,6 +86,15 @@ struct napi_gro_cb {/* used to support CHECKSUM_COMPLETE for tunneling protocols */ __wsum csum; + +/* L3 offsets */ +union { +struct { +u16 network_offset; +u16 inner_network_offset; + }; +u16 network_offsets[2 ]; + }; };#define NAPI_GRO_CB (skb) ((struct napi_gro_cb *)(skb)->cb)
net/8021q/vlan_core.c +2 -0
@@ -478,6 +478,8 @@ static struct sk_buff *vlan_gro_receive(struct list_head *head,if (unlikely (!vhdr)) goto out; +NAPI_GRO_CB (skb)->network_offsets[NAPI_GRO_CB (skb)->encap_mark] = hlen; + type = vhdr->h_vlan_encapsulated_proto; ptype =gro_find_receive_by_type (type);
net/core/gro.c +1 -0
@@ -373,6 +373,7 @@ static inline void skb_gro_reset_offset(struct sk_buff *skb, u32 nhoff)const struct skb_shared_info *pinfo =skb_shinfo (skb);const skb_frag_t *frag0 = &pinfo->frags[0 ]; +NAPI_GRO_CB (skb)->network_offset =0 ;NAPI_GRO_CB (skb)->data_offset =0 ;NAPI_GRO_CB (skb)->frag0 =NULL ;NAPI_GRO_CB (skb)->frag0_len =0 ;
net/ipv4/af_inet.c +1 -0
@@ -1571,6 +1571,7 @@ struct sk_buff *inet_gro_receive(struct list_head *head, struct sk_buff *skb)/* The above will be needed by the transport layer if there is one * immediately following this IP hdr. */ +NAPI_GRO_CB (skb)->inner_network_offset = off;/* Note : No need to call skb_gro_postpull_rcsum() here, * as we already checked checksum over ipv4 header was 0
net/ipv4/udp.c +2 -1
@@ -534,7 +534,8 @@ static inline struct sock *__udp4_lib_lookup_skb(struct sk_buff *skb,struct sock *udp4_lib_lookup_skb (const struct sk_buff *skb,__be16 sport,__be16 dport) { -const struct iphdr *iph =ip_hdr (skb); +const u16 offset =NAPI_GRO_CB (skb)->network_offsets[skb->encapsulation]; +const struct iphdr *iph = (struct iphdr *)(skb->data + offset);struct net *net =dev_net (skb->dev);int iif, sdif;
net/ipv4/udp_offload.c +2 -1
@@ -718,7 +718,8 @@ EXPORT_SYMBOL(udp_gro_complete); INDIRECT_CALLABLE_SCOPE int udp4_gro_complete(struct sk_buff *skb, int nhoff) { -const struct iphdr *iph =ip_hdr (skb); +const u16 offset =NAPI_GRO_CB (skb)->network_offsets[skb->encapsulation]; +const struct iphdr *iph = (struct iphdr *)(skb->data + offset);struct udphdr *uh = (struct udphdr *)(skb->data + nhoff);/* do fraglist only if there is no outer UDP encap (or we already processed it) */
net/ipv6/ip6_offload.c +1 -0
@@ -240,6 +240,7 @@ INDIRECT_CALLABLE_SCOPE struct sk_buff *ipv6_gro_receive(struct list_head *head, goto out;skb_set_network_header (skb, off); +NAPI_GRO_CB (skb)->inner_network_offset = off; flush +=ntohs (iph->payload_len) != skb->len - hlen;
net/ipv6/udp.c +2 -1
@@ -275,7 +275,8 @@ static struct sock *__udp6_lib_lookup_skb(struct sk_buff *skb,struct sock *udp6_lib_lookup_skb (const struct sk_buff *skb,__be16 sport,__be16 dport) { -const struct ipv6hdr *iph =ipv6_hdr (skb); +const u16 offset =NAPI_GRO_CB (skb)->network_offsets[skb->encapsulation]; +const struct ipv6hdr *iph = (struct ipv6hdr *)(skb->data + offset);struct net *net =dev_net (skb->dev);int iif, sdif;
net/ipv6/udp_offload.c +2 -1
@@ -164,7 +164,8 @@ struct sk_buff *udp6_gro_receive(struct list_head *head, struct sk_buff *skb) INDIRECT_CALLABLE_SCOPE int udp6_gro_complete(struct sk_buff *skb, int nhoff) { -const struct ipv6hdr *ipv6h =ipv6_hdr (skb); +const u16 offset =NAPI_GRO_CB (skb)->network_offsets[skb->encapsulation]; +const struct ipv6hdr *ipv6h = (struct ipv6hdr *)(skb->data + offset);struct udphdr *uh = (struct udphdr *)(skb->data + nhoff);/* do fraglist only if there is no outer UDP encap (or we already processed it) */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/301 net: gro: add flush check in udp_gro_receive_segment
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Gobert <[email protected]>
[ Upstream commit 5babae777c61aa8a8679d59d3cdc54165ad96d42 ]
GRO-GSO path is supposed to be transparent and as such L3 flush checks are relevant to all UDP flows merging in GRO. This patch uses the same logic and code from tcp_gro_receive, terminating merge if flush is non zero.
--- net/ipv4/udp_offload.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
net/ipv4/udp_offload.c +11 -1
@@ -471,6 +471,7 @@ static struct sk_buff *udp_gro_receive_segment(struct list_head *head,struct sk_buff *p;unsigned int ulen;int ret =0 ; +int flush;/* requires non zero csum, for symmetry with GSO */ if (!uh->check) {
@@ -504,13 +505,22 @@ static struct sk_buff *udp_gro_receive_segment(struct list_head *head,return p; } + flush =NAPI_GRO_CB (p)->flush; + +if (NAPI_GRO_CB (p)->flush_id !=1 || +NAPI_GRO_CB (p)->count !=1 || + !NAPI_GRO_CB (p)->is_atomic) + flush |=NAPI_GRO_CB (p)->flush_id; +else +NAPI_GRO_CB (p)->is_atomic = false; +/* Terminate the flow on len mismatch or if it grow "too much". * Under small packet flood GRO count could elsewhere grow a lot * leading to excessive truesize values. * On len mismatch merge the first packet shorter than gso_size, * otherwise complete the GRO packet. */ -if (ulen >ntohs (uh2->len)) { +if (ulen >ntohs (uh2->len) || flush) { pp = p; }else {if (NAPI_GRO_CB (skb)->is_flist) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/301 clk: qcom: smd-rpm: Restore msm8976 num_clk
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Skladowski <[email protected]>
[ Upstream commit 0d4ce2458cd7d1d66a5ee2f3c036592fb663d5bc ]
During rework somehow msm8976 num_clk got removed, restore it.
--- drivers/clk/qcom/clk-smd-rpm.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/qcom/clk-smd-rpm.c +1 -0
@@ -758,6 +758,7 @@ static struct clk_smd_rpm *msm8976_clks[] = {static const struct rpm_smd_clk_desc rpm_clk_msm8976 = { .clks = msm8976_clks, + .num_clks =ARRAY_SIZE (msm8976_clks), .icc_clks = bimc_pcnoc_snoc_smmnoc_icc_clks, .num_icc_clks =ARRAY_SIZE (bimc_pcnoc_snoc_smmnoc_icc_clks), };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/301 clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jernej Skrabec <[email protected]>
[ Upstream commit 7e91ed763dc07437777bd012af7a2bd4493731ff ]
While PLL CPUX clock rate change when CPU is running from it works in vast majority of cases, now and then it causes instability. This leads to system crashes and other undefined behaviour. After a lot of testing (30+ hours) while also doing a lot of frequency switches, we can't observe any instability issues anymore when doing reparenting to stable clock like 24 MHz oscillator.
--- drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
drivers/clk/sunxi-ng/ccu-sun50i-h6.c +17 -2
@@ -1181,11 +1181,18 @@ static const u32 usb2_clk_regs[] = { SUN50I_H6_USB3_CLK_REG, }; +static struct ccu_mux_nb sun50i_h6_cpu_nb = { + .common = &cpux_clk.common, + .cm = &cpux_clk.mux, + .delay_us =1 , + .bypass_index =0 ,/* index of 24 MHz oscillator */ +}; +static int sun50i_h6_ccu_probe (struct platform_device *pdev) {void __iomem *reg; +int i, ret;u32 val; -int i; reg =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (reg))
@@ -1252,7 +1259,15 @@ static int sun50i_h6_ccu_probe(struct platform_device *pdev) val |=BIT (24 );writel (val, reg +SUN50I_H6_HDMI_CEC_CLK_REG ); -return devm_sunxi_ccu_probe (&pdev->dev, reg, &sun50i_h6_ccu_desc); + ret =devm_sunxi_ccu_probe (&pdev->dev, reg, &sun50i_h6_ccu_desc); +if (ret) +return ret; + +/* Reparent CPU during PLL CPUX rate changes */ +ccu_mux_notifier_register (pll_cpux_clk.common.hw.clk, + &sun50i_h6_cpu_nb); + +return 0 ; }static const struct of_device_id sun50i_h6_ccu_ids[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/301 powerpc/pseries: make max polling consistent for longer H_CALLs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nayna Jain <[email protected]>
[ Upstream commit 784354349d2c988590c63a5a001ca37b2a6d4da1 ]
Currently, plpks_confirm_object_flushed() function polls for 5msec in total instead of 5sec.
Keep max polling time consistent for all the H_CALLs, which take longer than expected, to be 5sec. Also, make use of fsleep() everywhere to insert delay.
--- arch/powerpc/include/asm/plpks.h | 5 ++--- arch/powerpc/platforms/pseries/plpks.c | 10 +++++----- 2 files changed, 7 insertions(+), 8 deletions(-)
arch/powerpc/include/asm/plpks.h +2 -3
@@ -44,9 +44,8 @@#define PLPKS_MAX_DATA_SIZE 4000// Timeouts for PLPKS operations -#define PLPKS_MAX_TIMEOUT 5000 // msec -#define PLPKS_FLUSH_SLEEP 10 // msec -#define PLPKS_FLUSH_SLEEP_RANGE 400 +#define PLPKS_MAX_TIMEOUT (5 * USEC_PER_SEC) +#define PLPKS_FLUSH_SLEEP 10000 // usecstruct plpks_var {char *component;
arch/powerpc/platforms/pseries/plpks.c +5 -5
@@ -415,8 +415,7 @@ static int plpks_confirm_object_flushed(struct label *label,break ; } -usleep_range (PLPKS_FLUSH_SLEEP , -PLPKS_FLUSH_SLEEP +PLPKS_FLUSH_SLEEP_RANGE ); +fsleep (PLPKS_FLUSH_SLEEP ); timeout = timeout +PLPKS_FLUSH_SLEEP ; }while (timeout <PLPKS_MAX_TIMEOUT );
@@ -464,9 +463,10 @@ int plpks_signed_update_var(struct plpks_var *var, u64 flags) continuetoken = retbuf[0 ];if (pseries_status_to_err (rc) == -EBUSY ) { -int delay_ms =get_longbusy_msecs (rc); -mdelay (delay_ms); - timeout += delay_ms; +int delay_us =get_longbusy_msecs (rc) *1000 ; + +fsleep (delay_us); + timeout += delay_us; } rc =pseries_status_to_err (rc); }while (rc == -EBUSY && timeout <PLPKS_MAX_TIMEOUT );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/301 powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaurav Batra <[email protected]>
[ Upstream commit 49a940dbdc3107fecd5e6d3063dc07128177e058 ]
At the time of LPAR boot up, partition firmware provides Open Firmware property ibm,dma-window for the PE. This property is provided on the PCI bus the PE is attached to.
There are execptions where the partition firmware might not provide this property for the PE at the time of LPAR boot up. One of the scenario is where the firmware has frozen the PE due to some error condition. This PE is frozen for 24 hours or unless the whole system is reinitialized.
Within this time frame, if the LPAR is booted, the frozen PE will be presented to the LPAR but ibm,dma-window property could be missing.
Today, under these circumstances, the LPAR oopses with NULL pointer dereference, when configuring the PCI bus the PE is attached to.
BUG: Kernel NULL pointer dereference on read at 0x000000c8
Faulting instruction address: 0xc0000000001024c0
Oops: Kernel access of bad area, sig: 7 [#1]
LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
Modules linked in:
Supported: Yes
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.4.0-150600.9-default #1
Hardware name: IBM,9043-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_023) hv:phyp pSeries
NIP: c0000000001024c0 LR: c0000000001024b0 CTR: c000000000102450
REGS: c0000000037db5c0 TRAP: 0300 Not tainted (6.4.0-150600.9-default)
MSR: 8000000002009033 <SF,VEC,EE,ME,IR,DR,RI,LE> CR: 28000822 XER: 00000000
CFAR: c00000000010254c DAR: 00000000000000c8 DSISR: 00080000 IRQMASK: 0
...
NIP [c0000000001024c0] pci_dma_bus_setup_pSeriesLP+0x70/0x2a0
LR [c0000000001024b0] pci_dma_bus_setup_pSeriesLP+0x60/0x2a0
Call Trace:
pci_dma_bus_setup_pSeriesLP+0x60/0x2a0 (unreliable)
pcibios_setup_bus_self+0x1c0/0x370
__of_scan_bus+0x2f8/0x330
pcibios_scan_phb+0x280/0x3d0
pcibios_init+0x88/0x12c
do_one_initcall+0x60/0x320
kernel_init_freeable+0x344/0x3e4
kernel_init+0x34/0x1d0
ret_from_kernel_user_thread+0x14/0x1c--- arch/powerpc/platforms/pseries/iommu.c | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/powerpc/platforms/pseries/iommu.c +8 -0
@@ -786,8 +786,16 @@ static void pci_dma_bus_setup_pSeriesLP(struct pci_bus *bus)* parent bus. During reboot, there will be ibm,dma-window property to * define DMA window. For kdump, there will at least be default window or DDW * or both. +* There is an exception to the above. In case the PE goes into frozen +* state, firmware may not provide ibm,dma-window property at the time +* of LPAR boot up. */ +if (!pdn) { +pr_debug (" no ibm,dma-window property !\n" ); +return ; + } + ppci =PCI_DN (pdn); pr_debug(" parent is %pOF, iommu_table: 0x%p\n",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/301 swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
[ Upstream commit 75961ffb5cb3e5196f19cae7683f35cc88b50800 ]
Using restricted DMA pools (CONFIG_DMA_RESTRICTED_POOL=y) in conjunction with dynamic SWIOTLB (CONFIG_SWIOTLB_DYNAMIC=y) leads to the following crash when initialising the restricted pools at boot-time:
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 | Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP | pc : rmem_swiotlb_device_init+0xfc/0x1ec | lr : rmem_swiotlb_device_init+0xf0/0x1ec | Call trace: | rmem_swiotlb_device_init+0xfc/0x1ec | of_reserved_mem_device_init_by_idx+0x18c/0x238 | of_dma_configure_id+0x31c/0x33c | platform_dma_configure+0x34/0x80
faddr2line reveals that the crash is in the list validation code:
include/linux/list.h:83
include/linux/rculist.h:79
include/linux/rculist.h:106
kernel/dma/swiotlb.c:306
kernel/dma/swiotlb.c:1695
because add_mem_pool() is trying to list_add_rcu() to a NULL 'mem->pools'.
Fix the crash by initialising the 'mem->pools' list_head in rmem_swiotlb_device_init() before calling add_mem_pool().
--- kernel/dma/swiotlb.c | 1 + 1 file changed, 1 insertion(+)
kernel/dma/swiotlb.c +1 -0
@@ -1692,6 +1692,7 @@ static int rmem_swiotlb_device_init(struct reserved_mem *rmem, mem->for_alloc = true;#ifdef CONFIG_SWIOTLB_DYNAMIC spin_lock_init (&mem->lock); +INIT_LIST_HEAD_RCU (&mem->pools);#endif add_mem_pool (mem, pool);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/301 KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
[ Upstream commit 4e7728c81a54b17bd33be402ac140bc11bb0c4f4 ]
When parsing a GICv2 attribute that contains a cpuid, handle this as the vcpu_id, not a vcpu_idx, as userspace cannot really know the mapping between the two. For this, use kvm_get_vcpu_by_id() instead of kvm_get_vcpu().
Take this opportunity to get rid of the pointless check against online_vcpus, which doesn't make much sense either, and switch to FIELD_GET as a way to extract the vcpu_id.
Stable-dep-of: 6ddb4f372fc6 ("KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()")
--- arch/arm64/kvm/vgic/vgic-kvm-device.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
arch/arm64/kvm/vgic/vgic-kvm-device.c +2 -6
@@ -339,13 +339,9 @@ int vgic_v2_parse_attr(struct kvm_device *dev, struct kvm_device_attr *attr, {int cpuid; - cpuid = (attr->attr &KVM_DEV_ARM_VGIC_CPUID_MASK ) >> -KVM_DEV_ARM_VGIC_CPUID_SHIFT ; + cpuid =FIELD_GET (KVM_DEV_ARM_VGIC_CPUID_MASK , attr->attr); -if (cpuid >=atomic_read (&dev->kvm->online_vcpus)) -return -EINVAL ; - - reg_attr->vcpu =kvm_get_vcpu (dev->kvm, cpuid); + reg_attr->vcpu =kvm_get_vcpu_by_id (dev->kvm, cpuid); reg_attr->addr = attr->attr &KVM_DEV_ARM_VGIC_OFFSET_MASK ;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/301 KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Upton <[email protected]>
[ Upstream commit 6ddb4f372fc63210034b903d96ebbeb3c7195adb ]
vgic_v2_parse_attr() is responsible for finding the vCPU that matches the user-provided CPUID, which (of course) may not be valid. If the ID is invalid, kvm_get_vcpu_by_id() returns NULL, which isn't handled gracefully.
Similar to the GICv3 uaccess flow, check that kvm_get_vcpu_by_id() actually returns something and fail the ioctl if not.
--- arch/arm64/kvm/vgic/vgic-kvm-device.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm64/kvm/vgic/vgic-kvm-device.c +4 -4
@@ -337,12 +337,12 @@ int kvm_register_vgic_device(unsigned long type)int vgic_v2_parse_attr (struct kvm_device *dev,struct kvm_device_attr *attr,struct vgic_reg_attr *reg_attr) { -int cpuid; +int cpuid =FIELD_GET (KVM_DEV_ARM_VGIC_CPUID_MASK , attr->attr); - cpuid =FIELD_GET (KVM_DEV_ARM_VGIC_CPUID_MASK , attr->attr); - - reg_attr->vcpu =kvm_get_vcpu_by_id (dev->kvm, cpuid); reg_attr->addr = attr->attr &KVM_DEV_ARM_VGIC_OFFSET_MASK ; + reg_attr->vcpu =kvm_get_vcpu_by_id (dev->kvm, cpuid); +if (!reg_attr->vcpu) +return -EINVAL ;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/301 scsi: ufs: core: Fix MCQ MAC configuration
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rohit Ner <[email protected]>
[ Upstream commit 767712f91de76abd22a45184e6e3440120b8bfce ]
As per JEDEC Standard No. 223E Section 5.9.2, the max # active commands value programmed by the host sw in MCQConfig.MAC should be one less than the actual value.
--- drivers/ufs/core/ufs-mcq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ufs/core/ufs-mcq.c +1 -1
@@ -94,7 +94,7 @@ void ufshcd_mcq_config_mac(struct ufs_hba *hba, u32 max_active_cmds) val =ufshcd_readl (hba,REG_UFS_MCQ_CFG ); val &= ~MCQ_CFG_MAC_MASK ; - val |=FIELD_PREP (MCQ_CFG_MAC_MASK , max_active_cmds); + val |=FIELD_PREP (MCQ_CFG_MAC_MASK , max_active_cmds -1 );ufshcd_writel (hba, val,REG_UFS_MCQ_CFG ); }EXPORT_SYMBOL_GPL (ufshcd_mcq_config_mac);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/301 scsi: lpfc: Move NPIVs transport unregistration to after resource clean up
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 4ddf01f2f1504fa08b766e8cfeec558e9f8eef6c ]
There are cases after NPIV deletion where the fabric switch still believes the NPIV is logged into the fabric. This occurs when a vport is unregistered before the Remove All DA_ID CT and LOGO ELS are sent to the fabric.
Currently fc_remove_host(), which calls dev_loss_tmo for all D_IDs including the fabric D_ID, removes the last ndlp reference and frees the ndlp rport object. This sometimes causes the race condition where the final DA_ID and LOGO are skipped from being sent to the fabric switch.
Fix by moving the fc_remove_host() and scsi_remove_host() calls after DA_ID and LOGO are sent.
--- drivers/scsi/lpfc/lpfc_vport.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/scsi/lpfc/lpfc_vport.c +4 -4
@@ -683,10 +683,6 @@ lpfc_vport_delete(struct fc_vport *fc_vport)lpfc_free_sysfs_attr (vport);lpfc_debugfs_terminate (vport); -/* Remove FC host to break driver binding. */ -fc_remove_host (shost); -scsi_remove_host (shost); -/* Send the DA_ID and Fabric LOGO to cleanup Nameserver entries. */ ndlp =lpfc_findnode_did (vport, Fabric_DID);if (!ndlp)
@@ -730,6 +726,10 @@ lpfc_vport_delete(struct fc_vport *fc_vport) skip_logo: +/* Remove FC host to break driver binding. */ +fc_remove_host (shost); +scsi_remove_host (shost); +lpfc_cleanup (vport);/* Remove scsi host now. The nodes are cleaned up. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/301 scsi: lpfc: Remove IRQF_ONESHOT flag from threaded IRQ handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 4623713e7ade46bfc63a3eade836f566ccbcd771 ]
IRQF_ONESHOT is found to mask HBA generated interrupts when thread_fn is running. As a result, some EQEs/CQEs miss timely processing resulting in SCSI layer attempts to abort commands due to io_timeout. Abort CQEs are also not processed leading to the observations of hangs and spam of "0748 abort handler timed out waiting for aborting I/O" log messages.
Remove the IRQF_ONESHOT flag. The cmpxchg and xchg atomic operations on lpfc_queue->queue_claimed already protect potential parallel access to an EQ/CQ should the thread_fn get interrupted by the primary irq handler.
--- drivers/scsi/lpfc/lpfc_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/lpfc/lpfc_init.c +1 -1
@@ -13051,7 +13051,7 @@ lpfc_sli4_enable_msix(struct lpfc_hba *phba) rc =request_threaded_irq (eqhdl->irq, &lpfc_sli4_hba_intr_handler, &lpfc_sli4_hba_intr_handler_th, -IRQF_ONESHOT , name, eqhdl); +0 , name, eqhdl);if (rc) {lpfc_printf_log (phba,KERN_WARNING ,LOG_INIT , "0486 MSI-X fast-path (%d) "
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/301 scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit bb011631435c705cdeddca68d5c85fd40a4320f9 ]
Typically when an out of resource CQE status is detected, the lpfc_ramp_down_queue_handler() logic is called to help reduce I/O load by reducing an sdev's queue_depth.
However, the current lpfc_rampdown_queue_depth() logic does not help reduce queue_depth. num_cmd_success is never updated and is always zero, which means new_queue_depth will always be set to sdev->queue_depth. So, new_queue_depth = sdev->queue_depth - new_queue_depth always sets new_queue_depth to zero. And, scsi_change_queue_depth(sdev, 0) is essentially a no-op.
Change the lpfc_ramp_down_queue_handler() logic to set new_queue_depth equal to sdev->queue_depth subtracted from number of times num_rsrc_err was incremented. If num_rsrc_err is >= sdev->queue_depth, then set new_queue_depth equal to 1. Eventually, the frequency of Good_Status frames will signal SCSI upper layer to auto increase the queue_depth back to the driver default of 64 via scsi_handle_queue_ramp_up().
--- drivers/scsi/lpfc/lpfc.h | 1 - drivers/scsi/lpfc/lpfc_scsi.c | 13 ++++--------- 2 files changed, 4 insertions(+), 10 deletions(-)
drivers/scsi/lpfc/lpfc.h +0 -1
@@ -1325,7 +1325,6 @@ struct lpfc_hba {struct timer_list fabric_block_timer;unsigned long bit_flags;atomic_t num_rsrc_err; -atomic_t num_cmd_success;unsigned long last_rsrc_error_time;unsigned long last_ramp_down_time;#ifdef CONFIG_SCSI_LPFC_DEBUG_FS
drivers/scsi/lpfc/lpfc_scsi.c +4 -9
@@ -167,11 +167,10 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)struct Scsi_Host *shost;struct scsi_device *sdev;unsigned long new_queue_depth; -unsigned long num_rsrc_err, num_cmd_success; +unsigned long num_rsrc_err;int i; num_rsrc_err =atomic_read (&phba->num_rsrc_err); - num_cmd_success =atomic_read (&phba->num_cmd_success);/* * The error and success command counters are global per
@@ -186,20 +185,16 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)for (i =0 ; i <= phba->max_vports && vports[i] !=NULL ; i++) { shost =lpfc_shost_from_vport (vports[i]);shost_for_each_device (sdev, shost) { - new_queue_depth = - sdev->queue_depth * num_rsrc_err / - (num_rsrc_err + num_cmd_success); -if (!new_queue_depth) - new_queue_depth = sdev->queue_depth -1 ; +if (num_rsrc_err >= sdev->queue_depth) + new_queue_depth =1 ;else new_queue_depth = sdev->queue_depth - - new_queue_depth; + num_rsrc_err;scsi_change_queue_depth (sdev, new_queue_depth); } }lpfc_destroy_vport_work_array (phba, vports);atomic_set (&phba->num_rsrc_err,0 ); -atomic_set (&phba->num_cmd_success,0 ); }/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/301 scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit d11272be497e48a8e8f980470eb6b70e92eed0ce ]
The ndlp object update in lpfc_nvme_unregister_port() should be protected by the ndlp lock rather than hbalock.
--- drivers/scsi/lpfc/lpfc_nvme.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/lpfc/lpfc_nvme.c +2 -2
@@ -2614,9 +2614,9 @@ lpfc_nvme_unregister_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)/* No concern about the role change on the nvme remoteport. * The transport will update it. */ -spin_lock_irq (&vport->phba->hbalock); +spin_lock_irq (&ndlp->lock); ndlp->fc4_xpt_flags |=NVME_XPT_UNREG_WAIT ; -spin_unlock_irq (&vport->phba->hbalock); +spin_unlock_irq (&ndlp->lock);/* Don't let the host nvme transport keep sending keep-alives * on this remoteport. Vport is unloading, no recovery. The
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/301 scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit ded20192dff31c91cef2a04f7e20e60e9bb887d3 ]
lpfc_worker_wake_up() calls the lpfc_work_done() routine, which takes the hbalock. Thus, lpfc_worker_wake_up() should not be called while holding the hbalock to avoid potential deadlock.
--- drivers/scsi/lpfc/lpfc_els.c | 20 ++++++++++---------- drivers/scsi/lpfc/lpfc_hbadisc.c | 5 ++--- drivers/scsi/lpfc/lpfc_sli.c | 14 +++++++------- 3 files changed, 19 insertions(+), 20 deletions(-)
drivers/scsi/lpfc/lpfc_els.c +10 -10
@@ -4432,23 +4432,23 @@ lpfc_els_retry_delay(struct timer_list *t)unsigned long flags;struct lpfc_work_evt *evtp = &ndlp->els_retry_evt; +/* Hold a node reference for outstanding queued work */ +if (!lpfc_nlp_get (ndlp)) +return ; +spin_lock_irqsave (&phba->hbalock, flags);if (!list_empty (&evtp->evt_listp)) {spin_unlock_irqrestore (&phba->hbalock, flags); +lpfc_nlp_put (ndlp);return ; } -/* We need to hold the node by incrementing the reference -* count until the queued work is done -*/ - evtp->evt_arg1 =lpfc_nlp_get (ndlp); -if (evtp->evt_arg1) { - evtp->evt =LPFC_EVT_ELS_RETRY ; -list_add_tail (&evtp->evt_listp, &phba->work_list); -lpfc_worker_wake_up (phba); - } + evtp->evt_arg1 = ndlp; + evtp->evt =LPFC_EVT_ELS_RETRY ; +list_add_tail (&evtp->evt_listp, &phba->work_list);spin_unlock_irqrestore (&phba->hbalock, flags); -return ; + +lpfc_worker_wake_up (phba); }/**
drivers/scsi/lpfc/lpfc_hbadisc.c +2 -3
@@ -257,7 +257,9 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport *rport)if (evtp->evt_arg1) { evtp->evt =LPFC_EVT_DEV_LOSS ;list_add_tail (&evtp->evt_listp, &phba->work_list); +spin_unlock_irqrestore (&phba->hbalock, iflags);lpfc_worker_wake_up (phba); +return ; }spin_unlock_irqrestore (&phba->hbalock, iflags); }else {
@@ -275,10 +277,7 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport *rport)lpfc_disc_state_machine (vport, ndlp,NULL ,NLP_EVT_DEVICE_RM ); } - } - -return ; }/**
drivers/scsi/lpfc/lpfc_sli.c +7 -7
@@ -1217,9 +1217,9 @@ lpfc_set_rrq_active(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp, empty =list_empty (&phba->active_rrq_list);list_add_tail (&rrq->list, &phba->active_rrq_list); phba->hba_flag |=HBA_RRQ_ACTIVE ; +spin_unlock_irqrestore (&phba->hbalock, iflags);if (empty)lpfc_worker_wake_up (phba); -spin_unlock_irqrestore (&phba->hbalock, iflags);return 0 ; out:spin_unlock_irqrestore (&phba->hbalock, iflags);
@@ -11369,18 +11369,18 @@ lpfc_sli_post_recovery_event(struct lpfc_hba *phba,unsigned long iflags;struct lpfc_work_evt *evtp = &ndlp->recovery_evt; +/* Hold a node reference for outstanding queued work */ +if (!lpfc_nlp_get (ndlp)) +return ; +spin_lock_irqsave (&phba->hbalock, iflags);if (!list_empty (&evtp->evt_listp)) {spin_unlock_irqrestore (&phba->hbalock, iflags); +lpfc_nlp_put (ndlp);return ; } -/* Incrementing the reference count until the queued work is done. */ - evtp->evt_arg1 =lpfc_nlp_get (ndlp); -if (!evtp->evt_arg1) { -spin_unlock_irqrestore (&phba->hbalock, iflags); -return ; - } + evtp->evt_arg1 = ndlp; evtp->evt =LPFC_EVT_RECOVER_PORT ;list_add_tail (&evtp->evt_listp, &phba->work_list);spin_unlock_irqrestore (&phba->hbalock, iflags);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/301 scsi: lpfc: Use a dedicated lock for ras_fwlog state
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit f733a76ea0a9a84aee4ac41b81fad4d610ecbd8e ]
To reduce usage of and contention for hbalock, a separate dedicated lock is used to protect ras_fwlog state.
--- drivers/scsi/lpfc/lpfc.h | 1 + drivers/scsi/lpfc/lpfc_attr.c | 4 ++-- drivers/scsi/lpfc/lpfc_bsg.c | 20 ++++++++++---------- drivers/scsi/lpfc/lpfc_debugfs.c | 12 ++++++------ drivers/scsi/lpfc/lpfc_init.c | 3 +++ drivers/scsi/lpfc/lpfc_sli.c | 20 ++++++++++---------- 6 files changed, 32 insertions(+), 28 deletions(-)
drivers/scsi/lpfc/lpfc.h +1 -0
@@ -1429,6 +1429,7 @@ struct lpfc_hba {struct timer_list inactive_vmid_poll;/* RAS Support */ +spinlock_t ras_fwlog_lock;/* do not take while holding another lock */ struct lpfc_ras_fwlog ras_fwlog;uint32_t iocb_cnt;
drivers/scsi/lpfc/lpfc_attr.c +2 -2
@@ -5864,9 +5864,9 @@ lpfc_ras_fwlog_buffsize_set(struct lpfc_hba *phba, uint val)if (phba->cfg_ras_fwlog_func !=PCI_FUNC (phba->pcidev->devfn))return -EINVAL ; -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock); state = phba->ras_fwlog.state; -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock);if (state ==REG_INPROGRESS ) { lpfc_printf_log(phba, KERN_ERR, LOG_SLI, "6147 RAS Logging "
drivers/scsi/lpfc/lpfc_bsg.c +10 -10
@@ -5070,12 +5070,12 @@ lpfc_bsg_get_ras_config(struct bsg_job *job) bsg_reply->reply_data.vendor_reply.vendor_rsp;/* Current logging state */ -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock);if (ras_fwlog->state ==ACTIVE ) ras_reply->state =LPFC_RASLOG_STATE_RUNNING ;else ras_reply->state =LPFC_RASLOG_STATE_STOPPED ; -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock); ras_reply->log_level = phba->ras_fwlog.fw_loglevel; ras_reply->log_buff_sz = phba->cfg_ras_fwlog_buffsize;
@@ -5132,13 +5132,13 @@ lpfc_bsg_set_ras_config(struct bsg_job *job)if (action ==LPFC_RASACTION_STOP_LOGGING ) {/* Check if already disabled */ -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock);if (ras_fwlog->state !=ACTIVE ) { -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock); rc = -ESRCH ; goto ras_job_error; } -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock);/* Disable logging */ lpfc_ras_stop_fwlog (phba);
@@ -5149,10 +5149,10 @@ lpfc_bsg_set_ras_config(struct bsg_job *job)* FW-logging with new log-level. Return status * "Logging already Running" to caller. **/ -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock);if (ras_fwlog->state !=INACTIVE ) action_status = -EINPROGRESS ; -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock);/* Enable logging */ rc = lpfc_sli4_ras_fwlog_init(phba, log_level,
@@ -5268,13 +5268,13 @@ lpfc_bsg_get_ras_fwlog(struct bsg_job *job) goto ras_job_error;/* Logging to be stopped before reading */ -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock);if (ras_fwlog->state ==ACTIVE ) { -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock); rc = -EINPROGRESS ; goto ras_job_error; } -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock);if (job->request_len < sizeof(struct fc_bsg_request) +
drivers/scsi/lpfc/lpfc_debugfs.c +6 -6
@@ -2196,12 +2196,12 @@ static int lpfc_debugfs_ras_log_data(struct lpfc_hba *phba,memset (buffer,0 , size); -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock);if (phba->ras_fwlog.state !=ACTIVE ) { -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock);return -EINVAL ; } -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock);list_for_each_entry_safe (dmabuf, next, &phba->ras_fwlog.fwlog_buff_list, list) {
@@ -2252,13 +2252,13 @@ lpfc_debugfs_ras_log_open(struct inode *inode, struct file *file)int size;int rc = -ENOMEM ; -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock);if (phba->ras_fwlog.state !=ACTIVE ) { -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock); rc = -EINVAL ; goto out; } -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock);if (check_mul_overflow (LPFC_RAS_MIN_BUFF_POST_SIZE , phba->cfg_ras_fwlog_buffsize, &size))
drivers/scsi/lpfc/lpfc_init.c +3 -0
@@ -7698,6 +7698,9 @@ lpfc_setup_driver_resource_phase1(struct lpfc_hba *phba) "NVME" : " "), (phba->nvmet_support ? "NVMET" : " ")); +/* ras_fwlog state */ +spin_lock_init (&phba->ras_fwlog_lock); +/* Initialize the IO buffer list used by driver for SLI3 SCSI */ spin_lock_init (&phba->scsi_buf_list_get_lock);INIT_LIST_HEAD (&phba->lpfc_scsi_buf_list_get);
drivers/scsi/lpfc/lpfc_sli.c +10 -10
@@ -6844,9 +6844,9 @@ lpfc_ras_stop_fwlog(struct lpfc_hba *phba) {struct lpfc_ras_fwlog *ras_fwlog = &phba->ras_fwlog; -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock); ras_fwlog->state =INACTIVE ; -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock);/* Disable FW logging to host memory */ writel(LPFC_CTL_PDEV_CTL_DDL_RAS,
@@ -6889,9 +6889,9 @@ lpfc_sli4_ras_dma_free(struct lpfc_hba *phba) ras_fwlog->lwpd.virt =NULL ; } -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock); ras_fwlog->state =INACTIVE ; -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock); }/**
@@ -6993,9 +6993,9 @@ lpfc_sli4_ras_mbox_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb) goto disable_ras; } -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock); ras_fwlog->state =ACTIVE ; -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock);mempool_free (pmb, phba->mbox_mem_pool);return ;
@@ -7027,9 +7027,9 @@ lpfc_sli4_ras_fwlog_init(struct lpfc_hba *phba,uint32_t len =0 , fwlog_buffsize, fwlog_entry_count;int rc =0 ; -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock); ras_fwlog->state =INACTIVE ; -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock); fwlog_buffsize = (LPFC_RAS_MIN_BUFF_POST_SIZE * phba->cfg_ras_fwlog_buffsize);
@@ -7090,9 +7090,9 @@ lpfc_sli4_ras_fwlog_init(struct lpfc_hba *phba, mbx_fwlog->u.request.lwpd.addr_lo =putPaddrLow (ras_fwlog->lwpd.phys); mbx_fwlog->u.request.lwpd.addr_hi =putPaddrHigh (ras_fwlog->lwpd.phys); -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock); ras_fwlog->state =REG_INPROGRESS ; -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock); mbox->vport = phba->pport; mbox->mbox_cmpl = lpfc_sli4_ras_mbox_cmpl;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/301 gfs2: Fix invalid metadata access in punch_hole
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Price <[email protected]>
[ Upstream commit c95346ac918c5badf51b9a7ac58a26d3bd5bb224 ]
In punch_hole(), when the offset lies in the final block for a given height, there is no hole to punch, but the maximum size check fails to detect that. Consequently, punch_hole() will try to punch a hole beyond the end of the metadata and fail. Fix the maximum size check.
--- fs/gfs2/bmap.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/gfs2/bmap.c +3 -2
@@ -1715,7 +1715,8 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length)struct buffer_head *dibh, *bh;struct gfs2_holder rd_gh;unsigned int bsize_shift = sdp->sd_sb.sb_bsize_shift; -u64 lblock = (offset + (1 << bsize_shift) -1 ) >> bsize_shift; +unsigned int bsize =1 << bsize_shift; +u64 lblock = (offset + bsize -1 ) >> bsize_shift;__u16 start_list[GFS2_MAX_META_HEIGHT ];__u16 __end_list[GFS2_MAX_META_HEIGHT ], *end_list =NULL ;unsigned int start_aligned, end_aligned;
@@ -1726,7 +1727,7 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length)u64 prev_bnr =0 ;__be64 *start, *end; -if (offset >= maxsize) { +if (offset + bsize -1 >= maxsize) {/* * The starting point lies beyond the allocated metadata; * there are no blocks to deallocate.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/301 wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <[email protected]>
[ Upstream commit 774f8841f55d7ac4044c79812691649da203584a ]
Running kernel-doc on ieee80211_i.h flagged the following:net/mac80211/ieee80211_i.h:145: warning: expecting prototype for enum ieee80211_corrupt_data_flags. Prototype was for enum ieee80211_bss_corrupt_data_flags instead net/mac80211/ieee80211_i.h:162: warning: expecting prototype for enum ieee80211_valid_data_flags. Prototype was for enum ieee80211_bss_valid_data_flags instead
Fix these warnings.
--- net/mac80211/ieee80211_i.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/mac80211/ieee80211_i.h +2 -2
@@ -122,7 +122,7 @@ struct ieee80211_bss { };/** -* enum ieee80211_corrupt_data_flags - BSS data corruption flags +* enum ieee80211_bss_corrupt_data_flags - BSS data corruption flags * @IEEE80211_BSS_CORRUPT_BEACON: last beacon frame received was corrupted * @IEEE80211_BSS_CORRUPT_PROBE_RESP: last probe response received was corrupted *
@@ -135,7 +135,7 @@ enum ieee80211_bss_corrupt_data_flags { };/** -* enum ieee80211_valid_data_flags - BSS valid data flags +* enum ieee80211_bss_valid_data_flags - BSS valid data flags * @IEEE80211_BSS_VALID_WMM: WMM/UAPSD data was gathered from non-corrupt IE * @IEEE80211_BSS_VALID_RATES: Supported rates were gathered from non-corrupt IE * @IEEE80211_BSS_VALID_ERP: ERP flag was gathered from non-corrupt IE
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/301 wifi: cfg80211: fix rdev_dump_mpp() arguments order
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Artemiev <[email protected]>
[ Upstream commit ec50f3114e55406a1aad24b7dfaa1c3f4336d8eb ]
Fix the order of arguments in the TP_ARGS macro
for the rdev_dump_mpp tracepoint event.
Found by Linux Verification Center (linuxtesting.org).
--- net/wireless/trace.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/trace.h +1 -1
@@ -1015,7 +1015,7 @@ TRACE_EVENT(rdev_get_mpp, TRACE_EVENT(rdev_dump_mpp, TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, int _idx, u8 *dst, u8 *mpp), - TP_ARGS(wiphy, netdev, _idx, mpp, dst), + TP_ARGS(wiphy, netdev, _idx, dst, mpp), TP_STRUCT__entry( WIPHY_ENTRY NETDEV_ENTRY
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/301 wifi: mac80211: fix prep_connection error path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 2e6bd24339a6ff04413b2e49c0f2672d6f0edfa5 ]
If prep_channel fails in prep_connection, the code releases the deflink's chanctx, which is wrong since we may be using a different link. It's already wrong to even do that always though, since we might still have the station. Remove it only if prep_channel succeeded and later updates fail.
--- net/mac80211/mlme.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/mac80211/mlme.c +3 -2
@@ -7080,7 +7080,7 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,sdata_info (sdata,"failed to insert STA entry for the AP (error %d)\n" , err); - goto out_err; + goto out_release_chan; } }else WARN_ON_ONCE (!ether_addr_equal (link->u.mgd.bssid, cbss->bssid));
@@ -7091,8 +7091,9 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,return 0 ; +out_release_chan: +ieee80211_link_release_channel (link); out_err: -ieee80211_link_release_channel (&sdata->deflink);ieee80211_vif_set_links (sdata,0 ,0 );return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/301 wifi: iwlwifi: read txq->read_ptr under lock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit c2ace6300600c634553657785dfe5ea0ed688ac2 ]
If we read txq->read_ptr without lock, we can read the same value twice, then obtain the lock, and reclaim from there to two different places, but crucially reclaim the same entry twice, resulting in the WARN_ONCE() a little later. Fix that by reading txq->read_ptr under lock.
--- drivers/net/wireless/intel/iwlwifi/queue/tx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/queue/tx.c +1 -1
@@ -1588,9 +1588,9 @@ void iwl_txq_reclaim(struct iwl_trans *trans, int txq_id, int ssn,return ; tfd_num =iwl_txq_get_cmd_index (txq, ssn); - read_ptr =iwl_txq_get_cmd_index (txq, txq->read_ptr);spin_lock_bh (&txq->lock); + read_ptr =iwl_txq_get_cmd_index (txq, txq->read_ptr);if (!test_bit (txq_id, trans->txqs.queue_used)) { IWL_DEBUG_TX_QUEUES(trans, "Q %d inactive - ignoring idx %d\n",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/301 wifi: iwlwifi: mvm: guard against invalid STA ID on removal
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit 17f64517bf5c26af56b6c3566273aad6646c3c4f ]
Guard against invalid station IDs in iwl_mvm_mld_rm_sta_id as that would result in out-of-bounds array accesses. This prevents issues should the driver get into a bad state during error handling.
--- drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c +6 -1
@@ -853,10 +853,15 @@ int iwl_mvm_mld_rm_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif,int iwl_mvm_mld_rm_sta_id (struct iwl_mvm *mvm,u8 sta_id) { -int ret =iwl_mvm_mld_rm_sta_from_fw (mvm, sta_id); +int ret;lockdep_assert_held (&mvm->mutex); +if (WARN_ON (sta_id ==IWL_MVM_INVALID_STA )) +return 0 ; + + ret =iwl_mvm_mld_rm_sta_from_fw (mvm, sta_id); +RCU_INIT_POINTER (mvm->fw_id_to_mac_id[sta_id],NULL );RCU_INIT_POINTER (mvm->fw_id_to_link_sta[sta_id],NULL );return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/301 net: mark racy access on sk->sk_rcvbuf
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: linke li <[email protected]>
[ Upstream commit c2deb2e971f5d9aca941ef13ee05566979e337a4 ]
sk->sk_rcvbuf in __sock_queue_rcv_skb() and __sk_receive_skb() can be changed by other threads. Mark this as benign using READ_ONCE().
This patch is aimed at reducing the number of benign races reported by KCSAN in order to focus future debugging effort on harmful races.
--- net/core/sock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/core/sock.c +2 -2
@@ -486,7 +486,7 @@ int __sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)unsigned long flags;struct sk_buff_head *list = &sk->sk_receive_queue; -if (atomic_read (&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) { +if (atomic_read (&sk->sk_rmem_alloc) >=READ_ONCE (sk->sk_rcvbuf)) {atomic_inc (&sk->sk_drops);trace_sock_rcvqueue_full (sk, skb);return -ENOMEM ;
@@ -556,7 +556,7 @@ int __sk_receive_skb(struct sock *sk, struct sk_buff *skb, skb->dev =NULL ; -if (sk_rcvqueues_full (sk, sk->sk_rcvbuf)) { +if (sk_rcvqueues_full (sk,READ_ONCE (sk->sk_rcvbuf))) {atomic_inc (&sk->sk_drops); goto discard_and_relse; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/301 scsi: mpi3mr: Avoid memcpy field-spanning write WARNING
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shin'ichiro Kawasaki <[email protected]>
[ Upstream commit 429846b4b6ce9853e0d803a2357bb2e55083adf0 ]
When the "storcli2 show" command is executed for eHBA-9600, mpi3mr driver prints this WARNING message:
memcpy: detected field-spanning write (size 128) of single field "bsg_reply_buf->reply_buf" at drivers/scsi/mpi3mr/mpi3mr_app.c:1658 (size 1)
WARNING: CPU: 0 PID: 12760 at drivers/scsi/mpi3mr/mpi3mr_app.c:1658 mpi3mr_bsg_request+0x6b12/0x7f10 [mpi3mr]
The cause of the WARN is 128 bytes memcpy to the 1 byte size array "__u8 replay_buf[1]" in the struct mpi3mr_bsg_in_reply_buf. The array is intended to be a flexible length array, so the WARN is a false positive.
To suppress the WARN, remove the constant number '1' from the array declaration and clarify that it has flexible length. Also, adjust the memory allocation size to match the change.
--- drivers/scsi/mpi3mr/mpi3mr_app.c | 2 +- include/uapi/scsi/scsi_bsg_mpi3mr.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/mpi3mr/mpi3mr_app.c +1 -1
@@ -1345,7 +1345,7 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job, unsigned int *replyif ((mpirep_offset !=0xFF ) && drv_bufs[mpirep_offset].bsg_buf_len) { drv_buf_iter = &drv_bufs[mpirep_offset]; - drv_buf_iter->kern_buf_len = (sizeof (*bsg_reply_buf) -1 + + drv_buf_iter->kern_buf_len = (sizeof (*bsg_reply_buf) + mrioc->reply_sz); bsg_reply_buf =kzalloc (drv_buf_iter->kern_buf_len,GFP_KERNEL );
include/uapi/scsi/scsi_bsg_mpi3mr.h +1 -1
@@ -382,7 +382,7 @@ struct mpi3mr_bsg_in_reply_buf {__u8 mpi_reply_type;__u8 rsvd1;__u16 rsvd2; -__u8 reply_buf[1 ]; +__u8 reply_buf[]; };/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/301 scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saurav Kashyap <[email protected]>
[ Upstream commit c214ed2a4dda35b308b0b28eed804d7ae66401f9 ]
The session resources are used by FW and driver when session is offloaded, once session is uploaded these resources are not used. The lock is not required as these fields won't be used any longer. The offload and upload calls are sequential, hence lock is not required.
This will suppress following BUG_ON():
[ 449.843143] ------------[ cut here ]------------ [ 449.848302] kernel BUG at mm/vmalloc.c:2727! [ 449.853072] invalid opcode: 0000 [#1] PREEMPT SMP PTI [ 449.858712] CPU: 5 PID: 1996 Comm: kworker/u24:2 Not tainted 5.14.0-118.el9.x86_64 #1 Rebooting. [ 449.867454] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.3.4 11/08/2016 [ 449.876966] Workqueue: fc_rport_eq fc_rport_work [libfc] [ 449.882910] RIP: 0010:vunmap+0x2e/0x30 [ 449.887098] Code: 00 65 8b 05 14 a2 f0 4a a9 00 ff ff 00 75 1b 55 48 89 fd e8 34 36 79 00 48 85 ed 74 0b 48 89 ef 31 f6 5d e9 14 fc ff ff 5d c3 <0f> 0b 0f 1f 44 00 00 41 57 41 56 49 89 ce 41 55 49 89 fd 41 54 41 [ 449.908054] RSP: 0018:ffffb83d878b3d68 EFLAGS: 00010206 [ 449.913887] RAX: 0000000080000201 RBX: ffff8f4355133550 RCX: 000000000d400005 [ 449.921843] RDX: 0000000000000001 RSI: 0000000000001000 RDI: ffffb83da53f5000 [ 449.929808] RBP: ffff8f4ac6675800 R08: ffffb83d878b3d30 R09: 00000000000efbdf [ 449.937774] R10: 0000000000000003 R11: ffff8f434573e000 R12: 0000000000001000 [ 449.945736] R13: 0000000000001000 R14: ffffb83da53f5000 R15: ffff8f43d4ea3ae0 [ 449.953701] FS: 0000000000000000(0000) GS:ffff8f529fc80000(0000) knlGS:0000000000000000 [ 449.962732] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 449.969138] CR2: 00007f8cf993e150 CR3: 0000000efbe10003 CR4: 00000000003706e0 [ 449.977102] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 449.985065] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 449.993028] Call Trace: [ 449.995756] __iommu_dma_free+0x96/0x100 [ 450.000139] bnx2fc_free_session_resc+0x67/0x240 [bnx2fc] [ 450.006171] bnx2fc_upload_session+0xce/0x100 [bnx2fc] [ 450.011910] bnx2fc_rport_event_handler+0x9f/0x240 [bnx2fc] [ 450.018136] fc_rport_work+0x103/0x5b0 [libfc] [ 450.023103] process_one_work+0x1e8/0x3c0 [ 450.027581] worker_thread+0x50/0x3b0 [ 450.031669] ? rescuer_thread+0x370/0x370 [ 450.036143] kthread+0x149/0x170 [ 450.039744] ? set_kthread_struct+0x40/0x40 [ 450.044411] ret_from_fork+0x22/0x30 [ 450.048404] Modules linked in: vfat msdos fat xfs nfs_layout_nfsv41_files rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver dm_service_time qedf qed crc8 bnx2fc libfcoe libfc scsi_transport_fc intel_rapl_msr intel_rapl_common x86_pkg_temp_thermal intel_powerclamp dcdbas rapl intel_cstate intel_uncore mei_me pcspkr mei ipmi_ssif lpc_ich ipmi_si fuse zram ext4 mbcache jbd2 loop nfsv3 nfs_acl nfs lockd grace fscache netfs irdma ice sd_mod t10_pi sg ib_uverbs ib_core 8021q garp mrp stp llc mgag200 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt mxm_wmi fb_sys_fops cec crct10dif_pclmul ahci crc32_pclmul bnx2x drm ghash_clmulni_intel libahci rfkill i40e libata megaraid_sas mdio wmi sunrpc lrw dm_crypt dm_round_robin dm_multipath dm_snapshot dm_bufio dm_mirror dm_region_hash dm_log dm_zero dm_mod linear raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx raid6_pq libcrc32c crc32c_intel raid1 raid0 iscsi_ibft squashfs be2iscsi bnx2i cnic uio cxgb4i cxgb4 tls [ 450.048497] libcxgbi libcxgb qla4xxx iscsi_boot_sysfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi edd ipmi_devintf ipmi_msghandler [ 450.159753] ---[ end trace 712de2c57c64abc8 ]---
--- drivers/scsi/bnx2fc/bnx2fc_tgt.c | 2 -- 1 file changed, 2 deletions(-)
drivers/scsi/bnx2fc/bnx2fc_tgt.c +0 -2
@@ -833,7 +833,6 @@ static void bnx2fc_free_session_resc(struct bnx2fc_hba *hba,BNX2FC_TGT_DBG (tgt,"Freeing up session resources\n" ); -spin_lock_bh (&tgt->cq_lock); ctx_base_ptr = tgt->ctx_base; tgt->ctx_base =NULL ;
@@ -889,7 +888,6 @@ static void bnx2fc_free_session_resc(struct bnx2fc_hba *hba, tgt->sq, tgt->sq_dma); tgt->sq =NULL ; } -spin_unlock_bh (&tgt->cq_lock);if (ctx_base_ptr)iounmap (ctx_base_ptr);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/301 btrfs: return accurate error code on open failure in open_fs_devices()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anand Jain <[email protected]>
[ Upstream commit 2f1aeab9fca1a5f583be1add175d1ee95c213cfa ]
When attempting to exclusive open a device which has no exclusive open permission, such as a physical device associated with the flakey dm device, the open operation will fail, resulting in a mount failure.
In this particular scenario, we erroneously return -EINVAL instead of the correct error code provided by the bdev_open_by_path() function, which is -EBUSY.
Fix this, by returning error code from the bdev_open_by_path() function. With this correction, the mount error message will align with that of ext4 and xfs.
--- fs/btrfs/volumes.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
fs/btrfs/volumes.c +12 -5
@@ -1224,23 +1224,30 @@ static int open_fs_devices(struct btrfs_fs_devices *fs_devices,struct btrfs_device *device;struct btrfs_device *latest_dev =NULL ;struct btrfs_device *tmp_device; +int ret =0 ;list_for_each_entry_safe (device, tmp_device, &fs_devices->devices, dev_list) { -int ret; +int ret2; - ret =btrfs_open_one_device (fs_devices, device, flags, holder); -if (ret ==0 && + ret2 =btrfs_open_one_device (fs_devices, device, flags, holder); +if (ret2 ==0 && (!latest_dev || device->generation > latest_dev->generation)) { latest_dev = device; - }else if (ret == -ENODATA ) { + }else if (ret2 == -ENODATA ) { fs_devices->num_devices--;list_del (&device->dev_list);btrfs_free_device (device); } +if (ret ==0 && ret2 !=0 ) + ret = ret2; } -if (fs_devices->open_devices ==0 ) + +if (fs_devices->open_devices ==0 ) { +if (ret) +return ret;return -EINVAL ; + } fs_devices->opened =1 ; fs_devices->latest_dev = latest_dev;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/301 drm/amdkfd: Check cgroup when returning DMABuf info
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukul Joshi <[email protected]>
[ Upstream commit 9d7993a7ab9651afd5fb295a4992e511b2b727aa ]
Check cgroup permissions when returning DMA-buf info and based on cgroup info return the GPU id of the GPU that have access to the BO.
--- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +2 -2
@@ -1516,7 +1516,7 @@ static int kfd_ioctl_get_dmabuf_info(struct file *filep,/* Find a KFD GPU device that supports the get_dmabuf_info query */ for (i =0 ;kfd_topology_enum_kfd_devices (i, &dev) ==0 ; i++) -if (dev) +if (dev && !kfd_devcgroup_check_permission (dev))break ;if (!dev)return -EINVAL ;
@@ -1538,7 +1538,7 @@ static int kfd_ioctl_get_dmabuf_info(struct file *filep,if (xcp_id >=0 ) args->gpu_id = dmabuf_adev->kfd.dev->nodes[xcp_id]->id;else - args->gpu_id = dmabuf_adev->kfd.dev->nodes[0 ]->id; + args->gpu_id = dev->id; args->flags = flags;/* Copy metadata buffer to user mode */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/301 drm/amdkfd: range check cp bad op exception interrupts
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Kim <[email protected]>
[ Upstream commit 0cac183b98d8a8c692c98e8dba37df15a9e9210d ]
Due to a CP interrupt bug, bad packet garbage exception codes are raised. Do a range check so that the debugger and runtime do not receive garbage codes.
Update the user api to guard exception code type checking as well.
--- .../gpu/drm/amd/amdkfd/kfd_int_process_v10.c | 3 ++- .../gpu/drm/amd/amdkfd/kfd_int_process_v11.c | 3 ++- drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c | 3 ++- include/uapi/linux/kfd_ioctl.h | 17 ++++++++++++++--- 4 files changed, 20 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_int_process_v10.c +2 -1
@@ -336,7 +336,8 @@ static void event_interrupt_wq_v10(struct kfd_node *dev,break ; }kfd_signal_event_interrupt (pasid, context_id0 &0x7fffff ,23 ); - }else if (source_id ==SOC15_INTSRC_CP_BAD_OPCODE ) { + }else if (source_id ==SOC15_INTSRC_CP_BAD_OPCODE && +KFD_DBG_EC_TYPE_IS_PACKET (KFD_DEBUG_CP_BAD_OP_ECODE (context_id0))) { kfd_set_dbg_ev_from_interrupt(dev, pasid, KFD_DEBUG_DOORBELL_ID(context_id0), KFD_EC_MASK(KFD_DEBUG_CP_BAD_OP_ECODE(context_id0)),
drivers/gpu/drm/amd/amdkfd/kfd_int_process_v11.c +2 -1
@@ -325,7 +325,8 @@ static void event_interrupt_wq_v11(struct kfd_node *dev,/* CP */ if (source_id ==SOC15_INTSRC_CP_END_OF_PIPE )kfd_signal_event_interrupt (pasid, context_id0,32 ); -else if (source_id ==SOC15_INTSRC_CP_BAD_OPCODE ) +else if (source_id ==SOC15_INTSRC_CP_BAD_OPCODE && +KFD_DBG_EC_TYPE_IS_PACKET (KFD_CTXID0_CP_BAD_OP_ECODE (context_id0))) kfd_set_dbg_ev_from_interrupt(dev, pasid, KFD_CTXID0_DOORBELL_ID(context_id0), KFD_EC_MASK(KFD_CTXID0_CP_BAD_OP_ECODE(context_id0)),
drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c +2 -1
@@ -385,7 +385,8 @@ static void event_interrupt_wq_v9(struct kfd_node *dev,break ; }kfd_signal_event_interrupt (pasid, sq_int_data,24 ); - }else if (source_id ==SOC15_INTSRC_CP_BAD_OPCODE ) { + }else if (source_id ==SOC15_INTSRC_CP_BAD_OPCODE && +KFD_DBG_EC_TYPE_IS_PACKET (KFD_DEBUG_CP_BAD_OP_ECODE (context_id0))) { kfd_set_dbg_ev_from_interrupt(dev, pasid, KFD_DEBUG_DOORBELL_ID(context_id0), KFD_EC_MASK(KFD_DEBUG_CP_BAD_OP_ECODE(context_id0)),
include/uapi/linux/kfd_ioctl.h +14 -3
@@ -909,14 +909,25 @@ enum kfd_dbg_trap_exception_code { KFD_EC_MASK(EC_DEVICE_NEW))#define KFD_EC_MASK_PROCESS (KFD_EC_MASK(EC_PROCESS_RUNTIME) | \ KFD_EC_MASK(EC_PROCESS_DEVICE_REMOVE)) +#define KFD_EC_MASK_PACKET (KFD_EC_MASK(EC_QUEUE_PACKET_DISPATCH_DIM_INVALID) | \ + KFD_EC_MASK(EC_QUEUE_PACKET_DISPATCH_GROUP_SEGMENT_SIZE_INVALID) | \ + KFD_EC_MASK(EC_QUEUE_PACKET_DISPATCH_CODE_INVALID) | \ + KFD_EC_MASK(EC_QUEUE_PACKET_RESERVED) | \ + KFD_EC_MASK(EC_QUEUE_PACKET_UNSUPPORTED) | \ + KFD_EC_MASK(EC_QUEUE_PACKET_DISPATCH_WORK_GROUP_SIZE_INVALID) | \ + KFD_EC_MASK(EC_QUEUE_PACKET_DISPATCH_REGISTER_INVALID) | \ + KFD_EC_MASK(EC_QUEUE_PACKET_VENDOR_UNSUPPORTED))/* Checks for exception code types for KFD search */ +#define KFD_DBG_EC_IS_VALID (ecode) (ecode > EC_NONE && ecode < EC_MAX)#define KFD_DBG_EC_TYPE_IS_QUEUE (ecode) \ - (!!(KFD_EC_MASK(ecode) & KFD_EC_MASK_QUEUE)) + (KFD_DBG_EC_IS_VALID(ecode) && !!(KFD_EC_MASK(ecode) & KFD_EC_MASK_QUEUE))#define KFD_DBG_EC_TYPE_IS_DEVICE (ecode) \ - (!!(KFD_EC_MASK(ecode) & KFD_EC_MASK_DEVICE)) + (KFD_DBG_EC_IS_VALID(ecode) && !!(KFD_EC_MASK(ecode) & KFD_EC_MASK_DEVICE))#define KFD_DBG_EC_TYPE_IS_PROCESS (ecode) \ - (!!(KFD_EC_MASK(ecode) & KFD_EC_MASK_PROCESS)) + (KFD_DBG_EC_IS_VALID(ecode) && !!(KFD_EC_MASK(ecode) & KFD_EC_MASK_PROCESS)) +#define KFD_DBG_EC_TYPE_IS_PACKET (ecode) \ + (KFD_DBG_EC_IS_VALID(ecode) && !!(KFD_EC_MASK(ecode) & KFD_EC_MASK_PACKET))/* Runtime enable states */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/301 bpf: Check bloom filter map value size
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Matei <[email protected]>
[ Upstream commit a8d89feba7e54e691ca7c4efc2a6264fa83f3687 ]
This patch adds a missing check to bloom filter creating, rejecting values above KMALLOC_MAX_SIZE. This brings the bloom map in line with many other map types.
The lack of this protection can cause kernel crashes for value sizes that overflow int's. Such a crash was caught by syzkaller. The next patch adds more guard-rails at a lower level.
--- kernel/bpf/bloom_filter.c | 13 +++++++++++++ .../selftests/bpf/prog_tests/bloom_filter_map.c | 6 ++++++ 2 files changed, 19 insertions(+)
kernel/bpf/bloom_filter.c +13 -0
@@ -80,6 +80,18 @@ static int bloom_map_get_next_key(struct bpf_map *map, void *key, void *next_keyreturn -EOPNOTSUPP ; } +/* Called from syscall */ +static int bloom_map_alloc_check (union bpf_attr *attr) +{ +if (attr->value_size >KMALLOC_MAX_SIZE ) +/* if value_size is bigger, the user space won't be able to +* access the elements. +*/ +return -E2BIG ; + +return 0 ; +} +static struct bpf_map *bloom_map_alloc (union bpf_attr *attr) {u32 bitset_bytes, bitset_mask, nr_hash_funcs, nr_bits;
@@ -191,6 +203,7 @@ static u64 bloom_map_mem_usage(const struct bpf_map *map) BTF_ID_LIST_SINGLE(bpf_bloom_map_btf_ids, struct, bpf_bloom_filter)const struct bpf_map_ops bloom_filter_map_ops = { .map_meta_equal = bpf_map_meta_equal, + .map_alloc_check = bloom_map_alloc_check, .map_alloc = bloom_map_alloc, .map_free = bloom_map_free, .map_get_next_key = bloom_map_get_next_key,
tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c +6 -0
@@ -2,6 +2,7 @@/* Copyright (c) 2021 Facebook */ #include <sys/syscall.h> +#include <limits.h> #include <test_progs.h> #include "bloom_filter_map.skel.h"
@@ -21,6 +22,11 @@ static void test_fail_cases(void)if (!ASSERT_LT (fd,0 ,"bpf_map_create bloom filter invalid value size 0" ))close (fd); +/* Invalid value size: too big */ + fd =bpf_map_create (BPF_MAP_TYPE_BLOOM_FILTER ,NULL ,0 ,INT32_MAX ,100 ,NULL ); +if (!ASSERT_LT (fd,0 ,"bpf_map_create bloom filter invalid value too large" )) +close (fd); +/* Invalid max entries size */ fd =bpf_map_create (BPF_MAP_TYPE_BLOOM_FILTER ,NULL ,0 ,sizeof (value),0 ,NULL );if (!ASSERT_LT (fd,0 ,"bpf_map_create bloom filter invalid max entries size" ))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/301 selftests/ftrace: Fix event filter target_func selection
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
[ Upstream commit 8ecab2e64572f1aecdfc5a8feae748abda6e3347 ]
The event filter function test has been failing in our internal test farm:
| # not ok 33 event filter function - test event filtering on functions
Running the test in verbose mode indicates that this is because the test erroneously determines that kmem_cache_free() is the most common caller of kmem_cache_free():
# # + cut -d: -f3 trace
# # + sed s/call_site=([^+]*)+0x.*/1/
# # + sort
# # + uniq -c
# # + sort
# # + tail -n 1
# # + sed s/^[ 0-9]*//
# # + target_func=kmem_cache_free
... and as kmem_cache_free() doesn't call itself, setting this as the filter function for kmem_cache_free() results in no hits, and consequently the test fails:
# # + grep kmem_cache_free trace
# # + grep kmem_cache_free
# # + wc -l
# # + hitcnt=0
# # + grep kmem_cache_free trace
# # + grep -v kmem_cache_free
# # + wc -l
# # + misscnt=0
# # + [ 0 -eq 0 ]
# # + exit_fail
This seems to be because the system in question has tasks with ':' in their name (which a number of kernel worker threads have). These show up in the trace, e.g.
test:.sh-1299 [004] ..... 2886.040608: kmem_cache_free: call_site=putname+0xa4/0xc8 ptr=000000000f4d22f4 name=names_cache
... and so when we try to extact the call_site with:
cut -d: -f3 trace | sed 's/call_site=\([^+]*\)+0x.*/\1/'
... the 'cut' command will extrace the column containing 'kmem_cache_free' rather than the column containing 'call_site=...', and the 'sed' command will leave this unchanged. Consequently, the test will decide to use 'kmem_cache_free' as the filter function, resulting in the failure seen above.
Fix this by matching the 'call_site=<func>' part specifically to extract the function name.
--- .../selftests/ftrace/test.d/filter/event-filter-function.tc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/ftrace/test.d/filter/event-filter-function.tc +1 -1
@@ -24,7 +24,7 @@ echo 0 > events/enable echo "Get the most frequently calling function" sample_events -target_func=`cut -d: -f3 trace | sed 's/call_site=\([^+]*\)+0x.*/\1/' | sort | uniq -c | sort | tail -n 1 | sed 's/^[ 0-9]*//'` +target_func=`cat trace | grep -o 'call_site=\([^+]*\)' | sed 's/call_site=//' | sort | uniq -c | sort | tail -n 1 | sed 's/^[ 0-9]*//'` if [ -z "$target_func" ]; then exit_fail fi
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/301 kbuild: Disable KCSAN for autogenerated *.mod.c intermediaries
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
[ Upstream commit 54babdc0343fff2f32dfaafaaa9e42c4db278204 ]
When KCSAN and CONSTRUCTORS are enabled, one can trigger the
"Unpatched return thunk in use. This should not happen!"
catch-all warning.
Usually, when objtool runs on the .o objects, it does generate a section .return_sites which contains all offsets in the objects to the return thunks of the functions present there. Those return thunks then get patched at runtime by the alternatives.
KCSAN and CONSTRUCTORS add this to the object file's .text.startup section:
-------------------
Disassembly of section .text.startup:
...
0000000000000010 <_sub_I_00099_0>:
10: f3 0f 1e fa endbr64
14: e8 00 00 00 00 call 19 <_sub_I_00099_0+0x9>
15: R_X86_64_PLT32 __tsan_init-0x4
19: e9 00 00 00 00 jmp 1e <__UNIQUE_ID___addressable_cryptd_alloc_aead349+0x6>
1a: R_X86_64_PLT32 __x86_return_thunk-0x4-------------------
which, if it is built as a module goes through the intermediary stage of creating a <module>.mod.c file which, when translated, receives a second constructor:
-------------------
Disassembly of section .text.startup:
0000000000000010 <_sub_I_00099_0>:
10: f3 0f 1e fa endbr64
14: e8 00 00 00 00 call 19 <_sub_I_00099_0+0x9>
15: R_X86_64_PLT32 __tsan_init-0x4
19: e9 00 00 00 00 jmp 1e <_sub_I_00099_0+0xe>
1a: R_X86_64_PLT32 __x86_return_thunk-0x4...
0000000000000030 <_sub_I_00099_0>:
30: f3 0f 1e fa endbr64
34: e8 00 00 00 00 call 39 <_sub_I_00099_0+0x9>
35: R_X86_64_PLT32 __tsan_init-0x4
39: e9 00 00 00 00 jmp 3e <__ksymtab_cryptd_alloc_ahash+0x2>
3a: R_X86_64_PLT32 __x86_return_thunk-0x4-------------------
in the .ko file.
Objtool has run already so that second constructor's return thunk cannot be added to the .return_sites section and thus the return thunk remains unpatched and the warning rightfully fires.
Drop KCSAN flags from the mod.c generation stage as those constructors do not contain data races one would be interested about.
Debugged together with David Kaplan <[email protected]> and Nikolay Borisov <[email protected]>.
--- scripts/Makefile.modfinal | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/Makefile.modfinal +1 -1
@@ -23,7 +23,7 @@ modname = $(notdir $(@:.mod.o=)) part-of-module = y quiet_cmd_cc_o_c = CC [M] $@ - cmd_cc_o_c = $(CC) $(filter-out $(CC_FLAGS_CFI) $(CFLAGS_GCOV), $(c_flags)) -c -o $@ $< + cmd_cc_o_c = $(CC) $(filter-out $(CC_FLAGS_CFI) $(CFLAGS_GCOV) $(CFLAGS_KCSAN), $(c_flags)) -c -o $@ $< %.mod.o: %.mod.c FORCE $(call if_changed_dep,cc_o_c)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/301 ASoC: SOF: Intel: hda-dsp: Skip IMR boot on ACE platforms in case of S3 suspend
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit c61115b37ff964d63191dbf4a058f481daabdf57 ]
SoCs with ACE architecture are tailored to use s2idle instead deep (S3) suspend state and the IMR content is lost when the system is forced to enter even to S3.
When waking up from S3 state the IMR boot will fail as the content is lost. Set the skip_imr_boot flag to make sure that we don't try IMR in this case.
--- sound/soc/sof/intel/hda-dsp.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
sound/soc/sof/intel/hda-dsp.c +15 -5
@@ -681,17 +681,27 @@ static int hda_suspend(struct snd_sof_dev *sdev, bool runtime_suspend)struct sof_intel_hda_dev *hda = sdev->pdata->hw_pdata;const struct sof_intel_dsp_desc *chip = hda->desc;struct hdac_bus *bus =sof_to_bus (sdev); +bool imr_lost = false;int ret, j;/* -* The memory used for IMR boot loses its content in deeper than S3 state -* We must not try IMR boot on next power up (as it will fail). -* +* The memory used for IMR boot loses its content in deeper than S3 +* state on CAVS platforms. +* On ACE platforms due to the system architecture the IMR content is +* lost at S3 state already, they are tailored for s2idle use. +* We must not try IMR boot on next power up in these cases as it will +* fail. +*/ +if (sdev->system_suspend_target >SOF_SUSPEND_S3 || + (chip->hw_ip_version >=SOF_INTEL_ACE_1_0 && + sdev->system_suspend_target ==SOF_SUSPEND_S3 )) + imr_lost = true; + +/* * In case of firmware crash or boot failure set the skip_imr_boot to true * as well in order to try to re-load the firmware to do a 'cold' boot. */ -if (sdev->system_suspend_target >SOF_SUSPEND_S3 || - sdev->fw_state ==SOF_FW_CRASHED || +if (imr_lost || sdev->fw_state ==SOF_FW_CRASHED || sdev->fw_state ==SOF_FW_BOOT_FAILED ) hda->skip_imr_boot = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/301 regulator: tps65132: Add of_match table
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Apitzsch <[email protected]>
[ Upstream commit a469158eaf8f4b10263b417856d923dfa38ae96d ]
Add of_match table for "ti,tps65132" compatible string. This fixes automatic driver loading when using device-tree, and if built as a module like major linux distributions do.
--- drivers/regulator/tps65132-regulator.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/regulator/tps65132-regulator.c +7 -0
@@ -267,10 +267,17 @@ static const struct i2c_device_id tps65132_id[] = { };MODULE_DEVICE_TABLE (i2c, tps65132_id); +static const struct of_device_id __maybe_unused tps65132_of_match[] = { + { .compatible ="ti,tps65132" }, + {}, +}; +MODULE_DEVICE_TABLE (of, tps65132_of_match); +static struct i2c_driver tps65132_i2c_driver = { .driver = { .name ="tps65132" , .probe_type =PROBE_PREFER_ASYNCHRONOUS , + .of_match_table =of_match_ptr (tps65132_of_match), }, .probe = tps65132_probe, .id_table = tps65132_id,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/301 scsi: ufs: core: WLUN suspend dev/link state error recovery
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Wang <[email protected]>
[ Upstream commit 6bc5e70b1c792b31b497e48b4668a9a2909aca0d ]
When wl suspend error occurs, for example BKOP or SSU timeout, the host triggers an error handler and returns -EBUSY to break the wl suspend process. However, it is possible for the runtime PM to enter wl suspend again before the error handler has finished, and return -EINVAL because the device is in an error state. To address this, ensure that the rumtime PM waits for the error handler to finish, or trigger the error handler in such cases, because returning -EINVAL can cause the I/O to hang.
--- drivers/ufs/core/ufshcd.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/ufs/core/ufshcd.c +4 -1
@@ -9547,7 +9547,10 @@ static int __ufshcd_wl_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op)/* UFS device & link must be active before we enter in this function */ if (!ufshcd_is_ufs_dev_active (hba) || !ufshcd_is_link_active (hba)) { - ret = -EINVAL ; +/* Wait err handler finish or trigger err recovery */ +if (!ufshcd_eh_in_progress (hba)) +ufshcd_force_error_recovery (hba); + ret = -EBUSY ; goto enable_scaling; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/301 scsi: libsas: Align SMP request allocation to ARCH_DMA_MINALIGN
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <[email protected]>
[ Upstream commit e675a4fd6d1f8990d3bed5dada3d20edfa000423 ]
This series [1] reduced the kmalloc() minimum alignment on arm64 to 8 bytes (from 128). In libsas, this will cause SMP requests to be 8-byte aligned through kmalloc() allocation. However, for hisi_sas hardware, all command addresses must be 16-byte-aligned. Otherwise, the commands fail to be executed.
ARCH_DMA_MINALIGN represents the minimum (static) alignment for safe DMA operations, so use ARCH_DMA_MINALIGN as the alignment for SMP request.
--- drivers/scsi/libsas/sas_expander.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/libsas/sas_expander.c +1 -1
@@ -135,7 +135,7 @@ static int smp_execute_task(struct domain_device *dev, void *req, int req_size,static inline void *alloc_smp_req (int size) { -u8 *p =kzalloc (size,GFP_KERNEL ); +u8 *p =kzalloc (ALIGN (size,ARCH_DMA_MINALIGN ),GFP_KERNEL );if (p) p[0 ] =SMP_REQUEST ;return p;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/301 scsi: ufs: core: Fix MCQ mode dev command timeout
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Wang <[email protected]>
[ Upstream commit 2a26a11e9c258b14be6fd98f8a85f20ac1fff66e ]
When a dev command times out in MCQ mode, a successfully cleared command should cause a retry. However, because we currently return 0, the caller considers the command a success which causes the following error to be
logged: "Invalid offset 0x0 in descriptor IDN 0x9, length 0x0".
Retry if clearing the command was successful.
--- drivers/ufs/core/ufshcd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/ufs/core/ufshcd.c +3 -1
@@ -3064,7 +3064,9 @@ static int ufshcd_wait_for_dev_cmd(struct ufs_hba *hba,/* MCQ mode */ if (is_mcq_enabled (hba)) { - err =ufshcd_clear_cmd (hba, lrbp->task_tag); +/* successfully cleared the command, retry if needed */ +if (ufshcd_clear_cmd (hba, lrbp->task_tag) ==0 ) + err = -EAGAIN ; hba->dev_cmd.complete =NULL ;return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/301 ALSA: line6: Zero-initialize message buffers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit c4e51e424e2c772ce1836912a8b0b87cd61bc9d5 ]
For shutting up spurious KMSAN uninit-value warnings, just replace kmalloc() calls with kzalloc() for the buffers used for communications. There should be no real issue with the original code, but it's still better to cover.
Message-ID: <[email protected]>
--- sound/usb/line6/driver.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/usb/line6/driver.c +3 -3
@@ -202,7 +202,7 @@ int line6_send_raw_message_async(struct usb_line6 *line6, const char *buffer,struct urb *urb;/* create message: */ - msg =kmalloc (sizeof (struct message ),GFP_ATOMIC ); + msg =kzalloc (sizeof (struct message ),GFP_ATOMIC );if (msg ==NULL )return -ENOMEM ;
@@ -688,7 +688,7 @@ static int line6_init_cap_control(struct usb_line6 *line6)int ret;/* initialize USB buffers: */ - line6->buffer_listen =kmalloc (LINE6_BUFSIZE_LISTEN ,GFP_KERNEL ); + line6->buffer_listen =kzalloc (LINE6_BUFSIZE_LISTEN ,GFP_KERNEL );if (!line6->buffer_listen)return -ENOMEM ;
@@ -697,7 +697,7 @@ static int line6_init_cap_control(struct usb_line6 *line6)return -ENOMEM ;if (line6->properties->capabilities &LINE6_CAP_CONTROL_MIDI ) { - line6->buffer_message =kmalloc (LINE6_MIDI_MESSAGE_MAXLEN ,GFP_KERNEL ); + line6->buffer_message =kzalloc (LINE6_MIDI_MESSAGE_MAXLEN ,GFP_KERNEL );if (!line6->buffer_message)return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/301 block: fix overflow in blk_ioctl_discard()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Nan <[email protected]>
[ Upstream commit 22d24a544b0d49bbcbd61c8c0eaf77d3c9297155 ]
There is no check for overflow of 'start + len' in blk_ioctl_discard(). Hung task occurs if submit an discard ioctl with the following param:
start = 0x80000000000ff000, len = 0x8000000000fff000;
Add the overflow validation now.
--- block/ioctl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
block/ioctl.c +3 -2
@@ -89,7 +89,7 @@ static int blk_ioctl_discard(struct block_device *bdev, blk_mode_t mode, unsigned long arg) {uint64_t range[2 ]; -uint64_t start, len; +uint64_t start, len, end;struct inode *inode = bdev->bd_inode;int err;
@@ -110,7 +110,8 @@ static int blk_ioctl_discard(struct block_device *bdev, blk_mode_t mode,if (len &511 )return -EINVAL ; -if (start + len >bdev_nr_bytes (bdev)) +if (check_add_overflow (start, len, &end) || + end >bdev_nr_bytes (bdev))return -EINVAL ;filemap_invalidate_lock (inode->i_mapping);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/301 net: bcmgenet: Reset RBUF on first open
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Elwell <[email protected]>
[ Upstream commit 0a6380cb4c6b5c1d6dad226ba3130f9090f0ccea ]
If the RBUF logic is not reset when the kernel starts then there may be some data left over from any network boot loader. If the 64-byte packet headers are enabled then this can be fatal.
Extend bcmgenet_dma_disable to do perform the reset, but not when called from bcmgenet_resume in order to preserve a wake packet.
N.B. This different handling of resume is just based on a hunch - why else wouldn't one reset the RBUF as well as the TBUF? If this isn't the case then it's easy to change the patch to make the RBUF reset unconditional.
See: https://github.com/raspberrypi/linux/issues/3850
See: https://github.com/raspberrypi/firmware/issues/1882
--- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/net/ethernet/broadcom/genet/bcmgenet.c +12 -4
@@ -3299,7 +3299,7 @@ static void bcmgenet_get_hw_addr(struct bcmgenet_priv *priv, }/* Returns a reusable dma control register value */ -static u32 bcmgenet_dma_disable (struct bcmgenet_priv *priv) +static u32 bcmgenet_dma_disable (struct bcmgenet_priv *priv,bool flush_rx) {unsigned int i;u32 reg;
@@ -3324,6 +3324,14 @@ static u32 bcmgenet_dma_disable(struct bcmgenet_priv *priv)udelay (10 );bcmgenet_umac_writel (priv,0 ,UMAC_TX_FLUSH ); +if (flush_rx) { + reg =bcmgenet_rbuf_ctrl_get (priv); +bcmgenet_rbuf_ctrl_set (priv, reg |BIT (0 )); +udelay (10 ); +bcmgenet_rbuf_ctrl_set (priv, reg); +udelay (10 ); + } +return dma_ctrl; }
@@ -3387,8 +3395,8 @@ static int bcmgenet_open(struct net_device *dev)bcmgenet_set_hw_addr (priv, dev->dev_addr); -/* Disable RX/TX DMA and flush TX queues */ - dma_ctrl =bcmgenet_dma_disable (priv); +/* Disable RX/TX DMA and flush TX and RX queues */ + dma_ctrl =bcmgenet_dma_disable (priv, true);/* Reinitialize TDMA and RDMA and SW housekeeping */ ret =bcmgenet_init_dma (priv);
@@ -4259,7 +4267,7 @@ static int bcmgenet_resume(struct device *d)bcmgenet_hfb_create_rxnfc_filter (priv, rule);/* Disable RX/TX DMA and flush TX queues */ - dma_ctrl =bcmgenet_dma_disable (priv); + dma_ctrl =bcmgenet_dma_disable (priv, false);/* Reinitialize TDMA and RDMA and SW housekeeping */ ret =bcmgenet_init_dma (priv);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/301 vboxsf: explicitly deny setlease attempts
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit 1ece2c43b88660ddbdf8ecb772e9c41ed9cda3dd ]
vboxsf does not break leases on its own, so it can't properly handle the case where the hypervisor changes the data. Don't allow file leases on vboxsf.
--- fs/vboxsf/file.c | 1 + 1 file changed, 1 insertion(+)
fs/vboxsf/file.c +1 -0
@@ -218,6 +218,7 @@ const struct file_operations vboxsf_reg_fops = { .release = vboxsf_file_release, .fsync = noop_fsync, .splice_read = filemap_splice_read, + .setlease = simple_nosetlease, };const struct inode_operations vboxsf_reg_iops = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/301 ata: sata_gemini: Check clk_enable() result
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit e85006ae7430aef780cc4f0849692e266a102ec0 ]
The call to clk_enable() in gemini_sata_start_bridge() can fail. Add a check to detect such failure.
--- drivers/ata/sata_gemini.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/ata/sata_gemini.c +4 -1
@@ -200,7 +200,10 @@ int gemini_sata_start_bridge(struct sata_gemini *sg, unsigned int bridge) pclk = sg->sata0_pclk; else pclk = sg->sata1_pclk; -clk_enable (pclk); + ret =clk_enable (pclk); +if (ret) +return ret; +msleep (10 );/* Do not keep clocking a bridge that is not online */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/301 firewire: ohci: mask bus reset interrupts between ISR and bottom half
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Goldman <[email protected]>
[ Upstream commit 752e3c53de0fa3b7d817a83050b6699b8e9c6ec9 ]
In the FireWire OHCI interrupt handler, if a bus reset interrupt has occurred, mask bus reset interrupts until bus_reset_work has serviced and cleared the interrupt.
Normally, we always leave bus reset interrupts masked. We infer the bus reset from the self-ID interrupt that happens shortly thereafter. A scenario where we unmask bus reset interrupts was introduced in 2008 in a007bb857e0b26f5d8b73c2ff90782d9c0972620: If OHCI_PARAM_DEBUG_BUSRESETS (8) is set in the debug parameter bitmask, we will unmask bus reset interrupts so we can log them.
irq_handler logs the bus reset interrupt. However, we can't clear the bus reset event flag in irq_handler, because we won't service the event until later. irq_handler exits with the event flag still set. If the corresponding interrupt is still unmasked, the first bus reset will usually freeze the system due to irq_handler being called again each time it exits. This freeze can be reproduced by loading firewire_ohci with "modprobe firewire_ohci debug=-1" (to enable all debugging output). Apparently there are also some cases where bus_reset_work will get called soon enough to clear the event, and operation will continue normally.
This freeze was first reported a few months after a007bb85 was committed, but until now it was never fixed. The debug level could safely be set to -1 through sysfs after the module was loaded, but this would be ineffectual in logging bus reset interrupts since they were only unmasked during initialization.
irq_handler will now leave the event flag set but mask bus reset interrupts, so irq_handler won't be called again and there will be no freeze. If OHCI_PARAM_DEBUG_BUSRESETS is enabled, bus_reset_work will unmask the interrupt after servicing the event, so future interrupts will be caught as desired.
As a side effect to this change, OHCI_PARAM_DEBUG_BUSRESETS can now be enabled through sysfs in addition to during initial module loading. However, when enabled through sysfs, logging of bus reset interrupts will be effective only starting with the second bus reset, after bus_reset_work has executed.
--- drivers/firewire/ohci.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/firewire/ohci.c +5 -1
@@ -2060,6 +2060,8 @@ static void bus_reset_work(struct work_struct *work) ohci->generation = generation;reg_write (ohci, OHCI1394_IntEventClear, OHCI1394_busReset); +if (param_debug &OHCI_PARAM_DEBUG_BUSRESETS ) +reg_write (ohci, OHCI1394_IntMaskSet, OHCI1394_busReset);if (ohci->quirks &QUIRK_RESET_PACKET ) ohci->request_generation = generation;
@@ -2125,12 +2127,14 @@ static irqreturn_t irq_handler(int irq, void *data)return IRQ_NONE ;/* -* busReset and postedWriteErr must not be cleared yet +* busReset and postedWriteErr events must not be cleared yet * (OHCI 1.1 clauses 7.2.3.2 and 13.2.8.1) */ reg_write (ohci, OHCI1394_IntEventClear, event & ~(OHCI1394_busReset | OHCI1394_postedWriteErr));log_irqs (ohci, event); +if (event & OHCI1394_busReset) +reg_write (ohci, OHCI1394_IntMaskClear, OHCI1394_busReset);if (event & OHCI1394_selfIDComplete)queue_work (selfid_workqueue, &ohci->bus_reset_work);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/301 tools/power turbostat: Fix added raw MSR output
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doug Smythies <[email protected]>
[ Upstream commit e5f4e68eed85fa8495d78cd966eecc2b27bb9e53 ]
When using --Summary mode, added MSRs in raw mode always print zeros. Print the actual register contents.
Example, with patch:
note the added column:
--add msr0x64f,u32,package,raw,REASON
Where:
0x64F is MSR_CORE_PERF_LIMIT_REASONS
Busy% Bzy_MHz PkgTmp PkgWatt CorWatt REASON 0.00 4800 35 1.42 0.76 0x00000000 0.00 4801 34 1.42 0.76 0x00000000 80.08 4531 66 108.17 107.52 0x08000000 98.69 4530 66 133.21 132.54 0x08000000 99.28 4505 66 128.26 127.60 0x0c000400 99.65 4486 68 124.91 124.25 0x0c000400 99.63 4483 68 124.90 124.25 0x0c000400 79.34 4481 41 99.80 99.13 0x0c000000 0.00 4801 41 1.40 0.73 0x0c000000
Where, for the test processor (i5-10600K):
PKG Limit #1: 125.000 Watts, 8.000000 sec
MSR bit 26 = log; bit 10 = status
PKG Limit #2: 136.000 Watts, 0.002441 sec
MSR bit 27 = log; bit 11 = status
Example, without patch:
Busy% Bzy_MHz PkgTmp PkgWatt CorWatt REASON 0.01 4800 35 1.43 0.77 0x00000000 0.00 4801 35 1.39 0.73 0x00000000 83.49 4531 66 112.71 112.06 0x00000000 98.69 4530 68 133.35 132.69 0x00000000 99.31 4500 67 127.96 127.30 0x00000000 99.63 4483 69 124.91 124.25 0x00000000 99.61 4481 69 124.90 124.25 0x00000000 99.61 4481 71 124.92 124.25 0x00000000 59.35 4479 42 75.03 74.37 0x00000000 0.00 4800 42 1.39 0.73 0x00000000 0.00 4801 42 1.42 0.76 0x00000000
c000000
[lenb: simplified patch to apply only to package scope]
--- tools/power/x86/turbostat/turbostat.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
tools/power/x86/turbostat/turbostat.c +4 -3
@@ -1811,9 +1811,10 @@ int sum_counters(struct thread_data *t, struct core_data *c, struct pkg_data *p) average.packages.rapl_dram_perf_status += p->rapl_dram_perf_status;for (i =0 , mp = sys.pp; mp; i++, mp = mp->next) { -if (mp->format ==FORMAT_RAW ) -continue ; - average.packages.counter[i] += p->counter[i]; +if ((mp->format ==FORMAT_RAW ) && (topo.num_packages ==0 )) + average.packages.counter[i] = p->counter[i]; +else + average.packages.counter[i] += p->counter[i]; }return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/301 tools/power turbostat: Increase the limit for fd opened
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wyes Karny <[email protected]>
[ Upstream commit 3ac1d14d0583a2de75d49a5234d767e2590384dd ]
When running turbostat, a system with 512 cpus reaches the limit for maximum number of file descriptors that can be opened. To solve this problem, the limit is raised to 2^15, which is a large enough number.
Below data is collected from AMD server systems while running turbostat:
|-----------+-------------------------------| | # of cpus | # of opened fds for turbostat | |-----------+-------------------------------| | 128 | 260 | |-----------+-------------------------------| | 192 | 388 | |-----------+-------------------------------| | 512 | 1028 | |-----------+-------------------------------|
So, the new max limit would be sufficient up to 2^14 cpus (but this also depends on how many counters are enabled).
--- tools/power/x86/turbostat/turbostat.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
tools/power/x86/turbostat/turbostat.c +21 -0
@@ -53,6 +53,8 @@#define NAME_BYTES 20#define PATH_BYTES 128 +#define MAX_NOFILE 0x8000 +enum counter_scope {SCOPE_CPU ,SCOPE_CORE ,SCOPE_PACKAGE };enum counter_type {COUNTER_ITEMS ,COUNTER_CYCLES ,COUNTER_SECONDS ,COUNTER_USEC };enum counter_format {FORMAT_RAW ,FORMAT_DELTA ,FORMAT_PERCENT };
@@ -6719,6 +6721,22 @@ void cmdline(int argc, char **argv) } } +void set_rlimit (void ) +{ +struct rlimit limit; + +if (getrlimit (RLIMIT_NOFILE , &limit) <0 ) +err (1 ,"Failed to get rlimit" ); + +if (limit.rlim_max <MAX_NOFILE ) + limit.rlim_max =MAX_NOFILE ; +if (limit.rlim_cur <MAX_NOFILE ) + limit.rlim_cur =MAX_NOFILE ; + +if (setrlimit (RLIMIT_NOFILE , &limit) <0 ) +err (1 ,"Failed to set rlimit" ); +} +int main (int argc,char **argv) { outf = stderr;
@@ -6731,6 +6749,9 @@ int main(int argc, char **argv)probe_sysfs (); +if (!getuid ()) +set_rlimit (); +turbostat_init ();msr_sum_record ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/301 tools/power turbostat: Fix Bzy_MHz documentation typo
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Liu <[email protected]>
[ Upstream commit 0b13410b52c4636aacb6964a4253a797c0fa0d16 ]
The code calculates Bzy_MHz by multiplying TSC_delta * APERF_delta/MPERF_delta The man page erroneously showed that TSC_delta was divided.
--- tools/power/x86/turbostat/turbostat.8 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/power/x86/turbostat/turbostat.8 +1 -1
@@ -370,7 +370,7 @@ below the processor's base frequency. Busy% = MPERF_delta/TSC_delta -Bzy_MHz = TSC_delta/APERF_delta/MPERF_delta/measurement_interval +Bzy_MHz = TSC_delta*APERF_delta/MPERF_delta/measurement_interval Note that these calculations depend on TSC_delta, so they are not reliable during intervals when TSC_MHz is not running at the base frequency.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/301 tools/power turbostat: Print ucode revision only if valid
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patryk Wlazlyn <[email protected]>
[ Upstream commit fb5ceca046efc84f69fcf9779a013f8a0e63bbff ]
If the MSR read were to fail, turbostat would print "microcode 0x0"
--- tools/power/x86/turbostat/turbostat.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
tools/power/x86/turbostat/turbostat.c +9 -3
@@ -5518,6 +5518,7 @@ void process_cpuid()unsigned int eax, ebx, ecx, edx;unsigned int fms, family, model, stepping, ecx_flags, edx_flags;unsigned long long ucode_patch =0 ; +bool ucode_patch_valid = false; eax = ebx = ecx = edx =0 ;
@@ -5547,6 +5548,8 @@ void process_cpuid()if (get_msr (sched_getcpu (),MSR_IA32_UCODE_REV , &ucode_patch))warnx ("get_msr(UCODE)" ); +else + ucode_patch_valid = true;/* * check max extended function levels of CPUID.
@@ -5557,9 +5560,12 @@ void process_cpuid()__cpuid (0x80000000 , max_extended_level, ebx, ecx, edx);if (!quiet) { -fprintf (outf,"CPUID(1): family:model:stepping 0x%x:%x:%x (%d:%d:%d) microcode 0x%x\n" , - family, model, stepping, family, model, stepping, - (unsigned int )((ucode_patch >>32 ) &0xFFFFFFFF )); +fprintf (outf,"CPUID(1): family:model:stepping 0x%x:%x:%x (%d:%d:%d)" , + family, model, stepping, family, model, stepping); +if (ucode_patch_valid) +fprintf (outf," microcode 0x%x" , (unsigned int )((ucode_patch >>32 ) &0xFFFFFFFF )); +fputc ('\n' , outf); +fprintf (outf,"CPUID(0x80000000): max_extended_levels: 0x%x\n" , max_extended_level); fprintf(outf, "CPUID(1): %s %s %s %s %s %s %s %s %s %s\n", ecx_flags & (1 << 0) ? "SSE3" : "-",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/301 tools/power turbostat: Fix warning upon failed /dev/cpu_dma_latency read
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Len Brown <[email protected]>
[ Upstream commit b6fe938317eed58e8c687bd5965a956e15fb5828 ]
Previously a failed read of /dev/cpu_dma_latency erroneously complained
turbostat: capget(CAP_SYS_ADMIN) failed, try "# setcap cap_sys_admin=ep ./turbostat
This went unnoticed because this file is typically visible to root, and turbostat was typically run as root.
Going forward, when a non-root user can run turbostat... Complain about failed read access to this file only if --debug is used.
--- tools/power/x86/turbostat/turbostat.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/power/x86/turbostat/turbostat.c +2 -1
@@ -5479,7 +5479,8 @@ void print_dev_latency(void) fd =open (path,O_RDONLY );if (fd <0 ) { -warnx ("capget(CAP_SYS_ADMIN) failed, try \"# setcap cap_sys_admin=ep %s\"" , progname); +if (debug) +warnx ("Read %s failed" , path);return ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/301 btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
[ Upstream commit 3c6f0c5ecc8910d4ffb0dfe85609ebc0c91c8f34 ]
Currently, this call site in btrfs_clear_delalloc_extent() only converts the reservation. We are marking it not delalloc, so I don't think it makes sense to keep the rsv around. This is a path where we are not sure to join a transaction, so it leads to incorrect free-ing during umount.
Helps with the pass rate of generic/269 and generic/475.
--- fs/btrfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/inode.c +1 -1
@@ -2510,7 +2510,7 @@ void btrfs_clear_delalloc_extent(struct btrfs_inode *inode,*/ if (bits &EXTENT_CLEAR_META_RESV && root != fs_info->tree_root) -btrfs_delalloc_release_metadata (inode, len, false); +btrfs_delalloc_release_metadata (inode, len, true);/* For sanity tests. */ if (btrfs_is_testing (fs_info))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/301 btrfs: always clear PERTRANS metadata during commit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
[ Upstream commit 6e68de0bb0ed59e0554a0c15ede7308c47351e2d ]
It is possible to clear a root's IN_TRANS tag from the radix tree, but not clear its PERTRANS, if there is some error in between. Eliminate that possibility by moving the free up to where we clear the tag.
--- fs/btrfs/transaction.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/transaction.c +1 -1
@@ -1449,6 +1449,7 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans)radix_tree_tag_clear (&fs_info->fs_roots_radix, (unsigned long )root->root_key.objectid,BTRFS_ROOT_TRANS_TAG ); +btrfs_qgroup_free_meta_all_pertrans (root);spin_unlock (&fs_info->fs_roots_radix_lock);btrfs_free_log (trans, root);
@@ -1473,7 +1474,6 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans)if (ret2)return ret2;spin_lock (&fs_info->fs_roots_radix_lock); -btrfs_qgroup_free_meta_all_pertrans (root); } }spin_unlock (&fs_info->fs_roots_radix_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/301 memblock tests: fix undefined reference to `early_pfn_to_nid
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yang <[email protected]>
[ Upstream commit 7d8ed162e6a92268d4b2b84d364a931216102c8e ]
commit 6a9531c3a880 ("memblock: fix crash when reserved memory is not added to memory") introduce the usage of early_pfn_to_nid, which is not defined in memblock tests.
The original definition of early_pfn_to_nid is defined in mm.h, so let add this in the corresponding mm.h.
--- tools/include/linux/mm.h | 5 +++++ 1 file changed, 5 insertions(+)
tools/include/linux/mm.h +5 -0
@@ -37,4 +37,9 @@ static inline void totalram_pages_add(long count) { } +static inline int early_pfn_to_nid (unsigned long pfn) +{ +return 0 ; +} +#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/301 memblock tests: fix undefined reference to `panic
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yang <[email protected]>
[ Upstream commit e0f5a8e74be88f2476e58b25d3b49a9521bdc4ec ]
commit e96c6b8f212a ("memblock: report failures when memblock_can_resize is not set") introduced the usage of panic, which is not defined in memblock test.
Let's define it directly in panic.h to fix it.
--- tools/include/linux/kernel.h | 1 + tools/include/linux/panic.h | 19 +++++++++++++++++++ 2 files changed, 20 insertions(+) create mode 100644 tools/include/linux/panic.h
tools/include/linux/kernel.h +1 -0
@@ -8,6 +8,7 @@#include <linux/build_bug.h> #include <linux/compiler.h> #include <linux/math.h> +#include <linux/panic.h> #include <endian.h> #include <byteswap.h>
tools/include/linux/panic.h new file +19 -0
@@ -0,0 +1,19 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _TOOLS_LINUX_PANIC_H +#define _TOOLS_LINUX_PANIC_H + +#include <stdarg.h> +#include <stdio.h> +#include <stdlib.h> + +static inline void panic (const char *fmt, ...) +{ +va_list argp; + +va_start (argp, fmt); +vfprintf (stderr, fmt, argp); +va_end (argp); +exit (-1 ); +} + +#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/301 memblock tests: fix undefined reference to `BIT
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yang <[email protected]>
[ Upstream commit 592447f6cb3c20d606d6c5d8e6af68e99707b786 ]
commit 772dd0342727 ("mm: enumerate all gfp flags") define gfp flags with the help of BIT, while gfp_types.h doesn't include header file for the definition. This through an error on building memblock tests.
Let's include linux/bits.h to fix it.
--- include/linux/gfp_types.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/gfp_types.h +2 -0
@@ -2,6 +2,8 @@#ifndef __LINUX_GFP_TYPES_H#define __LINUX_GFP_TYPES_H +#include <linux/bits.h> +/* The typedef is in types.h but we want the documentation here */ #if 0 /**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 139/301 scsi: target: Fix SELinux error when systemd-modules loads the target module
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <[email protected]>
[ Upstream commit 97a54ef596c3fd24ec2b227ba8aaf2cf5415e779 ]
If the systemd-modules service loads the target module, the credentials of that userspace process will be used to validate the access to the target db directory. SELinux will prevent it, reporting an error like the following:
kernel: audit: type=1400 audit(1676301082.205:4): avc: denied { read } for pid=1020 comm="systemd-modules" name="target" dev="dm-3" ino=4657583 scontext=system_u:system_r:systemd_modules_load_t:s0 tcontext=system_u:object_r:targetd_etc_rw_t:s0 tclass=dir permissive=0
Fix the error by using the kernel credentials to access the db directory
--- drivers/target/target_core_configfs.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/target/target_core_configfs.c +12 -0
@@ -3634,6 +3634,8 @@ static int __init target_core_init_configfs(void) {struct configfs_subsystem *subsys = &target_core_fabrics;struct t10_alua_lu_gp *lu_gp; +struct cred *kern_cred; +const struct cred *old_cred;int ret; pr_debug("TARGET_CORE[0]: Loading Generic Kernel Storage"
@@ -3710,11 +3712,21 @@ static int __init target_core_init_configfs(void)if (ret <0 ) goto out; +/* We use the kernel credentials to access the target directory */ + kern_cred =prepare_kernel_cred (&init_task); +if (!kern_cred) { + ret = -ENOMEM ; + goto out; + } + old_cred =override_creds (kern_cred);target_init_dbroot (); +revert_creds (old_cred); +put_cred (kern_cred);return 0 ; out: +target_xcopy_release_pt ();configfs_unregister_subsystem (subsys);core_dev_release_virtual_lun0 ();rd_module_exit ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 140/301 scsi: hisi_sas: Handle the NCQ error returned by D2H frame
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Chen <[email protected]>
[ Upstream commit 358e919a351f2ea4b412e7dac6b1c23ec10bd4f5 ]
We find that some disks use D2H frame instead of SDB frame to return NCQ error. Currently, only the I/O corresponding to the D2H frame is processed in this scenario, which does not meet the processing requirements of the NCQ error scenario. So we set dev_status to HISI_SAS_DEV_NCQ_ERR and abort all I/Os of the disk in this scenario.
--- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +9 -1
@@ -2245,7 +2245,15 @@ slot_err_v3_hw(struct hisi_hba *hisi_hba, struct sas_task *task,case SAS_PROTOCOL_SATA |SAS_PROTOCOL_STP :if ((dw0 &CMPLT_HDR_RSPNS_XFRD_MSK ) && (sipc_rx_err_type &RX_FIS_STATUS_ERR_MSK )) { - ts->stat =SAS_PROTO_RESPONSE ; +if (task->ata_task.use_ncq) { +struct domain_device *device = task->dev; +struct hisi_sas_device *sas_dev = device->lldd_dev; + + sas_dev->dev_status =HISI_SAS_DEV_NCQ_ERR ; + slot->abort =1 ; + }else { + ts->stat =SAS_PROTO_RESPONSE ; + } }else if (dma_rx_err_type &RX_DATA_LEN_UNDERFLOW_MSK ) { ts->residual = trans_tx_fail_type; ts->stat =SAS_DATA_UNDERRUN ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 141/301 blk-iocost: avoid out of bounds shift
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <[email protected]>
[ Upstream commit beaa51b36012fad5a4d3c18b88a617aea7a9b96d ]
UBSAN catches undefined behavior in blk-iocost, where sometimes iocg->delay is shifted right by a number that is too large, resulting in undefined behavior on some architectures.
[ 186.556576] ------------[ cut here ]------------ UBSAN: shift-out-of-bounds in block/blk-iocost.c:1366:23 shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long') CPU: 16 PID: 0 Comm: swapper/16 Tainted: G S E N 6.9.0-0_fbk700_debug_rc2_kbuilder_0_gc85af715cac0 #1 Hardware name: Quanta Twin Lakes MP/Twin Lakes Passive MP, BIOS F09_3A23 12/08/2020 Call Trace: <IRQ> dump_stack_lvl+0x8f/0xe0 __ubsan_handle_shift_out_of_bounds+0x22c/0x280 iocg_kick_delay+0x30b/0x310 ioc_timer_fn+0x2fb/0x1f80 __run_timer_base+0x1b6/0x250
...
Avoid that undefined behavior by simply taking the "delay = 0" branch if the shift is too large.
I am not sure what the symptoms of an undefined value delay will be, but I suspect it could be more than a little annoying to debug.
--- block/blk-iocost.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
block/blk-iocost.c +4 -3
@@ -1347,7 +1347,7 @@ static bool iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now) {struct ioc *ioc = iocg->ioc;struct blkcg_gq *blkg =iocg_to_blkg (iocg); -u64 tdelta, delay, new_delay; +u64 tdelta, delay, new_delay, shift;s64 vover, vover_pct;u32 hwa;
@@ -1362,8 +1362,9 @@ static bool iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now)/* calculate the current delay in effect - 1/2 every second */ tdelta = now->now - iocg->delay_at; -if (iocg->delay) - delay = iocg->delay >>div64_u64 (tdelta,USEC_PER_SEC ); + shift =div64_u64 (tdelta,USEC_PER_SEC ); +if (iocg->delay && shift <BITS_PER_LONG ) + delay = iocg->delay >> shift;else delay =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 142/301 gpu: host1x: Do not setup DMA for virtual devices
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thierry Reding <[email protected]>
[ Upstream commit 8ab58f6841b19423231c5db3378691ec80c778f8 ]
The host1x devices are virtual compound devices and do not perform DMA accesses themselves, so they do not need to be set up for DMA.
Ideally we would also not need to set up DMA masks for the virtual devices, but we currently still need those for legacy support on old hardware.
--- drivers/gpu/host1x/bus.c | 8 -------- 1 file changed, 8 deletions(-)
drivers/gpu/host1x/bus.c +0 -8
@@ -351,11 +351,6 @@ static int host1x_device_uevent(const struct device *dev,return 0 ; } -static int host1x_dma_configure (struct device *dev) -{ -return of_dma_configure (dev, dev->of_node, true); -} -static const struct dev_pm_ops host1x_device_pm_ops = { .suspend = pm_generic_suspend, .resume = pm_generic_resume,
@@ -369,7 +364,6 @@ struct bus_type host1x_bus_type = { .name = "host1x", .match = host1x_device_match, .uevent = host1x_device_uevent, - .dma_configure = host1x_dma_configure, .pm = &host1x_device_pm_ops, };
@@ -458,8 +452,6 @@ static int host1x_device_add(struct host1x *host1x, device->dev.bus = &host1x_bus_type; device->dev.parent = host1x->dev; -of_dma_configure (&device->dev, host1x->dev->of_node, true); - device->dev.dma_parms = &device->dma_parms;dma_set_max_seg_size (&device->dev,UINT_MAX );
Signature · 1 line
2.43.0